nixpkgs-fmt everything
This commit is contained in:
@@ -4,11 +4,12 @@
|
||||
|
||||
let
|
||||
cfg = config.system.autoUpgrade;
|
||||
in {
|
||||
in
|
||||
{
|
||||
config = lib.mkIf cfg.enable {
|
||||
system.autoUpgrade = {
|
||||
flake = "git+https://git.neet.dev/zuckerberg/nix-config.git";
|
||||
flags = [ "--recreate-lock-file" ]; # ignore lock file, just pull the latest
|
||||
};
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
@@ -3,7 +3,8 @@
|
||||
with lib;
|
||||
let
|
||||
cfg = config.bios;
|
||||
in {
|
||||
in
|
||||
{
|
||||
options.bios = {
|
||||
enable = mkEnableOption "enable bios boot";
|
||||
device = mkOption {
|
||||
@@ -25,4 +26,4 @@ in {
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
@@ -7,4 +7,4 @@
|
||||
./bios.nix
|
||||
./remote-luks-unlock.nix
|
||||
];
|
||||
}
|
||||
}
|
||||
|
||||
@@ -3,7 +3,8 @@
|
||||
with lib;
|
||||
let
|
||||
cfg = config.efi;
|
||||
in {
|
||||
in
|
||||
{
|
||||
options.efi = {
|
||||
enable = mkEnableOption "enable efi boot";
|
||||
};
|
||||
@@ -19,7 +20,7 @@ in {
|
||||
version = 2;
|
||||
efiSupport = true;
|
||||
useOSProber = true;
|
||||
# memtest86.enable = true;
|
||||
# memtest86.enable = true;
|
||||
configurationLimit = 20;
|
||||
theme = pkgs.nixos-grub2-theme;
|
||||
};
|
||||
|
||||
@@ -3,7 +3,8 @@
|
||||
with lib;
|
||||
let
|
||||
cfg = config.firmware;
|
||||
in {
|
||||
in
|
||||
{
|
||||
options.firmware.x86_64 = {
|
||||
enable = mkEnableOption "enable x86_64 firmware";
|
||||
};
|
||||
@@ -14,4 +15,4 @@ in {
|
||||
};
|
||||
|
||||
# services.fwupd.enable = true;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -2,7 +2,8 @@
|
||||
|
||||
let
|
||||
cfg = config.remoteLuksUnlock;
|
||||
in {
|
||||
in
|
||||
{
|
||||
options.remoteLuksUnlock = {
|
||||
enable = lib.mkEnableOption "enable luks root remote decrypt over ssh/tor";
|
||||
enableTorUnlock = lib.mkOption {
|
||||
@@ -61,33 +62,38 @@ in {
|
||||
copy_bin_and_libs ${pkgs.haveged}/bin/haveged
|
||||
'';
|
||||
boot.initrd.network.postCommands = lib.mkMerge [
|
||||
(''
|
||||
# Add nice prompt for giving LUKS passphrase over ssh
|
||||
echo 'read -s -p "Unlock Passphrase: " passphrase && echo $passphrase > /crypt-ramfs/passphrase && exit' >> /root/.profile
|
||||
'')
|
||||
|
||||
(let torRc = (pkgs.writeText "tor.rc" ''
|
||||
DataDirectory /etc/tor
|
||||
SOCKSPort 127.0.0.1:9050 IsolateDestAddr
|
||||
SOCKSPort 127.0.0.1:9063
|
||||
HiddenServiceDir /etc/tor/onion/bootup
|
||||
HiddenServicePort 22 127.0.0.1:22
|
||||
''); in lib.mkIf cfg.enableTorUnlock ''
|
||||
echo "tor: preparing onion folder"
|
||||
# have to do this otherwise tor does not want to start
|
||||
chmod -R 700 /etc/tor
|
||||
(
|
||||
''
|
||||
# Add nice prompt for giving LUKS passphrase over ssh
|
||||
echo 'read -s -p "Unlock Passphrase: " passphrase && echo $passphrase > /crypt-ramfs/passphrase && exit' >> /root/.profile
|
||||
''
|
||||
)
|
||||
|
||||
echo "make sure localhost is up"
|
||||
ip a a 127.0.0.1/8 dev lo
|
||||
ip link set lo up
|
||||
(
|
||||
let torRc = (pkgs.writeText "tor.rc" ''
|
||||
DataDirectory /etc/tor
|
||||
SOCKSPort 127.0.0.1:9050 IsolateDestAddr
|
||||
SOCKSPort 127.0.0.1:9063
|
||||
HiddenServiceDir /etc/tor/onion/bootup
|
||||
HiddenServicePort 22 127.0.0.1:22
|
||||
''); in
|
||||
lib.mkIf cfg.enableTorUnlock ''
|
||||
echo "tor: preparing onion folder"
|
||||
# have to do this otherwise tor does not want to start
|
||||
chmod -R 700 /etc/tor
|
||||
|
||||
echo "haveged: starting haveged"
|
||||
haveged -F &
|
||||
echo "make sure localhost is up"
|
||||
ip a a 127.0.0.1/8 dev lo
|
||||
ip link set lo up
|
||||
|
||||
echo "tor: starting tor"
|
||||
tor -f ${torRc} --verify-config
|
||||
tor -f ${torRc} &
|
||||
'')
|
||||
echo "haveged: starting haveged"
|
||||
haveged -F &
|
||||
|
||||
echo "tor: starting tor"
|
||||
tor -f ${torRc} --verify-config
|
||||
tor -f ${torRc} &
|
||||
''
|
||||
)
|
||||
];
|
||||
};
|
||||
}
|
||||
|
||||
@@ -40,7 +40,8 @@ in
|
||||
wget
|
||||
kakoune
|
||||
htop
|
||||
git git-lfs
|
||||
git
|
||||
git-lfs
|
||||
dnsutils
|
||||
tmux
|
||||
nethogs
|
||||
|
||||
@@ -2,7 +2,8 @@
|
||||
with lib;
|
||||
let
|
||||
cfg = config.nix.flakes;
|
||||
in {
|
||||
in
|
||||
{
|
||||
options.nix.flakes = {
|
||||
enable = mkEnableOption "use nix flakes";
|
||||
};
|
||||
|
||||
@@ -21,4 +21,4 @@ in
|
||||
boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
|
||||
boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
@@ -22,7 +22,8 @@ let
|
||||
ponyo = "cfamr6artx75qvt7ho3rrbsc7mkucmv5aawebwflsfuorusayacffryd.onion";
|
||||
s0 = "r3zvf7f2ppaeithzswigma46pajt3hqytmkg3rshgknbl3jbni455fqd.onion";
|
||||
};
|
||||
in {
|
||||
in
|
||||
{
|
||||
programs.ssh.knownHosts = {
|
||||
ponyo = {
|
||||
hostNames = [ "ponyo" "ponyo.neet.dev" "git.neet.dev" ];
|
||||
@@ -56,7 +57,7 @@ in {
|
||||
|
||||
# prebuilt cmds for easy ssh LUKS unlock
|
||||
environment.shellAliases =
|
||||
concatMapAttrs (host: addr: {"unlock-over-tor_${host}" = "torsocks ssh root@${addr}";}) unlock-onion-hosts
|
||||
//
|
||||
concatMapAttrs (host: addr: {"unlock_${host}" = "ssh root@${addr}";}) unlock-clearnet-hosts;
|
||||
}
|
||||
concatMapAttrs (host: addr: { "unlock-over-tor_${host}" = "torsocks ssh root@${addr}"; }) unlock-onion-hosts
|
||||
//
|
||||
concatMapAttrs (host: addr: { "unlock_${host}" = "ssh root@${addr}"; }) unlock-clearnet-hosts;
|
||||
}
|
||||
|
||||
@@ -110,4 +110,4 @@ in
|
||||
};
|
||||
age.secrets."pia-login.conf".file = ../../secrets/pia-login.conf;
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
@@ -72,7 +72,8 @@ let
|
||||
portForwarding = cfg.forwardPortForTransmission || cfg.forwardedPort != null;
|
||||
|
||||
containerServiceName = "container@${config.vpn-container.containerName}.service";
|
||||
in {
|
||||
in
|
||||
{
|
||||
options.pia.wireguard = {
|
||||
enable = mkEnableOption "Enable private internet access";
|
||||
badPortForwardPorts = mkOption {
|
||||
@@ -157,7 +158,7 @@ in {
|
||||
|
||||
# restart once a month; PIA forwarded port expires after two months
|
||||
# because the container is "PartOf" this unit, it gets restarted too
|
||||
RuntimeMaxSec="30d";
|
||||
RuntimeMaxSec = "30d";
|
||||
};
|
||||
|
||||
script = ''
|
||||
@@ -353,4 +354,4 @@ in {
|
||||
|
||||
age.secrets."pia-login.conf".file = ../../secrets/pia-login.conf;
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
@@ -11,34 +11,35 @@ let
|
||||
cfg = config.keepalive-ping;
|
||||
|
||||
serviceTemplate = host:
|
||||
{
|
||||
"keepalive-ping@${host}" = {
|
||||
description = "Periodic ping keep alive for ${host} connection";
|
||||
{
|
||||
"keepalive-ping@${host}" = {
|
||||
description = "Periodic ping keep alive for ${host} connection";
|
||||
|
||||
requires = [ "network-online.target" ];
|
||||
after = [ "network.target" "network-online.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig.Restart="always";
|
||||
requires = [ "network-online.target" ];
|
||||
after = [ "network.target" "network-online.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig.Restart = "always";
|
||||
|
||||
path = with pkgs; [ iputils ];
|
||||
path = with pkgs; [ iputils ];
|
||||
|
||||
script = ''
|
||||
ping -i ${cfg.delay} ${host} &>/dev/null
|
||||
'';
|
||||
script = ''
|
||||
ping -i ${cfg.delay} ${host} &>/dev/null
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
combineAttrs = foldl recursiveUpdate {};
|
||||
combineAttrs = foldl recursiveUpdate { };
|
||||
|
||||
serviceList = map serviceTemplate cfg.hosts;
|
||||
|
||||
services = combineAttrs serviceList;
|
||||
in {
|
||||
in
|
||||
{
|
||||
options.keepalive-ping = {
|
||||
enable = mkEnableOption "Enable keep alive ping task";
|
||||
hosts = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [];
|
||||
default = [ ];
|
||||
description = ''
|
||||
Hosts to ping periodically
|
||||
'';
|
||||
@@ -55,4 +56,4 @@ in {
|
||||
config = mkIf cfg.enable {
|
||||
systemd.services = services;
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
@@ -17,4 +17,4 @@ in
|
||||
# exit node
|
||||
config.networking.firewall.checkReversePath = mkIf cfg.exitNode "loose";
|
||||
config.networking.ip_forward = mkIf cfg.exitNode true;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -30,7 +30,7 @@ in
|
||||
|
||||
config = mkOption {
|
||||
type = types.anything;
|
||||
default = {};
|
||||
default = { };
|
||||
example = ''
|
||||
{
|
||||
services.nginx.enable = true;
|
||||
@@ -70,7 +70,7 @@ in
|
||||
localAddress = "172.16.100.2";
|
||||
|
||||
config = {
|
||||
imports = allModules ++ [cfg.config];
|
||||
imports = allModules ++ [ cfg.config ];
|
||||
|
||||
# speeds up evaluation
|
||||
nixpkgs.pkgs = pkgs;
|
||||
@@ -106,4 +106,4 @@ in
|
||||
networking.usePredictableInterfaceNames = false;
|
||||
networking.nat.externalInterface = "eth0";
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
@@ -2,7 +2,8 @@
|
||||
|
||||
let
|
||||
cfg = config.de;
|
||||
in {
|
||||
in
|
||||
{
|
||||
config = lib.mkIf cfg.enable {
|
||||
# enable pulseaudio support for packages
|
||||
nixpkgs.config.pulseaudio = true;
|
||||
@@ -28,29 +29,29 @@ in {
|
||||
# properyty when no other driver is currently active. JACK clients need this.
|
||||
factory = "spa-node-factory";
|
||||
args = {
|
||||
"factory.name" = "support.node.driver";
|
||||
"node.name" = "Dummy-Driver";
|
||||
"priority.driver" = 8000;
|
||||
"factory.name" = "support.node.driver";
|
||||
"node.name" = "Dummy-Driver";
|
||||
"priority.driver" = 8000;
|
||||
};
|
||||
}
|
||||
{
|
||||
factory = "adapter";
|
||||
args = {
|
||||
"factory.name" = "support.null-audio-sink";
|
||||
"node.name" = "Microphone-Proxy";
|
||||
"factory.name" = "support.null-audio-sink";
|
||||
"node.name" = "Microphone-Proxy";
|
||||
"node.description" = "Microphone";
|
||||
"media.class" = "Audio/Source/Virtual";
|
||||
"audio.position" = "MONO";
|
||||
"media.class" = "Audio/Source/Virtual";
|
||||
"audio.position" = "MONO";
|
||||
};
|
||||
}
|
||||
{
|
||||
factory = "adapter";
|
||||
args = {
|
||||
"factory.name" = "support.null-audio-sink";
|
||||
"node.name" = "Main-Output-Proxy";
|
||||
"factory.name" = "support.null-audio-sink";
|
||||
"node.name" = "Main-Output-Proxy";
|
||||
"node.description" = "Main Output";
|
||||
"media.class" = "Audio/Sink";
|
||||
"audio.position" = "FL,FR";
|
||||
"media.class" = "Audio/Sink";
|
||||
"audio.position" = "FL,FR";
|
||||
};
|
||||
}
|
||||
];
|
||||
|
||||
@@ -49,7 +49,8 @@ let
|
||||
];
|
||||
};
|
||||
|
||||
in {
|
||||
in
|
||||
{
|
||||
config = lib.mkIf cfg.enable {
|
||||
# chromium with specific extensions + settings
|
||||
programs.chromium = {
|
||||
@@ -92,7 +93,7 @@ in {
|
||||
enable = true;
|
||||
extraPackages = with pkgs; [
|
||||
intel-media-driver # LIBVA_DRIVER_NAME=iHD
|
||||
vaapiIntel # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium)
|
||||
vaapiIntel # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium)
|
||||
# vaapiVdpau
|
||||
libvdpau-va-gl
|
||||
nvidia-vaapi-driver
|
||||
|
||||
@@ -2,15 +2,16 @@
|
||||
|
||||
let
|
||||
cfg = config.de;
|
||||
in {
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
./kde.nix
|
||||
./xfce.nix
|
||||
./yubikey.nix
|
||||
./chromium.nix
|
||||
# ./firefox.nix
|
||||
# ./firefox.nix
|
||||
./audio.nix
|
||||
# ./torbrowser.nix
|
||||
# ./torbrowser.nix
|
||||
./pithos.nix
|
||||
./spotify.nix
|
||||
./vscodium.nix
|
||||
@@ -52,6 +53,10 @@ in {
|
||||
jellyfin-media-player
|
||||
joplin-desktop
|
||||
config.inputs.deploy-rs.packages.${config.currentSystem}.deploy-rs
|
||||
|
||||
# For Nix IDE
|
||||
nixpkgs-fmt
|
||||
rnix-lsp
|
||||
];
|
||||
|
||||
# Networking
|
||||
|
||||
@@ -2,10 +2,11 @@
|
||||
|
||||
let
|
||||
cfg = config.de;
|
||||
in {
|
||||
in
|
||||
{
|
||||
config = lib.mkIf cfg.enable {
|
||||
users.users.googlebot.packages = [
|
||||
pkgs.discord
|
||||
];
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
@@ -20,7 +20,7 @@ let
|
||||
};
|
||||
|
||||
firefox = pkgs.wrapFirefox somewhatPrivateFF {
|
||||
desktopName = "Sneed Browser";
|
||||
desktopName = "Sneed Browser";
|
||||
|
||||
nixExtensions = [
|
||||
(pkgs.fetchFirefoxAddon {
|
||||
@@ -71,8 +71,8 @@ let
|
||||
TopSites = false;
|
||||
};
|
||||
UserMessaging = {
|
||||
ExtensionRecommendations = false;
|
||||
SkipOnboarding = true;
|
||||
ExtensionRecommendations = false;
|
||||
SkipOnboarding = true;
|
||||
};
|
||||
WebsiteFilter = {
|
||||
Block = [
|
||||
@@ -92,4 +92,4 @@ in
|
||||
config = lib.mkIf cfg.enable {
|
||||
users.users.googlebot.packages = [ firefox ];
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
@@ -2,7 +2,8 @@
|
||||
|
||||
let
|
||||
cfg = config.de;
|
||||
in {
|
||||
in
|
||||
{
|
||||
config = lib.mkIf cfg.enable {
|
||||
# kde plasma
|
||||
services.xserver = {
|
||||
@@ -19,5 +20,5 @@ in {
|
||||
# plasma5Packages.kmail-account-wizard
|
||||
kate
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -14,22 +14,23 @@ let
|
||||
version_opts = "vers=3.1.1";
|
||||
|
||||
opts = "${systemd_opts},${network_opts},${user_opts},${version_opts},${auth_opts}";
|
||||
in {
|
||||
in
|
||||
{
|
||||
options.services.mount-samba = {
|
||||
enable = lib.mkEnableOption "enable mounting samba shares";
|
||||
};
|
||||
|
||||
config = lib.mkIf (cfg.enable && config.services.tailscale.enable) {
|
||||
fileSystems."/mnt/public" = {
|
||||
device = "//s0.koi-bebop.ts.net/public";
|
||||
fsType = "cifs";
|
||||
options = [ opts ];
|
||||
device = "//s0.koi-bebop.ts.net/public";
|
||||
fsType = "cifs";
|
||||
options = [ opts ];
|
||||
};
|
||||
|
||||
fileSystems."/mnt/private" = {
|
||||
device = "//s0.koi-bebop.ts.net/googlebot";
|
||||
fsType = "cifs";
|
||||
options = [ opts ];
|
||||
device = "//s0.koi-bebop.ts.net/googlebot";
|
||||
fsType = "cifs";
|
||||
options = [ opts ];
|
||||
};
|
||||
|
||||
age.secrets.smb-secrets.file = ../../secrets/smb-secrets.age;
|
||||
@@ -44,4 +45,4 @@ in {
|
||||
vault_lock = "umount /mnt/vault/";
|
||||
};
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
@@ -2,7 +2,8 @@
|
||||
|
||||
let
|
||||
cfg = config.de;
|
||||
in {
|
||||
in
|
||||
{
|
||||
config = lib.mkIf cfg.enable {
|
||||
nixpkgs.overlays = [
|
||||
(self: super: {
|
||||
@@ -11,7 +12,7 @@ in {
|
||||
version = "1.5.1";
|
||||
src = super.fetchFromGitHub {
|
||||
owner = pname;
|
||||
repo = pname;
|
||||
repo = pname;
|
||||
rev = version;
|
||||
sha256 = "il7OAALpHFZ6wjco9Asp04zWHCD8Ni+iBdiJWcMiQA4=";
|
||||
};
|
||||
|
||||
@@ -4,7 +4,7 @@ with lib;
|
||||
|
||||
let
|
||||
cfg = config.services.spotifyd;
|
||||
toml = pkgs.formats.toml {};
|
||||
toml = pkgs.formats.toml { };
|
||||
spotifydConf = toml.generate "spotify.conf" cfg.settings;
|
||||
in
|
||||
{
|
||||
@@ -17,7 +17,7 @@ in
|
||||
enable = mkEnableOption "spotifyd, a Spotify playing daemon";
|
||||
|
||||
settings = mkOption {
|
||||
default = {};
|
||||
default = { };
|
||||
type = toml.type;
|
||||
example = { global.bitrate = 320; };
|
||||
description = ''
|
||||
@@ -28,7 +28,7 @@ in
|
||||
|
||||
users = mkOption {
|
||||
type = with types; listOf str;
|
||||
default = [];
|
||||
default = [ ];
|
||||
description = ''
|
||||
Usernames to be added to the "spotifyd" group, so that they
|
||||
can start and interact with the userspace daemon.
|
||||
@@ -83,4 +83,4 @@ in
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
@@ -2,7 +2,8 @@
|
||||
|
||||
let
|
||||
cfg = config.de;
|
||||
in {
|
||||
in
|
||||
{
|
||||
config = lib.mkIf cfg.enable {
|
||||
programs.steam.enable = true;
|
||||
hardware.steam-hardware.enable = true; # steam controller
|
||||
@@ -11,4 +12,4 @@ in {
|
||||
pkgs.steam
|
||||
];
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
@@ -2,7 +2,8 @@
|
||||
|
||||
let
|
||||
cfg = config.de;
|
||||
in {
|
||||
in
|
||||
{
|
||||
config = lib.mkIf cfg.enable {
|
||||
nixpkgs.overlays = [
|
||||
(self: super: {
|
||||
|
||||
@@ -2,7 +2,8 @@
|
||||
|
||||
let
|
||||
cfg = config.de.touchpad;
|
||||
in {
|
||||
in
|
||||
{
|
||||
options.de.touchpad = {
|
||||
enable = lib.mkEnableOption "enable touchpad";
|
||||
};
|
||||
|
||||
@@ -4,8 +4,8 @@ let
|
||||
cfg = config.de;
|
||||
|
||||
extensions = with pkgs.vscode-extensions; [
|
||||
# bbenoist.Nix # nix syntax support
|
||||
# arrterian.nix-env-selector # nix dev envs
|
||||
# bbenoist.Nix # nix syntax support
|
||||
# arrterian.nix-env-selector # nix dev envs
|
||||
];
|
||||
|
||||
vscodium-with-extensions = pkgs.vscode-with-extensions.override {
|
||||
|
||||
@@ -2,7 +2,8 @@
|
||||
|
||||
let
|
||||
cfg = config.de;
|
||||
in {
|
||||
in
|
||||
{
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.xserver = {
|
||||
enable = true;
|
||||
|
||||
@@ -2,7 +2,8 @@
|
||||
|
||||
let
|
||||
cfg = config.de;
|
||||
in {
|
||||
in
|
||||
{
|
||||
config = lib.mkIf cfg.enable {
|
||||
# yubikey
|
||||
services.pcscd.enable = true;
|
||||
|
||||
@@ -3,13 +3,13 @@
|
||||
with lib;
|
||||
let
|
||||
cfg = config.ceph;
|
||||
in {
|
||||
options.ceph = {
|
||||
};
|
||||
in
|
||||
{
|
||||
options.ceph = { };
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
# ceph.enable = true;
|
||||
|
||||
|
||||
## S3 Object gateway
|
||||
#ceph.rgw.enable = true;
|
||||
#ceph.rgw.daemons = [
|
||||
@@ -40,4 +40,4 @@ in {
|
||||
ceph.global.fsid = "925773DC-D95F-476C-BBCD-08E01BF0865F";
|
||||
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
@@ -19,4 +19,4 @@
|
||||
./iodine.nix
|
||||
./searx.nix
|
||||
];
|
||||
}
|
||||
}
|
||||
|
||||
@@ -2,7 +2,8 @@
|
||||
|
||||
let
|
||||
cfg = config.services.gitea;
|
||||
in {
|
||||
in
|
||||
{
|
||||
options.services.gitea = {
|
||||
hostname = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
@@ -40,4 +41,4 @@ in {
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
@@ -20,6 +20,6 @@ in
|
||||
hydraURL = "https://${domain}";
|
||||
useSubstitutes = true;
|
||||
notificationSender = notifyEmail;
|
||||
buildMachinesFiles = [];
|
||||
buildMachinesFiles = [ ];
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
@@ -7,7 +7,8 @@
|
||||
|
||||
let
|
||||
cfg = config.services.icecast;
|
||||
in {
|
||||
in
|
||||
{
|
||||
options.services.icecast = {
|
||||
mount = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
|
||||
@@ -2,7 +2,8 @@
|
||||
|
||||
let
|
||||
cfg = config.services.iodine.server;
|
||||
in {
|
||||
in
|
||||
{
|
||||
config = lib.mkIf cfg.enable {
|
||||
# iodine DNS-based vpn
|
||||
services.iodine.server = {
|
||||
@@ -17,4 +18,4 @@ in {
|
||||
"dns0" # iodine
|
||||
];
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
@@ -15,7 +15,8 @@ let
|
||||
"bsd.ninja"
|
||||
"bsd.rocks"
|
||||
];
|
||||
in {
|
||||
in
|
||||
{
|
||||
config = lib.mkIf cfg.enable {
|
||||
# kresd doesn't work with tailscale MagicDNS
|
||||
mailserver.localDnsResolver = false;
|
||||
@@ -60,10 +61,12 @@ in {
|
||||
sender_dependent_relayhost_maps = "hash:/var/lib/postfix/conf/sender_relay";
|
||||
smtp_sender_dependent_authentication = "yes";
|
||||
};
|
||||
services.postfix.mapFiles.sender_relay = let
|
||||
relayHost = "[smtp.mailgun.org]:587";
|
||||
in pkgs.writeText "sender_relay"
|
||||
(concatStringsSep "\n" (map (domain: "@${domain} ${relayHost}") domains));
|
||||
services.postfix.mapFiles.sender_relay =
|
||||
let
|
||||
relayHost = "[smtp.mailgun.org]:587";
|
||||
in
|
||||
pkgs.writeText "sender_relay"
|
||||
(concatStringsSep "\n" (map (domain: "@${domain} ${relayHost}") domains));
|
||||
services.postfix.mapFiles.sasl_relay_passwd = "/run/agenix/sasl_relay_passwd";
|
||||
age.secrets.sasl_relay_passwd.file = ../../secrets/sasl_relay_passwd.age;
|
||||
|
||||
@@ -80,4 +83,4 @@ in {
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
@@ -3,7 +3,8 @@
|
||||
let
|
||||
cfg = config.services.matrix;
|
||||
certs = config.security.acme.certs;
|
||||
in {
|
||||
in
|
||||
{
|
||||
options.services.matrix = {
|
||||
enable = lib.mkEnableOption "enable matrix";
|
||||
element-web = {
|
||||
@@ -62,15 +63,15 @@ in {
|
||||
settings = {
|
||||
server_name = cfg.host;
|
||||
enable_registration = cfg.enable_registration;
|
||||
listeners = [ {
|
||||
bind_addresses = ["127.0.0.1"];
|
||||
listeners = [{
|
||||
bind_addresses = [ "127.0.0.1" ];
|
||||
port = cfg.port;
|
||||
tls = false;
|
||||
resources = [ {
|
||||
resources = [{
|
||||
compress = true;
|
||||
names = [ "client" "federation" ];
|
||||
} ];
|
||||
} ];
|
||||
}];
|
||||
}];
|
||||
turn_uris = [
|
||||
"turn:${cfg.turn.host}:${toString cfg.turn.port}?transport=udp"
|
||||
"turn:${cfg.turn.host}:${toString cfg.turn.port}?transport=tcp"
|
||||
@@ -120,7 +121,7 @@ in {
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
|
||||
virtualHosts.${cfg.host} = {
|
||||
virtualHosts.${cfg.host} = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
listen = [
|
||||
@@ -137,7 +138,8 @@ in {
|
||||
];
|
||||
locations."/".proxyPass = "http://localhost:${toString cfg.port}";
|
||||
};
|
||||
virtualHosts.${cfg.turn.host} = { # get TLS cert for TURN server
|
||||
virtualHosts.${cfg.turn.host} = {
|
||||
# get TLS cert for TURN server
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
};
|
||||
@@ -214,4 +216,4 @@ in {
|
||||
openFirewall = true;
|
||||
};
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
@@ -3,7 +3,8 @@
|
||||
let
|
||||
cfg = config.services.murmur;
|
||||
certs = config.security.acme.certs;
|
||||
in {
|
||||
in
|
||||
{
|
||||
options.services.murmur.domain = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
};
|
||||
|
||||
@@ -3,7 +3,8 @@
|
||||
|
||||
let
|
||||
cfg = config.services.nextcloud;
|
||||
in {
|
||||
in
|
||||
{
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.nextcloud = {
|
||||
https = true;
|
||||
@@ -24,4 +25,4 @@ in {
|
||||
forceSSL = true;
|
||||
};
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
@@ -5,7 +5,8 @@ let
|
||||
nginxWithRTMP = pkgs.nginx.override {
|
||||
modules = [ pkgs.nginxModules.rtmp ];
|
||||
};
|
||||
in {
|
||||
in
|
||||
{
|
||||
options.services.nginx.stream = {
|
||||
enable = lib.mkEnableOption "enable nginx rtmp/hls/dash video streaming";
|
||||
port = lib.mkOption {
|
||||
@@ -72,4 +73,4 @@ in {
|
||||
cfg.port
|
||||
];
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
@@ -2,7 +2,8 @@
|
||||
|
||||
let
|
||||
cfg = config.services.nginx;
|
||||
in {
|
||||
in
|
||||
{
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.nginx = {
|
||||
recommendedGzipSettings = true;
|
||||
@@ -13,4 +14,4 @@ in {
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
@@ -4,7 +4,8 @@ with lib;
|
||||
|
||||
let
|
||||
cfg = config.services.owncast;
|
||||
in {
|
||||
in
|
||||
{
|
||||
options.services.owncast = {
|
||||
hostname = lib.mkOption {
|
||||
type = types.str;
|
||||
@@ -28,4 +29,4 @@ in {
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
@@ -14,7 +14,8 @@ let
|
||||
cp -ar $src $out
|
||||
'';
|
||||
};
|
||||
in {
|
||||
in
|
||||
{
|
||||
options.services.privatebin = {
|
||||
enable = lib.mkEnableOption "enable privatebin";
|
||||
host = lib.mkOption {
|
||||
@@ -30,7 +31,7 @@ in {
|
||||
group = "privatebin";
|
||||
isSystemUser = true;
|
||||
};
|
||||
users.groups.privatebin = {};
|
||||
users.groups.privatebin = { };
|
||||
|
||||
services.nginx.enable = true;
|
||||
services.nginx.virtualHosts.${cfg.host} = {
|
||||
@@ -53,7 +54,7 @@ in {
|
||||
"d '/var/lib/privatebin' 0750 privatebin privatebin - -"
|
||||
];
|
||||
|
||||
services.phpfpm.pools.privatebin = {
|
||||
services.phpfpm.pools.privatebin = {
|
||||
user = "privatebin";
|
||||
group = "privatebin";
|
||||
phpEnv = {
|
||||
|
||||
@@ -3,7 +3,8 @@
|
||||
let
|
||||
cfg = config.services.radio;
|
||||
radioPackage = config.inputs.radio.packages.${config.currentSystem}.radio;
|
||||
in {
|
||||
in
|
||||
{
|
||||
options.services.radio = {
|
||||
enable = lib.mkEnableOption "enable radio";
|
||||
user = lib.mkOption {
|
||||
@@ -56,11 +57,11 @@ in {
|
||||
home = cfg.dataDir;
|
||||
createHome = true;
|
||||
};
|
||||
users.groups.${cfg.group} = {};
|
||||
users.groups.${cfg.group} = { };
|
||||
systemd.services.radio = {
|
||||
enable = true;
|
||||
after = ["network.target"];
|
||||
wantedBy = ["multi-user.target"];
|
||||
after = [ "network.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig.ExecStart = "${radioPackage}/bin/radio ${config.services.icecast.listen.address}:${toString config.services.icecast.listen.port} ${config.services.icecast.mount} 5500";
|
||||
serviceConfig.User = cfg.user;
|
||||
serviceConfig.Group = cfg.group;
|
||||
@@ -71,4 +72,4 @@ in {
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
@@ -110,6 +110,6 @@
|
||||
# samba user for share
|
||||
users.users.cris.isSystemUser = true;
|
||||
users.users.cris.group = "cris";
|
||||
users.groups.cris = {};
|
||||
users.groups.cris = { };
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
@@ -2,19 +2,20 @@
|
||||
|
||||
let
|
||||
cfg = config.services.searx;
|
||||
in {
|
||||
in
|
||||
{
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.searx = {
|
||||
environmentFile = "/run/agenix/searx";
|
||||
settings = {
|
||||
server.port = 43254;
|
||||
server.secret_key = "@SEARX_SECRET_KEY@";
|
||||
engines = [ {
|
||||
engines = [{
|
||||
name = "wolframalpha";
|
||||
shortcut = "wa";
|
||||
api_key = "@WOLFRAM_API_KEY@";
|
||||
engine = "wolframalpha_api";
|
||||
} ];
|
||||
}];
|
||||
};
|
||||
};
|
||||
services.nginx.virtualHosts."search.neet.space" = {
|
||||
@@ -26,4 +27,4 @@ in {
|
||||
};
|
||||
age.secrets.searx.file = ../../secrets/searx.age;
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
@@ -2,7 +2,8 @@
|
||||
|
||||
let
|
||||
cfg = config.services.thelounge;
|
||||
in {
|
||||
in
|
||||
{
|
||||
options.services.thelounge = {
|
||||
fileUploadBaseUrl = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
@@ -28,7 +29,7 @@ in {
|
||||
reverseProxy = true;
|
||||
maxHistory = -1;
|
||||
https.enable = false;
|
||||
# theme = "thelounge-theme-solarized";
|
||||
# theme = "thelounge-theme-solarized";
|
||||
prefetch = false;
|
||||
prefetchStorage = false;
|
||||
fileUpload = {
|
||||
|
||||
@@ -15,14 +15,14 @@ let
|
||||
in
|
||||
{
|
||||
networking.firewall.allowedUDPPorts = [ rtp-port ];
|
||||
networking.firewall.allowedTCPPortRanges = [ {
|
||||
networking.firewall.allowedTCPPortRanges = [{
|
||||
from = webrtc-peer-lower-port;
|
||||
to = webrtc-peer-upper-port;
|
||||
} ];
|
||||
networking.firewall.allowedUDPPortRanges = [ {
|
||||
}];
|
||||
networking.firewall.allowedUDPPortRanges = [{
|
||||
from = webrtc-peer-lower-port;
|
||||
to = webrtc-peer-upper-port;
|
||||
} ];
|
||||
}];
|
||||
|
||||
virtualisation.docker.enable = true;
|
||||
|
||||
@@ -49,12 +49,12 @@ in
|
||||
ports = [
|
||||
"${toStr ingest-port}:8084"
|
||||
];
|
||||
# imageFile = pkgs.dockerTools.pullImage {
|
||||
# imageName = "projectlightspeed/ingest";
|
||||
# finalImageTag = "version-0.1.4";
|
||||
# imageDigest = "sha256:9fc51833b7c27a76d26e40f092b9cec1ac1c4bfebe452e94ad3269f1f73ff2fc";
|
||||
# sha256 = "19kxl02x0a3i6hlnsfcm49hl6qxnq2f3hfmyv1v8qdaz58f35kd5";
|
||||
# };
|
||||
# imageFile = pkgs.dockerTools.pullImage {
|
||||
# imageName = "projectlightspeed/ingest";
|
||||
# finalImageTag = "version-0.1.4";
|
||||
# imageDigest = "sha256:9fc51833b7c27a76d26e40f092b9cec1ac1c4bfebe452e94ad3269f1f73ff2fc";
|
||||
# sha256 = "19kxl02x0a3i6hlnsfcm49hl6qxnq2f3hfmyv1v8qdaz58f35kd5";
|
||||
# };
|
||||
};
|
||||
"lightspeed-react" = {
|
||||
workdir = "/var/lib/lightspeed-react";
|
||||
@@ -62,12 +62,12 @@ in
|
||||
ports = [
|
||||
"${toStr web-port}:80"
|
||||
];
|
||||
# imageFile = pkgs.dockerTools.pullImage {
|
||||
# imageName = "projectlightspeed/react";
|
||||
# finalImageTag = "version-0.1.3";
|
||||
# imageDigest = "sha256:b7c58425f1593f7b4304726b57aa399b6e216e55af9c0962c5c19333fae638b6";
|
||||
# sha256 = "0d2jh7mr20h7dxgsp7ml7cw2qd4m8ja9rj75dpy59zyb6v0bn7js";
|
||||
# };
|
||||
# imageFile = pkgs.dockerTools.pullImage {
|
||||
# imageName = "projectlightspeed/react";
|
||||
# finalImageTag = "version-0.1.3";
|
||||
# imageDigest = "sha256:b7c58425f1593f7b4304726b57aa399b6e216e55af9c0962c5c19333fae638b6";
|
||||
# sha256 = "0d2jh7mr20h7dxgsp7ml7cw2qd4m8ja9rj75dpy59zyb6v0bn7js";
|
||||
# };
|
||||
};
|
||||
"lightspeed-webrtc" = {
|
||||
workdir = "/var/lib/lightspeed-webrtc";
|
||||
@@ -79,15 +79,18 @@ in
|
||||
"${toStr webrtc-peer-lower-port}-${toStr webrtc-peer-upper-port}:${toStr webrtc-peer-lower-port}-${toStr webrtc-peer-upper-port}/udp"
|
||||
];
|
||||
cmd = [
|
||||
"lightspeed-webrtc" "--addr=0.0.0.0" "--ip=${domain}"
|
||||
"--ports=${toStr webrtc-peer-lower-port}-${toStr webrtc-peer-upper-port}" "run"
|
||||
"lightspeed-webrtc"
|
||||
"--addr=0.0.0.0"
|
||||
"--ip=${domain}"
|
||||
"--ports=${toStr webrtc-peer-lower-port}-${toStr webrtc-peer-upper-port}"
|
||||
"run"
|
||||
];
|
||||
# imageFile = pkgs.dockerTools.pullImage {
|
||||
# imageName = "projectlightspeed/webrtc";
|
||||
# finalImageTag = "version-0.1.2";
|
||||
# imageDigest = "sha256:ddf8b3dd294485529ec11d1234a3fc38e365a53c4738998c6bc2c6930be45ecf";
|
||||
# sha256 = "1bdy4ak99fjdphj5bsk8rp13xxmbqdhfyfab14drbyffivg9ad2i";
|
||||
# };
|
||||
# imageFile = pkgs.dockerTools.pullImage {
|
||||
# imageName = "projectlightspeed/webrtc";
|
||||
# finalImageTag = "version-0.1.2";
|
||||
# imageDigest = "sha256:ddf8b3dd294485529ec11d1234a3fc38e365a53c4738998c6bc2c6930be45ecf";
|
||||
# sha256 = "1bdy4ak99fjdphj5bsk8rp13xxmbqdhfyfab14drbyffivg9ad2i";
|
||||
# };
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
import ./module.nix ({ name, description, serviceConfig }:
|
||||
|
||||
{
|
||||
systemd.user.services.${name} = {
|
||||
inherit description serviceConfig;
|
||||
wantedBy = [ "default.target" ];
|
||||
};
|
||||
})
|
||||
{
|
||||
systemd.user.services.${name} = {
|
||||
inherit description serviceConfig;
|
||||
wantedBy = [ "default.target" ];
|
||||
};
|
||||
})
|
||||
|
||||
@@ -1,15 +1,15 @@
|
||||
import ./module.nix ({ name, description, serviceConfig }:
|
||||
|
||||
{
|
||||
systemd.user.services.${name} = {
|
||||
Unit = {
|
||||
Description = description;
|
||||
};
|
||||
{
|
||||
systemd.user.services.${name} = {
|
||||
Unit = {
|
||||
Description = description;
|
||||
};
|
||||
|
||||
Service = serviceConfig;
|
||||
Service = serviceConfig;
|
||||
|
||||
Install = {
|
||||
WantedBy = [ "default.target" ];
|
||||
Install = {
|
||||
WantedBy = [ "default.target" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
})
|
||||
})
|
||||
|
||||
@@ -2,7 +2,8 @@
|
||||
|
||||
let
|
||||
cfg = config.services.zerobin;
|
||||
in {
|
||||
in
|
||||
{
|
||||
options.services.zerobin = {
|
||||
host = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
|
||||
@@ -47,4 +47,4 @@
|
||||
});
|
||||
})
|
||||
];
|
||||
}
|
||||
}
|
||||
|
||||
@@ -37,4 +37,4 @@ rec {
|
||||
storage = with system; [
|
||||
s0
|
||||
];
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user