zuckerberg/nix-config
zuckerberg/nix-config
1
0
Fork 0
Code Issues Pull Requests Actions Activity

migrate to nixos modules

Browse Source
This commit is contained in:
zuckerberg 2021-04-11 21:43:27 -04:00
parent 7b70b48de4
commit a9c6b46ff5
25 changed files with 544 additions and 459 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
common/boot/bios.nix
View File

@ -1,12 +1,28 @@
{ config, pkgs, ... }: { lib, config, pkgs, ... }:
{ with lib;
# Use GRUB 2 for BIOS let
boot.loader.grub = { cfg = config.bios;
enable = true; in {
version = 2; options.bios = {
useOSProber = true; enable = mkEnableOption "enable bios boot";
configurationLimit = 20; device = mkOption {
theme = pkgs.nixos-grub2-theme; type = types.str;
};
};
config = mkIf cfg.enable {
# Use GRUB 2 for BIOS
boot.loader = {
timeout = 2;
grub = {
enable = true;
device = cfg.device;
version = 2;
useOSProber = true;
configurationLimit = 20;
theme = pkgs.nixos-grub2-theme;
};
};
}; };
} }

38
common/boot/efi.nix
View File

@ -1,18 +1,28 @@
{ config, pkgs, ... }: { lib, config, pkgs, ... }:
{ with lib;
# Use GRUB2 for EFI let
boot.loader = { cfg = config.efi;
efi.canTouchEfiVariables = true; in {
grub = { options.efi = {
enable = true; enable = mkEnableOption "enable efi boot";
device = "nodev"; };
version = 2;
efiSupport = true; config = mkIf cfg.enable {
useOSProber = true; # Use GRUB2 for EFI
# memtest86.enable = true; boot.loader = {
configurationLimit = 20; efi.canTouchEfiVariables = true;
theme = pkgs.nixos-grub2-theme; timeout = 2;
grub = {
enable = true;
device = "nodev";
version = 2;
efiSupport = true;
useOSProber = true;
# memtest86.enable = true;
configurationLimit = 20;
theme = pkgs.nixos-grub2-theme;
};
}; };
}; };
} }

146
common/boot/luks.nix
View File

@ -1,59 +1,101 @@
{ config, pkgs, lib, ... }: { config, pkgs, lib, ... }:
{ let
# Unlock LUKS disk over ssh cfg = config.luks;
boot.initrd.network.enable = true; in {
boot.initrd.kernelModules = [ "e1000" "e1000e" "virtio_pci" "r8169" ]; options.luks = {
boot.initrd.network.ssh = { enable = lib.mkEnableOption "enable luks root remote decrypt over ssh/tor";
enable = true; device = {
port = 22; name = lib.mkOption {
hostKeys = [ type = lib.types.str;
"/secret/ssh_host_rsa_key" default = "enc-pv";
"/secret/ssh_host_ed25519_key" };
]; path = lib.mkOption {
authorizedKeys = config.users.users.googlebot.openssh.authorizedKeys.keys; type = lib.types.either lib.types.str lib.types.path;
};
allowDiscards = lib.mkOption {
type = lib.types.bool;
default = false;
};
};
sshHostKeys = lib.mkOption {
type = lib.types.listOf (lib.types.either lib.types.str lib.types.path);
default = [
"/secret/ssh_host_rsa_key"
"/secret/ssh_host_ed25519_key"
];
};
sshAuthorizedKeys = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = config.users.users.googlebot.openssh.authorizedKeys.keys;
};
onionConfig = lib.mkOption {
type = lib.types.path;
default = /secret/onion;
};
kernelModules = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ "e1000" "e1000e" "virtio_pci" "r8169" ];
};
}; };
boot.initrd.postDeviceCommands = '' config = lib.mkIf cfg.enable {
echo 'waiting for root device to be opened...' boot.initrd.luks.devices.${cfg.device.name} = {
mkfifo /crypt-ramfs/passphrase device = cfg.device.path;
echo /crypt-ramfs/passphrase >> /dev/null allowDiscards = cfg.device.allowDiscards;
''; };
# Make machine accessable over tor for boot unlock # Unlock LUKS disk over ssh
boot.initrd.secrets = { boot.initrd.network.enable = true;
"/etc/tor/onion/bootup" = /secret/onion; boot.initrd.kernelModules = cfg.kernelModules;
boot.initrd.network.ssh = {
enable = true;
port = 22;
hostKeys = cfg.sshHostKeys;
authorizedKeys = cfg.sshAuthorizedKeys;
};
boot.initrd.postDeviceCommands = ''
echo 'waiting for root device to be opened...'
mkfifo /crypt-ramfs/passphrase
echo /crypt-ramfs/passphrase >> /dev/null
'';
# Make machine accessable over tor for boot unlock
boot.initrd.secrets = {
"/etc/tor/onion/bootup" = cfg.onionConfig;
};
boot.initrd.extraUtilsCommands = ''
copy_bin_and_libs ${pkgs.tor}/bin/tor
copy_bin_and_libs ${pkgs.haveged}/bin/haveged
'';
# start tor during boot process
boot.initrd.network.postCommands = let
torRc = (pkgs.writeText "tor.rc" ''
DataDirectory /etc/tor
SOCKSPort 127.0.0.1:9050 IsolateDestAddr
SOCKSPort 127.0.0.1:9063
HiddenServiceDir /etc/tor/onion/bootup
HiddenServicePort 22 127.0.0.1:22
'');
in ''
# Add nice prompt for giving LUKS passphrase over ssh
echo 'read -s -p "Unlock Passphrase: " passphrase && echo $passphrase > /crypt-ramfs/passphrase && exit' >> /root/.profile
echo "tor: preparing onion folder"
# have to do this otherwise tor does not want to start
chmod -R 700 /etc/tor
echo "make sure localhost is up"
ip a a 127.0.0.1/8 dev lo
ip link set lo up
echo "haveged: starting haveged"
haveged -F &
echo "tor: starting tor"
tor -f ${torRc} --verify-config
tor -f ${torRc} &
'';
}; };
boot.initrd.extraUtilsCommands = ''
copy_bin_and_libs ${pkgs.tor}/bin/tor
copy_bin_and_libs ${pkgs.haveged}/bin/haveged
'';
# start tor during boot process
boot.initrd.network.postCommands = let
torRc = (pkgs.writeText "tor.rc" ''
DataDirectory /etc/tor
SOCKSPort 127.0.0.1:9050 IsolateDestAddr
SOCKSPort 127.0.0.1:9063
HiddenServiceDir /etc/tor/onion/bootup
HiddenServicePort 22 127.0.0.1:22
'');
in ''
# Add nice prompt for giving LUKS passphrase over ssh
echo 'read -s -p "Unlock Passphrase: " passphrase && echo $passphrase > /crypt-ramfs/passphrase && exit' >> /root/.profile
echo "tor: preparing onion folder"
# have to do this otherwise tor does not want to start
chmod -R 700 /etc/tor
echo "make sure localhost is up"
ip a a 127.0.0.1/8 dev lo
ip link set lo up
echo "haveged: starting haveged"
haveged -F &
echo "tor: starting tor"
tor -f ${torRc} --verify-config
tor -f ${torRc} &
'';
} }

9
common/common.nix
View File

@ -4,11 +4,18 @@
imports = [ imports = [
./flakes.nix ./flakes.nix
./boot/firmware.nix ./boot/firmware.nix
./boot/efi.nix
./boot/bios.nix
./boot/luks.nix
./server/nginx.nix
./server/thelounge.nix
./server/mumble.nix
./pc/de.nix
]; ];
system.stateVersion = "20.09"; system.stateVersion = "20.09";
boot.loader.timeout = 2; networking.useDHCP = false;
time.timeZone = "America/New_York"; time.timeZone = "America/New_York";
i18n.defaultLocale = "en_US.UTF-8"; i18n.defaultLocale = "en_US.UTF-8";

46
common/pc/audio.nix
View File

@ -1,28 +1,32 @@
{ config, pkgs, ... }: { lib, config, pkgs, ... }:
{ let
# Audio cfg = config.de;
sound.enable = true; in {
config = lib.mkIf cfg.enable {
# Audio
sound.enable = true;
# enable pulseaudio support for packages # enable pulseaudio support for packages
nixpkgs.config.pulseaudio = true; nixpkgs.config.pulseaudio = true;
# realtime pulseaudio # realtime pulseaudio
security.rtkit.enable = true; security.rtkit.enable = true;
hardware.pulseaudio = { hardware.pulseaudio = {
enable = true; enable = true;
support32Bit = true; support32Bit = true;
package = pkgs.pulseaudioFull; # bt headset support package = pkgs.pulseaudioFull; # bt headset support
# TODO: switch on connect isn't working for some reason (at least when in kde) # TODO: switch on connect isn't working for some reason (at least when in kde)
extraConfig = " extraConfig = "
load-module module-switch-on-connect load-module module-switch-on-connect
load-module module-switch-on-connect ignore_virtual=no load-module module-switch-on-connect ignore_virtual=no
"; ";
};
users.users.googlebot.extraGroups = [ "audio" ];
# bt headset support
hardware.bluetooth.enable = true;
}; };
users.users.googlebot.extraGroups = [ "audio" ];
# bt headset support
hardware.bluetooth.enable = true;
} }

74
common/pc/chromium.nix
View File

@ -1,40 +1,44 @@
{ config, pkgs, ... }: { lib, config, pkgs, ... }:
{ let
# chromium with specific extensions + settings cfg = config.de;
programs.chromium = { in {
enable = true; config = lib.mkIf cfg.enable {
extensions = [ # chromium with specific extensions + settings
"cjpalhdlnbpafiamejdnhcphjbkeiagm" # ublock origin programs.chromium = {
"gcbommkclmclpchllfjekcdonpmejbdp" # https everywhere enable = true;
"oboonakemofpalcgghocfoadofidjkkk" # keepassxc plugin extensions = [
"cimiefiiaegbelhefglklhhakcgmhkai" # plasma integration "cjpalhdlnbpafiamejdnhcphjbkeiagm" # ublock origin
"hkgfoiooedgoejojocmhlaklaeopbecg" # picture in picture "gcbommkclmclpchllfjekcdonpmejbdp" # https everywhere
]; "oboonakemofpalcgghocfoadofidjkkk" # keepassxc plugin
extraOpts = { "cimiefiiaegbelhefglklhhakcgmhkai" # plasma integration
"BrowserSignin" = 0; "hkgfoiooedgoejojocmhlaklaeopbecg" # picture in picture
"SyncDisabled" = true; ];
"PasswordManagerEnabled" = false; extraOpts = {
"SpellcheckEnabled" = true; "BrowserSignin" = 0;
"SpellcheckLanguage" = [ "en-US" ]; "SyncDisabled" = true;
"PasswordManagerEnabled" = false;
"SpellcheckEnabled" = true;
"SpellcheckLanguage" = [ "en-US" ];
};
defaultSearchProviderSuggestURL = null;
defaultSearchProviderSearchURL = " https://duckduckgo.com/?q={searchTerms}&kp=-1&kl=us-en";
}; };
defaultSearchProviderSuggestURL = null;
defaultSearchProviderSearchURL = " https://duckduckgo.com/?q={searchTerms}&kp=-1&kl=us-en";
};
# hardware accelerated video playback (on intel) # hardware accelerated video playback (on intel)
nixpkgs.config.packageOverrides = pkgs: { nixpkgs.config.packageOverrides = pkgs: {
vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; }; vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; };
chromium = pkgs.chromium.override { enableVaapi = true; }; chromium = pkgs.chromium.override { enableVaapi = true; };
};
hardware.opengl = {
enable = true;
extraPackages = with pkgs; [
intel-media-driver # LIBVA_DRIVER_NAME=iHD
vaapiIntel # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium)
vaapiVdpau
libvdpau-va-gl
];
extraPackages32 = with pkgs.pkgsi686Linux; [ vaapiIntel ];
};
}; };
hardware.opengl = {
enable = true;
extraPackages = with pkgs; [
intel-media-driver # LIBVA_DRIVER_NAME=iHD
vaapiIntel # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium)
vaapiVdpau
libvdpau-va-gl
];
extraPackages32 = with pkgs.pkgsi686Linux; [ vaapiIntel ];
};
} }

54
common/pc/de.nix
View File

@ -1,7 +1,8 @@
{ config, pkgs, lib, ... }: { config, pkgs, lib, ... }:
{ let
# General cfg = config.de;
in {
imports = [ imports = [
./kde.nix ./kde.nix
./xfce.nix ./xfce.nix
@ -14,32 +15,39 @@
./vscodium.nix ./vscodium.nix
./discord.nix ./discord.nix
./steam.nix ./steam.nix
./touchpad.nix
]; ];
# allow specific unfree packages options.de = {
nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ enable = lib.mkEnableOption "enable desktop environment";
"tigervnc" "font-bh-lucidatypewriter" # tigervnc };
"steam" "steam-original" "steam-runtime" # TODO move to steam.nix
"discord" # TODO move to discord.nix
];
# vulkan config = lib.mkIf cfg.enable {
hardware.opengl.driSupport = true; # allow specific unfree packages
hardware.opengl.driSupport32Bit = true; nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
"tigervnc" "font-bh-lucidatypewriter" # tigervnc
"steam" "steam-original" "steam-runtime" # TODO move to steam.nix
"discord" # TODO move to discord.nix
];
# Applications # vulkan
users.users.googlebot.packages = with pkgs; [ hardware.opengl.driSupport = true;
chromium keepassxc mumble tigervnc bluez-tools vscodium element-desktop mpv hardware.opengl.driSupport32Bit = true;
];
# Networking # Applications
networking.networkmanager.enable = true; users.users.googlebot.packages = with pkgs; [
users.users.googlebot.extraGroups = [ "networkmanager" ]; chromium keepassxc mumble tigervnc bluez-tools vscodium element-desktop mpv
];
# Printing # Networking
services.printing.enable = true; networking.networkmanager.enable = true;
users.users.googlebot.extraGroups = [ "networkmanager" ];
# Security # Printing
services.gnome3.gnome-keyring.enable = true; services.printing.enable = true;
security.pam.services.googlebot.enableGnomeKeyring = true;
# Security
services.gnome3.gnome-keyring.enable = true;
security.pam.services.googlebot.enableGnomeKeyring = true;
};
} }

14
common/pc/discord.nix
View File

@ -1,7 +1,11 @@
{ config, pkgs, ... }: { lib, config, pkgs, ... }:
{ let
users.users.googlebot.packages = [ cfg = config.de;
pkgs.discord in {
]; config = lib.mkIf cfg.enable {
users.users.googlebot.packages = [
pkgs.discord
];
};
} }

8
common/pc/firefox.nix
View File

@ -1,4 +1,4 @@
{ config, pkgs, ... }: { lib, config, pkgs, ... }:
# #
# Sort of private firefox # Sort of private firefox
@ -12,6 +12,8 @@
# #
let let
cfg = config.de;
somewhatPrivateFF = pkgs.firefox-unwrapped.override { somewhatPrivateFF = pkgs.firefox-unwrapped.override {
privacySupport = true; privacySupport = true;
webrtcSupport = true; # mostly private ;) webrtcSupport = true; # mostly private ;)
@ -87,5 +89,7 @@ let
}; };
in in
{ {
users.users.googlebot.packages = [ firefox ]; config = lib.mkIf cfg.enable {
users.users.googlebot.packages = [ firefox ];
};
} }

30
common/pc/kde.nix
View File

@ -1,16 +1,20 @@
{ config, pkgs, ... }: { lib, config, pkgs, ... }:
{ let
# kde plasma cfg = config.de;
services.xserver = { in {
enable = true; config = lib.mkIf cfg.enable {
desktopManager.plasma5.enable = true; # kde plasma
displayManager.sddm.enable = true; services.xserver = {
}; enable = true;
desktopManager.plasma5.enable = true;
displayManager.sddm.enable = true;
};
# kde apps # kde apps
nixpkgs.config.firefox.enablePlasmaBrowserIntegration = true; nixpkgs.config.firefox.enablePlasmaBrowserIntegration = true;
users.users.googlebot.packages = with pkgs; [ users.users.googlebot.packages = with pkgs; [
akonadi kmail plasma5Packages.kmail-account-wizard akonadi kmail plasma5Packages.kmail-account-wizard
]; ];
};
} }

42
common/pc/pithos.nix
View File

@ -1,22 +1,26 @@
{ config, pkgs, ... }: { lib, config, pkgs, ... }:
{ let
nixpkgs.overlays = [ cfg = config.de;
(self: super: { in {
pithos = super.pithos.overrideAttrs (old: rec { config = lib.mkIf cfg.enable {
pname = "pithos"; nixpkgs.overlays = [
version = "1.5.1"; (self: super: {
src = super.fetchFromGitHub { pithos = super.pithos.overrideAttrs (old: rec {
owner = pname; pname = "pithos";
repo = pname; version = "1.5.1";
rev = version; src = super.fetchFromGitHub {
sha256 = "il7OAALpHFZ6wjco9Asp04zWHCD8Ni+iBdiJWcMiQA4="; owner = pname;
}; repo = pname;
}); rev = version;
}) sha256 = "il7OAALpHFZ6wjco9Asp04zWHCD8Ni+iBdiJWcMiQA4=";
]; };
});
})
];
users.users.googlebot.packages = with pkgs; [ users.users.googlebot.packages = with pkgs; [
pithos pithos
]; ];
};
} }

18
common/pc/steam.nix
View File

@ -1,10 +1,14 @@
{ config, pkgs, ... }: { lib, config, pkgs, ... }:
{ let
programs.steam.enable = true; cfg = config.de;
hardware.steam-hardware.enable = true; # steam controller in {
config = lib.mkIf cfg.enable {
programs.steam.enable = true;
hardware.steam-hardware.enable = true; # steam controller
users.users.googlebot.packages = [ users.users.googlebot.packages = [
pkgs.steam pkgs.steam
]; ];
};
} }

38
common/pc/torbrowser.nix
View File

@ -1,20 +1,24 @@
{ config, pkgs, ... }: { lib, config, pkgs, ... }:
{ let
nixpkgs.overlays = [ cfg = config.de;
(self: super: { in {
tor-browser-bundle-bin = super.tor-browser-bundle-bin.overrideAttrs (old: rec { config = lib.mkIf cfg.enable {
version = "10.0.10"; nixpkgs.overlays = [
lang = "en-US"; (self: super: {
src = pkgs.fetchurl { tor-browser-bundle-bin = super.tor-browser-bundle-bin.overrideAttrs (old: rec {
url = "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"; version = "10.0.10";
sha256 = "vYWZ+NsGN8YH5O61+zrUjlFv3rieaBqjBQ+a18sQcZg="; lang = "en-US";
}; src = pkgs.fetchurl {
}); url = "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz";
}) sha256 = "vYWZ+NsGN8YH5O61+zrUjlFv3rieaBqjBQ+a18sQcZg=";
]; };
});
})
];
users.users.googlebot.packages = with pkgs; [ users.users.googlebot.packages = with pkgs; [
tor-browser-bundle-bin tor-browser-bundle-bin
]; ];
};
} }

16
common/pc/touchpad.nix
View File

@ -1,6 +1,14 @@
{ config, pkgs, ... }: { lib, config, pkgs, ... }:
{ let
services.xserver.libinput.enable = true; cfg = config.de.touchpad;
services.xserver.libinput.touchpad.naturalScrolling = true; in {
options.de.touchpad = {
enable = lib.mkEnableOption "enable touchpad";
};
config = lib.mkIf cfg.enable {
services.xserver.libinput.enable = true;
services.xserver.libinput.touchpad.naturalScrolling = true;
};
} }

12
common/pc/vscodium.nix
View File

@ -1,6 +1,8 @@
{ config, pkgs, ... }: { lib, config, pkgs, ... }:
let let
cfg = config.de;
extensions = with pkgs.vscode-extensions; [ extensions = with pkgs.vscode-extensions; [
bbenoist.Nix # nix syntax support bbenoist.Nix # nix syntax support
# arrterian.nix-env-selector # nix dev envs # arrterian.nix-env-selector # nix dev envs
@ -12,7 +14,9 @@ let
}; };
in in
{ {
users.users.googlebot.packages = [ config = lib.mkIf cfg.enable {
vscodium-with-extensions users.users.googlebot.packages = [
]; vscodium-with-extensions
];
};
} }

28
common/pc/xfce.nix
View File

@ -1,16 +1,20 @@
{ config, pkgs, ... }: { lib, config, pkgs, ... }:
{ let
services.xserver = { cfg = config.de;
enable = true; in {
desktopManager = { config = lib.mkIf cfg.enable {
xterm.enable = false; services.xserver = {
xfce.enable = true; enable = true;
desktopManager = {
xterm.enable = false;
xfce.enable = true;
};
displayManager.sddm.enable = true;
}; };
displayManager.sddm.enable = true;
};
# xfce apps # xfce apps
users.users.googlebot.packages = with pkgs; [ users.users.googlebot.packages = with pkgs; [
]; ];
};
} }

14
common/pc/yubikey.nix
View File

@ -1,7 +1,11 @@
{ config, pkgs, ... }: { lib, config, pkgs, ... }:
{ let
# yubikey cfg = config.de;
services.pcscd.enable = true; in {
services.udev.packages = [ pkgs.yubikey-personalization ]; config = lib.mkIf cfg.enable {
# yubikey
services.pcscd.enable = true;
services.udev.packages = [ pkgs.yubikey-personalization ];
};
} }

49
common/server/mumble.nix
View File

@ -1,31 +1,34 @@
{ config, ... }: { lib, config, ... }:
let let
murmurPort = 23563; cfg = config.services.murmur;
domain = "voice.neet.space";
certs = config.security.acme.certs; certs = config.security.acme.certs;
in { in {
config.networking.firewall.allowedTCPPorts = [ murmurPort ]; options.services.murmur.domain = lib.mkOption {
config.networking.firewall.allowedUDPPorts = [ murmurPort ]; type = lib.types.str;
config.services.murmur = {
enable = true;
port = murmurPort;
sslCa = "${certs.${domain}.directory}/chain.pem";
sslKey = "${certs.${domain}.directory}/key.pem";
sslCert = "${certs.${domain}.directory}/fullchain.pem";
welcometext = "Welcome to ${domain}";
}; };
config.services.nginx.virtualHosts."${domain}" = { config = lib.mkIf cfg.enable {
enableACME = true; networking.firewall.allowedTCPPorts = [ cfg.port ];
forceSSL = true; networking.firewall.allowedUDPPorts = [ cfg.port ];
};
# give mumble access to acme certs services.murmur = {
config.security.acme.certs.${domain} = { sslCa = "${certs.${cfg.domain}.directory}/chain.pem";
group = "murmur"; sslKey = "${certs.${cfg.domain}.directory}/key.pem";
postRun = "systemctl reload-or-restart murmur"; sslCert = "${certs.${cfg.domain}.directory}/fullchain.pem";
welcometext = "Welcome to ${cfg.domain}";
};
services.nginx.virtualHosts."${cfg.domain}" = {
enableACME = true;
forceSSL = true;
};
# give mumble access to acme certs
security.acme.certs.${cfg.domain} = {
group = "murmur";
postRun = "systemctl reload-or-restart murmur";
};
users.users.nginx.extraGroups = [ "murmur" ];
}; };
config.users.users.nginx.extraGroups = [ "murmur" ];
} }

21
common/server/nginx.nix
View File

@ -1,14 +1,15 @@
{ config, pkgs, ... }: { lib, config, pkgs, ... }:
{ {
services.nginx = { config = lib.mkIf config.services.nginx.enable {
enable = true; services.nginx = {
recommendedGzipSettings = true; recommendedGzipSettings = true;
recommendedOptimisation = true; recommendedOptimisation = true;
recommendedProxySettings = true; recommendedProxySettings = true;
recommendedTlsSettings = true; recommendedTlsSettings = true;
}; };
networking.firewall.allowedTCPPorts = [ 80 443 ]; networking.firewall.allowedTCPPorts = [ 80 443 ];
networking.firewall.allowedUDPPorts = [ 80 443 ]; networking.firewall.allowedUDPPorts = [ 80 443 ];
};
} }

95
common/server/nsd.nix
View File

@ -1,95 +0,0 @@
{ config, ... }:
{
services.nsd = let
self = "142.4.210.222";
secondary = "167.114.154.31";
in {
enable = true;
interfaces = [ "0.0.0.0" ];
roundRobin = true;
ipTransparent = true;
zones.neet = rec {
provideXFR = [ "${secondary} NOKEY" ];
notify = provideXFR;
children = {
"neet.dev.".data = ''
$TTL 300
@ IN SOA ns1.neet.dev. contact.neet.dev. (
2011072000 ;Serial
300 ;Refresh
300 ;Retry
604800 ;Expire
300 ;Minimum TTL
)
@ IN NS ns1.neet.dev.
@ IN NS ns2.neet.dev.
@ IN A ${self}
www IN A ${self}
irc IN A ${self}
wiki IN A ${self}
ns1 IN A ${self}
ns2 IN A 167.114.154.31
ragnarok IN A 155.138.219.146
coder IN A ${self}
git IN A ${self}
@ IN TXT "rizon_vhost=Googlebot"
ownercheck IN TXT "dc97b3fd"
'';
"neet.space.".data = ''
$TTL 300
@ IN SOA ns1.neet.dev. contact.neet.dev. (
2011071017 ;Serial
300 ;Refresh
300 ;Retry
604800 ;Expire
300 ;Minimum TTL
)
@ IN NS ns1.neet.dev.
@ IN NS ns2.neet.dev.
@ IN A ${self}
www IN A ${self}
voice IN A ${self}
stream IN A ${self}
radio IN A ${self}
tube IN A ${self}
sock.tube IN A ${self}
mural IN A ${self}
_minecraft._tcp IN SRV 0 5 23589 neet.space.
_mumble._tcp IN SRV 0 5 23563 voice.neet.space.
_mumble._tcp.voice IN SRV 0 5 23563 voice.neet.space.
@ IN TXT "rizon_vhost=Googlebot"
ownercheck IN TXT "dc97b3fd"
'';
"neet.cloud.".data = ''
$TTL 300
@ IN SOA ns1.neet.dev. contact.neet.dev. (
2011071011 ;Serial
300 ;Refresh
300 ;Retry
604800 ;Expire
300 ;Minimum TTL
)
@ IN NS ns1.neet.dev.
@ IN NS ns2.neet.dev.
@ IN A ${self}
www IN A ${self}
paste IN A ${self}
globie-info IN A ${self}
files IN A ${self}
ownercheck IN TXT "dc97b3fd"
'';
};
};
};
}

88
common/server/thelounge.nix
View File

@ -1,44 +1,64 @@
{ config, ... }: { lib, config, ... }:
{ let
services.thelounge = { cfg = config.services.thelounge;
enable = true; in {
port = 9000; options.services.thelounge = {
private = true; fileUploadBaseUrl = lib.mkOption {
extraConfig = { type = lib.types.str;
reverseProxy = true; };
maxHistory = -1; host = lib.mkOption {
https.enable = false; type = lib.types.str;
# theme = "thelounge-theme-solarized"; example = "example.com";
prefetch = false; };
prefetchStorage = false; fileHost = {
fileUpload = { host = lib.mkOption {
enable = true; type = lib.types.str;
maxFileSize = -1; };
baseUrl = "https://files.neet.cloud/irc/"; path = lib.mkOption {
type = lib.types.str;
}; };
transports = [ "websocket" "polling" ];
leaveMessage = "leaving";
messageStorage = [ "sqlite" "text" ];
}; };
}; };
# the lounge client config = lib.mkIf cfg.enable {
services.nginx.virtualHosts."irc.neet.dev" = { services.thelounge = {
enableACME = true; private = true;
forceSSL = true; extraConfig = {
locations."/" = { reverseProxy = true;
proxyPass = "http://localhost:${toString config.services.thelounge.port}"; maxHistory = -1;
proxyWebsockets = true; https.enable = false;
# theme = "thelounge-theme-solarized";
prefetch = false;
prefetchStorage = false;
fileUpload = {
enable = true;
maxFileSize = -1;
baseUrl = cfg.fileUploadBaseUrl;
};
transports = [ "websocket" "polling" ];
leaveMessage = "leaving";
messageStorage = [ "sqlite" "text" ];
};
}; };
};
# the lounge files # the lounge client
services.nginx.virtualHosts."files.neet.cloud" = { services.nginx.virtualHosts.${cfg.host} = {
enableACME = true; enableACME = true;
forceSSL = true; forceSSL = true;
locations."/irc" = { locations."/" = {
proxyPass = "http://localhost:${toString config.services.thelounge.port}/uploads"; proxyPass = "http://localhost:${toString config.services.thelounge.port}";
proxyWebsockets = true;
};
};
# the lounge files
services.nginx.virtualHosts.${cfg.fileHost.host} = {
enableACME = true;
forceSSL = true;
locations.${cfg.fileHost.path} = {
proxyPass = "http://localhost:${toString config.services.thelounge.port}/uploads";
};
}; };
}; };
} }

22
machines/mitty/configuration.nix
View File

@ -4,23 +4,27 @@
imports =[ imports =[
./hardware-configuration.nix ./hardware-configuration.nix
../../common/common.nix ../../common/common.nix
../../common/boot/bios.nix
../../common/boot/luks.nix
../../common/server/nginx.nix
]; ];
# cuxhh3ei2djpgf2zdkboceuhaxavgr3ipu3d7a2swx4giy2wosfxspyd.onion # cuxhh3ei2djpgf2zdkboceuhaxavgr3ipu3d7a2swx4giy2wosfxspyd.onion
boot.loader.grub.device = "/dev/vda"; nix.flakes.enable = true;
networking.hostName = "mitty";
boot.initrd.luks.devices.enc-pv.device = "/dev/disk/by-uuid/6dcf23ea-cb5e-4329-a88b-832209918c40"; bios = {
enable = true;
device = "/dev/vda";
};
luks = {
enable = true;
device.path = "/dev/disk/by-uuid/6dcf23ea-cb5e-4329-a88b-832209918c40";
};
networking.hostName = "mitty";
networking.wireless.enable = false;
networking.useDHCP = false;
networking.interfaces.ens3.useDHCP = true; networking.interfaces.ens3.useDHCP = true;
security.acme.acceptTerms = true; security.acme.acceptTerms = true;
security.acme.email = "letsencrypt+5@tar.ninja"; security.acme.email = "letsencrypt+5@tar.ninja";
nix.flakes.enable = true;
} }

24
machines/nanachi/configuration.nix
View File

@ -4,26 +4,30 @@
imports =[ imports =[
./hardware-configuration.nix ./hardware-configuration.nix
../../common/common.nix ../../common/common.nix
../../common/boot/bios.nix
../../common/boot/luks.nix
../../common/server/nginx.nix
]; ];
# uxzq63kr2uuwutpaqjna2sg4gnk3p65e5bkvedzx5dsxx2mvxhjm7fid.onion # uxzq63kr2uuwutpaqjna2sg4gnk3p65e5bkvedzx5dsxx2mvxhjm7fid.onion
boot.loader.grub.device = "/dev/vda"; nix.flakes.enable = true;
networking.hostName = "nanachi";
boot.initrd.luks.devices.enc-pv.device = "/dev/disk/by-uuid/e57ac752-bd99-421f-a3b9-0cfa9608a54e"; bios = {
enable = true;
device = "/dev/vda";
};
luks = {
enable = true;
device.path = "/dev/disk/by-uuid/e57ac752-bd99-421f-a3b9-0cfa9608a54e";
};
networking.hostName = "nanachi";
networking.wireless.enable = false;
networking.useDHCP = false;
networking.interfaces.ens3.useDHCP = true; networking.interfaces.ens3.useDHCP = true;
security.acme.acceptTerms = true; security.acme.acceptTerms = true;
security.acme.email = "letsencrypt+5@tar.ninja"; security.acme.email = "letsencrypt+5@tar.ninja";
nix.flakes.enable = true; services.nginx.enable = true;
services.nginx.virtualHosts."nanachi.neet.dev" = { services.nginx.virtualHosts."nanachi.neet.dev" = {
enableACME = true; enableACME = true;
forceSSL = true; forceSSL = true;

55
machines/neet.dev/configuration.nix
View File

@ -4,12 +4,6 @@
imports =[ imports =[
./hardware-configuration.nix ./hardware-configuration.nix
../../common/common.nix ../../common/common.nix
../../common/boot/bios.nix
../../common/boot/luks.nix
# ../../common/server/nsd.nix
../../common/server/nginx.nix
../../common/server/thelounge.nix
../../common/server/mumble.nix
../../common/server/gitlab.nix ../../common/server/gitlab.nix
../../common/server/video-stream.nix ../../common/server/video-stream.nix
../../common/server/hydra.nix ../../common/server/hydra.nix
@ -17,30 +11,47 @@
# wt6nczjfvtba6pvjt2qtevwjpq4gcbz46bwjz4hboehgecyqmzqgwnqd.onion # wt6nczjfvtba6pvjt2qtevwjpq4gcbz46bwjz4hboehgecyqmzqgwnqd.onion
boot.loader.grub.device = "/dev/sda";
networking.hostName = "neetdev";
boot.initrd.luks.devices.enc-pv.device = "/dev/disk/by-uuid/06f6b0bf-fe79-4b89-a549-b464c2b162a1";
networking.wireless.enable = false;
networking.useDHCP = false;
networking.interfaces.eno1.useDHCP = true;
security.acme.acceptTerms = true;
security.acme.email = "letsencrypt+5@tar.ninja";
nix.flakes.enable = true; nix.flakes.enable = true;
# tmp bios = {
services.nginx.virtualHosts."tmp.neet.space" = { enable = true;
enableACME = true; device = "/dev/sda";
forceSSL = true;
root = "/var/www/tmp";
}; };
luks = {
enable = true;
device.path = "/dev/disk/by-uuid/06f6b0bf-fe79-4b89-a549-b464c2b162a1";
};
networking.hostName = "neetdev";
networking.interfaces.eno1.useDHCP = true;
services.nginx.enable = true;
security.acme.acceptTerms = true;
security.acme.email = "letsencrypt+5@tar.ninja";
# placeholder # placeholder
services.nginx.virtualHosts."radio.neet.space" = { services.nginx.virtualHosts."radio.neet.space" = {
enableACME = true; enableACME = true;
forceSSL = true; forceSSL = true;
}; };
services.thelounge = {
enable = true;
port = 9000;
fileUploadBaseUrl = "https://files.neet.cloud/irc/";
host = "irc.neet.dev";
fileHost = {
host = "files.neet.cloud";
path = "/irc";
};
};
config.services.murmur = {
enable = true;
port = 23563;
domain = "voice.neet.space";
};
} }

28
machines/reg/configuration.nix
View File

@ -4,25 +4,27 @@
imports = [ imports = [
./hardware-configuration.nix ./hardware-configuration.nix
../../common/common.nix ../../common/common.nix
../../common/boot/efi.nix
../../common/boot/luks.nix
../../common/pc/de.nix
../../common/pc/touchpad.nix
]; ];
# smcxui7kwoyxpswwage4fkcppxnqzpw33xcmxmlhxvk5gcp5s6lrtfad.onion # smcxui7kwoyxpswwage4fkcppxnqzpw33xcmxmlhxvk5gcp5s6lrtfad.onion
networking.hostName = "reg";
boot.initrd.luks.devices.enc-pv = {
device = "/dev/disk/by-uuid/975d8427-2c6a-440d-a1d2-18dd15ba5bc2";
allowDiscards = true;
};
nix.flakes.enable = true; nix.flakes.enable = true;
networking.useDHCP = false; efi.enable = true;
luks = {
enable = true;
device = {
path = "/dev/disk/by-uuid/975d8427-2c6a-440d-a1d2-18dd15ba5bc2";
allowDiscards = true;
};
};
networking.hostName = "reg";
de.enable = true;
de.touchpad.enable = true;
networking.interfaces.enp57s0f1.useDHCP = true; networking.interfaces.enp57s0f1.useDHCP = true;
networking.interfaces.wlp0s20f3.useDHCP = true;
networking.interfaces.wwp0s20f0u2i12.useDHCP = true;
} }