Compare commits
1 Commits
dev
...
r0-persist
| Author | SHA1 | Date | |
|---|---|---|---|
|
ab263e5184 |
20
TODO.md
20
TODO.md
@@ -1,20 +0,0 @@
|
||||
- add other remote
|
||||
- fully automate remote provisioning (remote keys)
|
||||
- fix ipv6 on remotes
|
||||
- modularize home manager
|
||||
- add services?
|
||||
- 0x0
|
||||
- forgejo
|
||||
- matrix homeserver
|
||||
- matrix webclient
|
||||
- radicale
|
||||
- tor relay
|
||||
- wireguard as vpn
|
||||
- add home functionality
|
||||
- better term emulator
|
||||
- switch browser?
|
||||
- chromium: much better sandboxing
|
||||
- ladybird: be an early tester, contribute
|
||||
- glide: sexier tridactyl implementation
|
||||
- browsh: the GOAT
|
||||
- get mouse out of here
|
||||
@@ -1,5 +0,0 @@
|
||||
# usage:
|
||||
# $ ./deploy.sh <hostname> <ip>
|
||||
# example usage:
|
||||
# $ ./deply.sh 109-199-104-83 109.199.104.83
|
||||
nix run github:nix-community/nixos-anywhere -- --generate-hardware-config nixos-generate-config ./hardware-configuration.nix --flake .?ref=411ee0c#$1 --target-host root@$2
|
||||
198
flake.lock
generated
198
flake.lock
generated
@@ -129,27 +129,6 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"disko": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1746728054,
|
||||
"narHash": "sha256-eDoSOhxGEm2PykZFa/x9QG5eTH0MJdiJ9aR00VAofXE=",
|
||||
"owner": "nix-community",
|
||||
"repo": "disko",
|
||||
"rev": "ff442f5d1425feb86344c028298548024f21256d",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"ref": "latest",
|
||||
"repo": "disko",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"firefox-gnome-theme": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
@@ -385,27 +364,6 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"home-manager_3": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nix-on-droid",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1709445365,
|
||||
"narHash": "sha256-DVv6nd9FQBbMWbOmhq0KVqmlc3y3FMSYl49UXmMcO+0=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "4de84265d7ec7634a69ba75028696d74de9a44a7",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"impermanence": {
|
||||
"locked": {
|
||||
"lastModified": 1737831083,
|
||||
@@ -454,73 +412,6 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nix-formatter-pack": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nix-on-droid",
|
||||
"nixpkgs"
|
||||
],
|
||||
"nmd": [
|
||||
"nix-on-droid",
|
||||
"nmd"
|
||||
],
|
||||
"nmt": "nmt"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1705252799,
|
||||
"narHash": "sha256-HgSTREh7VoXjGgNDwKQUYcYo13rPkltW7IitHrTPA5c=",
|
||||
"owner": "Gerschtli",
|
||||
"repo": "nix-formatter-pack",
|
||||
"rev": "2de39dedd79aab14c01b9e2934842051a160ffa5",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "Gerschtli",
|
||||
"repo": "nix-formatter-pack",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nix-on-droid": {
|
||||
"inputs": {
|
||||
"home-manager": "home-manager_3",
|
||||
"nix-formatter-pack": "nix-formatter-pack",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
],
|
||||
"nixpkgs-docs": "nixpkgs-docs",
|
||||
"nixpkgs-for-bootstrap": "nixpkgs-for-bootstrap",
|
||||
"nmd": "nmd"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1765031149,
|
||||
"narHash": "sha256-4ZtlnCp4blhsjGnQIxAXDAj7nCJKy7tozoBRtklmwcU=",
|
||||
"owner": "nix-community",
|
||||
"repo": "nix-on-droid",
|
||||
"rev": "55b6449b4582a4ba3ce712543c973360a026db7d",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"repo": "nix-on-droid",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nix-zulip": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1764583012,
|
||||
"narHash": "sha256-6ht4dtI1TBDAaB/Tatq+FcPexaZTBWuRiJGnioCDx5c=",
|
||||
"ref": "refs/heads/main",
|
||||
"rev": "a9dd0f80d775745f1d88055f24d944562db97c5e",
|
||||
"revCount": 67,
|
||||
"type": "git",
|
||||
"url": "https://git.afnix.fr/nix-zulip/nix-zulip"
|
||||
},
|
||||
"original": {
|
||||
"type": "git",
|
||||
"url": "https://git.afnix.fr/nix-zulip/nix-zulip"
|
||||
}
|
||||
},
|
||||
"nixos-mailserver": {
|
||||
"inputs": {
|
||||
"blobs": "blobs",
|
||||
@@ -560,38 +451,6 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs-docs": {
|
||||
"locked": {
|
||||
"lastModified": 1705957679,
|
||||
"narHash": "sha256-Q8LJaVZGJ9wo33wBafvZSzapYsjOaNjP/pOnSiKVGHY=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "9a333eaa80901efe01df07eade2c16d183761fa3",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "release-23.05",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs-for-bootstrap": {
|
||||
"locked": {
|
||||
"lastModified": 1720244366,
|
||||
"narHash": "sha256-WrDV0FPMVd2Sq9hkR5LNHudS3OSMmUrs90JUTN+MXpA=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "49ee0e94463abada1de470c9c07bfc12b36dcf40",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "49ee0e94463abada1de470c9c07bfc12b36dcf40",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_2": {
|
||||
"locked": {
|
||||
"lastModified": 1764242076,
|
||||
@@ -608,44 +467,6 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nmd": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nix-on-droid",
|
||||
"nixpkgs-docs"
|
||||
],
|
||||
"scss-reset": "scss-reset"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1705050560,
|
||||
"narHash": "sha256-x3zzcdvhJpodsmdjqB4t5mkVW22V3wqHLOun0KRBzUI=",
|
||||
"owner": "~rycee",
|
||||
"repo": "nmd",
|
||||
"rev": "66d9334933119c36f91a78d565c152a4fdc8d3d3",
|
||||
"type": "sourcehut"
|
||||
},
|
||||
"original": {
|
||||
"owner": "~rycee",
|
||||
"repo": "nmd",
|
||||
"type": "sourcehut"
|
||||
}
|
||||
},
|
||||
"nmt": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1648075362,
|
||||
"narHash": "sha256-u36WgzoA84dMVsGXzml4wZ5ckGgfnvS0ryzo/3zn/Pc=",
|
||||
"owner": "rycee",
|
||||
"repo": "nmt",
|
||||
"rev": "d83601002c99b78c89ea80e5e6ba21addcfe12ae",
|
||||
"type": "gitlab"
|
||||
},
|
||||
"original": {
|
||||
"owner": "rycee",
|
||||
"repo": "nmt",
|
||||
"type": "gitlab"
|
||||
}
|
||||
},
|
||||
"noshell": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
@@ -760,11 +581,8 @@
|
||||
"root": {
|
||||
"inputs": {
|
||||
"agenix": "agenix",
|
||||
"disko": "disko",
|
||||
"home-manager": "home-manager_2",
|
||||
"impermanence": "impermanence",
|
||||
"nix-on-droid": "nix-on-droid",
|
||||
"nix-zulip": "nix-zulip",
|
||||
"nixos-mailserver": "nixos-mailserver",
|
||||
"nixpkgs": "nixpkgs",
|
||||
"noshell": "noshell",
|
||||
@@ -774,22 +592,6 @@
|
||||
"stylix": "stylix"
|
||||
}
|
||||
},
|
||||
"scss-reset": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1631450058,
|
||||
"narHash": "sha256-muDlZJPtXDIGevSEWkicPP0HQ6VtucbkMNygpGlBEUM=",
|
||||
"owner": "andreymatin",
|
||||
"repo": "scss-reset",
|
||||
"rev": "0cf50e27a4e95e9bb5b1715eedf9c54dee1a5a91",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "andreymatin",
|
||||
"repo": "scss-reset",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"stylix": {
|
||||
"inputs": {
|
||||
"base16": "base16",
|
||||
|
||||
52
flake.nix
52
flake.nix
@@ -4,10 +4,6 @@
|
||||
url = "github:ryantm/agenix";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
disko = {
|
||||
url = "github:nix-community/disko/latest";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
home-manager = {
|
||||
url = "github:nix-community/home-manager";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
@@ -18,14 +14,6 @@
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
|
||||
nix-on-droid = {
|
||||
url = "github:nix-community/nix-on-droid";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
nix-zulip = {
|
||||
url = "git+https://git.afnix.fr/nix-zulip/nix-zulip";
|
||||
flake = false;
|
||||
};
|
||||
noshell = {
|
||||
url = "github:viperML/noshell";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
@@ -49,13 +37,10 @@
|
||||
};
|
||||
outputs = {
|
||||
agenix,
|
||||
disko,
|
||||
home-manager,
|
||||
impermanence,
|
||||
nixos-mailserver,
|
||||
nixpkgs,
|
||||
nix-on-droid,
|
||||
nix-zulip,
|
||||
noshell,
|
||||
nur,
|
||||
nvf,
|
||||
@@ -63,7 +48,6 @@
|
||||
stylix,
|
||||
...
|
||||
}: let
|
||||
nix-zulip' = (import "${nix-zulip}/nix/default.nix" {}).output;
|
||||
machines = import ./machines.nix;
|
||||
configuration = machine: modules:
|
||||
nixpkgs.lib.nixosSystem {
|
||||
@@ -72,30 +56,23 @@
|
||||
modules =
|
||||
modules
|
||||
++ [
|
||||
./machines/${machine.hostname}/configuration.nix
|
||||
./users.nix
|
||||
./secrets.nix
|
||||
./modules/nixos/common.nix
|
||||
agenix.nixosModules.default
|
||||
disko.nixosModules.disko
|
||||
impermanence.nixosModules.impermanence
|
||||
agenix.nixosModules.default
|
||||
nixos-mailserver.nixosModule
|
||||
noshell.nixosModules.default
|
||||
phoenix.nixosModules.default
|
||||
nix-zulip'.nixosModules.zulip
|
||||
{
|
||||
nixpkgs.overlays = [
|
||||
agenix.overlays.default
|
||||
nur.overlays.default
|
||||
nix-zulip'.overlays.default
|
||||
];
|
||||
}
|
||||
]
|
||||
++ machine.modules;
|
||||
];
|
||||
};
|
||||
configurationWithHomeManager = machine: (configuration machine
|
||||
[
|
||||
home-manager.nixosModules.home-manager
|
||||
{
|
||||
nixpkgs.overlays = [
|
||||
agenix.overlays.default
|
||||
nur.overlays.default
|
||||
];
|
||||
home-manager.useGlobalPkgs = true;
|
||||
home-manager.extraSpecialArgs = {inherit machine;};
|
||||
home-manager.users =
|
||||
@@ -116,25 +93,12 @@
|
||||
)
|
||||
);
|
||||
}
|
||||
noshell.nixosModules.default
|
||||
]);
|
||||
in {
|
||||
nixosConfigurations =
|
||||
builtins.mapAttrs
|
||||
(hostname: value: configurationWithHomeManager value)
|
||||
machines;
|
||||
nixOnDroidConfigurations.default = nix-on-droid.lib.nixOnDroidConfiguration {
|
||||
pkgs = import nixpkgs {system = "aarch64-linux";};
|
||||
modules = [
|
||||
./modules/nix-on-droid/nix-on-droid.nix
|
||||
{
|
||||
home-manager.useGlobalPkgs = true;
|
||||
home-manager.users."andromeda" = {
|
||||
imports = [
|
||||
./modules/nix-on-droid/home.nix
|
||||
];
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,24 +0,0 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.ens18.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
}
|
||||
84
machines.nix
84
machines.nix
@@ -2,92 +2,14 @@
|
||||
lenovo = {
|
||||
hostname = "lenovo";
|
||||
system = "x86_64-linux";
|
||||
users = ["andromeda"];
|
||||
modules = [
|
||||
# impermanence
|
||||
./modules/nixos/impermanence.nix
|
||||
./modules/nixos/impermanence-ssh.nix
|
||||
|
||||
# hardware configuration
|
||||
# includes `system.stateVersion`
|
||||
./modules/nixos/machines/lenovo.nix
|
||||
|
||||
# boot process
|
||||
# systemd-boot
|
||||
./modules/nixos/boot/lenovo.nix
|
||||
|
||||
# networking
|
||||
./modules/nixos/laptop.nix
|
||||
|
||||
# vpn
|
||||
./modules/nixos/openvpn-client.nix
|
||||
|
||||
# ly display manager
|
||||
./modules/nixos/ly.nix
|
||||
|
||||
# sway window manager
|
||||
./modules/nixos/sway.nix
|
||||
|
||||
# apps
|
||||
./modules/nixos/steam.nix
|
||||
|
||||
# substitutors
|
||||
./substitutors.nix
|
||||
users = [
|
||||
"andromeda"
|
||||
"mtgmonkey"
|
||||
];
|
||||
};
|
||||
"109-199-104-83" = {
|
||||
hostname = "109-199-104-83";
|
||||
system = "x86_64-linux";
|
||||
users = [];
|
||||
modules = [
|
||||
# impermanence
|
||||
./modules/nixos/impermanence.nix
|
||||
./modules/nixos/impermanence-ssh.nix
|
||||
|
||||
# hardware configuration
|
||||
# verbatim as `nixos-generate-config` AND `system.stateVersion`
|
||||
./modules/nixos/machines/109-199-104-83.nix
|
||||
./modules/nixos/disko/remote.nix
|
||||
|
||||
# boot process
|
||||
# grub boot on /dev/sda
|
||||
./modules/nixos/boot/109-199-104-83.nix
|
||||
|
||||
# networking
|
||||
./modules/nixos/networking/domains/galaxious.de.nix
|
||||
# uses cloud-init to network
|
||||
./modules/nixos/networking/networks/109-199-104-83.nix
|
||||
|
||||
# ssh through port 5522 among other things
|
||||
# andromeda@lenovo is the only user allowed access
|
||||
./modules/nixos/networking/hard-ssh.nix
|
||||
./modules/nixos/networking/ssh-as-root.nix
|
||||
({config, ...}: {users.users.root.openssh.authorizedKeys.keys = [config.pub-keys.ssh.andromeda];})
|
||||
|
||||
# simple-nixos-mailserver email server
|
||||
# mail.domain
|
||||
./modules/nixos/mailserver.nix
|
||||
|
||||
# roundcube webmail client
|
||||
# webmail.domain
|
||||
./modules/nixos/roundcube.nix
|
||||
|
||||
# matrix homeserver
|
||||
# matrix.domain
|
||||
# ./modules/nixos/matrix-conduit.nix
|
||||
|
||||
# matrix homeserver
|
||||
./modules/nixos/matrix-synapse.nix
|
||||
|
||||
# BROKEN
|
||||
# forgejo
|
||||
# git.domain
|
||||
# ./modules/nixos/forgejo.nix
|
||||
|
||||
# BROKEN
|
||||
# zulip chat client
|
||||
# chat.domain
|
||||
./modules/nixos/zulip.nix
|
||||
];
|
||||
};
|
||||
}
|
||||
|
||||
98
machines/109-199-104-83/configuration.nix
Normal file
98
machines/109-199-104-83/configuration.nix
Normal file
@@ -0,0 +1,98 @@
|
||||
{
|
||||
config,
|
||||
modulesPath,
|
||||
machine,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
./impermanence.nix
|
||||
(modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
# roundcube config
|
||||
services.roundcube = {
|
||||
enable = true;
|
||||
hostName = "webmail.${config.networking.domain}";
|
||||
extraConfig = ''
|
||||
$config['imap_host'] = "ssl://${config.mailserver.fqdn}";
|
||||
$config['smtp_host'] = "ssl://${config.mailserver.fqdn}";
|
||||
$config['smtp_user'] = "%u";
|
||||
$config['smtp_pass'] = "%p";
|
||||
'';
|
||||
};
|
||||
|
||||
# mailserver config
|
||||
mailserver = {
|
||||
enable = true;
|
||||
stateVersion = 3;
|
||||
fqdn = "mail.${config.networking.domain}";
|
||||
domains = ["${config.networking.domain}"];
|
||||
x509.useACMEHost = config.mailserver.fqdn;
|
||||
loginAccounts = {
|
||||
"test@${config.networking.domain}" = {
|
||||
hashedPasswordFile = builtins.toString config.age.secrets.secret3.path;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# cert config
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults.email = "mtgmonket@gmail.com";
|
||||
};
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
virtualHosts."mail.${config.networking.domain}" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
};
|
||||
};
|
||||
|
||||
# system config
|
||||
system.stateVersion = "25.11";
|
||||
nix.settings.experimental-features = ["flakes" "nix-command"];
|
||||
fileSystems."/" = {
|
||||
device = "none";
|
||||
fsType = "tmpfs";
|
||||
options = ["defaults" "size=60%" "mode=755"];
|
||||
};
|
||||
fileSystems."/nix" = {
|
||||
device = "/dev/sda1";
|
||||
fsType = "ext4";
|
||||
};
|
||||
boot.loader.grub.device = "/dev/sda";
|
||||
boot.loader.timeout = 30;
|
||||
boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "xen_blkfront"];
|
||||
boot.initrd.kernelModules = ["nvme"];
|
||||
boot.tmp.cleanOnBoot = true;
|
||||
zramSwap.enable = true;
|
||||
networking = {
|
||||
useNetworkd = true;
|
||||
usePredictableInterfaceNames = true;
|
||||
hostName = machine.hostname;
|
||||
domain = "galaxious.de";
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [80 443];
|
||||
allowedUDPPorts = [80 443];
|
||||
};
|
||||
};
|
||||
systemd.network = {
|
||||
enable = true;
|
||||
networks."40-wan" = {
|
||||
matchConfig.Name = "enx0050565f4fff";
|
||||
address = ["2a02:c207:2299:8419::1/64" "109.199.104.83/20"];
|
||||
routes = [
|
||||
{
|
||||
Gateway = "109.199.96.1";
|
||||
GatewayOnLink = true;
|
||||
}
|
||||
{Gateway = "fe80::1";}
|
||||
];
|
||||
dns = ["2620:fe::fe" "9.9.9.9"];
|
||||
};
|
||||
};
|
||||
services.openssh.enable = true;
|
||||
users.mutableUsers = false;
|
||||
users.users.root.openssh.authorizedKeys.keys = [config.pub-keys.ssh.andromeda];
|
||||
programs.noshell.enable = true;
|
||||
}
|
||||
30
machines/109-199-104-83/impermanence.nix
Normal file
30
machines/109-199-104-83/impermanence.nix
Normal file
@@ -0,0 +1,30 @@
|
||||
{
|
||||
environment.persistence."/nix/persist" = {
|
||||
enable = true;
|
||||
hideMounts = true;
|
||||
directories = [
|
||||
# logs
|
||||
"/var/log"
|
||||
"/var/lib/systemd/coredump"
|
||||
|
||||
# users
|
||||
"/var/lib/nixos"
|
||||
|
||||
# private ssh keys
|
||||
"/etc/ssh"
|
||||
|
||||
# mailserver
|
||||
"/var/vmail"
|
||||
"/var/dkim"
|
||||
"/var/lib/dovecot"
|
||||
"/var/lib/postfix"
|
||||
"/var/lib/postgresql"
|
||||
"/var/lib/redis-rspamd"
|
||||
"/var/lib/roundcube"
|
||||
"/var/lib/secrets"
|
||||
];
|
||||
files = [
|
||||
"/etc/machine-id"
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -1,17 +1,70 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
machine,
|
||||
...
|
||||
}: {
|
||||
imports = [(modulesPath + "/installer/scan/not-detected.nix")];
|
||||
imports = [
|
||||
./impermanence.nix
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
age.secrets = {
|
||||
secret0.file = ../../secrets/secret0.age;
|
||||
secret1.file = ../../secrets/secret1.age;
|
||||
};
|
||||
boot.loader = {
|
||||
efi.canTouchEfiVariables = true;
|
||||
systemd-boot.enable = true;
|
||||
};
|
||||
hardware.bluetooth = {
|
||||
enable = true;
|
||||
powerOnBoot = true;
|
||||
};
|
||||
i18n.defaultLocale = "de_DE.UTF-8";
|
||||
networking = {
|
||||
dhcpcd.enable = true;
|
||||
firewall.enable = true;
|
||||
hostName = machine.hostname;
|
||||
networkmanager.enable = true;
|
||||
};
|
||||
nix.settings.experimental-features = [
|
||||
"nix-command"
|
||||
"flakes"
|
||||
];
|
||||
nixpkgs.config.allowUnfreePredicate = pkg:
|
||||
builtins.elem (lib.getName pkg) [
|
||||
"steam"
|
||||
"steam-original"
|
||||
"steam-unwrapped"
|
||||
"steam-run"
|
||||
];
|
||||
programs = {
|
||||
noshell.enable = true;
|
||||
steam.enable = true;
|
||||
sway.enable = true;
|
||||
};
|
||||
services = {
|
||||
blueman.enable = true;
|
||||
displayManager = {
|
||||
enable = true;
|
||||
ly.enable = true;
|
||||
};
|
||||
libinput.enable = true;
|
||||
openssh.enable = true;
|
||||
printing.enable = true;
|
||||
};
|
||||
system.stateVersion = "26.05";
|
||||
time.timeZone = "Europe/Berlin";
|
||||
boot.initrd.availableKernelModules = ["xhci_pci" "nvme" "sdhci_pci"];
|
||||
boot.initrd.kernelModules = [];
|
||||
boot.kernelModules = ["kvm-intel"];
|
||||
boot.extraModulePackages = [];
|
||||
|
||||
fileSystems."/" = {
|
||||
#device = "none";
|
||||
#fsType = "tmpfs";
|
||||
#options = ["defaults" "size=60%" "mode=755"];
|
||||
device = "/dev/disk/by-uuid/5455cfb4-0efd-4f55-b496-d2cab3f419b7";
|
||||
fsType = "btrfs";
|
||||
options = ["subvol=root"];
|
||||
@@ -39,12 +92,12 @@
|
||||
done
|
||||
|
||||
btrfs subvolume create /btrfs_tmp/root
|
||||
mkdir /btrfs_tmp/root/persist
|
||||
mkdir /btrfs_tmp/root/nix
|
||||
mkdir /btrfs_tmp/root/etc
|
||||
mount ${config.fileSystems."/persist".device} /btrfs_tmp/root/persist -o subvol=persist
|
||||
cp /btrfs_tmp/root/persist/etc/ssh /btrfs_tmp/root/etc/ssh -r
|
||||
umount /btrfs_tmp/root/persist
|
||||
rm -r /btrfs_tmp/root/persist
|
||||
mount ${config.fileSystems."/nix".device} /btrfs_tmp/root/nix
|
||||
cp /btrfs_tmp/root/nix/persist/etc/ssh /btrfs_tmp/root/etc/ssh -r
|
||||
umount /btrfs_tmp/root/nix
|
||||
rm -r /btrfs_tmp/root/nix
|
||||
umount /btrfs_tmp
|
||||
'';
|
||||
|
||||
@@ -53,12 +106,6 @@
|
||||
fsType = "btrfs";
|
||||
};
|
||||
|
||||
fileSystems."/persist" = {
|
||||
device = "/dev/disk/by-uuid/5455cfb4-0efd-4f55-b496-d2cab3f419b7";
|
||||
fsType = "btrfs";
|
||||
options = ["subvol=persist"];
|
||||
};
|
||||
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-uuid/F425-55BA";
|
||||
fsType = "vfat";
|
||||
@@ -69,5 +116,4 @@
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
system.stateVersion = "26.05";
|
||||
}
|
||||
@@ -1,15 +1,19 @@
|
||||
{
|
||||
fileSystems."/persist".neededForBoot = true;
|
||||
environment.persistence."/persist" = {
|
||||
environment.persistence."/nix/persist" = {
|
||||
enable = true;
|
||||
hideMounts = true;
|
||||
directories = [
|
||||
"/var/log"
|
||||
"/var/lib/bluetooth"
|
||||
"/var/lib/nixos"
|
||||
"/var/lib/systemd/coredump"
|
||||
"/etc/NetworkManager/system-connections"
|
||||
"/etc/ssh"
|
||||
"/etc/ly/custom-sessions"
|
||||
];
|
||||
files = [
|
||||
"/etc/machine-id"
|
||||
"/etc/ly/save.txt"
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -1,5 +0,0 @@
|
||||
{pkgs, ...}: {
|
||||
environment.packages = [pkgs.git];
|
||||
system.stateVersion = "26.05";
|
||||
nix.settings.experimentalFeatures = ["nix-command" "flakes"];
|
||||
}
|
||||
@@ -1,9 +0,0 @@
|
||||
{
|
||||
boot.loader.grub = {
|
||||
efiSupport = true;
|
||||
efiInstallAsRemovable = true;
|
||||
};
|
||||
age.identityPaths = [
|
||||
"/persist/etc/ssh/ssh_host_ed25519_key"
|
||||
];
|
||||
}
|
||||
@@ -1,6 +0,0 @@
|
||||
{
|
||||
boot.loader = {
|
||||
efi.canTouchEfiVariables = true;
|
||||
systemd-boot.enable = true;
|
||||
};
|
||||
}
|
||||
@@ -1,26 +0,0 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
# flakes usage
|
||||
nix.settings.experimental-features = [
|
||||
"flakes"
|
||||
"nix-command"
|
||||
];
|
||||
|
||||
# allows users to customize shell in `$XDG_CONFIG_HOME/shell` rather than
|
||||
# needing /etc/shells. Useful for home-manager. Falls back.
|
||||
programs.noshell.enable = true;
|
||||
|
||||
# cleans /tmp to maintain a tidy system
|
||||
boot.tmp.cleanOnBoot = true;
|
||||
|
||||
networking.domain = lib.mkDefault config.networking.hostName;
|
||||
|
||||
# disable lecture
|
||||
security.sudo.extraConfig = ''Defaults lecture="never"'';
|
||||
|
||||
# make users immutable
|
||||
users.mutableUsers = false;
|
||||
}
|
||||
@@ -1,64 +0,0 @@
|
||||
{
|
||||
disko.devices = {
|
||||
disk = {
|
||||
disk1 = {
|
||||
device = "/dev/sda";
|
||||
type = "disk";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
# legacy boot
|
||||
boot = {
|
||||
name = "boot";
|
||||
size = "1M";
|
||||
type = "EF02";
|
||||
};
|
||||
|
||||
# efi boot
|
||||
esp = {
|
||||
name = "ESP";
|
||||
size = "512M";
|
||||
type = "EF00";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
};
|
||||
};
|
||||
|
||||
# btrfs
|
||||
# root is on nodev
|
||||
root = {
|
||||
size = "100%";
|
||||
content = {
|
||||
extraArgs = ["-f"]; # internet told me to, works
|
||||
type = "btrfs";
|
||||
subvolumes = {
|
||||
# nix store
|
||||
"/nix" = {
|
||||
mountpoint = "/nix";
|
||||
};
|
||||
|
||||
# persistant directory
|
||||
"/persist" = {
|
||||
mountpoint = "/persist";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
nodev = {
|
||||
# root
|
||||
"/" = {
|
||||
fsType = "tmpfs";
|
||||
mountOptions = [
|
||||
"defaults"
|
||||
"mode=755" # stops security complaints
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,27 +0,0 @@
|
||||
{config, ...}: {
|
||||
services.nginx = {
|
||||
virtualHosts.${config.services.forgejo.settings.server.DOMAIN} = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
extraConfig = ''
|
||||
client_max_body_size 512M
|
||||
'';
|
||||
locations."/".proxyPass = "https://localhost:${builtins.toString config.services.forgejo.settings.server.HTTP_PORT}";
|
||||
};
|
||||
};
|
||||
services.forgejo = {
|
||||
enable = true;
|
||||
database.type = "postgres";
|
||||
lfs.enable = true;
|
||||
settings = {
|
||||
server = rec {
|
||||
DOMAIN = "git.galaxious.de";
|
||||
ROOT_URL = "https://${DOMAIN}";
|
||||
HTTP_PORT = 4043;
|
||||
SSH_PORT = 4022;
|
||||
};
|
||||
service.DISABLE_REGISTRATION = false;
|
||||
};
|
||||
};
|
||||
services.openssh.ports = [config.services.forgejo.settings.server.SSH_PORT];
|
||||
}
|
||||
@@ -1,4 +0,0 @@
|
||||
{
|
||||
# ONLY include this module AFTER a machine has been provisioned
|
||||
environment.persistence."/persist".directories = ["/etc/ssh"];
|
||||
}
|
||||
@@ -1,37 +0,0 @@
|
||||
{
|
||||
# bluetooth
|
||||
hardware.bluetooth = {
|
||||
enable = true;
|
||||
powerOnBoot = true;
|
||||
};
|
||||
services.blueman.enable = true;
|
||||
|
||||
# locale
|
||||
i18n.defaultLocale = "de_DE.UTF-8";
|
||||
time.timeZone = "Europe/Berlin";
|
||||
|
||||
# networking
|
||||
networking = {
|
||||
firewall.enable = true;
|
||||
networkmanager.enable = true;
|
||||
};
|
||||
|
||||
# misc
|
||||
services = {
|
||||
printing.enable = true;
|
||||
|
||||
# trackpad
|
||||
libinput.enable = true;
|
||||
|
||||
# ssh
|
||||
openssh.enable = true;
|
||||
};
|
||||
|
||||
# impermanence
|
||||
environment.persistence."/persist".directories = [
|
||||
# bluetooth
|
||||
"/var/lib/bluetooth"
|
||||
# wifi connections
|
||||
"/etc/NetworkManager/system-connections"
|
||||
];
|
||||
}
|
||||
@@ -1,11 +0,0 @@
|
||||
{
|
||||
services.displayManager = {
|
||||
enable = true;
|
||||
ly.enable = true;
|
||||
};
|
||||
# TODO needs to be manually updated when new users added
|
||||
environment.persistence."/persist" = {
|
||||
directories = ["/etc/ly/custom-sessions"];
|
||||
files = ["/etc/ly/save.txt"];
|
||||
};
|
||||
}
|
||||
@@ -1,25 +0,0 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
(modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod"];
|
||||
boot.initrd.kernelModules = [];
|
||||
boot.kernelModules = [];
|
||||
boot.extraModulePackages = [];
|
||||
|
||||
swapDevices = [];
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
|
||||
system.stateVersion = "26.05";
|
||||
}
|
||||
@@ -1,57 +0,0 @@
|
||||
{config, ...}: {
|
||||
mailserver = {
|
||||
enable = true;
|
||||
stateVersion = 3;
|
||||
|
||||
# domain bs
|
||||
fqdn = "mail.${config.networking.domain}";
|
||||
domains = ["${config.networking.domain}"];
|
||||
x509.useACMEHost = config.mailserver.fqdn;
|
||||
|
||||
loginAccounts = {
|
||||
# test acc
|
||||
"test@${config.networking.domain}" = {
|
||||
hashedPasswordFile = builtins.toString config.age.secrets.mailserver-acc-test-pw.path;
|
||||
};
|
||||
"admin@${config.networking.domain}" = {
|
||||
hashedPasswordFile = builtins.toString config.age.secrets.mailserver-acc-admin-pw.path;
|
||||
aliases = ["@${config.networking.domain}"];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# put dkim key into /etc for declarability
|
||||
mailserver.dkimKeyDirectory = "/etc/dkim";
|
||||
environment.etc."dkim/${config.networking.domain}.${config.mailserver.dkimSelector}.key" = {
|
||||
source = config.age.secrets."dkim-${config.networking.domain}.${config.mailserver.dkimSelector}.key".path;
|
||||
mode = "600";
|
||||
user = config.services.rspamd.user;
|
||||
group = config.services.rspamd.group;
|
||||
};
|
||||
|
||||
# does acme for me
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
virtualHosts = {
|
||||
"mail.${config.networking.domain}" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults.email = "mtgmonket@gmail.com";
|
||||
};
|
||||
|
||||
# persist directories per the backup guidelines
|
||||
environment.persistence."/persist" = {
|
||||
directories = [
|
||||
# not needed bc the dkim dir is declared
|
||||
# "/var/dkim"
|
||||
"/var/vmail"
|
||||
"/var/lib/redis-rspamd"
|
||||
"/var/lib/acme"
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -1,82 +0,0 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
well_known_server = pkgs.writeText "well-known-matrix-server" ''
|
||||
{
|
||||
"m.server": "matrix.${config.services.matrix-conduit.settings.global.server_name}"
|
||||
}
|
||||
'';
|
||||
well_known_client = pkgs.writeText "well-known-matrix-client" ''
|
||||
{
|
||||
"m.homeserver": {
|
||||
"base_url": "https://matrix.${config.services.matrix-conduit.settings.global.server_name}"
|
||||
}
|
||||
'';
|
||||
in {
|
||||
services.matrix-conduit = {
|
||||
enable = true;
|
||||
settings.global = {
|
||||
server_name = "${config.networking.domain}";
|
||||
};
|
||||
};
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
virtualHosts = {
|
||||
"matrix.${config.services.matrix-conduit.settings.global.server_name}" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
listen = [
|
||||
{
|
||||
addr = "0.0.0.0";
|
||||
port = 443;
|
||||
ssl = true;
|
||||
}
|
||||
{
|
||||
addr = "0.0.0.0";
|
||||
port = 8448;
|
||||
ssl = true;
|
||||
}
|
||||
];
|
||||
locations."/_matrix/" = {
|
||||
proxyPass = "http://backend_conduit$request_uri";
|
||||
proxyWebsockets = true;
|
||||
extraConfig = ''
|
||||
proxy_set_header Host $host;
|
||||
proxy_buffering off;
|
||||
'';
|
||||
};
|
||||
extraConfig = ''
|
||||
merge_slashes off;
|
||||
'';
|
||||
};
|
||||
"${config.services.matrix-conduit.settings.global.server_name}" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
locations."/.well-known/matrix/server/" = {
|
||||
alias = "${well_known_server}";
|
||||
extraConfig = ''
|
||||
default_type application/json;
|
||||
'';
|
||||
};
|
||||
locations."/.well-known/matrix/client/" = {
|
||||
alias = "${well_known_client}";
|
||||
extraConfig = ''
|
||||
default_type application/json;
|
||||
add_header Access-Control-Allow-Origin "";
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
upstreams = {
|
||||
backend-conduit = {
|
||||
servers = {
|
||||
"localhost:${builtins.toString config.services.matrix-conduit.settings.global.port}" = {};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
networking.firewall.allowedTCPPorts = [8448];
|
||||
networking.firewall.allowedUDPPorts = [8448];
|
||||
}
|
||||
@@ -1,65 +0,0 @@
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}: let
|
||||
fqdn = "${config.networking.hostName}.${config.networking.domain}";
|
||||
baseUrl = "https://${fqdn}";
|
||||
clientConfig."m.homeserver".base_url = baseUrl;
|
||||
serverConfig."m.server" = "${fqdn}:443";
|
||||
mkWellKnown = data: ''
|
||||
default_type application/json;
|
||||
add_header Access-Control-Allow-Origin *;
|
||||
return 200 '${builtins.toJSON data}';
|
||||
'';
|
||||
in {
|
||||
services.postgresql.enable = true;
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
recommendedTlsSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedGzipSettings = true;
|
||||
recommendedProxySettings = true;
|
||||
virtualHosts = {
|
||||
"${config.networking.domain}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."= /.well-known/matrix/server".extraConfig = mkWellKnown serverConfig;
|
||||
locations."= /.well-known/matrix/client".extraConfig = mkWellKnown clientConfig;
|
||||
};
|
||||
"${fqdn}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/".extraConfig = ''
|
||||
return 404;
|
||||
'';
|
||||
locations."/_matrix".proxyPass = "http://[::1]:8008";
|
||||
locations."/_synapse/client".proxyPass = "http://[::1]:8008";
|
||||
};
|
||||
};
|
||||
};
|
||||
services.matrix-synapse = {
|
||||
enable = true;
|
||||
settings.server_name = config.networking.domain;
|
||||
settings.public_baseurl = baseUrl;
|
||||
settings.listeners = [
|
||||
{
|
||||
port = 8008;
|
||||
bind_addresses = ["::1"];
|
||||
type = "http";
|
||||
tls = false;
|
||||
x_forwarded = true;
|
||||
resources = [
|
||||
{
|
||||
names = [
|
||||
"client"
|
||||
"federation"
|
||||
];
|
||||
compress = true;
|
||||
}
|
||||
];
|
||||
}
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -1,3 +0,0 @@
|
||||
{
|
||||
networking.domain = "galaxious.de";
|
||||
}
|
||||
@@ -1,19 +0,0 @@
|
||||
{
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
allowSFTP = false;
|
||||
ports = [5522];
|
||||
settings = {
|
||||
PermitRootLogin = "no";
|
||||
PasswordAuthentication = false;
|
||||
KbdInteractiveAuthentication = true;
|
||||
};
|
||||
extraConfig = ''
|
||||
AllowTcpForwarding no
|
||||
AllowAgentForwarding no
|
||||
MaxAuthTries 3
|
||||
MaxSessions 4
|
||||
TCPKeepAlive no
|
||||
'';
|
||||
};
|
||||
}
|
||||
@@ -1,15 +0,0 @@
|
||||
{
|
||||
networking = {
|
||||
useDHCP = false;
|
||||
hostName = "109-199-104-83";
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [80 443];
|
||||
allowedUDPPorts = [80 443];
|
||||
};
|
||||
};
|
||||
services.cloud-init = {
|
||||
enable = true;
|
||||
network.enable = true;
|
||||
};
|
||||
}
|
||||
@@ -1,3 +0,0 @@
|
||||
{lib, ...}: {
|
||||
services.openssh.settings.PermitRootLogin = lib.mkForce "yes";
|
||||
}
|
||||
@@ -1,11 +0,0 @@
|
||||
{
|
||||
services.openvpn.servers = {
|
||||
"173.249.5.230" = {config = ''config /etc/openvpn-confs/173.249.5.230.ovpn'';};
|
||||
};
|
||||
environment.persistence."/persist".directories = ["/etc/openvpn-confs"];
|
||||
|
||||
# turns out disabling ipv6 is a bad idea; I'm just going to enable v6 on the remote xD
|
||||
# networking.enableIPv6 = lib.mkForce false;
|
||||
# workaround; NetworkManager reenables ipv6 without the following
|
||||
# boot.kernelParams = ["ipv6.disable=1"];
|
||||
}
|
||||
@@ -1,16 +0,0 @@
|
||||
{config, ...}: {
|
||||
services.roundcube = {
|
||||
enable = true;
|
||||
hostName = "webmail.${config.networking.domain}";
|
||||
extraConfig = ''
|
||||
$config['imap_host'] = "ssl://${config.mailserver.fqdn}";
|
||||
$config['smtp_host'] = "ssl://${config.mailserver.fqdn}";
|
||||
$config['smtp_user'] = "%u";
|
||||
$config['smtp_pass'] = "%p";
|
||||
'';
|
||||
};
|
||||
environment.persistence."/persist".directories = [
|
||||
"/var/lib/roundcube"
|
||||
"/var/lib/postgresql"
|
||||
];
|
||||
}
|
||||
@@ -1,10 +0,0 @@
|
||||
{lib, ...}: {
|
||||
nixpkgs.config.allowUnfreePredicate = pkg:
|
||||
builtins.elem (lib.getName pkg) [
|
||||
"steam"
|
||||
"steam-original"
|
||||
"steam-unwrapped"
|
||||
"steam-run"
|
||||
];
|
||||
programs.steam.enable = true;
|
||||
}
|
||||
@@ -1,3 +0,0 @@
|
||||
{
|
||||
programs.sway.enable = true;
|
||||
}
|
||||
@@ -1,54 +0,0 @@
|
||||
{config, ...}: {
|
||||
services.zulip = {
|
||||
enable = true;
|
||||
|
||||
# lets it set up my postgresql for me
|
||||
enablePostgresqlLocally = true;
|
||||
|
||||
# host domain
|
||||
host = "chat.${config.networking.domain}";
|
||||
|
||||
# secrets; head rolled on keyboard for all :)
|
||||
camoKeyFile = builtins.toString config.age.secrets.zulip-camoKey.path;
|
||||
rabbitmqPasswordFile = builtins.toString config.age.secrets.zulip-rabbitmqPassword.path;
|
||||
secretKeyFile = builtins.toString config.age.secrets.zulip-secretKey.path;
|
||||
sharedSecretKeyFile = builtins.toString config.age.secrets.zulip-sharedSecretKey.path;
|
||||
avatarSaltKeyFile = builtins.toString config.age.secrets.zulip-avatarSaltKey.path;
|
||||
|
||||
# TODO check for parity with `mailserver-acc-admin-pw.age`
|
||||
extraSecrets.email_password = builtins.toString config.age.secrets.zulip-extraSecrets-email_password.path;
|
||||
|
||||
# settings
|
||||
zulipSettings = rec {
|
||||
# email users
|
||||
ZULIP_ADMINISTRATOR = "admin@${config.networking.domain}";
|
||||
EMAIL_HOST_USER = ZULIP_ADMINISTRATOR;
|
||||
|
||||
# configure mailserver port
|
||||
EMAIL_HOST = config.mailserver.fqdn;
|
||||
EMAIL_USE_SSL = true;
|
||||
EMAIL_PORT = 465;
|
||||
|
||||
# setting to allow realm creation; probably unsafe, might delete later :3
|
||||
OPEN_REALM_CREATION = true;
|
||||
|
||||
# send all noreply emails from `admin@galaxious.de`
|
||||
# TODO configure admin to send from any address
|
||||
ADD_TOKENS_TO_NOREPLY_ADDRESS = false;
|
||||
NOREPLY_EMAIL_ADDRESS = ZULIP_ADMINISTRATOR;
|
||||
|
||||
# domain name
|
||||
EXTERNAL_HOST = config.services.zulip.host;
|
||||
};
|
||||
};
|
||||
# persist
|
||||
environment.persistence."/persist".directories = [
|
||||
# messages
|
||||
"/var/lib/rabbitmq"
|
||||
# uploads
|
||||
"/var/lib/zulip"
|
||||
|
||||
# contrived, but in the store a couple layers down
|
||||
# "/var/lib/redis-zulip"
|
||||
];
|
||||
}
|
||||
@@ -1,11 +0,0 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
...
|
||||
}: {
|
||||
imports = [];
|
||||
options = {};
|
||||
config = {};
|
||||
}
|
||||
19
pub-keys.nix
19
pub-keys.nix
@@ -1,24 +1,15 @@
|
||||
{
|
||||
age.secrets = {
|
||||
andromeda-pw.file = ./secrets/andromeda-pw.age;
|
||||
conduit-secretFile.file = ./secrets/conduit-secretFile.age;
|
||||
"dkim-galaxious.de.mail.key".file = ./secrets/dkim-galaxious.de.mail.key.age;
|
||||
mtgmonkey-pw.file = ./secrets/mtgmonkey-pw.age;
|
||||
mailserver-acc-test-pw.file = ./secrets/mailserver-acc-test-pw.age;
|
||||
mailserver-acc-admin-pw.file = ./secrets/mailserver-acc-admin-pw.age;
|
||||
"mailserver-acc-zulip+admin-pw".file = "${./secrets}/mailserver-acc-zulip+admin-pw.age";
|
||||
zulip-avatarSaltKey.file = ./secrets/zulip-avatarSaltKey.age;
|
||||
zulip-camoKey.file = ./secrets/zulip-camoKey.age;
|
||||
zulip-extraSecrets-email_password.file = ./secrets/zulip-extraSecrets-email_password.age;
|
||||
zulip-rabbitmqPassword.file = ./secrets/zulip-rabbitmqPassword.age;
|
||||
zulip-secretKey.file = ./secrets/zulip-secretKey.age;
|
||||
zulip-sharedSecretKey.file = ./secrets/zulip-sharedSecretKey.age;
|
||||
secret0.file = ./secrets/secret0.age;
|
||||
secret1.file = ./secrets/secret1.age;
|
||||
secret2.file = ./secrets/secret2.age;
|
||||
secret3.file = ./secrets/secret3.age;
|
||||
};
|
||||
pub-keys = {
|
||||
ssh = {
|
||||
andromeda = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJy2VD362wUcu0lKj2d6OIU8dbAna0Lu/NaAYIj8gdIA andromeda@lenovo";
|
||||
lenovo = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHG4eqsLTq2os2mxfwhys3BpVnowcJrqt2CbRFzN2pJb root@lenovo";
|
||||
_109-199-104-83 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBH5TA6Br8K4xTjD5YcXQDh4UQSvuE0lEs1UxUytDiAn root@109-199-104-83";
|
||||
_109-199-104-83 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJe5ol56yC23fivSEKeK4HZQm934ROX46AM7o0aE2hMq root@vmi2998419";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,8 +0,0 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 mT2fyg ixFM7swaItfNnTRVSdTm1wZJ8lHUv7tDOgSXo1OpgCc
|
||||
lf8/ChfcpgYkK8mTS9Zk++toOu0KNh88S+Lqu4a0UIw
|
||||
-> ssh-ed25519 UHxfvA hbsRwdzU1IP3K/gH0btUOQ8hZer8Kgq+RqzcEVrCqTE
|
||||
iSVh+yeypHoalRhaRM2XMlBvtO8HCyatDnWgUyC3GWU
|
||||
--- hcs6DJZRvjoKDPI/cjUXRfM7+06PNJvWqjkvJof/bSs
|
||||
Bo <1A>p<EFBFBD>Qlg-<2D>\<5C>=ƙ ڼ <0B><> <1E><>sv<13><>~<7E><>O<EFBFBD><4F>{Rx <1E>IErô<>s<EFBFBD>1 <1F><>v<EFBFBD><76><EFBFBD>:<<3C>
|
||||
i<EFBFBD><EFBFBD><EFBFBD>1<EFBFBD>v<0E><03>K<EFBFBD><4B><07><16><>*<2A> |<7C> <20><><EFBFBD><EFBFBD><EFBFBD>5[{<7B>\<5C>
|
||||
@@ -1,9 +0,0 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 mT2fyg x0n1JToeD7bRsDYJpv0HFzQYB9YxxiSqt+dG6elG1Eg
|
||||
vspLec9Vm6fvJnlDGjzezThc1qeIYyWncBxYwsE/6rg
|
||||
-> ssh-ed25519 UHxfvA nOlZo53SINXJs8tt/vdoiGjMnIW/lYZVdI8TJfAFqxE
|
||||
XlxvrHDFlm8c7odfNbBw0/QeYuCj5e4VValql5JNNgg
|
||||
-> ssh-ed25519 yXDKAA Rf+obXBUKxOcMqrb6rlOSfZGyjkj1PnRvHUSDToj6Tw
|
||||
XV/3FmC48Wcg9r3C5soRKBwOcBgat2ueAa8pU1MUYLE
|
||||
--- l/eEq13iyiddR9Rgf47Mv8JxPfjINwCnU4pd3KyxMVQ
|
||||
^P%<25>Ϧ<EFBFBD><CFA6>}<7D><>M<EFBFBD><4D><EFBFBD>&ߢه<DFA2>Q<>?d^<04>Y<EFBFBD> <09>~<7E>Tu<54><75><EFBFBD>o<EFBFBD>f<EFBFBD><66><EFBFBD>7<>n <1D>'!'͓<> <10><><EFBFBD>]d͇0>v<>ǟ<EFBFBD><12>.<2E><>E] <1D><>ԇ|<7C> >d<><64>*wDɏ<44><1A><><EFBFBD><EFBFBD><0E><>)cH<63><48><EFBFBD>@W<>v*<2A>Wk<57><6B><EFBFBD>N<EFBFBD><4E>R<EFBFBD>F I@<40><>;9=u<><75><EFBFBD><EFBFBD><7F><EFBFBD><EFBFBD>τ<EFBFBD>,<01><><EFBFBD>)<29>>b<><03>:O<>J<EFBFBD>=<3D>W
|
||||
Binary file not shown.
Binary file not shown.
@@ -1,9 +0,0 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 mT2fyg at6Q9eK1o8Mk0+fJh+mnIVrvV1tASV+PGuV8MXuwR2c
|
||||
cm3wvsLAemeeTFok7yBocNlfwewKruPnymG+wsT5g+Y
|
||||
-> ssh-ed25519 UHxfvA aaQqfrUfUnLzwUVT6nCRPIAVlIhIWAJcPyeg3J6BQUI
|
||||
4sh8ZV14csafSs8yAtFZIccSkiz6YnseV3DJcuhw7dQ
|
||||
-> ssh-ed25519 yXDKAA KmwRbJURujQhlqOIVxzlVjyvaYRfyuJAVGWMZdkFaAE
|
||||
mX083o2XdnnYgqLs5NeppwMbFHDHTucMiHHZuYdzLvo
|
||||
--- Ay/SP2CXGOhSzO4KoiXFQhJMMdHaecxXOtNkGBK/RO0
|
||||
Z<11>?<14><0E><1A><><EFBFBD>B<EFBFBD> <1E>F<EFBFBD> 9_N`<60><>8<EFBFBD><38><EFBFBD>&<26><> <1D>@<40><>)q<>7<EFBFBD>a<11>O
|
||||
@@ -1,10 +0,0 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 mT2fyg sRu0FIphSJVMBcC02mo1YuZdy3i2+/jMeN3ROvxp4kM
|
||||
sEwx23t3IAauISKesq+110ZKRKxQv3Zesd0AJufYOLs
|
||||
-> ssh-ed25519 UHxfvA +YaJGPRT7nX2CqVzw1ixNLpW7MfzEnj44pSwj4iUwhI
|
||||
E2U6Q+4uesNCWK7uVSztrA84TU/n/xLFm3PJH0hO/EM
|
||||
-> ssh-ed25519 yXDKAA V2kygl0BK/oYpKnnheslBO2YqXFdQWFgtqfmDNdgolc
|
||||
NpJNN4nfrbgOav8Y38C9DwKFZH+QTRp/US/8kyo9m0o
|
||||
--- LdqtfywtHOAy3AZ7AexZU0TJMU/ugq+ZYN07706rNxY
|
||||
<EFBFBD>
|
||||
U$<24>Ap<>nG<6E>Neɕ<65>u<EFBFBD>y`!<21>ʤ<EFBFBD><CAA4><EFBFBD>f;ipv<70>Y<EFBFBD><59>V_3<5F><33>N+<06><><EFBFBD>k#<23>{<7B><><EFBFBD><EFBFBD><EFBFBD>W<EFBFBD>*<2A>n(<28><0F><03><><14><>ջG6<47><36> ݈yc`<60><>q<EFBFBD>:$K]?͗b=<3D>'<27>^<5E>9
|
||||
@@ -1,7 +0,0 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 mT2fyg WZNwnBmikWIb4rlH89iIQHouM7cw07/E/KXz/AVv3V8
|
||||
FxLaO1zM0aGztJAsq+lgrM8gFogKY76Wcs1vYxhA19g
|
||||
-> ssh-ed25519 UHxfvA YIpS5r25kHVJtG3+kDVUvAPyTKDsRPG/jHwXmiD44SA
|
||||
FKAmC669aQzSbjBjbQbzCixdqnCXnb/JJRQo2MgEZgw
|
||||
--- xvwJ5oYHR3T1D44fl/aeAVjZglnKhq0JKZr9YecC3EE
|
||||
<EFBFBD>ow<6F>M<EFBFBD><4D><EFBFBD><EFBFBD>{<7B>8<EFBFBD>m<EFBFBD>$/<2F>1<EFBFBD><1A>0<EFBFBD>ts<74><73><EFBFBD>X<EFBFBD><58> <1D><><EFBFBD><EFBFBD><EFBFBD>Cד<43><D793><EFBFBD><EFBFBD>\<13>h<>-}<7D><>E,<2C> <20><> <1E>,dxdX<>TAk<41><6B><18>
|
||||
7
secrets/secret0.age
Normal file
7
secrets/secret0.age
Normal file
@@ -0,0 +1,7 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 mT2fyg 4fCTrNibFdjnVfsIbXi6plbd56K8ZDDqtgryXPk2SUA
|
||||
vKlbDi+HpyYlSsN39GRh6GRwdHRSjypCEqguOaHPFDM
|
||||
-> ssh-ed25519 UHxfvA RqrDa4xJoAy1Gdzvq6Z5eTSNTDtHzUmzRoLC+j+HxiI
|
||||
+5CohUFSDB9oiLU0T25FKrQrz07DCviVuzZsVcUltOc
|
||||
--- SQ5zQx9lL5UdNinOgP6yG5WWiBdhSwFqJVt6u3SNpLA
|
||||
<EFBFBD>6<EFBFBD><16> <0B><> U<><55><EFBFBD>p<70><EE9087><EFBFBD><EFBFBD>Q<>]<5D>N<EFBFBD>;K;1y<31><79><EFBFBD>
|
||||
BIN
secrets/secret1.age
Normal file
BIN
secrets/secret1.age
Normal file
Binary file not shown.
BIN
secrets/secret2.age
Normal file
BIN
secrets/secret2.age
Normal file
Binary file not shown.
9
secrets/secret3.age
Normal file
9
secrets/secret3.age
Normal file
@@ -0,0 +1,9 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 mT2fyg slLOkD/9TAYOuZ/g5U4NvPWUlmYZeie12xzggioviw0
|
||||
E0uAj4RMgv7DTJpvtEO54G9XHNLFOgFflR54Cl6/X8g
|
||||
-> ssh-ed25519 UHxfvA xHFujOdegur0PLNHZP+h5RxHhVD2K906NZx7nprMkUs
|
||||
PdDxzD5QBdE/yWPMnF+CDGROEpE4nYvg12v1G3QK9XI
|
||||
-> ssh-ed25519 Xoin5w YWsO9HtEFB79+aKr6eWi5Sg5geKfzT+IrDy2L5qEmx4
|
||||
sXLRmcRDyAv64nSGs8QXcHmKYO+F11Pzea1EVGmpEys
|
||||
--- Sjg8SqkkEEL4X0G1GOUoHO702ZtrM0hMniIdS7yIsDA
|
||||
'<27>B<EFBFBD><42>(<28><>7Dϓ=<3D><>h<EFBFBD><10><>h f<>ɮ<13>xT<78><54>!K.<2E> <1D><>~س<>,<2C>ߓ<>D|<7C><>+p<><70><EFBFBD>"<22>t<EFBFBD><74>G<EFBFBD>y<EFBFBD>Q<EFBFBD><51>RcP<63>Q<EFBFBD><51> Q<><51>
|
||||
@@ -4,30 +4,8 @@ let
|
||||
lenovo = pub-keys.ssh.lenovo;
|
||||
_109-199-104-83 = pub-keys.ssh._109-199-104-83;
|
||||
in {
|
||||
# user passwords
|
||||
"andromeda-pw.age".publicKeys = [andromeda lenovo];
|
||||
"mtgmonkey-pw.age".publicKeys = [andromeda lenovo];
|
||||
|
||||
# contains the following env
|
||||
# CONDUIT_JWT_SECRET
|
||||
# CONDUIT_TURN_SECRET
|
||||
"conduit-secretFile.age".publicKeys = [andromeda lenovo _109-199-104-83];
|
||||
|
||||
# dkim private keys
|
||||
"dkim-galaxious.de.mail.key.age".publicKeys = [andromeda lenovo _109-199-104-83];
|
||||
|
||||
# mail account passwords
|
||||
"mailserver-acc-test-pw.age".publicKeys = [andromeda lenovo _109-199-104-83];
|
||||
"mailserver-acc-admin-pw.age".publicKeys = [andromeda lenovo _109-199-104-83];
|
||||
"mailserver-acc-zulip+admin-pw.age".publicKeys = [andromeda lenovo _109-199-104-83];
|
||||
|
||||
# zulip keys
|
||||
"zulip-avatarSaltKey.age".publicKeys = [andromeda lenovo _109-199-104-83];
|
||||
"zulip-camoKey.age".publicKeys = [andromeda lenovo _109-199-104-83];
|
||||
"zulip-rabbitmqPassword.age".publicKeys = [andromeda lenovo _109-199-104-83];
|
||||
"zulip-secretKey.age".publicKeys = [andromeda lenovo _109-199-104-83];
|
||||
"zulip-sharedSecretKey.age".publicKeys = [andromeda lenovo _109-199-104-83];
|
||||
|
||||
# zulip-secrets.conf values
|
||||
"zulip-extraSecrets-email_password.age".publicKeys = [andromeda lenovo _109-199-104-83];
|
||||
"secret0.age".publicKeys = [andromeda lenovo];
|
||||
"secret1.age".publicKeys = [andromeda lenovo];
|
||||
"secret2.age".publicKeys = [andromeda lenovo _109-199-104-83];
|
||||
"secret3.age".publicKeys = [andromeda lenovo _109-199-104-83];
|
||||
}
|
||||
|
||||
Binary file not shown.
@@ -1,10 +0,0 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 mT2fyg 5ADzKAtycqfFpqW/dp71FTaK2gchzdWFNqxPyZ6deSY
|
||||
+aISA4YwF1l9S0fmE84wOvAJpM221bwPDYvXELTVv9k
|
||||
-> ssh-ed25519 UHxfvA uKYcpPbaXA4r1OmlkuiIu/EqQ3IiHR7JpItnVgTaW2g
|
||||
LjySgI4mTlaZY81IJc6DmBh43l2qeGlQnZi+rOlbtb8
|
||||
-> ssh-ed25519 yXDKAA TMwoM06ZJsjkZ7eLguxqYB05jcRn+tTgVzE7WQIf0mw
|
||||
vKwCkWsywGsgVv6Y278Mi28MhCYBRRUnfg4+EouOw+0
|
||||
--- CScrim9wya9AhElXBtKBR3XBZDL83/g3MTfdF258GJ8
|
||||
K#<23> >8}c<><EFBFBD><7F>}8<><38>L<04>(<28><>c<EFBFBD><63>
|
||||
<EFBFBD>w1<EFBFBD>"O<><4F>
|
||||
@@ -1,10 +0,0 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 mT2fyg IOcD4r19Gx2AvjusnnJDHQXr/U4Ti6qKr01I9lNQDQE
|
||||
fCwouMQPvhkyzehszuv0YhSfNh9zGKaFNDKaTZT0rD0
|
||||
-> ssh-ed25519 UHxfvA e95raPehUz6T2FR/eT8kzfrxt/Ou6kKsqi7z/3BkfwU
|
||||
uHymqnY3t7IwpxWkN8xen3Vsy6R7VMoj+fR0zPnPinY
|
||||
-> ssh-ed25519 yXDKAA nlR1prGysW+k8gq2npEiboFqoo9jKQ5ISxRiiCFlb0s
|
||||
kaGOvlQgO0nOAl12mMKvafa9ezmy8XdUC2tVPuBG4iw
|
||||
--- MRFAGURoyediqNSjGxr57a0w6n9lH2zVjfyrUZcyAYw
|
||||
|
||||
z<EFBFBD>0
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
@@ -1,8 +0,0 @@
|
||||
{
|
||||
# spectrum
|
||||
nix.settings.substituters = ["https://cache.dataaturservice.se/spectrum/"];
|
||||
nix.settings.trusted-public-keys = [
|
||||
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
|
||||
"spectrum-os.org-2:foQk3r7t2VpRx92CaXb5ROyy/NBdRJQG2uX2XJMYZfU="
|
||||
];
|
||||
}
|
||||
32
users.nix
32
users.nix
@@ -13,14 +13,30 @@ in {
|
||||
"andromeda" = {
|
||||
isNormalUser = true;
|
||||
description = "andromeda";
|
||||
hashedPasswordFile = builtins.toString config.age.secrets.andromeda-pw.path;
|
||||
hashedPasswordFile = builtins.toString config.age.secrets.secret0.path;
|
||||
extraGroups = [
|
||||
"networkmanager"
|
||||
"wheel"
|
||||
];
|
||||
};
|
||||
"mtgmonkey" = {
|
||||
isNormalUser = true;
|
||||
description = "mtgmonkey";
|
||||
hashedPasswordFile = builtins.toString config.age.secrets.secret1.path;
|
||||
extraGroups = [
|
||||
(lib.mkIf
|
||||
(machine == machines.lenovo)
|
||||
"networkmanager")
|
||||
"wheel"
|
||||
];
|
||||
openssh.authorizedKeys.keys = [
|
||||
(lib.mkIf
|
||||
(machine == machines."109-199-104-83")
|
||||
config.pub-keys.ssh.andromeda)
|
||||
];
|
||||
};
|
||||
};
|
||||
environment.persistence."/persist".users = lib.mkIf config.environment.persistence."/persist".enable (
|
||||
environment.persistence."/nix/persist".users = lib.mkIf config.environment.persistence."/nix/persist".enable (
|
||||
builtins.mapAttrs
|
||||
(name: value: lib.mkIf (builtins.elem name machine.users) value)
|
||||
{
|
||||
@@ -29,7 +45,7 @@ in {
|
||||
".backups"
|
||||
".local/share/Anki2"
|
||||
".local/share/chat.fluffy.fluffychat"
|
||||
".local/share/zoxide"
|
||||
".local/share.zoxide"
|
||||
".ssh"
|
||||
"conf"
|
||||
"Downloads"
|
||||
@@ -40,6 +56,16 @@ in {
|
||||
".brush_history"
|
||||
];
|
||||
};
|
||||
"mtgmonkey" = {
|
||||
directories = [
|
||||
".local/share/zoxide"
|
||||
".ssh"
|
||||
];
|
||||
files = [
|
||||
".bash_history"
|
||||
".brush_history"
|
||||
];
|
||||
};
|
||||
}
|
||||
);
|
||||
}
|
||||
|
||||
@@ -16,6 +16,82 @@
|
||||
"${config.home.homeDirectory}/${background-path}"
|
||||
];
|
||||
};
|
||||
sway_config' = builtins.toFile "sway_config" ''
|
||||
set $mod Mod4
|
||||
set $left h
|
||||
set $down j
|
||||
set $up k
|
||||
set $right l
|
||||
set $term alacritty
|
||||
set $menu wmenu-run
|
||||
set $screenshot grim -g "$(slurp)"
|
||||
floating_modifier $mod normal
|
||||
|
||||
workspace_layout stacking
|
||||
output * bg ${config.home.homeDirectory}/${background-path} fill
|
||||
|
||||
# launch programs
|
||||
bindsym $mod+Shift+Return exec $term
|
||||
bindsym $mod+Shift+d exec $menu
|
||||
bindsym $mod+Shift+a exec anki
|
||||
bindsym $mod+Shift+q exec librewolf
|
||||
bindsym $mod+Shift+s exec $screenshot
|
||||
|
||||
bindsym $mod+Shift+c kill
|
||||
|
||||
bindsym $mod+Shift+r reload
|
||||
|
||||
bindsym $mod+Shift+Alt+q exit
|
||||
|
||||
bindsym $mod+$left focus left
|
||||
bindsym $mod+$down focus down
|
||||
bindsym $mod+$up focus up
|
||||
bindsym $mod+$right focus right
|
||||
|
||||
bindsym $mod+Shift+$left move left
|
||||
bindsym $mod+Shift+$down move down
|
||||
bindsym $mod+Shift+$up move up
|
||||
bindsym $mod+Shift+$right move right
|
||||
|
||||
bindsym $mod+1 workspace number 1
|
||||
bindsym $mod+2 workspace number 2
|
||||
bindsym $mod+3 workspace number 3
|
||||
bindsym $mod+4 workspace number 4
|
||||
bindsym $mod+5 workspace number 5
|
||||
bindsym $mod+6 workspace number 6
|
||||
bindsym $mod+7 workspace number 7
|
||||
bindsym $mod+8 workspace number 8
|
||||
bindsym $mod+9 workspace number 9
|
||||
bindsym $mod+0 workspace number 0
|
||||
|
||||
bindsym $mod+Shift+1 move container to workspace number 1
|
||||
bindsym $mod+Shift+2 move container to workspace number 2
|
||||
bindsym $mod+Shift+3 move container to workspace number 3
|
||||
bindsym $mod+Shift+4 move container to workspace number 4
|
||||
bindsym $mod+Shift+5 move container to workspace number 5
|
||||
bindsym $mod+Shift+6 move container to workspace number 6
|
||||
bindsym $mod+Shift+7 move container to workspace number 7
|
||||
bindsym $mod+Shift+8 move container to workspace number 8
|
||||
bindsym $mod+Shift+9 move container to workspace number 9
|
||||
bindsym $mod+Shift+0 move container to workspace number 0
|
||||
|
||||
bindsym $mod+f fullscreen
|
||||
bindsym $mod+Shift+space floating toggle
|
||||
bindsym $mod+Shift+minus move scratchpad
|
||||
bindsym $mod+minus scratchpad show
|
||||
|
||||
bindsym --locked XF86AudioMute exec pactl set-sink-mute \@DEFAULT_SINK@ toggle
|
||||
bindsym --locked XF86AudioLowerVolume exec pactl set-sink-volume \@DEFAULT_SINK@ -5%
|
||||
bindsym --locked XF86AudioRaiseVolume exec pactl set-sink-volume \@DEFAULT_SINK@ +5%
|
||||
bindsym --locked XF86AudioMicMute exec pact set-source-mute \@DEFAULT_SOURCE@ toggle
|
||||
bindsym --locked XF86MonBrightnessDown exec brightnessctl set 5%-
|
||||
bindsym --locked XF86MonbrightnessUp exec brightnessctl set 5%+
|
||||
|
||||
default_border none
|
||||
font pango:monospace 0.001
|
||||
titlebar_border_thickness 0
|
||||
titlebar_padding 0
|
||||
'';
|
||||
in {
|
||||
imports = [./stylix.nix];
|
||||
xdg.configFile."shell".source = lib.getExe pkgs.brush;
|
||||
@@ -91,81 +167,6 @@ in {
|
||||
};
|
||||
};
|
||||
fastfetch.enable = true;
|
||||
firefox = {
|
||||
enable = true;
|
||||
package = pkgs.firefox.override {
|
||||
cfg.enableTridactylNative = true;
|
||||
};
|
||||
profiles.${config.home.username} = {
|
||||
extensions.packages = [
|
||||
pkgs.nur.repos.rycee.firefox-addons.tridactyl
|
||||
];
|
||||
search = {
|
||||
default = "ddghtml";
|
||||
privateDefault = "ddghtml";
|
||||
order = [
|
||||
"wiki"
|
||||
"options"
|
||||
"packages"
|
||||
"repos"
|
||||
];
|
||||
engines = {
|
||||
"packages" = {
|
||||
urls = [
|
||||
{
|
||||
template = "https://search.nixos.org/packages";
|
||||
params = [
|
||||
{
|
||||
name = "channel";
|
||||
value = "unstable";
|
||||
}
|
||||
{
|
||||
name = "query";
|
||||
value = "{searchTerms}";
|
||||
}
|
||||
];
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
"options" = {
|
||||
urls = [
|
||||
{
|
||||
template = "https://search.nixos.org/options";
|
||||
params = [
|
||||
{
|
||||
name = "channel";
|
||||
value = "unstable";
|
||||
}
|
||||
{
|
||||
name = "query";
|
||||
value = "{searchTerms}";
|
||||
}
|
||||
];
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
"wiki" = {
|
||||
urls = [
|
||||
{
|
||||
template = "https://wiki.nixos.org/w/index.php";
|
||||
params = [
|
||||
{
|
||||
name = "search";
|
||||
value = "{searchTerms}";
|
||||
}
|
||||
];
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
settings = {
|
||||
"extensions.autoDisableScopes" = 0;
|
||||
};
|
||||
};
|
||||
};
|
||||
git = {
|
||||
enable = true;
|
||||
settings = {
|
||||
@@ -178,6 +179,15 @@ in {
|
||||
};
|
||||
gh.enable = true;
|
||||
home-manager.enable = true;
|
||||
firefox = {
|
||||
enable = true;
|
||||
package = pkgs.firefox.override {
|
||||
cfg.enableTridactylNative = true;
|
||||
};
|
||||
profiles.${config.home.username}.extensions.packages = [
|
||||
pkgs.nur.repos.rycee.firefox-addons.tridactyl
|
||||
];
|
||||
};
|
||||
lsd.enable = true;
|
||||
nvf = {
|
||||
enable = true;
|
||||
|
||||
@@ -55,12 +55,6 @@ bindsym $mod+Shift+8 move container to workspace number 8
|
||||
bindsym $mod+Shift+9 move container to workspace number 9
|
||||
bindsym $mod+Shift+0 move container to workspace number 0
|
||||
|
||||
seat * hide_cursor 100
|
||||
input type:touchpad events disabled
|
||||
|
||||
bindsym $mod+r exec 'swaymsg "seat * hide_cursor 100"; swaymsg "input type:touchpad events disabled"'
|
||||
bindsym $mod+t exec 'swaymsg "seat * hide_cursor 0"; swaymsg "input type:touchpad events enabled"'
|
||||
|
||||
bindsym $mod+f fullscreen
|
||||
bindsym $mod+Shift+space floating toggle
|
||||
bindsym $mod+Shift+minus move scratchpad
|
||||
@@ -70,8 +64,8 @@ bindsym --locked XF86AudioMute exec pactl set-sink-mute \@DEFAULT_SINK@ toggle
|
||||
bindsym --locked XF86AudioLowerVolume exec pactl set-sink-volume \@DEFAULT_SINK@ -5%
|
||||
bindsym --locked XF86AudioRaiseVolume exec pactl set-sink-volume \@DEFAULT_SINK@ +5%
|
||||
bindsym --locked XF86AudioMicMute exec pact set-source-mute \@DEFAULT_SOURCE@ toggle
|
||||
bindsym --locked XF86MonBrightnessDown exec brightnessctl set 2%-
|
||||
bindsym --locked XF86MonbrightnessUp exec brightnessctl set 2%+
|
||||
bindsym --locked XF86MonBrightnessDown exec brightnessctl set 5%-
|
||||
bindsym --locked XF86MonbrightnessUp exec brightnessctl set 5%+
|
||||
|
||||
default_border none
|
||||
font pango:monospace 0.001
|
||||
|
||||
@@ -1,18 +1,24 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
machine,
|
||||
pkgs,
|
||||
...
|
||||
}: {
|
||||
imports = [./stylix.nix];
|
||||
xdg.configFile."shell".source = lib.getExe pkgs.brush;
|
||||
home = {
|
||||
username = "andromeda";
|
||||
username = "mtgmonkey";
|
||||
homeDirectory = "/home/${config.home.username}";
|
||||
stateVersion = "26.05";
|
||||
packages = [
|
||||
pkgs.acpi
|
||||
pkgs.brightnessctl
|
||||
pkgs.brush
|
||||
pkgs.dust
|
||||
pkgs.fzf
|
||||
pkgs.glow
|
||||
pkgs.jmtpfs
|
||||
pkgs.nix-output-monitor
|
||||
pkgs.ranger
|
||||
pkgs.rip2
|
||||
@@ -68,11 +74,12 @@
|
||||
settings = {
|
||||
user = {
|
||||
name = config.home.username;
|
||||
email = "${config.home.username}@android";
|
||||
email = "${config.home.username}@${machine.hostname}";
|
||||
};
|
||||
init.defaultBranch = "master";
|
||||
};
|
||||
};
|
||||
gh.enable = true;
|
||||
home-manager.enable = true;
|
||||
lsd.enable = true;
|
||||
nvf = {
|
||||
29
users/mtgmonkey/stylix.nix
Normal file
29
users/mtgmonkey/stylix.nix
Normal file
@@ -0,0 +1,29 @@
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
...
|
||||
}: {
|
||||
stylix = {
|
||||
enable = true;
|
||||
# rebecca has lavener bkg
|
||||
# tube has dark gray bkg
|
||||
# silk-light is light theme
|
||||
base16Scheme = "${pkgs.base16-schemes}/share/themes/gruvbox-material-dark-hard.yaml";
|
||||
polarity = "dark";
|
||||
fonts = {
|
||||
monospace = {
|
||||
package = pkgs.miracode;
|
||||
name = "Miracode";
|
||||
};
|
||||
serif = config.stylix.fonts.sansSerif;
|
||||
emoji = {
|
||||
package = pkgs.noto-fonts-color-emoji;
|
||||
name = "Noto Color Emoji";
|
||||
};
|
||||
sizes = {
|
||||
applications = 12;
|
||||
terminal = 10;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user