Compare commits
10 commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Antoine Martin
|
beb366f9a5 | ||
|
Antoine Martin
|
93764167e9 | ||
|
Antoine Martin
|
ae2c988bdb | ||
|
Antoine Martin
|
b05eec42c5 | ||
|
Antoine Martin
|
b28266d6ea | ||
|
Antoine Martin
|
401ee0005a | ||
|
Antoine Martin
|
2d420362ac | ||
|
Antoine Martin
|
79d60288aa | ||
|
Antoine Martin
|
3e3f4331d2 | ||
|
Antoine Martin
|
2a2275a87a |
22
.github/workflows/cachix.yaml
vendored
22
.github/workflows/cachix.yaml
vendored
|
|
@ -15,10 +15,10 @@ jobs:
|
|||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- uses: cachix/install-nix-action@v27
|
||||
- uses: cachix/install-nix-action@v25
|
||||
|
||||
- name: Run alejandra
|
||||
run: nix develop --command alejandra --check .
|
||||
run: nix run nixpkgs#alejandra -- --check .
|
||||
|
||||
flake-check:
|
||||
name: Flake check
|
||||
|
|
@ -26,9 +26,9 @@ jobs:
|
|||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- uses: cachix/install-nix-action@v27
|
||||
- uses: cachix/install-nix-action@v25
|
||||
|
||||
- uses: cachix/cachix-action@v15
|
||||
- uses: cachix/cachix-action@v14
|
||||
with:
|
||||
name: alarsyo
|
||||
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
|
||||
|
|
@ -46,6 +46,7 @@ jobs:
|
|||
fail-fast: false
|
||||
matrix:
|
||||
name:
|
||||
- ansel
|
||||
- grafanaDashboards/nginx
|
||||
- grafanaDashboards/node-exporter
|
||||
- kaleidoscope-udev-rules
|
||||
|
|
@ -55,9 +56,9 @@ jobs:
|
|||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- uses: cachix/install-nix-action@v27
|
||||
- uses: cachix/install-nix-action@v25
|
||||
|
||||
- uses: cachix/cachix-action@v15
|
||||
- uses: cachix/cachix-action@v14
|
||||
with:
|
||||
name: alarsyo
|
||||
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
|
||||
|
|
@ -77,18 +78,15 @@ jobs:
|
|||
name:
|
||||
- boreal
|
||||
- hades
|
||||
- talos
|
||||
- hephaestus
|
||||
- thanatos
|
||||
|
||||
steps:
|
||||
- name: Delete huge unnecessary tools folder
|
||||
run: rm -rf /opt/hostedtoolcache
|
||||
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- uses: cachix/install-nix-action@v27
|
||||
- uses: cachix/install-nix-action@v25
|
||||
|
||||
- uses: cachix/cachix-action@v15
|
||||
- uses: cachix/cachix-action@v14
|
||||
with:
|
||||
name: alarsyo
|
||||
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
|
||||
|
|
|
|||
|
|
@ -23,47 +23,35 @@ in {
|
|||
programs.gnupg.agent = {
|
||||
enable = true;
|
||||
enableSSHSupport = true;
|
||||
pinentryPackage = pkgs.pinentry-qt;
|
||||
pinentryFlavor = "qt";
|
||||
};
|
||||
|
||||
services = {
|
||||
xserver = {
|
||||
enable = true;
|
||||
# NOTE: could use `mkOptionDefault` but this feels more explicit
|
||||
videoDrivers =
|
||||
if config.my.gui.isNvidia
|
||||
then ["nvidia"]
|
||||
else options.services.xserver.videoDrivers.default;
|
||||
windowManager.i3.enable = true;
|
||||
xkb = {
|
||||
layout = "fr";
|
||||
variant = "us";
|
||||
};
|
||||
};
|
||||
|
||||
libinput = {
|
||||
enable = true;
|
||||
touchpad = {
|
||||
naturalScrolling = true;
|
||||
};
|
||||
};
|
||||
|
||||
logind.lidSwitch = "ignore";
|
||||
|
||||
printing = {
|
||||
enable = true;
|
||||
cups-pdf.enable = true;
|
||||
};
|
||||
|
||||
udev.packages = [pkgs.chrysalis];
|
||||
logind.lidSwitch = "ignore";
|
||||
};
|
||||
|
||||
environment.systemPackages = builtins.attrValues {
|
||||
inherit
|
||||
(pkgs)
|
||||
arandr
|
||||
chrysalis
|
||||
discord
|
||||
evince
|
||||
feh
|
||||
firefox
|
||||
ffmpeg
|
||||
gimp-with-plugins
|
||||
imagemagick
|
||||
|
|
@ -78,10 +66,58 @@ in {
|
|||
zathura
|
||||
;
|
||||
|
||||
inherit (pkgs.gnome) nautilus;
|
||||
|
||||
inherit (pkgs.libsForQt5) okular;
|
||||
|
||||
discord = pkgs.discord.override {nss = pkgs.nss_latest;};
|
||||
};
|
||||
|
||||
networking.networkmanager.enable = true;
|
||||
networking.networkmanager = {
|
||||
enable = true;
|
||||
|
||||
dispatcherScripts = [
|
||||
{
|
||||
source = let
|
||||
grep = "${pkgs.gnugrep}/bin/grep";
|
||||
nmcli = "${pkgs.networkmanager}/bin/nmcli";
|
||||
in
|
||||
pkgs.writeShellScript "disable_wifi_on_ethernet" ''
|
||||
export LC_ALL=C
|
||||
date >> /tmp/disable_wifi_on_ethernet.log
|
||||
echo START "$@" >> /tmp/disable_wifi_on_ethernet.log
|
||||
|
||||
beginswith() { case $2 in "$1"*) true;; *) false;; esac; }
|
||||
|
||||
is_ethernet_interface ()
|
||||
{
|
||||
local type="$(${nmcli} dev show "$1" | grep 'GENERAL\.TYPE:' | awk '{ print $2 }')"
|
||||
test "$type" = "ethernet" || beginswith enp "$1"
|
||||
}
|
||||
|
||||
hotspot_enabled ()
|
||||
{
|
||||
${nmcli} dev | ${grep} -q "hotspot"
|
||||
}
|
||||
|
||||
if is_ethernet_interface "$1" && ! hotspot_enabled; then
|
||||
echo "change in ethernet and not in hotspot mode" >> /tmp/disable_wifi_on_ethernet.log
|
||||
if [ "$2" = "up" ]; then
|
||||
echo "turning wifi off" >> /tmp/disable_wifi_on_ethernet.log
|
||||
nmcli radio wifi off
|
||||
fi
|
||||
|
||||
if [ "$2" = "down" ]; then
|
||||
echo "turning wifi on" >> /tmp/disable_wifi_on_ethernet.log
|
||||
nmcli radio wifi on
|
||||
fi
|
||||
fi
|
||||
echo END "$@" >> /tmp/disable_wifi_on_ethernet.log
|
||||
'';
|
||||
type = "basic";
|
||||
}
|
||||
];
|
||||
};
|
||||
programs.nm-applet.enable = true;
|
||||
programs.steam.enable = true;
|
||||
|
||||
|
|
|
|||
|
|
@ -26,22 +26,31 @@
|
|||
fd
|
||||
file
|
||||
ripgrep
|
||||
sd
|
||||
tokei
|
||||
tree
|
||||
wget
|
||||
jq
|
||||
pciutils
|
||||
usbutils
|
||||
# development
|
||||
|
||||
agenix
|
||||
alejandra
|
||||
git
|
||||
git-crypt
|
||||
git-lfs
|
||||
gnumake
|
||||
gnupg
|
||||
pinentry-qt
|
||||
python3
|
||||
vim
|
||||
# terminal utilities
|
||||
|
||||
dogdns
|
||||
du-dust
|
||||
htop
|
||||
ldns # drill
|
||||
unzip
|
||||
zip
|
||||
;
|
||||
|
|
|
|||
136
flake.lock
136
flake.lock
|
|
@ -8,11 +8,11 @@
|
|||
"systems": "systems"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1716561646,
|
||||
"narHash": "sha256-UIGtLO89RxKt7RF2iEgPikSdU53r6v/6WYB0RW3k89I=",
|
||||
"lastModified": 1707830867,
|
||||
"narHash": "sha256-PAdwm5QqdlwIqGrfzzvzZubM+FXtilekQ/FA0cI49/o=",
|
||||
"owner": "ryantm",
|
||||
"repo": "agenix",
|
||||
"rev": "c2fc0762bbe8feb06a2e59a364fa81b3a57671c9",
|
||||
"rev": "8cb01a0e717311680e0cbca06a76cbceba6f3ed6",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -48,11 +48,11 @@
|
|||
"nixpkgs": "nixpkgs_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1717032306,
|
||||
"narHash": "sha256-s3Sis+M1qTSVIehHrEKBzHBpqprIFJli5V6WojkJnYE=",
|
||||
"lastModified": 1709286488,
|
||||
"narHash": "sha256-RDpTZ72zLu05djvXRzK76Ysqp9zSdh84ax/edEaJucs=",
|
||||
"owner": "nix-community",
|
||||
"repo": "disko",
|
||||
"rev": "8ea5bcccc03111bdedaeaae9380dfab61e9deb33",
|
||||
"rev": "bde7dd352c07d43bd5b8245e6c39074a391fdd46",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -67,11 +67,11 @@
|
|||
"systems": "systems_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1710146030,
|
||||
"narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
|
||||
"lastModified": 1709126324,
|
||||
"narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
|
||||
"rev": "d465f4819400de7c8d874d50b982301f28a84605",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -81,39 +81,6 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils_2": {
|
||||
"inputs": {
|
||||
"systems": "systems_3"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1710146030,
|
||||
"narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flakey-profile": {
|
||||
"locked": {
|
||||
"lastModified": 1712898590,
|
||||
"narHash": "sha256-FhGIEU93VHAChKEXx905TSiPZKga69bWl1VB37FK//I=",
|
||||
"owner": "lf-",
|
||||
"repo": "flakey-profile",
|
||||
"rev": "243c903fd8eadc0f63d205665a92d4df91d42d9d",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "lf-",
|
||||
"repo": "flakey-profile",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"home-manager": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
|
|
@ -142,62 +109,27 @@
|
|||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1726989464,
|
||||
"narHash": "sha256-Vl+WVTJwutXkimwGprnEtXc/s/s8sMuXzqXaspIGlwM=",
|
||||
"lastModified": 1709204054,
|
||||
"narHash": "sha256-U1idK0JHs1XOfSI1APYuXi4AEADf+B+ZU4Wifc0pBHk=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "2f23fa308a7c067e52dfcc30a0758f47043ec176",
|
||||
"rev": "2f3367769a93b226c467551315e9e270c3f78b15",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"ref": "release-24.05",
|
||||
"ref": "master",
|
||||
"repo": "home-manager",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"lix": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1729298361,
|
||||
"narHash": "sha256-hiGtfzxFkDc9TSYsb96Whg0vnqBVV7CUxyscZNhed0U=",
|
||||
"rev": "ad9d06f7838a25beec425ff406fe68721fef73be",
|
||||
"type": "tarball",
|
||||
"url": "https://git.lix.systems/api/v1/repos/lix-project/lix/archive/ad9d06f7838a25beec425ff406fe68721fef73be.tar.gz?rev=ad9d06f7838a25beec425ff406fe68721fef73be"
|
||||
},
|
||||
"original": {
|
||||
"type": "tarball",
|
||||
"url": "https://git.lix.systems/lix-project/lix/archive/2.91.1.tar.gz"
|
||||
}
|
||||
},
|
||||
"lix-module": {
|
||||
"inputs": {
|
||||
"flake-utils": "flake-utils_2",
|
||||
"flakey-profile": "flakey-profile",
|
||||
"lix": "lix",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1729360442,
|
||||
"narHash": "sha256-6U0CyPycIBc04hbYy2hBINnVso58n/ZyywY2BD3hu+s=",
|
||||
"rev": "9098ac95768f7006d7e070b88bae76939f6034e6",
|
||||
"type": "tarball",
|
||||
"url": "https://git.lix.systems/api/v1/repos/lix-project/nixos-module/archive/9098ac95768f7006d7e070b88bae76939f6034e6.tar.gz?rev=9098ac95768f7006d7e070b88bae76939f6034e6"
|
||||
},
|
||||
"original": {
|
||||
"type": "tarball",
|
||||
"url": "https://git.lix.systems/lix-project/nixos-module/archive/2.91.1-1.tar.gz"
|
||||
}
|
||||
},
|
||||
"nixos-hardware": {
|
||||
"locked": {
|
||||
"lastModified": 1731797098,
|
||||
"narHash": "sha256-UhWmEZhwJZmVZ1jfHZFzCg+ZLO9Tb/v3Y6LC0UNyeTo=",
|
||||
"lastModified": 1709147990,
|
||||
"narHash": "sha256-vpXMWoaCtMYJ7lisJedCRhQG9BSsInEyZnnG5GfY9tQ=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixos-hardware",
|
||||
"rev": "672ac2ac86f7dff2f6f3406405bddecf960e0db6",
|
||||
"rev": "33a97b5814d36ddd65ad678ad07ce43b1a67f159",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -225,11 +157,11 @@
|
|||
},
|
||||
"nixpkgs-unstable-small": {
|
||||
"locked": {
|
||||
"lastModified": 1729493358,
|
||||
"narHash": "sha256-Ti+Y9nWt5Fcs3JlarxLPgIOVlbqQo7jobz/qOwOaziM=",
|
||||
"lastModified": 1709271102,
|
||||
"narHash": "sha256-Z2sBL/HRRTNABsU8E5XsP+FXBEyBoi6oMwm5bV7lSFw=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "a5e6a9e979367ee14f65d9c38119c30272f8455f",
|
||||
"rev": "09c1497ce5d4ed4a0edfdd44450d3048074cb300",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -241,11 +173,11 @@
|
|||
},
|
||||
"nixpkgs_2": {
|
||||
"locked": {
|
||||
"lastModified": 1716914467,
|
||||
"narHash": "sha256-KkT6YM/yNQqirtYj/frn6RRakliB8RDvGqVGGaNhdcU=",
|
||||
"lastModified": 1708815994,
|
||||
"narHash": "sha256-hL7N/ut2Xu0NaDxDMsw2HagAjgDskToGiyZOWriiLYM=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "4a3fc4cf736b7d2d288d7a8bf775ac8d4c0920b4",
|
||||
"rev": "9a9dae8f6319600fa9aebde37f340975cab4b8c0",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -257,16 +189,16 @@
|
|||
},
|
||||
"nixpkgs_3": {
|
||||
"locked": {
|
||||
"lastModified": 1731797254,
|
||||
"narHash": "sha256-df3dJApLPhd11AlueuoN0Q4fHo/hagP75LlM5K1sz9g=",
|
||||
"lastModified": 1709150264,
|
||||
"narHash": "sha256-HofykKuisObPUfj0E9CJVfaMhawXkYx3G8UIFR/XQ38=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "e8c38b73aeb218e27163376a2d617e61a2ad9b59",
|
||||
"rev": "9099616b93301d5cf84274b184a3a5ec69e94e08",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-24.05",
|
||||
"ref": "nixos-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
|
|
@ -277,7 +209,6 @@
|
|||
"disko": "disko",
|
||||
"flake-utils": "flake-utils",
|
||||
"home-manager": "home-manager_2",
|
||||
"lix-module": "lix-module",
|
||||
"nixos-hardware": "nixos-hardware",
|
||||
"nixpkgs": "nixpkgs_3",
|
||||
"nixpkgs-unstable-small": "nixpkgs-unstable-small"
|
||||
|
|
@ -312,21 +243,6 @@
|
|||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"systems_3": {
|
||||
"locked": {
|
||||
"lastModified": 1681028828,
|
||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
}
|
||||
},
|
||||
"root": "root",
|
||||
|
|
|
|||
49
flake.nix
49
flake.nix
|
|
@ -5,7 +5,7 @@
|
|||
type = "github";
|
||||
owner = "NixOS";
|
||||
repo = "nixpkgs";
|
||||
ref = "nixos-24.05";
|
||||
ref = "nixos-unstable";
|
||||
};
|
||||
|
||||
nixpkgs-unstable-small = {
|
||||
|
|
@ -25,7 +25,7 @@
|
|||
type = "github";
|
||||
owner = "nix-community";
|
||||
repo = "home-manager";
|
||||
ref = "release-24.05";
|
||||
ref = "master";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
|
||||
|
|
@ -49,11 +49,6 @@
|
|||
repo = "disko";
|
||||
ref = "master";
|
||||
};
|
||||
|
||||
lix-module = {
|
||||
url = "https://git.lix.systems/lix-project/nixos-module/archive/2.91.1-1.tar.gz";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
};
|
||||
|
||||
outputs = {
|
||||
|
|
@ -62,18 +57,26 @@
|
|||
home-manager,
|
||||
agenix,
|
||||
disko,
|
||||
lix-module,
|
||||
...
|
||||
} @ inputs:
|
||||
{
|
||||
nixosModules = {
|
||||
home = {
|
||||
home-manager.backupFileExtension = "hm-backup";
|
||||
home-manager.useGlobalPkgs = true;
|
||||
home-manager.useUserPackages = true;
|
||||
home-manager.users.alarsyo = import ./home;
|
||||
home-manager.verbose = true;
|
||||
};
|
||||
nix-path = {
|
||||
nix = {
|
||||
nixPath = [
|
||||
"nixpkgs=${inputs.nixpkgs}"
|
||||
];
|
||||
registry = {
|
||||
nixpkgs.flake = inputs.nixpkgs;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
overlays = import ./overlays;
|
||||
|
|
@ -99,7 +102,6 @@
|
|||
[
|
||||
agenix.nixosModules.default
|
||||
home-manager.nixosModules.default
|
||||
lix-module.nixosModules.default
|
||||
{
|
||||
nixpkgs = {
|
||||
overlays = shared_overlays;
|
||||
|
|
@ -139,6 +141,20 @@
|
|||
++ sharedModules;
|
||||
};
|
||||
|
||||
hephaestus = nixpkgs.lib.nixosSystem rec {
|
||||
inherit system;
|
||||
modules =
|
||||
[
|
||||
./hephaestus.nix
|
||||
|
||||
inputs.nixos-hardware.nixosModules.common-cpu-amd
|
||||
inputs.nixos-hardware.nixosModules.common-gpu-amd
|
||||
inputs.nixos-hardware.nixosModules.common-pc-laptop
|
||||
inputs.nixos-hardware.nixosModules.common-pc-ssd
|
||||
]
|
||||
++ sharedModules;
|
||||
};
|
||||
|
||||
talos = nixpkgs.lib.nixosSystem {
|
||||
inherit system;
|
||||
modules =
|
||||
|
|
@ -161,16 +177,11 @@
|
|||
};
|
||||
};
|
||||
}
|
||||
// inputs.flake-utils.lib.eachDefaultSystem (system: let
|
||||
pkgs = nixpkgs.legacyPackages.${system};
|
||||
in {
|
||||
// inputs.flake-utils.lib.eachDefaultSystem (system: {
|
||||
packages =
|
||||
inputs.flake-utils.lib.flattenTree
|
||||
(import ./pkgs {inherit pkgs;});
|
||||
devShells.default = pkgs.mkShellNoCC {
|
||||
buildInputs = [
|
||||
pkgs.alejandra
|
||||
];
|
||||
};
|
||||
(import ./pkgs {
|
||||
pkgs = import nixpkgs {inherit system;};
|
||||
});
|
||||
});
|
||||
}
|
||||
|
|
|
|||
23
hephaestus.nix
Normal file
23
hephaestus.nix
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
{...}: {
|
||||
imports = [
|
||||
# Default configuration
|
||||
./base
|
||||
|
||||
# Module definitions
|
||||
./modules
|
||||
|
||||
# Service definitions
|
||||
./services
|
||||
|
||||
# Host-specific config
|
||||
./hosts/hephaestus
|
||||
];
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "23.05"; # Did you read the comment?
|
||||
}
|
||||
|
|
@ -2,7 +2,6 @@
|
|||
imports = [
|
||||
./alacritty.nix
|
||||
./bat.nix
|
||||
./direnv.nix
|
||||
./emacs.nix
|
||||
./env.nix
|
||||
./firefox.nix
|
||||
|
|
@ -11,6 +10,7 @@
|
|||
./git.nix
|
||||
./gtk.nix
|
||||
./laptop.nix
|
||||
./lorri.nix
|
||||
./mail.nix
|
||||
./rbw.nix
|
||||
./rofi.nix
|
||||
|
|
|
|||
|
|
@ -43,7 +43,7 @@ in {
|
|||
|
||||
programs.emacs = {
|
||||
enable = true;
|
||||
package = pkgs.emacs29-pgtk;
|
||||
package = pkgs.emacs29;
|
||||
extraPackages = epkgs: [epkgs.vterm epkgs.pdf-tools pkgs.lilypond epkgs.mu4e];
|
||||
};
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,4 +1,7 @@
|
|||
function nfl
|
||||
set -l flags "--commit-lock-file"
|
||||
nix flake update $flags $argv
|
||||
for flake in $argv
|
||||
set -a flags "--update-input" "$flake"
|
||||
end
|
||||
nix flake lock $flags
|
||||
end
|
||||
|
|
|
|||
|
|
@ -9,15 +9,17 @@
|
|||
mkIf
|
||||
;
|
||||
|
||||
cfg = config.my.home.direnv;
|
||||
cfg = config.my.home.lorri;
|
||||
in {
|
||||
options.my.home.direnv = {
|
||||
enable = (mkEnableOption "setup direnv usage") // {default = true;};
|
||||
options.my.home.lorri = {
|
||||
enable = (mkEnableOption "lorri daemon setup") // {default = true;};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
services.lorri.enable = true;
|
||||
programs.direnv = {
|
||||
enable = true;
|
||||
# FIXME: proper file, not lorri.nix
|
||||
nix-direnv = {
|
||||
enable = true;
|
||||
};
|
||||
|
|
@ -18,10 +18,8 @@ bind ,<Space> nohlsearch
|
|||
" case insensitive if lowercase, case sensitive if using some uppercase letters
|
||||
set findcase smart
|
||||
|
||||
set modeindicatormodes {"ignore": "false"}
|
||||
|
||||
" New reddit is bad
|
||||
" autocmd DocStart ^http(s?)://www.reddit.com js tri.excmds.urlmodify("-t", "www", "old")
|
||||
autocmd DocStart ^http(s?)://www.reddit.com js tri.excmds.urlmodify("-t", "www", "old")
|
||||
|
||||
" Orange site / Reddit / Lobste.rs specific hints to toggle comments
|
||||
bind ;c hint -Jc [class*="expand"],[class="togg"],[class="comment_folder"]
|
||||
|
|
@ -38,6 +36,3 @@ blacklistadd localhost
|
|||
blacklistadd netflix.com
|
||||
blacklistadd primevideo.com
|
||||
blacklistadd youtube.com
|
||||
|
||||
" prevent teams from crashing
|
||||
seturl teams.microsoft.com superignore true
|
||||
|
|
|
|||
|
|
@ -6,12 +6,11 @@
|
|||
}: let
|
||||
inherit
|
||||
(lib)
|
||||
mkEnableOption
|
||||
mkIf
|
||||
mkOptionDefault
|
||||
;
|
||||
|
||||
isEnabled = config.my.home.x.i3.enable;
|
||||
isEnabled = config.my.home.x.enable;
|
||||
|
||||
myTerminal =
|
||||
# FIXME: fix when terminal is setup in home
|
||||
|
|
@ -27,10 +26,6 @@
|
|||
|
||||
i3Theme = config.my.theme.i3Theme;
|
||||
in {
|
||||
options.my.home.x.i3 = {
|
||||
enable = mkEnableOption "i3wm configuration";
|
||||
};
|
||||
|
||||
config = mkIf isEnabled {
|
||||
my.home = {
|
||||
flameshot.enable = true;
|
||||
|
|
|
|||
|
|
@ -24,12 +24,10 @@
|
|||
|
||||
boot.tmp.useTmpfs = true;
|
||||
|
||||
boot.supportedFilesystems = {
|
||||
btrfs = true;
|
||||
ntfs = true;
|
||||
};
|
||||
|
||||
services.xserver.windowManager.i3.enable = true;
|
||||
boot.supportedFilesystems = [
|
||||
"btrfs"
|
||||
"ntfs"
|
||||
];
|
||||
|
||||
services.btrfs = {
|
||||
autoScrub = {
|
||||
|
|
@ -86,6 +84,7 @@
|
|||
services = {
|
||||
openssh = {
|
||||
enable = true;
|
||||
forwardX11 = true;
|
||||
};
|
||||
};
|
||||
my.gui = {
|
||||
|
|
@ -93,14 +92,18 @@
|
|||
isNvidia = true;
|
||||
};
|
||||
|
||||
hardware = {
|
||||
bluetooth = {
|
||||
my.wakeonwlan.interfaces.phy0.methods = [
|
||||
"magic-packet"
|
||||
"disconnect"
|
||||
"gtk-rekey-failure"
|
||||
"eap-identity-request"
|
||||
"rfkill-release"
|
||||
];
|
||||
|
||||
services.udev.packages = [pkgs.chrysalis];
|
||||
|
||||
hardware.bluetooth = {
|
||||
enable = true;
|
||||
powerOnBoot = false;
|
||||
};
|
||||
nvidia = {
|
||||
open = true;
|
||||
modesetting.enable = true;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -4,11 +4,11 @@
|
|||
...
|
||||
}: {
|
||||
home-manager.users.alarsyo = {
|
||||
home.stateVersion = "20.09";
|
||||
# TODO: can probably upgrade me
|
||||
home.stateVersion = "21.05";
|
||||
|
||||
# Keyboard settings & i3 settings
|
||||
my.home.x.enable = true;
|
||||
my.home.x.i3.enable = true;
|
||||
my.home.x.i3bar.temperature.chip = "k10temp-pci-*";
|
||||
my.home.x.i3bar.temperature.inputs = ["Tccd1"];
|
||||
my.home.x.i3bar.networking.throughput_interfaces = ["enp8s0" "wlp4s0"];
|
||||
|
|
|
|||
|
|
@ -57,7 +57,7 @@ in {
|
|||
my.services = {
|
||||
fail2ban.enable = true;
|
||||
|
||||
forgejo = {
|
||||
gitea = {
|
||||
enable = true;
|
||||
privatePort = 8082;
|
||||
};
|
||||
|
|
@ -81,11 +81,6 @@ in {
|
|||
secretConfigFile = config.age.secrets."matrix-synapse/secret-config".path;
|
||||
};
|
||||
|
||||
mealie = {
|
||||
enable = true;
|
||||
port = 8090;
|
||||
};
|
||||
|
||||
microbin = {
|
||||
enable = true;
|
||||
privatePort = 8088;
|
||||
|
|
@ -117,6 +112,11 @@ in {
|
|||
secretKeyFile = config.age.secrets."paperless/secret-key".path;
|
||||
};
|
||||
|
||||
photoprism = {
|
||||
enable = true;
|
||||
port = 8084;
|
||||
};
|
||||
|
||||
pleroma = {
|
||||
enable = true;
|
||||
port = 8086;
|
||||
|
|
|
|||
|
|
@ -1,6 +1,8 @@
|
|||
{config, ...}: {
|
||||
home-manager.users.alarsyo = {
|
||||
home.stateVersion = "22.05";
|
||||
# TODO: can probably upgrade me
|
||||
home.stateVersion = "21.05";
|
||||
|
||||
my.theme = config.home-manager.users.alarsyo.my.themes.solarizedLight;
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -13,6 +13,8 @@
|
|||
// attrs;
|
||||
in
|
||||
lib.mapAttrs toSecret {
|
||||
"gandi/api-key" = {};
|
||||
|
||||
"lohr/shared-secret" = {};
|
||||
|
||||
"matrix-synapse/secret-config" = {
|
||||
|
|
@ -27,8 +29,6 @@
|
|||
owner = "nextcloud";
|
||||
};
|
||||
|
||||
"ovh/credentials" = {};
|
||||
|
||||
"paperless/admin-password" = {};
|
||||
"paperless/secret-key" = {};
|
||||
|
||||
|
|
|
|||
246
hosts/hephaestus/default.nix
Normal file
246
hosts/hephaestus/default.nix
Normal file
|
|
@ -0,0 +1,246 @@
|
|||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
./home.nix
|
||||
./secrets.nix
|
||||
];
|
||||
|
||||
hardware.amdgpu.opencl = false;
|
||||
|
||||
boot.kernelPackages = pkgs.linuxPackages;
|
||||
|
||||
# Use the systemd-boot EFI boot loader.
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
# boot.initrd.systemd.enable = true;
|
||||
# boot.plymouth.enable = true;
|
||||
# boot.kernelParams = ["quiet"];
|
||||
|
||||
boot.initrd.secrets = {
|
||||
"/crypto_keyfile.bin" = null;
|
||||
};
|
||||
|
||||
boot.tmp.useTmpfs = true;
|
||||
|
||||
services.btrfs = {
|
||||
autoScrub = {
|
||||
enable = true;
|
||||
fileSystems = ["/"];
|
||||
};
|
||||
};
|
||||
|
||||
networking.hostName = "hephaestus"; # Define your hostname.
|
||||
networking.domain = "alarsyo.net";
|
||||
|
||||
networking.networkmanager.enable = true;
|
||||
|
||||
# Set your time zone.
|
||||
time.timeZone = "Europe/Paris";
|
||||
|
||||
# List services that you want to enable:
|
||||
my.services = {
|
||||
tailscale = {
|
||||
enable = true;
|
||||
useRoutingFeatures = "client";
|
||||
};
|
||||
|
||||
pipewire.enable = true;
|
||||
|
||||
restic-backup = {
|
||||
enable = true;
|
||||
repo = "b2:hephaestus-backup";
|
||||
passwordFile = config.age.secrets."restic-backup/hephaestus-password".path;
|
||||
environmentFile = config.age.secrets."restic-backup/hephaestus-credentials".path;
|
||||
|
||||
timerConfig = {
|
||||
OnCalendar = "*-*-* 13:00:00"; # laptop only gets used during the day
|
||||
};
|
||||
|
||||
paths = [
|
||||
"/home/alarsyo"
|
||||
];
|
||||
exclude = [
|
||||
"/home/alarsyo/Downloads"
|
||||
|
||||
# Rust builds using half my storage capacity
|
||||
"/home/alarsyo/**/target"
|
||||
"/home/alarsyo/work/rust/build"
|
||||
|
||||
# don't backup nixpkgs
|
||||
"/home/alarsyo/work/nixpkgs"
|
||||
|
||||
"/home/alarsyo/go"
|
||||
|
||||
# C build crap
|
||||
"*.a"
|
||||
"*.o"
|
||||
"*.so"
|
||||
|
||||
".direnv"
|
||||
|
||||
# test vms
|
||||
"*.qcow2"
|
||||
|
||||
# secrets stay offline
|
||||
"/home/alarsyo/**/secrets"
|
||||
|
||||
# ignore all dotfiles as .config and .cache can become quite big
|
||||
"/home/alarsyo/.*"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
virtualisation.docker.enable = true;
|
||||
virtualisation.libvirtd.enable = true;
|
||||
programs.dconf.enable = true;
|
||||
|
||||
services = {
|
||||
tlp = {
|
||||
enable = true;
|
||||
settings = {
|
||||
START_CHARGE_THRESH_BAT0 = 70;
|
||||
STOP_CHARGE_THRESH_BAT0 = 80;
|
||||
};
|
||||
};
|
||||
fwupd.enable = true;
|
||||
openssh.enable = true;
|
||||
};
|
||||
|
||||
my.gui.enable = true;
|
||||
my.displayManager.sddm.enable = lib.mkForce false;
|
||||
|
||||
hardware.bluetooth = {
|
||||
enable = true;
|
||||
powerOnBoot = false;
|
||||
settings.General.Experimental = true;
|
||||
};
|
||||
|
||||
# Select internationalisation properties.
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
|
||||
i18n.extraLocaleSettings = {
|
||||
LC_ADDRESS = "fr_FR.UTF-8";
|
||||
LC_IDENTIFICATION = "fr_FR.UTF-8";
|
||||
LC_MEASUREMENT = "fr_FR.UTF-8";
|
||||
LC_MONETARY = "fr_FR.UTF-8";
|
||||
LC_NAME = "fr_FR.UTF-8";
|
||||
LC_PAPER = "fr_FR.UTF-8";
|
||||
LC_TELEPHONE = "fr_FR.UTF-8";
|
||||
};
|
||||
|
||||
# Enable the X11 windowing system.
|
||||
services.xserver.enable = true;
|
||||
|
||||
# Enable the KDE Plasma Desktop Environment.
|
||||
services.xserver.displayManager.sddm.enable = true;
|
||||
services.xserver.desktopManager.plasma5.enable = true;
|
||||
services.power-profiles-daemon.enable = false;
|
||||
|
||||
services.autorandr = {
|
||||
enable = true;
|
||||
profiles = {
|
||||
default = {
|
||||
fingerprint = {
|
||||
"eDP-1" = "00ffffffffffff0030e42c0600000000001c0104a51f117802aa95955e598e271b5054000000010101010101010101010101010101012e3680a070381f403020350035ae1000001ab62c80f4703816403020350035ae1000001a000000fe004c4720446973706c61790a2020000000fe004c503134305746412d535044340018";
|
||||
};
|
||||
config = {
|
||||
"eDP-1" = {
|
||||
enable = true;
|
||||
crtc = 0;
|
||||
primary = true;
|
||||
position = "0x0";
|
||||
mode = "1920x1080";
|
||||
};
|
||||
};
|
||||
};
|
||||
dock = {
|
||||
fingerprint = {
|
||||
"eDP-1" = "00ffffffffffff0030e42c0600000000001c0104a51f117802aa95955e598e271b5054000000010101010101010101010101010101012e3680a070381f403020350035ae1000001ab62c80f4703816403020350035ae1000001a000000fe004c4720446973706c61790a2020000000fe004c503134305746412d535044340018";
|
||||
"DP-4" = "00ffffffffffff0026cd4161fb060000021e0104a5351e783aee35a656529d280b5054b74f00714f818081c081009500b300d1c0d1cf023a801871382d40582c45000f282100001e000000fd00374c1e5512000a202020202020000000ff0031313634383030323031373837000000fc00504c32343933480a202020202001c9020318f14b9002030411121305141f012309070183010000023a801871382d40582c45000f282100001e8c0ad08a20e02d10103e96000f2821000018011d007251d01e206e2855000f282100001e8c0ad090204031200c4055000f28210000182a4480a070382740302035000f282100001a00000000000000000000000000a1";
|
||||
"DP-5" = "00ffffffffffff0026cd4561990000001f1c0104a5351e783ace65a657519f270f5054b30c00714f818081c081009500b300d1c00101023a801871382d40582c45000f282100001e000000fd00374c1e5311000a202020202020000000ff0031313634384238383030313533000000fc00504c32343933480a202020202001d3020318f14b9002030411121305141f012309070183010000023a801871382d40582c45000f282100001e8c0ad08a20e02d10103e96000f2821000018011d007251d01e206e2855000f282100001e8c0ad090204031200c4055000f28210000180000000000000000000000000000000000000000000000000000000000000035";
|
||||
};
|
||||
config = {
|
||||
"eDP-1" = {
|
||||
enable = true;
|
||||
primary = false;
|
||||
position = "3000x840";
|
||||
mode = "1920x1080";
|
||||
};
|
||||
"DP-4" = {
|
||||
enable = true;
|
||||
primary = true;
|
||||
position = "0x420";
|
||||
mode = "1920x1080";
|
||||
};
|
||||
"DP-5" = {
|
||||
enable = true;
|
||||
primary = false;
|
||||
position = "1920x0";
|
||||
mode = "1920x1080";
|
||||
rotate = "left";
|
||||
};
|
||||
};
|
||||
};
|
||||
dock-lid-closed = {
|
||||
fingerprint = {
|
||||
"DP-4" = "00ffffffffffff0026cd4161fb060000021e0104a5351e783aee35a656529d280b5054b74f00714f818081c081009500b300d1c0d1cf023a801871382d40582c45000f282100001e000000fd00374c1e5512000a202020202020000000ff0031313634383030323031373837000000fc00504c32343933480a202020202001c9020318f14b9002030411121305141f012309070183010000023a801871382d40582c45000f282100001e8c0ad08a20e02d10103e96000f2821000018011d007251d01e206e2855000f282100001e8c0ad090204031200c4055000f28210000182a4480a070382740302035000f282100001a00000000000000000000000000a1";
|
||||
"DP-5" = "00ffffffffffff0026cd4561990000001f1c0104a5351e783ace65a657519f270f5054b30c00714f818081c081009500b300d1c00101023a801871382d40582c45000f282100001e000000fd00374c1e5311000a202020202020000000ff0031313634384238383030313533000000fc00504c32343933480a202020202001d3020318f14b9002030411121305141f012309070183010000023a801871382d40582c45000f282100001e8c0ad08a20e02d10103e96000f2821000018011d007251d01e206e2855000f282100001e8c0ad090204031200c4055000f28210000180000000000000000000000000000000000000000000000000000000000000035";
|
||||
};
|
||||
config = {
|
||||
"DP-4" = {
|
||||
enable = true;
|
||||
primary = true;
|
||||
position = "0x420";
|
||||
mode = "1920x1080";
|
||||
};
|
||||
"DP-5" = {
|
||||
enable = true;
|
||||
primary = false;
|
||||
position = "1920x0";
|
||||
mode = "1920x1080";
|
||||
rotate = "left";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.autorandr-lid-listener = {
|
||||
wantedBy = ["multi-user.target"];
|
||||
description = "Listening for lid events to invoke autorandr";
|
||||
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
ExecStart = let
|
||||
stdbufExe = lib.getExe' pkgs.coreutils "stdbuf";
|
||||
libinputExe = lib.getExe' pkgs.libinput "libinput";
|
||||
grepExe = lib.getExe pkgs.gnugrep;
|
||||
autorandrExe = lib.getExe pkgs.autorandr;
|
||||
in
|
||||
pkgs.writeShellScript "lid-listener.sh" ''
|
||||
${stdbufExe} -oL ${libinputExe} debug-events |
|
||||
${grepExe} -E --line-buffered '^[[:space:]-]+event[0-9]+[[:space:]]+SWITCH_TOGGLE[[:space:]]' |
|
||||
while read line; do
|
||||
${pkgs.systemd}/bin/systemctl start --no-block autorandr.service
|
||||
done
|
||||
'';
|
||||
Restart = "always";
|
||||
RestartSec = "30";
|
||||
};
|
||||
};
|
||||
|
||||
# Configure console keymap
|
||||
console.keyMap = "us";
|
||||
|
||||
programs.light.enable = true;
|
||||
}
|
||||
45
hosts/hephaestus/hardware-configuration.nix
Normal file
45
hosts/hephaestus/hardware-configuration.nix
Normal file
|
|
@ -0,0 +1,45 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = ["nvme" "ehci_pci" "xhci_pci" "usb_storage" "sd_mod" "sdhci_pci"];
|
||||
boot.initrd.kernelModules = [];
|
||||
boot.kernelModules = ["kvm-amd"];
|
||||
boot.extraModulePackages = [];
|
||||
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-uuid/54ded736-367c-4081-9978-9e2d8f61cb1b";
|
||||
fsType = "btrfs";
|
||||
options = ["subvol=@"];
|
||||
};
|
||||
|
||||
boot.initrd.luks.devices."luks-df96458d-45a1-4a30-8633-58feeff603f8".device = "/dev/disk/by-uuid/df96458d-45a1-4a30-8633-58feeff603f8";
|
||||
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-uuid/826A-23F7";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
swapDevices = [];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp2s0f0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.wlp3s0.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
49
hosts/hephaestus/home.nix
Normal file
49
hosts/hephaestus/home.nix
Normal file
|
|
@ -0,0 +1,49 @@
|
|||
{
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}: {
|
||||
home-manager.users.alarsyo = {
|
||||
# TODO: can probably upgrade me
|
||||
home.stateVersion = "21.05";
|
||||
|
||||
my.home.laptop.enable = true;
|
||||
|
||||
# Keyboard settings & i3 settings
|
||||
my.home.x.enable = true;
|
||||
my.home.x.i3bar.temperature.chip = "k10temp-pci-*";
|
||||
my.home.x.i3bar.temperature.inputs = ["Tctl"];
|
||||
my.home.x.i3bar.networking.throughput_interfaces = ["wlp3s0" "enp6s0f3u1u1"];
|
||||
my.home.emacs.enable = true;
|
||||
|
||||
my.theme = config.home-manager.users.alarsyo.my.themes.solarizedLight;
|
||||
|
||||
# TODO: place in global home conf
|
||||
services.dunst.enable = true;
|
||||
|
||||
home.packages = builtins.attrValues {
|
||||
inherit
|
||||
(pkgs)
|
||||
# some websites only work there :(
|
||||
|
||||
chromium
|
||||
darktable
|
||||
# dev
|
||||
|
||||
rustup
|
||||
gdb
|
||||
valgrind
|
||||
arandr
|
||||
zotero
|
||||
;
|
||||
|
||||
inherit
|
||||
(pkgs.packages)
|
||||
ansel
|
||||
spot
|
||||
;
|
||||
|
||||
inherit (pkgs.wineWowPackages) stable;
|
||||
};
|
||||
};
|
||||
}
|
||||
23
hosts/hephaestus/secrets.nix
Normal file
23
hosts/hephaestus/secrets.nix
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
{
|
||||
config,
|
||||
lib,
|
||||
options,
|
||||
...
|
||||
}: {
|
||||
config.age = {
|
||||
secrets = let
|
||||
toSecret = name: {...} @ attrs:
|
||||
{
|
||||
file = ./../../modules/secrets + "/${name}.age";
|
||||
}
|
||||
// attrs;
|
||||
in
|
||||
lib.mapAttrs toSecret {
|
||||
"restic-backup/hephaestus-credentials" = {};
|
||||
"restic-backup/hephaestus-password" = {};
|
||||
|
||||
"users/alarsyo-hashed-password" = {};
|
||||
"users/root-hashed-password" = {};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -16,16 +16,9 @@
|
|||
./secrets.nix
|
||||
];
|
||||
|
||||
boot.kernelPackages = pkgs.linuxPackages_6_11;
|
||||
# Set Wi-Fi regulatory domain. Currently always set to '00' (world), and could
|
||||
# lead to bad Wi-Fi performance
|
||||
boot.kernelParams = ["cfg80211.ieee80211_regdom=FR"];
|
||||
boot.extraModulePackages = with config.boot.kernelPackages; [
|
||||
v4l2loopback
|
||||
];
|
||||
boot.extraModprobeConfig = ''
|
||||
options v4l2loopback devices=1 video_nr=1 card_label="OBS Cam" exclusive_caps=1
|
||||
'';
|
||||
hardware.amdgpu.opencl = false;
|
||||
|
||||
boot.kernelPackages = pkgs.linuxPackages_6_6;
|
||||
|
||||
# Use the systemd-boot EFI boot loader.
|
||||
boot.loader.systemd-boot = {
|
||||
|
|
@ -48,10 +41,7 @@
|
|||
networking.domain = "alarsyo.net";
|
||||
# Pick only one of the below networking options.
|
||||
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
|
||||
networking.networkmanager = {
|
||||
enable = true;
|
||||
wifi.powersave = true;
|
||||
};
|
||||
networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
|
||||
|
||||
# Set your time zone.
|
||||
time.timeZone = "Europe/Paris";
|
||||
|
|
@ -61,6 +51,7 @@
|
|||
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||||
|
||||
programs = {
|
||||
dconf.enable = true;
|
||||
light.enable = true;
|
||||
};
|
||||
services = {
|
||||
|
|
@ -69,10 +60,7 @@
|
|||
};
|
||||
virtualisation = {
|
||||
docker.enable = true;
|
||||
libvirtd.enable = false;
|
||||
virtualbox.host = {
|
||||
enable = false;
|
||||
};
|
||||
libvirtd.enable = true;
|
||||
};
|
||||
|
||||
my.services = {
|
||||
|
|
@ -82,54 +70,10 @@
|
|||
};
|
||||
|
||||
pipewire.enable = true;
|
||||
|
||||
restic-backup = {
|
||||
enable = true;
|
||||
repo = "b2:talos-backup";
|
||||
passwordFile = config.age.secrets."restic-backup/talos-password".path;
|
||||
environmentFile = config.age.secrets."restic-backup/talos-credentials".path;
|
||||
|
||||
timerConfig = {
|
||||
OnCalendar = "*-*-* 13:00:00"; # laptop only gets used during the day
|
||||
};
|
||||
|
||||
paths = [
|
||||
"/home/alarsyo"
|
||||
];
|
||||
exclude = [
|
||||
"/home/alarsyo/Downloads"
|
||||
|
||||
# Rust builds using half my storage capacity
|
||||
"/home/alarsyo/**/target"
|
||||
"/home/alarsyo/work/rust/build"
|
||||
|
||||
# don't backup nixpkgs
|
||||
"/home/alarsyo/work/nixpkgs"
|
||||
|
||||
"/home/alarsyo/go"
|
||||
|
||||
# C build crap
|
||||
"*.a"
|
||||
"*.o"
|
||||
"*.so"
|
||||
|
||||
".direnv"
|
||||
|
||||
# test vms
|
||||
"*.qcow2"
|
||||
"*.vbox"
|
||||
"*.vdi"
|
||||
|
||||
# secrets stay offline
|
||||
"/home/alarsyo/**/secrets"
|
||||
|
||||
# ignore all dotfiles as .config and .cache can become quite big
|
||||
"/home/alarsyo/.*"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
my.gui.enable = true;
|
||||
my.displayManager.sddm.enable = lib.mkForce false;
|
||||
|
||||
hardware.bluetooth = {
|
||||
enable = true;
|
||||
|
|
@ -152,21 +96,22 @@
|
|||
LC_TELEPHONE = "fr_FR.UTF-8";
|
||||
};
|
||||
|
||||
# Enable the X11 windowing system.
|
||||
services.xserver.enable = true;
|
||||
|
||||
# Enable the KDE Plasma Desktop Environment.
|
||||
services.desktopManager.plasma6.enable = true;
|
||||
services.xserver.displayManager.sddm = {
|
||||
enable = true;
|
||||
wayland.enable = true;
|
||||
};
|
||||
services.xserver.desktopManager.plasma5.enable = true;
|
||||
services.power-profiles-daemon.enable = true;
|
||||
|
||||
environment.systemPackages = [
|
||||
pkgs.unstable.zed-editor
|
||||
pkgs.foot
|
||||
];
|
||||
|
||||
#programs.hyprland.enable = true;
|
||||
programs.hyprland.enable = true;
|
||||
programs.sway = {
|
||||
enable = true;
|
||||
wrapperFeatures.gtk = true;
|
||||
};
|
||||
|
||||
# Copy the NixOS configuration file and link it from the resulting system
|
||||
# (/run/current-system/configuration.nix). This is useful in case you
|
||||
# accidentally delete configuration.nix.
|
||||
|
|
|
|||
|
|
@ -20,7 +20,7 @@
|
|||
};
|
||||
};
|
||||
luks = {
|
||||
size = "600G";
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "luks";
|
||||
name = "crypted";
|
||||
|
|
@ -35,24 +35,19 @@
|
|||
type = "btrfs";
|
||||
extraArgs = ["-f"];
|
||||
subvolumes = {
|
||||
"@" = {
|
||||
"/root" = {
|
||||
mountpoint = "/";
|
||||
mountOptions = ["compress=zstd" "noatime"];
|
||||
};
|
||||
"@home" = {
|
||||
"/home" = {
|
||||
mountpoint = "/home";
|
||||
mountOptions = ["compress=zstd" "noatime"];
|
||||
};
|
||||
"@nix" = {
|
||||
"/nix" = {
|
||||
mountpoint = "/nix";
|
||||
mountOptions = ["compress=zstd" "noatime"];
|
||||
};
|
||||
"@persist" = {
|
||||
mountpoint = "/persist";
|
||||
mountOptions = ["compress=zstd" "noatime"];
|
||||
};
|
||||
"@snapshots" = {};
|
||||
"@swap" = {
|
||||
"/swap" = {
|
||||
mountpoint = "/.swapvol";
|
||||
swap.swapfile.size = "8G";
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,16 +1,10 @@
|
|||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
inherit
|
||||
(lib)
|
||||
mkOptionDefault
|
||||
;
|
||||
in {
|
||||
}: {
|
||||
home-manager.users.alarsyo = {
|
||||
home.stateVersion = "23.11";
|
||||
home.stateVersion = "24.05";
|
||||
|
||||
my.home.laptop.enable = true;
|
||||
|
||||
|
|
@ -29,101 +23,26 @@ in {
|
|||
home.packages = builtins.attrValues {
|
||||
inherit
|
||||
(pkgs)
|
||||
ansel
|
||||
chromium # some websites only work there :(
|
||||
# some websites only work there :(
|
||||
|
||||
chromium
|
||||
darktable
|
||||
# dev
|
||||
|
||||
rustup
|
||||
gdb
|
||||
valgrind
|
||||
arandr
|
||||
zotero
|
||||
;
|
||||
|
||||
inherit
|
||||
(pkgs.packages)
|
||||
spot
|
||||
;
|
||||
};
|
||||
#inherit
|
||||
# (pkgs.packages)
|
||||
# ansel
|
||||
# spot
|
||||
# ;
|
||||
|
||||
wayland.windowManager.sway = {
|
||||
enable = true;
|
||||
swaynag.enable = true;
|
||||
wrapperFeatures.gtk = true;
|
||||
config = {
|
||||
modifier = "Mod4";
|
||||
input = {
|
||||
"type:keyboard" = {
|
||||
xkb_layout = "fr";
|
||||
xkb_variant = "us";
|
||||
};
|
||||
"type:touchpad" = {
|
||||
dwt = "enabled";
|
||||
tap = "enabled";
|
||||
middle_emulation = "enabled";
|
||||
natural_scroll = "enabled";
|
||||
};
|
||||
};
|
||||
output = {
|
||||
"eDP-1" = {
|
||||
scale = "1.5";
|
||||
};
|
||||
};
|
||||
fonts = {
|
||||
names = ["Iosevka Fixed" "FontAwesome6Free"];
|
||||
size = 9.0;
|
||||
};
|
||||
bars = [
|
||||
{
|
||||
mode = "dock";
|
||||
hiddenState = "hide";
|
||||
position = "top";
|
||||
workspaceButtons = true;
|
||||
workspaceNumbers = true;
|
||||
statusCommand = "${pkgs.i3status}/bin/i3status";
|
||||
fonts = {
|
||||
names = ["Iosevka Fixed" "FontAwesome6Free"];
|
||||
size = 9.0;
|
||||
};
|
||||
trayOutput = "primary";
|
||||
colors = {
|
||||
background = "#000000";
|
||||
statusline = "#ffffff";
|
||||
separator = "#666666";
|
||||
focusedWorkspace = {
|
||||
border = "#4c7899";
|
||||
background = "#285577";
|
||||
text = "#ffffff";
|
||||
};
|
||||
activeWorkspace = {
|
||||
border = "#333333";
|
||||
background = "#5f676a";
|
||||
text = "#ffffff";
|
||||
};
|
||||
inactiveWorkspace = {
|
||||
border = "#333333";
|
||||
background = "#222222";
|
||||
text = "#888888";
|
||||
};
|
||||
urgentWorkspace = {
|
||||
border = "#2f343a";
|
||||
background = "#900000";
|
||||
text = "#ffffff";
|
||||
};
|
||||
bindingMode = {
|
||||
border = "#2f343a";
|
||||
background = "#900000";
|
||||
text = "#ffffff";
|
||||
};
|
||||
};
|
||||
}
|
||||
];
|
||||
|
||||
keybindings = mkOptionDefault {
|
||||
"Mod4+i" = "exec emacsclient --create-frame";
|
||||
};
|
||||
};
|
||||
};
|
||||
programs = {
|
||||
fuzzel.enable = true;
|
||||
swaylock.enable = true;
|
||||
waybar = {
|
||||
enable = true;
|
||||
};
|
||||
inherit (pkgs.wineWowPackages) stable;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -13,8 +13,8 @@
|
|||
// attrs;
|
||||
in
|
||||
lib.mapAttrs toSecret {
|
||||
"restic-backup/talos-credentials" = {};
|
||||
"restic-backup/talos-password" = {};
|
||||
#"restic-backup/hephaestus-credentials" = {};
|
||||
#"restic-backup/hephaestus-password" = {};
|
||||
|
||||
"users/alarsyo-hashed-password" = {};
|
||||
"users/root-hashed-password" = {};
|
||||
|
|
|
|||
|
|
@ -35,56 +35,6 @@ in {
|
|||
};
|
||||
|
||||
services = {
|
||||
gitlab-runner = {
|
||||
enable = true;
|
||||
settings = {
|
||||
concurrent = 4;
|
||||
};
|
||||
services = {
|
||||
nix = {
|
||||
authenticationTokenConfigFile = config.age.secrets."gitlab-runner/thanatos-nix-runner-env".path;
|
||||
dockerImage = "alpine";
|
||||
dockerVolumes = [
|
||||
"/nix/store:/nix/store:ro"
|
||||
"/nix/var/nix/db:/nix/var/nix/db:ro"
|
||||
"/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro"
|
||||
];
|
||||
dockerDisableCache = true;
|
||||
preBuildScript = pkgs.writeScript "setup-container" ''
|
||||
mkdir -p -m 0755 /nix/var/log/nix/drvs
|
||||
mkdir -p -m 0755 /nix/var/nix/gcroots
|
||||
mkdir -p -m 0755 /nix/var/nix/profiles
|
||||
mkdir -p -m 0755 /nix/var/nix/temproots
|
||||
mkdir -p -m 0755 /nix/var/nix/userpool
|
||||
mkdir -p -m 1777 /nix/var/nix/gcroots/per-user
|
||||
mkdir -p -m 1777 /nix/var/nix/profiles/per-user
|
||||
mkdir -p -m 0755 /nix/var/nix/profiles/per-user/root
|
||||
mkdir -p -m 0700 "$HOME/.nix-defexpr"
|
||||
|
||||
. ${pkgs.nix}/etc/profile.d/nix.sh
|
||||
|
||||
${pkgs.nix}/bin/nix-env -i ${lib.concatStringsSep " " (with pkgs; [nix cacert git openssh])}
|
||||
|
||||
${pkgs.nix}/bin/nix-channel --add https://nixos.org/channels/nixpkgs-unstable
|
||||
${pkgs.nix}/bin/nix-channel --update nixpkgs
|
||||
|
||||
mkdir -p ~/.config/nix
|
||||
echo "experimental-features = nix-command flakes" > ~/.config/nix/nix.conf
|
||||
'';
|
||||
environmentVariables = {
|
||||
ENV = "/etc/profile";
|
||||
USER = "root";
|
||||
NIX_REMOTE = "daemon";
|
||||
PATH = "/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/bin:/sbin:/usr/bin:/usr/sbin";
|
||||
NIX_SSL_CERT_FILE = "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt";
|
||||
};
|
||||
};
|
||||
default = {
|
||||
authenticationTokenConfigFile = config.age.secrets."gitlab-runner/thanatos-runner-env".path;
|
||||
dockerImage = "debian:stable";
|
||||
};
|
||||
};
|
||||
};
|
||||
openssh.enable = true;
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
{config, ...}: {
|
||||
home-manager.users.alarsyo = {
|
||||
home.stateVersion = "23.11";
|
||||
# TODO: can probably upgrade me
|
||||
home.stateVersion = "21.05";
|
||||
|
||||
my.theme = config.home-manager.users.alarsyo.my.themes.solarizedLight;
|
||||
};
|
||||
|
|
|
|||
|
|
@ -15,8 +15,6 @@
|
|||
lib.mapAttrs toSecret {
|
||||
"users/alarsyo-hashed-password" = {};
|
||||
"users/root-hashed-password" = {};
|
||||
"gitlab-runner/thanatos-runner-env" = {};
|
||||
"gitlab-runner/thanatos-nix-runner-env" = {};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -15,17 +15,23 @@ in {
|
|||
options.my.displayManager.sddm.enable = mkEnableOption "SDDM setup";
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
services.displayManager.sddm = {
|
||||
services.xserver.displayManager.sddm = {
|
||||
enable = true;
|
||||
theme = "catppuccin-latte";
|
||||
wayland.enable = true;
|
||||
theme = "sugar-candy";
|
||||
};
|
||||
|
||||
environment.systemPackages = [
|
||||
(pkgs.catppuccin-sddm.override
|
||||
{
|
||||
flavor = "latte";
|
||||
})
|
||||
];
|
||||
environment.systemPackages = builtins.attrValues {
|
||||
inherit
|
||||
(pkgs.packages)
|
||||
sddm-sugar-candy
|
||||
;
|
||||
|
||||
inherit
|
||||
(pkgs.libsForQt5.qt5)
|
||||
qtgraphicaleffects
|
||||
qtquickcontrols2
|
||||
qtsvg
|
||||
;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
Binary file not shown.
|
|
@ -1,7 +0,0 @@
|
|||
age-encryption.org/v1
|
||||
-> ssh-ed25519 k2gHjw naNq55qkAm47KXPJpYFDjVQuxPz2Ffpima5z1WEqRSA
|
||||
ETC3Hh4gglwYpiJCu/EGOUzjN3BJYk8yJshMeMkgYug
|
||||
-> ssh-ed25519 6UUuZw Azk9jDbUL/nO20lvzs0s36q/4ZcWSpkUbt1J/PE7A2M
|
||||
kPKHGLoWHDpFhsRr+CBteWKYsDw0dn/+IKbrh/5qMoE
|
||||
--- g1akMn28voSQByQR9/ArJ4CsQehcwJ7MfCco+k2fPWo
|
||||
› YMZÓíî:ú{R^n~ó½±ã¢ÊwPaª§h£8<C2A3>T'hc mªe(<28>‘ÝXx=7”‹‡Ë¢[äË4@b=“&ª®æYÅ;‘€Ü[„ª¹ØÁˆß¿kôk>ˆ5’4‚0ÞGâŒ÷ðÌŸ±Q<C2B1>Êë·±Ÿw¡
|
||||
|
|
@ -1,7 +0,0 @@
|
|||
age-encryption.org/v1
|
||||
-> ssh-ed25519 k2gHjw XED7gkKAp1ioBegA7ryqULRF1BORpW74esfIGp9zPE8
|
||||
ANxnQN+tox9KYdZvNZFZvQxOymckldPQMhFnz6fSIBo
|
||||
-> ssh-ed25519 pX8y2g 9wgPqL6GoOxad5AAUmDAYj0h/57AEM8VsQKq1pGTtjM
|
||||
SxD++XJioZLpt6C8Xse5Nmz4wtL0Fb5NKWo5ijKpyv8
|
||||
--- 3qOJnkY3Uc4fIex9mgz2+w+su5dS7K7Tmtk1hiqkn9M
|
||||
ÁXª¨àeéˆaLQ H2*ZÅTé¿ ‘®P;Ý(jCÌ€k‡ viäµû<C2B5>ÿ’ħ¡à†kæ`™ô]mò<6D> ÿBñ ,³±,ü÷?!¶{àŠ%eÙì(„Su¿-SŸD¢¾“=H#‡„¼Þq=ï<>Uùí;=OÍ <÷R¼ÇÎE±“<+&èdÂæ<18>>G+_ oP¥Þ]ÿê¦RÄßL$Ö³\š°ü0ø¤N!þ"Áã&÷%Nž à<ËÃ,òv°1ÿ‘Ê‘Új1
|
||||
9
modules/secrets/restic-backup/hephaestus-credentials.age
Normal file
9
modules/secrets/restic-backup/hephaestus-credentials.age
Normal file
|
|
@ -0,0 +1,9 @@
|
|||
age-encryption.org/v1
|
||||
-> ssh-ed25519 k2gHjw tTdHZJpSocTHlznYH9eRzeZkrYBbsdT4F8jV1FKw/yk
|
||||
xKIkYhL/A8wTy6LqDkTuUvm4rhDI6+DXwjzl43PcR8E
|
||||
-> ssh-ed25519 SYm+hA vzQCZWYdgG0yxUEyGJ4Q8EAh1Kzw5CutDa6q6XSaels
|
||||
Y7VqpvLfrUvWZcXqGeulRld9kff03kgzz22UBW77AOw
|
||||
-> j-c8-grease
|
||||
WeQ
|
||||
--- KHLA1KlfWM432GDbPIiKInzZeqVRJZ2YCKtF3qClfgs
|
||||
ü8Êâ5œ¢|<7C>ŒòQx_5':Á½È ´A?îÎÚ¡ÄÛ ØŠ¾þèoA‘x‰)rýd!Š(´®”èѨ5£¸ìô~ý\†ŽLd "^ÑZ¨Z^®…Vï/‡§5Ë•¶¢¨Ý¦<C39D>a诲áḷo]O/®Eueà†
|
||||
9
modules/secrets/restic-backup/hephaestus-password.age
Normal file
9
modules/secrets/restic-backup/hephaestus-password.age
Normal file
|
|
@ -0,0 +1,9 @@
|
|||
age-encryption.org/v1
|
||||
-> ssh-ed25519 k2gHjw 2/spllcr7Fo+1sQ4VJW/MywBVUcpKEbicv4vZQyre0c
|
||||
Vc2Wugxc5M4i73UKMFXWA2PeHgUOm/+HekoeYt9ycro
|
||||
-> ssh-ed25519 SYm+hA KFjo2JVxpdOey8A7GAKeZci+ezE0RYBRKR8vNtloU3M
|
||||
SAzpTjF/RGOgjawT2Sk5H7TNnk/SdbksuAcZZqakJOs
|
||||
-> !!6BS-grease Gs<Om0
|
||||
d7WvJNMg3OX9CwWvGNWCuViu1X+e9oFE5vZQixfaJI3xKax2lTNh
|
||||
--- QICRX2ve/1CFNHjnVXDpue3DRlFbTftu9yrWw745gVk
|
||||
|†`F…3Þ°˜¤VEû²ÊósßK³ÞQwÿÙ$ùÉŒ{‘¨¯†>¹Hˆ7Þh™î”Ä©Û’2ÅïÂÈÆcH^¸“×÷Ÿ© X_ñæzv'¢ÄÐ!Zkš_„þÉ0Ë}Yo•je§¼<icé{SkÁ|1Ÿalé*ü7ÓÖ3Å ŒF«Þ9j¬\§X{¢¾#H7ÑŒ¢!>< .^¸¿[ï£q4åpP
|
||||
|
|
@ -1,7 +0,0 @@
|
|||
age-encryption.org/v1
|
||||
-> ssh-ed25519 k2gHjw WWJQxqfxQzLmBFPpTzuKBMhAl+ZxnQdvnaDvfpwxR00
|
||||
tEsf6xSw/MP/qJnr/SyLlkEEf/LaI7IxjVzaxRwh5FI
|
||||
-> ssh-ed25519 nh0dAQ yRu0VZqx+DuB3SSQaVtg+txuRu9OyJDfLDNCKg9XYk0
|
||||
xTpucapaejG2EMrZLIDt46JD3QYM4XXT1Y2F77HPQO8
|
||||
--- uZjO0dDIFesU2B/GkjpqrOJas1+K6hGbQAdFV/t1GOk
|
||||
BV͵Ç\Õ 8 Û‘¾ºý[%<25>½l^>9<>\Eö5¹šþ¿Új(6èÜgå;(I7CS4èv6ièÉÐþSªÐXïC»ï`OòT™ŒÓÚ\ô;I·Ýœ ò6ƒ<36>_k˜éy-‡±¹½qKl†¾ôKþÓ hŠ?tô
|
||||
Binary file not shown.
|
|
@ -4,18 +4,16 @@ let
|
|||
|
||||
boreal = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAagal1aqZh52wEmgsw7fkCzO41o4Cx+nV4wJGZuX1RP root@boreal";
|
||||
hades = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMxw8CtKUPAiPdKDEnuS7UyRrZN5BkUwsy5UPVF8V+lt root@hades";
|
||||
hephaestus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA7Cp+n5+huof68QlAoJV8bVf5h5p9kEZFAVpltWopdL root@hephaestus";
|
||||
talos = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMBYcmL9HZJ9SqB9OJwQ0Nt6ZbvHZTS+fzM8A6D5MPZs root@talos";
|
||||
thanatos = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID8JEAWk/8iSl8fN6/f76JkmVFwtyixTpLol4zSVsnVw root@thanatos";
|
||||
|
||||
machines = [boreal hades talos thanatos];
|
||||
machines = [boreal hades hephaestus talos thanatos];
|
||||
|
||||
all = users ++ machines;
|
||||
in {
|
||||
"gandi/api-key.age".publicKeys = [alarsyo hades];
|
||||
|
||||
"gitlab-runner/thanatos-runner-env.age".publicKeys = [alarsyo thanatos];
|
||||
"gitlab-runner/thanatos-nix-runner-env.age".publicKeys = [alarsyo thanatos];
|
||||
|
||||
"lohr/shared-secret.age".publicKeys = [alarsyo hades];
|
||||
|
||||
"matrix-synapse/secret-config.age".publicKeys = [alarsyo hades];
|
||||
|
|
@ -26,8 +24,6 @@ in {
|
|||
|
||||
"nextcloud/admin-pass.age".publicKeys = [alarsyo hades];
|
||||
|
||||
"ovh/credentials.age".publicKeys = [alarsyo hades];
|
||||
|
||||
"paperless/admin-password.age".publicKeys = [alarsyo hades];
|
||||
"paperless/secret-key.age".publicKeys = [alarsyo hades];
|
||||
|
||||
|
|
@ -37,8 +33,8 @@ in {
|
|||
"restic-backup/boreal-credentials.age".publicKeys = [alarsyo boreal];
|
||||
"restic-backup/hades-password.age".publicKeys = [alarsyo hades];
|
||||
"restic-backup/hades-credentials.age".publicKeys = [alarsyo hades];
|
||||
"restic-backup/talos-password.age".publicKeys = [alarsyo talos];
|
||||
"restic-backup/talos-credentials.age".publicKeys = [alarsyo talos];
|
||||
"restic-backup/hephaestus-password.age".publicKeys = [alarsyo hephaestus];
|
||||
"restic-backup/hephaestus-credentials.age".publicKeys = [alarsyo hephaestus];
|
||||
|
||||
"users/root-hashed-password.age".publicKeys = machines ++ [alarsyo];
|
||||
"users/alarsyo-hashed-password.age".publicKeys = machines ++ [alarsyo];
|
||||
|
|
|
|||
155
pkgs/ansel/default.nix
Normal file
155
pkgs/ansel/default.nix
Normal file
|
|
@ -0,0 +1,155 @@
|
|||
{
|
||||
cmake,
|
||||
colord,
|
||||
colord-gtk,
|
||||
curl,
|
||||
dav1d,
|
||||
desktop-file-utils,
|
||||
exiftool,
|
||||
exiv2,
|
||||
fetchFromGitHub,
|
||||
glib,
|
||||
gmic,
|
||||
graphicsmagick,
|
||||
gtk3,
|
||||
icu,
|
||||
intltool,
|
||||
isocodes,
|
||||
jasper,
|
||||
json-glib,
|
||||
lcms,
|
||||
lensfun,
|
||||
lib,
|
||||
libXdmcp,
|
||||
libXtst,
|
||||
libaom,
|
||||
libavif,
|
||||
libdatrie,
|
||||
libde265,
|
||||
libepoxy,
|
||||
libffi,
|
||||
libgcrypt,
|
||||
libgpg-error,
|
||||
libheif,
|
||||
libjpeg,
|
||||
libpsl,
|
||||
librsvg,
|
||||
libsecret,
|
||||
libselinux,
|
||||
libsepol,
|
||||
libsoup,
|
||||
libsysprof-capture,
|
||||
libthai,
|
||||
libwebp,
|
||||
libxkbcommon,
|
||||
libxml2,
|
||||
libxslt,
|
||||
llvmPackages,
|
||||
openexr_3,
|
||||
openjpeg,
|
||||
osm-gps-map,
|
||||
pcre,
|
||||
pcre2,
|
||||
perlPackages,
|
||||
pkg-config,
|
||||
pugixml,
|
||||
python3Packages,
|
||||
rav1e,
|
||||
sqlite,
|
||||
stdenv,
|
||||
util-linux,
|
||||
wrapGAppsHook,
|
||||
x265,
|
||||
}:
|
||||
stdenv.mkDerivation {
|
||||
pname = "ansel";
|
||||
version = "unstable-2024-01-05";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "aurelienpierreeng";
|
||||
repo = "ansel";
|
||||
rev = "e2c4a0a60cd80f741dd3d3c6ab72be9ac11234fb";
|
||||
hash = "sha256-Kg020MHy9fn1drCk+66f25twqczvD/5evutDODqOjYM=";
|
||||
fetchSubmodules = true;
|
||||
};
|
||||
|
||||
nativeBuildInputs = [
|
||||
cmake
|
||||
desktop-file-utils
|
||||
exiftool
|
||||
intltool
|
||||
libxml2
|
||||
llvmPackages.clang
|
||||
llvmPackages.llvm
|
||||
pkg-config
|
||||
perlPackages.perl
|
||||
python3Packages.jsonschema
|
||||
wrapGAppsHook
|
||||
];
|
||||
|
||||
buildInputs = [
|
||||
colord
|
||||
colord-gtk
|
||||
curl
|
||||
dav1d
|
||||
exiv2
|
||||
json-glib
|
||||
glib
|
||||
gmic
|
||||
graphicsmagick
|
||||
gtk3
|
||||
icu
|
||||
isocodes
|
||||
jasper
|
||||
lcms
|
||||
lensfun
|
||||
libaom
|
||||
libavif
|
||||
libdatrie
|
||||
libde265
|
||||
libepoxy
|
||||
libffi
|
||||
libgcrypt
|
||||
libgpg-error
|
||||
libheif
|
||||
libjpeg
|
||||
libpsl
|
||||
librsvg
|
||||
libsecret
|
||||
libselinux
|
||||
libsepol
|
||||
libsoup
|
||||
libsysprof-capture
|
||||
libthai
|
||||
libwebp
|
||||
libXdmcp
|
||||
libxkbcommon
|
||||
libxslt
|
||||
libXtst
|
||||
openexr_3
|
||||
openjpeg
|
||||
osm-gps-map
|
||||
pcre
|
||||
pcre2
|
||||
perlPackages.Po4a
|
||||
pugixml
|
||||
rav1e
|
||||
sqlite
|
||||
util-linux
|
||||
x265
|
||||
];
|
||||
|
||||
preFixup = ''
|
||||
gappsWrapperArgs+=(
|
||||
--prefix LD_LIBRARY_PATH ":" "$out/lib/ansel"
|
||||
)
|
||||
'';
|
||||
|
||||
meta = {
|
||||
description = "A darktable fork minus the bloat plus some design vision";
|
||||
homepage = "https://ansel.photos/";
|
||||
license = lib.licenses.gpl3Plus;
|
||||
mainProgram = "ansel";
|
||||
platforms = lib.platforms.linux;
|
||||
};
|
||||
}
|
||||
|
|
@ -1,4 +1,5 @@
|
|||
{pkgs}: {
|
||||
ansel = pkgs.callPackage ./ansel {};
|
||||
sddm-sugar-candy = pkgs.callPackage ./sddm-sugar-candy {};
|
||||
kaleidoscope-udev-rules = pkgs.callPackage ./kaleidoscope-udev-rules {};
|
||||
grafanaDashboards = pkgs.recurseIntoAttrs (pkgs.callPackage ./grafana-dashboards {});
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@
|
|||
fetchurl,
|
||||
python3,
|
||||
}: let
|
||||
version = "2.12.1";
|
||||
version = "2.11.6";
|
||||
in
|
||||
stdenv.mkDerivation {
|
||||
inherit version;
|
||||
|
|
@ -15,6 +15,6 @@ in
|
|||
|
||||
src = fetchurl {
|
||||
url = "https://www.lrde.epita.fr/dload/spot/spot-${version}.tar.gz";
|
||||
sha256 = "sha256-VHfAjU4dBi8WTC5IaoNVaSXQfXDyGA3nBq96qUnG/1w=";
|
||||
sha256 = "sha256-ppJ5T4nA2zlWulkZvdUxPjcuDeNAAKkCLynhxukcU4o=";
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -3,13 +3,11 @@
|
|||
./vaultwarden.nix
|
||||
./fail2ban.nix
|
||||
./fava.nix
|
||||
./forgejo
|
||||
./gitea
|
||||
./immich.nix
|
||||
./jellyfin.nix
|
||||
./lohr.nix
|
||||
./matrix.nix
|
||||
./mealie.nix
|
||||
./media.nix
|
||||
./microbin.nix
|
||||
./miniflux.nix
|
||||
|
|
|
|||
|
|
@ -1,129 +0,0 @@
|
|||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
inherit
|
||||
(lib)
|
||||
mkEnableOption
|
||||
mkIf
|
||||
mkOption
|
||||
;
|
||||
|
||||
cfg = config.my.services.forgejo;
|
||||
my = config.my;
|
||||
|
||||
domain = config.networking.domain;
|
||||
hostname = config.networking.hostName;
|
||||
fqdn = "${hostname}.${domain}";
|
||||
|
||||
forgejoUser = "git";
|
||||
in {
|
||||
options.my.services.forgejo = let
|
||||
inherit (lib) types;
|
||||
in {
|
||||
enable = mkEnableOption "Personal Git hosting with Forgejo";
|
||||
|
||||
privatePort = mkOption {
|
||||
type = types.port;
|
||||
default = 8082;
|
||||
example = 8082;
|
||||
description = "Port to serve the app";
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
# use git as user to have `git clone git@git.domain`
|
||||
users.users.${forgejoUser} = {
|
||||
description = "Forgejo Service";
|
||||
home = config.services.forgejo.stateDir;
|
||||
useDefaultShell = true;
|
||||
group = forgejoUser;
|
||||
|
||||
# the systemd service for the forgejo module seems to hardcode the group as
|
||||
# forgejo, so, uh, just in case?
|
||||
extraGroups = ["forgejo"];
|
||||
|
||||
isSystemUser = true;
|
||||
};
|
||||
users.groups.${forgejoUser} = {};
|
||||
|
||||
services.forgejo = {
|
||||
enable = true;
|
||||
user = forgejoUser;
|
||||
group = config.users.users.${forgejoUser}.group;
|
||||
stateDir = "/var/lib/${forgejoUser}";
|
||||
|
||||
lfs.enable = true;
|
||||
|
||||
settings = {
|
||||
server = {
|
||||
ROOT_URL = "https://git.${domain}/";
|
||||
DOMAIN = "git.${domain}";
|
||||
HTTP_ADDR = "127.0.0.1";
|
||||
HTTP_PORT = cfg.privatePort;
|
||||
};
|
||||
log.LEVEL = "Warn"; # [ "Trace" "Debug" "Info" "Warn" "Error" "Critical" ]
|
||||
repository = {
|
||||
ENABLE_PUSH_CREATE_USER = true;
|
||||
DEFAULT_BRANCH = "main";
|
||||
};
|
||||
|
||||
# NOTE: temporarily remove this for initial setup
|
||||
service.DISABLE_REGISTRATION = true;
|
||||
|
||||
# only send cookies via HTTPS
|
||||
session.COOKIE_SECURE = true;
|
||||
|
||||
DEFAULT.APP_NAME = "Personal Forge";
|
||||
};
|
||||
|
||||
# NixOS module uses `forgejo dump` to backup repositories and the database,
|
||||
# but it produces a single .zip file that's not very restic friendly.
|
||||
# I configure my backup system manually below.
|
||||
dump.enable = false;
|
||||
|
||||
database = {
|
||||
type = "postgres";
|
||||
# user needs to be the same as forgejo user
|
||||
user = forgejoUser;
|
||||
name = forgejoUser;
|
||||
};
|
||||
};
|
||||
|
||||
# FIXME: Borg *could* be backing up files while they're being edited by
|
||||
# forgejo, so it may produce corrupt files in the snapshot if I push stuff
|
||||
# around midnight. I'm not sure how `forgejo dump` handles this either,
|
||||
# though.
|
||||
my.services.restic-backup = {
|
||||
paths = [
|
||||
config.services.forgejo.lfs.contentDir
|
||||
config.services.forgejo.repositoryRoot
|
||||
];
|
||||
};
|
||||
|
||||
# NOTE: no need to use postgresql.ensureDatabases because the forgejo module
|
||||
# takes care of this automatically
|
||||
services.postgresqlBackup = {
|
||||
databases = [config.services.forgejo.database.name];
|
||||
};
|
||||
|
||||
services.nginx = {
|
||||
virtualHosts = {
|
||||
"git.${domain}" = {
|
||||
forceSSL = true;
|
||||
useACMEHost = fqdn;
|
||||
|
||||
locations."/" = {
|
||||
proxyPass = "http://127.0.0.1:${toString cfg.privatePort}";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
security.acme.certs.${fqdn}.extraDomainNames = ["git.${domain}"];
|
||||
|
||||
systemd.services.forgejo.preStart = "${pkgs.coreutils}/bin/ln -sfT ${./templates} ${config.services.forgejo.stateDir}/custom/templates";
|
||||
};
|
||||
}
|
||||
|
|
@ -1,17 +0,0 @@
|
|||
{{template "base/head" .}}
|
||||
<div class="page-content home">
|
||||
<div class="ui stackable middle very relaxed page grid">
|
||||
<div class="sixteen wide center aligned centered column">
|
||||
<div>
|
||||
<img class="logo" width="220" height="220" src="{{AssetUrlPrefix}}/img/logo.svg"/>
|
||||
</div>
|
||||
<div class="hero">
|
||||
<h1 class="ui icon header title">
|
||||
{{AppName}}
|
||||
</h1>
|
||||
<h2>alarsyo's personal projects are hosted here</h2>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
{{template "base/footer" .}}
|
||||
|
|
@ -74,7 +74,7 @@ in {
|
|||
proxy_connect_timeout 600;
|
||||
proxy_read_timeout 600;
|
||||
proxy_send_timeout 600;
|
||||
client_max_body_size 1000m;
|
||||
client_max_body_size 100m;
|
||||
access_log syslog:server=unix:/dev/log,tag=immich;
|
||||
'';
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,122 +0,0 @@
|
|||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
inherit
|
||||
(lib)
|
||||
mkEnableOption
|
||||
mkIf
|
||||
mkOption
|
||||
;
|
||||
|
||||
cfg = config.my.services.mealie;
|
||||
my = config.my;
|
||||
|
||||
domain = config.networking.domain;
|
||||
hostname = config.networking.hostName;
|
||||
fqdn = "${hostname}.${domain}";
|
||||
pkg = pkgs.unstable.mealie;
|
||||
listenAddress = "127.0.0.1";
|
||||
in {
|
||||
options.my.services.mealie = let
|
||||
inherit (lib) types;
|
||||
in {
|
||||
enable = mkEnableOption "Mealie";
|
||||
port = mkOption {
|
||||
type = types.port;
|
||||
example = 8080;
|
||||
description = "Internal port for Mealie webapp";
|
||||
};
|
||||
credentialsFile = lib.mkOption {
|
||||
type = types.nullOr types.path;
|
||||
default = null;
|
||||
example = "/run/secrets/mealie-credentials.env";
|
||||
description = ''
|
||||
File containing credentials used in mealie such as {env}`POSTGRES_PASSWORD`
|
||||
or sensitive LDAP options.
|
||||
|
||||
Expects the format of an `EnvironmentFile=`, as described by {manpage}`systemd.exec(5)`.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
# FIXME(NixOS 24.11) Copy pasted from nixpkgs master module, because some needed changes weren't in stable yet.
|
||||
config = mkIf cfg.enable (let
|
||||
settings = {
|
||||
ALLOW_SIGNUP = "false";
|
||||
BASE_URL = "https://mealie.${domain}";
|
||||
TZ = config.time.timeZone;
|
||||
|
||||
# Use PostgreSQL
|
||||
DB_ENGINE = "postgres";
|
||||
|
||||
# Settings for Mealie 1.7+
|
||||
POSTGRES_URL_OVERRIDE = "postgresql://mealie:@/mealie?host=/run/postgresql";
|
||||
};
|
||||
in {
|
||||
systemd.services = {
|
||||
mealie = {
|
||||
after = ["network-online.target" "postgresql.service"];
|
||||
requires = ["postgresql.service"];
|
||||
wants = ["network-online.target"];
|
||||
wantedBy = ["multi-user.target"];
|
||||
|
||||
description = "Mealie, a self hosted recipe manager and meal planner";
|
||||
|
||||
environment =
|
||||
{
|
||||
PRODUCTION = "true";
|
||||
API_PORT = toString cfg.port;
|
||||
BASE_URL = "http://localhost:${toString cfg.port}";
|
||||
DATA_DIR = "/var/lib/mealie";
|
||||
CRF_MODEL_PATH = "/var/lib/mealie/model.crfmodel";
|
||||
}
|
||||
// (builtins.mapAttrs (_: val: toString val) settings);
|
||||
|
||||
serviceConfig = {
|
||||
DynamicUser = true;
|
||||
User = "mealie";
|
||||
ExecStartPre = "${pkg}/libexec/init_db";
|
||||
ExecStart = "${lib.getExe pkg} -b ${listenAddress}:${builtins.toString cfg.port}";
|
||||
EnvironmentFile = lib.mkIf (cfg.credentialsFile != null) cfg.credentialsFile;
|
||||
StateDirectory = "mealie";
|
||||
StandardOutput = "journal";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Set-up database
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
ensureDatabases = ["mealie"];
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "mealie";
|
||||
ensureDBOwnership = true;
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
services.postgresqlBackup = {
|
||||
databases = ["mealie"];
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."mealie.${domain}" = {
|
||||
forceSSL = true;
|
||||
useACMEHost = fqdn;
|
||||
|
||||
locations."/" = {
|
||||
proxyPass = "http://${listenAddress}:${toString cfg.port}/";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
};
|
||||
|
||||
security.acme.certs.${fqdn}.extraDomainNames = ["mealie.${domain}"];
|
||||
|
||||
my.services.restic-backup = {
|
||||
paths = ["/var/lib/mealie"];
|
||||
};
|
||||
});
|
||||
}
|
||||
|
|
@ -62,11 +62,15 @@ in {
|
|||
|
||||
hostName = "cloud.${domain}";
|
||||
https = true;
|
||||
package = pkgs.nextcloud29;
|
||||
package = pkgs.nextcloud27;
|
||||
|
||||
maxUploadSize = "1G";
|
||||
|
||||
config = {
|
||||
overwriteProtocol = "https";
|
||||
|
||||
defaultPhoneRegion = "FR";
|
||||
|
||||
dbtype = "pgsql";
|
||||
dbuser = "nextcloud";
|
||||
dbname = dbName;
|
||||
|
|
@ -75,11 +79,6 @@ in {
|
|||
adminuser = "admin";
|
||||
adminpassFile = cfg.adminpassFile;
|
||||
};
|
||||
|
||||
settings = {
|
||||
default_phone_region = "FR";
|
||||
overwriteprotocol = "https";
|
||||
};
|
||||
};
|
||||
|
||||
users.groups.media.members = ["nextcloud"];
|
||||
|
|
|
|||
|
|
@ -66,8 +66,8 @@ in {
|
|||
gandiKey = config.my.secrets.gandiKey;
|
||||
in {
|
||||
"${fqdn}" = {
|
||||
dnsProvider = "ovh";
|
||||
credentialsFile = config.age.secrets."ovh/credentials".path;
|
||||
dnsProvider = "gandiv5";
|
||||
credentialsFile = config.age.secrets."gandi/api-key".path;
|
||||
group = "nginx";
|
||||
};
|
||||
};
|
||||
|
|
|
|||
|
|
@ -50,7 +50,7 @@ in {
|
|||
enable = true;
|
||||
port = cfg.port;
|
||||
passwordFile = cfg.passwordFile;
|
||||
settings = {
|
||||
extraConfig = {
|
||||
# Postgres settings
|
||||
PAPERLESS_DBHOST = "/run/postgresql";
|
||||
PAPERLESS_DBUSER = "paperless";
|
||||
|
|
|
|||
|
|
@ -61,7 +61,7 @@ in {
|
|||
proxy_connect_timeout 600;
|
||||
proxy_read_timeout 600;
|
||||
proxy_send_timeout 600;
|
||||
client_max_body_size 500m;
|
||||
client_max_body_size 100m;
|
||||
access_log syslog:server=unix:/dev/log,tag=photoprism;
|
||||
'';
|
||||
};
|
||||
|
|
|
|||
|
|
@ -98,7 +98,7 @@ in {
|
|||
environmentFile = cfg.environmentFile;
|
||||
|
||||
extraBackupArgs =
|
||||
["--verbose=1"]
|
||||
["--verbose=2"]
|
||||
++ optional (builtins.length cfg.exclude != 0) excludeArg;
|
||||
|
||||
timerConfig = cfg.timerConfig;
|
||||
|
|
|
|||
|
|
@ -19,5 +19,5 @@
|
|||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "23.11"; # Did you read the comment?
|
||||
system.stateVersion = "24.05"; # Did you read the comment?
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue