cy/nixos-config
cy/nixos-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

use rfc-style formatter

Browse source
This commit is contained in:
cy 2024-12-19 02:32:58 -05:00
parent 993b457e0b
commit f57ed53bc5
30 changed files with 324 additions and 176 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
flake.nix
View file

@ -13,12 +13,14 @@
};
};
outputs = {
outputs =
{
self,
nixpkgs,
home-manager,
...
} @ inputs: let
}@inputs:
let
lib = nixpkgs.lib;
inherit (self) outputs;
@ -33,17 +35,20 @@
};
}
);
in {
in
{
packages = forEachSystem (pkgs: import ./pkgs { inherit pkgs; });
formatter = forEachSystem (pkgs: pkgs.alejandra);
formatter = forEachSystem (pkgs: pkgs.nixfmt-rfc-style);
devShells = forEachSystem (pkgs: import ./shells { inherit pkgs; });
nixosModules = import ./modules/nixos;
homeManagerModules = import ./modules/home-manager;
overlays = import ./overlays { inherit inputs outputs; };
nixosConfigurations = let
nixosConfigurations =
let
pkgs = pkgsFor.x86_64-linux;
in {
in
{
ytnix = lib.nixosSystem {
specialArgs = { inherit inputs outputs; };
modules = [

3
home/foot.nix
View file

@ -1,4 +1,5 @@
{...}: {
{ ... }:
{
programs.foot = {
enable = true;
settings = {

3
home/tmux.nix
View file

@ -1,4 +1,5 @@
{pkgs, ...}: {
{ pkgs, ... }:
{
programs.tmux = {
enable = true;
baseIndex = 1;

3
home/yt/chunk.nix
View file

@ -5,7 +5,8 @@
inputs,
outputs,
...
}: {
}:
{
imports = [
./common.nix
];

3
home/yt/common.nix
View file

@ -1,4 +1,5 @@
{...}: {
{ ... }:
{
imports = [
../tmux.nix
../zsh

3
home/yt/ytnix.nix
View file

@ -2,7 +2,8 @@
pkgs,
inputs,
...
}: {
}:
{
imports = [
./common.nix
../foot.nix

8
home/zsh/default.nix
View file

@ -1,9 +1,13 @@
{...}: {
{ ... }:
{
programs.zsh = {
enable = true;
autosuggestion = {
enable = true;
strategy = ["history" "completion"];
strategy = [
"history"
"completion"
];
};
syntaxHighlighting = {
enable = true;

3
hosts/chunk/adguard.nix
View file

@ -1,4 +1,5 @@
{...}: {
{ ... }:
{
services.adguardhome = {
enable = true;
host = "127.0.0.1";

28
hosts/chunk/borg.nix
View file

@ -2,11 +2,29 @@
pkgs,
config,
...
}: {
}:
{
services.borgbackup.jobs = {
crashRsync = {
paths = ["/root" "/home" "/var/backup" "/var/lib" "/var/log" "/opt" "/etc" "/vw-data"];
exclude = ["**/.cache" "**/node_modules" "**/cache" "**/Cache" "/var/lib/docker" "/var/lib/containers/cache" "/var/lib/containers/overlay*"];
paths = [
"/root"
"/home"
"/var/backup"
"/var/lib"
"/var/log"
"/opt"
"/etc"
"/vw-data"
];
exclude = [
"**/.cache"
"**/node_modules"
"**/cache"
"**/Cache"
"/var/lib/docker"
"/var/lib/containers/cache"
"/var/lib/containers/overlay*"
];
repo = "de3911@de3911.rsync.net:borg/crash";
encryption = {
mode = "repokey-blake2";
@ -22,7 +40,9 @@
# warnings are often not that serious
failOnWarnings = false;
postHook = ''
${pkgs.curl}/bin/curl -u $(cat ${config.sops.secrets."services/ntfy".path}) -d "chunk: backup completed with exit code: $exitStatus
${pkgs.curl}/bin/curl -u $(cat ${
config.sops.secrets."services/ntfy".path
}) -d "chunk: backup completed with exit code: $exitStatus
$(journalctl -u borgbackup-job-crashRsync.service|tail -n 5)" \
https://ntfy.cything.io/chunk
'';

3
hosts/chunk/conduit.nix
View file

@ -2,7 +2,8 @@
pkgs,
config,
...
}: {
}:
{
virtualisation.oci-containers.containers.conduit = {
image = "matrixconduit/matrix-conduit:latest";
autoStart = true;

37
hosts/chunk/default.nix
View file

@ -3,7 +3,8 @@
lib,
pkgs,
...
}: {
}:
{
imports = [
./hardware-configuration.nix
../common.nix
@ -91,8 +92,19 @@
networking.networkmanager.enable = true;
networking.firewall = {
enable = true;
allowedTCPPorts = [22 80 443 53 853];
allowedUDPPorts = [443 51820 53 853]; # 51820 is wireguard
allowedTCPPorts = [
22
80
443
53
853
];
allowedUDPPorts = [
443
51820
53
853
]; # 51820 is wireguard
trustedInterfaces = [ "wg0" ];
};
networking.interfaces.ens18 = {
@ -117,7 +129,10 @@
address = "31.59.129.1";
interface = "ens18";
};
networking.nameservers = ["127.0.0.1" "::1"];
networking.nameservers = [
"127.0.0.1"
"::1"
];
time.timeZone = "America/Toronto";
@ -129,12 +144,20 @@
users.users.yt = {
isNormalUser = true;
extraGroups = ["wheel" "networkmanager" "podman"];
openssh.authorizedKeys.keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPdhAQYy0+vS+QmyCd0MAbqbgzyMGcsuuFyf6kg2yKge yt@ytlinux"];
extraGroups = [
"wheel"
"networkmanager"
"podman"
];
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPdhAQYy0+vS+QmyCd0MAbqbgzyMGcsuuFyf6kg2yKge yt@ytlinux"
];
shell = pkgs.zsh;
};
programs.zsh.enable = true;
users.users.root.openssh.authorizedKeys.keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPdhAQYy0+vS+QmyCd0MAbqbgzyMGcsuuFyf6kg2yKge yt@ytlinux"];
users.users.root.openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPdhAQYy0+vS+QmyCd0MAbqbgzyMGcsuuFyf6kg2yKge yt@ytlinux"
];
environment.systemPackages = with pkgs; [
vim

3
hosts/chunk/deluge.nix
View file

@ -1,4 +1,5 @@
{...}: {
{ ... }:
{
services.deluge = {
enable = true;
web = {

3
hosts/chunk/ghost.nix
View file

@ -2,7 +2,8 @@
pkgs,
config,
...
}: {
}:
{
virtualisation.oci-containers.containers.ghost = {
image = "ghost:5-alpine";
autoStart = true;

3
hosts/chunk/gitlab.nix
View file

@ -1,4 +1,5 @@
{config, ...}: {
{ config, ... }:
{
services.gitlab = {
enable = true;
https = true;

3
hosts/chunk/grafana.nix
View file

@ -1,4 +1,5 @@
{config, ...}: {
{ config, ... }:
{
services.grafana = {
enable = true;
settings.server = {

11
hosts/chunk/hardware-configuration.nix
View file

@ -7,12 +7,19 @@
pkgs,
modulesPath,
...
}: {
}:
{
imports = [
(modulesPath + "/profiles/qemu-guest.nix")
];
boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk"];
boot.initrd.availableKernelModules = [
"ata_piix"
"uhci_hcd"
"virtio_pci"
"sr_mod"
"virtio_blk"
];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];

3
hosts/chunk/hedgedoc.nix
View file

@ -1,4 +1,5 @@
{config, ...}: {
{ config, ... }:
{
services.hedgedoc = {
enable = true;
environmentFile = config.sops.secrets."hedgedoc/env".path;

29
hosts/chunk/immich.nix
View file

@ -2,13 +2,15 @@
pkgs,
config,
...
}: let
}:
let
uploadLocation = "/mnt/photos/immich";
thumbsLocation = "/opt/immich/thumbs";
profileLocation = "/opt/immich/profile";
dbDataLocation = "/opt/immich/postgres";
modelCache = "/opt/immich-ml";
in {
in
{
virtualisation.oci-containers.containers = {
immich-server = {
image = "ghcr.io/immich-app/immich-server:release";
@ -25,7 +27,10 @@ in {
DB_HOSTNAME = "immich-db";
};
networks = [ "immich-net" ];
dependsOn = ["immich-db" "immich-redis"];
dependsOn = [
"immich-db"
"immich-redis"
];
};
immich-redis = {
@ -48,12 +53,18 @@ in {
volumes = [ "${dbDataLocation}:/var/lib/postgresql/data" ];
cmd = [
"postgres"
"-c" "shared_preload_libraries=vectors.so"
"-c" ''search_path="$$user", public, vectors''
"-c" "logging_collector=on"
"-c" "max_wal_size=2GB"
"-c" "shared_buffers=512MB"
"-c" "wal_compression=on"
"-c"
"shared_preload_libraries=vectors.so"
"-c"
''search_path="$$user", public, vectors''
"-c"
"logging_collector=on"
"-c"
"max_wal_size=2GB"
"-c"
"shared_buffers=512MB"
"-c"
"wal_compression=on"
];
networks = [ "immich-net" ];
};

3
hosts/chunk/jellyfin.nix
View file

@ -1,4 +1,5 @@
{...}: {
{ ... }:
{
services.jellyfin = {
enable = true;
dataDir = "/mnt/jellyfin";

3
hosts/chunk/miniflux.nix
View file

@ -1,4 +1,5 @@
{config, ...}: {
{ config, ... }:
{
services.miniflux = {
enable = true;
adminCredentialsFile = config.sops.secrets."miniflux/env".path;

3
hosts/chunk/ntfy.nix
View file

@ -1,4 +1,5 @@
{...}: {
{ ... }:
{
services.ntfy-sh = {
enable = true;
settings = {

3
hosts/chunk/postgres.nix
View file

@ -2,7 +2,8 @@
pkgs,
lib,
...
}: {
}:
{
services.postgresql = {
enable = true;
settings.port = 5432;

3
hosts/chunk/rclone.nix
View file

@ -2,7 +2,8 @@
pkgs,
config,
...
}: {
}:
{
systemd.services.immich-mount = {
enable = true;
description = "Mount the immich data remote";

3
hosts/chunk/redlib.nix
View file

@ -1,4 +1,5 @@
{...}: {
{ ... }:
{
services.redlib = {
enable = true;
port = 8087;

3
hosts/chunk/tor.nix
View file

@ -1,4 +1,5 @@
{...}: {
{ ... }:
{
services.tor = {
enable = true;
openFirewall = true;

3
hosts/chunk/vaultwarden.nix
View file

@ -1,4 +1,5 @@
{config, ...}: {
{ config, ... }:
{
services.vaultwarden = {
enable = true;
dbBackend = "postgresql";

18
hosts/chunk/wireguard.nix
View file

@ -2,7 +2,8 @@
pkgs,
config,
...
}: {
}:
{
networking.nat = {
enable = true;
enableIPv6 = true;
@ -11,7 +12,10 @@
};
networking.wg-quick.interfaces.wg0 = {
address = ["10.0.0.1/24" "fdc9:281f:04d7:9ee9::1/64"];
address = [
"10.0.0.1/24"
"fdc9:281f:04d7:9ee9::1/64"
];
listenPort = 51820;
privateKeyFile = config.sops.secrets."wireguard/private".path;
postUp = ''
@ -33,12 +37,18 @@
peers = [
{
publicKey = "qUhWoTPVC7jJdDEJLYY92OeiwPkaf8I5pv5kkMcSW3g=";
allowedIPs = ["10.0.0.2/32" "fdc9:281f:04d7:9ee9::2/128"];
allowedIPs = [
"10.0.0.2/32"
"fdc9:281f:04d7:9ee9::2/128"
];
presharedKeyFile = config.sops.secrets."wireguard/psk-yt".path;
}
{
publicKey = "JIGi60wzLw717Cim1dSFoLCdJz5rePa5AIFfuisJI0k=";
allowedIPs = ["10.0.0.3/32" "fdc9:281f:04d7:9ee9::3/128"];
allowedIPs = [
"10.0.0.3/32"
"fdc9:281f:04d7:9ee9::3/128"
];
presharedKeyFile = config.sops.secrets."wireguard/psk-phone".path;
}
];

3
hosts/common.nix
View file

@ -1,4 +1,5 @@
{...}: {
{ ... }:
{
nix = {
settings = {
experimental-features = "nix-command flakes";

42
hosts/ytnix/default.nix
View file

@ -2,7 +2,8 @@
config,
pkgs,
...
}: {
}:
{
imports = [
./hardware-configuration.nix
../common.nix
@ -53,7 +54,10 @@
dns = "none";
wifi.backend = "iwd";
};
nameservers = ["31.59.129.225" "2a0f:85c1:840:2bfb::1"];
nameservers = [
"31.59.129.225"
"2a0f:85c1:840:2bfb::1"
];
resolvconf.enable = true;
firewall = {
allowedUDPPorts = [ 51820 ]; # for wireguard
@ -76,7 +80,10 @@
"bluez5.enable-sbc-xq" = true;
"bluez5.enable-msbc" = true;
"bluez5.enable-hw-volume" = true;
"bluez5.roles" = ["a2dp_sink" "a2dp_source"];
"bluez5.roles" = [
"a2dp_sink"
"a2dp_source"
];
};
};
# https://wiki.archlinux.org/title/Bluetooth_headset#Connecting_works,_sound_plays_fine_until_headphones_become_idle,_then_stutters
@ -100,7 +107,11 @@
users.users.yt = {
isNormalUser = true;
extraGroups = ["wheel" "libvirtd" "docker"];
extraGroups = [
"wheel"
"libvirtd"
"docker"
];
shell = pkgs.zsh;
};
programs.zsh.enable = true;
@ -168,7 +179,14 @@
programs.sway.enable = true;
services.borgbackup.jobs.ytnixRsync = {
paths = ["/root" "/home" "/var/lib" "/var/log" "/opt" "/etc"];
paths = [
"/root"
"/home"
"/var/lib"
"/var/log"
"/opt"
"/etc"
];
exclude = [
"**/.cache"
"**/node_modules"
@ -198,7 +216,9 @@
# warnings are often not that serious
failOnWarnings = false;
postHook = ''
${pkgs.curl}/bin/curl -u $(cat ${config.sops.secrets."services/ntfy".path}) -d "ytnixRsync: backup completed with exit code: $exitStatus
${pkgs.curl}/bin/curl -u $(cat ${
config.sops.secrets."services/ntfy".path
}) -d "ytnixRsync: backup completed with exit code: $exitStatus
$(journalctl -u borgbackup-job-ytnixRsync.service|tail -n 5)" \
https://ntfy.cything.io/chunk
'';
@ -286,12 +306,18 @@
# wireguard setup
networking.wg-quick.interfaces.wg0 = {
address = ["10.0.0.2/24" "fdc9:281f:04d7:9ee9::2/64"];
address = [
"10.0.0.2/24"
"fdc9:281f:04d7:9ee9::2/64"
];
privateKeyFile = config.sops.secrets."wireguard/private".path;
peers = [
{
publicKey = "a16/F/wP7HQIUtFywebqPSXQAktPsLgsMLH9ZfevMy0=";
allowedIPs = ["0.0.0.0/0" "::/0"];
allowedIPs = [
"0.0.0.0/0"
"::/0"
];
endpoint = "31.59.129.225:51820";
persistentKeepalive = 25;
presharedKeyFile = config.sops.secrets."wireguard/psk".path;

35
hosts/ytnix/hardware-configuration.nix
View file

@ -7,8 +7,15 @@
pkgs,
modulesPath,
...
}: {
boot.initrd.availableKernelModules = ["xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod"];
}:
{
boot.initrd.availableKernelModules = [
"xhci_pci"
"ahci"
"nvme"
"usb_storage"
"sd_mod"
];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
@ -16,21 +23,32 @@
fileSystems."/" = {
device = "/dev/disk/by-uuid/17870658-6118-46af-837f-70c9175e09c3";
fsType = "btrfs";
options = ["subvol=root" "compress=zstd"];
options = [
"subvol=root"
"compress=zstd"
];
};
boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-uuid/c6098a16-c8a6-4a97-8648-6f46ca919d13";
boot.initrd.luks.devices."cryptroot".device =
"/dev/disk/by-uuid/c6098a16-c8a6-4a97-8648-6f46ca919d13";
fileSystems."/home" = {
device = "/dev/disk/by-uuid/17870658-6118-46af-837f-70c9175e09c3";
fsType = "btrfs";
options = ["subvol=home" "compress=zstd"];
options = [
"subvol=home"
"compress=zstd"
];
};
fileSystems."/nix" = {
device = "/dev/disk/by-uuid/17870658-6118-46af-837f-70c9175e09c3";
fsType = "btrfs";
options = ["subvol=nix" "compress=zstd" "noatime"];
options = [
"subvol=nix"
"compress=zstd"
"noatime"
];
};
fileSystems."/swap" = {
@ -42,7 +60,10 @@
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/29B7-F46D";
fsType = "vfat";
options = ["fmask=0022" "dmask=0022"];
options = [
"fmask=0022"
"dmask=0022"
];
};
swapDevices = [