zuckerberg/nix-config
zuckerberg/nix-config
1
0
Fork 0
Code Issues Pull Requests Actions Activity

migrate to nixos modules

Browse Source
This commit is contained in:
zuckerberg 2021-04-11 21:43:27 -04:00
parent 7b70b48de4
commit a9c6b46ff5
25 changed files with 544 additions and 459 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
common/boot/bios.nix
View File

@ -1,12 +1,28 @@
{ config, pkgs, ... }:
{ lib, config, pkgs, ... }:
{
# Use GRUB 2 for BIOS
boot.loader.grub = {
enable = true;
version = 2;
useOSProber = true;
configurationLimit = 20;
theme = pkgs.nixos-grub2-theme;
with lib;
let
cfg = config.bios;
in {
options.bios = {
enable = mkEnableOption "enable bios boot";
device = mkOption {
type = types.str;
};
};
config = mkIf cfg.enable {
# Use GRUB 2 for BIOS
boot.loader = {
timeout = 2;
grub = {
enable = true;
device = cfg.device;
version = 2;
useOSProber = true;
configurationLimit = 20;
theme = pkgs.nixos-grub2-theme;
};
};
};
}

38
common/boot/efi.nix
View File

@ -1,18 +1,28 @@
{ config, pkgs, ... }:
{ lib, config, pkgs, ... }:
{
# Use GRUB2 for EFI
boot.loader = {
efi.canTouchEfiVariables = true;
grub = {
enable = true;
device = "nodev";
version = 2;
efiSupport = true;
useOSProber = true;
# memtest86.enable = true;
configurationLimit = 20;
theme = pkgs.nixos-grub2-theme;
with lib;
let
cfg = config.efi;
in {
options.efi = {
enable = mkEnableOption "enable efi boot";
};
config = mkIf cfg.enable {
# Use GRUB2 for EFI
boot.loader = {
efi.canTouchEfiVariables = true;
timeout = 2;
grub = {
enable = true;
device = "nodev";
version = 2;
efiSupport = true;
useOSProber = true;
# memtest86.enable = true;
configurationLimit = 20;
theme = pkgs.nixos-grub2-theme;
};
};
};
}

146
common/boot/luks.nix
View File

@ -1,59 +1,101 @@
{ config, pkgs, lib, ... }:
{
# Unlock LUKS disk over ssh
boot.initrd.network.enable = true;
boot.initrd.kernelModules = [ "e1000" "e1000e" "virtio_pci" "r8169" ];
boot.initrd.network.ssh = {
enable = true;
port = 22;
hostKeys = [
"/secret/ssh_host_rsa_key"
"/secret/ssh_host_ed25519_key"
];
authorizedKeys = config.users.users.googlebot.openssh.authorizedKeys.keys;
let
cfg = config.luks;
in {
options.luks = {
enable = lib.mkEnableOption "enable luks root remote decrypt over ssh/tor";
device = {
name = lib.mkOption {
type = lib.types.str;
default = "enc-pv";
};
path = lib.mkOption {
type = lib.types.either lib.types.str lib.types.path;
};
allowDiscards = lib.mkOption {
type = lib.types.bool;
default = false;
};
};
sshHostKeys = lib.mkOption {
type = lib.types.listOf (lib.types.either lib.types.str lib.types.path);
default = [
"/secret/ssh_host_rsa_key"
"/secret/ssh_host_ed25519_key"
];
};
sshAuthorizedKeys = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = config.users.users.googlebot.openssh.authorizedKeys.keys;
};
onionConfig = lib.mkOption {
type = lib.types.path;
default = /secret/onion;
};
kernelModules = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ "e1000" "e1000e" "virtio_pci" "r8169" ];
};
};
boot.initrd.postDeviceCommands = ''
echo 'waiting for root device to be opened...'
mkfifo /crypt-ramfs/passphrase
echo /crypt-ramfs/passphrase >> /dev/null
'';
config = lib.mkIf cfg.enable {
boot.initrd.luks.devices.${cfg.device.name} = {
device = cfg.device.path;
allowDiscards = cfg.device.allowDiscards;
};
# Make machine accessable over tor for boot unlock
boot.initrd.secrets = {
"/etc/tor/onion/bootup" = /secret/onion;
# Unlock LUKS disk over ssh
boot.initrd.network.enable = true;
boot.initrd.kernelModules = cfg.kernelModules;
boot.initrd.network.ssh = {
enable = true;
port = 22;
hostKeys = cfg.sshHostKeys;
authorizedKeys = cfg.sshAuthorizedKeys;
};
boot.initrd.postDeviceCommands = ''
echo 'waiting for root device to be opened...'
mkfifo /crypt-ramfs/passphrase
echo /crypt-ramfs/passphrase >> /dev/null
'';
# Make machine accessable over tor for boot unlock
boot.initrd.secrets = {
"/etc/tor/onion/bootup" = cfg.onionConfig;
};
boot.initrd.extraUtilsCommands = ''
copy_bin_and_libs ${pkgs.tor}/bin/tor
copy_bin_and_libs ${pkgs.haveged}/bin/haveged
'';
# start tor during boot process
boot.initrd.network.postCommands = let
torRc = (pkgs.writeText "tor.rc" ''
DataDirectory /etc/tor
SOCKSPort 127.0.0.1:9050 IsolateDestAddr
SOCKSPort 127.0.0.1:9063
HiddenServiceDir /etc/tor/onion/bootup
HiddenServicePort 22 127.0.0.1:22
'');
in ''
# Add nice prompt for giving LUKS passphrase over ssh
echo 'read -s -p "Unlock Passphrase: " passphrase && echo $passphrase > /crypt-ramfs/passphrase && exit' >> /root/.profile
echo "tor: preparing onion folder"
# have to do this otherwise tor does not want to start
chmod -R 700 /etc/tor
echo "make sure localhost is up"
ip a a 127.0.0.1/8 dev lo
ip link set lo up
echo "haveged: starting haveged"
haveged -F &
echo "tor: starting tor"
tor -f ${torRc} --verify-config
tor -f ${torRc} &
'';
};
boot.initrd.extraUtilsCommands = ''
copy_bin_and_libs ${pkgs.tor}/bin/tor
copy_bin_and_libs ${pkgs.haveged}/bin/haveged
'';
# start tor during boot process
boot.initrd.network.postCommands = let
torRc = (pkgs.writeText "tor.rc" ''
DataDirectory /etc/tor
SOCKSPort 127.0.0.1:9050 IsolateDestAddr
SOCKSPort 127.0.0.1:9063
HiddenServiceDir /etc/tor/onion/bootup
HiddenServicePort 22 127.0.0.1:22
'');
in ''
# Add nice prompt for giving LUKS passphrase over ssh
echo 'read -s -p "Unlock Passphrase: " passphrase && echo $passphrase > /crypt-ramfs/passphrase && exit' >> /root/.profile
echo "tor: preparing onion folder"
# have to do this otherwise tor does not want to start
chmod -R 700 /etc/tor
echo "make sure localhost is up"
ip a a 127.0.0.1/8 dev lo
ip link set lo up
echo "haveged: starting haveged"
haveged -F &
echo "tor: starting tor"
tor -f ${torRc} --verify-config
tor -f ${torRc} &
'';
}

9
common/common.nix
View File

@ -4,11 +4,18 @@
imports = [
./flakes.nix
./boot/firmware.nix
./boot/efi.nix
./boot/bios.nix
./boot/luks.nix
./server/nginx.nix
./server/thelounge.nix
./server/mumble.nix
./pc/de.nix
];
system.stateVersion = "20.09";
boot.loader.timeout = 2;
networking.useDHCP = false;
time.timeZone = "America/New_York";
i18n.defaultLocale = "en_US.UTF-8";

46
common/pc/audio.nix
View File

@ -1,28 +1,32 @@
{ config, pkgs, ... }:
{ lib, config, pkgs, ... }:
{
# Audio
sound.enable = true;
let
cfg = config.de;
in {
config = lib.mkIf cfg.enable {
# Audio
sound.enable = true;
# enable pulseaudio support for packages
nixpkgs.config.pulseaudio = true;
# enable pulseaudio support for packages
nixpkgs.config.pulseaudio = true;
# realtime pulseaudio
security.rtkit.enable = true;
# realtime pulseaudio
security.rtkit.enable = true;
hardware.pulseaudio = {
enable = true;
support32Bit = true;
package = pkgs.pulseaudioFull; # bt headset support
hardware.pulseaudio = {
enable = true;
support32Bit = true;
package = pkgs.pulseaudioFull; # bt headset support
# TODO: switch on connect isn't working for some reason (at least when in kde)
extraConfig = "
load-module module-switch-on-connect
load-module module-switch-on-connect ignore_virtual=no
";
# TODO: switch on connect isn't working for some reason (at least when in kde)
extraConfig = "
load-module module-switch-on-connect
load-module module-switch-on-connect ignore_virtual=no
";
};
users.users.googlebot.extraGroups = [ "audio" ];
# bt headset support
hardware.bluetooth.enable = true;
};
users.users.googlebot.extraGroups = [ "audio" ];
# bt headset support
hardware.bluetooth.enable = true;
}

74
common/pc/chromium.nix
View File

@ -1,40 +1,44 @@
{ config, pkgs, ... }:
{ lib, config, pkgs, ... }:
{
# chromium with specific extensions + settings
programs.chromium = {
enable = true;
extensions = [
"cjpalhdlnbpafiamejdnhcphjbkeiagm" # ublock origin
"gcbommkclmclpchllfjekcdonpmejbdp" # https everywhere
"oboonakemofpalcgghocfoadofidjkkk" # keepassxc plugin
"cimiefiiaegbelhefglklhhakcgmhkai" # plasma integration
"hkgfoiooedgoejojocmhlaklaeopbecg" # picture in picture
];
extraOpts = {
"BrowserSignin" = 0;
"SyncDisabled" = true;
"PasswordManagerEnabled" = false;
"SpellcheckEnabled" = true;
"SpellcheckLanguage" = [ "en-US" ];
let
cfg = config.de;
in {
config = lib.mkIf cfg.enable {
# chromium with specific extensions + settings
programs.chromium = {
enable = true;
extensions = [
"cjpalhdlnbpafiamejdnhcphjbkeiagm" # ublock origin
"gcbommkclmclpchllfjekcdonpmejbdp" # https everywhere
"oboonakemofpalcgghocfoadofidjkkk" # keepassxc plugin
"cimiefiiaegbelhefglklhhakcgmhkai" # plasma integration
"hkgfoiooedgoejojocmhlaklaeopbecg" # picture in picture
];
extraOpts = {
"BrowserSignin" = 0;
"SyncDisabled" = true;
"PasswordManagerEnabled" = false;
"SpellcheckEnabled" = true;
"SpellcheckLanguage" = [ "en-US" ];
};
defaultSearchProviderSuggestURL = null;
defaultSearchProviderSearchURL = " https://duckduckgo.com/?q={searchTerms}&kp=-1&kl=us-en";
};
defaultSearchProviderSuggestURL = null;
defaultSearchProviderSearchURL = " https://duckduckgo.com/?q={searchTerms}&kp=-1&kl=us-en";
};
# hardware accelerated video playback (on intel)
nixpkgs.config.packageOverrides = pkgs: {
vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; };
chromium = pkgs.chromium.override { enableVaapi = true; };
# hardware accelerated video playback (on intel)
nixpkgs.config.packageOverrides = pkgs: {
vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; };
chromium = pkgs.chromium.override { enableVaapi = true; };
};
hardware.opengl = {
enable = true;
extraPackages = with pkgs; [
intel-media-driver # LIBVA_DRIVER_NAME=iHD
vaapiIntel # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium)
vaapiVdpau
libvdpau-va-gl
];
extraPackages32 = with pkgs.pkgsi686Linux; [ vaapiIntel ];
};
};
hardware.opengl = {
enable = true;
extraPackages = with pkgs; [
intel-media-driver # LIBVA_DRIVER_NAME=iHD
vaapiIntel # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium)
vaapiVdpau
libvdpau-va-gl
];
extraPackages32 = with pkgs.pkgsi686Linux; [ vaapiIntel ];
};
}

54
common/pc/de.nix
View File

@ -1,7 +1,8 @@
{ config, pkgs, lib, ... }:
{
# General
let
cfg = config.de;
in {
imports = [
./kde.nix
./xfce.nix
@ -14,32 +15,39 @@
./vscodium.nix
./discord.nix
./steam.nix
./touchpad.nix
];
# allow specific unfree packages
nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
"tigervnc" "font-bh-lucidatypewriter" # tigervnc
"steam" "steam-original" "steam-runtime" # TODO move to steam.nix
"discord" # TODO move to discord.nix
];
options.de = {
enable = lib.mkEnableOption "enable desktop environment";
};
# vulkan
hardware.opengl.driSupport = true;
hardware.opengl.driSupport32Bit = true;
config = lib.mkIf cfg.enable {
# allow specific unfree packages
nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
"tigervnc" "font-bh-lucidatypewriter" # tigervnc
"steam" "steam-original" "steam-runtime" # TODO move to steam.nix
"discord" # TODO move to discord.nix
];
# Applications
users.users.googlebot.packages = with pkgs; [
chromium keepassxc mumble tigervnc bluez-tools vscodium element-desktop mpv
];
# vulkan
hardware.opengl.driSupport = true;
hardware.opengl.driSupport32Bit = true;
# Networking
networking.networkmanager.enable = true;
users.users.googlebot.extraGroups = [ "networkmanager" ];
# Applications
users.users.googlebot.packages = with pkgs; [
chromium keepassxc mumble tigervnc bluez-tools vscodium element-desktop mpv
];
# Printing
services.printing.enable = true;
# Networking
networking.networkmanager.enable = true;
users.users.googlebot.extraGroups = [ "networkmanager" ];
# Security
services.gnome3.gnome-keyring.enable = true;
security.pam.services.googlebot.enableGnomeKeyring = true;
# Printing
services.printing.enable = true;
# Security
services.gnome3.gnome-keyring.enable = true;
security.pam.services.googlebot.enableGnomeKeyring = true;
};
}

14
common/pc/discord.nix
View File

@ -1,7 +1,11 @@
{ config, pkgs, ... }:
{ lib, config, pkgs, ... }:
{
users.users.googlebot.packages = [
pkgs.discord
];
let
cfg = config.de;
in {
config = lib.mkIf cfg.enable {
users.users.googlebot.packages = [
pkgs.discord
];
};
}

8
common/pc/firefox.nix
View File

@ -1,4 +1,4 @@
{ config, pkgs, ... }:
{ lib, config, pkgs, ... }:
#
# Sort of private firefox
@ -12,6 +12,8 @@
#
let
cfg = config.de;
somewhatPrivateFF = pkgs.firefox-unwrapped.override {
privacySupport = true;
webrtcSupport = true; # mostly private ;)
@ -87,5 +89,7 @@ let
};
in
{
users.users.googlebot.packages = [ firefox ];
config = lib.mkIf cfg.enable {
users.users.googlebot.packages = [ firefox ];
};
}

30
common/pc/kde.nix
View File

@ -1,16 +1,20 @@
{ config, pkgs, ... }:
{ lib, config, pkgs, ... }:
{
# kde plasma
services.xserver = {
enable = true;
desktopManager.plasma5.enable = true;
displayManager.sddm.enable = true;
};
let
cfg = config.de;
in {
config = lib.mkIf cfg.enable {
# kde plasma
services.xserver = {
enable = true;
desktopManager.plasma5.enable = true;
displayManager.sddm.enable = true;
};
# kde apps
nixpkgs.config.firefox.enablePlasmaBrowserIntegration = true;
users.users.googlebot.packages = with pkgs; [
akonadi kmail plasma5Packages.kmail-account-wizard
];
# kde apps
nixpkgs.config.firefox.enablePlasmaBrowserIntegration = true;
users.users.googlebot.packages = with pkgs; [
akonadi kmail plasma5Packages.kmail-account-wizard
];
};
}

42
common/pc/pithos.nix
View File

@ -1,22 +1,26 @@
{ config, pkgs, ... }:
{ lib, config, pkgs, ... }:
{
nixpkgs.overlays = [
(self: super: {
pithos = super.pithos.overrideAttrs (old: rec {
pname = "pithos";
version = "1.5.1";
src = super.fetchFromGitHub {
owner = pname;
repo = pname;
rev = version;
sha256 = "il7OAALpHFZ6wjco9Asp04zWHCD8Ni+iBdiJWcMiQA4=";
};
});
})
];
let
cfg = config.de;
in {
config = lib.mkIf cfg.enable {
nixpkgs.overlays = [
(self: super: {
pithos = super.pithos.overrideAttrs (old: rec {
pname = "pithos";
version = "1.5.1";
src = super.fetchFromGitHub {
owner = pname;
repo = pname;
rev = version;
sha256 = "il7OAALpHFZ6wjco9Asp04zWHCD8Ni+iBdiJWcMiQA4=";
};
});
})
];
users.users.googlebot.packages = with pkgs; [
pithos
];
users.users.googlebot.packages = with pkgs; [
pithos
];
};
}

18
common/pc/steam.nix
View File

@ -1,10 +1,14 @@
{ config, pkgs, ... }:
{ lib, config, pkgs, ... }:
{
programs.steam.enable = true;
hardware.steam-hardware.enable = true; # steam controller
let
cfg = config.de;
in {
config = lib.mkIf cfg.enable {
programs.steam.enable = true;
hardware.steam-hardware.enable = true; # steam controller
users.users.googlebot.packages = [
pkgs.steam
];
users.users.googlebot.packages = [
pkgs.steam
];
};
}

38
common/pc/torbrowser.nix
View File

@ -1,20 +1,24 @@
{ config, pkgs, ... }:
{ lib, config, pkgs, ... }:
{
nixpkgs.overlays = [
(self: super: {
tor-browser-bundle-bin = super.tor-browser-bundle-bin.overrideAttrs (old: rec {
version = "10.0.10";
lang = "en-US";
src = pkgs.fetchurl {
url = "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz";
sha256 = "vYWZ+NsGN8YH5O61+zrUjlFv3rieaBqjBQ+a18sQcZg=";
};
});
})
];
let
cfg = config.de;
in {
config = lib.mkIf cfg.enable {
nixpkgs.overlays = [
(self: super: {
tor-browser-bundle-bin = super.tor-browser-bundle-bin.overrideAttrs (old: rec {
version = "10.0.10";
lang = "en-US";
src = pkgs.fetchurl {
url = "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz";
sha256 = "vYWZ+NsGN8YH5O61+zrUjlFv3rieaBqjBQ+a18sQcZg=";
};
});
})
];
users.users.googlebot.packages = with pkgs; [
tor-browser-bundle-bin
];
users.users.googlebot.packages = with pkgs; [
tor-browser-bundle-bin
];
};
}

16
common/pc/touchpad.nix
View File

@ -1,6 +1,14 @@
{ config, pkgs, ... }:
{ lib, config, pkgs, ... }:
{
services.xserver.libinput.enable = true;
services.xserver.libinput.touchpad.naturalScrolling = true;
let
cfg = config.de.touchpad;
in {
options.de.touchpad = {
enable = lib.mkEnableOption "enable touchpad";
};
config = lib.mkIf cfg.enable {
services.xserver.libinput.enable = true;
services.xserver.libinput.touchpad.naturalScrolling = true;
};
}

12
common/pc/vscodium.nix
View File

@ -1,6 +1,8 @@
{ config, pkgs, ... }:
{ lib, config, pkgs, ... }:
let
cfg = config.de;
extensions = with pkgs.vscode-extensions; [
bbenoist.Nix # nix syntax support
# arrterian.nix-env-selector # nix dev envs
@ -12,7 +14,9 @@ let
};
in
{
users.users.googlebot.packages = [
vscodium-with-extensions
];
config = lib.mkIf cfg.enable {
users.users.googlebot.packages = [
vscodium-with-extensions
];
};
}

28
common/pc/xfce.nix
View File

@ -1,16 +1,20 @@
{ config, pkgs, ... }:
{ lib, config, pkgs, ... }:
{
services.xserver = {
enable = true;
desktopManager = {
xterm.enable = false;
xfce.enable = true;
let
cfg = config.de;
in {
config = lib.mkIf cfg.enable {
services.xserver = {
enable = true;
desktopManager = {
xterm.enable = false;
xfce.enable = true;
};
displayManager.sddm.enable = true;
};
displayManager.sddm.enable = true;
};
# xfce apps
users.users.googlebot.packages = with pkgs; [
];
# xfce apps
users.users.googlebot.packages = with pkgs; [
];
};
}

14
common/pc/yubikey.nix
View File

@ -1,7 +1,11 @@
{ config, pkgs, ... }:
{ lib, config, pkgs, ... }:
{
# yubikey
services.pcscd.enable = true;
services.udev.packages = [ pkgs.yubikey-personalization ];
let
cfg = config.de;
in {
config = lib.mkIf cfg.enable {
# yubikey
services.pcscd.enable = true;
services.udev.packages = [ pkgs.yubikey-personalization ];
};
}

49
common/server/mumble.nix
View File

@ -1,31 +1,34 @@
{ config, ... }:
{ lib, config, ... }:
let
murmurPort = 23563;
domain = "voice.neet.space";
let
cfg = config.services.murmur;
certs = config.security.acme.certs;
in {
config.networking.firewall.allowedTCPPorts = [ murmurPort ];
config.networking.firewall.allowedUDPPorts = [ murmurPort ];
config.services.murmur = {
enable = true;
port = murmurPort;
sslCa = "${certs.${domain}.directory}/chain.pem";
sslKey = "${certs.${domain}.directory}/key.pem";
sslCert = "${certs.${domain}.directory}/fullchain.pem";
welcometext = "Welcome to ${domain}";
options.services.murmur.domain = lib.mkOption {
type = lib.types.str;
};
config.services.nginx.virtualHosts."${domain}" = {
enableACME = true;
forceSSL = true;
};
config = lib.mkIf cfg.enable {
networking.firewall.allowedTCPPorts = [ cfg.port ];
networking.firewall.allowedUDPPorts = [ cfg.port ];
# give mumble access to acme certs
config.security.acme.certs.${domain} = {
group = "murmur";
postRun = "systemctl reload-or-restart murmur";
services.murmur = {
sslCa = "${certs.${cfg.domain}.directory}/chain.pem";
sslKey = "${certs.${cfg.domain}.directory}/key.pem";
sslCert = "${certs.${cfg.domain}.directory}/fullchain.pem";
welcometext = "Welcome to ${cfg.domain}";
};
services.nginx.virtualHosts."${cfg.domain}" = {
enableACME = true;
forceSSL = true;
};
# give mumble access to acme certs
security.acme.certs.${cfg.domain} = {
group = "murmur";
postRun = "systemctl reload-or-restart murmur";
};
users.users.nginx.extraGroups = [ "murmur" ];
};
config.users.users.nginx.extraGroups = [ "murmur" ];
}

21
common/server/nginx.nix
View File

@ -1,14 +1,15 @@
{ config, pkgs, ... }:
{ lib, config, pkgs, ... }:
{
services.nginx = {
enable = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
};
config = lib.mkIf config.services.nginx.enable {
services.nginx = {
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
};
networking.firewall.allowedTCPPorts = [ 80 443 ];
networking.firewall.allowedUDPPorts = [ 80 443 ];
networking.firewall.allowedTCPPorts = [ 80 443 ];
networking.firewall.allowedUDPPorts = [ 80 443 ];
};
}

95
common/server/nsd.nix
View File

@ -1,95 +0,0 @@
{ config, ... }:
{
services.nsd = let
self = "142.4.210.222";
secondary = "167.114.154.31";
in {
enable = true;
interfaces = [ "0.0.0.0" ];
roundRobin = true;
ipTransparent = true;
zones.neet = rec {
provideXFR = [ "${secondary} NOKEY" ];
notify = provideXFR;
children = {
"neet.dev.".data = ''
$TTL 300
@ IN SOA ns1.neet.dev. contact.neet.dev. (
2011072000 ;Serial
300 ;Refresh
300 ;Retry
604800 ;Expire
300 ;Minimum TTL
)
@ IN NS ns1.neet.dev.
@ IN NS ns2.neet.dev.
@ IN A ${self}
www IN A ${self}
irc IN A ${self}
wiki IN A ${self}
ns1 IN A ${self}
ns2 IN A 167.114.154.31
ragnarok IN A 155.138.219.146
coder IN A ${self}
git IN A ${self}
@ IN TXT "rizon_vhost=Googlebot"
ownercheck IN TXT "dc97b3fd"
'';
"neet.space.".data = ''
$TTL 300
@ IN SOA ns1.neet.dev. contact.neet.dev. (
2011071017 ;Serial
300 ;Refresh
300 ;Retry
604800 ;Expire
300 ;Minimum TTL
)
@ IN NS ns1.neet.dev.
@ IN NS ns2.neet.dev.
@ IN A ${self}
www IN A ${self}
voice IN A ${self}
stream IN A ${self}
radio IN A ${self}
tube IN A ${self}
sock.tube IN A ${self}
mural IN A ${self}
_minecraft._tcp IN SRV 0 5 23589 neet.space.
_mumble._tcp IN SRV 0 5 23563 voice.neet.space.
_mumble._tcp.voice IN SRV 0 5 23563 voice.neet.space.
@ IN TXT "rizon_vhost=Googlebot"
ownercheck IN TXT "dc97b3fd"
'';
"neet.cloud.".data = ''
$TTL 300
@ IN SOA ns1.neet.dev. contact.neet.dev. (
2011071011 ;Serial
300 ;Refresh
300 ;Retry
604800 ;Expire
300 ;Minimum TTL
)
@ IN NS ns1.neet.dev.
@ IN NS ns2.neet.dev.
@ IN A ${self}
www IN A ${self}
paste IN A ${self}
globie-info IN A ${self}
files IN A ${self}
ownercheck IN TXT "dc97b3fd"
'';
};
};
};
}

88
common/server/thelounge.nix
View File

@ -1,44 +1,64 @@
{ config, ... }:
{ lib, config, ... }:
{
services.thelounge = {
enable = true;
port = 9000;
private = true;
extraConfig = {
reverseProxy = true;
maxHistory = -1;
https.enable = false;
# theme = "thelounge-theme-solarized";
prefetch = false;
prefetchStorage = false;
fileUpload = {
enable = true;
maxFileSize = -1;
baseUrl = "https://files.neet.cloud/irc/";
let
cfg = config.services.thelounge;
in {
options.services.thelounge = {
fileUploadBaseUrl = lib.mkOption {
type = lib.types.str;
};
host = lib.mkOption {
type = lib.types.str;
example = "example.com";
};
fileHost = {
host = lib.mkOption {
type = lib.types.str;
};
path = lib.mkOption {
type = lib.types.str;
};
transports = [ "websocket" "polling" ];
leaveMessage = "leaving";
messageStorage = [ "sqlite" "text" ];
};
};
# the lounge client
services.nginx.virtualHosts."irc.neet.dev" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://localhost:${toString config.services.thelounge.port}";
proxyWebsockets = true;
config = lib.mkIf cfg.enable {
services.thelounge = {
private = true;
extraConfig = {
reverseProxy = true;
maxHistory = -1;
https.enable = false;
# theme = "thelounge-theme-solarized";
prefetch = false;
prefetchStorage = false;
fileUpload = {
enable = true;
maxFileSize = -1;
baseUrl = cfg.fileUploadBaseUrl;
};
transports = [ "websocket" "polling" ];
leaveMessage = "leaving";
messageStorage = [ "sqlite" "text" ];
};
};
};
# the lounge files
services.nginx.virtualHosts."files.neet.cloud" = {
enableACME = true;
forceSSL = true;
locations."/irc" = {
proxyPass = "http://localhost:${toString config.services.thelounge.port}/uploads";
# the lounge client
services.nginx.virtualHosts.${cfg.host} = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://localhost:${toString config.services.thelounge.port}";
proxyWebsockets = true;
};
};
# the lounge files
services.nginx.virtualHosts.${cfg.fileHost.host} = {
enableACME = true;
forceSSL = true;
locations.${cfg.fileHost.path} = {
proxyPass = "http://localhost:${toString config.services.thelounge.port}/uploads";
};
};
};
}

22
machines/mitty/configuration.nix
View File

@ -4,23 +4,27 @@
imports =[
./hardware-configuration.nix
../../common/common.nix
../../common/boot/bios.nix
../../common/boot/luks.nix
../../common/server/nginx.nix
];
# cuxhh3ei2djpgf2zdkboceuhaxavgr3ipu3d7a2swx4giy2wosfxspyd.onion
boot.loader.grub.device = "/dev/vda";
networking.hostName = "mitty";
boot.initrd.luks.devices.enc-pv.device = "/dev/disk/by-uuid/6dcf23ea-cb5e-4329-a88b-832209918c40";
nix.flakes.enable = true;
bios = {
enable = true;
device = "/dev/vda";
};
luks = {
enable = true;
device.path = "/dev/disk/by-uuid/6dcf23ea-cb5e-4329-a88b-832209918c40";
};
networking.hostName = "mitty";
networking.wireless.enable = false;
networking.useDHCP = false;
networking.interfaces.ens3.useDHCP = true;
security.acme.acceptTerms = true;
security.acme.email = "letsencrypt+5@tar.ninja";
nix.flakes.enable = true;
}

24
machines/nanachi/configuration.nix
View File

@ -4,26 +4,30 @@
imports =[
./hardware-configuration.nix
../../common/common.nix
../../common/boot/bios.nix
../../common/boot/luks.nix
../../common/server/nginx.nix
];
# uxzq63kr2uuwutpaqjna2sg4gnk3p65e5bkvedzx5dsxx2mvxhjm7fid.onion
boot.loader.grub.device = "/dev/vda";
networking.hostName = "nanachi";
boot.initrd.luks.devices.enc-pv.device = "/dev/disk/by-uuid/e57ac752-bd99-421f-a3b9-0cfa9608a54e";
nix.flakes.enable = true;
bios = {
enable = true;
device = "/dev/vda";
};
luks = {
enable = true;
device.path = "/dev/disk/by-uuid/e57ac752-bd99-421f-a3b9-0cfa9608a54e";
};
networking.hostName = "nanachi";
networking.wireless.enable = false;
networking.useDHCP = false;
networking.interfaces.ens3.useDHCP = true;
security.acme.acceptTerms = true;
security.acme.email = "letsencrypt+5@tar.ninja";
nix.flakes.enable = true;
services.nginx.enable = true;
services.nginx.virtualHosts."nanachi.neet.dev" = {
enableACME = true;
forceSSL = true;

55
machines/neet.dev/configuration.nix
View File

@ -4,12 +4,6 @@
imports =[
./hardware-configuration.nix
../../common/common.nix
../../common/boot/bios.nix
../../common/boot/luks.nix
# ../../common/server/nsd.nix
../../common/server/nginx.nix
../../common/server/thelounge.nix
../../common/server/mumble.nix
../../common/server/gitlab.nix
../../common/server/video-stream.nix
../../common/server/hydra.nix
@ -17,30 +11,47 @@
# wt6nczjfvtba6pvjt2qtevwjpq4gcbz46bwjz4hboehgecyqmzqgwnqd.onion
boot.loader.grub.device = "/dev/sda";
networking.hostName = "neetdev";
boot.initrd.luks.devices.enc-pv.device = "/dev/disk/by-uuid/06f6b0bf-fe79-4b89-a549-b464c2b162a1";
networking.wireless.enable = false;
networking.useDHCP = false;
networking.interfaces.eno1.useDHCP = true;
security.acme.acceptTerms = true;
security.acme.email = "letsencrypt+5@tar.ninja";
nix.flakes.enable = true;
# tmp
services.nginx.virtualHosts."tmp.neet.space" = {
enableACME = true;
forceSSL = true;
root = "/var/www/tmp";
bios = {
enable = true;
device = "/dev/sda";
};
luks = {
enable = true;
device.path = "/dev/disk/by-uuid/06f6b0bf-fe79-4b89-a549-b464c2b162a1";
};
networking.hostName = "neetdev";
networking.interfaces.eno1.useDHCP = true;
services.nginx.enable = true;
security.acme.acceptTerms = true;
security.acme.email = "letsencrypt+5@tar.ninja";
# placeholder
services.nginx.virtualHosts."radio.neet.space" = {
enableACME = true;
forceSSL = true;
};
services.thelounge = {
enable = true;
port = 9000;
fileUploadBaseUrl = "https://files.neet.cloud/irc/";
host = "irc.neet.dev";
fileHost = {
host = "files.neet.cloud";
path = "/irc";
};
};
config.services.murmur = {
enable = true;
port = 23563;
domain = "voice.neet.space";
};
}

28
machines/reg/configuration.nix
View File

@ -4,25 +4,27 @@
imports = [
./hardware-configuration.nix
../../common/common.nix
../../common/boot/efi.nix
../../common/boot/luks.nix
../../common/pc/de.nix
../../common/pc/touchpad.nix
];
# smcxui7kwoyxpswwage4fkcppxnqzpw33xcmxmlhxvk5gcp5s6lrtfad.onion
networking.hostName = "reg";
boot.initrd.luks.devices.enc-pv = {
device = "/dev/disk/by-uuid/975d8427-2c6a-440d-a1d2-18dd15ba5bc2";
allowDiscards = true;
};
nix.flakes.enable = true;
networking.useDHCP = false;
efi.enable = true;
luks = {
enable = true;
device = {
path = "/dev/disk/by-uuid/975d8427-2c6a-440d-a1d2-18dd15ba5bc2";
allowDiscards = true;
};
};
networking.hostName = "reg";
de.enable = true;
de.touchpad.enable = true;
networking.interfaces.enp57s0f1.useDHCP = true;
networking.interfaces.wlp0s20f3.useDHCP = true;
networking.interfaces.wwp0s20f0u2i12.useDHCP = true;
}