Compare commits

..

10 commits

Author SHA1 Message Date
Antoine Martin beb366f9a5 home: individualise stateVersion 2024-03-01 13:34:33 +01:00
Antoine Martin 93764167e9 flake.lock: Update
Flake lock file updates:

• Updated input 'disko':
    'github:nix-community/disko/a13f36255cf4ce99cc4236a34251c2e7106e101d' (2024-02-26)
  → 'github:nix-community/disko/bde7dd352c07d43bd5b8245e6c39074a391fdd46' (2024-03-01)
• Updated input 'home-manager':
    'github:nix-community/home-manager/1d085ea4444d26aa52297758b333b449b2aa6fca' (2024-02-26)
  → 'github:nix-community/home-manager/2f3367769a93b226c467551315e9e270c3f78b15' (2024-02-29)
• Updated input 'nixos-hardware':
    'github:NixOS/nixos-hardware/01467901ec51dd92774040f2b3dff4f21f4e1c45' (2024-02-28)
  → 'github:NixOS/nixos-hardware/33a97b5814d36ddd65ad678ad07ce43b1a67f159' (2024-02-28)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/13aff9b34cc32e59d35c62ac9356e4a41198a538' (2024-02-26)
  → 'github:NixOS/nixpkgs/9099616b93301d5cf84274b184a3a5ec69e94e08' (2024-02-28)
• Updated input 'nixpkgs-unstable-small':
    'github:NixOS/nixpkgs/c1fe227b486d4bfffb319fd225a95ea574d398bf' (2024-02-28)
  → 'github:NixOS/nixpkgs/09c1497ce5d4ed4a0edfdd44450d3048074cb300' (2024-03-01)
2024-03-01 11:43:13 +01:00
Antoine Martin ae2c988bdb talos: switch sddm to wayland 2024-03-01 10:35:36 +01:00
Antoine Martin b05eec42c5 talos: enable some wayland window managers 2024-02-29 16:35:17 +01:00
Antoine Martin b28266d6ea talos: update systemd-boot settings 2024-02-29 10:58:36 +01:00
Antoine Martin 401ee0005a run formatter 2024-02-29 03:48:41 +01:00
Antoine Martin 2d420362ac base: remove driver config
NVIDIA specific settings should just go to boreal
2024-02-29 02:45:20 +01:00
Antoine Martin 79d60288aa base: update xkb option names 2024-02-29 02:44:24 +01:00
Antoine Martin 3e3f4331d2 talos: initial setup 2024-02-28 23:30:28 +01:00
Antoine Martin 2a2275a87a flake: update everything 2024-02-28 17:48:56 +01:00
56 changed files with 826 additions and 775 deletions

View file

@ -15,10 +15,10 @@ jobs:
steps:
- uses: actions/checkout@v4
- uses: cachix/install-nix-action@v27
- uses: cachix/install-nix-action@v25
- name: Run alejandra
run: nix develop --command alejandra --check .
run: nix run nixpkgs#alejandra -- --check .
flake-check:
name: Flake check
@ -26,9 +26,9 @@ jobs:
steps:
- uses: actions/checkout@v4
- uses: cachix/install-nix-action@v27
- uses: cachix/install-nix-action@v25
- uses: cachix/cachix-action@v15
- uses: cachix/cachix-action@v14
with:
name: alarsyo
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
@ -46,6 +46,7 @@ jobs:
fail-fast: false
matrix:
name:
- ansel
- grafanaDashboards/nginx
- grafanaDashboards/node-exporter
- kaleidoscope-udev-rules
@ -55,9 +56,9 @@ jobs:
steps:
- uses: actions/checkout@v4
- uses: cachix/install-nix-action@v27
- uses: cachix/install-nix-action@v25
- uses: cachix/cachix-action@v15
- uses: cachix/cachix-action@v14
with:
name: alarsyo
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
@ -77,18 +78,15 @@ jobs:
name:
- boreal
- hades
- talos
- hephaestus
- thanatos
steps:
- name: Delete huge unnecessary tools folder
run: rm -rf /opt/hostedtoolcache
- uses: actions/checkout@v4
- uses: cachix/install-nix-action@v27
- uses: cachix/install-nix-action@v25
- uses: cachix/cachix-action@v15
- uses: cachix/cachix-action@v14
with:
name: alarsyo
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'

View file

@ -23,47 +23,35 @@ in {
programs.gnupg.agent = {
enable = true;
enableSSHSupport = true;
pinentryPackage = pkgs.pinentry-qt;
pinentryFlavor = "qt";
};
services = {
xserver = {
enable = true;
# NOTE: could use `mkOptionDefault` but this feels more explicit
videoDrivers =
if config.my.gui.isNvidia
then ["nvidia"]
else options.services.xserver.videoDrivers.default;
windowManager.i3.enable = true;
xkb = {
layout = "fr";
variant = "us";
};
};
libinput = {
enable = true;
touchpad = {
naturalScrolling = true;
libinput = {
enable = true;
touchpad = {
naturalScrolling = true;
};
};
};
logind.lidSwitch = "ignore";
printing = {
enable = true;
cups-pdf.enable = true;
};
udev.packages = [pkgs.chrysalis];
};
environment.systemPackages = builtins.attrValues {
inherit
(pkgs)
arandr
chrysalis
discord
evince
feh
firefox
ffmpeg
gimp-with-plugins
imagemagick
@ -78,10 +66,58 @@ in {
zathura
;
inherit (pkgs.gnome) nautilus;
inherit (pkgs.libsForQt5) okular;
discord = pkgs.discord.override {nss = pkgs.nss_latest;};
};
networking.networkmanager.enable = true;
networking.networkmanager = {
enable = true;
dispatcherScripts = [
{
source = let
grep = "${pkgs.gnugrep}/bin/grep";
nmcli = "${pkgs.networkmanager}/bin/nmcli";
in
pkgs.writeShellScript "disable_wifi_on_ethernet" ''
export LC_ALL=C
date >> /tmp/disable_wifi_on_ethernet.log
echo START "$@" >> /tmp/disable_wifi_on_ethernet.log
beginswith() { case $2 in "$1"*) true;; *) false;; esac; }
is_ethernet_interface ()
{
local type="$(${nmcli} dev show "$1" | grep 'GENERAL\.TYPE:' | awk '{ print $2 }')"
test "$type" = "ethernet" || beginswith enp "$1"
}
hotspot_enabled ()
{
${nmcli} dev | ${grep} -q "hotspot"
}
if is_ethernet_interface "$1" && ! hotspot_enabled; then
echo "change in ethernet and not in hotspot mode" >> /tmp/disable_wifi_on_ethernet.log
if [ "$2" = "up" ]; then
echo "turning wifi off" >> /tmp/disable_wifi_on_ethernet.log
nmcli radio wifi off
fi
if [ "$2" = "down" ]; then
echo "turning wifi on" >> /tmp/disable_wifi_on_ethernet.log
nmcli radio wifi on
fi
fi
echo END "$@" >> /tmp/disable_wifi_on_ethernet.log
'';
type = "basic";
}
];
};
programs.nm-applet.enable = true;
programs.steam.enable = true;

View file

@ -21,24 +21,36 @@
inherit
(pkgs)
# shell usage
bat
fd
file
ripgrep
sd
tokei
tree
wget
jq
pciutils
usbutils
# development
agenix
alejandra
git
git-crypt
git-lfs
gnumake
gnupg
pinentry-qt
python3
vim
# terminal utilities
dogdns
du-dust
htop
ldns # drill
unzip
zip
;

View file

@ -8,11 +8,11 @@
"systems": "systems"
},
"locked": {
"lastModified": 1723293904,
"narHash": "sha256-b+uqzj+Wa6xgMS9aNbX4I+sXeb5biPDi39VgvSFqFvU=",
"lastModified": 1707830867,
"narHash": "sha256-PAdwm5QqdlwIqGrfzzvzZubM+FXtilekQ/FA0cI49/o=",
"owner": "ryantm",
"repo": "agenix",
"rev": "f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41",
"rev": "8cb01a0e717311680e0cbca06a76cbceba6f3ed6",
"type": "github"
},
"original": {
@ -48,11 +48,11 @@
"nixpkgs": "nixpkgs_2"
},
"locked": {
"lastModified": 1732988076,
"narHash": "sha256-2uMaVAZn7fiyTUGhKgleuLYe5+EAAYB/diKxrM7g3as=",
"lastModified": 1709286488,
"narHash": "sha256-RDpTZ72zLu05djvXRzK76Ysqp9zSdh84ax/edEaJucs=",
"owner": "nix-community",
"repo": "disko",
"rev": "2814a5224a47ca19e858e027f7e8bff74a8ea9f1",
"rev": "bde7dd352c07d43bd5b8245e6c39074a391fdd46",
"type": "github"
},
"original": {
@ -67,11 +67,11 @@
"systems": "systems_2"
},
"locked": {
"lastModified": 1731533236,
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
"lastModified": 1709126324,
"narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
"rev": "d465f4819400de7c8d874d50b982301f28a84605",
"type": "github"
},
"original": {
@ -81,39 +81,6 @@
"type": "github"
}
},
"flake-utils_2": {
"inputs": {
"systems": "systems_3"
},
"locked": {
"lastModified": 1710146030,
"narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"flakey-profile": {
"locked": {
"lastModified": 1712898590,
"narHash": "sha256-FhGIEU93VHAChKEXx905TSiPZKga69bWl1VB37FK//I=",
"owner": "lf-",
"repo": "flakey-profile",
"rev": "243c903fd8eadc0f63d205665a92d4df91d42d9d",
"type": "github"
},
"original": {
"owner": "lf-",
"repo": "flakey-profile",
"type": "github"
}
},
"home-manager": {
"inputs": {
"nixpkgs": [
@ -142,62 +109,27 @@
]
},
"locked": {
"lastModified": 1733951536,
"narHash": "sha256-Zb5ZCa7Xj+0gy5XVXINTSr71fCfAv+IKtmIXNrykT54=",
"lastModified": 1709204054,
"narHash": "sha256-U1idK0JHs1XOfSI1APYuXi4AEADf+B+ZU4Wifc0pBHk=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "1318c3f3b068cdcea922fa7c1a0a1f0c96c22f5f",
"rev": "2f3367769a93b226c467551315e9e270c3f78b15",
"type": "github"
},
"original": {
"owner": "nix-community",
"ref": "release-24.11",
"ref": "master",
"repo": "home-manager",
"type": "github"
}
},
"lix": {
"flake": false,
"locked": {
"lastModified": 1729298361,
"narHash": "sha256-hiGtfzxFkDc9TSYsb96Whg0vnqBVV7CUxyscZNhed0U=",
"rev": "ad9d06f7838a25beec425ff406fe68721fef73be",
"type": "tarball",
"url": "https://git.lix.systems/api/v1/repos/lix-project/lix/archive/ad9d06f7838a25beec425ff406fe68721fef73be.tar.gz?rev=ad9d06f7838a25beec425ff406fe68721fef73be"
},
"original": {
"type": "tarball",
"url": "https://git.lix.systems/lix-project/lix/archive/2.91.1.tar.gz"
}
},
"lix-module": {
"inputs": {
"flake-utils": "flake-utils_2",
"flakey-profile": "flakey-profile",
"lix": "lix",
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1732605668,
"narHash": "sha256-DN5/166jhiiAW0Uw6nueXaGTueVxhfZISAkoxasmz/g=",
"rev": "f19bd752910bbe3a861c9cad269bd078689d50fe",
"type": "tarball",
"url": "https://git.lix.systems/api/v1/repos/lix-project/nixos-module/archive/f19bd752910bbe3a861c9cad269bd078689d50fe.tar.gz?rev=f19bd752910bbe3a861c9cad269bd078689d50fe"
},
"original": {
"type": "tarball",
"url": "https://git.lix.systems/lix-project/nixos-module/archive/2.91.1-2.tar.gz"
}
},
"nixos-hardware": {
"locked": {
"lastModified": 1733861262,
"narHash": "sha256-+jjPup/ByS0LEVIrBbt7FnGugJgLeG9oc+ivFASYn2U=",
"lastModified": 1709147990,
"narHash": "sha256-vpXMWoaCtMYJ7lisJedCRhQG9BSsInEyZnnG5GfY9tQ=",
"owner": "NixOS",
"repo": "nixos-hardware",
"rev": "cf737e2eba82b603f54f71b10cb8fd09d22ce3f5",
"rev": "33a97b5814d36ddd65ad678ad07ce43b1a67f159",
"type": "github"
},
"original": {
@ -225,11 +157,11 @@
},
"nixpkgs-unstable-small": {
"locked": {
"lastModified": 1733038015,
"narHash": "sha256-kIKqS3093Xz5vuvSLk0x1hqo2pFaGwMjnwr3qrTBkzk=",
"lastModified": 1709271102,
"narHash": "sha256-Z2sBL/HRRTNABsU8E5XsP+FXBEyBoi6oMwm5bV7lSFw=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "767b0e3398fb899d0c88a9f7aecf30dd1cad3166",
"rev": "09c1497ce5d4ed4a0edfdd44450d3048074cb300",
"type": "github"
},
"original": {
@ -241,11 +173,11 @@
},
"nixpkgs_2": {
"locked": {
"lastModified": 1732238832,
"narHash": "sha256-sQxuJm8rHY20xq6Ah+GwIUkF95tWjGRd1X8xF+Pkk38=",
"lastModified": 1708815994,
"narHash": "sha256-hL7N/ut2Xu0NaDxDMsw2HagAjgDskToGiyZOWriiLYM=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "8edf06bea5bcbee082df1b7369ff973b91618b8d",
"rev": "9a9dae8f6319600fa9aebde37f340975cab4b8c0",
"type": "github"
},
"original": {
@ -257,16 +189,16 @@
},
"nixpkgs_3": {
"locked": {
"lastModified": 1734083684,
"narHash": "sha256-5fNndbndxSx5d+C/D0p/VF32xDiJCJzyOqorOYW4JEo=",
"lastModified": 1709150264,
"narHash": "sha256-HofykKuisObPUfj0E9CJVfaMhawXkYx3G8UIFR/XQ38=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "314e12ba369ccdb9b352a4db26ff419f7c49fa84",
"rev": "9099616b93301d5cf84274b184a3a5ec69e94e08",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-24.11",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
@ -277,7 +209,6 @@
"disko": "disko",
"flake-utils": "flake-utils",
"home-manager": "home-manager_2",
"lix-module": "lix-module",
"nixos-hardware": "nixos-hardware",
"nixpkgs": "nixpkgs_3",
"nixpkgs-unstable-small": "nixpkgs-unstable-small"
@ -312,21 +243,6 @@
"repo": "default",
"type": "github"
}
},
"systems_3": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
}
},
"root": "root",

View file

@ -5,7 +5,7 @@
type = "github";
owner = "NixOS";
repo = "nixpkgs";
ref = "nixos-24.11";
ref = "nixos-unstable";
};
nixpkgs-unstable-small = {
@ -25,7 +25,7 @@
type = "github";
owner = "nix-community";
repo = "home-manager";
ref = "release-24.11";
ref = "master";
inputs.nixpkgs.follows = "nixpkgs";
};
@ -49,11 +49,6 @@
repo = "disko";
ref = "master";
};
lix-module = {
url = "https://git.lix.systems/lix-project/nixos-module/archive/2.91.1-2.tar.gz";
inputs.nixpkgs.follows = "nixpkgs";
};
};
outputs = {
@ -62,18 +57,26 @@
home-manager,
agenix,
disko,
lix-module,
...
} @ inputs:
{
nixosModules = {
home = {
home-manager.backupFileExtension = "hm-backup";
home-manager.useGlobalPkgs = true;
home-manager.useUserPackages = true;
home-manager.users.alarsyo = import ./home;
home-manager.verbose = true;
};
nix-path = {
nix = {
nixPath = [
"nixpkgs=${inputs.nixpkgs}"
];
registry = {
nixpkgs.flake = inputs.nixpkgs;
};
};
};
};
overlays = import ./overlays;
@ -99,7 +102,6 @@
[
agenix.nixosModules.default
home-manager.nixosModules.default
lix-module.nixosModules.default
{
nixpkgs = {
overlays = shared_overlays;
@ -139,6 +141,20 @@
++ sharedModules;
};
hephaestus = nixpkgs.lib.nixosSystem rec {
inherit system;
modules =
[
./hephaestus.nix
inputs.nixos-hardware.nixosModules.common-cpu-amd
inputs.nixos-hardware.nixosModules.common-gpu-amd
inputs.nixos-hardware.nixosModules.common-pc-laptop
inputs.nixos-hardware.nixosModules.common-pc-ssd
]
++ sharedModules;
};
talos = nixpkgs.lib.nixosSystem {
inherit system;
modules =
@ -161,16 +177,11 @@
};
};
}
// inputs.flake-utils.lib.eachDefaultSystem (system: let
pkgs = nixpkgs.legacyPackages.${system};
in {
// inputs.flake-utils.lib.eachDefaultSystem (system: {
packages =
inputs.flake-utils.lib.flattenTree
(import ./pkgs {inherit pkgs;});
devShells.default = pkgs.mkShellNoCC {
buildInputs = [
pkgs.alejandra
];
};
(import ./pkgs {
pkgs = import nixpkgs {inherit system;};
});
});
}

23
hephaestus.nix Normal file
View file

@ -0,0 +1,23 @@
{...}: {
imports = [
# Default configuration
./base
# Module definitions
./modules
# Service definitions
./services
# Host-specific config
./hosts/hephaestus
];
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. Its perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "23.05"; # Did you read the comment?
}

View file

@ -2,7 +2,6 @@
imports = [
./alacritty.nix
./bat.nix
./direnv.nix
./emacs.nix
./env.nix
./firefox.nix
@ -11,6 +10,7 @@
./git.nix
./gtk.nix
./laptop.nix
./lorri.nix
./mail.nix
./rbw.nix
./rofi.nix

View file

@ -24,8 +24,9 @@ in {
inherit
(pkgs)
sqlite # needed by org-roam
# fonts used by my config
emacs-all-the-icons-fonts
iosevka-bin
;
@ -42,7 +43,7 @@ in {
programs.emacs = {
enable = true;
package = pkgs.emacs29-pgtk;
package = pkgs.emacs29;
extraPackages = epkgs: [epkgs.vterm epkgs.pdf-tools pkgs.lilypond epkgs.mu4e];
};
};

View file

@ -1,4 +1,7 @@
function nfl
set -l flags "--commit-lock-file"
nix flake update $flags $argv
for flake in $argv
set -a flags "--update-input" "$flake"
end
nix flake lock $flags
end

View file

@ -24,12 +24,12 @@ in {
};
iconTheme = {
package = pkgs.gnome-themes-extra;
package = pkgs.gnome.gnome-themes-extra;
name = "Adwaita";
};
theme = {
package = pkgs.gnome-themes-extra;
package = pkgs.gnome.gnome-themes-extra;
name = "Adwaita";
};
};

View file

@ -9,15 +9,17 @@
mkIf
;
cfg = config.my.home.direnv;
cfg = config.my.home.lorri;
in {
options.my.home.direnv = {
enable = (mkEnableOption "setup direnv usage") // {default = true;};
options.my.home.lorri = {
enable = (mkEnableOption "lorri daemon setup") // {default = true;};
};
config = mkIf cfg.enable {
services.lorri.enable = true;
programs.direnv = {
enable = true;
# FIXME: proper file, not lorri.nix
nix-direnv = {
enable = true;
};

View file

@ -18,10 +18,8 @@ bind ,<Space> nohlsearch
" case insensitive if lowercase, case sensitive if using some uppercase letters
set findcase smart
set modeindicatormodes {"ignore": "false"}
" New reddit is bad
" autocmd DocStart ^http(s?)://www.reddit.com js tri.excmds.urlmodify("-t", "www", "old")
autocmd DocStart ^http(s?)://www.reddit.com js tri.excmds.urlmodify("-t", "www", "old")
" Orange site / Reddit / Lobste.rs specific hints to toggle comments
bind ;c hint -Jc [class*="expand"],[class="togg"],[class="comment_folder"]
@ -38,6 +36,3 @@ blacklistadd localhost
blacklistadd netflix.com
blacklistadd primevideo.com
blacklistadd youtube.com
" prevent teams from crashing
seturl teams.microsoft.com superignore true

View file

@ -6,12 +6,11 @@
}: let
inherit
(lib)
mkEnableOption
mkIf
mkOptionDefault
;
isEnabled = config.my.home.x.i3.enable;
isEnabled = config.my.home.x.enable;
myTerminal =
# FIXME: fix when terminal is setup in home
@ -27,10 +26,6 @@
i3Theme = config.my.theme.i3Theme;
in {
options.my.home.x.i3 = {
enable = mkEnableOption "i3wm configuration";
};
config = mkIf isEnabled {
my.home = {
flameshot.enable = true;

View file

@ -41,6 +41,7 @@ in {
inherit
(pkgs)
# FIXME: is this useful?
font-awesome
;
};

View file

@ -24,12 +24,10 @@
boot.tmp.useTmpfs = true;
boot.supportedFilesystems = {
btrfs = true;
ntfs = true;
};
services.xserver.windowManager.i3.enable = true;
boot.supportedFilesystems = [
"btrfs"
"ntfs"
];
services.btrfs = {
autoScrub = {
@ -86,6 +84,7 @@
services = {
openssh = {
enable = true;
forwardX11 = true;
};
};
my.gui = {
@ -93,14 +92,18 @@
isNvidia = true;
};
hardware = {
bluetooth = {
enable = true;
powerOnBoot = false;
};
nvidia = {
open = true;
modesetting.enable = true;
};
my.wakeonwlan.interfaces.phy0.methods = [
"magic-packet"
"disconnect"
"gtk-rekey-failure"
"eap-identity-request"
"rfkill-release"
];
services.udev.packages = [pkgs.chrysalis];
hardware.bluetooth = {
enable = true;
powerOnBoot = false;
};
}

View file

@ -4,11 +4,11 @@
...
}: {
home-manager.users.alarsyo = {
home.stateVersion = "20.09";
# TODO: can probably upgrade me
home.stateVersion = "21.05";
# Keyboard settings & i3 settings
my.home.x.enable = true;
my.home.x.i3.enable = true;
my.home.x.i3bar.temperature.chip = "k10temp-pci-*";
my.home.x.i3bar.temperature.inputs = ["Tccd1"];
my.home.x.i3bar.networking.throughput_interfaces = ["enp8s0" "wlp4s0"];
@ -20,11 +20,13 @@
inherit
(pkgs)
# some websites only work there :(
chromium
darktable
hugin
enblend-enfuse
# dev
rustup
;

View file

@ -57,7 +57,7 @@ in {
my.services = {
fail2ban.enable = true;
forgejo = {
gitea = {
enable = true;
privatePort = 8082;
};
@ -81,11 +81,6 @@ in {
secretConfigFile = config.age.secrets."matrix-synapse/secret-config".path;
};
mealie = {
enable = true;
port = 8090;
};
microbin = {
enable = true;
privatePort = 8088;
@ -117,6 +112,11 @@ in {
secretKeyFile = config.age.secrets."paperless/secret-key".path;
};
photoprism = {
enable = true;
port = 8084;
};
pleroma = {
enable = true;
port = 8086;

View file

@ -1,6 +1,8 @@
{config, ...}: {
home-manager.users.alarsyo = {
home.stateVersion = "22.05";
# TODO: can probably upgrade me
home.stateVersion = "21.05";
my.theme = config.home-manager.users.alarsyo.my.themes.solarizedLight;
};
}

View file

@ -13,6 +13,8 @@
// attrs;
in
lib.mapAttrs toSecret {
"gandi/api-key" = {};
"lohr/shared-secret" = {};
"matrix-synapse/secret-config" = {
@ -27,8 +29,6 @@
owner = "nextcloud";
};
"ovh/credentials" = {};
"paperless/admin-password" = {};
"paperless/secret-key" = {};

View file

@ -0,0 +1,246 @@
# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running nixos-help).
{
config,
lib,
pkgs,
...
}: {
imports = [
# Include the results of the hardware scan.
./hardware-configuration.nix
./home.nix
./secrets.nix
];
hardware.amdgpu.opencl = false;
boot.kernelPackages = pkgs.linuxPackages;
# Use the systemd-boot EFI boot loader.
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
# boot.initrd.systemd.enable = true;
# boot.plymouth.enable = true;
# boot.kernelParams = ["quiet"];
boot.initrd.secrets = {
"/crypto_keyfile.bin" = null;
};
boot.tmp.useTmpfs = true;
services.btrfs = {
autoScrub = {
enable = true;
fileSystems = ["/"];
};
};
networking.hostName = "hephaestus"; # Define your hostname.
networking.domain = "alarsyo.net";
networking.networkmanager.enable = true;
# Set your time zone.
time.timeZone = "Europe/Paris";
# List services that you want to enable:
my.services = {
tailscale = {
enable = true;
useRoutingFeatures = "client";
};
pipewire.enable = true;
restic-backup = {
enable = true;
repo = "b2:hephaestus-backup";
passwordFile = config.age.secrets."restic-backup/hephaestus-password".path;
environmentFile = config.age.secrets."restic-backup/hephaestus-credentials".path;
timerConfig = {
OnCalendar = "*-*-* 13:00:00"; # laptop only gets used during the day
};
paths = [
"/home/alarsyo"
];
exclude = [
"/home/alarsyo/Downloads"
# Rust builds using half my storage capacity
"/home/alarsyo/**/target"
"/home/alarsyo/work/rust/build"
# don't backup nixpkgs
"/home/alarsyo/work/nixpkgs"
"/home/alarsyo/go"
# C build crap
"*.a"
"*.o"
"*.so"
".direnv"
# test vms
"*.qcow2"
# secrets stay offline
"/home/alarsyo/**/secrets"
# ignore all dotfiles as .config and .cache can become quite big
"/home/alarsyo/.*"
];
};
};
virtualisation.docker.enable = true;
virtualisation.libvirtd.enable = true;
programs.dconf.enable = true;
services = {
tlp = {
enable = true;
settings = {
START_CHARGE_THRESH_BAT0 = 70;
STOP_CHARGE_THRESH_BAT0 = 80;
};
};
fwupd.enable = true;
openssh.enable = true;
};
my.gui.enable = true;
my.displayManager.sddm.enable = lib.mkForce false;
hardware.bluetooth = {
enable = true;
powerOnBoot = false;
settings.General.Experimental = true;
};
# Select internationalisation properties.
i18n.defaultLocale = "en_US.UTF-8";
i18n.extraLocaleSettings = {
LC_ADDRESS = "fr_FR.UTF-8";
LC_IDENTIFICATION = "fr_FR.UTF-8";
LC_MEASUREMENT = "fr_FR.UTF-8";
LC_MONETARY = "fr_FR.UTF-8";
LC_NAME = "fr_FR.UTF-8";
LC_PAPER = "fr_FR.UTF-8";
LC_TELEPHONE = "fr_FR.UTF-8";
};
# Enable the X11 windowing system.
services.xserver.enable = true;
# Enable the KDE Plasma Desktop Environment.
services.xserver.displayManager.sddm.enable = true;
services.xserver.desktopManager.plasma5.enable = true;
services.power-profiles-daemon.enable = false;
services.autorandr = {
enable = true;
profiles = {
default = {
fingerprint = {
"eDP-1" = "00ffffffffffff0030e42c0600000000001c0104a51f117802aa95955e598e271b5054000000010101010101010101010101010101012e3680a070381f403020350035ae1000001ab62c80f4703816403020350035ae1000001a000000fe004c4720446973706c61790a2020000000fe004c503134305746412d535044340018";
};
config = {
"eDP-1" = {
enable = true;
crtc = 0;
primary = true;
position = "0x0";
mode = "1920x1080";
};
};
};
dock = {
fingerprint = {
"eDP-1" = "00ffffffffffff0030e42c0600000000001c0104a51f117802aa95955e598e271b5054000000010101010101010101010101010101012e3680a070381f403020350035ae1000001ab62c80f4703816403020350035ae1000001a000000fe004c4720446973706c61790a2020000000fe004c503134305746412d535044340018";
"DP-4" = "00ffffffffffff0026cd4161fb060000021e0104a5351e783aee35a656529d280b5054b74f00714f818081c081009500b300d1c0d1cf023a801871382d40582c45000f282100001e000000fd00374c1e5512000a202020202020000000ff0031313634383030323031373837000000fc00504c32343933480a202020202001c9020318f14b9002030411121305141f012309070183010000023a801871382d40582c45000f282100001e8c0ad08a20e02d10103e96000f2821000018011d007251d01e206e2855000f282100001e8c0ad090204031200c4055000f28210000182a4480a070382740302035000f282100001a00000000000000000000000000a1";
"DP-5" = "00ffffffffffff0026cd4561990000001f1c0104a5351e783ace65a657519f270f5054b30c00714f818081c081009500b300d1c00101023a801871382d40582c45000f282100001e000000fd00374c1e5311000a202020202020000000ff0031313634384238383030313533000000fc00504c32343933480a202020202001d3020318f14b9002030411121305141f012309070183010000023a801871382d40582c45000f282100001e8c0ad08a20e02d10103e96000f2821000018011d007251d01e206e2855000f282100001e8c0ad090204031200c4055000f28210000180000000000000000000000000000000000000000000000000000000000000035";
};
config = {
"eDP-1" = {
enable = true;
primary = false;
position = "3000x840";
mode = "1920x1080";
};
"DP-4" = {
enable = true;
primary = true;
position = "0x420";
mode = "1920x1080";
};
"DP-5" = {
enable = true;
primary = false;
position = "1920x0";
mode = "1920x1080";
rotate = "left";
};
};
};
dock-lid-closed = {
fingerprint = {
"DP-4" = "00ffffffffffff0026cd4161fb060000021e0104a5351e783aee35a656529d280b5054b74f00714f818081c081009500b300d1c0d1cf023a801871382d40582c45000f282100001e000000fd00374c1e5512000a202020202020000000ff0031313634383030323031373837000000fc00504c32343933480a202020202001c9020318f14b9002030411121305141f012309070183010000023a801871382d40582c45000f282100001e8c0ad08a20e02d10103e96000f2821000018011d007251d01e206e2855000f282100001e8c0ad090204031200c4055000f28210000182a4480a070382740302035000f282100001a00000000000000000000000000a1";
"DP-5" = "00ffffffffffff0026cd4561990000001f1c0104a5351e783ace65a657519f270f5054b30c00714f818081c081009500b300d1c00101023a801871382d40582c45000f282100001e000000fd00374c1e5311000a202020202020000000ff0031313634384238383030313533000000fc00504c32343933480a202020202001d3020318f14b9002030411121305141f012309070183010000023a801871382d40582c45000f282100001e8c0ad08a20e02d10103e96000f2821000018011d007251d01e206e2855000f282100001e8c0ad090204031200c4055000f28210000180000000000000000000000000000000000000000000000000000000000000035";
};
config = {
"DP-4" = {
enable = true;
primary = true;
position = "0x420";
mode = "1920x1080";
};
"DP-5" = {
enable = true;
primary = false;
position = "1920x0";
mode = "1920x1080";
rotate = "left";
};
};
};
};
};
systemd.services.autorandr-lid-listener = {
wantedBy = ["multi-user.target"];
description = "Listening for lid events to invoke autorandr";
serviceConfig = {
Type = "simple";
ExecStart = let
stdbufExe = lib.getExe' pkgs.coreutils "stdbuf";
libinputExe = lib.getExe' pkgs.libinput "libinput";
grepExe = lib.getExe pkgs.gnugrep;
autorandrExe = lib.getExe pkgs.autorandr;
in
pkgs.writeShellScript "lid-listener.sh" ''
${stdbufExe} -oL ${libinputExe} debug-events |
${grepExe} -E --line-buffered '^[[:space:]-]+event[0-9]+[[:space:]]+SWITCH_TOGGLE[[:space:]]' |
while read line; do
${pkgs.systemd}/bin/systemctl start --no-block autorandr.service
done
'';
Restart = "always";
RestartSec = "30";
};
};
# Configure console keymap
console.keyMap = "us";
programs.light.enable = true;
}

View file

@ -0,0 +1,45 @@
# Do not modify this file! It was generated by nixos-generate-config
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{
config,
lib,
pkgs,
modulesPath,
...
}: {
imports = [
(modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = ["nvme" "ehci_pci" "xhci_pci" "usb_storage" "sd_mod" "sdhci_pci"];
boot.initrd.kernelModules = [];
boot.kernelModules = ["kvm-amd"];
boot.extraModulePackages = [];
fileSystems."/" = {
device = "/dev/disk/by-uuid/54ded736-367c-4081-9978-9e2d8f61cb1b";
fsType = "btrfs";
options = ["subvol=@"];
};
boot.initrd.luks.devices."luks-df96458d-45a1-4a30-8633-58feeff603f8".device = "/dev/disk/by-uuid/df96458d-45a1-4a30-8633-58feeff603f8";
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/826A-23F7";
fsType = "vfat";
};
swapDevices = [];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.enp2s0f0.useDHCP = lib.mkDefault true;
# networking.interfaces.wlp3s0.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}

49
hosts/hephaestus/home.nix Normal file
View file

@ -0,0 +1,49 @@
{
config,
pkgs,
...
}: {
home-manager.users.alarsyo = {
# TODO: can probably upgrade me
home.stateVersion = "21.05";
my.home.laptop.enable = true;
# Keyboard settings & i3 settings
my.home.x.enable = true;
my.home.x.i3bar.temperature.chip = "k10temp-pci-*";
my.home.x.i3bar.temperature.inputs = ["Tctl"];
my.home.x.i3bar.networking.throughput_interfaces = ["wlp3s0" "enp6s0f3u1u1"];
my.home.emacs.enable = true;
my.theme = config.home-manager.users.alarsyo.my.themes.solarizedLight;
# TODO: place in global home conf
services.dunst.enable = true;
home.packages = builtins.attrValues {
inherit
(pkgs)
# some websites only work there :(
chromium
darktable
# dev
rustup
gdb
valgrind
arandr
zotero
;
inherit
(pkgs.packages)
ansel
spot
;
inherit (pkgs.wineWowPackages) stable;
};
};
}

View file

@ -0,0 +1,23 @@
{
config,
lib,
options,
...
}: {
config.age = {
secrets = let
toSecret = name: {...} @ attrs:
{
file = ./../../modules/secrets + "/${name}.age";
}
// attrs;
in
lib.mapAttrs toSecret {
"restic-backup/hephaestus-credentials" = {};
"restic-backup/hephaestus-password" = {};
"users/alarsyo-hashed-password" = {};
"users/root-hashed-password" = {};
};
};
}

View file

@ -16,16 +16,9 @@
./secrets.nix
];
boot.kernelPackages = pkgs.linuxPackages_6_12;
# Set Wi-Fi regulatory domain. Currently always set to '00' (world), and could
# lead to bad Wi-Fi performance
boot.kernelParams = ["cfg80211.ieee80211_regdom=FR"];
boot.extraModulePackages = with config.boot.kernelPackages; [
v4l2loopback
];
boot.extraModprobeConfig = ''
options v4l2loopback devices=1 video_nr=1 card_label="OBS Cam" exclusive_caps=1
'';
hardware.amdgpu.opencl = false;
boot.kernelPackages = pkgs.linuxPackages_6_6;
# Use the systemd-boot EFI boot loader.
boot.loader.systemd-boot = {
@ -48,10 +41,7 @@
networking.domain = "alarsyo.net";
# Pick only one of the below networking options.
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
networking.networkmanager = {
enable = true;
wifi.powersave = true;
};
networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
# Set your time zone.
time.timeZone = "Europe/Paris";
@ -61,6 +51,7 @@
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
programs = {
dconf.enable = true;
light.enable = true;
};
services = {
@ -69,10 +60,7 @@
};
virtualisation = {
docker.enable = true;
libvirtd.enable = false;
virtualbox.host = {
enable = false;
};
libvirtd.enable = true;
};
my.services = {
@ -82,54 +70,10 @@
};
pipewire.enable = true;
restic-backup = {
enable = true;
repo = "b2:talos-backup";
passwordFile = config.age.secrets."restic-backup/talos-password".path;
environmentFile = config.age.secrets."restic-backup/talos-credentials".path;
timerConfig = {
OnCalendar = "*-*-* 13:00:00"; # laptop only gets used during the day
};
paths = [
"/home/alarsyo"
];
exclude = [
"/home/alarsyo/Downloads"
# Rust builds using half my storage capacity
"/home/alarsyo/**/target"
"/home/alarsyo/work/rust/build"
# don't backup nixpkgs
"/home/alarsyo/work/nixpkgs"
"/home/alarsyo/go"
# C build crap
"*.a"
"*.o"
"*.so"
".direnv"
# test vms
"*.qcow2"
"*.vbox"
"*.vdi"
# secrets stay offline
"/home/alarsyo/**/secrets"
# ignore all dotfiles as .config and .cache can become quite big
"/home/alarsyo/.*"
];
};
};
my.gui.enable = true;
my.displayManager.sddm.enable = lib.mkForce false;
hardware.bluetooth = {
enable = true;
@ -152,21 +96,22 @@
LC_TELEPHONE = "fr_FR.UTF-8";
};
# Enable the X11 windowing system.
services.xserver.enable = true;
# Enable the KDE Plasma Desktop Environment.
services.desktopManager.plasma6.enable = true;
services.xserver.displayManager.sddm = {
enable = true;
wayland.enable = true;
};
services.xserver.desktopManager.plasma5.enable = true;
services.power-profiles-daemon.enable = true;
environment.systemPackages = [
pkgs.unstable.zed-editor
pkgs.foot
];
#programs.hyprland.enable = true;
programs.hyprland.enable = true;
programs.sway = {
enable = true;
wrapperFeatures.gtk = true;
};
# Copy the NixOS configuration file and link it from the resulting system
# (/run/current-system/configuration.nix). This is useful in case you
# accidentally delete configuration.nix.

View file

@ -20,7 +20,7 @@
};
};
luks = {
size = "600G";
size = "100%";
content = {
type = "luks";
name = "crypted";
@ -35,24 +35,19 @@
type = "btrfs";
extraArgs = ["-f"];
subvolumes = {
"@" = {
"/root" = {
mountpoint = "/";
mountOptions = ["compress=zstd" "noatime"];
};
"@home" = {
"/home" = {
mountpoint = "/home";
mountOptions = ["compress=zstd" "noatime"];
};
"@nix" = {
"/nix" = {
mountpoint = "/nix";
mountOptions = ["compress=zstd" "noatime"];
};
"@persist" = {
mountpoint = "/persist";
mountOptions = ["compress=zstd" "noatime"];
};
"@snapshots" = {};
"@swap" = {
"/swap" = {
mountpoint = "/.swapvol";
swap.swapfile.size = "8G";
};

View file

@ -1,16 +1,10 @@
{
config,
lib,
pkgs,
...
}: let
inherit
(lib)
mkOptionDefault
;
in {
}: {
home-manager.users.alarsyo = {
home.stateVersion = "23.11";
home.stateVersion = "24.05";
my.home.laptop.enable = true;
@ -29,101 +23,26 @@ in {
home.packages = builtins.attrValues {
inherit
(pkgs)
ansel
chromium # some websites only work there :(
# some websites only work there :(
chromium
darktable
# dev
rustup
gdb
valgrind
arandr
zotero
;
inherit
(pkgs.packages)
spot
;
};
#inherit
# (pkgs.packages)
# ansel
# spot
# ;
wayland.windowManager.sway = {
enable = true;
swaynag.enable = true;
wrapperFeatures.gtk = true;
config = {
modifier = "Mod4";
input = {
"type:keyboard" = {
xkb_layout = "fr";
xkb_variant = "us";
};
"type:touchpad" = {
dwt = "enabled";
tap = "enabled";
middle_emulation = "enabled";
natural_scroll = "enabled";
};
};
output = {
"eDP-1" = {
scale = "1.5";
};
};
fonts = {
names = ["Iosevka Fixed" "FontAwesome6Free"];
size = 9.0;
};
bars = [
{
mode = "dock";
hiddenState = "hide";
position = "top";
workspaceButtons = true;
workspaceNumbers = true;
statusCommand = "${pkgs.i3status}/bin/i3status";
fonts = {
names = ["Iosevka Fixed" "FontAwesome6Free"];
size = 9.0;
};
trayOutput = "primary";
colors = {
background = "#000000";
statusline = "#ffffff";
separator = "#666666";
focusedWorkspace = {
border = "#4c7899";
background = "#285577";
text = "#ffffff";
};
activeWorkspace = {
border = "#333333";
background = "#5f676a";
text = "#ffffff";
};
inactiveWorkspace = {
border = "#333333";
background = "#222222";
text = "#888888";
};
urgentWorkspace = {
border = "#2f343a";
background = "#900000";
text = "#ffffff";
};
bindingMode = {
border = "#2f343a";
background = "#900000";
text = "#ffffff";
};
};
}
];
keybindings = mkOptionDefault {
"Mod4+i" = "exec emacsclient --create-frame";
};
};
};
programs = {
fuzzel.enable = true;
swaylock.enable = true;
waybar = {
enable = true;
};
inherit (pkgs.wineWowPackages) stable;
};
};
}

View file

@ -13,8 +13,8 @@
// attrs;
in
lib.mapAttrs toSecret {
"restic-backup/talos-credentials" = {};
"restic-backup/talos-password" = {};
#"restic-backup/hephaestus-credentials" = {};
#"restic-backup/hephaestus-password" = {};
"users/alarsyo-hashed-password" = {};
"users/root-hashed-password" = {};

View file

@ -35,56 +35,6 @@ in {
};
services = {
gitlab-runner = {
enable = true;
settings = {
concurrent = 4;
};
services = {
nix = {
authenticationTokenConfigFile = config.age.secrets."gitlab-runner/thanatos-nix-runner-env".path;
dockerImage = "alpine";
dockerVolumes = [
"/nix/store:/nix/store:ro"
"/nix/var/nix/db:/nix/var/nix/db:ro"
"/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro"
];
dockerDisableCache = true;
preBuildScript = pkgs.writeScript "setup-container" ''
mkdir -p -m 0755 /nix/var/log/nix/drvs
mkdir -p -m 0755 /nix/var/nix/gcroots
mkdir -p -m 0755 /nix/var/nix/profiles
mkdir -p -m 0755 /nix/var/nix/temproots
mkdir -p -m 0755 /nix/var/nix/userpool
mkdir -p -m 1777 /nix/var/nix/gcroots/per-user
mkdir -p -m 1777 /nix/var/nix/profiles/per-user
mkdir -p -m 0755 /nix/var/nix/profiles/per-user/root
mkdir -p -m 0700 "$HOME/.nix-defexpr"
. ${pkgs.nix}/etc/profile.d/nix.sh
${pkgs.nix}/bin/nix-env -i ${lib.concatStringsSep " " (with pkgs; [nix cacert git openssh])}
${pkgs.nix}/bin/nix-channel --add https://nixos.org/channels/nixpkgs-unstable
${pkgs.nix}/bin/nix-channel --update nixpkgs
mkdir -p ~/.config/nix
echo "experimental-features = nix-command flakes" > ~/.config/nix/nix.conf
'';
environmentVariables = {
ENV = "/etc/profile";
USER = "root";
NIX_REMOTE = "daemon";
PATH = "/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/bin:/sbin:/usr/bin:/usr/sbin";
NIX_SSL_CERT_FILE = "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt";
};
};
default = {
authenticationTokenConfigFile = config.age.secrets."gitlab-runner/thanatos-runner-env".path;
dockerImage = "debian:stable";
};
};
};
openssh.enable = true;
};

View file

@ -1,6 +1,7 @@
{config, ...}: {
home-manager.users.alarsyo = {
home.stateVersion = "23.11";
# TODO: can probably upgrade me
home.stateVersion = "21.05";
my.theme = config.home-manager.users.alarsyo.my.themes.solarizedLight;
};

View file

@ -15,8 +15,6 @@
lib.mapAttrs toSecret {
"users/alarsyo-hashed-password" = {};
"users/root-hashed-password" = {};
"gitlab-runner/thanatos-runner-env" = {};
"gitlab-runner/thanatos-nix-runner-env" = {};
};
};
}

View file

@ -15,17 +15,23 @@ in {
options.my.displayManager.sddm.enable = mkEnableOption "SDDM setup";
config = mkIf cfg.enable {
services.displayManager.sddm = {
services.xserver.displayManager.sddm = {
enable = true;
theme = "catppuccin-latte";
wayland.enable = true;
theme = "sugar-candy";
};
environment.systemPackages = [
(pkgs.catppuccin-sddm.override
{
flavor = "latte";
})
];
environment.systemPackages = builtins.attrValues {
inherit
(pkgs.packages)
sddm-sugar-candy
;
inherit
(pkgs.libsForQt5.qt5)
qtgraphicaleffects
qtquickcontrols2
qtsvg
;
};
};
}

View file

@ -1,7 +0,0 @@
age-encryption.org/v1
-> ssh-ed25519 k2gHjw naNq55qkAm47KXPJpYFDjVQuxPz2Ffpima5z1WEqRSA
ETC3Hh4gglwYpiJCu/EGOUzjN3BJYk8yJshMeMkgYug
-> ssh-ed25519 6UUuZw Azk9jDbUL/nO20lvzs0s36q/4ZcWSpkUbt1J/PE7A2M
kPKHGLoWHDpFhsRr+CBteWKYsDw0dn/+IKbrh/5qMoE
--- g1akMn28voSQByQR9/ArJ4CsQehcwJ7MfCco+k2fPWo
YMZÓíî:ú{R­^n~ó½±ã¢ÊwPaª§h£8<C2A3>T'hcmªe(<28>ÝXx=7”‡Ë¢[äË4@b=“&ª®æYÅ;‘€Ü[„ª¹ØÁˆß¿kôk>ˆ540ÞGâŒ÷ðÌŸ­±Q<C2B1>Êë·±Ÿw¡

View file

@ -1,7 +0,0 @@
age-encryption.org/v1
-> ssh-ed25519 k2gHjw XED7gkKAp1ioBegA7ryqULRF1BORpW74esfIGp9zPE8
ANxnQN+tox9KYdZvNZFZvQxOymckldPQMhFnz6fSIBo
-> ssh-ed25519 pX8y2g 9wgPqL6GoOxad5AAUmDAYj0h/57AEM8VsQKq1pGTtjM
SxD++XJioZLpt6C8Xse5Nmz4wtL0Fb5NKWo5ijKpyv8
--- 3qOJnkY3Uc4fIex9mgz2+w+su5dS7K7Tmtk1hiqkn9M
ÁXª¨àeéˆaLQ H2*ZÅTé¿ ®P;Ý(jCÌ€k‡ viäµû<C2B5>ÿħ¡à†kæ`™ô]mò<6D>ÿBñ ,³±,ü÷?!¶{àŠ%­eÙì(„Su¿-SŸD¢¾“=H#‡„¼Þq=ï<>Uùí;=OÍ <÷R¼ÇÎE±“<+&­èdÂæ<18>>G+_oP¥Þ]ÿê¦RÄßL$Ö³\š°ü0ø¤N!þ"Áã&÷%Nž à<ËÃ,òv°1ÿÊÚj1

View file

@ -0,0 +1,9 @@
age-encryption.org/v1
-> ssh-ed25519 k2gHjw tTdHZJpSocTHlznYH9eRzeZkrYBbsdT4F8jV1FKw/yk
xKIkYhL/A8wTy6LqDkTuUvm4rhDI6+DXwjzl43PcR8E
-> ssh-ed25519 SYm+hA vzQCZWYdgG0yxUEyGJ4Q8EAh1Kzw5CutDa6q6XSaels
Y7VqpvLfrUvWZcXqGeulRld9kff03kgzz22UBW77AOw
-> j-c8-grease
WeQ
--- KHLA1KlfWM432GDbPIiKInzZeqVRJZ2YCKtF3qClfgs
 ü8Êâ5œ¢|<7C>ŒòQx_5':Á½È ´A?îÎÚ¡ÄÛ ­ØŠ¾þèoAx‰)rýd!Š(´®”èѨ5£¸ìô~ý\†ŽLd"^ÑZ¨Z^®…Vï/‡§5Ë•¶¢¨Ý¦<C39D>a诲áḷo]O/®Eueà†

View file

@ -0,0 +1,9 @@
age-encryption.org/v1
-> ssh-ed25519 k2gHjw 2/spllcr7Fo+1sQ4VJW/MywBVUcpKEbicv4vZQyre0c
Vc2Wugxc5M4i73UKMFXWA2PeHgUOm/+HekoeYt9ycro
-> ssh-ed25519 SYm+hA KFjo2JVxpdOey8A7GAKeZci+ezE0RYBRKR8vNtloU3M
SAzpTjF/RGOgjawT2Sk5H7TNnk/SdbksuAcZZqakJOs
-> !!6BS-grease Gs<Om0
d7WvJNMg3OX9CwWvGNWCuViu1X+e9oFE5vZQixfaJI3xKax2lTNh
--- QICRX2ve/1CFNHjnVXDpue3DRlFbTftu9yrWw745gVk
|†`F…3Þ°˜¤VEû²ÊósßK³ÞQwÿÙ$ùÉŒ{‘¨¯†>¹Hˆ7Þh™î”Ä©Û2ÅïÂÈÆcH^¸×÷Ÿ© X_ñæzv'¢ÄÐ!Zkš_„þÉ0Ë}Yo•je§¼<icé{SkÁ|1Ÿalé*ü7ÓÖŒF«Þ9j¬\§X{¢¾#H7ÑŒ¢!><.^¸¿[ï£q4åpP

View file

@ -1,7 +0,0 @@
age-encryption.org/v1
-> ssh-ed25519 k2gHjw WWJQxqfxQzLmBFPpTzuKBMhAl+ZxnQdvnaDvfpwxR00
tEsf6xSw/MP/qJnr/SyLlkEEf/LaI7IxjVzaxRwh5FI
-> ssh-ed25519 nh0dAQ yRu0VZqx+DuB3SSQaVtg+txuRu9OyJDfLDNCKg9XYk0
xTpucapaejG2EMrZLIDt46JD3QYM4XXT1Y2F77HPQO8
--- uZjO0dDIFesU2B/GkjpqrOJas1+K6hGbQAdFV/t1GOk
BV͵Ç\Õ 8 Û‘¾ºý[%<25>½l^>9<>\Eö5¹šþ¿Új(6èÜgå;(I7CS4èv6ièÉÐþSªÐXïC»ï`OòT™ŒÓÚ\ô;I·Ýœò6ƒ<36>_k˜éy-‡±¹½qKl†¾ôKþÓ hŠ?tô

View file

@ -4,18 +4,16 @@ let
boreal = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAagal1aqZh52wEmgsw7fkCzO41o4Cx+nV4wJGZuX1RP root@boreal";
hades = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMxw8CtKUPAiPdKDEnuS7UyRrZN5BkUwsy5UPVF8V+lt root@hades";
hephaestus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA7Cp+n5+huof68QlAoJV8bVf5h5p9kEZFAVpltWopdL root@hephaestus";
talos = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMBYcmL9HZJ9SqB9OJwQ0Nt6ZbvHZTS+fzM8A6D5MPZs root@talos";
thanatos = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID8JEAWk/8iSl8fN6/f76JkmVFwtyixTpLol4zSVsnVw root@thanatos";
machines = [boreal hades talos thanatos];
machines = [boreal hades hephaestus talos thanatos];
all = users ++ machines;
in {
"gandi/api-key.age".publicKeys = [alarsyo hades];
"gitlab-runner/thanatos-runner-env.age".publicKeys = [alarsyo thanatos];
"gitlab-runner/thanatos-nix-runner-env.age".publicKeys = [alarsyo thanatos];
"lohr/shared-secret.age".publicKeys = [alarsyo hades];
"matrix-synapse/secret-config.age".publicKeys = [alarsyo hades];
@ -26,8 +24,6 @@ in {
"nextcloud/admin-pass.age".publicKeys = [alarsyo hades];
"ovh/credentials.age".publicKeys = [alarsyo hades];
"paperless/admin-password.age".publicKeys = [alarsyo hades];
"paperless/secret-key.age".publicKeys = [alarsyo hades];
@ -37,8 +33,8 @@ in {
"restic-backup/boreal-credentials.age".publicKeys = [alarsyo boreal];
"restic-backup/hades-password.age".publicKeys = [alarsyo hades];
"restic-backup/hades-credentials.age".publicKeys = [alarsyo hades];
"restic-backup/talos-password.age".publicKeys = [alarsyo talos];
"restic-backup/talos-credentials.age".publicKeys = [alarsyo talos];
"restic-backup/hephaestus-password.age".publicKeys = [alarsyo hephaestus];
"restic-backup/hephaestus-credentials.age".publicKeys = [alarsyo hephaestus];
"users/root-hashed-password.age".publicKeys = machines ++ [alarsyo];
"users/alarsyo-hashed-password.age".publicKeys = machines ++ [alarsyo];

155
pkgs/ansel/default.nix Normal file
View file

@ -0,0 +1,155 @@
{
cmake,
colord,
colord-gtk,
curl,
dav1d,
desktop-file-utils,
exiftool,
exiv2,
fetchFromGitHub,
glib,
gmic,
graphicsmagick,
gtk3,
icu,
intltool,
isocodes,
jasper,
json-glib,
lcms,
lensfun,
lib,
libXdmcp,
libXtst,
libaom,
libavif,
libdatrie,
libde265,
libepoxy,
libffi,
libgcrypt,
libgpg-error,
libheif,
libjpeg,
libpsl,
librsvg,
libsecret,
libselinux,
libsepol,
libsoup,
libsysprof-capture,
libthai,
libwebp,
libxkbcommon,
libxml2,
libxslt,
llvmPackages,
openexr_3,
openjpeg,
osm-gps-map,
pcre,
pcre2,
perlPackages,
pkg-config,
pugixml,
python3Packages,
rav1e,
sqlite,
stdenv,
util-linux,
wrapGAppsHook,
x265,
}:
stdenv.mkDerivation {
pname = "ansel";
version = "unstable-2024-01-05";
src = fetchFromGitHub {
owner = "aurelienpierreeng";
repo = "ansel";
rev = "e2c4a0a60cd80f741dd3d3c6ab72be9ac11234fb";
hash = "sha256-Kg020MHy9fn1drCk+66f25twqczvD/5evutDODqOjYM=";
fetchSubmodules = true;
};
nativeBuildInputs = [
cmake
desktop-file-utils
exiftool
intltool
libxml2
llvmPackages.clang
llvmPackages.llvm
pkg-config
perlPackages.perl
python3Packages.jsonschema
wrapGAppsHook
];
buildInputs = [
colord
colord-gtk
curl
dav1d
exiv2
json-glib
glib
gmic
graphicsmagick
gtk3
icu
isocodes
jasper
lcms
lensfun
libaom
libavif
libdatrie
libde265
libepoxy
libffi
libgcrypt
libgpg-error
libheif
libjpeg
libpsl
librsvg
libsecret
libselinux
libsepol
libsoup
libsysprof-capture
libthai
libwebp
libXdmcp
libxkbcommon
libxslt
libXtst
openexr_3
openjpeg
osm-gps-map
pcre
pcre2
perlPackages.Po4a
pugixml
rav1e
sqlite
util-linux
x265
];
preFixup = ''
gappsWrapperArgs+=(
--prefix LD_LIBRARY_PATH ":" "$out/lib/ansel"
)
'';
meta = {
description = "A darktable fork minus the bloat plus some design vision";
homepage = "https://ansel.photos/";
license = lib.licenses.gpl3Plus;
mainProgram = "ansel";
platforms = lib.platforms.linux;
};
}

View file

@ -1,4 +1,5 @@
{pkgs}: {
ansel = pkgs.callPackage ./ansel {};
sddm-sugar-candy = pkgs.callPackage ./sddm-sugar-candy {};
kaleidoscope-udev-rules = pkgs.callPackage ./kaleidoscope-udev-rules {};
grafanaDashboards = pkgs.recurseIntoAttrs (pkgs.callPackage ./grafana-dashboards {});

View file

@ -3,7 +3,7 @@
fetchurl,
python3,
}: let
version = "2.12.1";
version = "2.11.6";
in
stdenv.mkDerivation {
inherit version;
@ -15,6 +15,6 @@ in
src = fetchurl {
url = "https://www.lrde.epita.fr/dload/spot/spot-${version}.tar.gz";
sha256 = "sha256-VHfAjU4dBi8WTC5IaoNVaSXQfXDyGA3nBq96qUnG/1w=";
sha256 = "sha256-ppJ5T4nA2zlWulkZvdUxPjcuDeNAAKkCLynhxukcU4o=";
};
}

View file

@ -3,13 +3,11 @@
./vaultwarden.nix
./fail2ban.nix
./fava.nix
./forgejo
./gitea
./immich.nix
./jellyfin.nix
./lohr.nix
./matrix.nix
./mealie.nix
./media.nix
./microbin.nix
./miniflux.nix

View file

@ -1,129 +0,0 @@
{
config,
lib,
pkgs,
...
}: let
inherit
(lib)
mkEnableOption
mkIf
mkOption
;
cfg = config.my.services.forgejo;
my = config.my;
domain = config.networking.domain;
hostname = config.networking.hostName;
fqdn = "${hostname}.${domain}";
forgejoUser = "git";
in {
options.my.services.forgejo = let
inherit (lib) types;
in {
enable = mkEnableOption "Personal Git hosting with Forgejo";
privatePort = mkOption {
type = types.port;
default = 8082;
example = 8082;
description = "Port to serve the app";
};
};
config = mkIf cfg.enable {
# use git as user to have `git clone git@git.domain`
users.users.${forgejoUser} = {
description = "Forgejo Service";
home = config.services.forgejo.stateDir;
useDefaultShell = true;
group = forgejoUser;
# the systemd service for the forgejo module seems to hardcode the group as
# forgejo, so, uh, just in case?
extraGroups = ["forgejo"];
isSystemUser = true;
};
users.groups.${forgejoUser} = {};
services.forgejo = {
enable = true;
user = forgejoUser;
group = config.users.users.${forgejoUser}.group;
stateDir = "/var/lib/${forgejoUser}";
lfs.enable = true;
settings = {
server = {
ROOT_URL = "https://git.${domain}/";
DOMAIN = "git.${domain}";
HTTP_ADDR = "127.0.0.1";
HTTP_PORT = cfg.privatePort;
};
log.LEVEL = "Warn"; # [ "Trace" "Debug" "Info" "Warn" "Error" "Critical" ]
repository = {
ENABLE_PUSH_CREATE_USER = true;
DEFAULT_BRANCH = "main";
};
# NOTE: temporarily remove this for initial setup
service.DISABLE_REGISTRATION = true;
# only send cookies via HTTPS
session.COOKIE_SECURE = true;
DEFAULT.APP_NAME = "Personal Forge";
};
# NixOS module uses `forgejo dump` to backup repositories and the database,
# but it produces a single .zip file that's not very restic friendly.
# I configure my backup system manually below.
dump.enable = false;
database = {
type = "postgres";
# user needs to be the same as forgejo user
user = forgejoUser;
name = forgejoUser;
};
};
# FIXME: Borg *could* be backing up files while they're being edited by
# forgejo, so it may produce corrupt files in the snapshot if I push stuff
# around midnight. I'm not sure how `forgejo dump` handles this either,
# though.
my.services.restic-backup = {
paths = [
config.services.forgejo.lfs.contentDir
config.services.forgejo.repositoryRoot
];
};
# NOTE: no need to use postgresql.ensureDatabases because the forgejo module
# takes care of this automatically
services.postgresqlBackup = {
databases = [config.services.forgejo.database.name];
};
services.nginx = {
virtualHosts = {
"git.${domain}" = {
forceSSL = true;
useACMEHost = fqdn;
locations."/" = {
proxyPass = "http://127.0.0.1:${toString cfg.privatePort}";
};
};
};
};
security.acme.certs.${fqdn}.extraDomainNames = ["git.${domain}"];
systemd.services.forgejo.preStart = "${pkgs.coreutils}/bin/ln -sfT ${./templates} ${config.services.forgejo.stateDir}/custom/templates";
};
}

View file

@ -1,17 +0,0 @@
{{template "base/head" .}}
<div class="page-content home">
<div class="ui stackable middle very relaxed page grid">
<div class="sixteen wide center aligned centered column">
<div>
<img class="logo" width="220" height="220" src="{{AssetUrlPrefix}}/img/logo.svg"/>
</div>
<div class="hero">
<h1 class="ui icon header title">
{{AppName}}
</h1>
<h2>alarsyo's personal projects are hosted here</h2>
</div>
</div>
</div>
</div>
{{template "base/footer" .}}

View file

@ -74,7 +74,7 @@ in {
proxy_connect_timeout 600;
proxy_read_timeout 600;
proxy_send_timeout 600;
client_max_body_size 1000m;
client_max_body_size 100m;
access_log syslog:server=unix:/dev/log,tag=immich;
'';
};

View file

@ -1,122 +0,0 @@
{
config,
lib,
pkgs,
...
}: let
inherit
(lib)
mkEnableOption
mkIf
mkOption
;
cfg = config.my.services.mealie;
my = config.my;
domain = config.networking.domain;
hostname = config.networking.hostName;
fqdn = "${hostname}.${domain}";
pkg = pkgs.unstable.mealie;
listenAddress = "127.0.0.1";
in {
options.my.services.mealie = let
inherit (lib) types;
in {
enable = mkEnableOption "Mealie";
port = mkOption {
type = types.port;
example = 8080;
description = "Internal port for Mealie webapp";
};
credentialsFile = lib.mkOption {
type = types.nullOr types.path;
default = null;
example = "/run/secrets/mealie-credentials.env";
description = ''
File containing credentials used in mealie such as {env}`POSTGRES_PASSWORD`
or sensitive LDAP options.
Expects the format of an `EnvironmentFile=`, as described by {manpage}`systemd.exec(5)`.
'';
};
};
# FIXME(NixOS 24.11) Copy pasted from nixpkgs master module, because some needed changes weren't in stable yet.
config = mkIf cfg.enable (let
settings = {
ALLOW_SIGNUP = "false";
BASE_URL = "https://mealie.${domain}";
TZ = config.time.timeZone;
# Use PostgreSQL
DB_ENGINE = "postgres";
# Settings for Mealie 1.7+
POSTGRES_URL_OVERRIDE = "postgresql://mealie:@/mealie?host=/run/postgresql";
};
in {
systemd.services = {
mealie = {
after = ["network-online.target" "postgresql.service"];
requires = ["postgresql.service"];
wants = ["network-online.target"];
wantedBy = ["multi-user.target"];
description = "Mealie, a self hosted recipe manager and meal planner";
environment =
{
PRODUCTION = "true";
API_PORT = toString cfg.port;
BASE_URL = "http://localhost:${toString cfg.port}";
DATA_DIR = "/var/lib/mealie";
CRF_MODEL_PATH = "/var/lib/mealie/model.crfmodel";
}
// (builtins.mapAttrs (_: val: toString val) settings);
serviceConfig = {
DynamicUser = true;
User = "mealie";
ExecStartPre = "${pkg}/libexec/init_db";
ExecStart = "${lib.getExe pkg} -b ${listenAddress}:${builtins.toString cfg.port}";
EnvironmentFile = lib.mkIf (cfg.credentialsFile != null) cfg.credentialsFile;
StateDirectory = "mealie";
StandardOutput = "journal";
};
};
};
# Set-up database
services.postgresql = {
enable = true;
ensureDatabases = ["mealie"];
ensureUsers = [
{
name = "mealie";
ensureDBOwnership = true;
}
];
};
services.postgresqlBackup = {
databases = ["mealie"];
};
services.nginx.virtualHosts."mealie.${domain}" = {
forceSSL = true;
useACMEHost = fqdn;
locations."/" = {
proxyPass = "http://${listenAddress}:${toString cfg.port}/";
proxyWebsockets = true;
};
};
security.acme.certs.${fqdn}.extraDomainNames = ["mealie.${domain}"];
my.services.restic-backup = {
paths = ["/var/lib/mealie"];
};
});
}

View file

@ -62,11 +62,15 @@ in {
hostName = "cloud.${domain}";
https = true;
package = pkgs.nextcloud30;
package = pkgs.nextcloud27;
maxUploadSize = "1G";
config = {
overwriteProtocol = "https";
defaultPhoneRegion = "FR";
dbtype = "pgsql";
dbuser = "nextcloud";
dbname = dbName;
@ -75,11 +79,6 @@ in {
adminuser = "admin";
adminpassFile = cfg.adminpassFile;
};
settings = {
default_phone_region = "FR";
overwriteprotocol = "https";
};
};
users.groups.media.members = ["nextcloud"];

View file

@ -66,8 +66,8 @@ in {
gandiKey = config.my.secrets.gandiKey;
in {
"${fqdn}" = {
dnsProvider = "ovh";
credentialsFile = config.age.secrets."ovh/credentials".path;
dnsProvider = "gandiv5";
credentialsFile = config.age.secrets."gandi/api-key".path;
group = "nginx";
};
};

View file

@ -50,7 +50,7 @@ in {
enable = true;
port = cfg.port;
passwordFile = cfg.passwordFile;
settings = {
extraConfig = {
# Postgres settings
PAPERLESS_DBHOST = "/run/postgresql";
PAPERLESS_DBUSER = "paperless";

View file

@ -61,7 +61,7 @@ in {
proxy_connect_timeout 600;
proxy_read_timeout 600;
proxy_send_timeout 600;
client_max_body_size 500m;
client_max_body_size 100m;
access_log syslog:server=unix:/dev/log,tag=photoprism;
'';
};

View file

@ -22,6 +22,8 @@ in {
# HACK: services.pipewire.alsa doesn't exist on 20.09, avoid evaluating this
# config (my 20.09 machine is a server anyway)
config = optionalAttrs (options ? services.pipewire.alsa) (mkIf cfg.enable {
# from NixOS wiki, causes conflicts with pipewire
sound.enable = false;
# recommended for pipewire as well
security.rtkit.enable = true;
services.pipewire = {

View file

@ -1,11 +1,10 @@
{
config,
pkgs,
lib,
...
}: {
# set postgresql version so we don't get any bad surprise
config.services.postgresql = {
package = pkgs.postgresql_16;
package = pkgs.postgresql_15;
};
}

View file

@ -98,7 +98,7 @@ in {
environmentFile = cfg.environmentFile;
extraBackupArgs =
["--verbose=1"]
["--verbose=2"]
++ optional (builtins.length cfg.exclude != 0) excludeArg;
timerConfig = cfg.timerConfig;

View file

@ -19,5 +19,5 @@
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "23.11"; # Did you read the comment?
system.stateVersion = "24.05"; # Did you read the comment?
}

View file

@ -1,5 +0,0 @@
* TODO Take a look at goldwarden when 24.05 releases
https://github.com/quexten/goldwarden
* TODO Setup sway correctly