forked from
lass.pds.lassul.us/superconfig
This repository has no description
treewide: nix fmt
author
lassulus
date
(Sep 27, 2024, 6:30 PM CEST)
commit
a2b7bd33
a2b7bd33bca3c7135a5e1e7f53bbdbfc60010a3b
parent
6c358cd7
6c358cd7887d88eb9192ae4e5aca09e128168d67
+4955
-2855
+58
-34
flake.nix
+58
-34
flake.nix
···
52
52
treefmt-nix.inputs.nixpkgs.follows = "nixpkgs";
53
53
};
54
54
55
-
outputs = inputs@{ self, flake-parts, nixpkgs, clan-core, ... }:
56
-
let
57
-
clan = clan-core.lib.buildClan {
58
-
directory = self;
59
-
specialArgs.self = self;
60
-
machines = nixpkgs.lib.mapAttrs (machineName: _: {
55
+
outputs =
56
+
inputs@{
57
+
self,
58
+
flake-parts,
59
+
nixpkgs,
60
+
clan-core,
61
+
...
62
+
}:
63
+
let
64
+
clan = clan-core.lib.buildClan {
65
+
directory = self;
66
+
specialArgs.self = self;
67
+
machines = nixpkgs.lib.mapAttrs (machineName: _: {
61
68
62
-
imports = [
63
-
./machines/${machineName}/physical.nix
64
-
({ config, pkgs, ... }: {
65
-
clan.core.machineName = machineName;
66
-
clan.core.facts.secretStore = "password-store";
67
-
clan.core.facts.secretUploadDirectory = nixpkgs.lib.mkDefault "/etc/secrets";
68
-
clan.networking.targetHost = "root@${machineName}";
69
-
krebs.secret.directory = config.clanCore.facts.secretUploadDirectory;
70
-
nixpkgs.overlays = [
71
-
self.inputs.stockholm.overlays.default
72
-
(import (self.inputs.stockholm.inputs.nix-writers + "/pkgs")) # TODO get rid of that overlay
73
-
];
74
-
})
75
-
./2configs
76
-
./3modules
77
-
self.inputs.stockholm.nixosModules.krebs
78
-
];
79
-
}) (builtins.readDir ./machines);
80
-
};
81
-
in
69
+
imports = [
70
+
./machines/${machineName}/physical.nix
71
+
(
72
+
{ config, ... }:
73
+
{
74
+
clan.core.machineName = machineName;
75
+
clan.core.facts.secretStore = "password-store";
76
+
clan.core.facts.secretUploadDirectory = nixpkgs.lib.mkDefault "/etc/secrets";
77
+
clan.networking.targetHost = "root@${machineName}";
78
+
krebs.secret.directory = config.clanCore.facts.secretUploadDirectory;
79
+
nixpkgs.overlays = [
80
+
self.inputs.stockholm.overlays.default
81
+
(import (self.inputs.stockholm.inputs.nix-writers + "/pkgs")) # TODO get rid of that overlay
82
+
];
83
+
}
84
+
)
85
+
./2configs
86
+
./3modules
87
+
self.inputs.stockholm.nixosModules.krebs
88
+
];
89
+
}) (builtins.readDir ./machines);
90
+
};
91
+
in
82
92
flake-parts.lib.mkFlake { inherit inputs; } {
83
-
systems = [ "x86_64-linux" "aarch64-linux" "aarch64-darwin" "x86_64-darwin" ];
93
+
systems = [
94
+
"x86_64-linux"
95
+
"aarch64-linux"
96
+
"aarch64-darwin"
97
+
"x86_64-darwin"
98
+
];
84
99
imports = [
85
100
./tools/nvim.nix
86
101
./tools/astronvim/flake-module.nix
···
90
105
];
91
106
flake.nixosConfigurations = clan.nixosConfigurations;
92
107
flake.clanInternals = clan.clanInternals;
93
-
perSystem = { config, lib, pkgs, system, ... }: {
94
-
packages = lib.mapAttrs (name: v_: pkgs.callPackage ./5pkgs/${name} {}) (builtins.readDir ./5pkgs);
95
-
devShells.default = pkgs.mkShell {
96
-
packages = [
97
-
clan-core.packages.${system}.clan-cli
98
-
];
108
+
perSystem =
109
+
{
110
+
lib,
111
+
pkgs,
112
+
system,
113
+
...
114
+
}:
115
+
{
116
+
packages = lib.mapAttrs (name: _v_: pkgs.callPackage ./5pkgs/${name} { }) (
117
+
builtins.readDir ./5pkgs
118
+
);
119
+
devShells.default = pkgs.mkShell {
120
+
packages = [
121
+
clan-core.packages.${system}.clan-cli
122
+
];
123
+
};
99
124
};
100
-
};
101
125
flake.darwinConfigurations.barnacle = inputs.nix-darwin.lib.darwinSystem {
102
126
modules = [ ./darwin/barnacle/config.nix ];
103
127
};
+78
-17
2configs/AP.nix
+78
-17
2configs/AP.nix
···
1
-
{ config, pkgs, ... }:
1
+
{ pkgs, ... }:
2
2
let
3
3
wifi = "wlp0s29u1u2";
4
-
in {
4
+
in
5
+
{
5
6
boot.extraModulePackages = [
6
7
pkgs.linuxPackages.rtl8814au
7
8
];
8
-
networking.networkmanager.unmanaged = [ wifi "et0" ];
9
+
networking.networkmanager.unmanaged = [
10
+
wifi
11
+
"et0"
12
+
];
9
13
10
14
systemd.services.hostapd = {
11
15
description = "hostapd wireless AP";
12
16
path = [ pkgs.hostapd ];
13
17
wantedBy = [ "network.target" ];
14
18
15
-
after = [ "${wifi}-cfg.service" "nat.service" "bind.service" "dhcpd.service" "sys-subsystem-net-devices-${wifi}.device" ];
19
+
after = [
20
+
"${wifi}-cfg.service"
21
+
"nat.service"
22
+
"bind.service"
23
+
"dhcpd.service"
24
+
"sys-subsystem-net-devices-${wifi}.device"
25
+
];
16
26
17
27
serviceConfig = {
18
28
ExecStart = "${pkgs.hostapd}/bin/hostapd ${pkgs.writeText "hostapd.conf" ''
···
43
53
];
44
54
45
55
networking.interfaces.br0.ipv4.addresses = [
46
-
{ address = "10.99.0.1"; prefixLength = 24; }
56
+
{
57
+
address = "10.99.0.1";
58
+
prefixLength = 24;
59
+
}
47
60
];
48
61
services.dhcpd4 = {
49
62
enable = true;
···
60
73
61
74
boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
62
75
krebs.iptables.tables.filter.FORWARD.rules = [
63
-
{ v6 = false; predicate = "-d 10.99.0.0/24 -o br0 -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
64
-
{ v6 = false; predicate = "-s 10.99.0.0/24 -i br0"; target = "ACCEPT"; }
65
-
{ v6 = false; predicate = "-i br0 -o br0"; target = "ACCEPT"; }
66
-
{ v6 = false; predicate = "-i br0 -o br0"; target = "ACCEPT"; }
67
-
{ v6 = false; predicate = "-o br0"; target = "REJECT --reject-with icmp-port-unreachable"; }
68
-
{ v6 = false; predicate = "-i br0"; target = "REJECT --reject-with icmp-port-unreachable"; }
76
+
{
77
+
v6 = false;
78
+
predicate = "-d 10.99.0.0/24 -o br0 -m conntrack --ctstate RELATED,ESTABLISHED";
79
+
target = "ACCEPT";
80
+
}
81
+
{
82
+
v6 = false;
83
+
predicate = "-s 10.99.0.0/24 -i br0";
84
+
target = "ACCEPT";
85
+
}
86
+
{
87
+
v6 = false;
88
+
predicate = "-i br0 -o br0";
89
+
target = "ACCEPT";
90
+
}
91
+
{
92
+
v6 = false;
93
+
predicate = "-i br0 -o br0";
94
+
target = "ACCEPT";
95
+
}
96
+
{
97
+
v6 = false;
98
+
predicate = "-o br0";
99
+
target = "REJECT --reject-with icmp-port-unreachable";
100
+
}
101
+
{
102
+
v6 = false;
103
+
predicate = "-i br0";
104
+
target = "REJECT --reject-with icmp-port-unreachable";
105
+
}
69
106
];
70
107
krebs.iptables.tables.nat.PREROUTING.rules = mkBefore [
71
-
{ v6 = false; predicate = "-s 10.99.0.0/24"; target = "ACCEPT"; }
108
+
{
109
+
v6 = false;
110
+
predicate = "-s 10.99.0.0/24";
111
+
target = "ACCEPT";
112
+
}
72
113
];
73
114
krebs.iptables.tables.nat.POSTROUTING.rules = [
74
115
#TODO find out what this is about?
75
-
{ v6 = false; predicate = "-s 10.99.0.0/24 -d 224.0.0.0/24"; target = "RETURN"; }
76
-
{ v6 = false; predicate = "-s 10.99.0.0/24 -d 255.255.255.255"; target = "RETURN"; }
116
+
{
117
+
v6 = false;
118
+
predicate = "-s 10.99.0.0/24 -d 224.0.0.0/24";
119
+
target = "RETURN";
120
+
}
121
+
{
122
+
v6 = false;
123
+
predicate = "-s 10.99.0.0/24 -d 255.255.255.255";
124
+
target = "RETURN";
125
+
}
77
126
78
-
{ v6 = false; predicate = "-s 10.99.0.0/24 ! -d 10.99.0.0/24"; target = "MASQUERADE"; }
79
-
{ v6 = false; predicate = "-s 10.99.0.0/24 ! -d 10.99.0.0/24 -p tcp"; target = "MASQUERADE --to-ports 1024-65535"; }
80
-
{ v6 = false; predicate = "-s 10.99.0.0/24 ! -d 10.99.0.0/24 -p udp"; target = "MASQUERADE --to-ports 1024-65535"; }
127
+
{
128
+
v6 = false;
129
+
predicate = "-s 10.99.0.0/24 ! -d 10.99.0.0/24";
130
+
target = "MASQUERADE";
131
+
}
132
+
{
133
+
v6 = false;
134
+
predicate = "-s 10.99.0.0/24 ! -d 10.99.0.0/24 -p tcp";
135
+
target = "MASQUERADE --to-ports 1024-65535";
136
+
}
137
+
{
138
+
v6 = false;
139
+
predicate = "-s 10.99.0.0/24 ! -d 10.99.0.0/24 -p udp";
140
+
target = "MASQUERADE --to-ports 1024-65535";
141
+
}
81
142
];
82
143
}
+11
-7
2configs/IM.nix
+11
-7
2configs/IM.nix
···
1
-
{ config, lib, pkgs, ... }: let
1
+
{ pkgs, ... }:
2
+
let
2
3
weechat = pkgs.weechat.override {
3
-
configure = { availablePlugins, ... }: {
4
-
scripts = with pkgs.weechatScripts; [
5
-
weechat-matrix
6
-
];
7
-
};
4
+
configure =
5
+
{ ... }:
6
+
{
7
+
scripts = with pkgs.weechatScripts; [
8
+
weechat-matrix
9
+
];
10
+
};
8
11
};
9
12
10
13
tmux = "/run/current-system/sw/bin/tmux";
11
14
12
-
in {
15
+
in
16
+
{
13
17
imports = [
14
18
./bitlbee.nix
15
19
];
+5
-3
2configs/ableton.nix
+5
-3
2configs/ableton.nix
+62
-53
2configs/alacritty.nix
+62
-53
2configs/alacritty.nix
···
1
-
{ config, lib, pkgs, ... }: let
1
+
{ pkgs, ... }:
2
+
let
2
3
3
-
alacritty-cfg = extrVals: pkgs.writers.writeTOML "alacritty.toml" ({
4
-
font = let
5
-
family = "IosevkaTerm Nerd Font";
6
-
in {
7
-
normal = {
8
-
family = family;
9
-
style = "Regular";
10
-
};
11
-
bold = {
12
-
family = family;
13
-
style = "Bold";
14
-
};
15
-
italic = {
16
-
family = family;
17
-
style = "Italic";
18
-
};
19
-
bold_italic = {
20
-
family = family;
21
-
style = "Bold Italic";
22
-
};
23
-
size = 12;
24
-
};
25
-
live_config_reload = true;
26
-
window.dimensions = {
27
-
columns = 80;
28
-
lines = 20;
29
-
};
30
-
env.WINIT_X11_SCALE_FACTOR = "1.0";
31
-
hints.enabled = [
4
+
alacritty-cfg =
5
+
extrVals:
6
+
pkgs.writers.writeTOML "alacritty.toml" (
32
7
{
33
-
regex = ''(mailto:|gemini:|gopher:|https:|http:|news:|file:|git:|ssh:|ftp:)[^\u0000-\u001F\u007F-\u009F<>"\s{-}\^⟨⟩`]+'';
34
-
command = "/run/current-system/sw/bin/xdg-open";
35
-
post_processing = true;
36
-
mouse.enabled = true;
37
-
binding = {
38
-
key = "U";
39
-
mods = "Alt";
8
+
font =
9
+
let
10
+
family = "IosevkaTerm Nerd Font";
11
+
in
12
+
{
13
+
normal = {
14
+
family = family;
15
+
style = "Regular";
16
+
};
17
+
bold = {
18
+
family = family;
19
+
style = "Bold";
20
+
};
21
+
italic = {
22
+
family = family;
23
+
style = "Italic";
24
+
};
25
+
bold_italic = {
26
+
family = family;
27
+
style = "Bold Italic";
28
+
};
29
+
size = 12;
30
+
};
31
+
live_config_reload = true;
32
+
window.dimensions = {
33
+
columns = 80;
34
+
lines = 20;
40
35
};
36
+
env.WINIT_X11_SCALE_FACTOR = "1.0";
37
+
hints.enabled = [
38
+
{
39
+
regex = ''(mailto:|gemini:|gopher:|https:|http:|news:|file:|git:|ssh:|ftp:)[^\u0000-\u001F\u007F-\u009F<>"\s{-}\^⟨⟩`]+'';
40
+
command = "/run/current-system/sw/bin/xdg-open";
41
+
post_processing = true;
42
+
mouse.enabled = true;
43
+
binding = {
44
+
key = "U";
45
+
mods = "Alt";
46
+
};
47
+
}
48
+
];
41
49
}
42
-
];
43
-
} // extrVals);
50
+
// extrVals
51
+
);
44
52
45
53
alacritty = pkgs.symlinkJoin {
46
54
name = "alacritty";
···
53
61
];
54
62
};
55
63
56
-
in {
64
+
in
65
+
{
57
66
environment.etc = {
58
67
"themes/light/alacritty.toml".source = alacritty-cfg {
59
68
colors = {
···
69
78
# Normal colors
70
79
normal = {
71
80
black = "#fbf1c7";
72
-
red = "#cc241d";
73
-
green = "#98971a";
74
-
yellow = "#d79921";
75
-
blue = "#458588";
81
+
red = "#cc241d";
82
+
green = "#98971a";
83
+
yellow = "#d79921";
84
+
blue = "#458588";
76
85
magenta = "#b16286";
77
-
cyan = "#689d6a";
78
-
white = "#7c6f64";
86
+
cyan = "#689d6a";
87
+
white = "#7c6f64";
79
88
};
80
89
81
90
# Bright colors
82
91
bright = {
83
-
black = "#928374";
84
-
red = "#9d0006";
85
-
green = "#79740e";
86
-
yellow = "#b57614";
87
-
blue = "#076678";
92
+
black = "#928374";
93
+
red = "#9d0006";
94
+
green = "#79740e";
95
+
yellow = "#b57614";
96
+
blue = "#076678";
88
97
magenta = "#8f3f71";
89
-
cyan = "#427b58";
90
-
white = "#3c3836";
98
+
cyan = "#427b58";
99
+
white = "#3c3836";
91
100
};
92
101
};
93
102
};
+1
-1
2configs/atuin-server.nix
+1
-1
2configs/atuin-server.nix
+1
-1
2configs/autotether.nix
+1
-1
2configs/autotether.nix
+2
-1
2configs/bitcoin.nix
+2
-1
2configs/bitcoin.nix
+1
-1
2configs/bitlbee.nix
+1
-1
2configs/bitlbee.nix
+21
-25
2configs/blue-host.nix
+21
-25
2configs/blue-host.nix
···
1
-
{ config, lib, pkgs, ... }:
2
-
let
3
-
all_hosts = [
4
-
"icarus"
5
-
"shodan"
6
-
"daedalus"
7
-
"skynet"
8
-
"prism"
9
-
"littleT"
10
-
];
11
-
remote_hosts = lib.filter (h: h != config.networking.hostName) all_hosts;
12
-
13
-
in {
1
+
{
2
+
config,
3
+
lib,
4
+
pkgs,
5
+
...
6
+
}:
7
+
{
14
8
imports = [
15
9
<stockholm/lass/2configs/container-networking.nix>
16
-
{ #hack for already defined
10
+
{
11
+
#hack for already defined
17
12
systemd.services."container@blue".reloadIfChanged = lib.mkForce false;
18
13
systemd.services."container@blue".preStart = ''
19
14
${pkgs.mount}/bin/mount | ${pkgs.gnugrep}/bin/grep -q '^encfs on /var/lib/containers/blue'
···
30
25
'';
31
26
32
27
containers.blue = {
33
-
config = { ... }: {
34
-
environment.systemPackages = [
35
-
pkgs.git
36
-
pkgs.rxvt-unicode-unwrapped.terminfo
37
-
];
38
-
services.openssh.enable = true;
39
-
users.users.root.openssh.authorizedKeys.keys = [
40
-
config.krebs.users.lass.pubkey
41
-
];
42
-
};
28
+
config =
29
+
{ ... }:
30
+
{
31
+
environment.systemPackages = [
32
+
pkgs.git
33
+
pkgs.rxvt-unicode-unwrapped.terminfo
34
+
];
35
+
services.openssh.enable = true;
36
+
users.users.root.openssh.authorizedKeys.keys = [
37
+
config.krebs.users.lass.pubkey
38
+
];
39
+
};
43
40
autoStart = false;
44
41
enableTun = true;
45
42
privateNetwork = true;
46
43
hostAddress = "10.233.2.9";
47
44
localAddress = "10.233.2.10";
48
45
};
49
-
50
46
51
47
#systemd.services = builtins.listToAttrs (map (host:
52
48
# let
+25
-7
2configs/blue.nix
+25
-7
2configs/blue.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ pkgs, ... }:
2
2
3
3
{
4
4
imports = [
···
17
17
services.tor.client.enable = true;
18
18
19
19
krebs.iptables.tables.filter.INPUT.rules = [
20
-
{ predicate = "-i retiolum -p udp --dport 60000:61000"; target = "ACCEPT";}
21
-
{ predicate = "-i wiregrill -p udp --dport 60000:61000"; target = "ACCEPT";}
22
-
{ predicate = "-i retiolum -p tcp --dport 9998:9999"; target = "ACCEPT";}
23
-
{ predicate = "-i wiregrill -p tcp --dport 9998:9999"; target = "ACCEPT";}
24
-
{ predicate = "-i retiolum -p tcp --dport imap"; target = "ACCEPT";}
25
-
{ predicate = "-i wiregrill -p tcp --dport imap"; target = "ACCEPT";}
20
+
{
21
+
predicate = "-i retiolum -p udp --dport 60000:61000";
22
+
target = "ACCEPT";
23
+
}
24
+
{
25
+
predicate = "-i wiregrill -p udp --dport 60000:61000";
26
+
target = "ACCEPT";
27
+
}
28
+
{
29
+
predicate = "-i retiolum -p tcp --dport 9998:9999";
30
+
target = "ACCEPT";
31
+
}
32
+
{
33
+
predicate = "-i wiregrill -p tcp --dport 9998:9999";
34
+
target = "ACCEPT";
35
+
}
36
+
{
37
+
predicate = "-i retiolum -p tcp --dport imap";
38
+
target = "ACCEPT";
39
+
}
40
+
{
41
+
predicate = "-i wiregrill -p tcp --dport imap";
42
+
target = "ACCEPT";
43
+
}
26
44
];
27
45
28
46
services.dovecot2 = {
+6
-2
2configs/br.nix
+6
-2
2configs/br.nix
···
1
-
{ config, lib, pkgs, modulesPath, ... }: {
1
+
{ pkgs, modulesPath, ... }:
2
+
{
2
3
3
4
imports = [
4
5
(modulesPath + "/services/hardware/sane_extra_backends/brscan4.nix")
···
38
39
];
39
40
};
40
41
41
-
users.users.mainUser.extraGroups = [ "scanner" "lp" ];
42
+
users.users.mainUser.extraGroups = [
43
+
"scanner"
44
+
"lp"
45
+
];
42
46
43
47
}
+1
-1
2configs/browsers.nix
+1
-1
2configs/browsers.nix
+13
-10
2configs/c-base.nix
+13
-10
2configs/c-base.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ config, pkgs, ... }:
2
2
3
3
{
4
4
5
5
environment.systemPackages = [
6
6
pkgs.cifs-utils
7
7
];
8
-
9
8
10
9
clanCore.facts.services.c-base = {
11
10
secret."c-base.txt" = { };
···
26
25
Domains = "cbrp3.c-base.org";
27
26
};
28
27
routes = [
29
-
{ routeConfig = {
30
-
Destination = "10.0.0.0/23";
31
-
Gateway = "172.31.77.1";
32
-
};}
33
-
{ routeConfig = {
34
-
Destination = "91.102.9.99/32"; # vorstand.c-base.org
35
-
Gateway = "172.31.77.1";
36
-
};}
28
+
{
29
+
routeConfig = {
30
+
Destination = "10.0.0.0/23";
31
+
Gateway = "172.31.77.1";
32
+
};
33
+
}
34
+
{
35
+
routeConfig = {
36
+
Destination = "91.102.9.99/32"; # vorstand.c-base.org
37
+
Gateway = "172.31.77.1";
38
+
};
39
+
}
37
40
];
38
41
};
39
42
services.openvpn.servers.c-base = {
+2
-1
2configs/cast.nix
+2
-1
2configs/cast.nix
+5
-3
2configs/codimd.nix
+5
-3
2configs/codimd.nix
···
1
-
{ config, pkgs, lib, ... }:
1
+
{ config, pkgs, ... }:
2
2
let
3
3
domain = "pad.lassul.us";
4
4
in
···
21
21
};
22
22
23
23
security.acme.certs.${domain}.group = "hedgecert";
24
-
users.groups.hedgecert.members = [ "hedgedoc" "nginx" ];
24
+
users.groups.hedgecert.members = [
25
+
"hedgedoc"
26
+
"nginx"
27
+
];
25
28
26
29
security.dhparams = {
27
30
enable = true;
28
31
params.hedgedoc = { };
29
32
};
30
-
31
33
32
34
services.borgbackup.jobs.hetzner.paths = [
33
35
"/var/backup"
+40
-13
2configs/consul.nix
+40
-13
2configs/consul.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ config, lib, ... }:
2
2
{
3
3
services.consul = {
4
4
enable = true;
···
10
10
bootstrap_expect = 3;
11
11
server = true;
12
12
# retry_join = config.services.consul.extraConfig.start_join;
13
-
retry_join = lib.mapAttrsToList (n: h:
14
-
lib.head h.nets.retiolum.aliases
15
-
) (lib.filterAttrs (n: h: h.consul) config.krebs.hosts);
13
+
retry_join = lib.mapAttrsToList (_n: h: lib.head h.nets.retiolum.aliases) (
14
+
lib.filterAttrs (_n: h: h.consul) config.krebs.hosts
15
+
);
16
16
rejoin_after_leave = true;
17
17
18
18
# try to fix random lock loss on leader reelection
···
27
27
};
28
28
29
29
krebs.iptables.tables.filter.INPUT.rules = [
30
-
{ predicate = "-i retiolum -p tcp --dport 8300"; target = "ACCEPT"; }
31
-
{ predicate = "-i retiolum -p tcp --dport 8301"; target = "ACCEPT"; }
32
-
{ predicate = "-i retiolum -p udp --dport 8301"; target = "ACCEPT"; }
33
-
{ predicate = "-i retiolum -p tcp --dport 8302"; target = "ACCEPT"; }
34
-
{ predicate = "-i retiolum -p udp --dport 8302"; target = "ACCEPT"; }
35
-
{ predicate = "-i retiolum -p tcp --dport 8400"; target = "ACCEPT"; }
36
-
{ predicate = "-i retiolum -p tcp --dport 8500"; target = "ACCEPT"; }
37
-
{ predicate = "-i retiolum -p tcp --dport 8600"; target = "ACCEPT"; }
38
-
{ predicate = "-i retiolum -p udp --dport 8500"; target = "ACCEPT"; }
30
+
{
31
+
predicate = "-i retiolum -p tcp --dport 8300";
32
+
target = "ACCEPT";
33
+
}
34
+
{
35
+
predicate = "-i retiolum -p tcp --dport 8301";
36
+
target = "ACCEPT";
37
+
}
38
+
{
39
+
predicate = "-i retiolum -p udp --dport 8301";
40
+
target = "ACCEPT";
41
+
}
42
+
{
43
+
predicate = "-i retiolum -p tcp --dport 8302";
44
+
target = "ACCEPT";
45
+
}
46
+
{
47
+
predicate = "-i retiolum -p udp --dport 8302";
48
+
target = "ACCEPT";
49
+
}
50
+
{
51
+
predicate = "-i retiolum -p tcp --dport 8400";
52
+
target = "ACCEPT";
53
+
}
54
+
{
55
+
predicate = "-i retiolum -p tcp --dport 8500";
56
+
target = "ACCEPT";
57
+
}
58
+
{
59
+
predicate = "-i retiolum -p tcp --dport 8600";
60
+
target = "ACCEPT";
61
+
}
62
+
{
63
+
predicate = "-i retiolum -p udp --dport 8500";
64
+
target = "ACCEPT";
65
+
}
39
66
];
40
67
}
+35
-7
2configs/container-networking.nix
+35
-7
2configs/container-networking.nix
···
4
4
krebs.iptables.tables.filter.FORWARD.rules = [
5
5
# { v6 = false; predicate = "-d 10.233.2.0/24 -o ve-+ -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
6
6
# { v6 = false; predicate = "-s 10.233.2.0/24 -i ve-+"; target = "ACCEPT"; }
7
-
{ v6 = false; predicate = "-o ctr+ -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
8
-
{ v6 = false; predicate = "-i ctr+"; target = "ACCEPT"; }
9
-
{ v6 = false; predicate = "-o ve-+ -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
10
-
{ v6 = false; predicate = "-i ve-+"; target = "ACCEPT"; }
7
+
{
8
+
v6 = false;
9
+
predicate = "-o ctr+ -m conntrack --ctstate RELATED,ESTABLISHED";
10
+
target = "ACCEPT";
11
+
}
12
+
{
13
+
v6 = false;
14
+
predicate = "-i ctr+";
15
+
target = "ACCEPT";
16
+
}
17
+
{
18
+
v6 = false;
19
+
predicate = "-o ve-+ -m conntrack --ctstate RELATED,ESTABLISHED";
20
+
target = "ACCEPT";
21
+
}
22
+
{
23
+
v6 = false;
24
+
predicate = "-i ve-+";
25
+
target = "ACCEPT";
26
+
}
11
27
# { v6 = false; predicate = "-i ve-+ -o ve-+"; target = "ACCEPT"; }
12
28
# { v6 = false; predicate = "-o ve-+"; target = "REJECT --reject-with icmp-port-unreachable"; }
13
29
# { v6 = false; predicate = "-i ve-+"; target = "REJECT --reject-with icmp-port-unreachable"; }
14
30
];
15
31
krebs.iptables.tables.nat.PREROUTING.rules = lib.mkBefore [
16
-
{ v6 = false; predicate = "-i ctr+"; target = "ACCEPT"; }
17
-
{ v6 = false; predicate = "-i ve-+"; target = "ACCEPT"; }
32
+
{
33
+
v6 = false;
34
+
predicate = "-i ctr+";
35
+
target = "ACCEPT";
36
+
}
37
+
{
38
+
v6 = false;
39
+
predicate = "-i ve-+";
40
+
target = "ACCEPT";
41
+
}
18
42
];
19
43
krebs.iptables.tables.nat.POSTROUTING.rules = [
20
44
# { v6 = false; predicate = "-o et0"; target = "MASQUERADE"; }
21
45
22
-
{ v6 = false; predicate = "-s 10.233.0.0/16 ! -d 10.233.0.0/16"; target = "MASQUERADE"; }
46
+
{
47
+
v6 = false;
48
+
predicate = "-s 10.233.0.0/16 ! -d 10.233.0.0/16";
49
+
target = "MASQUERADE";
50
+
}
23
51
# { v6 = false; predicate = "-s 10.233.2.0/24 -d 224.0.0.0/24"; target = "RETURN"; }
24
52
# { v6 = false; predicate = "-s 10.233.2.0/24 -d 255.255.255.255"; target = "RETURN"; }
25
53
# { v6 = false; predicate = "-s 10.233.2.0/24 ! -d 10.233.2.0/24"; target = "MASQUERADE"; }
+2
-1
2configs/container-tests.nix
+2
-1
2configs/container-tests.nix
+2
-1
2configs/copyq.nix
+2
-1
2configs/copyq.nix
+20
-10
2configs/cunicu.nix
+20
-10
2configs/cunicu.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{
2
+
config,
3
+
lib,
4
+
pkgs,
5
+
...
6
+
}:
2
7
{
3
8
environment.systemPackages = [
4
9
pkgs.cunicu
···
38
43
interface_filter = "w*|e*|v*|i*";
39
44
};
40
45
41
-
interfaces.wiregrill = {};
46
+
interfaces.wiregrill = { };
42
47
43
-
peers = lib.mapAttrs
44
-
(_: host: {
48
+
peers = lib.mapAttrs (
49
+
_: host:
50
+
{
45
51
public_key = host.nets.wiregrill.wireguard.pubkey;
46
-
allowed_ips = with host.nets.wiregrill; [
47
-
"${ip6.addr}/128"
48
-
] ++ (lib.optional (ip4 != null) "${ip4.addr}/32");
49
-
} // lib.optionalAttrs (host.nets.wiregrill.via != null) {
52
+
allowed_ips =
53
+
with host.nets.wiregrill;
54
+
[
55
+
"${ip6.addr}/128"
56
+
]
57
+
++ (lib.optional (ip4 != null) "${ip4.addr}/32");
58
+
}
59
+
// lib.optionalAttrs (host.nets.wiregrill.via != null) {
50
60
endpoint = host.nets.wiregrill.via.ip4.addr + ":${toString host.nets.wiregrill.wireguard.port}";
51
-
})
52
-
(lib.filterAttrs (_: host: lib.hasAttr "wiregrill" host.nets) config.krebs.hosts);
61
+
}
62
+
) (lib.filterAttrs (_: host: lib.hasAttr "wiregrill" host.nets) config.krebs.hosts);
53
63
};
54
64
55
65
systemd.services.cunicu = {
+146
-34
2configs/default.nix
+146
-34
2configs/default.nix
···
1
-
{ self, config, lib, pkgs, ... }:
1
+
{
2
+
self,
3
+
config,
4
+
lib,
5
+
pkgs,
6
+
...
7
+
}:
2
8
{
3
9
imports = [
4
10
./security-workarounds.nix
···
39
45
clanCore.facts.services.password = {
40
46
secret.password = { };
41
47
secret.passwordHash = { };
42
-
generator.path = with pkgs; [ coreutils xkcdpass mkpasswd ];
48
+
generator.path = with pkgs; [
49
+
coreutils
50
+
xkcdpass
51
+
mkpasswd
52
+
];
43
53
generator.script = ''
44
54
xkcdpass -n 4 -d - > $secrets/password
45
55
cat $secrets/password | mkpasswd -s -m sha-512 > $secrets/passwordHash
···
47
57
};
48
58
}
49
59
{
60
+
clan.core.vars.settings.secretStore = "password-store";
61
+
clan.core.vars.generators.testing = {
62
+
files.testaaa = { };
63
+
runtimeInputs = with pkgs; [ coreutils ];
64
+
script = ''
65
+
echo lol > $out/testaaa
66
+
'';
67
+
};
68
+
}
69
+
{
70
+
# deployment information
71
+
options.clan.flake-inputs = lib.mkOption {
72
+
description = ''
73
+
information about the flake inputs.
74
+
Used for update tracking.
75
+
'';
76
+
type = lib.types.attrsOf (
77
+
lib.types.attrsOf (
78
+
lib.types.nullOr (
79
+
lib.types.oneOf [
80
+
lib.types.str
81
+
lib.types.int
82
+
]
83
+
)
84
+
)
85
+
);
86
+
default =
87
+
let
88
+
inputs = config.clan.core.clanDir.inputs;
89
+
cleanSourceInfo = input: {
90
+
rev = input.rev or null;
91
+
dirtyRev = input.dirtyRev or null;
92
+
lastModified = input.lastModified or null;
93
+
narHash = input.narHash or null;
94
+
};
95
+
sourceInfo = lib.mapAttrs (_: input: cleanSourceInfo input) inputs;
96
+
in
97
+
sourceInfo
98
+
// {
99
+
self = cleanSourceInfo config.clan.core.clanDir.sourceInfo;
100
+
};
101
+
};
102
+
config.environment.etc."flake-inputs.json".text =
103
+
let
104
+
text = builtins.unsafeDiscardStringContext (builtins.toJSON config.clan.flake-inputs);
105
+
in
106
+
text;
107
+
}
108
+
{
50
109
services.openssh.enable = true;
51
-
services.openssh.hostKeys = [{
52
-
path = config.clanCore.facts.services.ssh.secret."ssh.id_ed25519".path;
53
-
type = "ed25519";
54
-
}];
110
+
services.openssh.hostKeys = [
111
+
{
112
+
path = config.clanCore.facts.services.ssh.secret."ssh.id_ed25519".path;
113
+
type = "ed25519";
114
+
}
115
+
];
55
116
clanCore.facts.services.ssh = {
56
117
secret."ssh.id_ed25519" = { };
57
118
public."ssh.id_ed25519.pub" = { };
58
-
generator.path = with pkgs; [ coreutils openssh ];
119
+
generator.path = with pkgs; [
120
+
coreutils
121
+
openssh
122
+
];
59
123
generator.script = ''
60
124
ssh-keygen -t ed25519 -N "" -f $secrets/ssh.id_ed25519
61
125
mv $secrets/ssh.id_ed25519.pub $facts/ssh.id_ed25519.pub
···
90
154
};
91
155
};
92
156
}
93
-
(let ca-bundle = "/etc/ssl/certs/ca-bundle.crt"; in {
94
-
environment.variables = {
95
-
CURL_CA_BUNDLE = ca-bundle;
96
-
GIT_SSL_CAINFO = ca-bundle;
97
-
SSL_CERT_FILE = ca-bundle;
98
-
};
99
-
})
157
+
(
158
+
let
159
+
ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
160
+
in
161
+
{
162
+
environment.variables = {
163
+
CURL_CA_BUNDLE = ca-bundle;
164
+
GIT_SSL_CAINFO = ca-bundle;
165
+
SSL_CERT_FILE = ca-bundle;
166
+
};
167
+
}
168
+
)
100
169
{
101
170
#for sshuttle
102
171
environment.systemPackages = [
···
125
194
nixpkgs.config.allowUnfree = true;
126
195
127
196
environment.systemPackages = with pkgs; [
128
-
self.packages.${pkgs.system}.vim
197
+
self.packages.${pkgs.system}.nvim
129
198
130
-
#stockholm
199
+
#stockholm
131
200
git
132
201
git-absorb
133
202
git-preview
···
135
204
jq
136
205
nix-output-monitor
137
206
138
-
#style
207
+
#style
139
208
rxvt-unicode-unwrapped.terminfo
140
209
alacritty.terminfo
141
210
142
-
#monitoring tools
211
+
#monitoring tools
143
212
htop
144
213
iotop
145
214
146
-
#network
215
+
#network
147
216
iptables
148
217
iftop
149
218
tcpdump
···
151
220
eternal-terminal
152
221
self.packages.${pkgs.system}.sshify
153
222
154
-
#stuff for dl
223
+
#stuff for dl
155
224
aria2
156
225
157
-
#neat utils
226
+
#neat utils
158
227
file
159
228
hashPassword
160
229
kpaste
···
171
240
self.packages.${pkgs.system}.logify
172
241
goify
173
242
174
-
#unpack stuff
243
+
#unpack stuff
175
244
libarchive
176
245
177
246
(pkgs.writeDashBin "sshn" ''
···
232
301
filter.FORWARD.policy = lib.mkDefault "DROP";
233
302
filter.INPUT.rules = lib.mkMerge [
234
303
(lib.mkBefore [
235
-
{ predicate = "-m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
236
-
{ predicate = "-p icmp"; target = "ACCEPT"; }
237
-
{ predicate = "-p ipv6-icmp"; target = "ACCEPT"; v4 = false; }
238
-
{ predicate = "-i lo"; target = "ACCEPT"; }
239
-
{ predicate = "-p tcp --dport 22"; target = "ACCEPT"; }
304
+
{
305
+
predicate = "-m conntrack --ctstate RELATED,ESTABLISHED";
306
+
target = "ACCEPT";
307
+
}
308
+
{
309
+
predicate = "-p icmp";
310
+
target = "ACCEPT";
311
+
}
312
+
{
313
+
predicate = "-p ipv6-icmp";
314
+
target = "ACCEPT";
315
+
v4 = false;
316
+
}
317
+
{
318
+
predicate = "-i lo";
319
+
target = "ACCEPT";
320
+
}
321
+
{
322
+
predicate = "-p tcp --dport 22";
323
+
target = "ACCEPT";
324
+
}
240
325
])
241
326
(lib.mkOrder 1000 [
242
-
{ predicate = "-p udp --dport 60000:61000"; target = "ACCEPT"; } # mosh
243
-
{ predicate = "-i retiolum -p udp -m udp --dport 53"; target = "ACCEPT"; }
244
-
{ predicate = "-i retiolum -p tcp --dport 19999"; target = "ACCEPT"; }
327
+
{
328
+
predicate = "-p udp --dport 60000:61000";
329
+
target = "ACCEPT";
330
+
} # mosh
331
+
{
332
+
predicate = "-i retiolum -p udp -m udp --dport 53";
333
+
target = "ACCEPT";
334
+
}
335
+
{
336
+
predicate = "-i retiolum -p tcp --dport 19999";
337
+
target = "ACCEPT";
338
+
}
245
339
])
246
340
(lib.mkAfter [
247
-
{ predicate = "-p tcp -i retiolum"; target = "REJECT --reject-with tcp-reset"; }
248
-
{ predicate = "-p udp -i retiolum"; target = "REJECT --reject-with icmp-port-unreachable"; v6 = false; }
249
-
{ predicate = "-i retiolum"; target = "REJECT --reject-with icmp-proto-unreachable"; v6 = false; }
341
+
{
342
+
predicate = "-p tcp -i retiolum";
343
+
target = "REJECT --reject-with tcp-reset";
344
+
}
345
+
{
346
+
predicate = "-p udp -i retiolum";
347
+
target = "REJECT --reject-with icmp-port-unreachable";
348
+
v6 = false;
349
+
}
350
+
{
351
+
predicate = "-i retiolum";
352
+
target = "REJECT --reject-with icmp-proto-unreachable";
353
+
v6 = false;
354
+
}
250
355
])
251
356
];
252
357
};
···
267
372
268
373
# use 24:00 time format, the default got sneakily changed around 20.03
269
374
i18n.defaultLocale = lib.mkDefault "C.UTF-8";
270
-
time.timeZone = lib.mkDefault"Europe/Berlin";
375
+
time.timeZone = lib.mkDefault "Europe/Berlin";
271
376
272
377
# disable doc usually
273
378
documentation.nixos.enable = lib.mkDefault false;
···
277
382
enable = false;
278
383
enableNg = true;
279
384
};
385
+
386
+
# use latest nix to hunt all the bugs
387
+
nix.package = pkgs.nixVersions.latest;
388
+
389
+
# workaround for systemd freezing up when suspending
390
+
# https://github.com/systemd/systemd/issues/33083
391
+
environment.variables.SYSTEMD_SLEEP_FREEZE_USER_SESSIONS = "false";
280
392
}
+44
-37
2configs/doc.nix
+44
-37
2configs/doc.nix
···
1
1
let
2
-
pkgs = import <nixpkgs> {};
2
+
pkgs = import <nixpkgs> { };
3
3
4
-
mkNixosManual = let
5
-
inherit pkgs;
6
-
inherit (pkgs) lib;
7
-
# Reduces the attrs from a package set so broken packages evaluate (I think?)
8
-
scrubDerivations = namePrefix: pkgSet: lib.mapAttrs
9
-
(name: value:
10
-
let wholeName = "${namePrefix}.${name}"; in
11
-
if lib.isAttrs value then
12
-
scrubDerivations wholeName value
13
-
// (lib.optionalAttrs (lib.isDerivation value) { outPath = "\${${wholeName}}"; })
14
-
else value
15
-
)
16
-
pkgSet;
17
-
# An evluation of the specified system version with only the modules and no config
18
-
scrubbedEval = lib.evalModules {
19
-
modules = [
20
-
{
21
-
#imports = [ ./default.nix ];
22
-
}
23
-
] ++ (import (pkgs.path + /nixos/modules/module-list.nix));
24
-
# Forward the filtered package set and the modules path
25
-
specialArgs = {
26
-
pkgs = scrubDerivations "pkgs" pkgs;
27
-
modulesPath = pkgs.path + /nixos/modules;
4
+
mkNixosManual =
5
+
let
6
+
inherit pkgs;
7
+
inherit (pkgs) lib;
8
+
# Reduces the attrs from a package set so broken packages evaluate (I think?)
9
+
scrubDerivations =
10
+
namePrefix: pkgSet:
11
+
lib.mapAttrs (
12
+
name: value:
13
+
let
14
+
wholeName = "${namePrefix}.${name}";
15
+
in
16
+
if lib.isAttrs value then
17
+
scrubDerivations wholeName value
18
+
// (lib.optionalAttrs (lib.isDerivation value) { outPath = "\${${wholeName}}"; })
19
+
else
20
+
value
21
+
) pkgSet;
22
+
# An evluation of the specified system version with only the modules and no config
23
+
scrubbedEval = lib.evalModules {
24
+
modules = [
25
+
{
26
+
#imports = [ ./default.nix ];
27
+
}
28
+
] ++ (import (pkgs.path + /nixos/modules/module-list.nix));
29
+
# Forward the filtered package set and the modules path
30
+
specialArgs = {
31
+
pkgs = scrubDerivations "pkgs" pkgs;
32
+
modulesPath = pkgs.path + /nixos/modules;
33
+
};
28
34
};
29
-
};
30
-
in (import (pkgs.path + /nixos/doc/manual)) rec {
31
-
# From parent scope
32
-
inherit (scrubbedEval) config;
33
-
# From let
34
-
inherit pkgs;
35
-
version = scrubbedEval.config.system.nixos.release;
36
-
revision = "release-${version}";
35
+
in
36
+
(import (pkgs.path + /nixos/doc/manual)) rec {
37
+
# From parent scope
38
+
inherit (scrubbedEval) config;
39
+
# From let
40
+
inherit pkgs;
41
+
version = scrubbedEval.config.system.nixos.release;
42
+
revision = "release-${version}";
37
43
38
-
extraSources = [ ../. ];
39
-
options = scrubbedEval.options;
40
-
};
41
-
in mkNixosManual
44
+
extraSources = [ ../. ];
45
+
options = scrubbedEval.options;
46
+
};
47
+
in
48
+
mkNixosManual
+1
-1
2configs/docker.nix
+1
-1
2configs/docker.nix
+2
-1
2configs/dunst.nix
+2
-1
2configs/dunst.nix
+1
-1
2configs/et-server.nix
+1
-1
2configs/et-server.nix
+17
-5
2configs/exim-retiolum.nix
+17
-5
2configs/exim-retiolum.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ ... }:
2
2
{
3
3
krebs.exim-retiolum = {
4
4
enable = true;
5
5
system-aliases = [
6
-
{ from = "root"; to = "lass"; }
6
+
{
7
+
from = "root";
8
+
to = "lass";
9
+
}
7
10
];
8
11
};
9
12
krebs.iptables.tables.filter.INPUT.rules = [
10
-
{ predicate = "-i retiolum -p tcp --dport smtp"; target = "ACCEPT"; }
11
-
{ predicate = "-i zttzibeakb -p tcp --dport smtp"; target = "ACCEPT"; }
12
-
{ predicate = "-i nether -p tcp --dport smtp"; target = "ACCEPT"; }
13
+
{
14
+
predicate = "-i retiolum -p tcp --dport smtp";
15
+
target = "ACCEPT";
16
+
}
17
+
{
18
+
predicate = "-i zttzibeakb -p tcp --dport smtp";
19
+
target = "ACCEPT";
20
+
}
21
+
{
22
+
predicate = "-i nether -p tcp --dport smtp";
23
+
target = "ACCEPT";
24
+
}
13
25
];
14
26
}
-1
2configs/fetchWallpaper.nix
-1
2configs/fetchWallpaper.nix
+6
-7
2configs/firefoxPatched.nix
+6
-7
2configs/firefoxPatched.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ lib, pkgs, ... }:
2
2
3
3
let
4
4
lpkgs = import ../5pkgs { inherit pkgs; };
5
5
6
6
inherit (lib)
7
7
concatMapStrings
8
-
;
8
+
;
9
9
10
10
plugins = with lpkgs.firefoxPlugins; [
11
11
noscript
···
13
13
vimperator
14
14
];
15
15
16
-
copyXpi = plugin:
17
-
"cp ${plugin}/*.xpi $out/usr/lib/firefox-*/browser/extensions/";
16
+
copyXpi = plugin: "cp ${plugin}/*.xpi $out/usr/lib/firefox-*/browser/extensions/";
18
17
19
18
preferences = pkgs.writeText "autoload.js" ''
20
19
pref('general.config.filename', 'firefox.cfg');
···
40
39
defaultPref("plugin.scan.plid.all", false);
41
40
'';
42
41
43
-
in {
42
+
in
43
+
{
44
44
environment.systemPackages = [
45
-
(pkgs.lib.overrideDerivation pkgs.firefox-bin (original : {
45
+
(pkgs.lib.overrideDerivation pkgs.firefox-bin (original: {
46
46
installPhase = ''
47
47
${original.installPhase}
48
48
find $out/usr/lib
···
55
55
}))
56
56
];
57
57
}
58
-
+7
-1
2configs/fonts.nix
+7
-1
2configs/fonts.nix
+18
-6
2configs/fysiirc.nix
+18
-6
2configs/fysiirc.nix
···
1
-
{ config, lib, pkgs, ... }: let
1
+
{
2
+
config,
3
+
lib,
4
+
pkgs,
5
+
...
6
+
}:
7
+
let
2
8
3
9
format-github-message = pkgs.writeDashBin "format-github-message" ''
4
10
set -efu
5
-
export PATH=${lib.makeBinPath [
6
-
pkgs.jq
7
-
]}
11
+
export PATH=${
12
+
lib.makeBinPath [
13
+
pkgs.jq
14
+
]
15
+
}
8
16
INPUT=$(jq -c .)
9
17
if $(printf '%s' "$INPUT" | jq 'has("issue") or has("pull_request")'); then
10
18
${write_to_irc} "$(printf '%s' "$INPUT" | jq -r '
···
26
34
)"
27
35
'';
28
36
29
-
in {
37
+
in
38
+
{
30
39
krebs.iptables.tables.filter.INPUT.rules = [
31
-
{ predicate = "-p tcp --dport 44002"; target = "ACCEPT"; }
40
+
{
41
+
predicate = "-p tcp --dport 44002";
42
+
target = "ACCEPT";
43
+
}
32
44
];
33
45
krebs.reaktor2.fysiweb-github = {
34
46
hostname = "irc.libera.chat";
+17
-56
2configs/games.nix
+17
-56
2configs/games.nix
···
2
2
3
3
let
4
4
mainUser = config.users.extraUsers.mainUser;
5
-
vdoom = pkgs.writers.writeDash "vdoom" ''
6
-
${pkgs.zandronum}/bin/zandronum \
7
-
-fov 120 \
8
-
"$@"
9
-
'';
10
-
doom = pkgs.writers.writeDash "doom" ''
11
-
DOOM_DIR=''${DOOM_DIR:-~/doom/}
12
-
${vdoom} \
13
-
-file $DOOM_DIR/lib/brutalv21.pk3 \
14
-
"$@"
15
-
'';
16
-
doom1 = pkgs.writers.writeDashBin "doom1" ''
17
-
DOOM_DIR=''${DOOM_DIR:-~/doom/}
18
-
${doom} -iwad $DOOM_DIR/wads/stock/doom.wad "$@"
19
-
'';
20
-
doom2 = pkgs.writers.writeDashBin "doom2" ''
21
-
DOOM_DIR=''${DOOM_DIR:-~/doom/}
22
-
${doom} -iwad $DOOM_DIR/wads/stock/doom2.wad "$@"
23
-
'';
24
-
vdoom1 = pkgs.writers.writeDashBin "vdoom1" ''
25
-
DOOM_DIR=''${DOOM_DIR:-~/doom/}
26
-
${vdoom} -iwad $DOOM_DIR/wads/stock/doom.wad "$@"
27
-
'';
28
-
vdoom2 = pkgs.writers.writeDashBin "vdoom2" ''
29
-
DOOM_DIR=''${DOOM_DIR:-~/doom/}
30
-
${vdoom} -iwad $DOOM_DIR/wads/stock/doom2.wad "$@"
31
-
'';
32
5
33
-
doomservercfg = pkgs.writeText "doomserver.cfg" ''
34
-
skill 7
35
-
#survival true
36
-
#sv_maxlives 4
37
-
#sv_norespawn true
38
-
#sv_weapondrop true
39
-
no_jump true
40
-
#sv_noweaponspawn true
41
-
sv_sharekeys true
42
-
sv_survivalcountdowntime 1
43
-
sv_noteamselect true
44
-
sv_updatemaster false
45
-
#sv_coop_loseinventory true
46
-
#cl_startasspectator false
47
-
#lms_spectatorview false
48
-
'';
49
-
50
-
vdoomserver = pkgs.writers.writeDashBin "vdoomserver" ''
51
-
DOOM_DIR=''${DOOM_DIR:-~/doom/}
52
-
53
-
${pkgs.zandronum}/bin/zandronum-server \
54
-
+exec ${doomservercfg} \
55
-
"$@"
56
-
'';
57
-
58
-
in {
6
+
in
7
+
{
59
8
users.extraUsers = {
60
9
games = {
61
10
name = "games";
62
11
description = "user playing games";
63
12
home = "/home/games";
64
-
extraGroups = [ "audio" "video" "input" "loot" "pipewire" ];
13
+
extraGroups = [
14
+
"audio"
15
+
"video"
16
+
"input"
17
+
"loot"
18
+
"pipewire"
19
+
];
65
20
createHome = true;
66
21
useDefaultShell = true;
67
22
packages = with pkgs; [
···
90
45
'';
91
46
92
47
krebs.iptables.tables.filter.INPUT.rules = [
93
-
{ predicate = "-p tcp --dport 10666"; target = "ACCEPT"; }
94
-
{ predicate = "-p udp --dport 10666"; target = "ACCEPT"; }
48
+
{
49
+
predicate = "-p tcp --dport 10666";
50
+
target = "ACCEPT";
51
+
}
52
+
{
53
+
predicate = "-p udp --dport 10666";
54
+
target = "ACCEPT";
55
+
}
95
56
];
96
57
}
+11
-1
2configs/gc.nix
+11
-1
2configs/gc.nix
···
1
1
{ config, lib, ... }:
2
2
{
3
3
nix.gc = {
4
-
automatic = ! (lib.elem config.krebs.build.host.name [ "aergia" "ignavia" "mors" "xerxes" "coaxmetal" ] || config.boot.isContainer);
4
+
automatic =
5
+
!(
6
+
lib.elem config.krebs.build.host.name [
7
+
"aergia"
8
+
"ignavia"
9
+
"mors"
10
+
"xerxes"
11
+
"coaxmetal"
12
+
]
13
+
|| config.boot.isContainer
14
+
);
5
15
options = "--delete-older-than 15d";
6
16
};
7
17
}
+32
-9
2configs/gg23.nix
+32
-9
2configs/gg23.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ lib, pkgs, ... }:
2
2
{
3
3
# vodafone router drifts out of time
4
4
services.timesyncd.servers = [
···
43
43
# DHCPPrefixDelegation = "yes";
44
44
};
45
45
dhcpServerStaticLeases = [
46
-
{ # printer
46
+
{
47
+
# printer
47
48
dhcpServerStaticLeaseConfig = {
48
49
Address = "10.42.0.4";
49
50
MACAddress = "3c:2a:f4:22:28:37";
50
51
};
51
52
}
52
-
{ # firetv
53
+
{
54
+
# firetv
53
55
dhcpServerStaticLeaseConfig = {
54
56
Address = "10.42.0.11";
55
57
MACAddress = "84:28:59:f0:d2:a8";
···
71
73
};
72
74
networking.networkmanager.unmanaged = [ "int0" ];
73
75
krebs.iptables.tables.filter.INPUT.rules = [
74
-
{ predicate = "-i int0"; target = "ACCEPT"; }
76
+
{
77
+
predicate = "-i int0";
78
+
target = "ACCEPT";
79
+
}
75
80
];
76
81
krebs.iptables.tables.filter.FORWARD.rules = [
77
-
{ predicate = "-i int0"; target = "ACCEPT"; }
78
-
{ predicate = "-o int0"; target = "ACCEPT"; }
79
-
{ predicate = "-p ipv6-icmp"; target = "ACCEPT"; v4 = false; }
82
+
{
83
+
predicate = "-i int0";
84
+
target = "ACCEPT";
85
+
}
86
+
{
87
+
predicate = "-o int0";
88
+
target = "ACCEPT";
89
+
}
90
+
{
91
+
predicate = "-p ipv6-icmp";
92
+
target = "ACCEPT";
93
+
v4 = false;
94
+
}
80
95
];
81
96
krebs.iptables.tables.nat.PREROUTING.rules = lib.mkBefore [
82
-
{ v6 = false; predicate = "-s 10.42.0.0/24"; target = "ACCEPT"; }
97
+
{
98
+
v6 = false;
99
+
predicate = "-s 10.42.0.0/24";
100
+
target = "ACCEPT";
101
+
}
83
102
];
84
103
krebs.iptables.tables.nat.POSTROUTING.rules = [
85
-
{ v6 = false; predicate = "-s 10.42.0.0/24"; target = "MASQUERADE"; }
104
+
{
105
+
v6 = false;
106
+
predicate = "-s 10.42.0.0/24";
107
+
target = "MASQUERADE";
108
+
}
86
109
];
87
110
88
111
networking.domain = "gg23";
+45
-22
2configs/git-brain.nix
+45
-22
2configs/git-brain.nix
···
1
-
{ self, config, lib, pkgs, ... }:
1
+
{
2
+
self,
3
+
config,
4
+
lib,
5
+
pkgs,
6
+
...
7
+
}:
2
8
let
3
9
git = self.inputs.stockholm.lib.git;
4
10
repos = krebs-repos;
···
8
14
brain = { };
9
15
};
10
16
11
-
12
-
make-krebs-repo = with git; name: { cgit ? {}, ... }: {
13
-
inherit cgit name;
14
-
public = false;
15
-
hooks = {
16
-
post-receive = pkgs.git-hooks.irc-announce {
17
-
nick = config.networking.hostName;
18
-
verbose = true;
19
-
channel = "#xxx";
20
-
# TODO remove the hardcoded hostname
21
-
server = "irc.r";
17
+
make-krebs-repo =
18
+
with git;
19
+
name:
20
+
{
21
+
cgit ? { },
22
+
...
23
+
}:
24
+
{
25
+
inherit cgit name;
26
+
public = false;
27
+
hooks = {
28
+
post-receive = pkgs.git-hooks.irc-announce {
29
+
nick = config.networking.hostName;
30
+
verbose = true;
31
+
channel = "#xxx";
32
+
# TODO remove the hardcoded hostname
33
+
server = "irc.r";
34
+
};
22
35
};
23
36
};
24
-
};
25
-
26
-
27
37
28
38
# TODO: get the list of all krebsministers
29
-
krebsminister = with config.krebs.users; [ makefu tv kmein ];
30
-
krebs-rules = repo:
31
-
set-owners repo [ config.krebs.users.lass ] ++ set-ro-access repo krebsminister;
39
+
krebsminister = with config.krebs.users; [
40
+
makefu
41
+
tv
42
+
kmein
43
+
];
44
+
krebs-rules = repo: set-owners repo [ config.krebs.users.lass ] ++ set-ro-access repo krebsminister;
32
45
33
-
set-ro-access = with git; repo: user:
46
+
set-ro-access =
47
+
with git;
48
+
repo: user:
34
49
lib.singleton {
35
50
inherit user;
36
51
repo = [ repo ];
37
52
perm = fetch;
38
53
};
39
54
40
-
set-owners = with git;repo: user:
55
+
set-owners =
56
+
with git;
57
+
repo: user:
41
58
lib.singleton {
42
59
inherit user;
43
60
repo = [ repo ];
44
-
perm = push "refs/*" [ non-fast-forward create delete merge ];
61
+
perm = push "refs/*" [
62
+
non-fast-forward
63
+
create
64
+
delete
65
+
merge
66
+
];
45
67
};
46
68
47
-
in {
69
+
in
70
+
{
48
71
imports = [
49
72
self.inputs.stockholm.nixosModules.git
50
73
];
+104
-70
2configs/git.nix
+104
-70
2configs/git.nix
···
1
-
{ self, config, lib, pkgs, ... }:
1
+
{
2
+
self,
3
+
config,
4
+
lib,
5
+
pkgs,
6
+
...
7
+
}:
2
8
3
9
let
4
10
git = self.inputs.stockholm.lib.git;
···
20
26
};
21
27
22
28
krebs.iptables.tables.filter.INPUT.rules = [
23
-
{ predicate = "-i retiolum -p tcp --dport 80"; target = "ACCEPT"; }
29
+
{
30
+
predicate = "-i retiolum -p tcp --dport 80";
31
+
target = "ACCEPT";
32
+
}
24
33
];
25
34
26
35
system.activationScripts.spool-chmod = ''
···
32
41
inherit (config.krebs.git.cgit.settings) cache-root;
33
42
};
34
43
35
-
repos =
36
-
public-repos //
37
-
lib.optionalAttrs config.krebs.build.host.secure restricted-repos;
44
+
repos = public-repos // lib.optionalAttrs config.krebs.build.host.secure restricted-repos;
38
45
39
46
rules = lib.concatMap make-rules (lib.attrValues repos);
40
47
···
112
119
};
113
120
the_playlist = {
114
121
cgit.desc = "Good Music collection + tools";
115
-
cgit.section = "art";
122
+
cgit.section = "art";
116
123
};
117
124
workadventure-nix = {
118
125
cgit.desc = "Nix packaging for workadventure";
···
126
133
127
134
restricted-repos = lib.mapAttrs make-restricted-repo {
128
135
brain = {
129
-
collaborators = with config.krebs.users; [ tv makefu ];
136
+
collaborators = with config.krebs.users; [
137
+
tv
138
+
makefu
139
+
];
130
140
announce = true;
131
141
};
132
142
};
133
143
134
-
make-public-repo = name: { cgit ? {}, collaborators ? [], ... }: {
135
-
inherit cgit collaborators name;
136
-
public = true;
137
-
hooks = {
138
-
post-receive = ''
139
-
${pkgs.git-hooks.irc-announce {
140
-
# TODO make nick = config.krebs.build.host.name the default
141
-
nick = config.krebs.build.host.name;
142
-
channel = "#xxx";
143
-
# TODO define refs in some kind of option per repo
144
-
server = "irc.r";
145
-
verbose = config.krebs.build.host.name == "orange";
146
-
}}
147
-
${cgit-clear-cache}/bin/cgit-clear-cache
148
-
'';
144
+
make-public-repo =
145
+
name:
146
+
{
147
+
cgit ? { },
148
+
collaborators ? [ ],
149
+
...
150
+
}:
151
+
{
152
+
inherit cgit collaborators name;
153
+
public = true;
154
+
hooks = {
155
+
post-receive = ''
156
+
${pkgs.git-hooks.irc-announce {
157
+
# TODO make nick = config.krebs.build.host.name the default
158
+
nick = config.krebs.build.host.name;
159
+
channel = "#xxx";
160
+
# TODO define refs in some kind of option per repo
161
+
server = "irc.r";
162
+
verbose = config.krebs.build.host.name == "orange";
163
+
}}
164
+
${cgit-clear-cache}/bin/cgit-clear-cache
165
+
'';
166
+
};
149
167
};
150
-
};
151
168
152
-
make-public-repo-silent = name: { cgit ? {}, ... }: {
153
-
inherit cgit name;
154
-
public = true;
155
-
};
156
-
157
-
make-restricted-repo = name: { admins ? [], collaborators ? [], announce ? true, hooks ? {}, ... }: {
158
-
inherit admins collaborators name;
159
-
public = false;
160
-
hooks = {
161
-
post-receive = ''
162
-
${lib.optionalString announce (pkgs.git-hooks.irc-announce {
163
-
# TODO make nick = config.krebs.build.host.name the default
164
-
nick = config.krebs.build.host.name;
165
-
channel = "#xxx";
166
-
# TODO define refs in some kind of option per repo
167
-
refs = [
168
-
"refs/heads/master"
169
-
"refs/heads/staging*"
170
-
];
171
-
server = "irc.r";
172
-
verbose = false;
173
-
})}
174
-
${cgit-clear-cache}/bin/cgit-clear-cache
175
-
'';
176
-
} // hooks;
177
-
};
169
+
make-restricted-repo =
170
+
name:
171
+
{
172
+
admins ? [ ],
173
+
collaborators ? [ ],
174
+
announce ? true,
175
+
hooks ? { },
176
+
...
177
+
}:
178
+
{
179
+
inherit admins collaborators name;
180
+
public = false;
181
+
hooks = {
182
+
post-receive = ''
183
+
${lib.optionalString announce (
184
+
pkgs.git-hooks.irc-announce {
185
+
# TODO make nick = config.krebs.build.host.name the default
186
+
nick = config.krebs.build.host.name;
187
+
channel = "#xxx";
188
+
# TODO define refs in some kind of option per repo
189
+
refs = [
190
+
"refs/heads/master"
191
+
"refs/heads/staging*"
192
+
];
193
+
server = "irc.r";
194
+
verbose = false;
195
+
}
196
+
)}
197
+
${cgit-clear-cache}/bin/cgit-clear-cache
198
+
'';
199
+
} // hooks;
200
+
};
178
201
179
202
make-rules =
180
203
with git // config.krebs.users;
181
204
repo:
182
-
lib.singleton {
183
-
user = [ lass ];
184
-
repo = [ repo ];
185
-
perm = push "refs/*" [ non-fast-forward create delete merge ];
186
-
} ++
187
-
lib.optional (lib.length (repo.admins or []) > 0) {
188
-
user = repo.admins;
189
-
repo = [ repo ];
190
-
perm = push "refs/*" [ non-fast-forward create delete merge ];
191
-
} ++
192
-
lib.optional (lib.length (repo.collaborators or []) > 0) {
193
-
user = repo.collaborators;
194
-
repo = [ repo ];
195
-
perm = fetch;
196
-
} ++
197
-
lib.optional repo.public {
198
-
user = lib.attrValues config.krebs.users;
199
-
repo = [ repo ];
200
-
perm = fetch;
201
-
};
205
+
lib.singleton {
206
+
user = [ lass ];
207
+
repo = [ repo ];
208
+
perm = push "refs/*" [
209
+
non-fast-forward
210
+
create
211
+
delete
212
+
merge
213
+
];
214
+
}
215
+
++ lib.optional (lib.length (repo.admins or [ ]) > 0) {
216
+
user = repo.admins;
217
+
repo = [ repo ];
218
+
perm = push "refs/*" [
219
+
non-fast-forward
220
+
create
221
+
delete
222
+
merge
223
+
];
224
+
}
225
+
++ lib.optional (lib.length (repo.collaborators or [ ]) > 0) {
226
+
user = repo.collaborators;
227
+
repo = [ repo ];
228
+
perm = fetch;
229
+
}
230
+
++ lib.optional repo.public {
231
+
user = lib.attrValues config.krebs.users;
232
+
repo = [ repo ];
233
+
perm = fetch;
234
+
};
202
235
203
-
in out
236
+
in
237
+
out
+1
-1
2configs/hardening.nix
+1
-1
2configs/hardening.nix
+56
-21
2configs/hfos.nix
+56
-21
2configs/hfos.nix
···
1
-
{ config, lib, pkgs, ... }: let
2
-
3
-
vmip = "192.168.122.208";
4
-
5
-
in {
1
+
{ pkgs, ... }:
2
+
{
6
3
users.users.riot = {
7
4
uid = genid "riot";
8
5
isNormalUser = true;
···
20
17
];
21
18
22
19
krebs.iptables.tables.nat.PREROUTING.rules = mkBefore [
23
-
{ v6 = false; predicate = "-d 213.239.205.246 -p tcp --dport 22"; target = "DNAT --to-destination 192.168.122.208:22"; }
24
-
{ v6 = false; predicate = "-d 213.239.205.246 -p tcp --dport 25"; target = "DNAT --to-destination 192.168.122.208:25"; }
25
-
{ v6 = false; predicate = "-d 213.239.205.246 -p tcp --dport 80"; target = "DNAT --to-destination 192.168.122.208:1080"; }
26
-
{ v6 = false; predicate = "-d 213.239.205.246 -p tcp --dport 443"; target = "DNAT --to-destination 192.168.122.208:1443"; }
20
+
{
21
+
v6 = false;
22
+
predicate = "-d 213.239.205.246 -p tcp --dport 22";
23
+
target = "DNAT --to-destination 192.168.122.208:22";
24
+
}
25
+
{
26
+
v6 = false;
27
+
predicate = "-d 213.239.205.246 -p tcp --dport 25";
28
+
target = "DNAT --to-destination 192.168.122.208:25";
29
+
}
30
+
{
31
+
v6 = false;
32
+
predicate = "-d 213.239.205.246 -p tcp --dport 80";
33
+
target = "DNAT --to-destination 192.168.122.208:1080";
34
+
}
35
+
{
36
+
v6 = false;
37
+
predicate = "-d 213.239.205.246 -p tcp --dport 443";
38
+
target = "DNAT --to-destination 192.168.122.208:1443";
39
+
}
27
40
];
28
41
29
42
krebs.iptables.tables.filter.FORWARD.rules = mkBefore [
30
-
{ v6 = false; predicate = "-d 192.168.122.208 -p tcp --dport 22 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; }
31
-
{ v6 = false; predicate = "-d 192.168.122.208 -p tcp --dport 25 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; }
32
-
{ v6 = false; predicate = "-d 192.168.122.208 -p tcp --dport 1080 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; }
33
-
{ v6 = false; predicate = "-d 192.168.122.208 -p tcp --dport 1443 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; }
43
+
{
44
+
v6 = false;
45
+
predicate = "-d 192.168.122.208 -p tcp --dport 22 -m state --state NEW,ESTABLISHED,RELATED";
46
+
target = "ACCEPT";
47
+
}
48
+
{
49
+
v6 = false;
50
+
predicate = "-d 192.168.122.208 -p tcp --dport 25 -m state --state NEW,ESTABLISHED,RELATED";
51
+
target = "ACCEPT";
52
+
}
53
+
{
54
+
v6 = false;
55
+
predicate = "-d 192.168.122.208 -p tcp --dport 1080 -m state --state NEW,ESTABLISHED,RELATED";
56
+
target = "ACCEPT";
57
+
}
58
+
{
59
+
v6 = false;
60
+
predicate = "-d 192.168.122.208 -p tcp --dport 1443 -m state --state NEW,ESTABLISHED,RELATED";
61
+
target = "ACCEPT";
62
+
}
34
63
];
35
64
36
65
krebs.iptables.tables.nat.OUTPUT.rules = mkBefore [
37
-
{ v6 = false; predicate = "-d 213.239.205.246 -p tcp --dport 443"; target = "DNAT --to-destination 192.168.122.208:1443"; }
66
+
{
67
+
v6 = false;
68
+
predicate = "-d 213.239.205.246 -p tcp --dport 443";
69
+
target = "DNAT --to-destination 192.168.122.208:1443";
70
+
}
38
71
];
39
72
40
73
# TODO use bridge interfaces instead of this crap
41
-
systemd.services.libvirtd.serviceConfig.ExecStartPost = let
42
-
restart-iptables = pkgs.writeDash "restart-iptables" ''
43
-
#soo hacky
44
-
${pkgs.coreutils}/bin/sleep 5s
45
-
${pkgs.systemd}/bin/systemctl restart krebs-iptables.service
46
-
'';
47
-
in restart-iptables;
74
+
systemd.services.libvirtd.serviceConfig.ExecStartPost =
75
+
let
76
+
restart-iptables = pkgs.writeDash "restart-iptables" ''
77
+
#soo hacky
78
+
${pkgs.coreutils}/bin/sleep 5s
79
+
${pkgs.systemd}/bin/systemctl restart krebs-iptables.service
80
+
'';
81
+
in
82
+
restart-iptables;
48
83
}
+13
-3
2configs/home-manager.nix
+13
-3
2configs/home-manager.nix
···
1
-
{ config, lib, pkgs, ... }: let
2
-
vim_nix = import ./vim.nix { inherit lib pkgs; config = {}; };
3
-
in {
1
+
{
2
+
config,
3
+
lib,
4
+
pkgs,
5
+
...
6
+
}:
7
+
let
8
+
vim_nix = import ./vim.nix {
9
+
inherit lib pkgs;
10
+
config = { };
11
+
};
12
+
in
13
+
{
4
14
programs.git = {
5
15
enable = true;
6
16
userName = "lassulus";
+16
-11
2configs/home-media.nix
+16
-11
2configs/home-media.nix
···
6
6
users.users.media = {
7
7
isNormalUser = true;
8
8
uid = self.inputs.stockholm.lib.genid_uint31 "media";
9
-
extraGroups = [ "video" "audio" "pipewire" ];
9
+
extraGroups = [
10
+
"video"
11
+
"audio"
12
+
"pipewire"
13
+
];
10
14
packages = [
11
15
(pkgs.writers.writeDashBin "mpv" ''
12
16
if test -e "$1"; then
···
68
72
User = "media";
69
73
RemainAfterExit = true;
70
74
Nice = "-10";
71
-
ExecStart = ''${pkgs.tmux}/bin/tmux -2 new-session -d -s mpvd -- /run/current-system/sw/bin/ipc-mpv \
72
-
--audio-display=no --audio-channels=stereo \
73
-
--audio-samplerate=48000 --audio-format=s16 \
74
-
--ao-pcm-file=/run/snapserver/snapfifo --ao=pcm \
75
-
--audio-delay=-1 \
76
-
--network-timeout=3 \
77
-
--untimed --cache-pause=no \
78
-
--idle=yes --force-window=yes \
79
-
--loop-playlist=inf \
80
-
--input-ipc-server=/tmp/mpv.ipc
75
+
ExecStart = ''
76
+
${pkgs.tmux}/bin/tmux -2 new-session -d -s mpvd -- /run/current-system/sw/bin/ipc-mpv \
77
+
--audio-display=no --audio-channels=stereo \
78
+
--audio-samplerate=48000 --audio-format=s16 \
79
+
--ao-pcm-file=/run/snapserver/snapfifo --ao=pcm \
80
+
--audio-delay=-1 \
81
+
--network-timeout=3 \
82
+
--untimed --cache-pause=no \
83
+
--idle=yes --force-window=yes \
84
+
--loop-playlist=inf \
85
+
--input-ipc-server=/tmp/mpv.ipc
81
86
'';
82
87
ExecStop = "${pkgs.tmux}/bin/tmux kill-session -t mpvd";
83
88
ExecStartPre = [
+4
-1
2configs/hotdog-host.nix
+4
-1
2configs/hotdog-host.nix
···
16
16
clanCore.facts.services.hotdog-container = {
17
17
secret."hotdog.sync.key" = { };
18
18
public."hotdog.sync.pub" = { };
19
-
generator.path = with pkgs; [ coreutils openssh ];
19
+
generator.path = with pkgs; [
20
+
coreutils
21
+
openssh
22
+
];
20
23
generator.script = ''
21
24
ssh-keygen -t ed25519 -N "" -f "$secrets"/hotdog.sync.key
22
25
mv "$secrets"/hotdog.sync.key.pub "$facts"/hotdog.sync.pub
+29
-14
2configs/idc.nix
+29
-14
2configs/idc.nix
···
1
-
{ config, pkgs, lib, ... }: let
2
-
interdimensional-cable = let
3
-
nimaid-github-io = pkgs.fetchFromGitHub {
4
-
owner = "nimaid";
5
-
repo = "nimaid.github.io";
6
-
rev = "5c4f8dda1216d578ad7cd6b0052d5ebf3696ea12";
7
-
sha256 = "sha256-w0u72Q0CkxRu8lr/pp863POzAg09xssbot9pOhSsAn4=";
8
-
};
9
-
in pkgs.writeShellScriptBin "interdimensional-cable" ''
10
-
export PATH=${lib.makeBinPath [ pkgs.mpv pkgs.jq pkgs.gnused ]}
11
-
mpv --shuffle --playlist=<(jq -r '.videos[]' ${nimaid-github-io}/tv/interdimensional_database.json | sed 's#^#https://youtu.be/#')
12
-
'';
13
-
in {
1
+
{
2
+
config,
3
+
pkgs,
4
+
lib,
5
+
...
6
+
}:
7
+
let
8
+
interdimensional-cable =
9
+
let
10
+
nimaid-github-io = pkgs.fetchFromGitHub {
11
+
owner = "nimaid";
12
+
repo = "nimaid.github.io";
13
+
rev = "5c4f8dda1216d578ad7cd6b0052d5ebf3696ea12";
14
+
sha256 = "sha256-w0u72Q0CkxRu8lr/pp863POzAg09xssbot9pOhSsAn4=";
15
+
};
16
+
in
17
+
pkgs.writeShellScriptBin "interdimensional-cable" ''
18
+
export PATH=${
19
+
lib.makeBinPath [
20
+
pkgs.mpv
21
+
pkgs.jq
22
+
pkgs.gnused
23
+
]
24
+
}
25
+
mpv --shuffle --playlist=<(jq -r '.videos[]' ${nimaid-github-io}/tv/interdimensional_database.json | sed 's#^#https://youtu.be/#')
26
+
'';
27
+
in
28
+
{
14
29
systemd.services.reaktor2-idc.serviceConfig.DynamicUser = lib.mkForce false;
15
30
systemd.services.reaktor2-idc.serviceConfig.Group = lib.mkForce "users";
16
31
···
39
54
activate = "match";
40
55
pattern = ''^!([^ ]+)(?:\s*(.*))?'';
41
56
command = 1;
42
-
arguments = [2];
57
+
arguments = [ 2 ];
43
58
commands = {
44
59
next.filename = pkgs.writeDash "next" ''
45
60
DISPLAY=:0 ${pkgs.xdotool}/bin/xdotool key "enter"
+7
-3
2configs/iodined.nix
+7
-3
2configs/iodined.nix
···
1
-
{ pkgs, config, ... }:
1
+
{ config, ... }:
2
2
3
3
let
4
4
# TODO: make this a parameter
5
5
domain = "io.lassul.us";
6
-
in {
6
+
in
7
+
{
7
8
8
9
services.iodine.server = {
9
10
enable = true;
···
13
14
};
14
15
15
16
krebs.iptables.tables.filter.INPUT.rules = [
16
-
{ predicate = "-p udp --dport 53"; target = "ACCEPT";}
17
+
{
18
+
predicate = "-p udp --dport 53";
19
+
target = "ACCEPT";
20
+
}
17
21
];
18
22
19
23
}
+1
-1
2configs/ipfs.nix
+1
-1
2configs/ipfs.nix
+81
-17
2configs/libvirt.nix
+81
-17
2configs/libvirt.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ lib, ... }:
2
2
3
3
{
4
4
virtualisation.libvirtd.enable = true;
5
5
security.polkit.enable = true;
6
6
7
7
krebs.iptables.tables.filter.INPUT.rules = [
8
-
{ v6 = false; predicate = "-i virbr0 -p udp -m udp --dport 53"; target = "ACCEPT"; }
9
-
{ v6 = false; predicate = "-i virbr0 -p tcp -m tcp --dport 53"; target = "ACCEPT"; }
10
-
{ v6 = false; predicate = "-i virbr0 -p udp -m udp --dport 67"; target = "ACCEPT"; }
11
-
{ v6 = false; predicate = "-i virbr0 -p tcp -m tcp --dport 67"; target = "ACCEPT"; }
8
+
{
9
+
v6 = false;
10
+
predicate = "-i virbr0 -p udp -m udp --dport 53";
11
+
target = "ACCEPT";
12
+
}
13
+
{
14
+
v6 = false;
15
+
predicate = "-i virbr0 -p tcp -m tcp --dport 53";
16
+
target = "ACCEPT";
17
+
}
18
+
{
19
+
v6 = false;
20
+
predicate = "-i virbr0 -p udp -m udp --dport 67";
21
+
target = "ACCEPT";
22
+
}
23
+
{
24
+
v6 = false;
25
+
predicate = "-i virbr0 -p tcp -m tcp --dport 67";
26
+
target = "ACCEPT";
27
+
}
12
28
];
13
29
krebs.iptables.tables.filter.FORWARD.rules = [
14
-
{ v6 = false; predicate = "-d 192.168.122.0/24 -o virbr0 -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
15
-
{ v6 = false; predicate = "-s 192.168.122.0/24 -i virbr0"; target = "ACCEPT"; }
16
-
{ v6 = false; predicate = "-i virbr0 -o virbr0"; target = "ACCEPT"; }
17
-
{ v6 = false; predicate = "-o virbr0"; target = "REJECT --reject-with icmp-port-unreachable"; }
18
-
{ v6 = false; predicate = "-i virbr0"; target = "REJECT --reject-with icmp-port-unreachable"; }
30
+
{
31
+
v6 = false;
32
+
predicate = "-d 192.168.122.0/24 -o virbr0 -m conntrack --ctstate RELATED,ESTABLISHED";
33
+
target = "ACCEPT";
34
+
}
35
+
{
36
+
v6 = false;
37
+
predicate = "-s 192.168.122.0/24 -i virbr0";
38
+
target = "ACCEPT";
39
+
}
40
+
{
41
+
v6 = false;
42
+
predicate = "-i virbr0 -o virbr0";
43
+
target = "ACCEPT";
44
+
}
45
+
{
46
+
v6 = false;
47
+
predicate = "-o virbr0";
48
+
target = "REJECT --reject-with icmp-port-unreachable";
49
+
}
50
+
{
51
+
v6 = false;
52
+
predicate = "-i virbr0";
53
+
target = "REJECT --reject-with icmp-port-unreachable";
54
+
}
19
55
];
20
56
krebs.iptables.tables.filter.OUTPUT.rules = [
21
-
{ v6 = false; predicate = "-o virbr0 -p udp -m udp --dport 68"; target = "ACCEPT"; }
57
+
{
58
+
v6 = false;
59
+
predicate = "-o virbr0 -p udp -m udp --dport 68";
60
+
target = "ACCEPT";
61
+
}
22
62
];
23
63
krebs.iptables.tables.nat.PREROUTING.rules = lib.mkBefore [
24
-
{ v6 = false; predicate = "-s 192.168.122.0/24"; target = "ACCEPT"; }
64
+
{
65
+
v6 = false;
66
+
predicate = "-s 192.168.122.0/24";
67
+
target = "ACCEPT";
68
+
}
25
69
];
26
70
krebs.iptables.tables.nat.POSTROUTING.rules = [
27
-
{ v6 = false; predicate = "-s 192.168.122.0/24 -d 224.0.0.0/24"; target = "RETURN"; }
28
-
{ v6 = false; predicate = "-s 192.168.122.0/24 -d 255.255.255.255"; target = "RETURN"; }
29
-
{ v6 = false; predicate = "-s 192.168.122.0/24 ! -d 192.168.122.0/24"; target = "MASQUERADE"; }
30
-
{ v6 = false; predicate = "-s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp"; target = "MASQUERADE --to-ports 1024-65535"; }
31
-
{ v6 = false; predicate = "-s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp"; target = "MASQUERADE --to-ports 1024-65535"; }
71
+
{
72
+
v6 = false;
73
+
predicate = "-s 192.168.122.0/24 -d 224.0.0.0/24";
74
+
target = "RETURN";
75
+
}
76
+
{
77
+
v6 = false;
78
+
predicate = "-s 192.168.122.0/24 -d 255.255.255.255";
79
+
target = "RETURN";
80
+
}
81
+
{
82
+
v6 = false;
83
+
predicate = "-s 192.168.122.0/24 ! -d 192.168.122.0/24";
84
+
target = "MASQUERADE";
85
+
}
86
+
{
87
+
v6 = false;
88
+
predicate = "-s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp";
89
+
target = "MASQUERADE --to-ports 1024-65535";
90
+
}
91
+
{
92
+
v6 = false;
93
+
predicate = "-s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp";
94
+
target = "MASQUERADE --to-ports 1024-65535";
95
+
}
32
96
];
33
97
}
+3
-2
2configs/livestream.nix
+3
-2
2configs/livestream.nix
+48
-14
2configs/mail.nix
+48
-14
2configs/mail.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ lib, pkgs, ... }:
2
2
3
3
let
4
4
···
69
69
dn42 = [ "to:dn42@lists.nox.tf" ];
70
70
eloop = [ "to:eloop.org" ];
71
71
github = [ "to:github@lassul.us" ];
72
-
gmail = [ "to:gmail@lassul.us" "to:lassulus@gmail.com" "lassulus@googlemail.com" ];
73
-
india = [ "to:hillhackers@lists.hillhacks.in" "to:hackbeach@lists.hackbeach.in" "to:hackbeach@mail.hackbeach.in" ];
74
-
kaosstuff = [ "to:gearbest@lassul.us" "to:banggood@lassul.us" "to:tomtop@lassul.us" ];
72
+
gmail = [
73
+
"to:gmail@lassul.us"
74
+
"to:lassulus@gmail.com"
75
+
"lassulus@googlemail.com"
76
+
];
77
+
india = [
78
+
"to:hillhackers@lists.hillhacks.in"
79
+
"to:hackbeach@lists.hackbeach.in"
80
+
"to:hackbeach@mail.hackbeach.in"
81
+
];
82
+
kaosstuff = [
83
+
"to:gearbest@lassul.us"
84
+
"to:banggood@lassul.us"
85
+
"to:tomtop@lassul.us"
86
+
];
75
87
lugs = [ "to:lugs@lug-s.org" ];
76
88
meetup = [ "to:meetup@lassul.us" ];
77
-
nix = [ "to:nix-devel@googlegroups.com" "to:nix@lassul.us" ];
89
+
nix = [
90
+
"to:nix-devel@googlegroups.com"
91
+
"to:nix@lassul.us"
92
+
];
78
93
patreon = [ "to:patreon@lassul.us" ];
79
94
paypal = [ "to:paypal@lassul.us" ];
80
95
ptl = [ "to:ptl@posttenebraslab.ch" ];
81
96
retiolum = [ "to:lass@mors.r" ];
82
97
security = [
83
-
"to:seclists.org" "to:bugtraq" "to:securityfocus@lassul.us"
98
+
"to:seclists.org"
99
+
"to:bugtraq"
100
+
"to:securityfocus@lassul.us"
84
101
"to:security-announce@lists.apple.com"
85
102
];
86
103
shack = [ "to:shackspace.de" ];
87
104
steam = [ "to:steam@lassul.us" ];
88
-
tinc = [ "to:tinc@tinc-vpn.org" "to:tinc-devel@tinc-vpn.org" ];
105
+
tinc = [
106
+
"to:tinc@tinc-vpn.org"
107
+
"to:tinc-devel@tinc-vpn.org"
108
+
];
89
109
wireguard = [ "to:wireguard@lists.zx2c4" ];
90
-
zzz = [ "to:pizza@lassul.us" "to:spam@krebsco.de" ];
110
+
zzz = [
111
+
"to:pizza@lassul.us"
112
+
"to:spam@krebsco.de"
113
+
];
91
114
};
92
115
93
116
tag-new-mails = pkgs.writeDashBin "nm-tag-init" ''
94
117
${pkgs.notmuch}/bin/notmuch new
95
118
${lib.concatMapStringsSep "\n" (i: ''
96
119
mkdir -p "$HOME/Maildir/.${i.name}/cur"
97
-
for mail in $(${pkgs.notmuch}/bin/notmuch search --output=files 'tag:inbox and (${lib.concatMapStringsSep " or " (f: "${f}") i.value})'); do
120
+
for mail in $(${pkgs.notmuch}/bin/notmuch search --output=files 'tag:inbox and (${
121
+
lib.concatMapStringsSep " or " (f: "${f}") i.value
122
+
})'); do
98
123
if test -e "$mail"; then
99
124
mv "$mail" "$HOME/Maildir/.${i.name}/cur/"
100
125
else
101
126
echo "$mail does not exist"
102
127
fi
103
128
done
104
-
${pkgs.notmuch}/bin/notmuch tag -inbox +${i.name} -- tag:inbox ${lib.concatMapStringsSep " or " (f: "${f}") i.value}
129
+
${pkgs.notmuch}/bin/notmuch tag -inbox +${i.name} -- tag:inbox ${
130
+
lib.concatMapStringsSep " or " (f: "${f}") i.value
131
+
}
105
132
'') (lib.mapAttrsToList lib.nameValuePair mailboxes)}
106
133
${pkgs.notmuch}/bin/notmuch new
107
134
${pkgs.notmuch}/bin/notmuch dump > "$HOME/Maildir/notmuch.backup"
···
110
137
tag-old-mails = pkgs.writeDashBin "nm-tag-old" ''
111
138
set -efux
112
139
${lib.concatMapStringsSep "\n" (i: ''
113
-
${pkgs.notmuch}/bin/notmuch tag -inbox -archive +${i.name} -- ${lib.concatMapStringsSep " or " (f: "${f}") i.value}
140
+
${pkgs.notmuch}/bin/notmuch tag -inbox -archive +${i.name} -- ${
141
+
lib.concatMapStringsSep " or " (f: "${f}") i.value
142
+
}
114
143
mkdir -p "$HOME/Maildir/.${i.name}/cur"
115
-
for mail in $(${pkgs.notmuch}/bin/notmuch search --output=files ${lib.concatMapStringsSep " or " (f: "${f}") i.value}); do
144
+
for mail in $(${pkgs.notmuch}/bin/notmuch search --output=files ${
145
+
lib.concatMapStringsSep " or " (f: "${f}") i.value
146
+
}); do
116
147
if test -e "$mail"; then
117
148
mv "$mail" "$HOME/Maildir/.${i.name}/cur/"
118
149
else
···
151
182
152
183
virtual-mailboxes "Unread" "notmuch://?query=tag:unread"
153
184
virtual-mailboxes "INBOX" "notmuch://?query=tag:inbox"
154
-
${lib.concatMapStringsSep "\n" (i: ''${" "}virtual-mailboxes "${i.name}" "notmuch://?query=tag:${i.name}"'') (lib.mapAttrsToList lib.nameValuePair mailboxes)}
185
+
${lib.concatMapStringsSep "\n" (
186
+
i: ''${" "}virtual-mailboxes "${i.name}" "notmuch://?query=tag:${i.name}"''
187
+
) (lib.mapAttrsToList lib.nameValuePair mailboxes)}
155
188
virtual-mailboxes "TODO" "notmuch://?query=tag:TODO"
156
189
virtual-mailboxes "Starred" "notmuch://?query=tag:*"
157
190
virtual-mailboxes "Archive" "notmuch://?query=tag:archive"
···
261
294
];
262
295
};
263
296
264
-
in {
297
+
in
298
+
{
265
299
environment.variables.NOTMUCH_CONFIG = toString notmuch-config;
266
300
environment.systemPackages = [
267
301
msmtp
+7
-5
2configs/mc.nix
+7
-5
2configs/mc.nix
···
1
-
{ config, pkgs, ... }:
1
+
{ pkgs, ... }:
2
2
3
3
let
4
4
mcExt = pkgs.writeText "mc.ext" ''
···
205
205
View=/run/current-system/sw/bin/xdg-open %f
206
206
'';
207
207
208
-
in {
208
+
in
209
+
{
209
210
environment.systemPackages = [
210
211
(pkgs.symlinkJoin {
211
212
name = "mc";
212
213
paths = [
213
214
(pkgs.writeDashBin "mc" ''
214
-
export MC_DATADIR=${pkgs.write "mc-ext" {
215
+
export MC_DATADIR=${
216
+
pkgs.write "mc-ext" {
215
217
"/mc.ext.ini".link = mcExt;
216
218
"/sfs.ini".text = "";
217
-
}};
219
+
}
220
+
};
218
221
export TERM=xterm-256color
219
222
exec ${pkgs.mc}/bin/mc -S nicedark "$@"
220
223
'')
···
223
226
})
224
227
];
225
228
}
226
-
+1
-1
2configs/minecraft.nix
+1
-1
2configs/minecraft.nix
+10
-5
2configs/minetest.nix
+10
-5
2configs/minetest.nix
···
1
-
{ pkgs, ... }: let
2
-
3
-
in {
1
+
{ ... }:
2
+
{
4
3
services.minetest-server = {
5
4
enable = true;
6
5
};
7
6
krebs.iptables.tables.filter.INPUT.rules = [
8
-
{ predicate = "-p tcp --dport 30000"; target = "ACCEPT"; }
9
-
{ predicate = "-p udp --dport 30000"; target = "ACCEPT"; }
7
+
{
8
+
predicate = "-p tcp --dport 30000";
9
+
target = "ACCEPT";
10
+
}
11
+
{
12
+
predicate = "-p udp --dport 30000";
13
+
target = "ACCEPT";
14
+
}
10
15
];
11
16
}
+12
-9
2configs/mpv.nix
+12
-9
2configs/mpv.nix
···
1
-
{ pkgs, lib, ... }:
1
+
{ pkgs, ... }:
2
2
3
3
let
4
4
dl_subs = pkgs.writers.writeDashBin "dl_subs" ''
···
55
55
Y_RES=1081
56
56
# we need to disable sponsorblock local database because of
57
57
# https://github.com/po5/mpv_sponsorblock/issues/31
58
-
exec ${pkgs.mpv.override {
59
-
scripts = with pkgs.mpvScripts; [
60
-
sponsorblock
61
-
quality-menu
62
-
vr-reversal
63
-
];
64
-
}}/bin/mpv \
58
+
exec ${
59
+
pkgs.mpv.override {
60
+
scripts = with pkgs.mpvScripts; [
61
+
sponsorblock
62
+
quality-menu
63
+
vr-reversal
64
+
];
65
+
}
66
+
}/bin/mpv \
65
67
--no-config \
66
68
--input-conf=${mpvInput} \
67
69
--include=${mpvConfig} \
···
76
78
];
77
79
};
78
80
79
-
in {
81
+
in
82
+
{
80
83
environment.systemPackages = [
81
84
mpv
82
85
dl_subs
+36
-34
2configs/muchsync.nix
+36
-34
2configs/muchsync.nix
···
1
1
{ config, pkgs, ... }:
2
2
3
3
{
4
-
systemd.services.muchsync = let
5
-
hosts = [
6
-
"coaxmetal.r"
7
-
"mors.r"
8
-
"green.r"
9
-
];
10
-
in {
11
-
description = "sync mails";
12
-
environment = {
13
-
NOTMUCH_CONFIG = config.environment.variables.NOTMUCH_CONFIG;
4
+
systemd.services.muchsync =
5
+
let
6
+
hosts = [
7
+
"coaxmetal.r"
8
+
"mors.r"
9
+
"green.r"
10
+
];
11
+
in
12
+
{
13
+
description = "sync mails";
14
+
environment = {
15
+
NOTMUCH_CONFIG = config.environment.variables.NOTMUCH_CONFIG;
16
+
};
17
+
after = [ "network.target" ];
18
+
19
+
restartIfChanged = false;
20
+
21
+
path = [
22
+
pkgs.notmuch
23
+
pkgs.openssh
24
+
];
25
+
26
+
startAt = "*:*"; # run every minute
27
+
serviceConfig = {
28
+
User = "lass";
29
+
Type = "oneshot";
30
+
ExecStart = pkgs.writeDash "sync-mails" ''
31
+
set -euf
32
+
33
+
/run/current-system/sw/bin/nm-tag-init 2>/dev/null
34
+
${concatMapStringsSep "\n" (host: ''
35
+
echo syncing ${host}:
36
+
${pkgs.muchsync}/bin/muchsync -s 'ssh -CTaxq -o ConnectTimeout=4' --nonew lass@${host} || :
37
+
'') hosts}
38
+
'';
39
+
};
14
40
};
15
-
after = [ "network.target" ];
16
-
17
-
restartIfChanged = false;
18
-
19
-
path = [
20
-
pkgs.notmuch
21
-
pkgs.openssh
22
-
];
23
-
24
-
startAt = "*:*"; # run every minute
25
-
serviceConfig = {
26
-
User = "lass";
27
-
Type = "oneshot";
28
-
ExecStart = pkgs.writeDash "sync-mails" ''
29
-
set -euf
30
-
31
-
/run/current-system/sw/bin/nm-tag-init 2>/dev/null
32
-
${concatMapStringsSep "\n" (host: ''
33
-
echo syncing ${host}:
34
-
${pkgs.muchsync}/bin/muchsync -s 'ssh -CTaxq -o ConnectTimeout=4' --nonew lass@${host} || :
35
-
'') hosts}
36
-
'';
37
-
};
38
-
};
39
41
}
+22
-12
2configs/mumble-reminder.nix
+22
-12
2configs/mumble-reminder.nix
···
1
-
{ self, config, lib, pkgs, ... }: let
2
-
write_to_irc = chan: pkgs.writeDash "write_to_irc" ''
3
-
${pkgs.curl}/bin/curl -fsSv --unix-socket '${lib.removePrefix "unix:" config.krebs.reaktor2.mumble-reminder.API.listen}' http://z/ \
4
-
-H content-type:application/json \
5
-
-d "$(${pkgs.jq}/bin/jq -n \
6
-
--arg text "$1" '{
7
-
command:"PRIVMSG",
8
-
params:["${chan}",$text]
9
-
}'
10
-
)"
11
-
'';
1
+
{
2
+
self,
3
+
config,
4
+
lib,
5
+
pkgs,
6
+
...
7
+
}:
8
+
let
9
+
write_to_irc =
10
+
chan:
11
+
pkgs.writeDash "write_to_irc" ''
12
+
${pkgs.curl}/bin/curl -fsSv --unix-socket '${lib.removePrefix "unix:" config.krebs.reaktor2.mumble-reminder.API.listen}' http://z/ \
13
+
-H content-type:application/json \
14
+
-d "$(${pkgs.jq}/bin/jq -n \
15
+
--arg text "$1" '{
16
+
command:"PRIVMSG",
17
+
params:["${chan}",$text]
18
+
}'
19
+
)"
20
+
'';
12
21
animals = ''
13
22
Erdferkel
14
23
Paviane
···
62
71
};
63
72
};
64
73
65
-
in {
74
+
in
75
+
{
66
76
imports = [
67
77
self.inputs.stockholm.nixosModules.reaktor2
68
78
];
+9
-3
2configs/murmur.nix
+9
-3
2configs/murmur.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ lib, ... }:
2
2
{
3
3
services.murmur = {
4
4
enable = true;
···
8
8
autobanTime = 30;
9
9
};
10
10
krebs.iptables.tables.filter.INPUT.rules = [
11
-
{ predicate = "-p tcp --dport 64738"; target = "ACCEPT";}
12
-
{ predicate = "-p udp --dport 64738"; target = "ACCEPT";}
11
+
{
12
+
predicate = "-p tcp --dport 64738";
13
+
target = "ACCEPT";
14
+
}
15
+
{
16
+
predicate = "-p udp --dport 64738";
17
+
target = "ACCEPT";
18
+
}
13
19
];
14
20
15
21
systemd.services.docker-mumble-web.serviceConfig = {
+5
-1
2configs/nether.nix
+5
-1
2configs/nether.nix
+6
-1
2configs/network-manager.nix
+6
-1
2configs/network-manager.nix
+1
-1
2configs/networkd.nix
+1
-1
2configs/networkd.nix
+4
-1
2configs/nginx.nix
+4
-1
2configs/nginx.nix
+1
-1
2configs/otp-ssh.nix
+1
-1
2configs/otp-ssh.nix
+6
-2
2configs/pair-programming.nix
+6
-2
2configs/pair-programming.nix
···
1
-
{ self, config, pkgs, ... }:
1
+
{
2
+
self,
3
+
config,
4
+
pkgs,
5
+
...
6
+
}:
2
7
{
3
8
users.users.pairprogramming = {
4
9
uid = self.inputs.stockholm.lib.genid_uint31 "pairprogramming";
···
15
20
};
16
21
17
22
virtualisation.podman.enable = true;
18
-
19
23
20
24
environment.systemPackages = [
21
25
pkgs.ripgrep
+1
-1
2configs/pass.nix
+1
-1
2configs/pass.nix
+56
-40
2configs/paste.nix
+56
-40
2configs/paste.nix
···
1
-
{ config, lib, pkgs, self, ... }:
1
+
{
2
+
config,
3
+
lib,
4
+
pkgs,
5
+
self,
6
+
...
7
+
}:
2
8
3
9
{
4
10
imports = [
···
23
29
proxy_set_header Host $host;
24
30
proxy_pass http://127.0.0.1:${toString config.krebs.htgen.paste.port};
25
31
'';
26
-
locations."/image".extraConfig = /* nginx */ ''
27
-
client_max_body_size 40M;
32
+
locations."/image".extraConfig = # nginx
33
+
''
34
+
client_max_body_size 40M;
28
35
29
-
proxy_set_header Host $host;
30
-
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
31
-
proxy_set_header X-Forwarded-Proto $scheme;
36
+
proxy_set_header Host $host;
37
+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
38
+
proxy_set_header X-Forwarded-Proto $scheme;
32
39
33
-
proxy_pass http://127.0.0.1:${toString config.krebs.htgen.imgur.port};
34
-
proxy_pass_header Server;
35
-
'';
40
+
proxy_pass http://127.0.0.1:${toString config.krebs.htgen.imgur.port};
41
+
proxy_pass_header Server;
42
+
'';
36
43
extraConfig = ''
37
44
add_header 'Access-Control-Allow-Origin' '*';
38
45
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
···
89
96
90
97
krebs.htgen.paste = {
91
98
port = 9081;
92
-
script = /* sh */ ''
93
-
(. ${pkgs.htgen-paste}/bin/htgen-paste)
94
-
'';
99
+
script = # sh
100
+
''
101
+
(. ${pkgs.htgen-paste}/bin/htgen-paste)
102
+
'';
95
103
};
96
104
97
105
systemd.services.paste-gc = {
···
106
114
107
115
krebs.htgen.paste-form = {
108
116
port = 7770;
109
-
script = /* sh */ ''
110
-
export PATH=${lib.makeBinPath [
111
-
pkgs.curl
112
-
pkgs.gnused
113
-
]}:$PATH
114
-
(. ${pkgs.writeScript "paste-form" ''
115
-
case "$Method" in
116
-
'POST')
117
-
ref=$(head -c $req_content_length | sed '0,/^\r$/d;$d' | curl -fSs --data-binary @- https://p.krebsco.de | sed '1d;s/^http:/https:/')
117
+
script = # sh
118
+
''
119
+
export PATH=${
120
+
lib.makeBinPath [
121
+
pkgs.curl
122
+
pkgs.gnused
123
+
]
124
+
}:$PATH
125
+
(. ${pkgs.writeScript "paste-form" ''
126
+
case "$Method" in
127
+
'POST')
128
+
ref=$(head -c $req_content_length | sed '0,/^\r$/d;$d' | curl -fSs --data-binary @- https://p.krebsco.de | sed '1d;s/^http:/https:/')
118
129
119
-
printf 'HTTP/1.1 200 OK\r\n'
120
-
printf 'Content-Type: text/plain; charset=UTF-8\r\n'
121
-
printf 'Server: %s\r\n' "$Server"
122
-
printf 'Connection: close\r\n'
123
-
printf 'Content-Length: %d\r\n' $(expr ''${#ref} + 1)
124
-
printf '\r\n'
125
-
printf '%s\n' "$ref"
130
+
printf 'HTTP/1.1 200 OK\r\n'
131
+
printf 'Content-Type: text/plain; charset=UTF-8\r\n'
132
+
printf 'Server: %s\r\n' "$Server"
133
+
printf 'Connection: close\r\n'
134
+
printf 'Content-Length: %d\r\n' $(expr ''${#ref} + 1)
135
+
printf '\r\n'
136
+
printf '%s\n' "$ref"
126
137
127
-
exit
128
-
;;
129
-
esac
130
-
''})
131
-
'';
138
+
exit
139
+
;;
140
+
esac
141
+
''})
142
+
'';
132
143
};
133
144
krebs.htgen.imgur = {
134
145
port = 7771;
135
-
script = /* sh */ ''
136
-
(. ${pkgs.htgen-imgur}/bin/htgen-imgur)
137
-
'';
146
+
script = # sh
147
+
''
148
+
(. ${pkgs.htgen-imgur}/bin/htgen-imgur)
149
+
'';
138
150
};
139
151
krebs.htgen.cyberlocker = {
140
152
port = 7772;
141
-
script = /* sh */ ''
142
-
(. ${pkgs.htgen-cyberlocker}/bin/htgen-cyberlocker)
143
-
'';
153
+
script = # sh
154
+
''
155
+
(. ${pkgs.htgen-cyberlocker}/bin/htgen-cyberlocker)
156
+
'';
144
157
};
145
158
krebs.iptables.tables.filter.INPUT.rules = [
146
-
{ predicate = "-i retiolum -p tcp --dport 80"; target = "ACCEPT";}
159
+
{
160
+
predicate = "-i retiolum -p tcp --dport 80";
161
+
target = "ACCEPT";
162
+
}
147
163
];
148
164
}
+4
-2
2configs/power-action.nix
+4
-2
2configs/power-action.nix
···
5
5
${pkgs.systemd}/bin/systemctl suspend
6
6
'';
7
7
8
-
speak = text:
8
+
speak =
9
+
text:
9
10
pkgs.writers.writeDash "speak" ''
10
11
${pkgs.espeak}/bin/espeak -v +whisper -s 110 "${text}"
11
12
'';
12
13
13
-
in {
14
+
in
15
+
{
14
16
krebs.power-action = {
15
17
enable = true;
16
18
plans.low-battery = {
+10
-3
2configs/privoxy-retiolum.nix
+10
-3
2configs/privoxy-retiolum.nix
···
2
2
3
3
let
4
4
r_ip = config.krebs.build.host.nets.retiolum.ip4.addr;
5
-
in {
5
+
in
6
+
{
6
7
imports = [
7
8
./privoxy.nix
8
9
];
···
12
13
krebs.iptables = {
13
14
tables = {
14
15
filter.INPUT.rules = [
15
-
{ predicate = "-i retiolum -p tcp --dport 8118"; target = "ACCEPT"; }
16
-
{ predicate = "-i dns0 -p tcp --dport 8118"; target = "ACCEPT"; }
16
+
{
17
+
predicate = "-i retiolum -p tcp --dport 8118";
18
+
target = "ACCEPT";
19
+
}
20
+
{
21
+
predicate = "-i dns0 -p tcp --dport 8118";
22
+
target = "ACCEPT";
23
+
}
17
24
];
18
25
};
19
26
};
+1
-1
2configs/programs.nix
+1
-1
2configs/programs.nix
+8
-2
2configs/radicale.nix
+8
-2
2configs/radicale.nix
···
13
13
'';
14
14
};
15
15
krebs.iptables.tables.filter.INPUT.rules = [
16
-
{ predicate = "-i retiolum -p tcp --dport 5555"; target = "ACCEPT"; }
17
-
{ predicate = "-i wiregrill -p tcp --dport 5555"; target = "ACCEPT"; }
16
+
{
17
+
predicate = "-i retiolum -p tcp --dport 5555";
18
+
target = "ACCEPT";
19
+
}
20
+
{
21
+
predicate = "-i wiregrill -p tcp --dport 5555";
22
+
target = "ACCEPT";
23
+
}
18
24
];
19
25
#services.nginx.virtualHosts."lassul.us".locations."/radicale/".extraConfig = ''
20
26
# proxy_pass http://localhost:5555/; # The / is important!
+4
-3
2configs/reaktor-coders.nix
+4
-3
2configs/reaktor-coders.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ config, pkgs, ... }:
2
2
3
3
let
4
4
hooks = pkgs.reaktor2-plugins.hooks;
5
-
in {
5
+
in
6
+
{
6
7
krebs.reaktor2.coders = {
7
8
hostname = "irc.hackint.org";
8
9
port = "9999";
···
30
31
activate = "match";
31
32
pattern = ''^!([^ ]+)(?:\s*(.*))?'';
32
33
command = 1;
33
-
arguments = [2];
34
+
arguments = [ 2 ];
34
35
commands = {
35
36
ping.filename = pkgs.writeDash "ping" ''
36
37
exec /run/wrappers/bin/ping -q -c1 "$1" 2>&1 | tail -1
+10
-2
2configs/realwallpaper.nix
+10
-2
2configs/realwallpaper.nix
···
1
-
{ self, config, lib, pkgs, ... }:
1
+
{
2
+
self,
3
+
config,
4
+
pkgs,
5
+
...
6
+
}:
2
7
{
3
8
imports = [
4
9
self.inputs.stockholm.nixosModules.realwallpaper
···
41
46
krebs.iptables = {
42
47
tables = {
43
48
filter.INPUT.rules = [
44
-
{ predicate = "-i retiolum -p tcp --dport 80"; target = "ACCEPT"; }
49
+
{
50
+
predicate = "-i retiolum -p tcp --dport 80";
51
+
target = "ACCEPT";
52
+
}
45
53
];
46
54
};
47
55
};
+1
-1
2configs/rebuild-on-boot.nix
+1
-1
2configs/rebuild-on-boot.nix
+1
-5
2configs/red-host.nix
+1
-5
2configs/red-host.nix
+1
-1
2configs/retiolum.nix
+1
-1
2configs/retiolum.nix
+2
-1
2configs/review.nix
+2
-1
2configs/review.nix
+28
-7
2configs/riot.nix
+28
-7
2configs/riot.nix
···
1
-
{ self, config, lib, pkgs, ... }: let
1
+
{
2
+
self,
3
+
config,
4
+
lib,
5
+
pkgs,
6
+
...
7
+
}:
8
+
let
2
9
domains = [
3
10
"hackerfleet.eu"
4
11
"hackerfleet.de"
5
12
];
6
-
in {
13
+
in
14
+
{
7
15
imports = [
8
16
self.inputs.stockholm.nixosModules.exim-smarthost
9
17
];
···
60
68
boot.kernel.sysctl."net.ipv4.ip_forward" = lib.mkDefault 1;
61
69
62
70
krebs.iptables.tables.nat.POSTROUTING.rules = [
63
-
{ v6 = false; predicate = "-s ${config.containers.riot.localAddress}"; target = "MASQUERADE"; }
71
+
{
72
+
v6 = false;
73
+
predicate = "-s ${config.containers.riot.localAddress}";
74
+
target = "MASQUERADE";
75
+
}
64
76
];
65
77
66
78
# networking.nat can be used instead of this
67
79
krebs.iptables.tables.nat.PREROUTING.rules = [
68
-
{ predicate = "-p tcp --dport 45622"; target = "DNAT --to-destination ${config.containers.riot.localAddress}:22"; v6 = false; }
80
+
{
81
+
predicate = "-p tcp --dport 45622";
82
+
target = "DNAT --to-destination ${config.containers.riot.localAddress}:22";
83
+
v6 = false;
84
+
}
69
85
];
70
86
krebs.iptables.tables.filter.FORWARD.rules = [
71
-
{ predicate = "-i ve-riot"; target = "ACCEPT"; }
72
-
{ predicate = "-o ve-riot"; target = "ACCEPT"; }
87
+
{
88
+
predicate = "-i ve-riot";
89
+
target = "ACCEPT";
90
+
}
91
+
{
92
+
predicate = "-o ve-riot";
93
+
target = "ACCEPT";
94
+
}
73
95
];
74
-
75
96
76
97
# non container stuff
77
98
+10
-7
2configs/searx.nix
+10
-7
2configs/searx.nix
···
1
1
{ pkgs, ... }:
2
2
let
3
3
port = 8889;
4
-
in {
4
+
in
5
+
{
5
6
services.nginx.virtualHosts.search = {
6
7
serverAliases = [ "search.r" ];
7
8
locations."/".extraConfig = ''
···
12
13
13
14
services.searx = {
14
15
enable = true;
15
-
configFile = pkgs.writeText "searx.cfg" (builtins.toJSON {
16
-
use_default_settings = true;
17
-
server = {
18
-
port = port;
19
-
};
20
-
});
16
+
configFile = pkgs.writeText "searx.cfg" (
17
+
builtins.toJSON {
18
+
use_default_settings = true;
19
+
server = {
20
+
port = port;
21
+
};
22
+
}
23
+
);
21
24
};
22
25
}
+5
-3
2configs/security-workarounds.nix
+5
-3
2configs/security-workarounds.nix
···
1
1
{
2
-
imports = [
3
-
{ # CVE-2024-3094
2
+
imports = [
3
+
{
4
+
# CVE-2024-3094
4
5
# https://www.openwall.com/lists/oss-security/2024/03/29/4
5
6
# https://github.com/NixOS/nixpkgs/pull/300028
6
7
# NixOS is not affected
7
8
}
8
-
{ # CVE-2024-6387
9
+
{
10
+
# CVE-2024-6387
9
11
# https://github.com/NixOS/nixpkgs/pull/323753#issuecomment-2199762128
10
12
services.openssh.settings.LoginGraceTime = 0;
11
13
}
+3
-2
2configs/shadowsocks.nix
+3
-2
2configs/shadowsocks.nix
···
1
-
{ config, pkgs, ... }: {
1
+
{ config, pkgs, ... }:
2
+
{
2
3
services.shadowsocks = {
3
4
enable = true;
4
5
passwordFile = config.clanCore.facts.services.shadowsocks.secret.shadowsocks_password.path;
···
6
7
networking.firewall.allowedTCPPorts = [ 8388 ];
7
8
clanCore.facts.services.shadowsocks = {
8
9
secret."shadowsocks_password" = { };
9
-
generator = {
10
+
generator = {
10
11
prompt = "please enter your shadowsocks password";
11
12
path = with pkgs; [
12
13
coreutils
+1
-1
2configs/smartd.nix
+1
-1
2configs/smartd.nix
+1
-1
2configs/snapclient.nix
+1
-1
2configs/snapclient.nix
+6
-2
2configs/snapserver.nix
+6
-2
2configs/snapserver.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ pkgs, ... }:
2
2
{
3
3
services.snapserver = {
4
4
enable = true;
···
25
25
http.enable = true;
26
26
};
27
27
28
-
networking.firewall.interfaces.int0.allowedTCPPorts = [ 1704 1705 1780 ];
28
+
networking.firewall.interfaces.int0.allowedTCPPorts = [
29
+
1704
30
+
1705
31
+
1780
32
+
];
29
33
networking.firewall.interfaces.retiolum.allowedTCPPorts = [ 1780 ];
30
34
}
+8
-3
2configs/spora.nix
+8
-3
2configs/spora.nix
···
1
-
{ self, config, pkgs, ... }:
1
+
{
2
+
self,
3
+
config,
4
+
pkgs,
5
+
...
6
+
}:
2
7
{
3
8
imports = [
4
9
self.inputs.spora.nixosModules.spora
···
18
23
secret."mycelium_key" = { };
19
24
public."mycelium_ip" = { };
20
25
public."mycelium_pubkey" = { };
21
-
generator = {
26
+
generator = {
22
27
path = [
23
-
pkgs.mycelium
28
+
pkgs.mycelium
24
29
pkgs.coreutils
25
30
pkgs.jq
26
31
];
+20
-5
2configs/ssh-redirect.nix
+20
-5
2configs/ssh-redirect.nix
···
3
3
enable = true;
4
4
tables = {
5
5
nat.PREROUTING.rules = [
6
-
{ predicate = "-i retiolum -p tcp -m tcp --dport 22"; target = "ACCEPT"; }
7
-
{ predicate = "-i wiregrill -p tcp -m tcp --dport 22"; target = "ACCEPT"; }
8
-
{ predicate = "-p tcp -m tcp --dport 22"; target = "REDIRECT --to-ports 0"; }
9
-
{ predicate = "-p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; }
6
+
{
7
+
predicate = "-i retiolum -p tcp -m tcp --dport 22";
8
+
target = "ACCEPT";
9
+
}
10
+
{
11
+
predicate = "-i wiregrill -p tcp -m tcp --dport 22";
12
+
target = "ACCEPT";
13
+
}
14
+
{
15
+
predicate = "-p tcp -m tcp --dport 22";
16
+
target = "REDIRECT --to-ports 0";
17
+
}
18
+
{
19
+
predicate = "-p tcp -m tcp --dport 45621";
20
+
target = "REDIRECT --to-ports 22";
21
+
}
10
22
];
11
23
nat.OUTPUT.rules = [
12
-
{ predicate = "-o lo -p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; }
24
+
{
25
+
predicate = "-o lo -p tcp -m tcp --dport 45621";
26
+
target = "REDIRECT --to-ports 22";
27
+
}
13
28
];
14
29
};
15
30
};
+5
-4
2configs/starcraft.nix
+5
-4
2configs/starcraft.nix
···
1
-
{ config, pkgs, ... }: let
1
+
{ config, pkgs, ... }:
2
+
let
2
3
mainUser = config.users.extraUsers.mainUser;
3
-
in {
4
-
users.users= {
4
+
in
5
+
{
6
+
users.users = {
5
7
starcraft = {
6
8
isNormalUser = true;
7
9
extraGroups = [
···
19
21
${mainUser.name} ALL=(starcraft) NOPASSWD: ALL
20
22
'';
21
23
}
22
-
+25
-12
2configs/steam.nix
+25
-12
2configs/steam.nix
···
6
6
remotePlay.openFirewall = true; # Open ports in the firewall for Steam Remote Play
7
7
dedicatedServer.openFirewall = true; # Open ports in the firewall for Source Dedicated Server
8
8
package = pkgs.steam.override {
9
-
extraPkgs = (pkgs: with pkgs; [
10
-
gamemode
11
-
xorg.libXcursor xorg.libXi xorg.libXinerama xorg.libXScrnSaver
12
-
libpng libpulseaudio libvorbis stdenv.cc.cc.lib
13
-
libkrb5 keyutils
14
-
# additional packages...
15
-
# e.g. some games require python3
16
-
]);
17
-
# extraLibraries = pkgs: [ pkgs.gperftools ];
9
+
extraPkgs = (
10
+
pkgs: with pkgs; [
11
+
gamemode
12
+
xorg.libXcursor
13
+
xorg.libXi
14
+
xorg.libXinerama
15
+
xorg.libXScrnSaver
16
+
libpng
17
+
libpulseaudio
18
+
libvorbis
19
+
stdenv.cc.cc.lib
20
+
libkrb5
21
+
keyutils
22
+
# additional packages...
23
+
# e.g. some games require python3
24
+
]
25
+
);
26
+
# extraLibraries = pkgs: [ pkgs.gperftools ];
18
27
# - Automatically enable gamemode whenever Steam is running
19
28
# -- NOTE: Assumes that a working system install of gamemode already exists!
20
-
extraProfile = let gmLib = "${lib.getLib(pkgs.gamemode)}/lib"; in ''
21
-
export LD_LIBRARY_PATH="${gmLib}:$LD_LIBRARY_PATH"
22
-
'';
29
+
extraProfile =
30
+
let
31
+
gmLib = "${lib.getLib (pkgs.gamemode)}/lib";
32
+
in
33
+
''
34
+
export LD_LIBRARY_PATH="${gmLib}:$LD_LIBRARY_PATH"
35
+
'';
23
36
};
24
37
};
25
38
+2
-1
2configs/sunshine.nix
+2
-1
2configs/sunshine.nix
+39
-11
2configs/syncthing.nix
+39
-11
2configs/syncthing.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{
2
+
config,
3
+
lib,
4
+
pkgs,
5
+
...
6
+
}:
2
7
let
3
8
4
9
shares = {
5
-
"/home/lass/sync" = [ "mors" "green" "coaxmetal" "ignavia" ]; # TODO add aergia
6
-
"/home/lass/tmp/the_playlist" = [ "mors" "prism" "radio" ];
10
+
"/home/lass/sync" = [
11
+
"mors"
12
+
"green"
13
+
"coaxmetal"
14
+
"ignavia"
15
+
]; # TODO add aergia
16
+
"/home/lass/tmp/the_playlist" = [
17
+
"mors"
18
+
"prism"
19
+
"radio"
20
+
];
7
21
# "/home/lass/.weechat" = [ "green" "mors" ];
8
-
"/home/lass/decsync" = [ "mors" "green" "massulus" "massulus2" ];
22
+
"/home/lass/decsync" = [
23
+
"mors"
24
+
"green"
25
+
"massulus"
26
+
"massulus2"
27
+
];
9
28
};
10
29
11
-
machine_peers = lib.foldr (host: acc:
30
+
machine_peers = lib.foldr (
31
+
host: acc:
12
32
if builtins.pathExists ../machines/${host}/facts/syncthing.pub then
13
-
acc // { ${host}.id = lib.removeSuffix "\n" (builtins.readFile ../machines/${host}/facts/syncthing.pub); }
33
+
acc
34
+
// {
35
+
${host}.id = lib.removeSuffix "\n" (builtins.readFile ../machines/${host}/facts/syncthing.pub);
36
+
}
14
37
else
15
-
acc
16
-
) {} (lib.attrNames (builtins.readDir ../machines));
38
+
acc
39
+
) { } (lib.attrNames (builtins.readDir ../machines));
17
40
18
41
all_peers = machine_peers // {
19
42
"massulus".id = "R2EGJ5S-PQMETUP-C2UGXQG-A6VP7TB-NGSN3MV-C7OGSWT-SZ34L3X-H6IF6AQ";
20
43
"massulus2".id = "OTJBJNO-VHBCVDL-QSELUS7-S6JDMYR-7WLE36A-6XSRSLP-VKYOYJJ-AHFGZAG";
21
44
};
22
45
23
-
used_peer_names = lib.unique (lib.filter lib.isString (lib.flatten (lib.mapAttrsToList (n: v: v.devices) config.services.syncthing.settings.folders)));
24
-
used_peers = lib.filterAttrs (n: v: lib.elem n used_peer_names) all_peers;
25
-
in {
46
+
used_peer_names = lib.unique (
47
+
lib.filter lib.isString (
48
+
lib.flatten (lib.mapAttrsToList (_n: v: v.devices) config.services.syncthing.settings.folders)
49
+
)
50
+
);
51
+
used_peers = lib.filterAttrs (n: _v: lib.elem n used_peer_names) all_peers;
52
+
in
53
+
{
26
54
services.syncthing = {
27
55
enable = true;
28
56
group = "syncthing";
+2
-3
2configs/terraria.nix
+2
-3
2configs/terraria.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ ... }:
2
2
{
3
3
services.terraria = {
4
4
enable = true;
5
5
openFirewall = true;
6
6
};
7
7
8
-
users.groups.terraria = {};
8
+
users.groups.terraria = { };
9
9
users.users.terraria.group = "terraria";
10
10
11
11
# mobile
···
18
18
# });
19
19
# };
20
20
}
21
-
+1
-1
2configs/testi-host.nix
+1
-1
2configs/testi-host.nix
+8
-6
2configs/texlive.nix
+8
-6
2configs/texlive.nix
···
2
2
3
3
{
4
4
environment.systemPackages = with pkgs; [
5
-
(texLiveAggregationFun { paths = [
6
-
texLive
7
-
texLiveExtra
8
-
texLiveCMSuper
9
-
texLiveModerncv
10
-
];})
5
+
(texLiveAggregationFun {
6
+
paths = [
7
+
texLive
8
+
texLiveExtra
9
+
texLiveCMSuper
10
+
texLiveModerncv
11
+
];
12
+
})
11
13
];
12
14
}
+22
-20
2configs/themes.nix
+22
-20
2configs/themes.nix
···
1
-
{ config, lib, pkgs, ... }: let
1
+
{ pkgs, ... }:
2
+
let
2
3
3
-
switch-theme = pkgs.writers.writeDashBin "switch-theme" ''
4
-
set -efux
5
-
if [ "$1" = toggle ]; then
6
-
if [ "$(${pkgs.coreutils}/bin/cat /var/theme/current_theme)" = dark ]; then
7
-
${placeholder "out"}/bin/switch-theme light
8
-
else
9
-
${placeholder "out"}/bin/switch-theme dark
10
-
fi
11
-
elif test -e "/etc/themes/$1"; then
12
-
${pkgs.coreutils}/bin/mkdir -p /var/theme/config
13
-
${pkgs.rsync}/bin/rsync --chown=lass:users -a --delete "/etc/themes/$1/" /var/theme/config/
14
-
echo "$1" > /var/theme/current_theme
15
-
${pkgs.coreutils}/bin/chown lass:users /var/theme/current_theme
16
-
${pkgs.xorg.xrdb}/bin/xrdb -merge /var/theme/config/xresources || : # wayland has no xresources
17
-
${pkgs.procps}/bin/pkill -HUP xsettingsd || :
18
-
${pkgs.glib}/bin/gsettings set org.gnome.desktop.interface gtk-theme "$(cat /var/theme/config/gtk-theme)" || :
4
+
switch-theme = pkgs.writers.writeDashBin "switch-theme" ''
5
+
set -efux
6
+
if [ "$1" = toggle ]; then
7
+
if [ "$(${pkgs.coreutils}/bin/cat /var/theme/current_theme)" = dark ]; then
8
+
${placeholder "out"}/bin/switch-theme light
19
9
else
20
-
echo "theme $1 not found"
10
+
${placeholder "out"}/bin/switch-theme dark
21
11
fi
22
-
'';
12
+
elif test -e "/etc/themes/$1"; then
13
+
${pkgs.coreutils}/bin/mkdir -p /var/theme/config
14
+
${pkgs.rsync}/bin/rsync --chown=lass:users -a --delete "/etc/themes/$1/" /var/theme/config/
15
+
echo "$1" > /var/theme/current_theme
16
+
${pkgs.coreutils}/bin/chown lass:users /var/theme/current_theme
17
+
${pkgs.xorg.xrdb}/bin/xrdb -merge /var/theme/config/xresources || : # wayland has no xresources
18
+
${pkgs.procps}/bin/pkill -HUP xsettingsd || :
19
+
${pkgs.glib}/bin/gsettings set org.gnome.desktop.interface gtk-theme "$(cat /var/theme/config/gtk-theme)" || :
20
+
else
21
+
echo "theme $1 not found"
22
+
fi
23
+
'';
23
24
24
-
in {
25
+
in
26
+
{
25
27
systemd.tmpfiles.rules = [
26
28
"d /var/theme/ 755 lass users"
27
29
];
+24
-21
2configs/tor-initrd.nix
+24
-21
2configs/tor-initrd.nix
···
1
-
{config, pkgs, ... }:
1
+
{ config, pkgs, ... }:
2
2
## unlock command:
3
3
# (pass admin/$host/root;echo) | torify ssh root@$(pass hosts/$host/initrd/hostname) 'cat > /crypt-ramfs/passphrase'
4
4
{
···
24
24
'';
25
25
26
26
# start tor during boot process
27
-
boot.initrd.network.postCommands = let
28
-
torRc = (pkgs.writeText "tor.rc" ''
29
-
DataDirectory /etc/tor
30
-
SOCKSPort 127.0.0.1:9050 IsolateDestAddr
31
-
SOCKSPort 127.0.0.1:9063
32
-
HiddenServiceDir /etc/tor/onion/bootup
33
-
HiddenServicePort 22 127.0.0.1:22
34
-
'');
35
-
in ''
36
-
echo "tor: preparing onion folder"
37
-
# have to do this otherwise tor does not want to start
38
-
chmod -R 700 /etc/tor
27
+
boot.initrd.network.postCommands =
28
+
let
29
+
torRc = (
30
+
pkgs.writeText "tor.rc" ''
31
+
DataDirectory /etc/tor
32
+
SOCKSPort 127.0.0.1:9050 IsolateDestAddr
33
+
SOCKSPort 127.0.0.1:9063
34
+
HiddenServiceDir /etc/tor/onion/bootup
35
+
HiddenServicePort 22 127.0.0.1:22
36
+
''
37
+
);
38
+
in
39
+
''
40
+
echo "tor: preparing onion folder"
41
+
# have to do this otherwise tor does not want to start
42
+
chmod -R 700 /etc/tor
39
43
40
-
echo "make sure localhost is up"
41
-
ip a a 127.0.0.1/8 dev lo
42
-
ip link set lo up
44
+
echo "make sure localhost is up"
45
+
ip a a 127.0.0.1/8 dev lo
46
+
ip link set lo up
43
47
44
-
echo "tor: starting tor"
45
-
tor -f ${torRc} --verify-config
46
-
tor -f ${torRc} &
47
-
'';
48
+
echo "tor: starting tor"
49
+
tor -f ${torRc} --verify-config
50
+
tor -f ${torRc} &
51
+
'';
48
52
}
49
-
+7
-6
2configs/tor-ssh.nix
+7
-6
2configs/tor-ssh.nix
···
1
-
{ config, pkgs, ... }:
1
+
{ config, pkgs, ... }:
2
2
{
3
3
services.tor = {
4
4
enable = true;
5
5
relay.onionServices.ssh = {
6
6
version = 3;
7
-
map = [{
8
-
port = 22;
9
-
target.port = 22;
10
-
}];
7
+
map = [
8
+
{
9
+
port = 22;
10
+
target.port = 22;
11
+
}
12
+
];
11
13
secretKey = "${config.krebs.secret.directory}/ssh-tor.priv";
12
14
};
13
15
controlSocket.enable = true;
···
28
30
'';
29
31
};
30
32
}
31
-
+65
-52
2configs/tv.nix
+65
-52
2configs/tv.nix
···
1
-
{ config, pkgs, ... }: let
1
+
{ config, pkgs, ... }:
2
+
let
2
3
3
-
nginxCfg = pkgs.writeText "nginx.conf" ''
4
-
daemon off;
5
-
pid /var/lib/rtmp/nginx.pid;
6
-
events {
7
-
use epoll;
8
-
worker_connections 128;
9
-
}
10
-
error_log stderr info;
4
+
nginxCfg = pkgs.writeText "nginx.conf" ''
5
+
daemon off;
6
+
pid /var/lib/rtmp/nginx.pid;
7
+
events {
8
+
use epoll;
9
+
worker_connections 128;
10
+
}
11
+
error_log stderr info;
11
12
12
-
http {
13
-
client_body_temp_path /var/lib/rtmp/nginx_cache_client_body;
14
-
proxy_temp_path /var/lib/rtmp/nginx_cache_proxy;
15
-
fastcgi_temp_path /var/lib/rtmp/nginx_cache_fastcgi;
16
-
uwsgi_temp_path /var/lib/rtmp/nginx_cache_uwsgi;
17
-
scgi_temp_path /var/lib/rtmp/nginx_cache_scgi;
13
+
http {
14
+
client_body_temp_path /var/lib/rtmp/nginx_cache_client_body;
15
+
proxy_temp_path /var/lib/rtmp/nginx_cache_proxy;
16
+
fastcgi_temp_path /var/lib/rtmp/nginx_cache_fastcgi;
17
+
uwsgi_temp_path /var/lib/rtmp/nginx_cache_uwsgi;
18
+
scgi_temp_path /var/lib/rtmp/nginx_cache_scgi;
18
19
19
-
server {
20
-
listen 8080;
21
-
root /var/lib/rtmp;
22
-
access_log stderr;
23
-
error_log stderr;
20
+
server {
21
+
listen 8080;
22
+
root /var/lib/rtmp;
23
+
access_log stderr;
24
+
error_log stderr;
24
25
25
-
# This URL provides RTMP statistics in XML
26
-
location /stat {
27
-
rtmp_stat all;
26
+
# This URL provides RTMP statistics in XML
27
+
location /stat {
28
+
rtmp_stat all;
29
+
}
28
30
}
29
31
}
30
-
}
31
32
32
-
rtmp {
33
-
server {
34
-
access_log stderr;
35
-
listen 1935;
36
-
ping 30s;
37
-
notify_method get;
33
+
rtmp {
34
+
server {
35
+
access_log stderr;
36
+
listen 1935;
37
+
ping 30s;
38
+
notify_method get;
38
39
39
-
application stream {
40
-
live on;
40
+
application stream {
41
+
live on;
41
42
42
-
hls on;
43
-
hls_path /var/lib/rtmp/tmp/hls;
44
-
hls_fragment 1;
45
-
hls_playlist_length 10;
43
+
hls on;
44
+
hls_path /var/lib/rtmp/tmp/hls;
45
+
hls_fragment 1;
46
+
hls_playlist_length 10;
46
47
47
-
dash on;
48
-
dash_path /var/lib/rtmp/tmp/dash;
48
+
dash on;
49
+
dash_path /var/lib/rtmp/tmp/dash;
50
+
}
49
51
}
50
52
}
51
-
}
52
-
'';
53
+
'';
53
54
54
-
in {
55
+
in
56
+
{
55
57
56
58
services.nginx = {
57
59
enable = true;
···
109
111
'';
110
112
locations."= /dash.all.min.js".extraConfig = ''
111
113
default_type "text/javascript";
112
-
alias ${pkgs.fetchurl {
113
-
url = "http://cdn.dashjs.org/v3.2.0/dash.all.min.js";
114
-
sha256 = "16f0b40gdqsnwqi01s5sz9f1q86dwzscgc3m701jd1sczygi481c";
115
-
}};
114
+
alias ${
115
+
pkgs.fetchurl {
116
+
url = "http://cdn.dashjs.org/v3.2.0/dash.all.min.js";
117
+
sha256 = "16f0b40gdqsnwqi01s5sz9f1q86dwzscgc3m701jd1sczygi481c";
118
+
}
119
+
};
116
120
'';
117
121
locations."= /player".extraConfig = ''
118
122
default_type "text/html";
···
150
154
fileSystems."/var/lib/rtmp/tmp" = {
151
155
device = "tmpfs";
152
156
fsType = "tmpfs";
153
-
options = [ "nosuid" "nodev" "noatime" ];
157
+
options = [
158
+
"nosuid"
159
+
"nodev"
160
+
"noatime"
161
+
];
154
162
};
155
163
156
164
users.users.rtmp = {
···
169
177
after = [ "network.target" ];
170
178
restartIfChanged = true;
171
179
script = ''
172
-
${pkgs.nginx.override {
173
-
modules = [
174
-
pkgs.nginxModules.rtmp
175
-
];
176
-
}}/bin/nginx -c ${nginxCfg} -p /var/lib/rtmp
180
+
${
181
+
pkgs.nginx.override {
182
+
modules = [
183
+
pkgs.nginxModules.rtmp
184
+
];
185
+
}
186
+
}/bin/nginx -c ${nginxCfg} -p /var/lib/rtmp
177
187
'';
178
188
serviceConfig = {
179
189
ExecStartPre = pkgs.writers.writeDash "setup-rtmp" ''
···
189
199
};
190
200
191
201
krebs.iptables.tables.filter.INPUT.rules = [
192
-
{ predicate = "-p tcp --dport 1935"; target = "ACCEPT"; }
202
+
{
203
+
predicate = "-p tcp --dport 1935";
204
+
target = "ACCEPT";
205
+
}
193
206
];
194
207
}
+1
-1
2configs/urxvt.nix
+1
-1
2configs/urxvt.nix
+8
-3
2configs/virtualbox.nix
+8
-3
2configs/virtualbox.nix
···
1
-
{ config, pkgs, ... }:
1
+
{ config, ... }:
2
2
3
3
let
4
4
mainUser = config.users.extraUsers.mainUser;
5
5
6
-
in {
6
+
in
7
+
{
7
8
#services.virtualboxHost.enable = true;
8
9
virtualisation.virtualbox.host.enable = true;
9
10
virtualisation.virtualbox.host.enableHardening = false;
···
14
15
description = "user for running VirtualBox";
15
16
home = "/home/virtual";
16
17
useDefaultShell = true;
17
-
extraGroups = [ "vboxusers" "audio" "video" ];
18
+
extraGroups = [
19
+
"vboxusers"
20
+
"audio"
21
+
"video"
22
+
];
18
23
createHome = true;
19
24
};
20
25
};
+105
-33
2configs/weechat.nix
+105
-33
2configs/weechat.nix
···
1
-
{ config, lib, pkgs, ... }: let
1
+
{ config, pkgs, ... }:
2
+
let
2
3
3
4
weechat-configured = pkgs.weechat-declarative.override {
4
5
config = {
···
7
8
pkgs.weechatScripts.wee-slack
8
9
];
9
10
settings = {
10
-
irc.server_default.nicks = [ "lassulus" "hackulus" ];
11
+
irc.server_default.nicks = [
12
+
"lassulus"
13
+
"hackulus"
14
+
];
11
15
irc.server.bitlbee = {
12
16
addresses = "localhost/6666";
13
17
command = "msg &bitlbee identify \${sec.data.bitlbee}";
···
128
132
matrix.look.server_buffer = "independent";
129
133
weechat.bar.buflist.size_max = 20;
130
134
weechat.color.chat_nick_colors = [
131
-
1 2 3 4 5 6 9
132
-
10 11 12 13 14
133
-
28 29
134
-
30 31 32 33 34 35 36 37 38 39
135
+
1
136
+
2
137
+
3
138
+
4
139
+
5
140
+
6
141
+
9
142
+
10
143
+
11
144
+
12
145
+
13
146
+
14
147
+
28
148
+
29
149
+
30
150
+
31
151
+
32
152
+
33
153
+
34
154
+
35
155
+
36
156
+
37
157
+
38
158
+
39
135
159
70
136
160
94
137
-
101 102 103 104 105 106 107
138
-
130 131 133 134 135 136 137
139
-
140 141 142 143
140
-
160 161 162 163 165 166 167 168 169
141
-
170 171 172 173 174 175
142
-
196 197 198 199
143
-
200 201 202 203 204 205 206 208 209 209
144
-
210 211 212
161
+
101
162
+
102
163
+
103
164
+
104
165
+
105
166
+
106
167
+
107
168
+
130
169
+
131
170
+
133
171
+
134
172
+
135
173
+
136
174
+
137
175
+
140
176
+
141
177
+
142
178
+
143
179
+
160
180
+
161
181
+
162
182
+
163
183
+
165
184
+
166
185
+
167
186
+
168
187
+
169
188
+
170
189
+
171
190
+
172
191
+
173
192
+
174
193
+
175
194
+
196
195
+
197
196
+
198
197
+
199
198
+
200
199
+
201
200
+
202
201
+
203
202
+
204
203
+
205
204
+
206
205
+
208
206
+
209
207
+
209
208
+
210
209
+
211
210
+
212
145
211
];
146
212
};
147
213
extraCommands = ''
···
166
232
/matrix connect nixos_dev
167
233
/matrix connect lassulus
168
234
'';
169
-
files."sec.conf" = toString (pkgs.writeText "sec.conf" ''
170
-
[crypt]
171
-
cipher = aes256
172
-
hash_algo = sha256
173
-
passphrase_command = "cat $CREDENTIALS_DIRECTORY/WEECHAT_PASSPHRASE"
174
-
salt = on
235
+
files."sec.conf" = toString (
236
+
pkgs.writeText "sec.conf" ''
237
+
[crypt]
238
+
cipher = aes256
239
+
hash_algo = sha256
240
+
passphrase_command = "cat $CREDENTIALS_DIRECTORY/WEECHAT_PASSPHRASE"
241
+
salt = on
175
242
176
-
[data]
177
-
__passphrase__ = on
178
-
hackint_sasl = "5CA242E92E7A09B180711B50C4AE2E65C42934EB4E584EC82BC1281D8C72CD411D590C16CC435687C0DA13759873CC"
179
-
libera_sasl = "9500B5AC3B29F9CAA273F1B89DC99550E038AF95C4B47442B1FB4CB9F0D6B86B26015988AD39E642CA9C4A78DED7F42D1F409B268C93E778"
180
-
r_sasl = "CB6FB1421ED5A9094CD2C05462DB1FA87C4A675628ABD9AEC9928A1A6F3F96C07D9F26472331BAF80B7B73270680EB1BBEFD"
181
-
c3-gsm = "C49DD845900CFDFA93EEBCE4F1ABF4A963EF6082B7DA6410FA701CC77A04BB6C201FCB864988C4F2B97ED7D44D5A28F162"
182
-
bitlbee = "814ECAC59D9CF6E8340B566563E5D7E92AB92209B49C1EDE4CAAC32DD0DF1EC511D97C75E840C45D69BB9E3D03E79C"
183
-
matrix_lassulus = "0CA5C0F70A9F893881370F4A665B4CC40FBB1A41E53BC94916CD92B029103528611EC0B390116BE60FA79AE10F486E96E17B0824BE2DE1C97D87B88F5407330DAD70C044147533C36B09B7030CAD97"
184
-
'');
243
+
[data]
244
+
__passphrase__ = on
245
+
hackint_sasl = "5CA242E92E7A09B180711B50C4AE2E65C42934EB4E584EC82BC1281D8C72CD411D590C16CC435687C0DA13759873CC"
246
+
libera_sasl = "9500B5AC3B29F9CAA273F1B89DC99550E038AF95C4B47442B1FB4CB9F0D6B86B26015988AD39E642CA9C4A78DED7F42D1F409B268C93E778"
247
+
r_sasl = "CB6FB1421ED5A9094CD2C05462DB1FA87C4A675628ABD9AEC9928A1A6F3F96C07D9F26472331BAF80B7B73270680EB1BBEFD"
248
+
c3-gsm = "C49DD845900CFDFA93EEBCE4F1ABF4A963EF6082B7DA6410FA701CC77A04BB6C201FCB864988C4F2B97ED7D44D5A28F162"
249
+
bitlbee = "814ECAC59D9CF6E8340B566563E5D7E92AB92209B49C1EDE4CAAC32DD0DF1EC511D97C75E840C45D69BB9E3D03E79C"
250
+
matrix_lassulus = "0CA5C0F70A9F893881370F4A665B4CC40FBB1A41E53BC94916CD92B029103528611EC0B390116BE60FA79AE10F486E96E17B0824BE2DE1C97D87B88F5407330DAD70C044147533C36B09B7030CAD97"
251
+
''
252
+
);
185
253
};
186
254
};
187
255
188
-
in {
256
+
in
257
+
{
258
+
nixpkgs.config.permittedInsecurePackages = [
259
+
"olm-3.2.16"
260
+
];
189
261
users.users.mainUser.packages = [
190
262
weechat-configured
191
263
];
···
205
277
User = "lass";
206
278
RemainAfterExit = true;
207
279
Type = "oneshot";
208
-
LoadCredential = [
209
-
"WEECHAT_PASSPHRASE:${config.krebs.secret.directory}/weechat_passphrase"
210
-
];
280
+
# LoadCredential = [
281
+
# "WEECHAT_PASSPHRASE:${config.krebs.secret.directory}/weechat_passphrase"
282
+
# ];
211
283
ExecStart = "${pkgs.tmux}/bin/tmux -2 new-session -d -s IM ${weechat-configured}/bin/weechat";
212
284
ExecStop = "${pkgs.tmux}/bin/tmux kill-session -t IM"; # TODO run save in weechat
213
285
};
+3
-2
2configs/wine.nix
+3
-2
2configs/wine.nix
+51
-26
2configs/wiregrill.nix
+51
-26
2configs/wiregrill.nix
···
1
-
{ config, lib, pkgs, ... }: with lib; let
1
+
{
2
+
config,
3
+
lib,
4
+
pkgs,
5
+
...
6
+
}:
7
+
with lib;
8
+
let
2
9
3
10
self = config.krebs.build.host.nets.wiregrill;
4
11
isRouter = !isNull self.via;
5
12
6
-
in mkIf (hasAttr "wiregrill" config.krebs.build.host.nets) {
13
+
in
14
+
mkIf (hasAttr "wiregrill" config.krebs.build.host.nets) {
7
15
#hack for modprobe inside containers
8
16
systemd.services."wireguard-wiregrill".path = mkIf config.boot.isContainer (mkBefore [
9
17
(pkgs.writeDashBin "modprobe" ":")
···
13
21
"net.ipv6.conf.all.forwarding" = 1;
14
22
};
15
23
krebs.iptables.tables.filter.INPUT.rules = [
16
-
{ predicate = "-p udp --dport ${toString self.wireguard.port}"; target = "ACCEPT"; }
24
+
{
25
+
predicate = "-p udp --dport ${toString self.wireguard.port}";
26
+
target = "ACCEPT";
27
+
}
17
28
];
18
29
krebs.iptables.tables.filter.FORWARD.rules = mkIf isRouter (mkBefore [
19
-
{ predicate = "-i wiregrill -o wiregrill"; target = "ACCEPT"; }
20
-
{ predicate = "-i wiregrill -o retiolum"; target = "ACCEPT"; }
21
-
{ predicate = "-i retiolum -o wiregrill"; target = "ACCEPT"; }
22
-
{ predicate = "-i wiregrill -o eth0"; target = "ACCEPT"; }
23
-
{ predicate = "-o wiregrill -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
30
+
{
31
+
predicate = "-i wiregrill -o wiregrill";
32
+
target = "ACCEPT";
33
+
}
34
+
{
35
+
predicate = "-i wiregrill -o retiolum";
36
+
target = "ACCEPT";
37
+
}
38
+
{
39
+
predicate = "-i retiolum -o wiregrill";
40
+
target = "ACCEPT";
41
+
}
42
+
{
43
+
predicate = "-i wiregrill -o eth0";
44
+
target = "ACCEPT";
45
+
}
46
+
{
47
+
predicate = "-o wiregrill -m conntrack --ctstate RELATED,ESTABLISHED";
48
+
target = "ACCEPT";
49
+
}
24
50
]);
25
51
26
52
clanCore.facts.services.wiregrill = {
···
39
65
systemd.network.networks.wiregrill = {
40
66
matchConfig.Name = "wiregrill";
41
67
address =
42
-
(optional (!isNull self.ip4) "${self.ip4.addr}/16") ++
43
-
(optional (!isNull self.ip6) "${self.ip6.addr}/48")
44
-
;
68
+
(optional (!isNull self.ip4) "${self.ip4.addr}/16")
69
+
++ (optional (!isNull self.ip6) "${self.ip6.addr}/48");
45
70
networkConfig = {
46
71
IgnoreCarrierLoss = "10s";
47
72
};
···
49
74
50
75
networking.wireguard.interfaces.wiregrill = {
51
76
ips =
52
-
(optional (!isNull self.ip4 && !config.systemd.network.enable) self.ip4.addr) ++
53
-
(optional (!isNull self.ip6 && !config.systemd.network.enable) self.ip6.addr);
77
+
(optional (!isNull self.ip4 && !config.systemd.network.enable) self.ip4.addr)
78
+
++ (optional (!isNull self.ip6 && !config.systemd.network.enable) self.ip6.addr);
54
79
listenPort = 51820;
55
80
privateKeyFile = "${config.krebs.secret.directory}/wiregrill.key";
56
81
allowedIPsAsRoutes = true;
57
-
peers = mapAttrsToList
58
-
(name: host: {
59
-
# inherit name;
60
-
allowedIPs = if isRouter then
61
-
(optional (!isNull host.nets.wiregrill.ip4) host.nets.wiregrill.ip4.addr) ++
62
-
(optional (!isNull host.nets.wiregrill.ip6) host.nets.wiregrill.ip6.addr)
82
+
peers = mapAttrsToList (_name: host: {
83
+
# inherit name;
84
+
allowedIPs =
85
+
if isRouter then
86
+
(optional (!isNull host.nets.wiregrill.ip4) host.nets.wiregrill.ip4.addr)
87
+
++ (optional (!isNull host.nets.wiregrill.ip6) host.nets.wiregrill.ip6.addr)
63
88
else
64
-
host.nets.wiregrill.wireguard.subnets
65
-
;
66
-
endpoint = mkIf (!isNull host.nets.wiregrill.via) (host.nets.wiregrill.via.ip4.addr + ":${toString host.nets.wiregrill.wireguard.port}");
67
-
persistentKeepalive = mkIf (!isNull host.nets.wiregrill.via) 61;
68
-
publicKey = (replaceStrings ["\n"] [""] host.nets.wiregrill.wireguard.pubkey);
69
-
})
70
-
(filterAttrs (_: h: hasAttr "wiregrill" h.nets) config.krebs.hosts);
89
+
host.nets.wiregrill.wireguard.subnets;
90
+
endpoint = mkIf (!isNull host.nets.wiregrill.via) (
91
+
host.nets.wiregrill.via.ip4.addr + ":${toString host.nets.wiregrill.wireguard.port}"
92
+
);
93
+
persistentKeepalive = mkIf (!isNull host.nets.wiregrill.via) 61;
94
+
publicKey = (replaceStrings [ "\n" ] [ "" ] host.nets.wiregrill.wireguard.pubkey);
95
+
}) (filterAttrs (_: h: hasAttr "wiregrill" h.nets) config.krebs.hosts);
71
96
};
72
97
}
+4
-2
2configs/xdg-open.nix
+4
-2
2configs/xdg-open.nix
+1
-1
2configs/xonsh.nix
+1
-1
2configs/xonsh.nix
+20
-7
2configs/yubikey.nix
+20
-7
2configs/yubikey.nix
···
1
-
{ self, lib, pkgs, ... }:
1
+
{
2
+
self,
3
+
lib,
4
+
pkgs,
5
+
...
6
+
}:
2
7
let
3
8
# pcsclite workaround until https://github.com/NixOS/nixpkgs/pull/308884 is in unstable
4
9
pcsclite = pkgs.pcsclite.overrideAttrs (old: {
5
-
postPatch = old.postPatch + (lib.optionalString (!(lib.strings.hasInfix ''--replace-fail "libpcsclite_real.so.1"'' old.postPatch)) ''
6
-
substituteInPlace src/libredirect.c src/spy/libpcscspy.c \
7
-
--replace-fail "libpcsclite_real.so.1" "$lib/lib/libpcsclite_real.so.1"
8
-
'');
10
+
postPatch =
11
+
old.postPatch
12
+
+ (lib.optionalString
13
+
(!(lib.strings.hasInfix ''--replace-fail "libpcsclite_real.so.1"'' old.postPatch))
14
+
''
15
+
substituteInPlace src/libredirect.c src/spy/libpcscspy.c \
16
+
--replace-fail "libpcsclite_real.so.1" "$lib/lib/libpcsclite_real.so.1"
17
+
''
18
+
);
9
19
});
10
20
in
11
21
{
12
22
environment.systemPackages = with pkgs; [
13
23
yubikey-personalization
14
24
yubikey-manager
15
-
pinentry-curses pinentry-qt
25
+
pinentry-curses
26
+
pinentry-qt
16
27
# fix polkit rules
17
28
# https://github.com/NixOS/nixpkgs/issues/280826
18
29
pcscliteWithPolkit.out
···
40
51
''} $HOME/.gnupg/scdaemon.conf
41
52
'';
42
53
systemd.user.services.gpg-agent.serviceConfig.ExecStartPost = pkgs.writers.writeDash "init_gpg" ''
43
-
${pkgs.gnupg}/bin/gpg --import ${self.inputs.stockholm.outPath + "/kartei/lass/pgp/yubikey.pgp"} >/dev/null
54
+
${pkgs.gnupg}/bin/gpg --import ${
55
+
self.inputs.stockholm.outPath + "/kartei/lass/pgp/yubikey.pgp"
56
+
} >/dev/null
44
57
echo -e '5\ny\n' | ${pkgs.gnupg}/bin/gpg --command-fd 0 --expert --edit-key DBCD757846069B392EA9401D6657BE8A8D1EE807 trust >/dev/null || :
45
58
'';
46
59
+15
-9
2configs/zerotier.nix
+15
-9
2configs/zerotier.nix
···
1
1
{ lib, ... }:
2
2
let
3
3
hosts = lib.mapAttrs (machine: _: {
4
-
ip = if builtins.pathExists ../machines/${machine}/facts/zerotier-ip then
5
-
builtins.readFile ../machines/${machine}/facts/zerotier-ip
6
-
else
7
-
null;
4
+
ip =
5
+
if builtins.pathExists ../machines/${machine}/facts/zerotier-ip then
6
+
builtins.readFile ../machines/${machine}/facts/zerotier-ip
7
+
else
8
+
null;
8
9
}) (builtins.readDir ../machines);
9
10
10
-
filteredHosts = lib.filterAttrs (name: host: host.ip != null) hosts;
11
+
filteredHosts = lib.filterAttrs (_name: host: host.ip != null) hosts;
11
12
in
12
13
{
13
14
services.zerotierone.joinNetworks = [ "7c31a21e86f9a75c" ];
14
15
services.zerotierone.localConf.settings = {
15
-
interfacePrefixBlacklist = [ "ygg" "mesh" "retiolum" "wiregrill" ];
16
+
interfacePrefixBlacklist = [
17
+
"ygg"
18
+
"mesh"
19
+
"retiolum"
20
+
"wiregrill"
21
+
];
16
22
physical = {
17
23
"10.243.0.0/16".blacklist = true;
18
24
"10.244.0.0/16".blacklist = true;
···
21
27
};
22
28
};
23
29
24
-
networking.extraHosts = lib.concatMapStringsSep "\n" (host:
25
-
"${host.value.ip} ${host.name}.z"
26
-
) (lib.attrsToList filteredHosts);
30
+
networking.extraHosts = lib.concatMapStringsSep "\n" (host: "${host.value.ip} ${host.name}.z") (
31
+
lib.attrsToList filteredHosts
32
+
);
27
33
}
+18
-14
2configs/zsh.nix
+18
-14
2configs/zsh.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ pkgs, ... }:
2
2
{
3
3
environment.systemPackages = with pkgs; [
4
4
atuin
5
5
direnv
6
6
fzf
7
7
];
8
-
environment.variables.ATUIN_CONFIG_DIR = toString (pkgs.writeTextDir "/config.toml" ''
9
-
auto_sync = true
10
-
update_check = false
11
-
sync_address = "http://green.r:8888"
12
-
sync_frequency = 0
13
-
style = "compact"
14
-
'');
8
+
environment.variables.ATUIN_CONFIG_DIR = toString (
9
+
pkgs.writeTextDir "/config.toml" ''
10
+
auto_sync = true
11
+
update_check = false
12
+
sync_address = "http://green.r:8888"
13
+
sync_frequency = 0
14
+
style = "compact"
15
+
''
16
+
);
15
17
programs.zsh = {
16
18
enable = true;
17
19
shellInit = ''
···
63
65
}
64
66
65
67
#beautiful colors
66
-
eval $(dircolors -b ${pkgs.fetchFromGitHub {
67
-
owner = "trapd00r";
68
-
repo = "LS_COLORS";
69
-
rev = "a75fca8545f91abb8a5f802981033ef54bf1eac0";
70
-
sha256="1lzj0qnj89mzh76ha137mnz2hf86k278rh0y9x124ghxj9yqsnb4";
71
-
}}/LS_COLORS)
68
+
eval $(dircolors -b ${
69
+
pkgs.fetchFromGitHub {
70
+
owner = "trapd00r";
71
+
repo = "LS_COLORS";
72
+
rev = "a75fca8545f91abb8a5f802981033ef54bf1eac0";
73
+
sha256 = "1lzj0qnj89mzh76ha137mnz2hf86k278rh0y9x124ghxj9yqsnb4";
74
+
}
75
+
}/LS_COLORS)
72
76
zstyle ':completion:*:default' list-colors ''${(s.:.)LS_COLORS}
73
77
74
78
#emacs bindings
+1
-2
3modules/default.nix
+1
-2
3modules/default.nix
+94
-68
3modules/drbd.nix
+94
-68
3modules/drbd.nix
···
1
-
{ config, lib, pkgs, self, ... }: let
1
+
{
2
+
config,
3
+
lib,
4
+
pkgs,
5
+
self,
6
+
...
7
+
}:
8
+
let
2
9
cfg = config.lass.drbd;
3
10
slib = self.inputs.stockholm.lib;
4
-
in {
11
+
in
12
+
{
5
13
options = {
6
14
lass.drbd = lib.mkOption {
7
-
default = {};
8
-
type = lib.types.attrsOf (lib.types.submodule ({ config, ... }: {
9
-
options = {
10
-
name = lib.mkOption {
11
-
type = lib.types.str;
12
-
default = config._module.args.name;
13
-
};
14
-
blockMinor = lib.mkOption {
15
-
type = lib.types.int;
16
-
default = lib.mod (slib.genid config.name) 16000; # TODO get max_id fron drbd
17
-
};
18
-
port = lib.mkOption {
19
-
type = lib.types.int;
20
-
default = 20000 + config.blockMinor;
21
-
};
22
-
peers = lib.mkOption {
23
-
type = lib.types.listOf slib.types.host;
24
-
};
25
-
disk = lib.mkOption {
26
-
type = lib.types.str;
27
-
default = "/dev/loop${toString config.blockMinor}";
28
-
};
29
-
drbdConfig = lib.mkOption {
30
-
type = lib.types.path;
31
-
internal = true;
32
-
default = pkgs.writeText "drbd-${config.name}.conf" ''
33
-
resource ${config.name} {
34
-
net {
35
-
protocol a;
36
-
ping-int 10;
37
-
csums-alg crc32c;
38
-
connect-int 3;
39
-
after-sb-0pri discard-older-primary;
40
-
after-sb-1pri discard-secondary;
15
+
default = { };
16
+
type = lib.types.attrsOf (
17
+
lib.types.submodule (
18
+
{ config, ... }:
19
+
{
20
+
options = {
21
+
name = lib.mkOption {
22
+
type = lib.types.str;
23
+
default = config._module.args.name;
24
+
};
25
+
blockMinor = lib.mkOption {
26
+
type = lib.types.int;
27
+
default = lib.mod (slib.genid config.name) 16000; # TODO get max_id fron drbd
28
+
};
29
+
port = lib.mkOption {
30
+
type = lib.types.int;
31
+
default = 20000 + config.blockMinor;
32
+
};
33
+
peers = lib.mkOption {
34
+
type = lib.types.listOf slib.types.host;
35
+
};
36
+
disk = lib.mkOption {
37
+
type = lib.types.str;
38
+
default = "/dev/loop${toString config.blockMinor}";
39
+
};
40
+
drbdConfig = lib.mkOption {
41
+
type = lib.types.path;
42
+
internal = true;
43
+
default = pkgs.writeText "drbd-${config.name}.conf" ''
44
+
resource ${config.name} {
45
+
net {
46
+
protocol a;
47
+
ping-int 10;
48
+
csums-alg crc32c;
49
+
connect-int 3;
50
+
after-sb-0pri discard-older-primary;
51
+
after-sb-1pri discard-secondary;
41
52
42
-
# seems to be drbd-proxy premium feature
43
-
on-congestion pull-ahead;
44
-
congestion-fill 1G;
45
-
congestion-extents 500;
53
+
# seems to be drbd-proxy premium feature
54
+
on-congestion pull-ahead;
55
+
congestion-fill 1G;
56
+
congestion-extents 500;
46
57
47
-
sndbuf-size 10M;
48
-
max-epoch-size 20000;
49
-
}
50
-
device minor ${toString config.blockMinor};
51
-
disk ${config.disk};
52
-
meta-disk internal;
53
-
${slib.indent (lib.concatStrings (lib.imap1 (i: peer: /* shell */ ''
54
-
on ${peer.name} {
55
-
address ${peer.nets.retiolum.ip4.addr}:${toString config.port};
56
-
node-id ${toString i};
58
+
sndbuf-size 10M;
59
+
max-epoch-size 20000;
60
+
}
61
+
device minor ${toString config.blockMinor};
62
+
disk ${config.disk};
63
+
meta-disk internal;
64
+
${
65
+
slib.indent (
66
+
lib.concatStrings (
67
+
lib.imap1 (
68
+
i: peer: # shell
69
+
''
70
+
on ${peer.name} {
71
+
address ${peer.nets.retiolum.ip4.addr}:${toString config.port};
72
+
node-id ${toString i};
73
+
}
74
+
'') config.peers
75
+
)
76
+
)
77
+
}
78
+
connection-mesh {
79
+
hosts ${lib.concatMapStringsSep " " (peer: peer.name) config.peers};
80
+
}
57
81
}
58
-
'') config.peers))}
59
-
connection-mesh {
60
-
hosts ${lib.concatMapStringsSep " " (peer: peer.name) config.peers};
61
-
}
62
-
}
63
-
'';
64
-
};
65
-
};
66
-
}));
82
+
'';
83
+
};
84
+
};
85
+
}
86
+
)
87
+
);
67
88
};
68
89
};
69
-
config = lib.mkIf (cfg != {}) {
90
+
config = lib.mkIf (cfg != { }) {
70
91
boot.extraModulePackages = [
71
-
(pkgs.linuxPackages.callPackage ../5pkgs/drbd9/default.nix {})
92
+
(pkgs.linuxPackages.callPackage ../5pkgs/drbd9/default.nix { })
72
93
];
73
94
boot.extraModprobeConfig = ''
74
95
options drbd usermode_helper=/run/current-system/sw/bin/drbdadm
···
109
130
];
110
131
111
132
networking.firewall.allowedTCPPorts = map (device: device.port) (lib.attrValues cfg);
112
-
systemd.services = lib.mapAttrs' (_: device:
133
+
systemd.services = lib.mapAttrs' (
134
+
_: device:
113
135
lib.nameValuePair "drbd-${device.name}" {
114
-
after = [ "systemd-udev.settle.service" "network.target" "retiolum.service" ];
136
+
after = [
137
+
"systemd-udev.settle.service"
138
+
"network.target"
139
+
"retiolum.service"
140
+
];
115
141
wants = [ "systemd-udev.settle.service" ];
116
142
wantedBy = [ "multi-user.target" ];
117
143
serviceConfig = {
···
144
170
}
145
171
) cfg;
146
172
147
-
148
173
environment.etc."drbd.conf".text = ''
149
174
global {
150
175
usage-count yes;
151
176
}
152
177
153
-
${lib.concatMapStrings (device: /* shell */ ''
154
-
include ${device.drbdConfig};
155
-
'') (lib.attrValues cfg)}
178
+
${lib.concatMapStrings (
179
+
device: # shell
180
+
''
181
+
include ${device.drbdConfig};
182
+
'') (lib.attrValues cfg)}
156
183
'';
157
184
};
158
185
}
159
-
+10
-4
3modules/fetchWallpaper.nix
+10
-4
3modules/fetchWallpaper.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{
2
+
config,
3
+
lib,
4
+
pkgs,
5
+
...
6
+
}:
2
7
3
8
let
4
9
cfg = config.lass.fetchWallpaper;
···
10
15
feh --no-fehbg --bg-scale wallpaper
11
16
'';
12
17
13
-
in {
18
+
in
19
+
{
14
20
options.lass.fetchWallpaper = {
15
21
enable = lib.mkEnableOption "fetch wallpaper";
16
22
url = lib.mkOption {
···
33
39
# do not start when running on umts
34
40
{ ConditionPathExists = "!/var/run/ppp0.pid"; }
35
41
'';
36
-
default = {};
42
+
default = { };
37
43
};
38
44
};
39
45
···
74
80
isSystemUser = true;
75
81
group = "wallpaper";
76
82
};
77
-
users.groups.wallpaper = {};
83
+
users.groups.wallpaper = { };
78
84
};
79
85
}
+42
-39
3modules/folderPerms.nix
+42
-39
3modules/folderPerms.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{
2
+
config,
3
+
lib,
4
+
pkgs,
5
+
...
6
+
}:
2
7
3
8
#TODO: implement recursive mode maybe?
4
9
# enable different mods for files and folders
···
6
11
let
7
12
inherit (pkgs)
8
13
writeScript
9
-
;
14
+
;
10
15
11
16
inherit (lib)
12
17
concatMapStringsSep
···
15
20
mkIf
16
21
mkOption
17
22
types
18
-
;
23
+
;
19
24
20
25
cfg = config.lass.folderPerms;
21
26
···
27
32
api = {
28
33
enable = mkEnableOption "folder permissions";
29
34
permissions = mkOption {
30
-
type = with types; listOf (submodule ({
31
-
options = {
32
-
path = mkOption {
33
-
type = str;
35
+
type =
36
+
with types;
37
+
listOf (submodule ({
38
+
options = {
39
+
path = mkOption {
40
+
type = str;
41
+
};
42
+
permission = mkOption {
43
+
type = nullOr str;
44
+
example = "755";
45
+
description = ''
46
+
basically anything that chmod takes as permission
47
+
'';
48
+
default = null;
49
+
};
50
+
owner = mkOption {
51
+
type = nullOr str;
52
+
example = "root:root";
53
+
description = ''
54
+
basically anything that chown takes as owner
55
+
'';
56
+
default = null;
57
+
};
34
58
};
35
-
permission = mkOption {
36
-
type = nullOr str;
37
-
example = "755";
38
-
description = ''
39
-
basically anything that chmod takes as permission
40
-
'';
41
-
default = null;
42
-
};
43
-
owner = mkOption {
44
-
type = nullOr str;
45
-
example = "root:root";
46
-
description = ''
47
-
basically anything that chown takes as owner
48
-
'';
49
-
default = null;
50
-
};
51
-
};
52
-
}));
59
+
}));
53
60
};
54
61
};
55
62
···
77
84
${concatMapStringsSep "\n" writeCommand cfg.permissions}
78
85
'';
79
86
80
-
writeCommand = fperm:
87
+
writeCommand =
88
+
fperm:
81
89
concatStringsSep "\n" [
82
90
(buildPermission fperm)
83
91
(buildOwner fperm)
84
92
];
85
93
86
-
buildPermission = perm:
94
+
buildPermission =
95
+
perm:
87
96
#TODO: create folder maybe
88
97
#TODO: check if permission is valid
89
-
if (perm.permission == null) then
90
-
""
91
-
else
92
-
"chmod ${perm.permission} ${perm.path}"
93
-
;
98
+
if (perm.permission == null) then "" else "chmod ${perm.permission} ${perm.path}";
94
99
95
-
buildOwner = perm:
100
+
buildOwner =
101
+
perm:
96
102
#TODO: create folder maybe
97
103
#TODO: check if owner/group valid
98
-
if (perm.owner == null) then
99
-
""
100
-
else
101
-
"chown ${perm.owner} ${perm.path}"
102
-
;
104
+
if (perm.owner == null) then "" else "chown ${perm.owner} ${perm.path}";
103
105
104
-
in out
106
+
in
107
+
out
+90
-69
3modules/klem.nix
+90
-69
3modules/klem.nix
···
1
-
{ self, config, lib, pkgs, ... }: with lib; let
1
+
{
2
+
self,
3
+
config,
4
+
lib,
5
+
pkgs,
6
+
...
7
+
}:
8
+
with lib;
9
+
let
2
10
cfg = config.lass.klem;
3
11
slib = self.inputs.stockholm.lib;
4
-
in {
12
+
in
13
+
{
5
14
options.lass.klem = mkOption {
6
-
default = {};
7
-
type = types.attrsOf (types.submodule ({ config, ...}: {
8
-
options = {
9
-
target = mkOption {
10
-
default = ".*";
11
-
description = ''
12
-
regex of valid targets
13
-
can be shown with xclip -selection clipboard -t TARGETS
14
-
the first hit is taken as target argument
15
-
'';
16
-
type = types.str;
17
-
};
18
-
script = mkOption {
19
-
description = ''
20
-
file to run if entry is selected
21
-
'';
22
-
type = types.path;
23
-
};
24
-
label = mkOption {
25
-
default = config._module.args.name;
26
-
description = ''
27
-
label to show in dmenu for this script
28
-
'';
29
-
type = types.str;
30
-
};
31
-
};
32
-
}));
15
+
default = { };
16
+
type = types.attrsOf (
17
+
types.submodule (
18
+
{ config, ... }:
19
+
{
20
+
options = {
21
+
target = mkOption {
22
+
default = ".*";
23
+
description = ''
24
+
regex of valid targets
25
+
can be shown with xclip -selection clipboard -t TARGETS
26
+
the first hit is taken as target argument
27
+
'';
28
+
type = types.str;
29
+
};
30
+
script = mkOption {
31
+
description = ''
32
+
file to run if entry is selected
33
+
'';
34
+
type = types.path;
35
+
};
36
+
label = mkOption {
37
+
default = config._module.args.name;
38
+
description = ''
39
+
label to show in dmenu for this script
40
+
'';
41
+
type = types.str;
42
+
};
43
+
};
44
+
}
45
+
)
46
+
);
33
47
};
34
-
config = let
35
-
klem = pkgs.writers.writeDashBin "klem" ''
36
-
set -x
48
+
config =
49
+
let
50
+
klem = pkgs.writers.writeDashBin "klem" ''
51
+
set -x
37
52
38
-
labels=""
39
-
# match filetype against patterns
40
-
${concatMapStringsSep "\n" (script: ''
41
-
${pkgs.xclip}/bin/xclip -selection clipboard -target TARGETS -out \
42
-
| ${pkgs.gnugrep}/bin/grep -q '${script.target}'
43
-
if [ $? -eq 0 ]; then
44
-
labels="$labels:${script.label}"
45
-
fi
46
-
'') (attrValues cfg)}
47
-
48
-
#remove empty line, feed into dmenu
49
-
script=$(echo "$labels" \
50
-
| ${pkgs.gnused}/bin/sed 's/^://;s/:/\n/g' \
51
-
| ${pkgs.dmenu}/bin/dmenu)
52
-
53
-
#run the chosen script
54
-
case $script in
55
-
${concatMapStringsSep "\n" (script: slib.indent ''
56
-
${script.label})
57
-
target=$(${pkgs.xclip}/bin/xclip -selection clipboard -target TARGETS -out \
58
-
| ${pkgs.gnugrep}/bin/grep '${script.target}' \
59
-
| ${pkgs.gnugrep}/bin/grep -v TARGETS \
60
-
| ${pkgs.coreutils}/bin/head -1)
61
-
${pkgs.xclip}/bin/xclip -selection clipboard -target "$target" -out \
62
-
| ${script.script} \
63
-
| ${pkgs.xclip}/bin/xclip -selection clipboard -in
64
-
;;
53
+
labels=""
54
+
# match filetype against patterns
55
+
${concatMapStringsSep "\n" (script: ''
56
+
${pkgs.xclip}/bin/xclip -selection clipboard -target TARGETS -out \
57
+
| ${pkgs.gnugrep}/bin/grep -q '${script.target}'
58
+
if [ $? -eq 0 ]; then
59
+
labels="$labels:${script.label}"
60
+
fi
65
61
'') (attrValues cfg)}
66
-
esac
67
-
'';
68
-
in mkIf (cfg != {}) {
69
-
environment.systemPackages = [ klem ];
70
-
nixpkgs.overlays = [
71
-
(self: super: {
72
-
klem = klem;
73
-
})
74
-
];
75
-
};
62
+
63
+
#remove empty line, feed into dmenu
64
+
script=$(echo "$labels" \
65
+
| ${pkgs.gnused}/bin/sed 's/^://;s/:/\n/g' \
66
+
| ${pkgs.dmenu}/bin/dmenu)
67
+
68
+
#run the chosen script
69
+
case $script in
70
+
${
71
+
concatMapStringsSep "\n" (
72
+
script:
73
+
slib.indent ''
74
+
${script.label})
75
+
target=$(${pkgs.xclip}/bin/xclip -selection clipboard -target TARGETS -out \
76
+
| ${pkgs.gnugrep}/bin/grep '${script.target}' \
77
+
| ${pkgs.gnugrep}/bin/grep -v TARGETS \
78
+
| ${pkgs.coreutils}/bin/head -1)
79
+
${pkgs.xclip}/bin/xclip -selection clipboard -target "$target" -out \
80
+
| ${script.script} \
81
+
| ${pkgs.xclip}/bin/xclip -selection clipboard -in
82
+
;;
83
+
''
84
+
) (attrValues cfg)
85
+
}
86
+
esac
87
+
'';
88
+
in
89
+
mkIf (cfg != { }) {
90
+
environment.systemPackages = [ klem ];
91
+
nixpkgs.overlays = [
92
+
(_self: _super: {
93
+
klem = klem;
94
+
})
95
+
];
96
+
};
76
97
}
+69
-46
3modules/mysql-backup.nix
+69
-46
3modules/mysql-backup.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{
2
+
config,
3
+
lib,
4
+
pkgs,
5
+
...
6
+
}:
2
7
3
8
with lib;
4
9
···
14
19
api = {
15
20
enable = mkEnableOption "mysqlBackup";
16
21
config = mkOption {
17
-
type = with types; attrsOf (submodule ({ config, ... }: {
18
-
options = {
19
-
name = mkOption {
20
-
type = types.str;
21
-
default = config._module.args.name;
22
-
};
23
-
startAt = mkOption {
24
-
type = with types; nullOr str; # TODO systemd.time(7)'s calendar event
25
-
default = "*-*-* 01:15:00";
26
-
};
27
-
user = mkOption {
28
-
type = str;
29
-
default = "root";
30
-
};
31
-
password = mkOption {
32
-
type = nullOr str;
33
-
default = null;
34
-
description = ''
35
-
path to a file containing the mysqlPassword for the specified user.
36
-
'';
37
-
};
38
-
databases = mkOption {
39
-
type = listOf str;
40
-
default = [];
41
-
};
42
-
location = mkOption {
43
-
type = str;
44
-
default = "/backups/sql_dumps";
45
-
};
46
-
};
47
-
}));
22
+
type =
23
+
with types;
24
+
attrsOf (
25
+
submodule (
26
+
{ config, ... }:
27
+
{
28
+
options = {
29
+
name = mkOption {
30
+
type = types.str;
31
+
default = config._module.args.name;
32
+
};
33
+
startAt = mkOption {
34
+
type = with types; nullOr str; # TODO systemd.time(7)'s calendar event
35
+
default = "*-*-* 01:15:00";
36
+
};
37
+
user = mkOption {
38
+
type = str;
39
+
default = "root";
40
+
};
41
+
password = mkOption {
42
+
type = nullOr str;
43
+
default = null;
44
+
description = ''
45
+
path to a file containing the mysqlPassword for the specified user.
46
+
'';
47
+
};
48
+
databases = mkOption {
49
+
type = listOf str;
50
+
default = [ ];
51
+
};
52
+
location = mkOption {
53
+
type = str;
54
+
default = "/backups/sql_dumps";
55
+
};
56
+
};
57
+
}
58
+
)
59
+
);
48
60
description = "configuration for mysqlBackup";
49
61
};
50
62
};
···
52
64
imp = {
53
65
54
66
services.mysql.ensureUsers = [
55
-
{ ensurePermissions = { "*.*" = "ALL"; }; name = "root"; }
67
+
{
68
+
ensurePermissions = {
69
+
"*.*" = "ALL";
70
+
};
71
+
name = "root";
72
+
}
56
73
];
57
74
58
-
systemd.services =
59
-
mapAttrs' (_: plan: nameValuePair "mysqlBackup-${plan.name}" {
75
+
systemd.services = mapAttrs' (
76
+
_: plan:
77
+
nameValuePair "mysqlBackup-${plan.name}" {
60
78
path = with pkgs; [
61
79
mysql
62
80
gzip
···
68
86
User = plan.user;
69
87
};
70
88
startAt = plan.startAt;
71
-
}) cfg.config;
89
+
}
90
+
) cfg.config;
72
91
};
73
92
93
+
start =
94
+
plan:
95
+
let
96
+
backupScript = plan: db: ''
97
+
mkdir -p ${plan.location}
98
+
mysqldump -u ${plan.user} ${
99
+
optionalString (plan.password != null) "-p$(cat ${plan.password})"
100
+
} ${db} | gzip -c > ${plan.location}/${db}.gz
101
+
'';
74
102
75
-
start = plan: let
76
-
backupScript = plan: db: ''
77
-
mkdir -p ${plan.location}
78
-
mysqldump -u ${plan.user} ${optionalString (plan.password != null) "-p$(cat ${plan.password})"} ${db} | gzip -c > ${plan.location}/${db}.gz
103
+
in
104
+
pkgs.pkgs.writeDash "mysqlBackup.${plan.name}" ''
105
+
${concatMapStringsSep "\n" (backupScript plan) plan.databases}
79
106
'';
80
107
81
-
in pkgs.pkgs.writeDash "mysqlBackup.${plan.name}" ''
82
-
${concatMapStringsSep "\n" (backupScript plan) plan.databases}
83
-
'';
84
-
85
-
86
-
in out
108
+
in
109
+
out
+126
-116
3modules/nichtparasoup.nix
+126
-116
3modules/nichtparasoup.nix
···
1
-
{ self, config, lib, pkgs, ... }:
1
+
{
2
+
self,
3
+
config,
4
+
lib,
5
+
pkgs,
6
+
...
7
+
}:
2
8
3
9
with lib;
4
10
···
24
30
[Sites]
25
31
SoupIO: everyone
26
32
Pr0gramm: new,top
27
-
Reddit: ${lib.concatStringsSep "," [
28
-
"2healthbars"
29
-
"abandonedporn"
30
-
"animalsbeingderps"
31
-
"ANormalDayInRussia"
32
-
"assholedesign"
33
-
"AwesomeOffBrands"
34
-
"bizarrebuildings"
35
-
"bonehurtingjuice"
36
-
"boottoobig"
37
-
"bossfight"
38
-
"bravofotogeschichten"
39
-
"breathinginformation"
40
-
"buddhistmemes"
41
-
"cablefail"
42
-
"cableporn"
43
-
"catastrophicfailure"
44
-
"chairsunderwater"
45
-
"clevercomebacks"
46
-
"confusingperspective"
47
-
"conni"
48
-
"crappydesign"
49
-
"cursedcomments"
50
-
"desirepath"
51
-
"doenerverbrechen"
52
-
"dontdeadopeninside"
53
-
"educationalgifs"
54
-
"EngineeringPorn"
55
-
"eyebleach"
56
-
"forbiddensnacks"
57
-
"funnyanimals"
58
-
"gifs"
59
-
"Gittertiere"
60
-
"goodboomerhumor"
61
-
"grssk"
62
-
"halthoch"
63
-
"hmm"
64
-
"hmmm"
65
-
"holdmybeer"
66
-
"holup"
67
-
"iamatotalpieceofshit"
68
-
"ichbin40undlustig"
69
-
"idiotsincars"
70
-
"illegallysmolcats"
71
-
"infokriegerkutschen"
72
-
"instagramreality"
73
-
"instant_regret"
74
-
"itrunsdoom"
75
-
"itsaunixsystem"
76
-
"kamikazebywords"
77
-
"keming"
78
-
"kidsarefuckingstupid"
79
-
"kitchenconfidential"
80
-
"laughingbuddha"
81
-
"LiminalSpace"
82
-
"loadingicon"
83
-
"MachinePorn"
84
-
"mallninjashit"
85
-
"michaelbaygifs"
86
-
"mildlyinfuriating"
87
-
"miscatculations"
88
-
"natureisfuckinglit"
89
-
"nononoyesno"
90
-
"notinteresting"
91
-
"notliketheothergirls"
92
-
"oddlysatisfying"
93
-
"ofcoursethatsathing"
94
-
"okbuddylinux"
95
-
"OSHA"
96
-
"PeopleFuckingDying"
97
-
"Perfectfit"
98
-
"perfectloops"
99
-
"PerfectTiming"
100
-
"picsofunusualbirds"
101
-
"PixelArt"
102
-
"pizzacrimes"
103
-
"prequelmemes"
104
-
"Prisonwallet"
105
-
"reactiongifs"
106
-
"RealFakeDoors"
107
-
"reallifedoodles"
108
-
"RetroFuturism"
109
-
"robotsbeingjerks"
110
-
"SchizophreniaRides"
111
-
"scriptedasiangifs"
112
-
"shitposting"
113
-
"shittyfoodporn"
114
-
"shittyrobots"
115
-
"softwaregore"
116
-
"specializedtools"
117
-
"spicypillows"
118
-
"StallmanWasRight"
119
-
"startledcats"
120
-
"startrekstabilized"
121
-
"stupidfood"
122
-
"techsupportgore"
123
-
"thathappened"
124
-
"ThingsCutInHalfPorn"
125
-
"totallynotrobots"
126
-
"trippinthroughtime"
127
-
"Unexpected"
128
-
"urbanexploration"
129
-
"wasletztepreis"
130
-
"wellthatsucks"
131
-
"wertekinder"
132
-
"wewantplates"
133
-
"whatcouldgowrong"
134
-
"whatsthisbug"
135
-
"whatsthisplant"
136
-
"whatswrongwithyourdog"
137
-
"whenthe"
138
-
"yesyesyesyesno"
139
-
"youseeingthisshit"
140
-
]}
33
+
Reddit: ${
34
+
lib.concatStringsSep "," [
35
+
"2healthbars"
36
+
"abandonedporn"
37
+
"animalsbeingderps"
38
+
"ANormalDayInRussia"
39
+
"assholedesign"
40
+
"AwesomeOffBrands"
41
+
"bizarrebuildings"
42
+
"bonehurtingjuice"
43
+
"boottoobig"
44
+
"bossfight"
45
+
"bravofotogeschichten"
46
+
"breathinginformation"
47
+
"buddhistmemes"
48
+
"cablefail"
49
+
"cableporn"
50
+
"catastrophicfailure"
51
+
"chairsunderwater"
52
+
"clevercomebacks"
53
+
"confusingperspective"
54
+
"conni"
55
+
"crappydesign"
56
+
"cursedcomments"
57
+
"desirepath"
58
+
"doenerverbrechen"
59
+
"dontdeadopeninside"
60
+
"educationalgifs"
61
+
"EngineeringPorn"
62
+
"eyebleach"
63
+
"forbiddensnacks"
64
+
"funnyanimals"
65
+
"gifs"
66
+
"Gittertiere"
67
+
"goodboomerhumor"
68
+
"grssk"
69
+
"halthoch"
70
+
"hmm"
71
+
"hmmm"
72
+
"holdmybeer"
73
+
"holup"
74
+
"iamatotalpieceofshit"
75
+
"ichbin40undlustig"
76
+
"idiotsincars"
77
+
"illegallysmolcats"
78
+
"infokriegerkutschen"
79
+
"instagramreality"
80
+
"instant_regret"
81
+
"itrunsdoom"
82
+
"itsaunixsystem"
83
+
"kamikazebywords"
84
+
"keming"
85
+
"kidsarefuckingstupid"
86
+
"kitchenconfidential"
87
+
"laughingbuddha"
88
+
"LiminalSpace"
89
+
"loadingicon"
90
+
"MachinePorn"
91
+
"mallninjashit"
92
+
"michaelbaygifs"
93
+
"mildlyinfuriating"
94
+
"miscatculations"
95
+
"natureisfuckinglit"
96
+
"nononoyesno"
97
+
"notinteresting"
98
+
"notliketheothergirls"
99
+
"oddlysatisfying"
100
+
"ofcoursethatsathing"
101
+
"okbuddylinux"
102
+
"OSHA"
103
+
"PeopleFuckingDying"
104
+
"Perfectfit"
105
+
"perfectloops"
106
+
"PerfectTiming"
107
+
"picsofunusualbirds"
108
+
"PixelArt"
109
+
"pizzacrimes"
110
+
"prequelmemes"
111
+
"Prisonwallet"
112
+
"reactiongifs"
113
+
"RealFakeDoors"
114
+
"reallifedoodles"
115
+
"RetroFuturism"
116
+
"robotsbeingjerks"
117
+
"SchizophreniaRides"
118
+
"scriptedasiangifs"
119
+
"shitposting"
120
+
"shittyfoodporn"
121
+
"shittyrobots"
122
+
"softwaregore"
123
+
"specializedtools"
124
+
"spicypillows"
125
+
"StallmanWasRight"
126
+
"startledcats"
127
+
"startrekstabilized"
128
+
"stupidfood"
129
+
"techsupportgore"
130
+
"thathappened"
131
+
"ThingsCutInHalfPorn"
132
+
"totallynotrobots"
133
+
"trippinthroughtime"
134
+
"Unexpected"
135
+
"urbanexploration"
136
+
"wasletztepreis"
137
+
"wellthatsucks"
138
+
"wertekinder"
139
+
"wewantplates"
140
+
"whatcouldgowrong"
141
+
"whatsthisbug"
142
+
"whatsthisplant"
143
+
"whatswrongwithyourdog"
144
+
"whenthe"
145
+
"yesyesyesyesno"
146
+
"youseeingthisshit"
147
+
]
148
+
}
141
149
NineGag: geeky,wtf,hot,trending
142
150
Instagram: nature,wtf
143
151
Fourchan: sci
···
154
162
restartIfChanged = true;
155
163
serviceConfig = {
156
164
Restart = "always";
157
-
ExecStart = "${self.packages.${pkgs.system}.nichtparasoup}/bin/nichtparasoup -c ${pkgs.writeText "config.ini" config.lass.nichtparasoup.config}";
165
+
ExecStart = "${
166
+
self.packages.${pkgs.system}.nichtparasoup
167
+
}/bin/nichtparasoup -c ${pkgs.writeText "config.ini" config.lass.nichtparasoup.config}";
158
168
};
159
169
};
160
170
};
+8
-2
3modules/screenlock.nix
+8
-2
3modules/screenlock.nix
+18
-17
3modules/usershadow.nix
+18
-17
3modules/usershadow.nix
···
1
-
{ config, lib, pkgs, ... }@args: with lib; let
1
+
{
2
+
config,
3
+
lib,
4
+
pkgs,
5
+
...
6
+
}:
7
+
with lib;
8
+
let
2
9
3
10
cfg = config.lass.usershadow;
4
11
···
17
24
type = types.str;
18
25
};
19
26
};
20
-
21
-
debugscript = pkgs.writeDash "testpam" ''
22
-
env > /tmp/xxx
23
-
echo xxx >> /tmp/xxx
24
-
${pkgs.coreutils}/bin/cat /home/testuser/.shadow >> /tmp/xxx
25
-
echo yyy >> /tmp/xxx
26
-
env >> /tmp/xxx
27
-
exit 23
28
-
'';
29
27
30
28
imp = {
31
29
environment.systemPackages = [ usershadow ];
···
58
56
};
59
57
};
60
58
61
-
usershadow = let
62
-
deps = [
63
-
"pwstore-fast"
64
-
"bytestring"
65
-
];
66
-
in pkgs.writeHaskellPackage "passwords" {
59
+
usershadow =
60
+
let
61
+
deps = [
62
+
"pwstore-fast"
63
+
"bytestring"
64
+
];
65
+
in
66
+
pkgs.writeHaskellPackage "passwords" {
67
67
ghc-options = [
68
68
"-rtsopts"
69
69
"-Wall"
···
144
144
};
145
145
};
146
146
147
-
in out
147
+
in
148
+
out
+18
-14
tools/get-spora-hosts.nix
+18
-14
tools/get-spora-hosts.nix
···
1
1
{ self, ... }:
2
2
{
3
-
perSystem = { system, pkgs, ... }: {
4
-
packages.get-spora-hosts = pkgs.writeScriptBin "get-spora-hosts" ''
5
-
set -eu
6
-
set -o pipefail
7
-
set -x
8
-
OUTDIR=$1
9
-
for host in ${self}/machines/*; do
10
-
if test -e "$host"/facts/mycelium_pubkey; then
11
-
if ! test -e "$OUTDIR"/"$(basename "$host")".json; then
12
-
${self.packages.${pkgs.system}.mycelium}/bin/mycelium inspect "$(cat "$host"/facts/mycelium_pubkey)" --json > "$OUTDIR/$(basename "$host").json"
3
+
perSystem =
4
+
{ system, pkgs, ... }:
5
+
{
6
+
packages.get-spora-hosts = pkgs.writeScriptBin "get-spora-hosts" ''
7
+
set -eu
8
+
set -o pipefail
9
+
set -x
10
+
OUTDIR=$1
11
+
for host in ${self}/machines/*; do
12
+
if test -e "$host"/facts/mycelium_pubkey; then
13
+
if ! test -e "$OUTDIR"/"$(basename "$host")".json; then
14
+
${
15
+
self.packages.${pkgs.system}.mycelium
16
+
}/bin/mycelium inspect "$(cat "$host"/facts/mycelium_pubkey)" --json > "$OUTDIR/$(basename "$host").json"
17
+
fi
13
18
fi
14
-
fi
15
-
done
16
-
'';
17
-
};
19
+
done
20
+
'';
21
+
};
18
22
}
+210
-127
tools/nvim.nix
+210
-127
tools/nvim.nix
···
1
1
{ inputs, ... }:
2
2
{
3
-
perSystem = { system, ... }: {
4
-
packages.nvim = inputs.nixvim.legacyPackages.${system}.makeNixvim {
5
-
vimAlias = true;
6
-
colorschemes.ayu = {
7
-
enable = true;
8
-
settings.overrides = {
9
-
EoLSpace = { bg = "#883333"; };
10
-
};
11
-
};
12
-
globals.mapleader = " ";
13
-
opts = {
14
-
mouse = "a";
15
-
number = true;
16
-
shiftwidth = 2;
17
-
clipboard = "unnamedplus";
18
-
# undo stuff
19
-
undofile = {};
20
-
undolevels = 10000;
21
-
undoreload = 10000;
22
-
listchars = "tab:⇥ ,extends:❯,precedes:❮,nbsp:␣,trail:·,eol:↲";
23
-
};
24
-
extraConfigVim = ''
25
-
set et
26
-
27
-
" show special characters
28
-
set list
29
-
30
-
" match trailing whitespace
31
-
match EoLSpace /\s\+$/
32
-
33
-
" need to use lua to expand $HOME
34
-
lua vim.o.undodir = vim.fs.normalize('$HOME/.vim/undodir')
35
-
'';
36
-
keymaps = [
37
-
{ mode = "i"; key = "<C-p>"; action = "<Nop>"; }
38
-
{ mode = "i"; key = "<C-n>"; action = "<Nop>"; }
39
-
{ mode = "n"; key = "<C-c>"; action = ":q<cr>"; }
40
-
{ mode = "n"; key = "<Space>"; action = "<Nop>"; }
41
-
{ mode = "n"; key = "<leader>u"; action = ":UndotreeToggle<cr>"; }
42
-
{ mode = "n"; key = "<leader>sd"; action = ":colorscheme ayu-dark<cr>"; }
43
-
{ mode = "n"; key = "<leader>sw"; action = ":colorscheme ayu-light<cr>"; }
44
-
{ mode = [ "n" "v" ]; key = "<leader>cc"; action = ":CopilotChatOpen<cr>"; }
45
-
{ mode = [ "n" "v" ]; key = "<leader>ce"; action = ":CopilotChatExplain<cr>"; }
46
-
{ mode = [ "n" "v" ]; key = "<leader>cr"; action = ":CopilotChatReview<cr>"; }
47
-
{ mode = [ "n" "v" ]; key = "<leader>cf"; action = ":CopilotChatFix<cr>"; }
48
-
{ mode = [ "n" "v" ]; key = "<leader>cd"; action = ":CopilotChatDocs<cr>"; }
49
-
{ mode = [ "n" "x" ]; key = "p"; action = "<Plug>(YankyPutAfter)"; }
50
-
{ mode = [ "n" "x" ]; key = "P"; action = "<Plug>(YankyPutBefore)"; }
51
-
];
52
-
plugins.web-devicons.enable = true;
53
-
plugins.telescope = {
54
-
enable = true;
55
-
keymaps = {
56
-
"<leader>b" = "buffers";
57
-
"<leader>ff" = "find_files";
58
-
"<leader>fg" = "live_grep";
59
-
"<leader>fh" = "help_tags";
60
-
"<leader>fp" = "yank_history";
61
-
};
62
-
};
63
-
plugins.lsp-format.enable = true;
64
-
plugins.lsp = {
65
-
enable = true;
66
-
servers = {
67
-
bashls.enable = true; # bash
68
-
nixd.enable = true; # nix
69
-
ruff-lsp.enable = true; # python
70
-
harper-ls.enable = true; # comments
71
-
jsonls.enable = true; # json
72
-
};
73
-
};
74
-
plugins.undotree = {
75
-
enable = true;
76
-
settings.SetFocusWhenToggle = true;
77
-
};
78
-
plugins.treesitter.enable = true;
79
-
plugins.copilot-cmp.enable = true;
80
-
plugins.copilot-lua.panel.enabled = false;
81
-
plugins.copilot-lua.suggestion.enabled = false;
82
-
plugins.cmp_yanky.enable = true;
83
-
plugins.cmp = {
84
-
enable = true;
85
-
autoEnableSources = true;
86
-
settings = {
87
-
experimental = { ghost_text = true; };
88
-
sources = [
89
-
{ name = "nvim_lsp"; }
90
-
{ name = "emoji"; }
91
-
{
92
-
name = "buffer"; # text within current buffer
93
-
option.get_bufnrs.__raw = "vim.api.nvim_list_bufs";
94
-
keywordLength = 2;
95
-
}
96
-
{
97
-
name = "copilot"; # enable copilot
98
-
}
99
-
{
100
-
name = "path"; # file system paths
101
-
keywordLength = 3;
102
-
}
103
-
{ name = "cmp_yanky"; }
104
-
];
105
-
106
-
mapping = {
107
-
"<Tab>" = "cmp.mapping.select_next_item()";
108
-
"<S-Tab>" = "cmp.mapping.select_prev_item()";
109
-
"<C-n>" = "cmp.mapping.select_next_item()";
110
-
"<C-p>" = "cmp.mapping.select_prev_item()";
111
-
"<C-e>" = "cmp.mapping.abort()";
112
-
"<C-b>" = "cmp.mapping.scroll_docs(-4)";
113
-
"<C-f>" = "cmp.mapping.scroll_docs(4)";
114
-
"<C-Space>" = "cmp.mapping.complete()";
115
-
"<CR>" = "cmp.mapping.confirm({ select = true })";
116
-
"<S-CR>" = "cmp.mapping.confirm({ behavior = cmp.ConfirmBehavior.Replace, select = true })";
3
+
perSystem =
4
+
{ system, ... }:
5
+
{
6
+
packages.nvim = inputs.nixvim.legacyPackages.${system}.makeNixvim {
7
+
vimAlias = true;
8
+
colorschemes.ayu = {
9
+
enable = true;
10
+
settings.overrides = {
11
+
EoLSpace = {
12
+
bg = "#883333";
13
+
};
117
14
};
118
15
};
16
+
globals.mapleader = " ";
17
+
opts = {
18
+
mouse = "a";
19
+
number = true;
20
+
shiftwidth = 2;
21
+
clipboard = "unnamedplus";
22
+
# undo stuff
23
+
undofile = { };
24
+
undolevels = 10000;
25
+
undoreload = 10000;
26
+
listchars = "tab:⇥ ,extends:❯,precedes:❮,nbsp:␣,trail:·,eol:↲";
27
+
};
28
+
extraConfigVim = ''
29
+
set et
30
+
31
+
" show special characters
32
+
set list
33
+
34
+
" match trailing whitespace
35
+
match EoLSpace /\s\+$/
36
+
37
+
" need to use lua to expand $HOME
38
+
lua vim.o.undodir = vim.fs.normalize('$HOME/.vim/undodir')
39
+
'';
40
+
keymaps = [
41
+
{
42
+
mode = "i";
43
+
key = "<C-p>";
44
+
action = "<Nop>";
45
+
}
46
+
{
47
+
mode = "i";
48
+
key = "<C-n>";
49
+
action = "<Nop>";
50
+
}
51
+
{
52
+
mode = "n";
53
+
key = "<C-c>";
54
+
action = ":q<cr>";
55
+
}
56
+
{
57
+
mode = "n";
58
+
key = "<Space>";
59
+
action = "<Nop>";
60
+
}
61
+
{
62
+
mode = "n";
63
+
key = "<leader>u";
64
+
action = ":UndotreeToggle<cr>";
65
+
}
66
+
{
67
+
mode = "n";
68
+
key = "<leader>sd";
69
+
action = ":colorscheme ayu-dark<cr>";
70
+
}
71
+
{
72
+
mode = "n";
73
+
key = "<leader>sw";
74
+
action = ":colorscheme ayu-light<cr>";
75
+
}
76
+
{
77
+
mode = [
78
+
"n"
79
+
"v"
80
+
];
81
+
key = "<leader>cc";
82
+
action = ":CopilotChatOpen<cr>";
83
+
}
84
+
{
85
+
mode = [
86
+
"n"
87
+
"v"
88
+
];
89
+
key = "<leader>ce";
90
+
action = ":CopilotChatExplain<cr>";
91
+
}
92
+
{
93
+
mode = [
94
+
"n"
95
+
"v"
96
+
];
97
+
key = "<leader>cr";
98
+
action = ":CopilotChatReview<cr>";
99
+
}
100
+
{
101
+
mode = [
102
+
"n"
103
+
"v"
104
+
];
105
+
key = "<leader>cf";
106
+
action = ":CopilotChatFix<cr>";
107
+
}
108
+
{
109
+
mode = [
110
+
"n"
111
+
"v"
112
+
];
113
+
key = "<leader>cd";
114
+
action = ":CopilotChatDocs<cr>";
115
+
}
116
+
{
117
+
mode = [
118
+
"n"
119
+
"x"
120
+
];
121
+
key = "p";
122
+
action = "<Plug>(YankyPutAfter)";
123
+
}
124
+
{
125
+
mode = [
126
+
"n"
127
+
"x"
128
+
];
129
+
key = "P";
130
+
action = "<Plug>(YankyPutBefore)";
131
+
}
132
+
];
133
+
plugins.web-devicons.enable = true;
134
+
plugins.telescope = {
135
+
enable = true;
136
+
keymaps = {
137
+
"<leader>b" = "buffers";
138
+
"<leader>ff" = "find_files";
139
+
"<leader>fg" = "live_grep";
140
+
"<leader>fh" = "help_tags";
141
+
"<leader>fp" = "yank_history";
142
+
};
143
+
};
144
+
plugins.lsp-format.enable = true;
145
+
plugins.lsp = {
146
+
enable = true;
147
+
servers = {
148
+
bashls.enable = true; # bash
149
+
nixd.enable = true; # nix
150
+
ruff-lsp.enable = true; # python
151
+
harper-ls.enable = true; # comments
152
+
jsonls.enable = true; # json
153
+
};
154
+
};
155
+
plugins.undotree = {
156
+
enable = true;
157
+
settings.SetFocusWhenToggle = true;
158
+
};
159
+
plugins.treesitter.enable = true;
160
+
plugins.copilot-cmp.enable = true;
161
+
plugins.copilot-lua.panel.enabled = false;
162
+
plugins.copilot-lua.suggestion.enabled = false;
163
+
plugins.cmp_yanky.enable = true;
164
+
plugins.cmp = {
165
+
enable = true;
166
+
autoEnableSources = true;
167
+
settings = {
168
+
experimental = {
169
+
ghost_text = true;
170
+
};
171
+
sources = [
172
+
{ name = "nvim_lsp"; }
173
+
{ name = "emoji"; }
174
+
{
175
+
name = "buffer"; # text within current buffer
176
+
option.get_bufnrs.__raw = "vim.api.nvim_list_bufs";
177
+
keywordLength = 2;
178
+
}
179
+
{
180
+
name = "copilot"; # enable copilot
181
+
}
182
+
{
183
+
name = "path"; # file system paths
184
+
keywordLength = 3;
185
+
}
186
+
{ name = "cmp_yanky"; }
187
+
];
188
+
189
+
mapping = {
190
+
"<Tab>" = "cmp.mapping.select_next_item()";
191
+
"<S-Tab>" = "cmp.mapping.select_prev_item()";
192
+
"<C-n>" = "cmp.mapping.select_next_item()";
193
+
"<C-p>" = "cmp.mapping.select_prev_item()";
194
+
"<C-e>" = "cmp.mapping.abort()";
195
+
"<C-b>" = "cmp.mapping.scroll_docs(-4)";
196
+
"<C-f>" = "cmp.mapping.scroll_docs(4)";
197
+
"<C-Space>" = "cmp.mapping.complete()";
198
+
"<CR>" = "cmp.mapping.confirm({ select = true })";
199
+
"<S-CR>" = "cmp.mapping.confirm({ behavior = cmp.ConfirmBehavior.Replace, select = true })";
200
+
};
201
+
};
202
+
};
203
+
plugins.none-ls = {
204
+
enable = true;
205
+
sources.formatting.treefmt.enable = true;
206
+
};
207
+
plugins.bufferline.enable = true;
208
+
plugins.which-key.enable = true;
209
+
plugins.yanky = {
210
+
enable = true;
211
+
enableTelescope = true;
212
+
};
213
+
plugins.comment.enable = true;
214
+
plugins.copilot-chat.enable = true;
119
215
};
120
-
plugins.none-ls = {
121
-
enable = true;
122
-
sources.formatting.treefmt.enable = true;
123
-
};
124
-
plugins.bufferline.enable = true;
125
-
plugins.which-key.enable = true;
126
-
plugins.yanky = {
127
-
enable = true;
128
-
enableTelescope = true;
129
-
};
130
-
plugins.comment.enable = true;
131
-
plugins.copilot-chat.enable = true;
132
216
};
133
-
};
134
217
}
+146
-143
tools/zsh.nix
+146
-143
tools/zsh.nix
···
1
1
{ ... }:
2
2
{
3
-
perSystem = { system, pkgs, ... }: let
4
-
zshrc = ''
5
-
autoload -U compinit && compinit
3
+
perSystem =
4
+
{ pkgs, ... }:
5
+
let
6
+
zshrc = ''
7
+
autoload -U compinit && compinit
6
8
7
-
# Setup custom interactive shell init stuff.
8
-
# Bind gpg-agent to this TTY if gpg commands are used.
9
-
export GPG_TTY=$(tty)
9
+
# Setup custom interactive shell init stuff.
10
+
# Bind gpg-agent to this TTY if gpg commands are used.
11
+
export GPG_TTY=$(tty)
10
12
11
13
12
-
unsetopt nomatch # no matches found urls
13
-
setopt autocd extendedglob
14
-
bindkey -e
14
+
unsetopt nomatch # no matches found urls
15
+
setopt autocd extendedglob
16
+
bindkey -e
15
17
16
-
#C-x C-e open line in editor
17
-
autoload -z edit-command-line
18
-
zle -N edit-command-line
19
-
bindkey "^X^E" edit-command-line
18
+
#C-x C-e open line in editor
19
+
autoload -z edit-command-line
20
+
zle -N edit-command-line
21
+
bindkey "^X^E" edit-command-line
20
22
21
-
#fzf inclusion
22
-
source ${pkgs.fzf}/share/fzf/completion.zsh
23
-
source ${pkgs.fzf}/share/fzf/key-bindings.zsh
23
+
#fzf inclusion
24
+
source ${pkgs.fzf}/share/fzf/completion.zsh
25
+
source ${pkgs.fzf}/share/fzf/key-bindings.zsh
24
26
25
-
# atuin distributed shell history
26
-
export ATUIN_CONFIG_DIR=${pkgs.writeTextDir "/config.toml" ''
27
-
auto_sync = true
28
-
update_check = false
29
-
sync_address = "http://green.r:8888"
30
-
sync_frequency = 0
31
-
style = "compact"
32
-
''};
33
-
export ATUIN_NOBIND="true" # disable all keybdinings of atuin
34
-
eval "$(atuin init zsh)"
35
-
bindkey '^r' _atuin_search_widget # bind ctrl+r to atuin
36
-
# use zsh only session history
37
-
fc -p
27
+
# atuin distributed shell history
28
+
export ATUIN_CONFIG_DIR=${pkgs.writeTextDir "/config.toml" ''
29
+
auto_sync = true
30
+
update_check = false
31
+
sync_address = "http://green.r:8888"
32
+
sync_frequency = 0
33
+
style = "compact"
34
+
''};
35
+
export ATUIN_NOBIND="true" # disable all keybdinings of atuin
36
+
eval "$(atuin init zsh)"
37
+
bindkey '^r' _atuin_search_widget # bind ctrl+r to atuin
38
+
# use zsh only session history
39
+
fc -p
38
40
39
-
#completion magic
40
-
autoload -Uz compinit
41
-
compinit
42
-
zstyle ':completion:*' menu select
41
+
#completion magic
42
+
autoload -Uz compinit
43
+
compinit
44
+
zstyle ':completion:*' menu select
43
45
44
-
#enable automatic rehashing of $PATH
45
-
zstyle ':completion:*' rehash true
46
+
#enable automatic rehashing of $PATH
47
+
zstyle ':completion:*' rehash true
46
48
47
-
# fancy mv which interactively gets the second argument if not given
48
-
function mv() {
49
-
if [[ "$#" -ne 1 ]] || [[ ! -e "$1" ]]; then
50
-
command mv -v "$@"
51
-
return
52
-
fi
49
+
# fancy mv which interactively gets the second argument if not given
50
+
function mv() {
51
+
if [[ "$#" -ne 1 ]] || [[ ! -e "$1" ]]; then
52
+
command mv -v "$@"
53
+
return
54
+
fi
53
55
54
-
newfilename="$1"
55
-
vared newfilename
56
-
command mv -v -- "$1" "$newfilename"
57
-
}
56
+
newfilename="$1"
57
+
vared newfilename
58
+
command mv -v -- "$1" "$newfilename"
59
+
}
58
60
59
-
#emacs bindings
60
-
bindkey "[7~" beginning-of-line
61
-
bindkey "[8~" end-of-line
62
-
bindkey "Oc" emacs-forward-word
63
-
bindkey "Od" emacs-backward-word
61
+
#emacs bindings
62
+
bindkey "[7~" beginning-of-line
63
+
bindkey "[8~" end-of-line
64
+
bindkey "Oc" emacs-forward-word
65
+
bindkey "Od" emacs-backward-word
64
66
65
-
# direnv integration
66
-
eval "$(${pkgs.direnv}/bin/direnv hook zsh)"
67
+
# direnv integration
68
+
eval "$(${pkgs.direnv}/bin/direnv hook zsh)"
67
69
68
-
# This function is called whenever a command is not found.
69
-
command_not_found_handler() {
70
-
local p='${pkgs.nix-index}/etc/profile.d/command-not-found.sh'
71
-
if [ -x "$p" ] && [ -f '/nix/var/nix/profiles/per-user/root/channels/nixos/programs.sqlite' ]; then
72
-
# Run the helper program.
73
-
"$p" "$@"
70
+
# This function is called whenever a command is not found.
71
+
command_not_found_handler() {
72
+
local p='${pkgs.nix-index}/etc/profile.d/command-not-found.sh'
73
+
if [ -x "$p" ] && [ -f '/nix/var/nix/profiles/per-user/root/channels/nixos/programs.sqlite' ]; then
74
+
# Run the helper program.
75
+
"$p" "$@"
74
76
75
-
# Retry the command if we just installed it.
76
-
if [ $? = 126 ]; then
77
-
"$@"
77
+
# Retry the command if we just installed it.
78
+
if [ $? = 126 ]; then
79
+
"$@"
80
+
else
81
+
return 127
82
+
fi
78
83
else
84
+
# Indicate than there was an error so ZSH falls back to its default handler
85
+
echo "$1: command not found" >&2
79
86
return 127
80
87
fi
88
+
}
89
+
90
+
91
+
# Setup aliases.
92
+
alias -- grep='grep --color=auto'
93
+
alias -- ip='ip -color=auto'
94
+
alias -- l='ls -alh'
95
+
alias -- la='ls -la'
96
+
alias -- ll='ls -l'
97
+
alias -- ls='ls --color'
98
+
alias -- ns='nix-shell --command zsh'
99
+
100
+
# Setup prompt.
101
+
autoload -U promptinit
102
+
promptinit
103
+
104
+
p_error='%(?..%F{red}%?%f )'
105
+
t_error='%(?..%? )'
106
+
107
+
case $UID in
108
+
0)
109
+
p_username='%F{red}root%f'
110
+
t_username='root'
111
+
;;
112
+
1337)
113
+
p_username=""
114
+
t_username=""
115
+
;;
116
+
*)
117
+
p_username='%F{blue}%n%f'
118
+
t_username='%n'
119
+
;;
120
+
esac
121
+
122
+
if test -n "$SSH_CLIENT"; then
123
+
p_hostname='@%F{magenta}%M%f '
124
+
t_hostname='@%M '
81
125
else
82
-
# Indicate than there was an error so ZSH falls back to its default handler
83
-
echo "$1: command not found" >&2
84
-
return 127
126
+
p_hostname=""
127
+
t_hostname=""
85
128
fi
86
-
}
87
129
130
+
#check if in nix shell
131
+
if test -n "$IN_NIX_SHELL"; then
132
+
p_nixshell='%F{green}[s]%f '
133
+
t_nixshell='[s] '
134
+
else
135
+
p_nixshell=""
136
+
t_nixshell=""
137
+
fi
88
138
89
-
# Setup aliases.
90
-
alias -- grep='grep --color=auto'
91
-
alias -- ip='ip -color=auto'
92
-
alias -- l='ls -alh'
93
-
alias -- la='ls -la'
94
-
alias -- ll='ls -l'
95
-
alias -- ls='ls --color'
96
-
alias -- ns='nix-shell --command zsh'
97
-
98
-
# Setup prompt.
99
-
autoload -U promptinit
100
-
promptinit
101
-
102
-
p_error='%(?..%F{red}%?%f )'
103
-
t_error='%(?..%? )'
104
-
105
-
case $UID in
106
-
0)
107
-
p_username='%F{red}root%f'
108
-
t_username='root'
139
+
PROMPT="$p_error$p_username$p_hostname$p_nixshell%~ "
140
+
TITLE="$t_error$t_username$t_hostname$t_nixshell%~"
141
+
case $TERM in
142
+
(*xterm* | *rxvt*)
143
+
function precmd {
144
+
PROMPT_EVALED=$(print -P "$TITLE")
145
+
echo -ne "\033]0;$$ $PROMPT_EVALED\007"
146
+
}
147
+
# This seems broken for some reason
148
+
# # This is seen while the shell waits for a command to complete.
149
+
# function preexec {
150
+
# PROMPT_EVALED=$(print -P "$TITLE")
151
+
# echo -ne "\033]0;$$ $PROMPT_EVALED $1\007"
152
+
# }
109
153
;;
110
-
1337)
111
-
p_username=""
112
-
t_username=""
113
-
;;
114
-
*)
115
-
p_username='%F{blue}%n%f'
116
-
t_username='%n'
117
-
;;
118
-
esac
119
-
120
-
if test -n "$SSH_CLIENT"; then
121
-
p_hostname='@%F{magenta}%M%f '
122
-
t_hostname='@%M '
123
-
else
124
-
p_hostname=""
125
-
t_hostname=""
126
-
fi
127
-
128
-
#check if in nix shell
129
-
if test -n "$IN_NIX_SHELL"; then
130
-
p_nixshell='%F{green}[s]%f '
131
-
t_nixshell='[s] '
132
-
else
133
-
p_nixshell=""
134
-
t_nixshell=""
135
-
fi
136
-
137
-
PROMPT="$p_error$p_username$p_hostname$p_nixshell%~ "
138
-
TITLE="$t_error$t_username$t_hostname$t_nixshell%~"
139
-
case $TERM in
140
-
(*xterm* | *rxvt*)
141
-
function precmd {
142
-
PROMPT_EVALED=$(print -P "$TITLE")
143
-
echo -ne "\033]0;$$ $PROMPT_EVALED\007"
144
-
}
145
-
# This seems broken for some reason
146
-
# # This is seen while the shell waits for a command to complete.
147
-
# function preexec {
148
-
# PROMPT_EVALED=$(print -P "$TITLE")
149
-
# echo -ne "\033]0;$$ $PROMPT_EVALED $1\007"
150
-
# }
151
-
;;
152
-
esac
154
+
esac
153
155
154
156
155
-
# Disable some features to support TRAMP.
156
-
if [ "$TERM" = dumb ]; then
157
-
unsetopt zle prompt_cr prompt_subst
158
-
unset RPS1 RPROMPT
159
-
PS1='$ '
160
-
PROMPT='$ '
161
-
fi
162
-
'';
163
-
in {
164
-
packages.sh = pkgs.writeScriptBin "sh" ''
165
-
zdotdir=$(mktemp -d)
166
-
export ZDOTDIR=${pkgs.writeTextDir "/.zshrc" zshrc}
167
-
exec ${pkgs.zsh}/bin/zsh "$@"
168
-
'';
169
-
};
157
+
# Disable some features to support TRAMP.
158
+
if [ "$TERM" = dumb ]; then
159
+
unsetopt zle prompt_cr prompt_subst
160
+
unset RPS1 RPROMPT
161
+
PS1='$ '
162
+
PROMPT='$ '
163
+
fi
164
+
'';
165
+
in
166
+
{
167
+
packages.sh = pkgs.writeScriptBin "sh" ''
168
+
zdotdir=$(mktemp -d)
169
+
export ZDOTDIR=${pkgs.writeTextDir "/.zshrc" zshrc}
170
+
exec ${pkgs.zsh}/bin/zsh "$@"
171
+
'';
172
+
};
170
173
}
+6
-1
2configs/antimicrox/default.nix
+6
-1
2configs/antimicrox/default.nix
+1
-1
2configs/binary-cache/proxy.nix
+1
-1
2configs/binary-cache/proxy.nix
+5
-3
2configs/binary-cache/server.nix
+5
-3
2configs/binary-cache/server.nix
···
1
-
{ config, lib, pkgs, ...}:
1
+
{ config, pkgs, ... }:
2
2
{
3
3
# nixpkgs.config.packageOverrides = p: {
4
4
# nix-serve = p.haskellPackages.nix-serve-ng;
···
8
8
clanCore.facts.services."nix-serve" = {
9
9
secret."nix-serve.key" = { };
10
10
public."nix-serve.pub" = { };
11
-
generator.path = with pkgs; [ coreutils nix ];
11
+
generator.path = with pkgs; [
12
+
coreutils
13
+
nix
14
+
];
12
15
generator.script = ''
13
16
nix-store --generate-binary-cache-key "$secrets"/nix-serve.key "$facts"/nix-serve.pub
14
17
'';
···
36
39
};
37
40
};
38
41
}
39
-
+42
-23
2configs/dns/knot.nix
+42
-23
2configs/dns/knot.nix
···
1
-
{ pkgs
2
-
, config
3
-
, lib
4
-
, inputs
5
-
, ...
1
+
{
2
+
lib,
3
+
...
6
4
}:
7
5
let
8
6
ip4 = "95.217.192.59";
···
21
19
22
20
# $TTL 300
23
21
24
-
# @ IN NS ns1.lassul.us.
25
-
# '';
26
22
in
23
+
# @ IN NS ns1.lassul.us.
24
+
# '';
27
25
{
28
26
#content of the secret
29
27
#key:
···
45
43
# ];
46
44
settings = {
47
45
server = {
48
-
listen = [ "${ip4}@53" "${ip6}@53" ];
46
+
listen = [
47
+
"${ip4}@53"
48
+
"${ip6}@53"
49
+
];
49
50
};
50
51
51
52
remote = [
···
110
111
}
111
112
];
112
113
113
-
mod-rrl = [{
114
-
id = "default";
115
-
rate-limit = 200;
116
-
slip = 2;
117
-
}];
114
+
mod-rrl = [
115
+
{
116
+
id = "default";
117
+
rate-limit = 200;
118
+
slip = 2;
119
+
}
120
+
];
118
121
119
-
policy = [{
120
-
id = "rsa2k";
121
-
algorithm = "RSASHA256";
122
-
ksk-size = 4096;
123
-
zsk-size = 2048;
124
-
nsec3 = true;
125
-
}];
122
+
policy = [
123
+
{
124
+
id = "rsa2k";
125
+
algorithm = "RSASHA256";
126
+
ksk-size = 4096;
127
+
zsk-size = 2048;
128
+
nsec3 = true;
129
+
}
130
+
];
126
131
127
132
zone = [
128
133
{
129
134
domain = "lassul.us";
130
135
file = "${./lassul.us.zone}";
131
-
notify = [ "hetzner_ip4_1" "hetzner_ip4_2" "hetzner_ip4_3" "hetzner_ip6_1" "hetzner_ip6_2" "hetzner_ip6_3" ];
132
-
acl = [ "hetzner_ip4_1" "hetzner_ip4_2" "hetzner_ip4_3" "hetzner_ip6_1" "hetzner_ip6_2" "hetzner_ip6_3" ];
136
+
notify = [
137
+
"hetzner_ip4_1"
138
+
"hetzner_ip4_2"
139
+
"hetzner_ip4_3"
140
+
"hetzner_ip6_1"
141
+
"hetzner_ip6_2"
142
+
"hetzner_ip6_3"
143
+
];
144
+
acl = [
145
+
"hetzner_ip4_1"
146
+
"hetzner_ip4_2"
147
+
"hetzner_ip4_3"
148
+
"hetzner_ip6_1"
149
+
"hetzner_ip6_2"
150
+
"hetzner_ip6_3"
151
+
];
133
152
dnssec-signing = true;
134
153
dnssec-policy = "rsa2k";
135
154
}
···
138
157
};
139
158
140
159
# disable to enable auto key generation
141
-
systemd.services.knot.serviceConfig.SystemCallFilter = lib.mkForce [];
160
+
systemd.services.knot.serviceConfig.SystemCallFilter = lib.mkForce [ ];
142
161
143
162
networking.firewall.allowedTCPPorts = [ 53 ];
144
163
networking.firewall.allowedUDPPorts = [ 53 ];
+32
-20
2configs/green-hosts/cryfs.nix
+32
-20
2configs/green-hosts/cryfs.nix
···
1
1
# seems to work, very slow though
2
2
3
-
{ config, lib, pkgs, ... }:
3
+
{ config, pkgs, ... }:
4
4
let
5
5
6
6
cname = "green-cryfs";
7
7
8
-
in {
8
+
in
9
+
{
9
10
imports = [
10
11
<stockholm/lass/2configs/container-networking.nix>
11
12
<stockholm/lass/2configs/syncthing.nix>
···
14
15
programs.fuse.userAllowOther = true;
15
16
16
17
services.syncthing.declarative.folders."/var/lib/sync-containers/${cname}/cryfs" = {
17
-
devices = [ "icarus" "skynet" "littleT" "shodan" "mors" "morpheus" ];
18
+
devices = [
19
+
"icarus"
20
+
"skynet"
21
+
"littleT"
22
+
"shodan"
23
+
"mors"
24
+
"morpheus"
25
+
];
18
26
ignorePerms = false;
19
27
};
20
28
···
25
33
];
26
34
};
27
35
28
-
29
36
systemd.services."container@${cname}".reloadIfChanged = mkForce false;
30
37
containers.${cname} = {
31
-
config = { ... }: {
32
-
environment.systemPackages = [
33
-
pkgs.git
34
-
pkgs.rxvt-unicode-unwrapped.terminfo
35
-
];
36
-
services.openssh.enable = true;
37
-
users.users.root.openssh.authorizedKeys.keys = [
38
-
config.krebs.users.lass.pubkey
39
-
];
40
-
system.activationScripts.fuse = {
41
-
text = ''
42
-
${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
43
-
'';
44
-
deps = [];
38
+
config =
39
+
{ ... }:
40
+
{
41
+
environment.systemPackages = [
42
+
pkgs.git
43
+
pkgs.rxvt-unicode-unwrapped.terminfo
44
+
];
45
+
services.openssh.enable = true;
46
+
users.users.root.openssh.authorizedKeys.keys = [
47
+
config.krebs.users.lass.pubkey
48
+
];
49
+
system.activationScripts.fuse = {
50
+
text = ''
51
+
${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
52
+
'';
53
+
deps = [ ];
54
+
};
45
55
};
46
-
};
47
56
allowedDevices = [
48
-
{ modifier = "rwm"; node = "/dev/fuse"; }
57
+
{
58
+
modifier = "rwm";
59
+
node = "/dev/fuse";
60
+
}
49
61
];
50
62
autoStart = false;
51
63
enableTun = true;
+32
-20
2configs/green-hosts/ecryptfs.nix
+32
-20
2configs/green-hosts/ecryptfs.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ config, pkgs, ... }:
2
2
let
3
3
4
4
cname = "green";
5
5
6
-
in {
6
+
in
7
+
{
7
8
imports = [
8
9
<stockholm/lass/2configs/container-networking.nix>
9
10
<stockholm/lass/2configs/syncthing.nix>
···
12
13
programs.fuse.userAllowOther = true;
13
14
14
15
services.syncthing.declarative.folders."/var/lib/sync-containers/${cname}/ecryptfs" = {
15
-
devices = [ "icarus" "skynet" "littleT" "shodan" "mors" "morpheus" ];
16
+
devices = [
17
+
"icarus"
18
+
"skynet"
19
+
"littleT"
20
+
"shodan"
21
+
"mors"
22
+
"morpheus"
23
+
];
16
24
ignorePerms = false;
17
25
};
18
26
···
25
33
26
34
systemd.services."container@${cname}".reloadIfChanged = mkForce false;
27
35
containers.${cname} = {
28
-
config = { ... }: {
29
-
environment.systemPackages = [
30
-
pkgs.git
31
-
pkgs.rxvt-unicode-unwrapped.terminfo
32
-
];
33
-
services.openssh.enable = true;
34
-
users.users.root.openssh.authorizedKeys.keys = [
35
-
config.krebs.users.lass.pubkey
36
-
];
37
-
system.activationScripts.fuse = {
38
-
text = ''
39
-
${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
40
-
'';
41
-
deps = [];
36
+
config =
37
+
{ ... }:
38
+
{
39
+
environment.systemPackages = [
40
+
pkgs.git
41
+
pkgs.rxvt-unicode-unwrapped.terminfo
42
+
];
43
+
services.openssh.enable = true;
44
+
users.users.root.openssh.authorizedKeys.keys = [
45
+
config.krebs.users.lass.pubkey
46
+
];
47
+
system.activationScripts.fuse = {
48
+
text = ''
49
+
${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
50
+
'';
51
+
deps = [ ];
52
+
};
42
53
};
43
-
};
44
54
allowedDevices = [
45
-
{ modifier = "rwm"; node = "/dev/fuse"; }
55
+
{
56
+
modifier = "rwm";
57
+
node = "/dev/fuse";
58
+
}
46
59
];
47
60
autoStart = false;
48
61
enableTun = true;
···
93
106
'')
94
107
];
95
108
}
96
-
+32
-21
2configs/green-hosts/plain-bindfs.nix
+32
-21
2configs/green-hosts/plain-bindfs.nix
···
1
1
# this seems to work, sadly there are no inotify events on the state directory because bindfs hides them,
2
2
3
-
{ config, lib, pkgs, ... }:
3
+
{ config, pkgs, ... }:
4
4
5
5
let
6
6
7
7
cname = "green-plain";
8
8
9
-
in {
9
+
in
10
+
{
10
11
imports = [
11
12
<stockholm/lass/2configs/container-networking.nix>
12
13
<stockholm/lass/2configs/syncthing.nix>
···
15
16
programs.fuse.userAllowOther = true;
16
17
17
18
services.syncthing.declarative.folders."/var/lib/containers/${cname}/var/state" = {
18
-
devices = [ "icarus" "skynet" "littleT" "shodan" "mors" "morpheus" ];
19
+
devices = [
20
+
"icarus"
21
+
"skynet"
22
+
"littleT"
23
+
"shodan"
24
+
"mors"
25
+
"morpheus"
26
+
];
19
27
ignorePerms = false;
20
28
};
21
29
···
26
34
];
27
35
};
28
36
29
-
30
37
systemd.services."container@${cname}".reloadIfChanged = mkForce false;
31
38
containers.${cname} = {
32
-
config = { ... }: {
33
-
environment.systemPackages = [
34
-
pkgs.git
35
-
pkgs.rxvt-unicode-unwrapped.terminfo
36
-
];
37
-
services.openssh.enable = true;
38
-
users.users.root.openssh.authorizedKeys.keys = [
39
-
config.krebs.users.lass.pubkey
40
-
];
41
-
system.activationScripts.fuse = {
42
-
text = ''
43
-
${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
44
-
'';
45
-
deps = [];
39
+
config =
40
+
{ ... }:
41
+
{
42
+
environment.systemPackages = [
43
+
pkgs.git
44
+
pkgs.rxvt-unicode-unwrapped.terminfo
45
+
];
46
+
services.openssh.enable = true;
47
+
users.users.root.openssh.authorizedKeys.keys = [
48
+
config.krebs.users.lass.pubkey
49
+
];
50
+
system.activationScripts.fuse = {
51
+
text = ''
52
+
${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
53
+
'';
54
+
deps = [ ];
55
+
};
46
56
};
47
-
};
48
57
allowedDevices = [
49
-
{ modifier = "rwm"; node = "/dev/fuse"; }
58
+
{
59
+
modifier = "rwm";
60
+
node = "/dev/fuse";
61
+
}
50
62
];
51
63
autoStart = false;
52
64
enableTun = true;
···
86
98
'')
87
99
];
88
100
}
89
-
+32
-21
2configs/green-hosts/plain-permown.nix
+32
-21
2configs/green-hosts/plain-permown.nix
···
1
1
# this seems to work fine, downsides are, all state is owned by syncthing and could be read by the guests syncthing
2
2
3
-
4
-
{ config, lib, pkgs, ... }:
3
+
{ config, pkgs, ... }:
5
4
6
5
let
7
6
8
7
cname = "green-plain";
9
8
10
-
in {
9
+
in
10
+
{
11
11
imports = [
12
12
<stockholm/lass/2configs/container-networking.nix>
13
13
<stockholm/lass/2configs/syncthing.nix>
14
14
];
15
15
16
16
services.syncthing.declarative.folders."/var/lib/containers/${cname}/var/state" = {
17
-
devices = [ "icarus" "skynet" "littleT" "shodan" "mors" "morpheus" ];
17
+
devices = [
18
+
"icarus"
19
+
"skynet"
20
+
"littleT"
21
+
"shodan"
22
+
"mors"
23
+
"morpheus"
24
+
];
18
25
ignorePerms = false;
19
26
};
20
27
···
27
34
28
35
systemd.services."container@${cname}".reloadIfChanged = mkForce false;
29
36
containers.${cname} = {
30
-
config = { ... }: {
31
-
environment.systemPackages = [
32
-
pkgs.git
33
-
pkgs.rxvt-unicode-unwrapped.terminfo
34
-
];
35
-
services.openssh.enable = true;
36
-
users.users.root.openssh.authorizedKeys.keys = [
37
-
config.krebs.users.lass.pubkey
38
-
];
39
-
system.activationScripts.fuse = {
40
-
text = ''
41
-
${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
42
-
'';
43
-
deps = [];
37
+
config =
38
+
{ ... }:
39
+
{
40
+
environment.systemPackages = [
41
+
pkgs.git
42
+
pkgs.rxvt-unicode-unwrapped.terminfo
43
+
];
44
+
services.openssh.enable = true;
45
+
users.users.root.openssh.authorizedKeys.keys = [
46
+
config.krebs.users.lass.pubkey
47
+
];
48
+
system.activationScripts.fuse = {
49
+
text = ''
50
+
${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
51
+
'';
52
+
deps = [ ];
53
+
};
44
54
};
45
-
};
46
55
allowedDevices = [
47
-
{ modifier = "rwm"; node = "/dev/fuse"; }
56
+
{
57
+
modifier = "rwm";
58
+
node = "/dev/fuse";
59
+
}
48
60
];
49
61
autoStart = false;
50
62
enableTun = true;
···
84
96
'')
85
97
];
86
98
}
87
-
+32
-20
2configs/green-hosts/plain.nix
+32
-20
2configs/green-hosts/plain.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ config, pkgs, ... }:
2
2
let
3
3
4
4
cname = "green-plain";
5
5
6
-
in {
6
+
in
7
+
{
7
8
imports = [
8
9
<stockholm/lass/2configs/container-networking.nix>
9
10
<stockholm/lass/2configs/syncthing.nix>
···
12
13
programs.fuse.userAllowOther = true;
13
14
14
15
services.syncthing.declarative.folders."/var/lib/containers/${cname}/var/state" = {
15
-
devices = [ "icarus" "skynet" "littleT" "shodan" "mors" "morpheus" ];
16
+
devices = [
17
+
"icarus"
18
+
"skynet"
19
+
"littleT"
20
+
"shodan"
21
+
"mors"
22
+
"morpheus"
23
+
];
16
24
ignorePerms = false;
17
25
};
18
26
···
25
33
26
34
systemd.services."container@${cname}".reloadIfChanged = mkForce false;
27
35
containers.${cname} = {
28
-
config = { ... }: {
29
-
environment.systemPackages = [
30
-
pkgs.git
31
-
pkgs.rxvt-unicode-unwrapped.terminfo
32
-
];
33
-
services.openssh.enable = true;
34
-
users.users.root.openssh.authorizedKeys.keys = [
35
-
config.krebs.users.lass.pubkey
36
-
];
37
-
system.activationScripts.fuse = {
38
-
text = ''
39
-
${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
40
-
'';
41
-
deps = [];
36
+
config =
37
+
{ ... }:
38
+
{
39
+
environment.systemPackages = [
40
+
pkgs.git
41
+
pkgs.rxvt-unicode-unwrapped.terminfo
42
+
];
43
+
services.openssh.enable = true;
44
+
users.users.root.openssh.authorizedKeys.keys = [
45
+
config.krebs.users.lass.pubkey
46
+
];
47
+
system.activationScripts.fuse = {
48
+
text = ''
49
+
${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
50
+
'';
51
+
deps = [ ];
52
+
};
42
53
};
43
-
};
44
54
allowedDevices = [
45
-
{ modifier = "rwm"; node = "/dev/fuse"; }
55
+
{
56
+
modifier = "rwm";
57
+
node = "/dev/fuse";
58
+
}
46
59
];
47
60
autoStart = false;
48
61
enableTun = true;
···
82
95
'')
83
96
];
84
97
}
85
-
+32
-20
2configs/green-hosts/securefs.nix
+32
-20
2configs/green-hosts/securefs.nix
···
1
1
# broken, muchsync cant sync into the folders which should be handles by bindfs
2
2
# ls -la also does not show the full directory permissions
3
-
{ config, lib, pkgs, ... }:
3
+
{ config, pkgs, ... }:
4
4
let
5
5
6
6
cname = "green";
7
7
8
-
in {
8
+
in
9
+
{
9
10
imports = [
10
11
<stockholm/lass/2configs/container-networking.nix>
11
12
<stockholm/lass/2configs/syncthing.nix>
···
14
15
programs.fuse.userAllowOther = true;
15
16
16
17
services.syncthing.declarative.folders."/var/lib/sync-containers/${cname}/securefs" = {
17
-
devices = [ "icarus" "skynet" "littleT" "shodan" "mors" "morpheus" ];
18
+
devices = [
19
+
"icarus"
20
+
"skynet"
21
+
"littleT"
22
+
"shodan"
23
+
"mors"
24
+
"morpheus"
25
+
];
18
26
ignorePerms = false;
19
27
};
20
28
···
27
35
28
36
systemd.services."container@${cname}".reloadIfChanged = mkForce false;
29
37
containers.${cname} = {
30
-
config = { ... }: {
31
-
environment.systemPackages = [
32
-
pkgs.git
33
-
pkgs.rxvt-unicode-unwrapped.terminfo
34
-
];
35
-
services.openssh.enable = true;
36
-
users.users.root.openssh.authorizedKeys.keys = [
37
-
config.krebs.users.lass.pubkey
38
-
];
39
-
system.activationScripts.fuse = {
40
-
text = ''
41
-
${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
42
-
'';
43
-
deps = [];
38
+
config =
39
+
{ ... }:
40
+
{
41
+
environment.systemPackages = [
42
+
pkgs.git
43
+
pkgs.rxvt-unicode-unwrapped.terminfo
44
+
];
45
+
services.openssh.enable = true;
46
+
users.users.root.openssh.authorizedKeys.keys = [
47
+
config.krebs.users.lass.pubkey
48
+
];
49
+
system.activationScripts.fuse = {
50
+
text = ''
51
+
${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
52
+
'';
53
+
deps = [ ];
54
+
};
44
55
};
45
-
};
46
56
allowedDevices = [
47
-
{ modifier = "rwm"; node = "/dev/fuse"; }
57
+
{
58
+
modifier = "rwm";
59
+
node = "/dev/fuse";
60
+
}
48
61
];
49
62
autoStart = false;
50
63
enableTun = true;
···
96
109
'')
97
110
];
98
111
}
99
-
+43
-14
2configs/hass/default.nix
+43
-14
2configs/hass/default.nix
···
5
5
];
6
6
7
7
krebs.iptables.tables.filter.INPUT.rules = [
8
-
{ predicate = "-i int0 -p tcp --dport 1883"; target = "ACCEPT"; } # mosquitto
9
-
{ predicate = "-i docker0 -p tcp --dport 1883"; target = "ACCEPT"; } # mosquitto
10
-
{ predicate = "-i int0 -p tcp --dport 8123"; target = "ACCEPT"; } # hass
11
-
{ predicate = "-i int0 -p tcp --dport 1337"; target = "ACCEPT"; } # zigbee2mqtt frontend
12
-
{ predicate = "-i retiolum -p tcp --dport 8123"; target = "ACCEPT"; } # hass
13
-
{ predicate = "-i retiolum -p tcp --dport 1337"; target = "ACCEPT"; } # zigbee2mqtt frontend
14
-
{ predicate = "-i wiregrill -p tcp --dport 8123"; target = "ACCEPT"; } # hass
15
-
{ predicate = "-i zttzibeakb -p tcp --dport 8123"; target = "ACCEPT"; } # hass
8
+
{
9
+
predicate = "-i int0 -p tcp --dport 1883";
10
+
target = "ACCEPT";
11
+
} # mosquitto
12
+
{
13
+
predicate = "-i docker0 -p tcp --dport 1883";
14
+
target = "ACCEPT";
15
+
} # mosquitto
16
+
{
17
+
predicate = "-i int0 -p tcp --dport 8123";
18
+
target = "ACCEPT";
19
+
} # hass
20
+
{
21
+
predicate = "-i int0 -p tcp --dport 1337";
22
+
target = "ACCEPT";
23
+
} # zigbee2mqtt frontend
24
+
{
25
+
predicate = "-i retiolum -p tcp --dport 8123";
26
+
target = "ACCEPT";
27
+
} # hass
28
+
{
29
+
predicate = "-i retiolum -p tcp --dport 1337";
30
+
target = "ACCEPT";
31
+
} # zigbee2mqtt frontend
32
+
{
33
+
predicate = "-i wiregrill -p tcp --dport 8123";
34
+
target = "ACCEPT";
35
+
} # hass
36
+
{
37
+
predicate = "-i zttzibeakb -p tcp --dport 8123";
38
+
target = "ACCEPT";
39
+
} # hass
16
40
];
17
41
18
42
systemd.services.hass-update = {
···
30
54
volumes = [ "home-assistant:/config" ];
31
55
environment.TZ = "Europe/Berlin";
32
56
image = "ghcr.io/home-assistant/home-assistant:stable"; # Warning: if the tag does not change, the image will not be updated
33
-
extraOptions = [
34
-
"--network=host"
57
+
extraOptions = [
58
+
"--network=host"
35
59
];
36
60
};
37
61
};
38
62
39
63
services.mosquitto = {
40
64
enable = true;
41
-
listeners = [{
42
-
acl = [ ];
43
-
users.gg23 = { acl = [ "readwrite #" ]; password = "gg23-mqtt"; };
44
-
}];
65
+
listeners = [
66
+
{
67
+
acl = [ ];
68
+
users.gg23 = {
69
+
acl = [ "readwrite #" ];
70
+
password = "gg23-mqtt";
71
+
};
72
+
}
73
+
];
45
74
};
46
75
47
76
environment.systemPackages = [ pkgs.mosquitto ];
-2
2configs/hass/zigbee.nix
-2
2configs/hass/zigbee.nix
···
75
75
# button https://www.zigbee2mqtt.io/devices/8718699693985.html#philips-8718699693985
76
76
"0x0017880108016e3e".friendly_name = "going_out_button";
77
77
78
-
79
78
# rotation https://www.zigbee2mqtt.io/devices/E1744.html
80
79
"0x8cf681fffe065493" = {
81
80
friendly_name = "r_test";
···
90
89
};
91
90
};
92
91
}
93
-
+12
-4
2configs/hw/gpd-pocket.nix
+12
-4
2configs/hw/gpd-pocket.nix
···
6
6
text = builtins.readFile ./brcmfmac4356-pcie.txt;
7
7
destination = "/lib/firmware/brcm/brcmfmac4356-pcie.txt";
8
8
};
9
-
in {
9
+
in
10
+
{
10
11
#imports = [ <nixpkgs/nixos/modules/installer/scan/not-detected.nix> ];
11
12
hardware.firmware = [ dummy_firmware ];
12
13
hardware.enableRedistributableFirmware = true;
13
14
14
-
boot.initrd.availableKernelModules = [ "xhci_pci" "usbhid" "usb_storage" "sd_mod" "sdhci_acpi" "sdhci_pci" ];
15
+
boot.initrd.availableKernelModules = [
16
+
"xhci_pci"
17
+
"usbhid"
18
+
"usb_storage"
19
+
"sd_mod"
20
+
"sdhci_acpi"
21
+
"sdhci_pci"
22
+
];
15
23
boot.kernelPackages = pkgs.linuxPackages_4_14;
16
24
boot.kernelParams = [
17
25
"fbcon=rotate:1"
···
23
31
services.xserver.dpi = 200;
24
32
fonts.fontconfig.dpi = 200;
25
33
lass.fonts.regular = "xft:Hack-Regular:pixelsize=22,xft:Symbola";
26
-
lass.fonts.bold = "xft:Hack-Bold:pixelsize=22,xft:Symbola";
27
-
lass.fonts.italic = "xft:Hack-RegularOblique:pixelsize=22,xft:Symbol";
34
+
lass.fonts.bold = "xft:Hack-Bold:pixelsize=22,xft:Symbola";
35
+
lass.fonts.italic = "xft:Hack-RegularOblique:pixelsize=22,xft:Symbol";
28
36
}
+24
-4
2configs/hw/x220.nix
+24
-4
2configs/hw/x220.nix
···
1
-
{ self, config, pkgs, ... }:
1
+
{
2
+
self,
3
+
config,
4
+
pkgs,
5
+
...
6
+
}:
2
7
{
3
8
imports = [
4
9
(self.inputs.stockholm + "/krebs/2configs/hw/x220.nix")
···
6
11
7
12
boot = {
8
13
initrd.luks.devices.luksroot.device = "/dev/sda3";
9
-
initrd.availableKernelModules = [ "xhci_hcd" "ehci_pci" "ahci" "usb_storage" ];
14
+
initrd.availableKernelModules = [
15
+
"xhci_hcd"
16
+
"ehci_pci"
17
+
"ahci"
18
+
"usb_storage"
19
+
];
10
20
extraModulePackages = [
11
21
config.boot.kernelPackages.tp_smapi
12
22
config.boot.kernelPackages.acpi_call
···
25
35
"/" = {
26
36
device = "/dev/mapper/pool-root";
27
37
fsType = "btrfs";
28
-
options = ["defaults" "noatime" "ssd" "compress=lzo"];
38
+
options = [
39
+
"defaults"
40
+
"noatime"
41
+
"ssd"
42
+
"compress=lzo"
43
+
];
29
44
};
30
45
"/boot" = {
31
46
device = "/dev/sda2";
···
33
48
"/home" = {
34
49
device = "/dev/mapper/pool-home";
35
50
fsType = "btrfs";
36
-
options = ["defaults" "noatime" "ssd" "compress=lzo"];
51
+
options = [
52
+
"defaults"
53
+
"noatime"
54
+
"ssd"
55
+
"compress=lzo"
56
+
];
37
57
};
38
58
};
39
59
+5
-2
2configs/mail/internet-gateway.nix
+5
-2
2configs/mail/internet-gateway.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ pkgs, ... }:
2
2
{
3
3
security.acme.certs."mail.lassul.us" = {
4
4
group = "lasscert";
···
12
12
clanCore.facts.services."lassul.us-dkim" = {
13
13
secret."lassul.us.dkim.priv" = { };
14
14
public."lassul.us.dkim.pub" = { };
15
-
generator.path = with pkgs; [ coreutils openssl ];
15
+
generator.path = with pkgs; [
16
+
coreutils
17
+
openssl
18
+
];
16
19
generator.script = ''
17
20
openssl genrsa -out "$secrets"/lassul.us.dkim.priv 2048
18
21
openssl rsa -in "$secrets"/lassul.us.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/lassul.us.dkim.pub
+23
-13
2configs/monitoring/prometheus.nix
+23
-13
2configs/monitoring/prometheus.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ lib, pkgs, ... }:
2
2
{
3
3
#prometheus
4
4
krebs.iptables = {
5
5
enable = true;
6
6
tables.filter.INPUT.rules = [
7
-
{ predicate = "-i retiolum -p tcp --dport 80"; target = "ACCEPT"; } # nginx
7
+
{
8
+
predicate = "-i retiolum -p tcp --dport 80";
9
+
target = "ACCEPT";
10
+
} # nginx
8
11
# { predicate = "-i retiolum -p tcp --dport 3012"; target = "ACCEPT"; } # grafana
9
12
# { predicate = "-i retiolum -p tcp --dport 9093"; target = "ACCEPT"; } # alertmanager
10
13
# { predicate = "-i retiolum -p tcp --dport 9223"; target = "ACCEPT"; } # alertmanager
···
38
41
services.prometheus = {
39
42
enable = true;
40
43
ruleFiles = [
41
-
(pkgs.writeText "prometheus-rules.yml" (builtins.toJSON {
42
-
groups = [{
43
-
name = "alerting-rules";
44
-
rules = import ./alert-rules.nix { inherit lib; };
45
-
}];
46
-
}))
44
+
(pkgs.writeText "prometheus-rules.yml" (
45
+
builtins.toJSON {
46
+
groups = [
47
+
{
48
+
name = "alerting-rules";
49
+
rules = import ./alert-rules.nix { inherit lib; };
50
+
}
51
+
];
52
+
}
53
+
))
47
54
];
48
55
scrapeConfigs = [
49
56
{
···
62
69
}
63
70
];
64
71
alertmanagers = [
65
-
{ scheme = "http";
72
+
{
73
+
scheme = "http";
66
74
path_prefix = "/";
67
75
static_configs = [ { targets = [ "localhost:9093" ]; } ];
68
76
}
···
94
102
receivers = [
95
103
{
96
104
name = "all";
97
-
webhook_configs = [{
98
-
url = "http://127.0.0.1:9223/";
99
-
max_alerts = 5;
100
-
}];
105
+
webhook_configs = [
106
+
{
107
+
url = "http://127.0.0.1:9223/";
108
+
max_alerts = 5;
109
+
}
110
+
];
101
111
}
102
112
{
103
113
name = "default";
+126
-92
2configs/monitoring/telegraf.nix
+126
-92
2configs/monitoring/telegraf.nix
···
1
-
{ pkgs, lib, config, ... }:
1
+
{
2
+
pkgs,
3
+
lib,
4
+
config,
5
+
...
6
+
}:
2
7
# To use this module you also need to allow port 9273 either on the internet or on a vpn interface
3
8
# i.e. networking.firewall.interfaces."vpn0".allowedTCPPorts = [ 9273 ];
4
9
# Example prometheus alert rules:
5
10
# - https://github.com/Mic92/dotfiles/blob/master/nixos/eva/modules/prometheus/alert-rules.nix
6
11
let
7
-
isVM = lib.any (mod: mod == "xen-blkfront" || mod == "virtio_console") config.boot.initrd.kernelModules;
12
+
isVM = lib.any (
13
+
mod: mod == "xen-blkfront" || mod == "virtio_console"
14
+
) config.boot.initrd.kernelModules;
8
15
# potentially wrong if the nvme is not used at boot...
9
16
hasNvme = lib.any (m: m == "nvme") config.boot.initrd.availableKernelModules;
10
17
···
13
20
${pkgs.jq}/bin/jq -r 'map(.addr_info) | flatten(1) | map(select(.dadfailed == true)) | map(.local) | @text "ipv6_dad_failures count=\(length)i"'
14
21
'';
15
22
16
-
zfsChecks = lib.optional
17
-
(lib.any (fs: fs == "zfs") (lib.attrNames config.boot.supportedFilesystems))
18
-
(pkgs.writeScript "zpool-health" ''
19
-
#!${pkgs.gawk}/bin/awk -f
20
-
BEGIN {
21
-
while ("${pkgs.zfs}/bin/zpool status" | getline) {
22
-
if ($1 ~ /pool:/) { printf "zpool_status,name=%s ", $2 }
23
-
if ($1 ~ /state:/) { printf " state=\"%s\",", $2 }
24
-
if ($1 ~ /errors:/) {
25
-
if (index($2, "No")) printf "errors=0i\n"; else printf "errors=%di\n", $2
23
+
zfsChecks =
24
+
lib.optional (lib.any (fs: fs == "zfs") (lib.attrNames config.boot.supportedFilesystems))
25
+
(
26
+
pkgs.writeScript "zpool-health" ''
27
+
#!${pkgs.gawk}/bin/awk -f
28
+
BEGIN {
29
+
while ("${pkgs.zfs}/bin/zpool status" | getline) {
30
+
if ($1 ~ /pool:/) { printf "zpool_status,name=%s ", $2 }
31
+
if ($1 ~ /state:/) { printf " state=\"%s\",", $2 }
32
+
if ($1 ~ /errors:/) {
33
+
if (index($2, "No")) printf "errors=0i\n"; else printf "errors=%di\n", $2
34
+
}
35
+
}
26
36
}
27
-
}
28
-
}
29
-
'');
37
+
''
38
+
);
30
39
31
40
nfsChecks =
32
41
let
33
-
collectHosts = shares: fs:
34
-
if builtins.elem fs.fsType [ "nfs" "nfs3" "nfs4" ]
42
+
collectHosts =
43
+
shares: fs:
44
+
if
45
+
builtins.elem fs.fsType [
46
+
"nfs"
47
+
"nfs3"
48
+
"nfs4"
49
+
]
35
50
then
36
51
shares
37
52
// (
···
45
60
${host} = (shares.${host} or [ ]) ++ [ path ];
46
61
}
47
62
)
48
-
else shares;
63
+
else
64
+
shares;
49
65
nfsHosts = lib.foldl collectHosts { } (builtins.attrValues config.fileSystems);
50
66
in
51
-
lib.mapAttrsToList
52
-
(
53
-
host: args:
54
-
(pkgs.writeScript "nfs-health" ''
55
-
#!${pkgs.gawk}/bin/awk -f
56
-
BEGIN {
57
-
for (i = 2; i < ARGC; i++) {
58
-
mounts[ARGV[i]] = 1
59
-
}
60
-
while ("${pkgs.nfs-utils}/bin/showmount -e " ARGV[1] | getline) {
61
-
if (NR == 1) { continue }
62
-
if (mounts[$1] == 1) {
63
-
printf "nfs_export,host=%s,path=%s present=1\n", ARGV[1], $1
64
-
}
65
-
delete mounts[$1]
66
-
}
67
-
for (mount in mounts) {
68
-
printf "nfs_export,host=%s,path=%s present=0\n", ARGV[1], $1
69
-
}
67
+
lib.mapAttrsToList (
68
+
host: args:
69
+
(pkgs.writeScript "nfs-health" ''
70
+
#!${pkgs.gawk}/bin/awk -f
71
+
BEGIN {
72
+
for (i = 2; i < ARGC; i++) {
73
+
mounts[ARGV[i]] = 1
74
+
}
75
+
while ("${pkgs.nfs-utils}/bin/showmount -e " ARGV[1] | getline) {
76
+
if (NR == 1) { continue }
77
+
if (mounts[$1] == 1) {
78
+
printf "nfs_export,host=%s,path=%s present=1\n", ARGV[1], $1
70
79
}
71
-
'')
72
-
+ " ${host} ${builtins.concatStringsSep " " args}"
73
-
)
74
-
nfsHosts;
80
+
delete mounts[$1]
81
+
}
82
+
for (mount in mounts) {
83
+
printf "nfs_export,host=%s,path=%s present=0\n", ARGV[1], $1
84
+
}
85
+
}
86
+
'')
87
+
+ " ${host} ${builtins.concatStringsSep " " args}"
88
+
) nfsHosts;
75
89
76
90
in
77
91
{
···
82
96
enable = true;
83
97
extraConfig = {
84
98
agent.interval = "60s";
85
-
inputs = {
86
-
prometheus.urls = lib.mkIf config.services.promtail.enable [
87
-
# default promtail port
88
-
"http://localhost:9080/metrics"
89
-
];
90
-
prometheus.metric_version = 2;
91
-
kernel_vmstat = { };
92
-
nginx.urls = lib.mkIf config.services.nginx.statusPage [
93
-
"http://localhost/nginx_status"
94
-
];
95
-
smart = lib.mkIf (!isVM) {
96
-
path_smartctl = pkgs.writeShellScript "smartctl" ''
97
-
exec /run/wrappers/bin/sudo ${pkgs.smartmontools}/bin/smartctl "$@"
98
-
'';
99
-
};
100
-
system = { };
101
-
mem = { };
102
-
file =
103
-
[
104
-
{
105
-
data_format = "influx";
106
-
file_tag = "name";
107
-
files = [ "/var/log/telegraf/*" ];
108
-
}
109
-
]
110
-
++ lib.optional (lib.any (fs: fs == "ext4") (lib.attrNames config.boot.supportedFilesystems)) {
111
-
name_override = "ext4_errors";
112
-
files = [ "/sys/fs/ext4/*/errors_count" ];
113
-
data_format = "value";
99
+
inputs =
100
+
{
101
+
prometheus.urls = lib.mkIf config.services.promtail.enable [
102
+
# default promtail port
103
+
"http://localhost:9080/metrics"
104
+
];
105
+
prometheus.metric_version = 2;
106
+
kernel_vmstat = { };
107
+
nginx.urls = lib.mkIf config.services.nginx.statusPage [
108
+
"http://localhost/nginx_status"
109
+
];
110
+
smart = lib.mkIf (!isVM) {
111
+
path_smartctl = pkgs.writeShellScript "smartctl" ''
112
+
exec /run/wrappers/bin/sudo ${pkgs.smartmontools}/bin/smartctl "$@"
113
+
'';
114
114
};
115
-
exec = [
115
+
system = { };
116
+
mem = { };
117
+
file =
118
+
[
119
+
{
120
+
data_format = "influx";
121
+
file_tag = "name";
122
+
files = [ "/var/log/telegraf/*" ];
123
+
}
124
+
]
125
+
++ lib.optional (lib.any (fs: fs == "ext4") (lib.attrNames config.boot.supportedFilesystems)) {
126
+
name_override = "ext4_errors";
127
+
files = [ "/sys/fs/ext4/*/errors_count" ];
128
+
data_format = "value";
129
+
};
130
+
exec = [
131
+
{
132
+
## Commands array
133
+
commands = [ ipv6DadCheck ] ++ zfsChecks ++ nfsChecks;
134
+
data_format = "influx";
135
+
}
136
+
];
137
+
systemd_units = { };
138
+
swap = { };
139
+
disk.tagdrop = {
140
+
fstype = [
141
+
"tmpfs"
142
+
"ramfs"
143
+
"devtmpfs"
144
+
"devfs"
145
+
"iso9660"
146
+
"overlay"
147
+
"aufs"
148
+
"squashfs"
149
+
];
150
+
device = [
151
+
"rpc_pipefs"
152
+
"lxcfs"
153
+
"nsfs"
154
+
"borgfs"
155
+
];
156
+
};
157
+
diskio = { };
158
+
zfs = {
159
+
poolMetrics = true;
160
+
};
161
+
}
162
+
// lib.optionalAttrs
163
+
(
164
+
if lib.versionAtLeast (lib.versions.majorMinor lib.version) "23.11" then
165
+
config.boot.swraid.enable
166
+
else
167
+
config.boot.initrd.services.swraid.enable
168
+
)
116
169
{
117
-
## Commands array
118
-
commands =
119
-
[ ipv6DadCheck ]
120
-
++ zfsChecks
121
-
++ nfsChecks;
122
-
data_format = "influx";
123
-
}
124
-
];
125
-
systemd_units = { };
126
-
swap = { };
127
-
disk.tagdrop = {
128
-
fstype = [ "tmpfs" "ramfs" "devtmpfs" "devfs" "iso9660" "overlay" "aufs" "squashfs" ];
129
-
device = [ "rpc_pipefs" "lxcfs" "nsfs" "borgfs" ];
130
-
};
131
-
diskio = { };
132
-
zfs = {
133
-
poolMetrics = true;
134
-
};
135
-
} // lib.optionalAttrs (if lib.versionAtLeast (lib.versions.majorMinor lib.version) "23.11" then config.boot.swraid.enable else config.boot.initrd.services.swraid.enable) {
136
-
mdstat = { };
137
-
};
170
+
mdstat = { };
171
+
};
138
172
outputs.prometheus_client = {
139
173
listen = ":9273";
140
174
metric_version = 2;
+2
-2
2configs/ppp/umts-stick.nix
+2
-2
2configs/ppp/umts-stick.nix
+2
-1
2configs/ppp/x220-modem.nix
+2
-1
2configs/ppp/x220-modem.nix
+1
-2
2configs/websites/default.nix
+1
-2
2configs/websites/default.nix
+179
-53
2configs/websites/domsen.nix
+179
-53
2configs/websites/domsen.nix
···
1
-
{ self, config, pkgs, lib, ... }:
1
+
{
2
+
self,
3
+
config,
4
+
pkgs,
5
+
lib,
6
+
...
7
+
}:
2
8
3
9
let
4
10
5
11
inherit (self.inputs.stockholm.lib)
6
12
genid_uint31
7
-
;
8
-
inherit (import ./util.nix {inherit lib pkgs;})
13
+
;
14
+
inherit (import ./util.nix { inherit lib pkgs; })
9
15
servePage
10
16
serveOwncloud
11
-
serveWordpress;
17
+
serveWordpress
18
+
;
12
19
13
20
msmtprc = pkgs.writeText "msmtprc" ''
14
21
account localhost
···
20
27
exec ${pkgs.msmtp}/bin/msmtp --read-envelope-from -C ${msmtprc} "$@"
21
28
'';
22
29
23
-
in {
30
+
in
31
+
{
24
32
imports = [
25
33
self.inputs.stockholm.nixosModules.acl
26
34
self.inputs.stockholm.nixosModules.on-failure
27
35
./default.nix
28
36
./sqlBackup.nix
29
-
(servePage [ "aldonasiech.com" "www.aldonasiech.com" ])
30
-
(servePage [ "apanowicz.de" "www.apanowicz.de" ])
31
-
(servePage [ "reich-gebaeudereinigung.de" "www.reich-gebaeudereinigung.de" ])
32
-
(servePage [ "illustra.de" "www.illustra.de" ])
33
-
(servePage [ "event-extra.de" "www.event-extra.de" ])
37
+
(servePage [
38
+
"aldonasiech.com"
39
+
"www.aldonasiech.com"
40
+
])
41
+
(servePage [
42
+
"apanowicz.de"
43
+
"www.apanowicz.de"
44
+
])
45
+
(servePage [
46
+
"reich-gebaeudereinigung.de"
47
+
"www.reich-gebaeudereinigung.de"
48
+
])
49
+
(servePage [
50
+
"illustra.de"
51
+
"www.illustra.de"
52
+
])
53
+
(servePage [
54
+
"event-extra.de"
55
+
"www.event-extra.de"
56
+
])
34
57
# (servePage [ "nirwanabluete.de" "www.nirwanabluete.de" ])
35
-
(servePage [ "familienrat-hamburg.de" "www.familienrat-hamburg.de" ])
58
+
(servePage [
59
+
"familienrat-hamburg.de"
60
+
"www.familienrat-hamburg.de"
61
+
])
36
62
(servePage [ "karlaskop.de" ])
37
63
(servePage [
38
64
"freemonkey.art"
···
75
101
# https://github.com/nextcloud/server/issues/25436
76
102
services.mysql.settings.mysqld.innodb_read_only_compressed = 0;
77
103
78
-
services.mysql.ensureDatabases = [ "ubikmedia_de" "o_ubikmedia_de" ];
104
+
services.mysql.ensureDatabases = [
105
+
"ubikmedia_de"
106
+
"o_ubikmedia_de"
107
+
];
79
108
services.mysql.ensureUsers = [
80
-
{ ensurePermissions = { "ubikmedia_de.*" = "ALL"; }; name = "nginx"; }
81
-
{ ensurePermissions = { "o_ubikmedia_de.*" = "ALL"; }; name = "nginx"; }
109
+
{
110
+
ensurePermissions = {
111
+
"ubikmedia_de.*" = "ALL";
112
+
};
113
+
name = "nginx";
114
+
}
115
+
{
116
+
ensurePermissions = {
117
+
"o_ubikmedia_de.*" = "ALL";
118
+
};
119
+
name = "nginx";
120
+
}
82
121
];
83
122
84
123
services.nginx.virtualHosts."ubikmedia.de".locations."/piwika".extraConfig = ''
···
153
192
sslServerKey = "/var/lib/acme/lassul.us/key.pem";
154
193
};
155
194
krebs.iptables.tables.filter.INPUT.rules = [
156
-
{ predicate = "-p tcp --dport pop3s"; target = "ACCEPT"; }
157
-
{ predicate = "-p tcp --dport imaps"; target = "ACCEPT"; }
195
+
{
196
+
predicate = "-p tcp --dport pop3s";
197
+
target = "ACCEPT";
198
+
}
199
+
{
200
+
predicate = "-p tcp --dport imaps";
201
+
target = "ACCEPT";
202
+
}
158
203
];
159
204
160
205
environment.systemPackages = [
···
182
227
# server_condition = ''${run{/run/current-system/sw/bin/debug_exim ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
183
228
'';
184
229
internet-aliases = [
185
-
{ from = "dma@ubikmedia.de"; to = "domsen"; }
186
-
{ from = "dma@ubikmedia.eu"; to = "domsen"; }
187
-
{ from = "mail@habsys.de"; to = "domsen"; }
188
-
{ from = "mail@habsys.eu"; to = "domsen"; }
189
-
{ from = "hallo@apanowicz.de"; to = "domsen"; }
190
-
{ from = "bruno@apanowicz.de"; to = "bruno"; }
191
-
{ from = "mail@jla-trading.com"; to = "jla-trading"; }
192
-
{ from = "jms@ubikmedia.eu"; to = "jms"; }
193
-
{ from = "ms@ubikmedia.eu"; to = "ms"; }
194
-
{ from = "ubik@ubikmedia.eu"; to = "domsen, jms, ms"; }
195
-
{ from = "kontakt@alewis.de"; to ="klabusterbeere"; }
196
-
{ from = "hallo@jarugadesign.de"; to ="kasia"; }
197
-
{ from = "noreply@beeshmooth.ch"; to ="besmooth@gmx.ch"; }
230
+
{
231
+
from = "dma@ubikmedia.de";
232
+
to = "domsen";
233
+
}
234
+
{
235
+
from = "dma@ubikmedia.eu";
236
+
to = "domsen";
237
+
}
238
+
{
239
+
from = "mail@habsys.de";
240
+
to = "domsen";
241
+
}
242
+
{
243
+
from = "mail@habsys.eu";
244
+
to = "domsen";
245
+
}
246
+
{
247
+
from = "hallo@apanowicz.de";
248
+
to = "domsen";
249
+
}
250
+
{
251
+
from = "bruno@apanowicz.de";
252
+
to = "bruno";
253
+
}
254
+
{
255
+
from = "mail@jla-trading.com";
256
+
to = "jla-trading";
257
+
}
258
+
{
259
+
from = "jms@ubikmedia.eu";
260
+
to = "jms";
261
+
}
262
+
{
263
+
from = "ms@ubikmedia.eu";
264
+
to = "ms";
265
+
}
266
+
{
267
+
from = "ubik@ubikmedia.eu";
268
+
to = "domsen, jms, ms";
269
+
}
270
+
{
271
+
from = "kontakt@alewis.de";
272
+
to = "klabusterbeere";
273
+
}
274
+
{
275
+
from = "hallo@jarugadesign.de";
276
+
to = "kasia";
277
+
}
278
+
{
279
+
from = "noreply@beeshmooth.ch";
280
+
to = "besmooth@gmx.ch";
281
+
}
198
282
199
-
{ from = "testuser@lassul.us"; to = "testuser"; }
200
-
{ from = "testuser@ubikmedia.eu"; to = "testuser"; }
283
+
{
284
+
from = "testuser@lassul.us";
285
+
to = "testuser";
286
+
}
287
+
{
288
+
from = "testuser@ubikmedia.eu";
289
+
to = "testuser";
290
+
}
201
291
];
202
292
sender_domains = [
203
293
"jla-trading.com"
···
218
308
clanCore.facts.services."ubikmedia.eu-dkim" = {
219
309
secret."ubikmedia.eu.dkim.priv" = { };
220
310
public."ubikmedia.eu.dkim.pub" = { };
221
-
generator.path = with pkgs; [ coreutils openssl ];
311
+
generator.path = with pkgs; [
312
+
coreutils
313
+
openssl
314
+
];
222
315
generator.script = ''
223
-
openssl genrsa -out "$secrets"/ubikmedia.eu.dkim.priv 2048
316
+
openssl genrsa -out "$secrets"/ubikmedia.eu.dkim.priv 1024
224
317
openssl rsa -in "$secrets"/ubikmedia.eu.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/ubikmedia.eu.dkim.pub
225
318
'';
226
319
};
227
320
clanCore.facts.services."apanowicz.de-dkim" = {
228
321
secret."apanowicz.de.dkim.priv" = { };
229
322
public."apanowicz.de.dkim.pub" = { };
230
-
generator.path = with pkgs; [ coreutils openssl ];
323
+
generator.path = with pkgs; [
324
+
coreutils
325
+
openssl
326
+
];
231
327
generator.script = ''
232
-
openssl genrsa -out "$secrets"/apanowicz.de.dkim.priv 2048
328
+
openssl genrsa -out "$secrets"/apanowicz.de.dkim.priv 1024
233
329
openssl rsa -in "$secrets"/apanowicz.de.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/apanowicz.de.dkim.pub
234
330
'';
235
331
};
236
332
clanCore.facts.services."beesmooth.ch-dkim" = {
237
333
secret."beesmooth.ch.dkim.priv" = { };
238
334
public."beesmooth.ch.dkim.pub" = { };
239
-
generator.path = with pkgs; [ coreutils openssl ];
335
+
generator.path = with pkgs; [
336
+
coreutils
337
+
openssl
338
+
];
240
339
generator.script = ''
241
-
openssl genrsa -out "$secrets"/beesmooth.ch.dkim.priv 2048
340
+
openssl genrsa -out "$secrets"/beesmooth.ch.dkim.priv 1024
341
+
openssl rsa -in "$secrets"/beesmooth.ch.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/beesmooth.ch.dkim.pub
342
+
'';
343
+
};
344
+
clanCore.facts.services."freemonkey.art" = {
345
+
secret."beesmooth.ch.dkim.priv" = { };
346
+
public."beesmooth.ch.dkim.pub" = { };
347
+
generator.path = with pkgs; [
348
+
coreutils
349
+
openssl
350
+
];
351
+
generator.script = ''
352
+
openssl genrsa -out "$secrets"/beesmooth.ch.dkim.priv 1024
242
353
openssl rsa -in "$secrets"/beesmooth.ch.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/beesmooth.ch.dkim.pub
243
354
'';
244
355
};
···
283
394
description = "maintenance acc for domsen";
284
395
home = "/home/domsen";
285
396
useDefaultShell = true;
286
-
extraGroups = [ "syncthing" "download" "xanf" ];
397
+
extraGroups = [
398
+
"syncthing"
399
+
"download"
400
+
"xanf"
401
+
];
287
402
createHome = true;
288
403
isNormalUser = true;
289
404
};
···
437
552
createHome = true;
438
553
isNormalUser = true;
439
554
};
440
-
krebs.acl."/srv/http/familienrat-hamburg.de"."u:familienrat:rwX" = {};
555
+
556
+
users.users.pr = {
557
+
uid = genid_uint31 "pr";
558
+
home = "/home/pr";
559
+
useDefaultShell = true;
560
+
createHome = true;
561
+
isNormalUser = true;
562
+
};
563
+
564
+
krebs.acl."/srv/http/familienrat-hamburg.de"."u:familienrat:rwX" = { };
441
565
krebs.acl."/srv/http"."u:familienrat:X" = {
442
566
default = false;
443
567
recursive = false;
444
568
};
445
569
446
-
users.groups.xanf = {};
570
+
users.groups.xanf = { };
447
571
448
572
krebs.on-failure.plans.restic-backups-domsen = {
449
573
journalctl = {
···
455
579
initialize = true;
456
580
repository = "/backups/domsen";
457
581
passwordFile = "${config.krebs.secret.directory}/domsen_backup_pw";
458
-
timerConfig = { OnCalendar = "00:05"; RandomizedDelaySec = "5h"; };
582
+
timerConfig = {
583
+
OnCalendar = "00:05";
584
+
RandomizedDelaySec = "5h";
585
+
};
459
586
paths = [
460
587
"/home/domsen/Mail"
461
588
"/home/ms/Mail"
···
468
595
];
469
596
};
470
597
471
-
services.syncthing.settings.folders = {
472
-
domsen-backups = {
473
-
path = "/backups/domsen";
474
-
devices = [ "domsen-backup" ];
475
-
};
476
-
domsen-backup-srv-http = {
477
-
path = "/srv/http";
478
-
devices = [ "domsen-backup" ];
479
-
};
480
-
};
598
+
# services.syncthing.settings.folders = {
599
+
# domsen-backups = {
600
+
# path = "/backups/domsen";
601
+
# devices = [ "domsen-backup" ];
602
+
# };
603
+
# domsen-backup-srv-http = {
604
+
# path = "/srv/http";
605
+
# devices = [ "domsen-backup" ];
606
+
# };
607
+
# };
481
608
482
609
system.activationScripts.domsen-backups = ''
483
610
${pkgs.coreutils}/bin/chmod 750 /backups
···
487
614
# krebs.acl."/srv/http"."u:syncthing:rwX" = {};
488
615
# krebs.acl."/srv/http"."u:nginx:rwX" = {};
489
616
# krebs.acl."/srv/http/ubikmedia.de"."u:avada:rwX" = {};
490
-
krebs.acl."/home/xanf/XANF_TEAM"."g:xanf:rwX" = {};
617
+
krebs.acl."/home/xanf/XANF_TEAM"."g:xanf:rwX" = { };
491
618
krebs.acl."/home/xanf"."g:xanf:X" = {
492
619
default = false;
493
620
recursive = false;
494
621
};
495
622
}
496
-
+1
-2
2configs/websites/flix.lassul.us.nix
+1
-2
2configs/websites/flix.lassul.us.nix
+2
-1
2configs/websites/mergebot.lassul.us.nix
+2
-1
2configs/websites/mergebot.lassul.us.nix
+1
-2
2configs/websites/sqlBackup.nix
+1
-2
2configs/websites/sqlBackup.nix
+17
-12
2configs/websites/util.nix
+17
-12
2configs/websites/util.nix
···
4
4
5
5
rec {
6
6
7
-
ssl = domains :
8
-
let
9
-
domain = head domains;
10
-
in {
7
+
ssl =
8
+
domains:
9
+
{
11
10
};
12
11
13
-
servePage = domains:
12
+
servePage =
13
+
domains:
14
14
let
15
15
domain = head domains;
16
-
in {
16
+
in
17
+
{
17
18
services.nginx.virtualHosts.${domain} = {
18
19
enableACME = true;
19
20
addSSL = true;
···
24
25
};
25
26
};
26
27
27
-
serveOwncloud = domains:
28
+
serveOwncloud =
29
+
domains:
28
30
let
29
31
domain = head domains;
30
-
in {
32
+
in
33
+
{
31
34
services.nginx.virtualHosts."${domain}" = {
32
35
enableACME = true;
33
36
addSSL = true;
···
77
80
deny all;
78
81
'';
79
82
80
-
locations."~ ^/(?:autotest|occ|issue|indie|db_|console)".extraConfig = ''
83
+
locations."~ ^/(?:autotest|occ|issue|indie|db_|console)".extraConfig = ''
81
84
deny all;
82
85
'';
83
86
···
87
90
try_files $uri $uri/ =404;
88
91
'';
89
92
90
-
locations."~ \.php(?:$|/)".extraConfig = ''
93
+
locations."~ \.php(?:$|/)".extraConfig = ''
91
94
fastcgi_split_path_info ^(.+\.php)(/.+)$;
92
95
include ${pkgs.nginx}/conf/fastcgi_params;
93
96
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
···
131
134
};
132
135
};
133
136
134
-
serveWordpress = domains:
137
+
serveWordpress =
138
+
domains:
135
139
let
136
140
domain = head domains;
137
141
138
-
in {
142
+
in
143
+
{
139
144
services.nginx.virtualHosts."${domain}" = {
140
145
enableACME = true;
141
146
forceSSL = true;
+1
-1
2configs/weron/client.nix
+1
-1
2configs/weron/client.nix
+4
-3
2configs/weron/signaler.nix
+4
-3
2configs/weron/signaler.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ pkgs, ... }:
2
2
{
3
3
systemd.services.weron-signaler = {
4
4
wantedBy = [ "multi-user.target" ];
5
-
environment = {
6
-
};
5
+
environment =
6
+
{
7
+
};
7
8
serviceConfig = {
8
9
ExecStart = ''${pkgs.weron}/bin/weron signaler --verbose=7 --laddr ":23420"'';
9
10
};
+1
-1
2configs/yellow-mounts/samba.nix
+1
-1
2configs/yellow-mounts/samba.nix
+1
-2
5pkgs/autowifi/default.nix
+1
-2
5pkgs/autowifi/default.nix
+7
-2
5pkgs/bank/default.nix
+7
-2
5pkgs/bank/default.nix
+1
-1
5pkgs/htmlparser/default.nix
+1
-1
5pkgs/htmlparser/default.nix
+7
-1
5pkgs/init/default.nix
+7
-1
5pkgs/init/default.nix
+2
-2
5pkgs/init/test.nix
+2
-2
5pkgs/init/test.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ lib, pkgs, ... }:
2
2
{
3
3
virtualisation.emptyDiskImages = [
4
4
8000
···
7
7
boot.tmpOnTmpfs = true;
8
8
9
9
environment.systemPackages = [
10
-
(pkgs.callPackage ./default.nix {})
10
+
(pkgs.callPackage ./default.nix { })
11
11
];
12
12
services.mingetty.autologinUser = lib.mkForce "root";
13
13
}
+10
-6
5pkgs/mycelium/default.nix
+10
-6
5pkgs/mycelium/default.nix
···
1
-
{ lib
2
-
, rustPlatform
3
-
, fetchFromGitHub
4
-
, stdenv
5
-
, darwin
1
+
{
2
+
lib,
3
+
rustPlatform,
4
+
fetchFromGitHub,
5
+
stdenv,
6
+
darwin,
6
7
}:
7
8
8
9
rustPlatform.buildRustPackage rec {
···
33
34
homepage = "https://github.com/threefoldtech/mycelium";
34
35
changelog = "https://github.com/threefoldtech/mycelium/blob/${src.rev}/CHANGELOG.md";
35
36
license = licenses.asl20;
36
-
maintainers = with maintainers; [ flokli matthewcroughan ];
37
+
maintainers = with maintainers; [
38
+
flokli
39
+
matthewcroughan
40
+
];
37
41
mainProgram = "mycelium";
38
42
};
39
43
}
+2
-1
5pkgs/nichtparasoup/default.nix
+2
-1
5pkgs/nichtparasoup/default.nix
+4
-2
5pkgs/review-mail-queue/default.nix
+4
-2
5pkgs/review-mail-queue/default.nix
···
1
-
{ pkgs }: let
1
+
{ pkgs }:
2
+
let
2
3
3
4
review = pkgs.writers.writeBash "review-mail" ''
4
5
mail="$1"
···
30
31
echo '-------------------'
31
32
'';
32
33
33
-
in pkgs.writers.writeBashBin "review-mail" ''
34
+
in
35
+
pkgs.writers.writeBashBin "review-mail" ''
34
36
for mail in $(${pkgs.exim}/bin/exim -bp \
35
37
| ${pkgs.gnugrep}/bin/grep frozen \
36
38
| ${pkgs.gawk}/bin/awk '{print $3}'); do
+17
-3
5pkgs/searx/default.nix
+17
-3
5pkgs/searx/default.nix
···
1
-
{ lib, nixosTests, python3, python3Packages, fetchFromGitHub, fetchpatch }:
1
+
{
2
+
lib,
3
+
nixosTests,
4
+
python3,
5
+
python3Packages,
6
+
fetchFromGitHub,
7
+
fetchpatch,
8
+
}:
2
9
3
10
with python3Packages;
4
11
···
58
65
ln -s ../${python3.sitePackages}/searx/static $out/share/
59
66
'';
60
67
61
-
passthru.tests = { inherit (nixosTests) searx; };
68
+
passthru.tests = {
69
+
inherit (nixosTests) searx;
70
+
};
62
71
63
72
meta = with lib; {
64
73
homepage = "https://github.com/searx/searx";
65
74
description = "A privacy-respecting, hackable metasearch engine";
66
75
license = licenses.agpl3Plus;
67
-
maintainers = with maintainers; [ matejc fpletz globin danielfullmer ];
76
+
maintainers = with maintainers; [
77
+
matejc
78
+
fpletz
79
+
globin
80
+
danielfullmer
81
+
];
68
82
};
69
83
})
+26
-11
5pkgs/xonsh2/default.nix
+26
-11
5pkgs/xonsh2/default.nix
···
1
-
{ lib, stdenv
2
-
, fetchFromGitHub
3
-
, python39Packages
4
-
, glibcLocales
5
-
, coreutils
6
-
, git
7
-
, extraInputs ? []
8
-
}: let
1
+
{
2
+
lib,
3
+
fetchFromGitHub,
4
+
python39Packages,
5
+
glibcLocales,
6
+
coreutils,
7
+
git,
8
+
extraInputs ? [ ],
9
+
}:
10
+
let
9
11
10
12
python3Packages = python39Packages;
11
13
12
-
in python3Packages.buildPythonApplication rec {
14
+
in
15
+
python3Packages.buildPythonApplication rec {
13
16
pname = "xonsh2";
14
17
version = "master";
15
18
···
38
41
HOME=$TMPDIR pytest -k 'test_ptk_highlight'
39
42
'';
40
43
41
-
checkInputs = [ python3Packages.pytest python3Packages.pytest-rerunfailures glibcLocales git ];
44
+
checkInputs = [
45
+
python3Packages.pytest
46
+
python3Packages.pytest-rerunfailures
47
+
glibcLocales
48
+
git
49
+
];
42
50
43
-
propagatedBuildInputs = with python3Packages; [ ply prompt_toolkit pygments ] ++ extraInputs;
51
+
propagatedBuildInputs =
52
+
with python3Packages;
53
+
[
54
+
ply
55
+
prompt_toolkit
56
+
pygments
57
+
]
58
+
++ extraInputs;
44
59
45
60
meta = with lib; {
46
61
description = "A Python-ish, BASHwards-compatible shell";
+8
-5
darwin/barnacle/config.nix
+8
-5
darwin/barnacle/config.nix
···
19
19
# Auto upgrade nix package and the daemon service.
20
20
services.nix-daemon.enable = true;
21
21
nix = {
22
-
package = pkgs.nix;
23
-
settings = {
24
-
extra-experimental-features = [ "nix-command" "flakes" ];
25
-
};
22
+
package = pkgs.nix;
23
+
settings = {
24
+
extra-experimental-features = [
25
+
"nix-command"
26
+
"flakes"
27
+
];
28
+
};
26
29
};
27
30
28
31
homebrew = {
···
61
64
# nix.linux-builder.enable = true;
62
65
63
66
# Create /etc/zshrc that loads the nix-darwin environment.
64
-
programs.zsh.enable = true; # default shell on catalina
67
+
programs.zsh.enable = true; # default shell on catalina
65
68
# programs.fish.enable = true;
66
69
67
70
programs.direnv.enable = true;
+7
-3
machines/aergia/config.nix
+7
-3
machines/aergia/config.nix
···
1
-
{ self, config, pkgs, ... }:
1
+
{ config, pkgs, ... }:
2
2
3
3
{
4
4
imports = [
···
23
23
../../2configs/print.nix
24
24
../../2configs/br.nix
25
25
../../2configs/c-base.nix
26
-
{ # autorandrs
26
+
{
27
+
# autorandrs
27
28
services.autorandr = {
28
29
enable = true;
29
30
hooks.postswitch.reset_usb = ''
···
127
128
};
128
129
hardware.pulseaudio.package = pkgs.pulseaudioFull;
129
130
130
-
nix.trustedUsers = [ "root" "lass" ];
131
+
nix.trustedUsers = [
132
+
"root"
133
+
"lass"
134
+
];
131
135
132
136
services.tor = {
133
137
enable = true;
+2
-3
machines/aergia/disk.nix
+2
-3
machines/aergia/disk.nix
···
38
38
};
39
39
# Mountpoints inferred from subvolume name
40
40
"/home" = {
41
-
mountOptions = [];
41
+
mountOptions = [ ];
42
42
mountpoint = "/home";
43
43
};
44
44
"/nix" = {
45
-
mountOptions = [];
45
+
mountOptions = [ ];
46
46
mountpoint = "/nix";
47
47
};
48
48
};
···
54
54
};
55
55
};
56
56
}
57
-
+13
-10
machines/aergia/physical.nix
+13
-10
machines/aergia/physical.nix
···
1
-
{ config, lib, pkgs, modulesPath, ... }:
1
+
{ pkgs, modulesPath, ... }:
2
2
{
3
3
imports = [
4
4
./config.nix
···
74
74
services.xserver.displayManager.sessionCommands = ''
75
75
${pkgs.xorg.xmodmap}/bin/xmodmap -e 'keycode 96 = F12 Insert F12 F12' # rebind shift + F12 to shift + insert
76
76
'';
77
-
services.udev.extraHwdb = /* sh */ ''
78
-
# disable back buttons
79
-
evdev:input:b0003v2F24p0135* # /dev/input/event2
80
-
KEYBOARD_KEY_70026=reserved
81
-
KEYBOARD_KEY_70027=reserved
82
-
'';
77
+
services.udev.extraHwdb = # sh
78
+
''
79
+
# disable back buttons
80
+
evdev:input:b0003v2F24p0135* # /dev/input/event2
81
+
KEYBOARD_KEY_70026=reserved
82
+
KEYBOARD_KEY_70027=reserved
83
+
'';
83
84
84
85
# update cpu microcode
85
86
hardware.cpu.amd.updateMicrocode = true;
···
92
93
];
93
94
94
95
# suspend to disk
95
-
swapDevices = [{
96
-
device = "/swapfile";
97
-
}];
96
+
swapDevices = [
97
+
{
98
+
device = "/swapfile";
99
+
}
100
+
];
98
101
boot.resumeDevice = "/dev/mapper/aergia1";
99
102
services.logind.lidSwitch = "suspend-then-hibernate";
100
103
services.logind.extraConfig = ''
+1
-1
machines/blue/config.nix
+1
-1
machines/blue/config.nix
+28
-16
machines/blue/source.nix
+28
-16
machines/blue/source.nix
···
1
-
{ lib, pkgs, test, ... }:
2
-
if test then {} else {
3
-
nixpkgs = lib.mkIf (! test) (lib.mkForce {
4
-
file = {
5
-
path = toString (pkgs.fetchFromGitHub {
6
-
owner = "nixos";
7
-
repo = "nixpkgs";
8
-
rev = (lib.importJSON ../../../krebs/nixpkgs.json).rev;
9
-
sha256 = (lib.importJSON ../../../krebs/nixpkgs.json).sha256;
10
-
});
11
-
useChecksum = true;
1
+
{
2
+
lib,
3
+
pkgs,
4
+
test,
5
+
...
6
+
}:
7
+
if test then
8
+
{ }
9
+
else
10
+
{
11
+
nixpkgs = lib.mkIf (!test) (
12
+
lib.mkForce {
13
+
file = {
14
+
path = toString (
15
+
pkgs.fetchFromGitHub {
16
+
owner = "nixos";
17
+
repo = "nixpkgs";
18
+
rev = (lib.importJSON ../../../krebs/nixpkgs.json).rev;
19
+
sha256 = (lib.importJSON ../../../krebs/nixpkgs.json).sha256;
20
+
}
21
+
);
22
+
useChecksum = true;
23
+
};
24
+
}
25
+
);
26
+
nixpkgs-unstable = lib.mkForce {
27
+
file.path = "/var/empty";
12
28
};
13
-
});
14
-
nixpkgs-unstable = lib.mkForce {
15
-
file.path = "/var/empty";
16
-
};
17
-
}
29
+
}
+25
-8
machines/coaxmetal/config.nix
+25
-8
machines/coaxmetal/config.nix
···
1
-
{ self, config, lib, pkgs, ... }:
1
+
{
2
+
self,
3
+
config,
4
+
lib,
5
+
pkgs,
6
+
...
7
+
}:
2
8
3
9
{
4
10
imports = [
···
14
20
../../2configs/wine.nix
15
21
../../2configs/yellow-mounts/samba.nix
16
22
../../2configs/review.nix
17
-
{ # moonlight test env
23
+
{
24
+
# moonlight test env
18
25
imports = [
19
26
../../2configs/sunshine.nix
20
27
../../2configs/mpv.nix
···
22
29
users.users.moon = {
23
30
isNormalUser = true;
24
31
uid = 1338;
25
-
extraGroups = [ "video" "audio" "input" "pipewire" ];
32
+
extraGroups = [
33
+
"video"
34
+
"audio"
35
+
"input"
36
+
"pipewire"
37
+
];
26
38
home = "/home/moon";
27
39
password = "moon";
28
40
packages = with pkgs; [
29
-
(retroarch.override { cores = [
30
-
libretro.bsnes-hd
31
-
libretro.mupen64plus
32
-
]; })
41
+
(retroarch.override {
42
+
cores = [
43
+
libretro.bsnes-hd
44
+
libretro.mupen64plus
45
+
];
46
+
})
33
47
];
34
48
};
35
49
services.xserver.enable = true;
···
68
82
69
83
programs.adb.enable = true;
70
84
71
-
nix.settings.trusted-users = [ "root" "lass" ];
85
+
nix.settings.trusted-users = [
86
+
"root"
87
+
"lass"
88
+
];
72
89
73
90
services.tor = {
74
91
enable = true;
+9
-2
machines/coaxmetal/physical.nix
+9
-2
machines/coaxmetal/physical.nix
···
1
-
{ config, lib, pkgs, modulesPath, ... }:
1
+
{ pkgs, modulesPath, ... }:
2
2
{
3
3
imports = [
4
4
./config.nix
···
25
25
hardware.opengl.extraPackages = [ pkgs.amdvlk ];
26
26
hardware.opengl.extraPackages32 = [ pkgs.driversi686Linux.amdvlk ];
27
27
28
-
boot.initrd.availableKernelModules = [ "nvme" "ehci_pci" "xhci_pci" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
28
+
boot.initrd.availableKernelModules = [
29
+
"nvme"
30
+
"ehci_pci"
31
+
"xhci_pci"
32
+
"usb_storage"
33
+
"sd_mod"
34
+
"rtsx_pci_sdmmc"
35
+
];
29
36
boot.kernelModules = [ "kvm-amd" ];
30
37
31
38
fileSystems."/" = {
+30
-19
machines/coaxmetal/source.nix
+30
-19
machines/coaxmetal/source.nix
···
1
-
{ lib, pkgs, test, ... }: let
1
+
{ lib, test, ... }:
2
+
let
2
3
npkgs = lib.importJSON ../../../krebs/nixpkgs-unstable.json;
3
-
in {
4
-
nixpkgs = (if test then lib.mkForce ({ derivation = let
5
-
rev = npkgs.rev;
6
-
sha256 = npkgs.sha256;
7
-
in ''
8
-
with import (builtins.fetchTarball {
9
-
url = "https://github.com/nixos/nixpkgs/archive/${rev}.tar.gz";
10
-
sha256 = "${sha256}";
11
-
}) {};
12
-
pkgs.fetchFromGitHub {
13
-
owner = "nixos";
14
-
repo = "nixpkgs";
15
-
rev = "${rev}";
16
-
sha256 = "${sha256}";
17
-
}
18
-
''; }) else {
19
-
git.ref = lib.mkForce npkgs.rev;
20
-
});
4
+
in
5
+
{
6
+
nixpkgs = (
7
+
if test then
8
+
lib.mkForce ({
9
+
derivation =
10
+
let
11
+
rev = npkgs.rev;
12
+
sha256 = npkgs.sha256;
13
+
in
14
+
''
15
+
with import (builtins.fetchTarball {
16
+
url = "https://github.com/nixos/nixpkgs/archive/${rev}.tar.gz";
17
+
sha256 = "${sha256}";
18
+
}) {};
19
+
pkgs.fetchFromGitHub {
20
+
owner = "nixos";
21
+
repo = "nixpkgs";
22
+
rev = "${rev}";
23
+
sha256 = "${sha256}";
24
+
}
25
+
'';
26
+
})
27
+
else
28
+
{
29
+
git.ref = lib.mkForce npkgs.rev;
30
+
}
31
+
);
21
32
}
+12
-3
machines/daedalus/config.nix
+12
-3
machines/daedalus/config.nix
···
1
-
{ self, config, lib, pkgs, ... }:
1
+
{
2
+
self,
3
+
config,
4
+
lib,
5
+
pkgs,
6
+
...
7
+
}:
2
8
3
9
{
4
10
imports = [
···
55
61
}
56
62
{
57
63
users = {
58
-
groups.plugdev = {};
64
+
groups.plugdev = { };
59
65
users = {
60
66
bitcoin = {
61
67
name = "bitcoin";
···
89
95
# torbrowser
90
96
];
91
97
krebs.iptables.tables.filter.INPUT.rules = [
92
-
{ predicate = "-p tcp -i retiolum --dport 5900"; target = "ACCEPT"; }
98
+
{
99
+
predicate = "-p tcp -i retiolum --dport 5900";
100
+
target = "ACCEPT";
101
+
}
93
102
];
94
103
}
95
104
];
+18
-3
machines/daedalus/physical.nix
+18
-3
machines/daedalus/physical.nix
···
17
17
"/home" = {
18
18
device = "/dev/mapper/pool-home";
19
19
fsType = "btrfs";
20
-
options = ["defaults" "noatime" "ssd" "compress=lzo"];
20
+
options = [
21
+
"defaults"
22
+
"noatime"
23
+
"ssd"
24
+
"compress=lzo"
25
+
];
21
26
};
22
27
"/bku" = {
23
28
device = "/dev/mapper/pool-bku";
24
29
fsType = "btrfs";
25
-
options = ["defaults" "noatime" "ssd" "compress=lzo"];
30
+
options = [
31
+
"defaults"
32
+
"noatime"
33
+
"ssd"
34
+
"compress=lzo"
35
+
];
26
36
};
27
37
"/backups" = {
28
38
device = "/dev/pool/backup";
···
37
47
38
48
boot = {
39
49
initrd.luks.devices.luksroot.device = "/dev/sda3";
40
-
initrd.availableKernelModules = [ "xhci_hcd" "ehci_pci" "ahci" "usb_storage" ];
50
+
initrd.availableKernelModules = [
51
+
"xhci_hcd"
52
+
"ehci_pci"
53
+
"ahci"
54
+
"usb_storage"
55
+
];
41
56
};
42
57
43
58
services.logind.lidSwitch = "ignore";
+1
-1
machines/dishfire/config.nix
+1
-1
machines/dishfire/config.nix
+12
-6
machines/dishfire/physical.nix
+12
-6
machines/dishfire/physical.nix
···
1
-
{ config, lib, pkgs, modulesPath, ... }:
1
+
{ modulesPath, ... }:
2
2
3
3
{
4
4
imports = [
···
6
6
(modulesPath + "/profiles/qemu-guest.nix")
7
7
];
8
8
9
-
boot.initrd.availableKernelModules = [ "ata_piix" "virtio_pci" "xhci_pci" "sd_mod" "sr_mod" ];
9
+
boot.initrd.availableKernelModules = [
10
+
"ata_piix"
11
+
"virtio_pci"
12
+
"xhci_pci"
13
+
"sd_mod"
14
+
"sr_mod"
15
+
];
10
16
boot.initrd.kernelModules = [ ];
11
17
boot.kernelModules = [ ];
12
18
boot.extraModulePackages = [ ];
13
19
boot.loader.grub.devices = [ "/dev/sda" ];
14
20
15
-
fileSystems."/" =
16
-
{ device = "/dev/disk/by-uuid/84053adc-49bc-4e02-8a19-3838bf3a43fd";
17
-
fsType = "ext4";
18
-
};
21
+
fileSystems."/" = {
22
+
device = "/dev/disk/by-uuid/84053adc-49bc-4e02-8a19-3838bf3a43fd";
23
+
fsType = "ext4";
24
+
};
19
25
20
26
swapDevices = [ ];
21
27
}
+9
-3
machines/green/config.nix
+9
-3
machines/green/config.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ config, pkgs, ... }:
2
2
{
3
3
imports = [
4
4
../../2configs
···
33
33
clanCore.facts.services.green-container = {
34
34
secret."green.sync.key" = { };
35
35
public."green.sync.pub" = { };
36
-
generator.path = with pkgs; [ coreutils openssh ];
36
+
generator.path = with pkgs; [
37
+
coreutils
38
+
openssh
39
+
];
37
40
generator.script = ''
38
41
ssh-keygen -t ed25519 -N "" -f "$secrets"/green.sync.key
39
42
mv "$secrets"/green.sync.key "$facts"/green.sync.pub
···
67
70
];
68
71
69
72
krebs.iptables.tables.nat.PREROUTING.rules = [
70
-
{ predicate = "-i eth0 -p tcp -m tcp --dport 22"; target = "ACCEPT"; }
73
+
{
74
+
predicate = "-i eth0 -p tcp -m tcp --dport 22";
75
+
target = "ACCEPT";
76
+
}
71
77
];
72
78
73
79
# workaround for ssh access from yubikey via android
+10
-5
machines/green/source.nix
+10
-5
machines/green/source.nix
···
1
-
{ lib, pkgs, test, ... }: let
1
+
{ lib, test, ... }:
2
+
let
2
3
npkgs = lib.importJSON ../../../krebs/nixpkgs-unstable.json;
3
-
in if test then {} else {
4
-
nixpkgs.git.ref = lib.mkForce npkgs.rev;
5
-
nixpkgs-unstable = lib.mkForce { file = "/var/empty"; };
6
-
}
4
+
in
5
+
if test then
6
+
{ }
7
+
else
8
+
{
9
+
nixpkgs.git.ref = lib.mkForce npkgs.rev;
10
+
nixpkgs-unstable = lib.mkForce { file = "/var/empty"; };
11
+
}
+13
-8
machines/hilum/config.nix
+13
-8
machines/hilum/config.nix
···
14
14
source /grub/autoiso.cfg
15
15
}
16
16
'';
17
-
extraFiles."/grub/autoiso.cfg" = (pkgs.stdenv.mkDerivation {
18
-
name = "autoiso.cfg";
19
-
src = pkgs.grub2.src;
20
-
phases = [ "unpackPhase" "installPhase" ];
21
-
installPhase = ''
22
-
cp docs/autoiso.cfg $out
23
-
'';
24
-
});
17
+
extraFiles."/grub/autoiso.cfg" = (
18
+
pkgs.stdenv.mkDerivation {
19
+
name = "autoiso.cfg";
20
+
src = pkgs.grub2.src;
21
+
phases = [
22
+
"unpackPhase"
23
+
"installPhase"
24
+
];
25
+
installPhase = ''
26
+
cp docs/autoiso.cfg $out
27
+
'';
28
+
}
29
+
);
25
30
};
26
31
27
32
services.logind.lidSwitch = "ignore";
+14
-2
machines/hilum/physical.nix
+14
-2
machines/hilum/physical.nix
···
1
-
{ self, modulesPath, lib, ... }:
1
+
{
2
+
self,
3
+
modulesPath,
4
+
lib,
5
+
...
6
+
}:
2
7
3
8
{
4
9
imports = [
···
8
13
(modulesPath + "/installer/scan/not-detected.nix")
9
14
];
10
15
11
-
boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "xhci_pci" "usb_storage" "sd_mod" "sdhci_pci" ];
16
+
boot.initrd.availableKernelModules = [
17
+
"ehci_pci"
18
+
"ahci"
19
+
"xhci_pci"
20
+
"usb_storage"
21
+
"sd_mod"
22
+
"sdhci_pci"
23
+
];
12
24
boot.initrd.kernelModules = [ "dm-snapshot" ];
13
25
boot.kernelModules = [ "kvm-intel" ];
14
26
boot.extraModulePackages = [ ];
+1
-1
machines/icarus/config.nix
+1
-1
machines/icarus/config.nix
+13
-2
machines/icarus/physical.nix
+13
-2
machines/icarus/physical.nix
···
1
-
{ self, modulesPath, lib, ... }:
1
+
{
2
+
self,
3
+
modulesPath,
4
+
lib,
5
+
...
6
+
}:
2
7
{
3
8
imports = [
4
9
./config.nix
···
13
18
boot.loader.grub.device = "/dev/disk/by-id/wwn-0x5002538d702f5ac6";
14
19
boot.initrd.luks.devices.ssd.device = "/dev/disk/by-id/wwn-0x5002538d702f5ac6-part3";
15
20
16
-
boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "xhci_pci" "sd_mod" "sdhci_pci" ];
21
+
boot.initrd.availableKernelModules = [
22
+
"ehci_pci"
23
+
"ahci"
24
+
"xhci_pci"
25
+
"sd_mod"
26
+
"sdhci_pci"
27
+
];
17
28
boot.initrd.kernelModules = [ "dm-snapshot" ];
18
29
boot.kernelModules = [ "kvm-intel" ];
19
30
boot.extraModulePackages = [ ];
+1
-3
machines/lasspi/config.nix
+1
-3
machines/lasspi/config.nix
+11
-7
machines/lasspi/physical.nix
+11
-7
machines/lasspi/physical.nix
···
1
-
{ config, lib, pkgs, modulesPath, ... }:
1
+
{ modulesPath, ... }:
2
2
{
3
3
imports = [
4
4
(modulesPath + "/installer/scan/not-detected.nix")
···
8
8
boot = {
9
9
# kernelPackages = pkgs.linuxPackages_rpi4;
10
10
tmpOnTmpfs = true;
11
-
initrd.availableKernelModules = [ "usbhid" "usb_storage" "xhci_pci" ];
11
+
initrd.availableKernelModules = [
12
+
"usbhid"
13
+
"usb_storage"
14
+
"xhci_pci"
15
+
];
12
16
# ttyAMA0 is the serial console broken out to the GPIO
13
17
kernelParams = [
14
-
"8250.nr_uarts=1"
15
-
"console=ttyAMA0,115200"
16
-
"console=tty1"
17
-
# Some gui programs need this
18
-
"cma=128M"
18
+
"8250.nr_uarts=1"
19
+
"console=ttyAMA0,115200"
20
+
"console=tty1"
21
+
# Some gui programs need this
22
+
"cma=128M"
19
23
];
20
24
};
21
25
+22
-7
machines/mors/config.nix
+22
-7
machines/mors/config.nix
···
1
-
{ self, config, pkgs, ... }:
1
+
{
2
+
self,
3
+
config,
4
+
pkgs,
5
+
...
6
+
}:
2
7
3
8
{
4
9
imports = [
···
32
37
{
33
38
krebs.iptables.tables.filter.INPUT.rules = [
34
39
#risk of rain
35
-
{ predicate = "-p tcp --dport 11100"; target = "ACCEPT"; }
40
+
{
41
+
predicate = "-p tcp --dport 11100";
42
+
target = "ACCEPT";
43
+
}
36
44
#quake3
37
-
{ predicate = "-p tcp --dport 27950:27965"; target = "ACCEPT"; }
38
-
{ predicate = "-p udp --dport 27950:27965"; target = "ACCEPT"; }
45
+
{
46
+
predicate = "-p tcp --dport 27950:27965";
47
+
target = "ACCEPT";
48
+
}
49
+
{
50
+
predicate = "-p udp --dport 27950:27965";
51
+
target = "ACCEPT";
52
+
}
39
53
];
40
54
}
41
55
{
···
107
121
nixpkgs.config.android_sdk.accept_license = true;
108
122
programs.adb.enable = true;
109
123
110
-
111
-
112
124
# It may leak your data, but look how FAST it is!1!!
113
125
# https://make-linux-fast-again.com/
114
126
boot.kernelParams = [
···
128
140
"aarch64-linux"
129
141
];
130
142
131
-
nix.trustedUsers = [ "root" "lass" ];
143
+
nix.trustedUsers = [
144
+
"root"
145
+
"lass"
146
+
];
132
147
133
148
services.nscd.enableNsncd = true;
134
149
+6
-1
machines/mors/physical.nix
+6
-1
machines/mors/physical.nix
···
11
11
"/bku" = {
12
12
device = "/dev/mapper/pool-bku";
13
13
fsType = "btrfs";
14
-
options = ["defaults" "noatime" "ssd" "compress=lzo"];
14
+
options = [
15
+
"defaults"
16
+
"noatime"
17
+
"ssd"
18
+
"compress=lzo"
19
+
];
15
20
};
16
21
"/home/virtual" = {
17
22
device = "/dev/mapper/pool-virtual";
+30
-19
machines/mors/source.nix
+30
-19
machines/mors/source.nix
···
1
-
{ lib, pkgs, test, ... }: let
1
+
{ lib, test, ... }:
2
+
let
2
3
npkgs = lib.importJSON ../../../krebs/nixpkgs-unstable.json;
3
-
in {
4
-
nixpkgs = (if test then lib.mkForce ({ derivation = let
5
-
rev = npkgs.rev;
6
-
sha256 = npkgs.sha256;
7
-
in ''
8
-
with import (builtins.fetchTarball {
9
-
url = "https://github.com/nixos/nixpkgs/archive/${rev}.tar.gz";
10
-
sha256 = "${sha256}";
11
-
}) {};
12
-
pkgs.fetchFromGitHub {
13
-
owner = "nixos";
14
-
repo = "nixpkgs";
15
-
rev = "${rev}";
16
-
sha256 = "${sha256}";
17
-
}
18
-
''; }) else {
19
-
git.ref = lib.mkForce npkgs.rev;
20
-
});
4
+
in
5
+
{
6
+
nixpkgs = (
7
+
if test then
8
+
lib.mkForce ({
9
+
derivation =
10
+
let
11
+
rev = npkgs.rev;
12
+
sha256 = npkgs.sha256;
13
+
in
14
+
''
15
+
with import (builtins.fetchTarball {
16
+
url = "https://github.com/nixos/nixpkgs/archive/${rev}.tar.gz";
17
+
sha256 = "${sha256}";
18
+
}) {};
19
+
pkgs.fetchFromGitHub {
20
+
owner = "nixos";
21
+
repo = "nixpkgs";
22
+
rev = "${rev}";
23
+
sha256 = "${sha256}";
24
+
}
25
+
'';
26
+
})
27
+
else
28
+
{
29
+
git.ref = lib.mkForce npkgs.rev;
30
+
}
31
+
);
21
32
}
+1
-1
machines/neoprism/config.nix
+1
-1
machines/neoprism/config.nix
+45
-35
machines/neoprism/disk.nix
+45
-35
machines/neoprism/disk.nix
···
1
-
{ lib, ... }: {
1
+
{ lib, ... }:
2
+
{
2
3
disko.imageBuilder.extraRootModules = [
3
4
"zfs"
4
5
];
···
6
7
services.mingetty.autologinUser = "root";
7
8
};
8
9
disko.devices = {
9
-
disk = (lib.genAttrs [ "/dev/nvme0n1" "/dev/nvme1n1" ] (disk: {
10
-
type = "disk";
11
-
device = disk;
12
-
imageSize = "3G";
13
-
content = {
14
-
type = "gpt";
15
-
partitions = {
16
-
boot = {
17
-
size = "1M";
18
-
type = "EF02";
19
-
};
20
-
ESP = {
21
-
size = "1G";
22
-
content = {
23
-
type = "mdraid";
24
-
name = "boot";
10
+
disk =
11
+
(lib.genAttrs
12
+
[
13
+
"/dev/nvme0n1"
14
+
"/dev/nvme1n1"
15
+
]
16
+
(disk: {
17
+
type = "disk";
18
+
device = disk;
19
+
imageSize = "3G";
20
+
content = {
21
+
type = "gpt";
22
+
partitions = {
23
+
boot = {
24
+
size = "1M";
25
+
type = "EF02";
26
+
};
27
+
ESP = {
28
+
size = "1G";
29
+
content = {
30
+
type = "mdraid";
31
+
name = "boot";
32
+
};
33
+
};
34
+
zfs = {
35
+
size = "100%";
36
+
content = {
37
+
type = "zfs";
38
+
pool = "zroot";
39
+
};
40
+
};
25
41
};
26
42
};
27
-
zfs = {
28
-
size = "100%";
29
-
content = {
30
-
type = "zfs";
31
-
pool = "zroot";
32
-
};
43
+
})
44
+
)
45
+
// {
46
+
hdd1 = {
47
+
type = "disk";
48
+
device = "/dev/sda";
49
+
content = {
50
+
type = "zfs";
51
+
pool = "tank";
33
52
};
34
53
};
35
54
};
36
-
})) // {
37
-
hdd1 = {
38
-
type = "disk";
39
-
device = "/dev/sda";
40
-
content = {
41
-
type = "zfs";
42
-
pool = "tank";
43
-
};
44
-
};
45
-
};
46
55
mdadm = {
47
56
boot = {
48
57
type = "mdadm";
···
60
69
type = "zpool";
61
70
mode = "mirror";
62
71
mountpoint = "/";
63
-
rootFsOptions = {
64
-
};
72
+
rootFsOptions =
73
+
{
74
+
};
65
75
datasets = {
66
76
reserved = {
67
77
type = "zfs_fs";
+14
-2
machines/neoprism/physical.nix
+14
-2
machines/neoprism/physical.nix
···
1
-
{ self, modulesPath, config, lib, pkgs, ... }:
1
+
{
2
+
self,
3
+
modulesPath,
4
+
config,
5
+
lib,
6
+
pkgs,
7
+
...
8
+
}:
2
9
{
3
10
4
11
imports = [
···
13
20
14
21
boot.loader.grub.enable = true;
15
22
boot.loader.grub.efiSupport = true;
16
-
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "sd_mod" ];
23
+
boot.initrd.availableKernelModules = [
24
+
"xhci_pci"
25
+
"ahci"
26
+
"nvme"
27
+
"sd_mod"
28
+
];
17
29
boot.kernelParams = [
18
30
"boot.shell_on_fail"
19
31
];
+8
-2
machines/orange/config.nix
+8
-2
machines/orange/config.nix
···
13
13
clan.password-store.targetDirectory = "/var/state/secrets";
14
14
15
15
services.nginx.enable = true;
16
-
networking.firewall.allowedTCPPorts = [ 80 443 ];
16
+
networking.firewall.allowedTCPPorts = [
17
+
80
18
+
443
19
+
];
17
20
security.acme = {
18
21
acceptTerms = true;
19
22
defaults.email = "acme@lassul.us";
···
26
29
clanCore.facts.services.orange-container = {
27
30
secret."orange.sync.key" = { };
28
31
public."orange.sync.pub" = { };
29
-
generator.path = with pkgs; [ coreutils openssh ];
32
+
generator.path = with pkgs; [
33
+
coreutils
34
+
openssh
35
+
];
30
36
generator.script = ''
31
37
ssh-keygen -t ed25519 -N "" -f "$secrets"/orange.sync.key
32
38
mv "$secrets"/orange.sync.key "$facts"/orange.sync.pub
+6
-4
machines/prism/backup.nix
+6
-4
machines/prism/backup.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ config, pkgs, ... }:
2
2
{
3
3
services.postgresqlBackup.enable = true;
4
4
5
5
systemd.services.borgbackup-job-hetzner.serviceConfig.ReadWritePaths = [ "/var/log/telegraf" ];
6
6
7
7
clanCore.facts.services.borgbackup = {
8
-
secret."borgbackup.ssh.id25519" = {};
9
-
public."borgbackup.ssh.id25519.pub" = {};
8
+
secret."borgbackup.ssh.id25519" = { };
9
+
public."borgbackup.ssh.id25519.pub" = { };
10
10
generator.path = [
11
11
pkgs.coreutils
12
12
pkgs.openssh
···
29
29
compression = "auto,zstd";
30
30
startAt = "*-*-* 02:00:00";
31
31
# TODO: change backup key
32
-
environment.BORG_RSH = "ssh -oPort=23 -i ${config.clanCore.facts.services.borgbackup.secret."borgbackup.ssh.id25519".path}";
32
+
environment.BORG_RSH = "ssh -oPort=23 -i ${
33
+
config.clanCore.facts.services.borgbackup.secret."borgbackup.ssh.id25519".path
34
+
}";
33
35
preHook = ''
34
36
set -x
35
37
'';
+71
-17
machines/prism/config.nix
+71
-17
machines/prism/config.nix
···
1
-
{ self, config, lib, pkgs, ... }: let
1
+
{
2
+
self,
3
+
config,
4
+
lib,
5
+
pkgs,
6
+
...
7
+
}:
8
+
let
2
9
slib = self.inputs.stockholm.lib;
3
-
in {
10
+
in
11
+
{
4
12
5
13
system.stateVersion = "23.05";
6
14
imports = [
···
23
31
};
24
32
25
33
krebs.iptables.tables.filter.INPUT.rules = [
26
-
{ predicate = "-p tcp --dport http"; target = "ACCEPT"; }
27
-
{ predicate = "-p tcp --dport https"; target = "ACCEPT"; }
34
+
{
35
+
predicate = "-p tcp --dport http";
36
+
target = "ACCEPT";
37
+
}
38
+
{
39
+
predicate = "-p tcp --dport https";
40
+
target = "ACCEPT";
41
+
}
28
42
];
29
43
}
30
-
{ # TODO make new hfos.nix out of this vv
44
+
{
45
+
# TODO make new hfos.nix out of this vv
31
46
users.users.riot = {
32
47
uid = slib.genid_uint31 "riot";
33
48
isNormalUser = true;
···
37
52
];
38
53
};
39
54
krebs.iptables.tables.filter.FORWARD.rules = lib.mkBefore [
40
-
{ v6 = false; predicate = "--destination 95.216.1.130"; target = "ACCEPT"; }
41
-
{ v6 = false; predicate = "--source 95.216.1.130"; target = "ACCEPT"; }
55
+
{
56
+
v6 = false;
57
+
predicate = "--destination 95.216.1.130";
58
+
target = "ACCEPT";
59
+
}
60
+
{
61
+
v6 = false;
62
+
predicate = "--source 95.216.1.130";
63
+
target = "ACCEPT";
64
+
}
42
65
];
43
66
}
44
67
{
···
79
102
extraGroups = [
80
103
"download"
81
104
];
82
-
openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDQFaYOWRUvHP6I37q9Dd4PJOq8FNQqAeJZ8pLx0G62uC450kbPGcG80rHHvXmk7HqQP6biJmMg48bOsvXAScPot2Qhp1Qc35CuUqVhLiTvUAsi8l/iJjhjZ23yRGDCAmW5+JIOzIvECkcbMnG7YoYAQ9trNGHe9qwGzQGhpt3QVClE23WtE3PVKRLQx1VbiabSnAm6tXVd2zpUoSdpWt8Gpi2taM4XXJ5+l744MNxFHvDapN5xqpYzwrA34Ii13jNLWcGbtgxESpR+VjnamdWByrkBsW4X5/xn2K1I1FrujaM/DBHV1QMaDKst9V8+uL5X7aYNt0OUBu2eyZdg6aujY2BYovB9uRyR1JIuSbA/a54MM96yN9WirMUufJF/YZrV0L631t9EW8ORyWUo1GRzMuBHVHQlfApj7NCU/jEddUuTqKgwyRgTmMFMUI4M0tRULAB/7pBE1Vbcx9tg6RsKIk8VkskfbBJW9Y6Sx6YoFlxPdgMNIrBefqEjIV62piP7YLMlvfIDCJ7TNd9dLN86XGggZ/nD5zt6SL1o61vVnw9If8pHosppxADPJsJvcdN6fOe16/tFAeE0JRo0jTcyFVTBGfhpey+rFfuW8wtUyuO5WPUxkOn7xMHGMWHJAtWX2vwVIDtLxvqn48B4SmEOpPD6ii+vcpwqAex3ycqBUQ==" ];
105
+
openssh.authorizedKeys.keys = [
106
+
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDQFaYOWRUvHP6I37q9Dd4PJOq8FNQqAeJZ8pLx0G62uC450kbPGcG80rHHvXmk7HqQP6biJmMg48bOsvXAScPot2Qhp1Qc35CuUqVhLiTvUAsi8l/iJjhjZ23yRGDCAmW5+JIOzIvECkcbMnG7YoYAQ9trNGHe9qwGzQGhpt3QVClE23WtE3PVKRLQx1VbiabSnAm6tXVd2zpUoSdpWt8Gpi2taM4XXJ5+l744MNxFHvDapN5xqpYzwrA34Ii13jNLWcGbtgxESpR+VjnamdWByrkBsW4X5/xn2K1I1FrujaM/DBHV1QMaDKst9V8+uL5X7aYNt0OUBu2eyZdg6aujY2BYovB9uRyR1JIuSbA/a54MM96yN9WirMUufJF/YZrV0L631t9EW8ORyWUo1GRzMuBHVHQlfApj7NCU/jEddUuTqKgwyRgTmMFMUI4M0tRULAB/7pBE1Vbcx9tg6RsKIk8VkskfbBJW9Y6Sx6YoFlxPdgMNIrBefqEjIV62piP7YLMlvfIDCJ7TNd9dLN86XGggZ/nD5zt6SL1o61vVnw9If8pHosppxADPJsJvcdN6fOe16/tFAeE0JRo0jTcyFVTBGfhpey+rFfuW8wtUyuO5WPUxkOn7xMHGMWHJAtWX2vwVIDtLxvqn48B4SmEOpPD6ii+vcpwqAex3ycqBUQ=="
107
+
];
83
108
};
84
109
}
85
110
{
···
143
168
../../2configs/wiregrill.nix
144
169
];
145
170
krebs.iptables.tables.nat.PREROUTING.rules = lib.mkOrder 999 [
146
-
{ v6 = false; predicate = "-s 10.244.0.0/16"; target = "ACCEPT"; }
147
-
{ v4 = false; predicate = "-s 42:1::/32"; target = "ACCEPT"; }
171
+
{
172
+
v6 = false;
173
+
predicate = "-s 10.244.0.0/16";
174
+
target = "ACCEPT";
175
+
}
176
+
{
177
+
v4 = false;
178
+
predicate = "-s 42:1::/32";
179
+
target = "ACCEPT";
180
+
}
148
181
];
149
182
krebs.iptables.tables.filter.FORWARD.rules = lib.mkBefore [
150
-
{ predicate = "-i wiregrill -o retiolum"; target = "ACCEPT"; }
151
-
{ predicate = "-i retiolum -o wiregrill"; target = "ACCEPT"; }
183
+
{
184
+
predicate = "-i wiregrill -o retiolum";
185
+
target = "ACCEPT";
186
+
}
187
+
{
188
+
predicate = "-i retiolum -o wiregrill";
189
+
target = "ACCEPT";
190
+
}
152
191
];
153
192
krebs.iptables.tables.nat.POSTROUTING.rules = [
154
-
{ v4 = false; predicate = "-s 42:1::/32 ! -d 42:1::/48"; target = "MASQUERADE"; }
155
-
{ v6 = false; predicate = "-s 10.244.0.0/16 ! -d 10.244.0.0/16"; target = "MASQUERADE"; }
193
+
{
194
+
v4 = false;
195
+
predicate = "-s 42:1::/32 ! -d 42:1::/48";
196
+
target = "MASQUERADE";
197
+
}
198
+
{
199
+
v6 = false;
200
+
predicate = "-s 10.244.0.0/16 ! -d 10.244.0.0/16";
201
+
target = "MASQUERADE";
202
+
}
156
203
];
157
204
services.dnsmasq = {
158
205
enable = true;
···
160
207
161
208
settings = {
162
209
bind-interfaces = true;
163
-
interface = [ "wiregrill" "retiolum " ];
210
+
interface = [
211
+
"wiregrill"
212
+
"retiolum "
213
+
];
164
214
};
165
215
};
166
216
}
167
217
{
168
218
krebs.iptables.tables.filter.INPUT.rules = [
169
-
{ predicate = "-p udp --dport 60000:61000"; target = "ACCEPT"; }
219
+
{
220
+
predicate = "-p udp --dport 60000:61000";
221
+
target = "ACCEPT";
222
+
}
170
223
];
171
224
}
172
225
../../2configs/services/coms/murmur.nix
173
-
{ # acme fallback for neoprism migration
226
+
{
227
+
# acme fallback for neoprism migration
174
228
services.nginx.virtualHosts."lassul.us".acmeFallbackHost = "orange.r";
175
229
services.nginx.virtualHosts."radio.lassul.us".acmeFallbackHost = "neoprism.r";
176
230
services.nginx.virtualHosts."flix.lassul.us".acmeFallbackHost = "neoprism.r";
+19
-6
machines/prism/physical.nix
+19
-6
machines/prism/physical.nix
···
1
-
{ modulesPath, config, lib, pkgs, ... }:
1
+
{ modulesPath, lib, ... }:
2
2
3
3
{
4
4
···
7
7
(modulesPath + "/installer/scan/not-detected.nix")
8
8
];
9
9
10
-
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "sd_mod" ];
10
+
boot.initrd.availableKernelModules = [
11
+
"xhci_pci"
12
+
"ahci"
13
+
"sd_mod"
14
+
];
11
15
boot.kernelModules = [ "kvm-intel" ];
12
16
boot.swraid.enable = true;
13
17
···
71
75
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
72
76
73
77
boot.loader.grub.enable = true;
74
-
boot.loader.grub.devices = [ "/dev/sda" "/dev/sdb" ];
78
+
boot.loader.grub.devices = [
79
+
"/dev/sda"
80
+
"/dev/sdb"
81
+
];
75
82
76
83
# we don't pay for power there and this might solve a problem we observed at least once
77
84
# https://www.thomas-krenn.com/de/wiki/PCIe_Bus_Error_Status_00001100_beheben
78
-
boot.kernelParams = [ "pcie_aspm=off" "net.ifnames=0" "nomodeset" ];
85
+
boot.kernelParams = [
86
+
"pcie_aspm=off"
87
+
"net.ifnames=0"
88
+
"nomodeset"
89
+
];
79
90
networking.dhcpcd.enable = false;
80
-
81
91
82
92
networking.useNetworkd = lib.mkForce false;
83
93
systemd.network.enable = lib.mkForce false;
···
86
96
networking = {
87
97
hostId = "2283aaae";
88
98
defaultGateway = "95.216.1.129";
89
-
defaultGateway6 = { address = "fe80::1"; interface = "ext-br"; };
99
+
defaultGateway6 = {
100
+
address = "fe80::1";
101
+
interface = "ext-br";
102
+
};
90
103
# Use google's public DNS server
91
104
nameservers = [ "8.8.8.8" ];
92
105
interfaces.ext-br.ipv4.addresses = [
+5
-2
machines/radio/config.nix
+5
-2
machines/radio/config.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ config, pkgs, ... }:
2
2
{
3
3
imports = [
4
4
../../2configs
···
25
25
clanCore.facts.services.radio-container = {
26
26
secret."radio.sync.key" = { };
27
27
public."radio.sync.pub" = { };
28
-
generator.path = with pkgs; [ coreutils openssh ];
28
+
generator.path = with pkgs; [
29
+
coreutils
30
+
openssh
31
+
];
29
32
generator.script = ''
30
33
ssh-keygen -t ed25519 -N "" -f "$secrets"/radio.sync.key
31
34
mv "$secrets"/radio.sync.key "$facts"/radio.sync.pub
+10
-5
machines/radio/source.nix
+10
-5
machines/radio/source.nix
···
1
-
{ lib, pkgs, test, ... }: let
1
+
{ lib, test, ... }:
2
+
let
2
3
npkgs = lib.importJSON ../../../krebs/nixpkgs-unstable.json;
3
-
in if test then {} else {
4
-
nixpkgs.git.ref = lib.mkForce npkgs.rev;
5
-
nixpkgs-unstable = lib.mkForce { file = "/var/empty"; };
6
-
}
4
+
in
5
+
if test then
6
+
{ }
7
+
else
8
+
{
9
+
nixpkgs.git.ref = lib.mkForce npkgs.rev;
10
+
nixpkgs-unstable = lib.mkForce { file = "/var/empty"; };
11
+
}
+5
-2
machines/shodan/config.nix
+5
-2
machines/shodan/config.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ config, ... }:
2
2
3
3
{
4
4
imports = [
···
21
21
22
22
services.logind.lidSwitch = "ignore";
23
23
services.logind.lidSwitchDocked = "ignore";
24
-
nix.trustedUsers = [ "root" "lass" ];
24
+
nix.trustedUsers = [
25
+
"root"
26
+
"lass"
27
+
];
25
28
system.stateVersion = "22.05";
26
29
}
+12
-2
machines/shodan/physical.nix
+12
-2
machines/shodan/physical.nix
···
12
12
loader.grub.device = "/dev/sda";
13
13
14
14
initrd.luks.devices.lusksroot.device = "/dev/sda2";
15
-
initrd.availableKernelModules = [ "xhci_hcd" "ehci_pci" "ahci" "usb_storage" ];
15
+
initrd.availableKernelModules = [
16
+
"xhci_hcd"
17
+
"ehci_pci"
18
+
"ahci"
19
+
"usb_storage"
20
+
];
16
21
};
17
22
fileSystems = {
18
23
"/" = {
···
26
31
"/home" = {
27
32
device = "/dev/mapper/pool-home";
28
33
fsType = "btrfs";
29
-
options = ["defaults" "noatime" "ssd" "compress=lzo"];
34
+
options = [
35
+
"defaults"
36
+
"noatime"
37
+
"ssd"
38
+
"compress=lzo"
39
+
];
30
40
};
31
41
"/bku" = {
32
42
device = "/dev/pool/bku";
+6
-2
machines/styx/config.nix
+6
-2
machines/styx/config.nix
+14
-9
machines/styx/physical.nix
+14
-9
machines/styx/physical.nix
···
6
6
(modulesPath + "/installer/scan/not-detected.nix")
7
7
];
8
8
9
-
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" ];
9
+
boot.initrd.availableKernelModules = [
10
+
"xhci_pci"
11
+
"ahci"
12
+
"usbhid"
13
+
"sd_mod"
14
+
];
10
15
boot.initrd.kernelModules = [ "dm-snapshot" ];
11
16
boot.kernelModules = [ "kvm-intel" ];
12
17
boot.extraModulePackages = [ ];
···
16
21
boot.loader.grub.device = "/dev/disk/by-id/ata-SanDisk_SSD_G5_BICS4_20248F446514";
17
22
boot.loader.grub.efiInstallAsRemovable = true;
18
23
19
-
fileSystems."/" =
20
-
{ device = "/dev/disk/by-uuid/ee5c9099-17fa-401e-852e-67cb4ae068f4";
21
-
fsType = "ext4";
22
-
};
24
+
fileSystems."/" = {
25
+
device = "/dev/disk/by-uuid/ee5c9099-17fa-401e-852e-67cb4ae068f4";
26
+
fsType = "ext4";
27
+
};
23
28
24
-
fileSystems."/boot" =
25
-
{ device = "/dev/disk/by-uuid/EAA5-88A9";
26
-
fsType = "vfat";
27
-
};
29
+
fileSystems."/boot" = {
30
+
device = "/dev/disk/by-uuid/EAA5-88A9";
31
+
fsType = "vfat";
32
+
};
28
33
29
34
swapDevices = [ ];
30
35
+64
-16
machines/ubik/config.nix
+64
-16
machines/ubik/config.nix
···
1
-
{ self, config, pkgs, ... }:
1
+
{
2
+
self,
3
+
config,
4
+
pkgs,
5
+
...
6
+
}:
2
7
{
3
8
imports = [
4
9
../../2configs
···
19
24
acceptTerms = true;
20
25
defaults.email = "acme@lassul.us";
21
26
};
22
-
networking.firewall.allowedTCPPorts = [ 80 443 ];
27
+
networking.firewall.allowedTCPPorts = [
28
+
80
29
+
443
30
+
];
23
31
24
32
# nextcloud
25
33
services.nginx.virtualHosts."c.apanowicz.de" = {
···
89
97
# server_condition = ''${run{/run/current-system/sw/bin/debug_exim ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
90
98
'';
91
99
internet-aliases = [
92
-
{ from = "dma@ubikmedia.de"; to = "domsen"; }
93
-
{ from = "dma@ubikmedia.eu"; to = "domsen"; }
94
-
{ from = "hallo@apanowicz.de"; to = "domsen"; }
95
-
{ from = "bruno@apanowicz.de"; to = "bruno"; }
96
-
{ from = "mail@jla-trading.com"; to = "jla-trading"; }
97
-
{ from = "jms@ubikmedia.eu"; to = "jms"; }
98
-
{ from = "ms@ubikmedia.eu"; to = "ms"; }
99
-
{ from = "ubik@ubikmedia.eu"; to = "domsen, jms, ms"; }
100
-
{ from = "kontakt@alewis.de"; to ="klabusterbeere"; }
101
-
{ from = "hallo@jarugadesign.de"; to ="kasia"; }
102
-
{ from = "noreply@beeshmooth.ch"; to ="besmooth@gmx.ch"; }
100
+
{
101
+
from = "dma@ubikmedia.de";
102
+
to = "domsen";
103
+
}
104
+
{
105
+
from = "dma@ubikmedia.eu";
106
+
to = "domsen";
107
+
}
108
+
{
109
+
from = "hallo@apanowicz.de";
110
+
to = "domsen";
111
+
}
112
+
{
113
+
from = "bruno@apanowicz.de";
114
+
to = "bruno";
115
+
}
116
+
{
117
+
from = "mail@jla-trading.com";
118
+
to = "jla-trading";
119
+
}
120
+
{
121
+
from = "jms@ubikmedia.eu";
122
+
to = "jms";
123
+
}
124
+
{
125
+
from = "ms@ubikmedia.eu";
126
+
to = "ms";
127
+
}
128
+
{
129
+
from = "ubik@ubikmedia.eu";
130
+
to = "domsen, jms, ms";
131
+
}
132
+
{
133
+
from = "kontakt@alewis.de";
134
+
to = "klabusterbeere";
135
+
}
136
+
{
137
+
from = "hallo@jarugadesign.de";
138
+
to = "kasia";
139
+
}
140
+
{
141
+
from = "noreply@beeshmooth.ch";
142
+
to = "besmooth@gmx.ch";
143
+
}
103
144
104
-
{ from = "testuser@ubikmedia.eu"; to = "testuser"; }
145
+
{
146
+
from = "testuser@ubikmedia.eu";
147
+
to = "testuser";
148
+
}
105
149
];
106
150
sender_domains = [
107
151
"jla-trading.com"
···
121
165
};
122
166
123
167
# users
124
-
users.groups.xanf = {};
168
+
users.groups.xanf = { };
125
169
users.users.UBIK-SFTP = {
126
170
uid = pkgs.stockholm.lib.genid_uint31 "UBIK-SFTP";
127
171
home = "/home/UBIK-SFTP";
···
144
188
description = "maintenance acc for domsen";
145
189
home = "/home/domsen";
146
190
useDefaultShell = true;
147
-
extraGroups = [ "syncthing" "download" "xanf" ];
191
+
extraGroups = [
192
+
"syncthing"
193
+
"download"
194
+
"xanf"
195
+
];
148
196
createHome = true;
149
197
isNormalUser = true;
150
198
};
+16
-7
machines/xerxes/config.nix
+16
-7
machines/xerxes/config.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{
2
+
config,
3
+
lib,
4
+
pkgs,
5
+
...
6
+
}:
2
7
3
8
{
4
9
imports = [
···
43
48
systemd.services.xboxdrv = {
44
49
wantedBy = [ "multi-user.target" ];
45
50
script = ''
46
-
${pkgs.xboxdrv.overrideAttrs(o: {
47
-
patches = o.patches ++ [ (pkgs.fetchurl {
48
-
url = "https://patch-diff.githubusercontent.com/raw/xboxdrv/xboxdrv/pull/251.patch";
49
-
sha256 = "17784y20mxqrlhgvwvszh8lprxrvgmb7ah9dknmbhj5jhkjl8wq5";
50
-
}) ];
51
-
})}/bin/xboxdrv --type xbox360 --dbus disabled -D
51
+
${
52
+
pkgs.xboxdrv.overrideAttrs (o: {
53
+
patches = o.patches ++ [
54
+
(pkgs.fetchurl {
55
+
url = "https://patch-diff.githubusercontent.com/raw/xboxdrv/xboxdrv/pull/251.patch";
56
+
sha256 = "17784y20mxqrlhgvwvszh8lprxrvgmb7ah9dknmbhj5jhkjl8wq5";
57
+
})
58
+
];
59
+
})
60
+
}/bin/xboxdrv --type xbox360 --dbus disabled -D
52
61
'';
53
62
};
54
63
+12
-2
machines/xerxes/physical.nix
+12
-2
machines/xerxes/physical.nix
···
1
-
{ modulesPath, pkgs, lib, ... }:
1
+
{
2
+
modulesPath,
3
+
pkgs,
4
+
lib,
5
+
...
6
+
}:
2
7
{
3
8
imports = [
4
9
./config.nix
···
16
21
"sdhci_pci"
17
22
];
18
23
19
-
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" ];
24
+
boot.initrd.availableKernelModules = [
25
+
"xhci_pci"
26
+
"ahci"
27
+
"usbhid"
28
+
"sd_mod"
29
+
];
20
30
boot.initrd.luks.devices.crypted.device = "/dev/sda3";
21
31
boot.kernelModules = [ "kvm-intel" ];
22
32
boot.kernelParams = [
+18
-5
machines/yellow/config.nix
+18
-5
machines/yellow/config.nix
···
1
-
{ config, pkgs, lib, ... }: let
1
+
{
2
+
config,
3
+
pkgs,
4
+
lib,
5
+
...
6
+
}:
7
+
let
2
8
torrentport = 56709; # port forwarded in airvpn webinterface
3
-
in {
9
+
in
10
+
{
4
11
imports = [
5
12
../../2configs
6
13
../../2configs/retiolum.nix
···
11
18
12
19
# we need to configure another port for the mycelium admin interface, because it conflicts with sonarr.
13
20
services.mycelium.extraArgs = [
14
-
"--api-addr" "127.0.0.1:9898"
21
+
"--api-addr"
22
+
"127.0.0.1:9898"
15
23
];
16
24
17
25
services.transmission.settings.peer-port = torrentport;
···
58
66
ip link set airvpn netns transmission
59
67
ip -n transmission addr add 10.176.43.231/32 dev airvpn
60
68
ip -n transmission addr add fd7d:76ee:e68f:a993:41b3:846b:d271:30d8/128 dev airvpn
61
-
ip netns exec transmission wg syncconf airvpn <(wg-quick strip ${config.clanCore.facts.services.airvpn.secret."airvpn.conf".path})
69
+
ip netns exec transmission wg syncconf airvpn <(wg-quick strip ${
70
+
config.clanCore.facts.services.airvpn.secret."airvpn.conf".path
71
+
})
62
72
ip -n transmission link set airvpn up
63
73
ip -n transmission route add default dev airvpn
64
74
ip -6 -n transmission route add default dev airvpn
···
114
124
clanCore.facts.services.yellow-container = {
115
125
secret."yellow.sync.key" = { };
116
126
public."yellow.sync.pub" = { };
117
-
generator.path = with pkgs; [ coreutils openssh ];
127
+
generator.path = with pkgs; [
128
+
coreutils
129
+
openssh
130
+
];
118
131
generator.script = ''
119
132
ssh-keygen -t ed25519 -N "" -f "$secrets"/yellow.sync.key
120
133
mv "$secrets"/yellow.sync.key "$facts"/yellow.sync.pub
+104
-81
tools/astronvim/flake-module.nix
+104
-81
tools/astronvim/flake-module.nix
···
1
-
{ inputs , ... }:
1
+
{ ... }:
2
2
{
3
-
perSystem = { system, lib, pkgs, ... }: let
4
-
nvim-appname = "lassvim";
3
+
perSystem =
4
+
{
5
+
system,
6
+
lib,
7
+
pkgs,
8
+
...
9
+
}:
10
+
let
11
+
nvim-appname = "lassvim";
5
12
6
-
lsp-packages = with pkgs; [
7
-
nodejs # copilot
8
-
terraform-ls
9
-
pyright
10
-
11
-
# based on ./suggested-pkgs.json
12
-
gopls
13
-
golangci-lint
14
-
nodePackages.bash-language-server
15
-
taplo-lsp
16
-
marksman
17
-
selene
18
-
rust-analyzer
19
-
yaml-language-server
20
-
nil
21
-
shellcheck
22
-
shfmt
23
-
ruff
24
-
ruff-lsp
25
-
nixfmt-rfc-style
26
-
terraform-ls
27
-
clang-tools
28
-
nodePackages.prettier
29
-
stylua
30
-
# based on https://github.com/ray-x/go.nvim#go-binaries-install-and-update
31
-
go
32
-
gofumpt
33
-
gomodifytags
34
-
gotools
35
-
delve
36
-
golines
37
-
gomodifytags
38
-
gotests
39
-
iferr
40
-
impl
41
-
reftools
42
-
ginkgo
43
-
richgo
44
-
govulncheck
45
-
46
-
#ocaml-ng.ocamlPackages_5_0.ocaml-lsp
47
-
#ocaml-ng.ocamlPackages_5_0.ocamlformat
48
-
# does not build yet on aarch64
49
-
] ++ lib.optional (pkgs.stdenv.hostPlatform.system == "x86_64-linux") pkgs.deno
50
-
++ lib.optional (!pkgs.stdenv.hostPlatform.isDarwin) sumneko-lua-language-server;
13
+
lsp-packages =
14
+
with pkgs;
15
+
[
16
+
nodejs # copilot
17
+
terraform-ls
18
+
pyright
51
19
52
-
lspEnv = pkgs.buildEnv {
53
-
name = "lspEnv";
54
-
paths = lsp-packages;
20
+
# based on ./suggested-pkgs.json
21
+
gopls
22
+
golangci-lint
23
+
nodePackages.bash-language-server
24
+
taplo-lsp
25
+
marksman
26
+
selene
27
+
rust-analyzer
28
+
yaml-language-server
29
+
nil
30
+
shellcheck
31
+
shfmt
32
+
ruff
33
+
ruff-lsp
34
+
nixfmt-rfc-style
35
+
terraform-ls
36
+
clang-tools
37
+
nodePackages.prettier
38
+
stylua
39
+
# based on https://github.com/ray-x/go.nvim#go-binaries-install-and-update
40
+
go
41
+
gofumpt
42
+
gomodifytags
43
+
gotools
44
+
delve
45
+
golines
46
+
gomodifytags
47
+
gotests
48
+
iferr
49
+
impl
50
+
reftools
51
+
ginkgo
52
+
richgo
53
+
govulncheck
54
+
55
+
#ocaml-ng.ocamlPackages_5_0.ocaml-lsp
56
+
#ocaml-ng.ocamlPackages_5_0.ocamlformat
57
+
# does not build yet on aarch64
58
+
]
59
+
++ lib.optional (pkgs.stdenv.hostPlatform.system == "x86_64-linux") pkgs.deno
60
+
++ lib.optional (!pkgs.stdenv.hostPlatform.isDarwin) sumneko-lua-language-server;
61
+
62
+
lspEnv = pkgs.buildEnv {
63
+
name = "lspEnv";
64
+
paths = lsp-packages;
65
+
};
66
+
67
+
treesitter-grammars =
68
+
let
69
+
grammars = lib.filterAttrs (
70
+
n: _: lib.hasPrefix "tree-sitter-" n
71
+
) pkgs.vimPlugins.nvim-treesitter.builtGrammars;
72
+
symlinks = lib.mapAttrsToList (
73
+
name: grammar: "ln -s ${grammar}/parser $out/${lib.removePrefix "tree-sitter-" name}.so"
74
+
) grammars;
75
+
in
76
+
(pkgs.runCommand "treesitter-grammars" { } ''
77
+
mkdir -p $out
78
+
${lib.concatStringsSep "\n" symlinks}
79
+
'').overrideAttrs
80
+
(_: {
81
+
passthru.rev = pkgs.vimPlugins.nvim-treesitter.src.rev;
82
+
});
83
+
84
+
in
85
+
{
86
+
packages.vim = pkgs.writeShellScriptBin "vim" ''
87
+
set -efux
88
+
unset VIMINIT
89
+
export PATH=${lspEnv}/bin:$PATH
90
+
export NVIM_APPNAME=${nvim-appname}
91
+
92
+
XDG_CONFIG_HOME=''${XDG_CONFIG_HOME:-$HOME/.config}
93
+
XDG_DATA_HOME=''${XDG_DATA_HOME:-$HOME/.local/share}
94
+
95
+
mkdir -p "$XDG_CONFIG_HOME/$NVIM_APPNAME" "$XDG_DATA_HOME"
96
+
chmod -R u+w "$XDG_CONFIG_HOME/$NVIM_APPNAME"
97
+
rm -rf "$XDG_CONFIG_HOME/$NVIM_APPNAME"
98
+
${pkgs.coreutils}/bin/cp -arfT '${./config}'/ "$XDG_CONFIG_HOME/$NVIM_APPNAME"
99
+
chmod -R u+w "$XDG_CONFIG_HOME/$NVIM_APPNAME"
100
+
echo "${treesitter-grammars.rev}" > "$XDG_CONFIG_HOME/$NVIM_APPNAME/treesitter-rev"
101
+
102
+
${pkgs.neovim}/bin/nvim --headless -c 'quitall' # install plugins
103
+
mkdir -p "$XDG_DATA_HOME/$NVIM_APPNAME/lib/" "$XDG_DATA_HOME/$NVIM_APPNAME/site/"
104
+
${pkgs.coreutils}/bin/ln -sfT "${pkgs.vimPlugins.telescope-fzf-native-nvim}/build/libfzf.so" "$XDG_DATA_HOME/$NVIM_APPNAME/lib/libfzf.so"
105
+
${pkgs.coreutils}/bin/ln -sfT "${treesitter-grammars}" "$XDG_DATA_HOME/$NVIM_APPNAME/site/parser"
106
+
exec ${pkgs.neovim}/bin/nvim "$@"
107
+
'';
55
108
};
56
-
57
-
treesitter-grammars = pkgs.runCommand "treesitter-grammars" { } (
58
-
lib.concatMapStringsSep "\n" (grammar: ''
59
-
mkdir -p $out
60
-
ln -s $(readlink -f ${grammar}/parser/*.so) $out/${lib.last (builtins.split "-" grammar.name)}.so
61
-
'') pkgs.vimPlugins.nvim-treesitter.withAllGrammars.dependencies
62
-
);
63
-
64
-
in {
65
-
packages.vim = pkgs.writeShellScriptBin "vim" ''
66
-
set -efux
67
-
unset VIMINIT
68
-
export PATH=${lspEnv}/bin:$PATH
69
-
export NVIM_APPNAME=${nvim-appname}
70
-
71
-
XDG_CONFIG_HOME=''${XDG_CONFIG_HOME:-$HOME/.config}
72
-
XDG_DATA_HOME=''${XDG_DATA_HOME:-$HOME/.local/share}
73
-
74
-
mkdir -p "$XDG_CONFIG_HOME/$NVIM_APPNAME" "$XDG_DATA_HOME"
75
-
chmod -R u+w "$XDG_CONFIG_HOME/$NVIM_APPNAME"
76
-
rm -rf "$XDG_CONFIG_HOME/$NVIM_APPNAME"
77
-
${pkgs.coreutils}/bin/cp -arfT '${./config}'/ "$XDG_CONFIG_HOME/$NVIM_APPNAME"
78
-
chmod -R u+w "$XDG_CONFIG_HOME/$NVIM_APPNAME"
79
-
${pkgs.neovim}/bin/nvim --headless -c 'quitall' # install plugins
80
-
mkdir -p "$XDG_DATA_HOME/$NVIM_APPNAME/lib/" "$XDG_DATA_HOME/$NVIM_APPNAME/site/"
81
-
${pkgs.coreutils}/bin/ln -sfT "${pkgs.vimPlugins.telescope-fzf-native-nvim}/build/libfzf.so" "$XDG_DATA_HOME/$NVIM_APPNAME/lib/libfzf.so"
82
-
${pkgs.coreutils}/bin/ln -sfT "${treesitter-grammars}" "$XDG_DATA_HOME/$NVIM_APPNAME/site/parser"
83
-
exec ${pkgs.neovim}/bin/nvim "$@"
84
-
'';
85
-
};
86
109
}
+12
-2
2configs/desktops/lib/wayland.nix
+12
-2
2configs/desktops/lib/wayland.nix
···
1
-
{ self, pkgs, lib, ... }:
1
+
{
2
+
self,
3
+
pkgs,
4
+
lib,
5
+
...
6
+
}:
2
7
{
3
8
imports = [
4
9
../../alacritty.nix
···
27
32
freeMemThreshold = 5;
28
33
};
29
34
30
-
users.users.mainUser.extraGroups = [ "audio" "pipewire" "video" "input" ];
35
+
users.users.mainUser.extraGroups = [
36
+
"audio"
37
+
"pipewire"
38
+
"video"
39
+
"input"
40
+
];
31
41
32
42
xdg.portal.enable = true;
33
43
xdg.portal.wlr.enable = true;
+14
-4
2configs/desktops/lib/x11.nix
+14
-4
2configs/desktops/lib/x11.nix
···
1
-
{ self, config, lib, pkgs, ... }:
1
+
{
2
+
config,
3
+
lib,
4
+
pkgs,
5
+
...
6
+
}:
2
7
{
3
8
imports = [
4
9
../../alacritty.nix
···
18
23
lass ALL= (root) NOPASSWD:SETENV: ${pkgs.sshuttle}/bin/.sshuttle-wrapped
19
24
'';
20
25
}
21
-
{ #font magic
26
+
{
27
+
#font magic
22
28
options.lass.fonts = {
23
29
regular = lib.mkOption {
24
30
type = lib.types.str;
···
41
47
}
42
48
];
43
49
44
-
users.users.mainUser.extraGroups = [ "audio" "pipewire" "video" ];
50
+
users.users.mainUser.extraGroups = [
51
+
"audio"
52
+
"pipewire"
53
+
"video"
54
+
];
45
55
46
56
time.timeZone = "Europe/Berlin";
47
57
···
131
141
};
132
142
};
133
143
134
-
nixpkgs.config.packageOverrides = super: {
144
+
nixpkgs.config.packageOverrides = _super: {
135
145
dmenu = pkgs.writers.writeDashBin "dmenu" ''
136
146
${pkgs.fzfmenu}/bin/fzfmenu "$@"
137
147
'';
+5
-6
2configs/desktops/sway/default.nix
+5
-6
2configs/desktops/sway/default.nix
···
1
-
{ config, lib, pkgs, ... }: let
1
+
{ pkgs, ... }:
2
+
let
2
3
3
4
term = "/run/current-system/sw/bin/alacritty";
4
5
5
-
in {
6
+
in
7
+
{
6
8
imports = [
7
9
../lib/wayland.nix
8
10
];
···
266
268
systemctl --user start xdg-desktop-portal xdg-desktop-portal-wlr
267
269
''}
268
270
269
-
exec_always ${let
270
-
schema = pkgs.gsettings-desktop-schemas;
271
-
datadir = "${schema}/share/gsettings-schemas/${schema.name}";
272
-
in pkgs.writers.writeDash "gsettings" ''
271
+
exec_always ${pkgs.writers.writeDash "gsettings" ''
273
272
set -efux
274
273
export XDG_DATA_DIRS=${pkgs.gsettings-desktop-schemas}:$XDG_DATA_DIRS
275
274
gnome_schema=org.gnome.desktop.interface
+197
-188
2configs/desktops/xmonad/default.nix
+197
-188
2configs/desktops/xmonad/default.nix
···
1
-
{ self, config, lib, pkgs, ... }:
1
+
{
2
+
self,
3
+
config,
4
+
lib,
5
+
pkgs,
6
+
...
7
+
}:
2
8
3
9
{
4
10
imports = [
···
10
16
hs.extra
11
17
hs.xmonad-contrib
12
18
];
13
-
config = /* haskell */ ''
14
-
{-# LANGUAGE LambdaCase #-}
19
+
config = # haskell
20
+
''
21
+
{-# LANGUAGE LambdaCase #-}
15
22
16
23
17
-
module Main where
18
-
import XMonad
24
+
module Main where
25
+
import XMonad
19
26
20
-
import qualified XMonad.StackSet as W
21
-
import Control.Monad.Extra (whenJustM)
22
-
import Data.List (isInfixOf)
23
-
import Data.Monoid (Endo)
24
-
import System.Environment (getArgs, lookupEnv)
25
-
import System.Exit (exitFailure)
26
-
import System.IO (hPutStrLn, stderr)
27
-
import System.Posix.Process (executeFile)
28
-
import Data.Ratio
27
+
import qualified XMonad.StackSet as W
28
+
import Control.Monad.Extra (whenJustM)
29
+
import Data.List (isInfixOf)
30
+
import Data.Monoid (Endo)
31
+
import System.Environment (getArgs, lookupEnv)
32
+
import System.Exit (exitFailure)
33
+
import System.IO (hPutStrLn, stderr)
34
+
import System.Posix.Process (executeFile)
35
+
import Data.Ratio
29
36
30
-
import XMonad.Actions.Commands (defaultCommands, runCommand)
31
-
import XMonad.Actions.CopyWindow (copy, copyToAll, kill1)
32
-
import XMonad.Actions.CycleWS (toggleWS)
33
-
import XMonad.Actions.DynamicWorkspaces ( addWorkspacePrompt, renameWorkspace, removeEmptyWorkspace)
34
-
import XMonad.Actions.DynamicWorkspaces (withWorkspace)
35
-
import XMonad.Actions.GridSelect (GSConfig(..), gridselectWorkspace, navNSearch)
36
-
import XMonad.Actions.Minimize (minimizeWindow, maximizeWindow, withLastMinimized)
37
-
import XMonad.Hooks.EwmhDesktops (ewmh)
38
-
import XMonad.Hooks.FloatNext (floatNext)
39
-
import XMonad.Hooks.FloatNext (floatNextHook)
40
-
import XMonad.Hooks.ManageDocks (avoidStruts, ToggleStruts(ToggleStruts))
41
-
import XMonad.Hooks.ManageHelpers (doCenterFloat, doRectFloat, (-?>))
42
-
import XMonad.Hooks.Place (placeHook, smart)
43
-
import XMonad.Hooks.UrgencyHook (focusUrgent)
44
-
import XMonad.Hooks.UrgencyHook (withUrgencyHook, UrgencyHook(..))
45
-
import XMonad.Layout.BoringWindows (boringWindows, focusDown, focusUp)
46
-
import XMonad.Layout.FixedColumn (FixedColumn(..))
47
-
import XMonad.Layout.Grid (Grid(..))
48
-
import XMonad.Layout.Minimize (minimize)
49
-
import XMonad.Layout.NoBorders (smartBorders, noBorders)
50
-
import XMonad.Layout.MouseResizableTile (mouseResizableTile)
51
-
import XMonad.Layout.SimplestFloat (simplestFloat)
52
-
import XMonad.Layout.StateFull
53
-
import XMonad.ManageHook (composeAll)
54
-
import XMonad.Prompt (autoComplete, font, height, searchPredicate, XPConfig)
55
-
import XMonad.Util.EZConfig (additionalKeysP)
56
-
import XMonad.Util.NamedWindows (getName)
57
-
import XMonad.Util.Run (safeSpawn)
58
-
import XMonad.Util.Ungrab (unGrab)
59
-
import XMonad.Util.Paste (sendKey)
37
+
import XMonad.Actions.Commands (defaultCommands, runCommand)
38
+
import XMonad.Actions.CopyWindow (copy, copyToAll, kill1)
39
+
import XMonad.Actions.CycleWS (toggleWS)
40
+
import XMonad.Actions.DynamicWorkspaces ( addWorkspacePrompt, renameWorkspace, removeEmptyWorkspace)
41
+
import XMonad.Actions.DynamicWorkspaces (withWorkspace)
42
+
import XMonad.Actions.GridSelect (GSConfig(..), gridselectWorkspace, navNSearch)
43
+
import XMonad.Actions.Minimize (minimizeWindow, maximizeWindow, withLastMinimized)
44
+
import XMonad.Hooks.EwmhDesktops (ewmh)
45
+
import XMonad.Hooks.FloatNext (floatNext)
46
+
import XMonad.Hooks.FloatNext (floatNextHook)
47
+
import XMonad.Hooks.ManageDocks (avoidStruts, ToggleStruts(ToggleStruts))
48
+
import XMonad.Hooks.ManageHelpers (doCenterFloat, doRectFloat, (-?>))
49
+
import XMonad.Hooks.Place (placeHook, smart)
50
+
import XMonad.Hooks.UrgencyHook (focusUrgent)
51
+
import XMonad.Hooks.UrgencyHook (withUrgencyHook, UrgencyHook(..))
52
+
import XMonad.Layout.BoringWindows (boringWindows, focusDown, focusUp)
53
+
import XMonad.Layout.FixedColumn (FixedColumn(..))
54
+
import XMonad.Layout.Grid (Grid(..))
55
+
import XMonad.Layout.Minimize (minimize)
56
+
import XMonad.Layout.NoBorders (smartBorders, noBorders)
57
+
import XMonad.Layout.MouseResizableTile (mouseResizableTile)
58
+
import XMonad.Layout.SimplestFloat (simplestFloat)
59
+
import XMonad.Layout.StateFull
60
+
import XMonad.ManageHook (composeAll)
61
+
import XMonad.Prompt (autoComplete, font, height, searchPredicate, XPConfig)
62
+
import XMonad.Util.EZConfig (additionalKeysP)
63
+
import XMonad.Util.NamedWindows (getName)
64
+
import XMonad.Util.Run (safeSpawn)
65
+
import XMonad.Util.Ungrab (unGrab)
66
+
import XMonad.Util.Paste (sendKey)
60
67
61
-
data LibNotifyUrgencyHook = LibNotifyUrgencyHook deriving (Read, Show)
68
+
data LibNotifyUrgencyHook = LibNotifyUrgencyHook deriving (Read, Show)
62
69
63
-
instance UrgencyHook LibNotifyUrgencyHook where
64
-
urgencyHook LibNotifyUrgencyHook w = do
65
-
name <- getName w
66
-
Just idx <- fmap (W.findTag w) $ gets windowset
70
+
instance UrgencyHook LibNotifyUrgencyHook where
71
+
urgencyHook LibNotifyUrgencyHook w = do
72
+
name <- getName w
73
+
Just idx <- fmap (W.findTag w) $ gets windowset
67
74
68
-
safeSpawn "${pkgs.libnotify}/bin/notify-send" [show name, "workspace " ++ idx]
75
+
safeSpawn "${pkgs.libnotify}/bin/notify-send" [show name, "workspace " ++ idx]
69
76
70
-
myTerm :: FilePath
71
-
myTerm = "/run/current-system/sw/bin/alacritty"
77
+
myTerm :: FilePath
78
+
myTerm = "/run/current-system/sw/bin/alacritty"
72
79
73
-
myFont :: String
74
-
myFont = "${config.lass.fonts.regular}"
80
+
myFont :: String
81
+
myFont = "${config.lass.fonts.regular}"
75
82
76
-
main :: IO ()
77
-
main = do
78
-
xmonad $ ewmh
79
-
$ withUrgencyHook LibNotifyUrgencyHook
80
-
$ def
81
-
{ terminal = myTerm
82
-
, modMask = mod4Mask
83
-
, layoutHook = myLayoutHook
84
-
, manageHook = floatHooks
85
-
, startupHook =
86
-
whenJustM (liftIO (lookupEnv "XMONAD_STARTUP_HOOK"))
87
-
(\path -> forkFile path [] Nothing)
88
-
, normalBorderColor = "#1c1c1c"
89
-
, focusedBorderColor = "#ff0000"
90
-
, workspaces = [ "dashboard", "sys", "wp" ]
91
-
} `additionalKeysP` myKeyMap
83
+
main :: IO ()
84
+
main = do
85
+
xmonad $ ewmh
86
+
$ withUrgencyHook LibNotifyUrgencyHook
87
+
$ def
88
+
{ terminal = myTerm
89
+
, modMask = mod4Mask
90
+
, layoutHook = myLayoutHook
91
+
, manageHook = floatHooks
92
+
, startupHook =
93
+
whenJustM (liftIO (lookupEnv "XMONAD_STARTUP_HOOK"))
94
+
(\path -> forkFile path [] Nothing)
95
+
, normalBorderColor = "#1c1c1c"
96
+
, focusedBorderColor = "#ff0000"
97
+
, workspaces = [ "dashboard", "sys", "wp" ]
98
+
} `additionalKeysP` myKeyMap
92
99
93
-
myLayoutHook = defLayout
94
-
where
95
-
defLayout = smartBorders $
96
-
minimize .
97
-
boringWindows $
98
-
(
99
-
noBorders StateFull |||
100
-
(avoidStruts $ Mirror (Tall 1 (3/100) (1/2))) |||
101
-
FixedColumn 2 80 80 1 |||
102
-
Tall 1 (3/100) (1/2) |||
103
-
simplestFloat |||
104
-
mouseResizableTile |||
105
-
Grid
106
-
)
100
+
myLayoutHook = defLayout
101
+
where
102
+
defLayout = smartBorders $
103
+
minimize .
104
+
boringWindows $
105
+
(
106
+
noBorders StateFull |||
107
+
(avoidStruts $ Mirror (Tall 1 (3/100) (1/2))) |||
108
+
FixedColumn 2 80 80 1 |||
109
+
Tall 1 (3/100) (1/2) |||
110
+
simplestFloat |||
111
+
mouseResizableTile |||
112
+
Grid
113
+
)
107
114
108
-
floatHooks = composeAll
109
-
[ className =? "Pinentry" --> doCenterFloat
110
-
, className =? "Pager" --> doCenterFloat
111
-
, title =? "pager" --> doCenterFloat
112
-
, title =? "fzfmenu" --> doCenterFloat
113
-
, title =? "glxgears" --> doCenterFloat
114
-
, resource =? "Dialog" --> doFloat
115
-
, title =? "Upload to Imgur" -->
116
-
doRectFloat (W.RationalRect 0 0 (1 % 8) (1 % 8))
117
-
, placeHook (smart (1,0))
118
-
, floatNextHook
119
-
]
115
+
floatHooks = composeAll
116
+
[ className =? "Pinentry" --> doCenterFloat
117
+
, className =? "Pager" --> doCenterFloat
118
+
, title =? "pager" --> doCenterFloat
119
+
, title =? "fzfmenu" --> doCenterFloat
120
+
, title =? "glxgears" --> doCenterFloat
121
+
, resource =? "Dialog" --> doFloat
122
+
, title =? "Upload to Imgur" -->
123
+
doRectFloat (W.RationalRect 0 0 (1 % 8) (1 % 8))
124
+
, placeHook (smart (1,0))
125
+
, floatNextHook
126
+
]
120
127
121
-
myKeyMap :: [([Char], X ())]
122
-
myKeyMap =
123
-
[ ("M4-p", forkFile "${pkgs.writers.writeDash "passmenu-wrapped" ''
124
-
set -efux
125
-
export TERM=dumb
126
-
${pkgs.pass}/bin/passmenu --type
127
-
''}" [] Nothing)
128
+
myKeyMap :: [([Char], X ())]
129
+
myKeyMap =
130
+
[ ("M4-p", forkFile "${pkgs.writers.writeDash "passmenu-wrapped" ''
131
+
set -efux
132
+
export TERM=dumb
133
+
${pkgs.pass}/bin/passmenu --type
134
+
''}" [] Nothing)
128
135
129
-
, ("M4-S-p", forkFile "${self.packages.${pkgs.system}.otpmenu}/bin/otpmenu" [] Nothing)
136
+
, ("M4-S-p", forkFile "${self.packages.${pkgs.system}.otpmenu}/bin/otpmenu" [] Nothing)
130
137
131
-
, ("M4-S-q", restart "xmonad" True)
138
+
, ("M4-S-q", restart "xmonad" True)
132
139
133
-
, ("<XF86AudioMute>", spawn "${pkgs.pulseaudio.out}/bin/pactl -- set-sink-mute @DEFAULT_SINK@ toggle")
134
-
, ("<XF86AudioRaiseVolume>", spawn "${pkgs.pulseaudio.out}/bin/pactl -- set-sink-volume @DEFAULT_SINK@ +4%")
135
-
, ("<XF86AudioLowerVolume>", spawn "${pkgs.pulseaudio.out}/bin/pactl -- set-sink-volume @DEFAULT_SINK@ -4%")
136
-
, ("<XF86MonBrightnessDown>", spawn "${pkgs.acpilight}/bin/xbacklight -time 0 -dec 1")
137
-
, ("<XF86MonBrightnessUp>", spawn "${pkgs.acpilight}/bin/xbacklight -time 0 -inc 1")
138
-
, ("M4-C-k", spawn "${pkgs.xorg.xkill}/bin/xkill")
140
+
, ("<XF86AudioMute>", spawn "${pkgs.pulseaudio.out}/bin/pactl -- set-sink-mute @DEFAULT_SINK@ toggle")
141
+
, ("<XF86AudioRaiseVolume>", spawn "${pkgs.pulseaudio.out}/bin/pactl -- set-sink-volume @DEFAULT_SINK@ +4%")
142
+
, ("<XF86AudioLowerVolume>", spawn "${pkgs.pulseaudio.out}/bin/pactl -- set-sink-volume @DEFAULT_SINK@ -4%")
143
+
, ("<XF86MonBrightnessDown>", spawn "${pkgs.acpilight}/bin/xbacklight -time 0 -dec 1")
144
+
, ("<XF86MonBrightnessUp>", spawn "${pkgs.acpilight}/bin/xbacklight -time 0 -inc 1")
145
+
, ("M4-C-k", spawn "${pkgs.xorg.xkill}/bin/xkill")
139
146
140
-
, ("M4-<Tab>", focusDown)
141
-
, ("M4-S-<Tab>", focusUp)
142
-
, ("M4-j", focusDown)
143
-
, ("M4-k", focusUp)
147
+
, ("M4-<Tab>", focusDown)
148
+
, ("M4-S-<Tab>", focusUp)
149
+
, ("M4-j", focusDown)
150
+
, ("M4-k", focusUp)
144
151
145
-
, ("M4-a", focusUrgent)
146
-
, ("M4-S-r", renameWorkspace myXPConfig)
147
-
, ("M4-S-a", addWorkspacePrompt myXPConfig)
148
-
, ("M4-S-<Backspace>", removeEmptyWorkspace)
149
-
, ("M4-S-c", kill1)
150
-
, ("M4-<Esc>", toggleWS)
151
-
, ("M4-S-<Enter>", spawn myTerm)
152
-
, ("M4-x", floatNext True >> spawn myTerm)
153
-
, ("M4-c", spawn "/run/current-system/sw/bin/emacsclient -c")
154
-
-- , ("M4-c", unGrab)
155
-
, ("M4-f", floatNext True)
156
-
, ("M4-b", spawn "/run/current-system/sw/bin/klem")
152
+
, ("M4-a", focusUrgent)
153
+
, ("M4-S-r", renameWorkspace myXPConfig)
154
+
, ("M4-S-a", addWorkspacePrompt myXPConfig)
155
+
, ("M4-S-<Backspace>", removeEmptyWorkspace)
156
+
, ("M4-S-c", kill1)
157
+
, ("M4-<Esc>", toggleWS)
158
+
, ("M4-S-<Enter>", spawn myTerm)
159
+
, ("M4-x", floatNext True >> spawn myTerm)
160
+
, ("M4-c", spawn "/run/current-system/sw/bin/emacsclient -c")
161
+
-- , ("M4-c", unGrab)
162
+
, ("M4-f", floatNext True)
163
+
, ("M4-b", spawn "/run/current-system/sw/bin/klem")
157
164
158
-
, ("M4-c", defaultCommands >>= runCommand)
159
-
, ("M4-v", withWorkspace autoXPConfig (windows . W.greedyView))
160
-
, ("M4-S-v", withWorkspace autoXPConfig (windows . W.shift))
161
-
, ("M4-C-v", withWorkspace autoXPConfig (windows . copy))
165
+
, ("M4-c", defaultCommands >>= runCommand)
166
+
, ("M4-v", withWorkspace autoXPConfig (windows . W.greedyView))
167
+
, ("M4-S-v", withWorkspace autoXPConfig (windows . W.shift))
168
+
, ("M4-C-v", withWorkspace autoXPConfig (windows . copy))
162
169
163
-
, ("M4-m", withFocused minimizeWindow)
164
-
, ("M4-S-m", withLastMinimized maximizeWindow)
170
+
, ("M4-m", withFocused minimizeWindow)
171
+
, ("M4-S-m", withLastMinimized maximizeWindow)
165
172
166
-
, ("M4-S-q", return ())
173
+
, ("M4-S-q", return ())
167
174
168
-
, ("M4-d", floatNext True >> spawn "${pkgs.writers.writeDash "clipmenu" ''
169
-
PATH=${lib.makeBinPath [
170
-
pkgs.coreutils
171
-
pkgs.gawk
172
-
pkgs.dmenu
173
-
]}
174
-
${pkgs.clipmenu}/bin/clipmenu
175
-
''}")
175
+
, ("M4-d", floatNext True >> spawn "${pkgs.writers.writeDash "clipmenu" ''
176
+
PATH=${
177
+
lib.makeBinPath [
178
+
pkgs.coreutils
179
+
pkgs.gawk
180
+
pkgs.dmenu
181
+
]
182
+
}
183
+
${pkgs.clipmenu}/bin/clipmenu
184
+
''}")
176
185
177
-
, ("M4-<Insert>", spawn "${pkgs.writers.writeDash "paste" ''
178
-
${pkgs.coreutils}/bin/sleep 0.4
179
-
${pkgs.xclip}/bin/xclip -o | ${pkgs.xdotool}/bin/xdotool type -f -
180
-
''}")
186
+
, ("M4-<Insert>", spawn "${pkgs.writers.writeDash "paste" ''
187
+
${pkgs.coreutils}/bin/sleep 0.4
188
+
${pkgs.xclip}/bin/xclip -o | ${pkgs.xdotool}/bin/xdotool type -f -
189
+
''}")
181
190
182
-
, ("M4-<F1>", spawn "/run/current-system/sw/bin/gamepad_mouse_toggle")
183
-
, ("M4-<F2>", windows copyToAll)
184
-
, ("M4-<F5>", spawn "${pkgs.acpilight}/bin/xbacklight -set 1")
185
-
, ("M4-<F6>", spawn "${pkgs.acpilight}/bin/xbacklight -set 10")
186
-
, ("M4-<F7>", spawn "${pkgs.acpilight}/bin/xbacklight -set 33")
187
-
, ("M4-<F8>", spawn "${pkgs.acpilight}/bin/xbacklight -set 100")
191
+
, ("M4-<F1>", spawn "/run/current-system/sw/bin/gamepad_mouse_toggle")
192
+
, ("M4-<F2>", windows copyToAll)
193
+
, ("M4-<F5>", spawn "${pkgs.acpilight}/bin/xbacklight -set 1")
194
+
, ("M4-<F6>", spawn "${pkgs.acpilight}/bin/xbacklight -set 10")
195
+
, ("M4-<F7>", spawn "${pkgs.acpilight}/bin/xbacklight -set 33")
196
+
, ("M4-<F8>", spawn "${pkgs.acpilight}/bin/xbacklight -set 100")
188
197
189
-
, ("M4-<F9>", spawn "${pkgs.redshift}/bin/redshift -O 4000 -g 0.9:0.8:0.8")
190
-
, ("M4-<F10>", spawn "${pkgs.redshift}/bin/redshift -x")
198
+
, ("M4-<F9>", spawn "${pkgs.redshift}/bin/redshift -O 4000 -g 0.9:0.8:0.8")
199
+
, ("M4-<F10>", spawn "${pkgs.redshift}/bin/redshift -x")
191
200
192
-
, ("M4-<F11>", spawn "${config.lass.screenlock.command}")
201
+
, ("M4-<F11>", spawn "${config.lass.screenlock.command}")
193
202
194
-
, ("M4-u", spawn "${pkgs.xcalib}/bin/xcalib -invert -alter")
195
-
, ("M4-y", spawn "/run/current-system/sw/bin/switch-theme toggle")
203
+
, ("M4-u", spawn "${pkgs.xcalib}/bin/xcalib -invert -alter")
204
+
, ("M4-y", spawn "/run/current-system/sw/bin/switch-theme toggle")
196
205
197
-
${lib.optionalString (builtins.hasAttr "warpd" pkgs) '', ("M4-s", spawn "${pkgs.warpd}/bin/warpd --hint")''}
198
-
, ("M4-i", spawn "/run/current-system/sw/bin/screenshot")
206
+
${lib.optionalString (builtins.hasAttr "warpd" pkgs) '', ("M4-s", spawn "${pkgs.warpd}/bin/warpd --hint")''}
207
+
, ("M4-i", spawn "/run/current-system/sw/bin/screenshot")
199
208
200
-
--, ("M4-w", screenWorkspace 0 >>= (windows . W.greedyView))
201
-
--, ("M4-e", screenWorkspace 1 >>= (windows . W.greedyView))
202
-
--, ("M4-r", screenWorkspace 2 >>= (windows . W.greedyView))
203
-
]
209
+
--, ("M4-w", screenWorkspace 0 >>= (windows . W.greedyView))
210
+
--, ("M4-e", screenWorkspace 1 >>= (windows . W.greedyView))
211
+
--, ("M4-r", screenWorkspace 2 >>= (windows . W.greedyView))
212
+
]
204
213
205
-
forkFile :: FilePath -> [String] -> Maybe [(String, String)] -> X ()
206
-
forkFile path args env =
207
-
xfork (executeFile path True args env) >> return ()
214
+
forkFile :: FilePath -> [String] -> Maybe [(String, String)] -> X ()
215
+
forkFile path args env =
216
+
xfork (executeFile path True args env) >> return ()
208
217
209
-
myXPConfig :: XPConfig
210
-
myXPConfig = def
211
-
{ font = myFont
212
-
, height = 40
213
-
}
218
+
myXPConfig :: XPConfig
219
+
myXPConfig = def
220
+
{ font = myFont
221
+
, height = 40
222
+
}
214
223
215
-
autoXPConfig :: XPConfig
216
-
autoXPConfig = myXPConfig
217
-
{ autoComplete = Just 5000
218
-
}
224
+
autoXPConfig :: XPConfig
225
+
autoXPConfig = myXPConfig
226
+
{ autoComplete = Just 5000
227
+
}
219
228
220
-
infixAutoXPConfig :: XPConfig
221
-
infixAutoXPConfig = autoXPConfig
222
-
{ searchPredicate = isInfixOf
223
-
}
229
+
infixAutoXPConfig :: XPConfig
230
+
infixAutoXPConfig = autoXPConfig
231
+
{ searchPredicate = isInfixOf
232
+
}
224
233
225
-
gridConfig :: GSConfig WorkspaceId
226
-
gridConfig = def
227
-
{ gs_cellwidth = 100
228
-
, gs_cellheight = 30
229
-
, gs_cellpadding = 2
230
-
, gs_navigate = navNSearch
231
-
, gs_font = myFont
232
-
}
234
+
gridConfig :: GSConfig WorkspaceId
235
+
gridConfig = def
236
+
{ gs_cellwidth = 100
237
+
, gs_cellheight = 30
238
+
, gs_cellpadding = 2
239
+
, gs_navigate = navNSearch
240
+
, gs_font = myFont
241
+
}
233
242
234
-
'';
243
+
'';
235
244
};
236
245
}
+24
-7
2configs/services/coms/jitsi.nix
+24
-7
2configs/services/coms/jitsi.nix
···
1
-
{ pkgs, ... }: let
1
+
{ pkgs, ... }:
2
+
let
2
3
3
4
prosody-contrib-plugins = pkgs.fetchFromGitHub {
4
5
owner = "jitsi-contrib";
···
7
8
sha256 = "sha256-1Lmj+ZWqZRRvHVgNDXXEqH2DwhE7TwP0gktjihJCg1g=";
8
9
};
9
10
10
-
in {
11
+
in
12
+
{
11
13
14
+
nixpkgs.config.permittedInsecurePackages = [
15
+
"jitsi-meet-1.0.8043"
16
+
];
12
17
services.jitsi-meet = {
13
18
enable = true;
14
19
hostName = "jitsi.lassul.us";
···
16
21
enableWelcomePage = true;
17
22
requireDisplayName = true;
18
23
analytics.disabled = true;
19
-
startAudioOnly = true;
24
+
startAudioOnly = false; # check if webcams work nicer with that
20
25
channelLastN = 4;
21
26
stunServers = [
22
27
# - https://www.kuketz-blog.de/jitsi-meet-server-einstellungen-fuer-einen-datenschutzfreundlichen-betrieb/
···
53
58
};
54
59
55
60
services.prosody.extraPluginPaths = [ "${prosody-contrib-plugins}/event_sync" ];
56
-
services.prosody.extraModules = [ "admin_shell" "event_sync" ];
61
+
services.prosody.extraModules = [
62
+
"admin_shell"
63
+
"event_sync"
64
+
];
57
65
services.prosody.extraConfig = ''
58
66
Component "event_sync.jitsi.lassul.us" "event_sync_component"
59
67
muc_component = "conference.jitsi.lassul.us"
···
63
71
'';
64
72
65
73
krebs.iptables.tables.filter.INPUT.rules = [
66
-
{ predicate = "-p tcp --dport 4443"; target = "ACCEPT"; }
67
-
{ predicate = "-p udp --dport 10000"; target = "ACCEPT"; }
68
-
{ predicate = "-p tcp --dport 10000"; target = "ACCEPT"; }
74
+
{
75
+
predicate = "-p tcp --dport 4443";
76
+
target = "ACCEPT";
77
+
}
78
+
{
79
+
predicate = "-p udp --dport 10000";
80
+
target = "ACCEPT";
81
+
}
82
+
{
83
+
predicate = "-p tcp --dport 10000";
84
+
target = "ACCEPT";
85
+
}
69
86
];
70
87
}
+9
-3
2configs/services/coms/murmur.nix
+9
-3
2configs/services/coms/murmur.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ ... }:
2
2
{
3
3
services.murmur = {
4
4
enable = true;
···
14
14
'';
15
15
};
16
16
krebs.iptables.tables.filter.INPUT.rules = [
17
-
{ predicate = "-p tcp --dport 64738"; target = "ACCEPT";}
18
-
{ predicate = "-p udp --dport 64738"; target = "ACCEPT";}
17
+
{
18
+
predicate = "-p tcp --dport 64738";
19
+
target = "ACCEPT";
20
+
}
21
+
{
22
+
predicate = "-p udp --dport 64738";
23
+
target = "ACCEPT";
24
+
}
19
25
];
20
26
21
27
# services.botamusique = {
+15
-5
2configs/services/coms/proxy.nix
+15
-5
2configs/services/coms/proxy.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ config, lib, ... }:
2
2
let
3
3
tcpports = [
4
4
4443 # jitsi
···
23
23
'') tcpports}
24
24
'';
25
25
26
-
krebs.iptables.tables.nat.PREROUTING.rules = lib.flatten (map (port: [
27
-
{ predicate = "-p udp --dport ${toString port}"; target = "DNAT --to-destination ${config.krebs.hosts.orange.nets.retiolum.ip4.addr}:${toString port}"; v6 = false; }
28
-
{ predicate = "-p udp --dport ${toString port}"; target = "DNAT --to-destination [${config.krebs.hosts.orange.nets.retiolum.ip6.addr}]:${toString port}"; v4 = false; }
29
-
]) udpports);
26
+
krebs.iptables.tables.nat.PREROUTING.rules = lib.flatten (
27
+
map (port: [
28
+
{
29
+
predicate = "-p udp --dport ${toString port}";
30
+
target = "DNAT --to-destination ${config.krebs.hosts.orange.nets.retiolum.ip4.addr}:${toString port}";
31
+
v6 = false;
32
+
}
33
+
{
34
+
predicate = "-p udp --dport ${toString port}";
35
+
target = "DNAT --to-destination [${config.krebs.hosts.orange.nets.retiolum.ip6.addr}]:${toString port}";
36
+
v4 = false;
37
+
}
38
+
]) udpports
39
+
);
30
40
31
41
services.nginx.virtualHosts."jitsi.lassul.us" = {
32
42
enableACME = true;
+28
-6
2configs/services/flix/container-host.nix
+28
-6
2configs/services/flix/container-host.nix
···
24
24
# { predicate = "-p tcp --dport 2"; target = "DNAT --to-destination ${config.krebs.hosts.radio.nets.retiolum.ip4.addr}:8000"; v6 = false; }
25
25
# { predicate = "-p tcp --dport 2"; target = "DNAT --to-destination ${config.krebs.hosts.radio.nets.retiolum.ip6.addr}:8000"; v4 = false; }
26
26
# ];
27
-
networking.firewall.allowedTCPPorts = [ 8096 8920 ];
28
-
networking.firewall.allowedUDPPorts = [ 1900 7359 ];
27
+
networking.firewall.allowedTCPPorts = [
28
+
8096
29
+
8920
30
+
];
31
+
networking.firewall.allowedUDPPorts = [
32
+
1900
33
+
7359
34
+
];
29
35
containers.yellow.forwardPorts = [
30
-
{ hostPort = 8096; containerPort = 8096; protocol = "tcp"; }
31
-
{ hostPort = 8920; containerPort = 8920; protocol = "tcp"; }
32
-
{ hostPort = 1900; containerPort = 1900; protocol = "udp"; }
33
-
{ hostPort = 7359; containerPort = 7359; protocol = "udp"; }
36
+
{
37
+
hostPort = 8096;
38
+
containerPort = 8096;
39
+
protocol = "tcp";
40
+
}
41
+
{
42
+
hostPort = 8920;
43
+
containerPort = 8920;
44
+
protocol = "tcp";
45
+
}
46
+
{
47
+
hostPort = 1900;
48
+
containerPort = 1900;
49
+
protocol = "udp";
50
+
}
51
+
{
52
+
hostPort = 7359;
53
+
containerPort = 7359;
54
+
protocol = "udp";
55
+
}
34
56
];
35
57
36
58
services.nginx.virtualHosts."flix.lassul.us" = {
+109
-41
2configs/services/flix/default.nix
+109
-41
2configs/services/flix/default.nix
···
233
233
};
234
234
235
235
systemd.services.bruellwuerfel =
236
-
let
237
-
bruellwuerfelSrc = pkgs.fetchFromGitHub {
238
-
owner = "krebs";
239
-
repo = "bruellwuerfel";
240
-
rev = "dc73adf69249fb63a4b024f1f3fbc9e541b27015";
241
-
sha256 = "078jp1gbavdp8lnwa09xa5m6bbbd05fi4x5ldkkgin5z04hwlhmd";
236
+
let
237
+
bruellwuerfelSrc = pkgs.fetchFromGitHub {
238
+
owner = "krebs";
239
+
repo = "bruellwuerfel";
240
+
rev = "dc73adf69249fb63a4b024f1f3fbc9e541b27015";
241
+
sha256 = "078jp1gbavdp8lnwa09xa5m6bbbd05fi4x5ldkkgin5z04hwlhmd";
242
+
};
243
+
in
244
+
{
245
+
wantedBy = [ "multi-user.target" ];
246
+
after = [ "network-online.target" ];
247
+
environment = {
248
+
IRC_CHANNEL = "#flix";
249
+
IRC_NICK = "bruelli";
250
+
IRC_SERVER = "irc.r";
251
+
IRC_HISTORY_FILE = "/tmp/bruelli.history";
252
+
};
253
+
serviceConfig = {
254
+
ExecStart = "${pkgs.deno}/bin/deno run -A ${bruellwuerfelSrc}/src/index.ts";
255
+
};
242
256
};
243
-
in {
244
-
wantedBy = [ "multi-user.target" ];
245
-
after = [ "network-online.target" ];
246
-
environment = {
247
-
IRC_CHANNEL = "#flix";
248
-
IRC_NICK = "bruelli";
249
-
IRC_SERVER = "irc.r";
250
-
IRC_HISTORY_FILE = "/tmp/bruelli.history";
251
-
};
252
-
serviceConfig = {
253
-
ExecStart = "${pkgs.deno}/bin/deno run -A ${bruellwuerfelSrc}/src/index.ts";
254
-
};
255
-
};
256
257
257
258
krebs.iptables = {
258
259
enable = true;
259
260
tables.filter.INPUT.rules = [
260
-
{ predicate = "-p tcp --dport 80"; target = "ACCEPT"; } # nginx web dir
261
-
{ predicate = "-p tcp --dport 443"; target = "ACCEPT"; } # nginx web dir
262
-
{ predicate = "-p tcp --dport 9091"; target = "ACCEPT"; } # transmission-web
263
-
{ predicate = "-p tcp --dport 51413"; target = "ACCEPT"; } # transmission-traffic
264
-
{ predicate = "-p udp --dport 51413"; target = "ACCEPT"; } # transmission-traffic
265
-
{ predicate = "-p tcp --dport 8096"; target = "ACCEPT"; } # jellyfin
266
-
{ predicate = "-p tcp --dport 8920"; target = "ACCEPT"; } # jellyfin
267
-
{ predicate = "-p udp --dport 1900"; target = "ACCEPT"; } # jellyfin
268
-
{ predicate = "-p udp --dport 7359"; target = "ACCEPT"; } # jellyfin
269
-
{ predicate = "-p tcp --dport 5055"; target = "ACCEPT"; } # jellyseerr
270
-
{ predicate = "-p tcp --dport 9696"; target = "ACCEPT"; } # prowlarr
271
-
{ predicate = "-p tcp --dport 8989"; target = "ACCEPT"; } # sonarr
272
-
{ predicate = "-p tcp --dport 7878"; target = "ACCEPT"; } # radarr
273
-
{ predicate = "-p tcp --dport 6767"; target = "ACCEPT"; } # bazarr
261
+
{
262
+
predicate = "-p tcp --dport 80";
263
+
target = "ACCEPT";
264
+
} # nginx web dir
265
+
{
266
+
predicate = "-p tcp --dport 443";
267
+
target = "ACCEPT";
268
+
} # nginx web dir
269
+
{
270
+
predicate = "-p tcp --dport 9091";
271
+
target = "ACCEPT";
272
+
} # transmission-web
273
+
{
274
+
predicate = "-p tcp --dport 51413";
275
+
target = "ACCEPT";
276
+
} # transmission-traffic
277
+
{
278
+
predicate = "-p udp --dport 51413";
279
+
target = "ACCEPT";
280
+
} # transmission-traffic
281
+
{
282
+
predicate = "-p tcp --dport 8096";
283
+
target = "ACCEPT";
284
+
} # jellyfin
285
+
{
286
+
predicate = "-p tcp --dport 8920";
287
+
target = "ACCEPT";
288
+
} # jellyfin
289
+
{
290
+
predicate = "-p udp --dport 1900";
291
+
target = "ACCEPT";
292
+
} # jellyfin
293
+
{
294
+
predicate = "-p udp --dport 7359";
295
+
target = "ACCEPT";
296
+
} # jellyfin
297
+
{
298
+
predicate = "-p tcp --dport 5055";
299
+
target = "ACCEPT";
300
+
} # jellyseerr
301
+
{
302
+
predicate = "-p tcp --dport 9696";
303
+
target = "ACCEPT";
304
+
} # prowlarr
305
+
{
306
+
predicate = "-p tcp --dport 8989";
307
+
target = "ACCEPT";
308
+
} # sonarr
309
+
{
310
+
predicate = "-p tcp --dport 7878";
311
+
target = "ACCEPT";
312
+
} # radarr
313
+
{
314
+
predicate = "-p tcp --dport 6767";
315
+
target = "ACCEPT";
316
+
} # bazarr
274
317
275
318
# smbd
276
-
{ predicate = "-p tcp --dport 445"; target = "ACCEPT"; }
277
-
{ predicate = "-p tcp --dport 111"; target = "ACCEPT"; }
278
-
{ predicate = "-p udp --dport 111"; target = "ACCEPT"; }
279
-
{ predicate = "-p tcp --dport 2049"; target = "ACCEPT"; }
280
-
{ predicate = "-p udp --dport 2049"; target = "ACCEPT"; }
281
-
{ predicate = "-p tcp --dport 4000:4002"; target = "ACCEPT"; }
282
-
{ predicate = "-p udp --dport 4000:4002"; target = "ACCEPT"; }
319
+
{
320
+
predicate = "-p tcp --dport 445";
321
+
target = "ACCEPT";
322
+
}
323
+
{
324
+
predicate = "-p tcp --dport 111";
325
+
target = "ACCEPT";
326
+
}
327
+
{
328
+
predicate = "-p udp --dport 111";
329
+
target = "ACCEPT";
330
+
}
331
+
{
332
+
predicate = "-p tcp --dport 2049";
333
+
target = "ACCEPT";
334
+
}
335
+
{
336
+
predicate = "-p udp --dport 2049";
337
+
target = "ACCEPT";
338
+
}
339
+
{
340
+
predicate = "-p tcp --dport 4000:4002";
341
+
target = "ACCEPT";
342
+
}
343
+
{
344
+
predicate = "-p udp --dport 4000:4002";
345
+
target = "ACCEPT";
346
+
}
283
347
];
284
348
285
349
tables.nat.PREROUTING.rules = [
286
350
# transmission rpc port
287
-
{ predicate = "-i retiolum -p tcp --dport 9091"; target = "DNAT --to-destination fdb4:3310:947::2"; v4 = false; }
351
+
{
352
+
predicate = "-i retiolum -p tcp --dport 9091";
353
+
target = "DNAT --to-destination fdb4:3310:947::2";
354
+
v4 = false;
355
+
}
288
356
];
289
357
tables.filter.FORWARD.policy = "ACCEPT"; # we need this so we can forward into the the transmission network namespace
290
358
};
+1
-1
2configs/services/flix/proxy.nix
+1
-1
2configs/services/flix/proxy.nix
+2
-2
2configs/services/git/default.nix
+2
-2
2configs/services/git/default.nix
+1
-1
2configs/services/git/proxy.nix
+1
-1
2configs/services/git/proxy.nix
+5
-2
2configs/services/matrix/default.nix
+5
-2
2configs/services/matrix/default.nix
···
9
9
args.database = "matrix-synapse";
10
10
name = "psycopg2";
11
11
};
12
-
turn_uris = [
12
+
turn_uris = [
13
13
"turn:turn.matrix.org?transport=udp"
14
14
"turn:turn.matrix.org?transport=tcp"
15
15
];
···
51
51
52
52
clanCore.facts.services."matrix-synapse" = {
53
53
secret."synapse-registration_shared_secret" = { };
54
-
generator.path = with pkgs; [ coreutils pwgen ];
54
+
generator.path = with pkgs; [
55
+
coreutils
56
+
pwgen
57
+
];
55
58
generator.script = ''
56
59
echo "registration_shared_secret: $(pwgen -s 32 1)" > "$secrets"/synapse-registration_shared_secret
57
60
'';
+15
-7
2configs/services/matrix/proxy.nix
+15
-7
2configs/services/matrix/proxy.nix
···
4
4
"lassul.us" = {
5
5
locations."= /.well-known/matrix/server".extraConfig = ''
6
6
add_header Content-Type application/json;
7
-
return 200 '${builtins.toJSON {
8
-
"m.server" = "matrix.lassul.us:443";
9
-
}}';
7
+
return 200 '${
8
+
builtins.toJSON {
9
+
"m.server" = "matrix.lassul.us:443";
10
+
}
11
+
}';
10
12
'';
11
13
locations."= /.well-known/matrix/client".extraConfig = ''
12
14
add_header Content-Type application/json;
13
15
add_header Access-Control-Allow-Origin *;
14
-
return 200 '${builtins.toJSON {
15
-
"m.homeserver" = { "base_url" = "https://matrix.lassul.us"; };
16
-
"m.identity_server" = { "base_url" = "https://vector.im"; };
17
-
}}';
16
+
return 200 '${
17
+
builtins.toJSON {
18
+
"m.homeserver" = {
19
+
"base_url" = "https://matrix.lassul.us";
20
+
};
21
+
"m.identity_server" = {
22
+
"base_url" = "https://vector.im";
23
+
};
24
+
}
25
+
}';
18
26
'';
19
27
};
20
28
"matrix.lassul.us" = {
+4
-1
2configs/services/nixcache/default.nix
+4
-1
2configs/services/nixcache/default.nix
···
13
13
clanCore.facts.services.nix-serve = {
14
14
secret."nix-serve.key" = { };
15
15
public."nix-serve.pub" = { };
16
-
generator.path = with pkgs; [ coreutils nix ];
16
+
generator.path = with pkgs; [
17
+
coreutils
18
+
nix
19
+
];
17
20
generator.script = ''
18
21
nix-store --generate-binary-cache-key cache.${config.networking.hostName} "$secrets"/nix-serve.key "$facts"/nix-serve.pub
19
22
'';
+15
2configs/services/pad/default.nix
+15
2configs/services/pad/default.nix
···
1
+
{ config, ... }:
1
2
{
2
3
imports = [ ./module.nix ];
3
4
clan.hedgedoc.domain = "pad2.lassul.us";
5
+
clan.core.facts.services.hedgedoc-github-auth = {
6
+
secret."hedgedoc.env" = { };
7
+
generator.script = ''
8
+
echo "$prompt_value" > "$secrets"/hedgedoc.env
9
+
'';
10
+
generator.prompt = ''
11
+
goto https://github.com/settings/ap:qplications/2352617 and paste the data in the following format:
12
+
GITHUB_CLIENT_ID=...
13
+
GITHUB_CLIENT_SECRET=...
14
+
'';
15
+
};
16
+
# https://github.com/settings/applications/2352617
17
+
services.hedgedoc.environmentFile =
18
+
config.clan.core.facts.services.hedgedoc-github-auth.secret."hedgedoc.env".path;
4
19
}
+40
-47
2configs/services/pad/module.nix
+40
-47
2configs/services/pad/module.nix
···
1
-
{ self, lib, config, ... }:
1
+
{
2
+
self,
3
+
lib,
4
+
config,
5
+
...
6
+
}:
2
7
{
3
8
imports = [
4
9
self.inputs.clan-core.clanModules.postgresql
5
10
];
6
-
clan.postgresql.users.hedgedoc = {};
7
-
clan.postgresql.databases.hedgedoc = {};
8
11
options.clan.hedgedoc = {
9
12
domain = lib.mkOption {
10
13
type = lib.types.str;
11
14
description = "The domain of the hedgedoc instance.";
12
15
};
13
16
};
14
-
systemd.services.hedgedoc.environment = {
15
-
CMD_COOKIE_POLICY = "none";
16
-
CMD_CSP_ALLOW_FRAMING = "true";
17
-
};
18
-
19
-
services.hedgedoc = {
20
-
enable = true;
21
-
settings = {
22
-
allowOrigin = [ config.clan.hedgedoc.domain ];
23
-
db = {
24
-
dialect = "postgres";
25
-
host = "/run/postgresql";
26
-
database = "hedgedoc";
27
-
username = "hedgedoc";
28
-
};
29
-
# db = {
30
-
# dialect = "sqlite";
31
-
# storage = "/var/lib/hedgedoc/db.hedgedoc.sqlite";
32
-
# };
33
-
useCDN = false;
34
-
port = 3091;
35
-
domain = config.hedgedoc.domain;
36
-
allowFreeURL = true;
37
-
defaultPermission = "freely";
38
-
39
-
useSSL = true;
40
-
protocolUseSSL = true;
41
-
sslCAPath = [ "/etc/ssl/certs/ca-certificates.crt" ];
42
-
sslCertPath = "/var/lib/acme/${config.clan.hedgedoc.domain}/cert.pem";
43
-
sslKeyPath = "/var/lib/acme/${config.clan.hedgedoc.domain}/key.pem";
44
-
dhParamPath = config.security.dhparams.params.hedgedoc.path;
17
+
config = {
18
+
clan.postgresql.users.hedgedoc = { };
19
+
clan.postgresql.databases.hedgedoc.create.options.OWNER = "matrix-synapse";
20
+
systemd.services.hedgedoc.environment = {
21
+
CMD_COOKIE_POLICY = "none";
22
+
CMD_CSP_ALLOW_FRAMING = "true";
45
23
};
46
24
47
-
# https://github.com/settings/applications/2352617
48
-
environmentFile = config.clanCore.facts.secretUploadDirectory + "/hedgedoc.env";
49
-
};
25
+
services.hedgedoc = {
26
+
enable = true;
27
+
settings = {
28
+
allowOrigin = [ config.clan.hedgedoc.domain ];
29
+
db = {
30
+
dialect = "postgres";
31
+
host = "/run/postgresql";
32
+
database = "hedgedoc";
33
+
username = "hedgedoc";
34
+
};
35
+
useCDN = false;
36
+
port = 3091;
37
+
domain = config.clan.hedgedoc.domain;
38
+
allowFreeURL = true;
39
+
defaultPermission = "freely";
40
+
useSSL = false;
41
+
debug = true;
42
+
};
43
+
};
50
44
51
-
clanCore.facts.services.hedgedoc-github-auth = {
52
-
secret."hedgedoc.env" = { };
53
-
generator.script = ''
54
-
cat > "$secrets"/hedgedoc.env
55
-
'';
56
-
generator.prompt = ''
57
-
goto https://github.com/settings/ap:qplications/2352617 and paste the data in the following format:
58
-
GITHUB_CLIENT_ID=...
59
-
GITHUB_CLIENT_SECRET=...
60
-
'';
45
+
services.nginx.virtualHosts.${config.clan.hedgedoc.domain} = {
46
+
enableACME = true;
47
+
forceSSL = true;
48
+
locations."/" = {
49
+
proxyPass = "http://localhost:${toString config.services.hedgedoc.settings.port}";
50
+
proxyWebsockets = true;
51
+
};
52
+
};
53
+
61
54
};
62
55
}
+6
-1
2configs/services/radio/container-host.nix
+6
-1
2configs/services/radio/container-host.nix
+78
-73
2configs/services/radio/controls.html
+78
-73
2configs/services/radio/controls.html
···
1
1
<!doctype html>
2
2
3
3
<html lang="en">
4
-
<head>
5
-
<meta charset="utf-8">
6
-
<meta name="viewport" content="width=device-width, initial-scale=1">
4
+
<head>
5
+
<meta charset="utf-8" />
6
+
<meta name="viewport" content="width=device-width, initial-scale=1" />
7
7
8
-
<title>The_Playlist Voting!</title>
9
-
<style>
10
-
#good {
11
-
display: block;
12
-
width: 100%;
13
-
border: none;
14
-
background-color: #04AA6D;
15
-
padding: 14px;
16
-
margin: 14px 0 0 0;
17
-
height: 100px;
18
-
font-size: 16px;
19
-
cursor: pointer;
20
-
text-align: center;
21
-
}
22
-
#bad {
23
-
display: block;
24
-
width: 100%;
25
-
border: none;
26
-
background-color: red;
27
-
padding: 14px;
28
-
height: 100px;
8
+
<title>The_Playlist Voting!</title>
9
+
<style>
10
+
#good {
11
+
display: block;
12
+
width: 100%;
13
+
border: none;
14
+
background-color: #04aa6d;
15
+
padding: 14px;
16
+
margin: 14px 0 0 0;
17
+
height: 100px;
18
+
font-size: 16px;
19
+
cursor: pointer;
20
+
text-align: center;
21
+
}
22
+
#bad {
23
+
display: block;
24
+
width: 100%;
25
+
border: none;
26
+
background-color: red;
27
+
padding: 14px;
28
+
height: 100px;
29
29
30
-
margin: 14px 0 0 0;
31
-
font-size: 16px;
32
-
cursor: pointer;
33
-
text-align: center;
34
-
}
35
-
</style>
30
+
margin: 14px 0 0 0;
31
+
font-size: 16px;
32
+
cursor: pointer;
33
+
text-align: center;
34
+
}
35
+
</style>
36
+
</head>
36
37
37
-
</head>
38
+
<body>
39
+
<div id="votenote"></div>
40
+
<button id="good" type="button">GUT</button>
38
41
39
-
<body>
40
-
<div id=votenote></div>
41
-
<button id=good type="button"> GUT </button>
42
+
<button id="bad" type="button">SCHLECHT</button>
43
+
<center>
44
+
Currently Running: <br />
45
+
<div>
46
+
<b id="current"></b>
47
+
</div>
48
+
<div id="vote"></div>
49
+
<audio controls autoplay="autoplay">
50
+
<source src="https://radio.lassul.us/radio.ogg" type="audio/ogg" />
51
+
Your browser does not support the audio element.
52
+
</audio>
53
+
</center>
42
54
43
-
<button id=bad type="button"> SCHLECHT </button>
44
-
<center>
45
-
Currently Running: <br/><div>
46
-
<b id=current></b>
47
-
</div>
48
-
<div id=vote>
49
-
</div>
50
-
<audio controls autoplay="autoplay">
51
-
<source src="https://radio.lassul.us/radio.ogg" type="audio/ogg">
52
-
Your browser does not support the audio element.
53
-
</audio>
54
-
</center>
55
+
<script>
56
+
document.getElementById("good").onclick = async () => {
57
+
let result = await fetch("https://radio.lassul.us/good", {
58
+
method: "POST",
59
+
});
60
+
document.getElementById("vote").textContent =
61
+
"Dieses Lied findest du gut";
62
+
};
63
+
document.getElementById("bad").onclick = async () => {
64
+
let result = await fetch("https://radio.lassul.us/skip", {
65
+
method: "POST",
66
+
});
67
+
document.getElementById("vote").textContent =
68
+
"Dieses Lied findest du schlecht";
69
+
document.getElementById("bad").disabled = true;
70
+
window.setTimeout(function () {
71
+
document.getElementById("bad").disabled = false;
72
+
}, 100000);
73
+
};
55
74
56
-
<script>
57
-
document.getElementById("good").onclick=async ()=>{
58
-
let result = await fetch("https://radio.lassul.us/good", {"method": "POST"})
59
-
document.getElementById("vote").textContent = "Dieses Lied findest du gut"
60
-
};
61
-
document.getElementById("bad").onclick=async ()=>{
62
-
let result = await fetch("https://radio.lassul.us/skip", {"method": "POST"})
63
-
document.getElementById("vote").textContent = "Dieses Lied findest du schlecht"
64
-
document.getElementById("bad").disabled = true
65
-
window.setTimeout(function(){
66
-
document.getElementById("bad").disabled = false
67
-
}, 100000)
68
-
69
-
};
70
-
71
-
async function current() {
72
-
let result = await fetch("https://radio.lassul.us/current", {"method": "GET"})
73
-
let data = await result.json()
74
-
document.getElementById("current").textContent = data.name
75
-
}
76
-
window.onload = function() {
77
-
window.setInterval('current()', 10000)
78
-
current()
79
-
}
80
-
81
-
</script>
82
-
</body>
75
+
async function current() {
76
+
let result = await fetch("https://radio.lassul.us/current", {
77
+
method: "GET",
78
+
});
79
+
let data = await result.json();
80
+
document.getElementById("current").textContent = data.name;
81
+
}
82
+
window.onload = function () {
83
+
window.setInterval("current()", 10000);
84
+
current();
85
+
};
86
+
</script>
87
+
</body>
83
88
</html>
+36
-11
2configs/services/radio/default.nix
+36
-11
2configs/services/radio/default.nix
···
1
-
{ self, config, pkgs, lib, ... }:
1
+
{
2
+
self,
3
+
config,
4
+
pkgs,
5
+
lib,
6
+
...
7
+
}:
2
8
3
9
let
4
10
name = "radio";
···
73
79
)"
74
80
'';
75
81
76
-
in {
82
+
in
83
+
{
77
84
imports = [
78
85
./news.nix
79
86
./weather.nix
···
102
109
};
103
110
104
111
users.groups = {
105
-
"radio" = {};
112
+
"radio" = { };
106
113
};
107
114
108
115
systemd.services.radio_watcher = {
···
148
155
149
156
nixpkgs.config.packageOverrides = opkgs: {
150
157
liquidsoap = opkgs.liquidsoap.override {
151
-
runtimePackages = with opkgs; [ bubblewrap curl ffmpeg yt-dlp ];
158
+
runtimePackages = with opkgs; [
159
+
bubblewrap
160
+
curl
161
+
ffmpeg
162
+
yt-dlp
163
+
];
152
164
};
153
165
icecast = opkgs.icecast.overrideAttrs (old: rec {
154
166
version = "2.5-beta3";
···
187
199
krebs.iptables = {
188
200
tables = {
189
201
filter.INPUT.rules = [
190
-
{ predicate = "-p tcp --dport 8000"; target = "ACCEPT"; }
191
-
{ predicate = "-i retiolum -p tcp --dport 8001"; target = "ACCEPT"; }
192
-
{ predicate = "-i retiolum -p tcp --dport 8002"; target = "ACCEPT"; }
202
+
{
203
+
predicate = "-p tcp --dport 8000";
204
+
target = "ACCEPT";
205
+
}
206
+
{
207
+
predicate = "-i retiolum -p tcp --dport 8001";
208
+
target = "ACCEPT";
209
+
}
210
+
{
211
+
predicate = "-i retiolum -p tcp --dport 8002";
212
+
target = "ACCEPT";
213
+
}
193
214
];
194
215
};
195
216
};
···
224
245
activate = "match";
225
246
pattern = "^(?:.*\\s)?\\s*the_playlist:\\s*([0-9A-Za-z._][0-9A-Za-z._-]*)(?:\\s+(.*\\S))?\\s*$";
226
247
command = 1;
227
-
arguments = [2];
248
+
arguments = [ 2 ];
228
249
commands = {
229
250
skip.filename = "${skip_track}/bin/skip_track";
230
251
next.filename = "${skip_track}/bin/skip_track";
···
348
369
};
349
370
services.syncthing.settings.folders."/home/lass/tmp/the_playlist" = {
350
371
path = lib.mkForce "/var/music/the_playlist";
351
-
devices = [ "mors" "prism" "radio" ];
372
+
devices = [
373
+
"mors"
374
+
"prism"
375
+
"radio"
376
+
];
352
377
};
353
378
krebs.acl."/var/music/the_playlist"."u:lass:X".parents = true;
354
-
krebs.acl."/var/music/the_playlist"."u:lass:rwX" = {};
355
-
krebs.acl."/var/music/the_playlist"."u:radio:rwX" = {};
379
+
krebs.acl."/var/music/the_playlist"."u:lass:rwX" = { };
380
+
krebs.acl."/var/music/the_playlist"."u:radio:rwX" = { };
356
381
}
+12
-10
2configs/services/radio/news.nix
+12
-10
2configs/services/radio/news.nix
···
25
25
) | .[]'
26
26
'';
27
27
28
-
newsshow = pkgs.writers.writeDashBin "newsshow" /* sh */ ''
29
-
cat << EOF
30
-
hello crabpeople!
31
-
$(${pkgs.ddate}/bin/ddate +'Today is %{%A, the %e of %B%}, %Y. %N%nCelebrate %H')
32
-
It is $(date --utc +%H) o clock UTC.
33
-
todays news:
34
-
$(get_current_news)
35
-
$(gc_news)
36
-
EOF
37
-
'';
28
+
newsshow =
29
+
pkgs.writers.writeDashBin "newsshow" # sh
30
+
''
31
+
cat << EOF
32
+
hello crabpeople!
33
+
$(${pkgs.ddate}/bin/ddate +'Today is %{%A, the %e of %B%}, %Y. %N%nCelebrate %H')
34
+
It is $(date --utc +%H) o clock UTC.
35
+
todays news:
36
+
$(get_current_news)
37
+
$(gc_news)
38
+
EOF
39
+
'';
38
40
in
39
41
{
40
42
systemd.services.newsshow = {
+3
-1
2configs/services/radio/shell.nix
+3
-1
2configs/services/radio/shell.nix
+13
-9
2configs/services/radio/tts.nix
+13
-9
2configs/services/radio/tts.nix
···
1
1
{ pkgs, ... }:
2
2
let
3
-
model = pkgs.runCommand "model" {} ''
3
+
model = pkgs.runCommand "model" { } ''
4
4
mkdir -p $out
5
-
ln -s ${pkgs.fetchurl {
6
-
url = "https://huggingface.co/rhasspy/piper-voices/resolve/v1.0.0/en/en_US/libritts/high/en_US-libritts-high.onnx?download=true";
7
-
hash = "sha256-kSelWeEWA/ELNm0aIKx0JoJggdvFId5MJCDFdyjXPw8=";
8
-
}} $out/model.onnx
9
-
ln -s ${pkgs.fetchurl {
10
-
url = "https://huggingface.co/rhasspy/piper-voices/resolve/v1.0.0/en/en_US/libritts/high/en_US-libritts-high.onnx.json?download=true.json";
11
-
hash = "sha256-Lv3G1/lUWIuBgBMsvZuAAZM/3QCTLJK8kv0NICip6z0=";
12
-
}} $out/model.onnx.json
5
+
ln -s ${
6
+
pkgs.fetchurl {
7
+
url = "https://huggingface.co/rhasspy/piper-voices/resolve/v1.0.0/en/en_US/libritts/high/en_US-libritts-high.onnx?download=true";
8
+
hash = "sha256-kSelWeEWA/ELNm0aIKx0JoJggdvFId5MJCDFdyjXPw8=";
9
+
}
10
+
} $out/model.onnx
11
+
ln -s ${
12
+
pkgs.fetchurl {
13
+
url = "https://huggingface.co/rhasspy/piper-voices/resolve/v1.0.0/en/en_US/libritts/high/en_US-libritts-high.onnx.json?download=true.json";
14
+
hash = "sha256-Lv3G1/lUWIuBgBMsvZuAAZM/3QCTLJK8kv0NICip6z0=";
15
+
}
16
+
} $out/model.onnx.json
13
17
'';
14
18
15
19
tts = pkgs.writers.writeBashBin "tts" ''
+10
-7
2configs/services/radio/weather.nix
+10
-7
2configs/services/radio/weather.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ lib, pkgs, ... }:
2
2
let
3
3
weather_for_ips = pkgs.writers.writePython3Bin "weather_for_ips" {
4
4
libraries = [ pkgs.python3Packages.geoip2 ];
···
7
7
8
8
weather_report = pkgs.writers.writeDashBin "weather_report" ''
9
9
set -efux
10
-
export PATH="${lib.makeBinPath [
11
-
pkgs.coreutils
12
-
pkgs.curl
13
-
pkgs.jq
14
-
]}"
10
+
export PATH="${
11
+
lib.makeBinPath [
12
+
pkgs.coreutils
13
+
pkgs.curl
14
+
pkgs.jq
15
+
]
16
+
}"
15
17
curl -fSsz /tmp/GeoLite2-City.mmdb -o /tmp/GeoLite2-City.mmdb http://c.r/GeoLite2-City.mmdb
16
18
MAXMIND_GEOIP_DB="/tmp/GeoLite2-City.mmdb"; export MAXMIND_GEOIP_DB
17
19
(
···
30
32
' |
31
33
${weather_for_ips}/bin/weather_for_ips
32
34
'';
33
-
in {
35
+
in
36
+
{
34
37
systemd.services.weather = {
35
38
path = [
36
39
weather_report
+10
-8
2configs/services/site/default.nix
+10
-8
2configs/services/site/default.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ config, pkgs, ... }:
2
2
{
3
3
security.acme = {
4
4
certs."lassul.us" = {
···
34
34
default_type "text/html";
35
35
alias ${pkgs.krebspage}/index.html;
36
36
'';
37
-
locations."= /init".extraConfig = let
38
-
initscript = pkgs.init.override {
39
-
pubkey = config.krebs.users.lass.pubkey;
40
-
};
41
-
in ''
42
-
alias ${initscript}/bin/init;
43
-
'';
37
+
locations."= /init".extraConfig =
38
+
let
39
+
initscript = pkgs.init.override {
40
+
pubkey = config.krebs.users.lass.pubkey;
41
+
};
42
+
in
43
+
''
44
+
alias ${initscript}/bin/init;
45
+
'';
44
46
locations."= /blue.pub".extraConfig = ''
45
47
alias ${pkgs.writeText "pub" config.krebs.users.lass-blue.pubkey};
46
48
'';