diff options
| author | adikro <adikro@disroot.org> | 2026-06-12 00:53:25 +0200 |
|---|---|---|
| committer | adikro <adikro@disroot.org> | 2026-06-12 00:53:25 +0200 |
| commit | 1eba5398fd09f98bd11cbf8c3b80f20bb9ce1f2d (patch) | |
| tree | c103e3d6ee0e3b2a1e3ac8fd525c08eb7d37e938 | |
| parent | 66eff7dbb117ccf9cbf743036f058d5dcb0a78e6 (diff) | |
microvm and dns stuff
40 files changed, 1089 insertions, 500 deletions
@@ -18,6 +18,22 @@ "url": "https://git.bwaaa.monster/beaker" } }, + "blobs": { + "flake": false, + "locked": { + "lastModified": 1604995301, + "narHash": "sha256-wcLzgLec6SGJA8fx1OEN1yV/Py5b+U5iyYpksUY/yLw=", + "owner": "simple-nixos-mailserver", + "repo": "blobs", + "rev": "2cccdf1ca48316f2cfd1c9a0017e8de5a7156265", + "type": "gitlab" + }, + "original": { + "owner": "simple-nixos-mailserver", + "repo": "blobs", + "type": "gitlab" + } + }, "disko": { "inputs": { "nixpkgs": [ @@ -85,17 +101,19 @@ } }, "flake-compat": { + "flake": false, "locked": { - "lastModified": 1733328505, - "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=", - "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec", - "revCount": 69, - "type": "tarball", - "url": "https://api.flakehub.com/f/pinned/edolstra/flake-compat/1.1.0/01948eb7-9cba-704f-bbf3-3fa956735b52/source.tar.gz" + "lastModified": 1767039857, + "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=", + "owner": "NixOS", + "repo": "flake-compat", + "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab", + "type": "github" }, "original": { - "type": "tarball", - "url": "https://flakehub.com/f/edolstra/flake-compat/1.tar.gz" + "owner": "NixOS", + "repo": "flake-compat", + "type": "github" } }, "flake-compat_2": { @@ -148,24 +166,6 @@ }, "flake-parts": { "inputs": { - "nixpkgs-lib": "nixpkgs-lib" - }, - "locked": { - "lastModified": 1778716662, - "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=", - "owner": "hercules-ci", - "repo": "flake-parts", - "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb", - "type": "github" - }, - "original": { - "owner": "hercules-ci", - "repo": "flake-parts", - "type": "github" - } - }, - "flake-parts_2": { - "inputs": { "nixpkgs-lib": [ "nixvim", "nixpkgs" @@ -185,7 +185,7 @@ "type": "github" } }, - "flake-parts_3": { + "flake-parts_2": { "inputs": { "nixpkgs-lib": [ "nvf", @@ -206,9 +206,9 @@ "type": "github" } }, - "flake-parts_4": { + "flake-parts_3": { "inputs": { - "nixpkgs-lib": "nixpkgs-lib_2" + "nixpkgs-lib": "nixpkgs-lib" }, "locked": { "lastModified": 1768135262, @@ -281,7 +281,7 @@ }, "flake-utils_3": { "inputs": { - "systems": "systems_7" + "systems": "systems_6" }, "locked": { "lastModified": 1731533236, @@ -319,6 +319,54 @@ "type": "github" } }, + "git-hooks": { + "inputs": { + "flake-compat": [ + "nixos-mailserver", + "flake-compat" + ], + "gitignore": "gitignore", + "nixpkgs": [ + "nixos-mailserver", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1778507602, + "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=", + "owner": "cachix", + "repo": "git-hooks.nix", + "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a", + "type": "github" + }, + "original": { + "owner": "cachix", + "repo": "git-hooks.nix", + "type": "github" + } + }, + "gitignore": { + "inputs": { + "nixpkgs": [ + "nixos-mailserver", + "git-hooks", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1709087332, + "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=", + "owner": "hercules-ci", + "repo": "gitignore.nix", + "rev": "637db329424fd7e46cf4185293b9cc8c88c95394", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "gitignore.nix", + "type": "github" + } + }, "home-manager": { "inputs": { "nixpkgs": [ @@ -326,11 +374,11 @@ ] }, "locked": { - "lastModified": 1780099287, - "narHash": "sha256-efIPwVGtIWIjWcznhaop6XN6HxnOL8800hF6CBNvlqQ=", + "lastModified": 1781189114, + "narHash": "sha256-5inaamLgUMWy+MOBE9ChF9QAF1o/74LFuHkI0W/9rqc=", "owner": "nix-community", "repo": "home-manager", - "rev": "7d8127d308c3fb9664f7e643eec944be74ebb37d", + "rev": "486595d2cf49cfcd649b58a284fa11ac0e34da22", "type": "github" }, "original": { @@ -369,11 +417,11 @@ "spectrum": "spectrum" }, "locked": { - "lastModified": 1779970379, - "narHash": "sha256-ZHsxoYXXnfJtMVh1/yY+1Eh9hHcPBhE28Qvinauh+BQ=", + "lastModified": 1780588968, + "narHash": "sha256-zQk+GqLO+T9taIl1UUt3swvaOksWJxL7PL8K0+Fc/Hs=", "owner": "microvm-nix", "repo": "microvm.nix", - "rev": "0d49083ba2d7419b22908ac392777c16df9a032e", + "rev": "4d3fb17437944ea57eef2b9e6108ca777b1209ca", "type": "github" }, "original": { @@ -384,11 +432,11 @@ }, "mnw": { "locked": { - "lastModified": 1778541201, - "narHash": "sha256-n0twkzWexzjsoDycOTvvQNuGEdg62UiNHYcFCduYpKI=", + "lastModified": 1780772958, + "narHash": "sha256-VKKe8r4pwCGWZ3Yr9CPN129R4S3CKLSrlYqdYz3vKpM=", "owner": "Gerg-L", "repo": "mnw", - "rev": "1a3573fc9d2486738fe0b2cacc5cd10dd5f3a445", + "rev": "0871dbf63a53610c95db04439ed8ea4d6ec9c160", "type": "github" }, "original": { @@ -466,11 +514,11 @@ "xwayland-satellite-unstable": "xwayland-satellite-unstable" }, "locked": { - "lastModified": 1780062130, - "narHash": "sha256-3XF+oy0PX4aajJw2RNB8rlMpyu0eXCG4pGH7fe94yBg=", + "lastModified": 1781038035, + "narHash": "sha256-X+uFuOQVWiouzl7eSV5JUgg4CAbv779QgEqOxIo6Gls=", "owner": "sodiboo", "repo": "niri-flake", - "rev": "3cb351d73c357a4e413f59c4551d219118791c14", + "rev": "27982962e1dee4994b05d2b0b4a29f8de2529a55", "type": "github" }, "original": { @@ -499,11 +547,11 @@ "niri-unstable": { "flake": false, "locked": { - "lastModified": 1780056110, - "narHash": "sha256-t7lKVshV/srD0G06j4r5P5qj9zaDeZ9JYFCxHDGROZU=", + "lastModified": 1780938415, + "narHash": "sha256-QHyIMGSbCQW8d5qbOrMsm6gem10bO3Au2YLa3alJfHo=", "owner": "YaLTeR", "repo": "niri", - "rev": "f9f43d826ab4014a7c302be28d7da33e12f5be37", + "rev": "6f1a2c5f0e8274223d4204b1f8d6f7f91538967e", "type": "github" }, "original": { @@ -512,66 +560,47 @@ "type": "github" } }, - "nix-gaming-edge": { + "nixos-hardware": { "inputs": { - "nixpkgs": [ - "nixpkgs" - ] + "nixpkgs": "nixpkgs_2" }, "locked": { - "lastModified": 1780210657, - "narHash": "sha256-6IwdQqgEJZ9wQ8vWuA39/w+JR+cJX6SF05NwpCH5IoM=", - "owner": "powerofthe69", - "repo": "nix-gaming-edge", - "rev": "94a16567641c4f6dffa22fce90fde36c7f4fda73", + "lastModified": 1781168557, + "narHash": "sha256-LOnLQ2tpYF9gqIDDr3+j3DbpJJr/QCH6zPRT2GzEUOE=", + "owner": "NixOS", + "repo": "nixos-hardware", + "rev": "6358ff76821101c178e3ab4919a62799bfe3652e", "type": "github" }, "original": { - "owner": "powerofthe69", - "repo": "nix-gaming-edge", + "owner": "NixOS", + "ref": "master", + "repo": "nixos-hardware", "type": "github" } }, - "nixcord": { + "nixos-mailserver": { "inputs": { + "blobs": "blobs", "flake-compat": "flake-compat", - "flake-parts": "flake-parts", + "git-hooks": "git-hooks", "nixpkgs": [ "nixpkgs" - ], - "nixpkgs-nixcord": "nixpkgs-nixcord" + ] }, "locked": { - "lastModified": 1780158792, - "narHash": "sha256-tAGrRIQOi11zwl7UOLKkNsy3owVTE+/lDU1MJT9K2Qw=", - "owner": "FlameFlag", - "repo": "nixcord", - "rev": "d0a08d06b3a00b1038b1780366180068af7c1489", - "type": "github" + "lastModified": 1781101699, + "narHash": "sha256-5erzbe5hgJufkqBr3KCYElX4nW+xfJJrFDOvweWZR3w=", + "owner": "simple-nixos-mailserver", + "repo": "nixos-mailserver", + "rev": "d59fcaeef8144328b8801f987f1a3af7ca6aec41", + "type": "gitlab" }, "original": { - "owner": "FlameFlag", - "repo": "nixcord", - "type": "github" - } - }, - "nixos-hardware": { - "inputs": { - "nixpkgs": "nixpkgs_2" - }, - "locked": { - "lastModified": 1780065812, - "narHash": "sha256-SCSLUKBmwlSLGQ8Xbr8PjRFtiHNk0l9ktqkcmqdBkfE=", - "owner": "NixOS", - "repo": "nixos-hardware", - "rev": "b76b5639c0593e0aeb0b5879ad62d4b30596c144", - "type": "github" - }, - "original": { - "owner": "NixOS", - "ref": "master", - "repo": "nixos-hardware", - "type": "github" + "owner": "simple-nixos-mailserver", + "ref": "nixos-26.05", + "repo": "nixos-mailserver", + "type": "gitlab" } }, "nixpkgs": { @@ -592,21 +621,6 @@ }, "nixpkgs-lib": { "locked": { - "lastModified": 1777168982, - "narHash": "sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ=", - "owner": "nix-community", - "repo": "nixpkgs.lib", - "rev": "f5901329dade4a6ea039af1433fb087bd9c1fe14", - "type": "github" - }, - "original": { - "owner": "nix-community", - "repo": "nixpkgs.lib", - "type": "github" - } - }, - "nixpkgs-lib_2": { - "locked": { "lastModified": 1765674936, "narHash": "sha256-k00uTP4JNfmejrCLJOwdObYC9jHRrr/5M/a/8L2EIdo=", "owner": "nix-community", @@ -620,29 +634,13 @@ "type": "github" } }, - "nixpkgs-nixcord": { - "locked": { - "lastModified": 1779102034, - "narHash": "sha256-vZJZjLo513IeI8hjzHFc6TDezUd4uCE2Eq4SNO3DNNg=", - "owner": "NixOS", - "repo": "nixpkgs", - "rev": "687f05a9184cad4eaf905c48b63649e3a86f5433", - "type": "github" - }, - "original": { - "owner": "NixOS", - "ref": "nixos-25.11", - "repo": "nixpkgs", - "type": "github" - } - }, "nixpkgs-stable": { "locked": { - "lastModified": 1779796641, - "narHash": "sha256-ZsIrKmhp4vbBXoXXmR/tBXA/UCsAQiJL9vsgZEduhVY=", + "lastModified": 1780952837, + "narHash": "sha256-Fwd1+spDtQ0hDyBwme6ufG3n4mY0UrjjFdYHv+G/Hds=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "25f538306313eae3927264466c70d7001dcea1df", + "rev": "e820eb4a444b46a19b2e03e8dfd2359439ff30fe", "type": "github" }, "original": { @@ -654,11 +652,11 @@ }, "nixpkgs-stable_2": { "locked": { - "lastModified": 1779796641, - "narHash": "sha256-ZsIrKmhp4vbBXoXXmR/tBXA/UCsAQiJL9vsgZEduhVY=", + "lastModified": 1780952837, + "narHash": "sha256-Fwd1+spDtQ0hDyBwme6ufG3n4mY0UrjjFdYHv+G/Hds=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "25f538306313eae3927264466c70d7001dcea1df", + "rev": "e820eb4a444b46a19b2e03e8dfd2359439ff30fe", "type": "github" }, "original": { @@ -683,11 +681,11 @@ }, "nixpkgs_3": { "locked": { - "lastModified": 1779560665, - "narHash": "sha256-tpyBcxPpcQb8ukyNF7DoCwfSY3VPsxHoYwj00Cayv5o=", + "lastModified": 1780749050, + "narHash": "sha256-3av0pIjlOWQ6rDbNOmpUSvbNnJkGORQKKjb4LtCZsIY=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "64c08a7ca051951c8eae34e3e3cb1e202fe36786", + "rev": "a799d3e3886da994fa307f817a6bc705ae538eeb", "type": "github" }, "original": { @@ -699,11 +697,11 @@ }, "nixpkgs_4": { "locked": { - "lastModified": 1780030872, - "narHash": "sha256-u6WU/yd/o8iYQrHX3RAwO1hYa3LkoSL+WNQD0rJfJZQ=", + "lastModified": 1780336545, + "narHash": "sha256-vhVhuXzFrIOfcssC/9hDHx7MHzDKjF3keHuREOQqQiQ=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "e9a7635a57597d9754eccebdfc7045e6c8600e6b", + "rev": "4df1b885d76a54e1aa1a318f8d16fd6005b6401f", "type": "github" }, "original": { @@ -731,16 +729,16 @@ }, "nixvim": { "inputs": { - "flake-parts": "flake-parts_2", + "flake-parts": "flake-parts", "nixpkgs": "nixpkgs_4", "systems": "systems_2" }, "locked": { - "lastModified": 1780235872, - "narHash": "sha256-/TTVFhJQ5StCOrRFO+5NfSkYPSbAAekwymovcQzxNgE=", + "lastModified": 1781034432, + "narHash": "sha256-+UuS36un3lXLtKsGCYQnOn51hDhB+dZ1SHoHXClnV/0=", "owner": "nix-community", "repo": "nixvim", - "rev": "e5c7b40dc569f5c97ba2182d409f0fb54c02d7c1", + "rev": "e9fbbd56eab78751ba4c166c31a1667042528ced", "type": "github" }, "original": { @@ -752,7 +750,7 @@ "nvf": { "inputs": { "flake-compat": "flake-compat_2", - "flake-parts": "flake-parts_3", + "flake-parts": "flake-parts_2", "mnw": "mnw", "ndg": "ndg", "nixpkgs": [ @@ -761,11 +759,11 @@ "systems": "systems_3" }, "locked": { - "lastModified": 1780042000, - "narHash": "sha256-RxFOqPMAlbWiWwh7CQ0bIHIdt4D5gAttx3YVifBBWgE=", + "lastModified": 1781204315, + "narHash": "sha256-0mEWVih7Aq2tdyZwHL91tZMsIitFIocGMvtfaenOSPc=", "owner": "NotAShelf", "repo": "nvf", - "rev": "07b57ebc6c9e778c536ac0ff1b01fb18dc90239a", + "rev": "5727a5b9a76f6540d93a26cfc96c6ec2b47fa4f3", "type": "github" }, "original": { @@ -822,7 +820,7 @@ }, "otter-launcher": { "inputs": { - "flake-parts": "flake-parts_4", + "flake-parts": "flake-parts_3", "home-manager": "home-manager_2", "nixpkgs": [ "nixpkgs" @@ -830,11 +828,11 @@ "systems": "systems_5" }, "locked": { - "lastModified": 1779154764, - "narHash": "sha256-D3wp7vR3+ktTNJ54rUWHIK6Y5tGeNXDD4FBO785wl0E=", + "lastModified": 1780973227, + "narHash": "sha256-vlNT2248Oxg3++bk8ZkozsU4wDbxOkh6dl3GeoBmmXE=", "owner": "kuokuo123", "repo": "otter-launcher", - "rev": "b1c2c0992403f52dff1f5754cc250ee6e121e342", + "rev": "764a38d1de308da3268222692652a0a85bb71eee", "type": "github" }, "original": { @@ -850,9 +848,8 @@ "home-manager": "home-manager", "microvm": "microvm", "niri": "niri", - "nix-gaming-edge": "nix-gaming-edge", - "nixcord": "nixcord", "nixos-hardware": "nixos-hardware", + "nixos-mailserver": "nixos-mailserver", "nixpkgs": "nixpkgs_3", "nixpkgs-stable": "nixpkgs-stable_2", "nixvim": "nixvim", @@ -863,7 +860,6 @@ "satty": "satty", "sls-steam": "sls-steam", "sops-nix": "sops-nix", - "spicetify-nix": "spicetify-nix", "waybar": "waybar", "yazi": "yazi" } @@ -949,11 +945,11 @@ "rust-overlay": "rust-overlay" }, "locked": { - "lastModified": 1780226934, - "narHash": "sha256-H6AFFlUvoLPlMZcyt2+XvZqThdrasY2pCvRiUNiZV5g=", + "lastModified": 1781157699, + "narHash": "sha256-3wCm5AnfEOqEvx1acTB5j4Wn5+8lDQ6nWAz6r/Er2ag=", "owner": "gabm", "repo": "Satty", - "rev": "8cad8cf1ac825f38c6e84a225cc0973d8ed0fd72", + "rev": "9dde65caaf515636a9cdcf5abece0413de465605", "type": "github" }, "original": { @@ -969,11 +965,11 @@ ] }, "locked": { - "lastModified": 1779974773, - "narHash": "sha256-/NdMwD6MOfg16+MhHYeDbThlgsl0Ui04daguc7OITDo=", + "lastModified": 1781157498, + "narHash": "sha256-gDNHztsHGFAmbbj7Gcu8vWcFU5+4c1EeGU4lhb7Hnqo=", "owner": "AceSLS", "repo": "SLSsteam", - "rev": "414a112981abb0cb9cd8788e4aaad76d813077e2", + "rev": "981da676e76f72b1ed3c387f192509ac9a1b91e4", "type": "github" }, "original": { @@ -1012,11 +1008,11 @@ ] }, "locked": { - "lastModified": 1777944972, - "narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=", + "lastModified": 1780547341, + "narHash": "sha256-Gq8KNx5A7hBB3uGJaj6eQfLDIz5YdLu92gqBcvHvoUo=", "owner": "Mic92", "repo": "sops-nix", - "rev": "c591bf665727040c6cc5cb409079acb22dcce33c", + "rev": "9ed65852b6257fbeae4355bc24ecfea307ca759a", "type": "github" }, "original": { @@ -1041,27 +1037,6 @@ "url": "https://spectrum-os.org/git/spectrum" } }, - "spicetify-nix": { - "inputs": { - "nixpkgs": [ - "nixpkgs" - ], - "systems": "systems_6" - }, - "locked": { - "lastModified": 1780213729, - "narHash": "sha256-rdeBztPA6tiKp6gG4ihZAzeYGC9mYa2tAU4UIOLcZM0=", - "owner": "Gerg-L", - "repo": "spicetify-nix", - "rev": "c679f3fa9fbe86903486a8f7ad71f99e26481d71", - "type": "github" - }, - "original": { - "owner": "Gerg-L", - "repo": "spicetify-nix", - "type": "github" - } - }, "systems": { "locked": { "lastModified": 1681028828, @@ -1153,21 +1128,6 @@ "type": "github" } }, - "systems_7": { - "locked": { - "lastModified": 1681028828, - "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", - "owner": "nix-systems", - "repo": "default", - "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", - "type": "github" - }, - "original": { - "owner": "nix-systems", - "repo": "default", - "type": "github" - } - }, "waybar": { "inputs": { "flake-compat": "flake-compat_4", @@ -1231,11 +1191,11 @@ "rust-overlay": "rust-overlay_2" }, "locked": { - "lastModified": 1780204031, - "narHash": "sha256-5CzvmbISW/n13HQ4saTtBLlHIsdQIHiVJy8GzXyritY=", + "lastModified": 1781181862, + "narHash": "sha256-EBeyydl9ekGp/98VyF4ciFS3zNkspWhJiTG/+UWyHQ4=", "owner": "sxyazi", "repo": "yazi", - "rev": "e892bf7d903d9efb7322f47d93c3ac6be5dd797e", + "rev": "9b920ed2e3ebc126cf8ba3e51acfc5be8b8cbf56", "type": "github" }, "original": { @@ -5,14 +5,14 @@ nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; nixpkgs-stable.url = "github:NixOS/nixpkgs/nixos-25.11"; - nixcord = { - url = "github:FlameFlag/nixcord"; - inputs.nixpkgs.follows = "nixpkgs"; - }; - # Hardware and gaming nixos-hardware.url = "github:NixOS/nixos-hardware/master"; + nixos-mailserver = { + url = "gitlab:simple-nixos-mailserver/nixos-mailserver/nixos-26.05"; + inputs.nixpkgs.follows = "nixpkgs"; + }; + microvm = { url = "github:microvm-nix/microvm.nix"; inputs.nixpkgs.follows = "nixpkgs"; @@ -28,11 +28,6 @@ inputs.nixpkgs.follows = "nixpkgs"; }; - nix-gaming-edge = { - url = "github:powerofthe69/nix-gaming-edge"; - inputs.nixpkgs.follows = "nixpkgs"; - }; - # System Utilities sops-nix = { url = "github:Mic92/sops-nix"; @@ -70,11 +65,6 @@ inputs.nixpkgs.follows = "nixpkgs"; }; - spicetify-nix = { - url = "github:Gerg-L/spicetify-nix"; - inputs.nixpkgs.follows = "nixpkgs"; - }; - # Other omnisearch = { # url = "git+https://git.bwaaa.monster/omnisearch"; diff --git a/hm/soft/chat.nix b/hm/soft/chat.nix index 90a3887..b886656 100644 --- a/hm/soft/chat.nix +++ b/hm/soft/chat.nix @@ -2,24 +2,14 @@ config, pkgs, lib, - inputs, ... }: let cfg = config.hm.soft.chat; in { - imports = [ inputs.nixcord.homeModules.nixcord ]; - options.hm.soft.chat.enable = lib.mkEnableOption "chatting apps"; config = lib.mkIf cfg.enable { - programs.nixcord = { - enable = true; - discord = { - vencord.enable = false; - equicord.enable = true; - }; - }; home.packages = with pkgs; [ telegram-desktop simplex-chat-desktop diff --git a/hm/soft/mangohud.nix b/hm/soft/mangohud.nix deleted file mode 100644 index 335014c..0000000 --- a/hm/soft/mangohud.nix +++ /dev/null @@ -1,28 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.hm.soft.mangohud; -in -{ - options.hm.soft.mangohud.enable = lib.mkEnableOption "mangohud hm config"; - config = lib.mkIf cfg.enable { - programs.mangohud = { - enable = true; - settings = { - table_columns = 4; - font_scale = 1.3; - cellpadding_y = 0.1; - round_corners = 10; - fps_limit = 240; - - gpu_temp = true; - gpu_core_clock = true; - - cpu_temp = true; - cpu_mhz = true; - - fps_metrics = "0.01"; - wine = true; - }; - }; - }; -} diff --git a/hm/soft/soft.nix b/hm/soft/soft.nix index 127a5fe..2bab675 100644 --- a/hm/soft/soft.nix +++ b/hm/soft/soft.nix @@ -6,13 +6,11 @@ ./editor.nix ./email.nix ./kdenlive.nix - ./mangohud.nix ./media.nix ./mpv.nix ./obs.nix ./obsidian.nix ./onlyoffice.nix - ./spicetify.nix ./torrent.nix ./yt-dlp.nix ./sioyek.nix diff --git a/hm/soft/spicetify.nix b/hm/soft/spicetify.nix deleted file mode 100644 index f9a4d0c..0000000 --- a/hm/soft/spicetify.nix +++ /dev/null @@ -1,29 +0,0 @@ -{ - inputs, - pkgs, - config, - lib, - ... -}: -let - cfg = config.hm.soft.spicetify; - spicePkgs = inputs.spicetify-nix.legacyPackages.${pkgs.stdenv.hostPlatform.system}; -in -{ - imports = [ inputs.spicetify-nix.homeManagerModules.default ]; - - options.hm.soft.spicetify.enable = lib.mkEnableOption "spicetify config"; - config = lib.mkIf cfg.enable { - programs.spicetify = { - enable = true; - - enabledExtensions = with spicePkgs.extensions; [ - adblockify - hidePodcasts - ]; - - theme = spicePkgs.themes.catppuccin; - colorScheme = "mocha"; - }; - }; -} diff --git a/hosts/desktop/configuration.nix b/hosts/desktop/configuration.nix index adfb5a3..088098d 100644 --- a/hosts/desktop/configuration.nix +++ b/hosts/desktop/configuration.nix @@ -84,7 +84,6 @@ }; sunshine.enable = true; virtualization.kvm.enable = true; - kdeconnect.enable = true; nix-helper.enable = true; monero.wallet.enable = true; sops.enable = true; @@ -117,35 +116,4 @@ config.boot.kernelPackages.nct6687d ]; }; - - # services.netbox = { - # enable = true; - # package = pkgs-stable.netbox; - # secretKeyFile = "/var/lib/netbox/key"; - # apiTokenPeppersFile = "/var/lib/netbox/api-pepper"; - # - # settings = { - # ALLOWED_HOSTS = [ - # "localhost" - # "127.0.0.1" - # "[::1]" - # ]; - # }; - # }; - # - # services.nginx = { - # enable = true; - # user = "netbox"; - # recommendedProxySettings = true; - # virtualHosts.localhost = { - # locations = { - # "/" = { - # proxyPass = "http://[::1]:8001"; - # }; - # "/static/" = { - # alias = "${config.services.netbox.dataDir}/static/"; - # }; - # }; - # }; - # }; } diff --git a/hosts/desktop/home.nix b/hosts/desktop/home.nix index cdce283..e4461cd 100644 --- a/hosts/desktop/home.nix +++ b/hosts/desktop/home.nix @@ -60,7 +60,6 @@ chat.enable = true; obs.enable = true; obsidian.enable = true; - spicetify.enable = true; torrent.enable = true; yt-dlp.enable = true; onlyoffice.enable = true; @@ -94,7 +93,6 @@ }; home.packages = with pkgs; [ - cosmic-files feishin tmux gimp diff --git a/os/core/audio.nix b/os/core/audio.nix index 1e8985a..a7fb5db 100644 --- a/os/core/audio.nix +++ b/os/core/audio.nix @@ -24,24 +24,104 @@ in config = lib.mkMerge [ (lib.mkIf cfg.enable { + services.pulseaudio.enable = false; + security.rtkit.enable = true; + services = { pipewire = { enable = true; audio.enable = true; pulse.enable = true; - alsa.enable = true; - alsa.support32Bit = true; + alsa = { + enable = true; + support32Bit = true; + }; jack.enable = true; - wireplumber.enable = true; + wireplumber = { + enable = true; + extraConfig = { + "99-lock-microphone-gain" = { + "pulse.rules" = [ + { + matches = [ + { "application.name" = "~*cord*"; } + ]; + actions = { + quirks = [ "no-source-volume" ]; + }; + } + ]; + }; + "99-disable-suspend" = { + "monitor.alsa.rules" = [ + { + matches = [ + { "node.name" = "~alsa_input.*"; } + { "node.name" = "~alsa_output.*"; } + ]; + actions.update-props = { + "session.suspend-timeout-seconds" = 0; + }; + } + ]; + }; + "10-bluetooth-policy" = { + "wireplumber.profiles" = { + "main" = { + "policy.bluetooth" = "enabled"; + }; + }; + "monitor.bluez.properties" = { + "bluez5.roles" = [ + "a2dp_sink" + "a2dp_source" + "bap_sink" + "bap_source" + "hfp_hf" + "hsp_hs" + ]; + "bluez5.codecs" = [ + "sbc" + "sbc_xq" + "aac" + "ldac" + "aptx" + "aptx_hd" + ]; + }; + }; + }; + }; }; playerctld.enable = true; - spotifyd.enable = true; }; - security.rtkit.enable = true; + systemd.user.services.pipewire-quantum = { + description = "Set strict low-latency PipeWire quantum"; + after = [ "wireplumber.service" ]; + bindsTo = [ "pipewire.service" ]; + wantedBy = [ "wireplumber.service" ]; + serviceConfig = { + Type = "oneshot"; + ExecStart = [ + "${pkgs.pipewire}/bin/pw-metadata -n settings 0 clock.quantum 512" + "${pkgs.pipewire}/bin/pw-metadata -n settings 0 clock.min-quantum 512" + ]; + }; + }; + + programs.noisetorch.enable = true; + + systemd.user.services.pipewire-pulse = { + serviceConfig = { + Environment = [ "LADSPA_PATH=/tmp" ]; + }; + }; + environment.systemPackages = with pkgs; [ toggleMuteNotify pulsemixer + pavucontrol crosspipe alsa-utils ]; diff --git a/os/core/drivers.nix b/os/core/drivers.nix index d6b2cec..e6e2814 100644 --- a/os/core/drivers.nix +++ b/os/core/drivers.nix @@ -9,7 +9,6 @@ let cfg = config.os.core.drivers; in { - imports = [ inputs.nix-gaming-edge.nixosModules.default ]; options.os.core.drivers = { enable = lib.mkEnableOption "enables hardware drivers"; @@ -25,14 +24,6 @@ in graphics = { enable = lib.mkEnableOption "graphics support"; - version = lib.mkOption { - type = lib.types.enum [ - "stable" - "git" - ]; - default = "stable"; - description = "Which Mesa version to use. 'git' uses the mesa-git overlay."; - }; amdgpu.enable = lib.mkEnableOption "amd specific gpu features"; }; @@ -92,14 +83,6 @@ in ]; }; }) - (lib.mkIf (cfg.graphics.enable && cfg.graphics.version == "git") { - nixpkgs.overlays = [ inputs.nix-gaming-edge.overlays.mesa-git ]; - drivers.mesa-git = { - enable = true; - # cacheCleanup.enable = true; - # steamOrphanCleanup.enable = true; - }; - }) { boot.kernelPackages = let diff --git a/os/core/greet.nix b/os/core/greet.nix index 67457e3..1c01b68 100644 --- a/os/core/greet.nix +++ b/os/core/greet.nix @@ -15,15 +15,15 @@ in settings = { default_session = { user = "greeter"; - command = '' - ${pkgs.tuigreet}/bin/tuigreet \ - --sessions ${config.services.displayManager.sessionData.desktops}/share/xsessions:${config.services.displayManager.sessionData.desktops}/share/wayland-sessions \ - --remember \ - --remember-user-session \ - --asterisks \ - --greeting 'Welcome to NixOS!' \ - --time - ''; + command = lib.concatStringsSep " " [ + "${pkgs.tuigreet}/bin/tuigreet" + "--sessions ${config.services.displayManager.sessionData.desktops}/share/xsessions:${config.services.displayManager.sessionData.desktops}/share/wayland-sessions" + "--remember" + "--remember-user-session" + "--asterisks" + "--greeting 'Welcome to NixOS!'" + "--time" + ]; }; }; }; diff --git a/os/core/networking.nix b/os/core/networking.nix index 22fc206..d50d899 100644 --- a/os/core/networking.nix +++ b/os/core/networking.nix @@ -19,21 +19,72 @@ in default = "client"; description = "Which networking profile configuration to apply"; }; + + lan = lib.mkOption { + description = "Physical Home Local Area Network configuration parameters."; + type = lib.types.submodule { + options = { + ip = lib.mkOption { + type = lib.types.str; + default = "10.0.0.2"; + description = "The local static or leased IP assigned to this machine on the home network."; + }; + range = lib.mkOption { + type = lib.types.str; + default = "10.0.0.0/8"; + description = "The broader subnet block representing the physical home network."; + }; + }; + }; + }; + + wg = lib.mkOption { + description = "Standard WireGuard VPN tunnel configuration parameters."; + type = lib.types.submodule { + options = { + ip = lib.mkOption { + type = lib.types.str; + default = "10.3.0.1"; + description = "The explicit tunnel IP address assigned to this machine's WireGuard interface."; + }; + range = lib.mkOption { + type = lib.types.str; + default = "10.3.0.0/24"; + description = "The total addressable IP space assigned to the WireGuard network pool."; + }; + }; + }; + }; + + hs = lib.mkOption { + description = "Headscale mesh overlay network configuration parameters."; + type = lib.types.submodule { + options = { + ip = lib.mkOption { + type = lib.types.str; + default = "10.4.0.1"; + description = "The explicit mesh network IP address assigned to this machine via Headscale."; + }; + range = lib.mkOption { + type = lib.types.str; + default = "10.4.0.0/24"; + description = "The full mesh overlay allocation subnet block."; + }; + }; + }; + }; }; config = lib.mkIf cfg.enable ( lib.mkMerge [ { - networking.networkmanager = { - enable = true; - dns = "systemd-resolved"; - }; - services.resolved.enable = true; } (lib.mkIf (cfg.profile == "client") { networking.networkmanager = { + enable = true; + dns = "systemd-resolved"; wifi.macAddress = "random"; wifi.backend = "iwd"; ethernet.macAddress = "random"; @@ -47,9 +98,28 @@ in }) (lib.mkIf (cfg.profile == "server") { - networking.networkmanager = { - wifi.macAddress = "keep"; - ethernet.macAddress = "keep"; + networking = { + useNetworkd = true; + useDHCP = false; + }; + systemd.network = { + enable = true; + + netdevs."10-br-srv" = { + netdevConfig = { + Name = "br-srv"; + Kind = "bridge"; + }; + }; + networks."20-host-management" = { + matchConfig.Name = "br-srv"; + address = [ "10.0.0.2/24" ]; + gateway = [ "10.0.0.1" ]; + networkConfig.LinkLocalAddressing = "no"; + }; + }; + boot.kernel.sysctl = { + "net.ipv4.ip_nonlocal_bind" = 1; }; }) ] diff --git a/os/core/security.nix b/os/core/security.nix index f69ab1f..33aa919 100644 --- a/os/core/security.nix +++ b/os/core/security.nix @@ -30,13 +30,13 @@ in } ]; }; - sudo.enable = false; + # sudo.enable = false; pam.services = { swaylock = { }; login.enableGnomeKeyring = true; }; }; - environment.systemPackages = [ pkgs.doas-sudo-shim ]; + # environment.systemPackages = [ pkgs.doas-sudo-shim ]; } (lib.mkIf cfg.sandboxing.enable { security.apparmor = { diff --git a/os/core/users.nix b/os/core/users.nix index 1ba471f..494406b 100644 --- a/os/core/users.nix +++ b/os/core/users.nix @@ -21,7 +21,7 @@ in sops.secrets = { "users/root_password".neededForUsers = true; "users/main_password".neededForUsers = true; - "users/opc_password".neededForUsers = true; + # "users/opc_password".neededForUsers = true; }; users = { mutableUsers = false; diff --git a/os/default.nix b/os/default.nix index 43e7476..5c55a8f 100644 --- a/os/default.nix +++ b/os/default.nix @@ -4,5 +4,6 @@ ./core/default.nix ./srv/default.nix ./wm/default.nix + ./vms/microvms.nix ]; } diff --git a/os/srv/authelia.nix b/os/srv/authelia.nix index a7a8c19..52b7114 100644 --- a/os/srv/authelia.nix +++ b/os/srv/authelia.nix @@ -8,11 +8,13 @@ let cfg = config.os.srv.authelia; in { - options.os.srv.authelia.enable = lib.mkEnableOption "enables authelia scanning"; - options.os.services.authelia.extraRules = lib.mkOption { - type = lib.types.listOf lib.types.attrs; - default = [ ]; - description = "Additional access control rules to be appended to Authelia."; + options.os.srv.authelia = { + enable = lib.mkEnableOption "enables authelia scanning"; + extraRules = lib.mkOption { + type = lib.types.listOf lib.types.attrs; + default = [ ]; + description = "Additional access control rules to be appended to Authelia."; + }; }; config = lib.mkIf cfg.enable { assertions = [ @@ -20,6 +22,10 @@ in assertion = config.os.srv.sops.enable; message = "Required for password secure password storing"; } + { + assertion = config.os.srv.lldap.enable; + message = "required for user accounts"; + } ]; services.authelia.instances.main = { enable = true; @@ -46,7 +52,7 @@ in policy = "bypass"; } ] - ++ config.os.services.authelia.extraRules; + ++ cfg.extraRules; }; session.domain = masterDomain; }; diff --git a/os/srv/default.nix b/os/srv/default.nix index 715b0e0..5729e10 100644 --- a/os/srv/default.nix +++ b/os/srv/default.nix @@ -7,13 +7,16 @@ ./clamav.nix ./compat.nix ./crowdsec.nix + ./dns.nix ./fail2ban.nix ./files.nix ./firewall.nix ./gaming.nix + ./headscale.nix ./i2p.nix - ./kdeconnect.nix + ./kea.nix ./lldap.nix + ./mailserver.nix ./monero.nix ./nfs.nix ./nginx.nix @@ -21,7 +24,6 @@ ./ntopng.nix ./oci.nix ./omnisearch.nix - ./opnsense.nix ./simplex.nix ./sops.nix ./ssh.nix @@ -29,6 +31,7 @@ ./syncthing.nix ./tailscale.nix ./tor.nix + ./ups.nix ./virtualization.nix ./wireguard.nix ./yggdrasil.nix diff --git a/os/srv/dns.nix b/os/srv/dns.nix new file mode 100644 index 0000000..f0c50a6 --- /dev/null +++ b/os/srv/dns.nix @@ -0,0 +1,247 @@ +{ config, lib, ... }: +let + cfg = config.os.srv.dns; + unboundPort = 5335; +in +{ + options.os.srv.dns.enable = lib.mkEnableOption "enables dns scanning"; + config = lib.mkIf cfg.enable { + services.unbound = { + enable = true; + settings = { + server = { + interface = [ "127.0.0.1" ]; + port = unboundPort; + + do-ip4 = true; + do-ip6 = false; + do-udp = true; + do-tcp = true; + + num-threads = 4; + msg-cache-slabs = 4; + rrset-cache-slabs = 4; + infra-cache-slabs = 4; + key-cache-slabs = 4; + + msg-cache-size = "256m"; + rrset-cache-size = "512m"; + infra-cache-numhosts = 20000; + + so-rcvbuf = "8m"; + so-sndbuf = "8m"; + so-reuseport = true; + + qname-minimisation = true; + prefetch = true; + prefetch-key = true; + harden-glue = true; + harden-dnssec-stripped = true; + hide-identity = true; + hide-version = true; + use-caps-for-id = false; # might try this later + edns-buffer-size = 1232; + + access-control = [ + "127.0.0.0/8 allow" + "0.0.0.0/0 deny" + ]; + }; + }; + }; + + services.adguardhome = { + enable = true; + mutableSettings = true; + + settings = { + http.address = "0.0.0.0:3000"; + dns = { + bind_hosts = [ + "127.0.0.1" + config.os.core.network.lan.ip + config.os.core.network.wg.ip + config.os.core.network.hs.ip + ]; + port = 53; + upstream_dns = [ "127.0.0.1:${toString unboundPort}" ]; + bootstrap_dns = [ "9.9.9.9" ]; + cache_size = 536870912; + # anonymize_client_ip = true; + }; + + filtering = { + filtering_enabled = true; + interval = 24; + }; + filters = [ + { + enabled = true; + name = "Black Mirror Blocklist"; + url = "https://raw.githubusercontent.com/T145/black-mirror/refs/heads/master/dist/ADGUARD_SOURCES.txt"; + } + { + enabled = true; + name = "Scam Blocklist by DurableNapkin"; + url = "https://raw.githubusercontent.com/durablenapkin/scamblocklist/master/adguard.txt"; + } + { + enabled = true; + name = "Neo Dev Host Blocklist"; + url = "https://raw.githubusercontent.com/neodevpro/neodevhost/master/adblocker"; + } + { + enabled = true; + name = "hBlock Blocklist"; + url = "https://hblock.molinero.dev/hosts_adblock.txt"; + } + { + enabled = true; + name = "OISD Big Blocklist"; + url = "https://big.oisd.nl"; + } + { + enabled = true; + name = "StevenBlack Unified"; + url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts"; + } + { + enabled = true; + name = "StevenBlack Fakenews"; + url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews-only/hosts"; + } + { + enabled = true; + name = "StevenBlack Gambling"; + url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/gambling-only/hosts"; + } + + #----------------------------------------------------------------------------- + + # HaGeZi's Blocklists + + { + enabled = true; + name = "HaGeZi's Ultimate Blocklist"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/ultimate.txt"; + } + { + enabled = false; # Added but disabled Pro++ as a fallback if Ultimate proves to be too aggressive + name = "HaGeZi's Pro++ DNS Blocklist"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/pro.plus.txt"; + } + { + enabled = true; + name = "HaGeZi's Fake DNS Blocklist"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/fake.txt"; + } + { + enabled = true; + name = "HaGeZi's Threat Intelligence Feeds DNS Blocklist"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/tif.txt"; + } + { + enabled = true; + name = "HaGeZi's Dynamic DNS Blocklsit"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/dyndns.txt"; + } + { + enabled = true; + name = "HaGeZi's Badware Hoster Blocklist"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/hoster.txt"; + } + { + enabled = true; + name = "HaGeZi's URL Shortener Blocklist"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/urlshortener.txt"; + } + { + enabled = true; + name = "HaGeZi's DNS Rebind Protection"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adguard/dns-rebind-protection.txt"; + } + { + enabled = true; + name = "HaGeZi's Gambling DNS Blocklist"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/gambling.txt"; + } + + #----------------------------------------------------------------------------- + + # NEWLY REGISTERED DOMAINS / ENTROPY DGAs + + { + enabled = true; + name = "HaGeZi's Newly Registered Domains 7 days ago to yesterday"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd7.txt"; + } + { + enabled = true; + name = "HaGeZi's Newly Registered Domains 14 days ago to 8 days ago"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd14-8.txt"; + } + { + enabled = true; + name = "HaGeZi's Newly Registered Domains 21 days ago to 15 days ago"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd21-15.txt"; + } + { + enabled = true; + name = "HaGeZi's Newly Registered Domains 28 days ago to 12 days ago"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd28-22.txt"; + } + { + enabled = true; + name = "HaGeZi's Newly Registered Domains 35 days ago to 29 days ago"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd35-29.txt"; + } + { + enabled = true; + name = "HaGeZi's Newly Registered High Entropy Domains"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/dga30.txt"; + } + + #----------------------------------------------------------------------------- + + # DNS BYPASS BLOCKLISTS + + { + enabled = true; + name = "HaGeZi's DNS Bypass Blocklist"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/doh-vpn-proxy-bypass.txt"; + } + { + enabled = true; + name = "DNS HTTPS Blocklist"; + url = "https://raw.githubusercontent.com/Bryantdl7/pihole-blocklists/main/dns-https-block.txt"; + } + + #----------------------------------------------------------------------------- + + # NSFW DNS BLOCKLISTS + + { + enabled = true; + name = "HaGeZi's NSFW DNS Blocklist"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nsfw.txt"; + } + { + enabled = true; + name = "oisd NSFW"; + url = "https://nsfw.oisd.nl"; + } + { + enabled = true; + name = "StevenBlack NSFW Blocklist"; + url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/porn-only/hosts"; + } + ]; + }; + }; + + networking.firewall = { + allowedUDPPorts = [ 53 ]; + allowedTCPPorts = [ 53 ]; + }; + }; +} diff --git a/os/srv/files.nix b/os/srv/files.nix index d4b9363..777a394 100644 --- a/os/srv/files.nix +++ b/os/srv/files.nix @@ -35,9 +35,8 @@ in pcmanfm file-roller gdu - duc pxz - pigz + ripunzip ]; }) (lib.mkIf cfg.localsend.enable { diff --git a/os/srv/gaming.nix b/os/srv/gaming.nix index 28e309a..7e9099d 100644 --- a/os/srv/gaming.nix +++ b/os/srv/gaming.nix @@ -42,14 +42,19 @@ in general.renice = 10; }; }; + environment = { + # sets the optiscaler shortcut key to be home by default + sessionVariables = { + OPTISCALER_ShortcutKey = "0x24"; + }; - home-manager.users.${username}.hm.soft.mangohud.enable = true; - - environment.systemPackages = with pkgs; [ - theclicker - ludusavi - protonplus - ]; + systemPackages = with pkgs; [ + mangohud + theclicker + ludusavi + protonplus + ]; + }; }) # --- EXTERNAL LAUNCHERS --- diff --git a/os/srv/headscale.nix b/os/srv/headscale.nix new file mode 100644 index 0000000..a650067 --- /dev/null +++ b/os/srv/headscale.nix @@ -0,0 +1,42 @@ +{ + config, + lib, + masterDomain, + ... +}: +let + cfg = config.os.srv.headscale; +in +{ + options.os.srv.headscale.enable = lib.mkEnableOption "enables headscales"; + config = lib.mkIf cfg.enable { + services.headscale = { + enable = true; + address = "127.0.0.1"; + port = 8080; + + settings = { + server_url = "https://vpn.${masterDomain}"; + + dns = { + magic_dns = true; + base_domain = "vpn.internal"; + nameservers = [ "10.255.1.1" ]; + }; + + ip_prefixes = [ + "10.254.0.0/16" + ]; + }; + }; + + services.nginx.virtualHosts."vpn.${masterDomain}" = { + enableACME = true; + forceSSL = true; + locations."/" = { + proxyPass = "http://127.0.0.1:8080"; + proxyWebsockets = true; + }; + }; + }; +} diff --git a/os/srv/kdeconnect.nix b/os/srv/kdeconnect.nix deleted file mode 100644 index 0b54f98..0000000 --- a/os/srv/kdeconnect.nix +++ /dev/null @@ -1,18 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.srv.kdeconnect; -in -{ - options.os.srv.kdeconnect.enable = lib.mkEnableOption "enables kde connect"; - config = lib.mkIf cfg.enable { - programs.kdeconnect = { - enable = true; - package = pkgs.valent; - }; - }; -} diff --git a/os/srv/kea.nix b/os/srv/kea.nix new file mode 100644 index 0000000..168590e --- /dev/null +++ b/os/srv/kea.nix @@ -0,0 +1,58 @@ +{ config, lib, ... }: +let + cfg = config.os.srv.kea; +in +{ + options.os.srv.kea.enable = lib.mkEnableOption "enables kea dhcp server"; + config = lib.mkIf cfg.enable { + services.kea.dhcp4 = { + enable = true; + settings = { + interfaces-config = { + # To be used in a VM + interfaces = [ "eth0" ]; + dhcp-socket-type = "udp"; + }; + + lease-database = { + type = "memfile"; + persist = true; + name = "/var/lib/kea/dhcp4.leases"; + }; + + subnet4 = [ + { + id = 1; + subnet = "10.1.0.0/24"; + pools = [ { pool = "10.1.0.50 - 10.1.0.250"; } ]; + option-data = [ + { + name = "routers"; + data = "10.1.0.1"; + } + { + name = "domain-name-servers"; + data = "10.0.0.3"; + } + ]; + } + { + id = 2; + subnet = "10.2.0.0/24"; + pools = [ { pool = "10.2.0.50 - 10.2.0.250"; } ]; + option-data = [ + { + name = "routers"; + data = "10.2.0.1"; + } + { + name = "domain-name-servers"; + data = "10.0.0.3"; + } + ]; + } + ]; + }; + }; + }; +} diff --git a/os/srv/mailserver.nix b/os/srv/mailserver.nix new file mode 100644 index 0000000..7bcd008 --- /dev/null +++ b/os/srv/mailserver.nix @@ -0,0 +1,59 @@ +{ + config, + lib, + inputs, + masterDomain, + ... +}: +let + cfg = config.os.srv.mailserver; +in +{ + options.os.srv.mailserver.enable = lib.mkEnableOption "enables mailserver scanning"; + imports = [ inputs.nixos-mailserver.nixosModules.mailserver ]; + config = lib.mkIf cfg.enable { + assertions = [ + { + assertion = config.os.srv.sops.enable; + message = "Required for password secure password storing"; + } + { + assertion = config.os.srv.lldap.enable; + message = "required for user accounts"; + } + ]; + mailserver = { + enable = true; + fqdn = "mail.${masterDomain}"; + domains = [ masterDomain ]; + + # TODO setup ldap + ldap = { + enable = true; + uris = [ "ldap://127.0.0.1:3890" ]; + base = "ou=people,dc=yourdomain,dc=com"; + + bind = { + dn = "uid=mail-service,ou=people,dc=yourdomain,dc=com"; + passwordFile = "/var/src/secrets/ldap-mail-password"; + }; + + attributes = { + username = "uid"; + mail = "mail"; + password = "userPassword"; + uuid = "entryUUID"; + }; + + dovecot = { + userFilter = "(|(mail=%{user})(uid=%{user}))"; + passFilter = "(uid=%{user})"; + }; + + postfix = { + filter = "(mail=%s)"; + }; + }; + }; + }; +} diff --git a/os/srv/monero.nix b/os/srv/monero.nix index 9088ef3..4e74432 100644 --- a/os/srv/monero.nix +++ b/os/srv/monero.nix @@ -3,6 +3,7 @@ lib, pkgs, masterDomain, + securityTemplates, ... }: let @@ -57,20 +58,15 @@ in services.nginx.virtualHosts."xmr.${masterDomain}" = { enableACME = true; forceSSL = true; - listen = [ - { - addr = "10.255.0.1"; - port = 443; - } - ]; locations."/" = { proxyPass = "http://127.0.0.1:18081"; extraConfig = '' proxy_read_timeout 600s; proxy_send_timeout 600s; - client_max_body_size 50m; + + ${securityTemplates.restrictToInternal} ''; }; }; diff --git a/os/srv/nginx.nix b/os/srv/nginx.nix index f0207b3..6159e25 100644 --- a/os/srv/nginx.nix +++ b/os/srv/nginx.nix @@ -19,39 +19,54 @@ in }; }; - config = lib.mkIf cfg.enable { - services.nginx = { - enable = true; - package = pkgs.nginx.override { openssl = pkgs.libressl; }; + config = lib.mkMerge [ + { + _module.args.securityTemplates.restrictToInternal = '' + allow 127.0.0.1; + allow ::1; - recommendedProxySettings = true; - recommendedTlsSettings = true; - recommendedOptimisation = true; - recommendedGzipSettings = true; - virtualHosts = { - default = { - serverName = "_"; - default = true; - rejectSSL = true; - locations."/".return = "444"; + allow ${config.os.core.network.lan.range}; + allow ${config.os.core.network.wg.range}; + allow ${config.os.core.network.hs.range}; + + deny all; + ''; + } + + (lib.mkIf cfg.enable { + services.nginx = { + enable = true; + package = pkgs.nginx.override { openssl = pkgs.libressl; }; + + recommendedProxySettings = true; + recommendedTlsSettings = true; + recommendedOptimisation = true; + recommendedGzipSettings = true; + virtualHosts = { + default = { + serverName = "_"; + default = true; + rejectSSL = true; + locations."/".return = "444"; + }; }; }; - }; - security.acme = { - acceptTerms = true; - defaults.email = "adikro@disroot.org"; - }; + security.acme = { + acceptTerms = true; + defaults.email = "adikro@disroot.org"; + }; - # users.users.nginx.extraGroups = [ "acme" ]; + users.users.nginx.extraGroups = [ "acme" ]; - networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ - 80 - 443 - ]; + networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ + 80 + 443 + ]; - systemd.tmpfiles.rules = [ - "d /var/log/nginx 0750 nginx adm -" - ]; - }; + systemd.tmpfiles.rules = [ + "d /var/log/nginx 0750 nginx adm -" + ]; + }) + ]; } diff --git a/os/srv/omnisearch.nix b/os/srv/omnisearch.nix index 756711f..ac36184 100644 --- a/os/srv/omnisearch.nix +++ b/os/srv/omnisearch.nix @@ -2,16 +2,72 @@ config, lib, inputs, + masterDomain, + templates, ... }: let cfg = config.os.srv.omnisearch; in { - options.os.srv.omnisearch.enable = lib.mkEnableOption "enables omnisearch"; imports = [ inputs.omnisearch.nixosModules.default ]; - config = lib.mkIf cfg.enable { - services.omnisearch.enable = true; + options.os.srv.omnisearch = { + enable = lib.mkEnableOption "enables omnisearch tracking infrastructure"; + + role = lib.mkOption { + type = lib.types.enum [ + "server" + "standalone" + ]; + default = "standalone"; + description = "Designates the deployment method"; + }; }; + + config = lib.mkIf cfg.enable ( + lib.mkMerge [ + { + services.omnisearch = { + enable = true; + settings = { + server = { + host = "127.0.0.1"; + port = 8087; + locale = "en"; + domain = if cfg.role == "server" then "https://search.${masterDomain}" else "http://localhost:8087"; + }; + proxy = { + max_retries = 3; + randomize_username = true; + randomize_password = true; + }; + cache = { + dir = "/var/cache/omnisearch"; + ttl_search = 1800; + ttl_infobox = 86400; + }; + }; + }; + } + + (lib.mkIf (cfg.role == "server") { + assertions = [ + { + assertion = config.os.srv.nginx.enable; + message = "Required for proxying"; + } + ]; + services.nginx.virtualHosts."search.${masterDomain}" = { + enableACME = true; + forceSSL = true; + locations."/" = { + proxyPass = "http://127.0.0.1:8087"; + proxyWebsockets = true; + extraConfig = templates.restrictToInternal; + }; + }; + }) + ] + ); } diff --git a/os/srv/sops.nix b/os/srv/sops.nix index 1b27042..3ca2d16 100644 --- a/os/srv/sops.nix +++ b/os/srv/sops.nix @@ -15,20 +15,15 @@ in options.os.srv.sops.enable = lib.mkEnableOption "enables sops-nix"; config = lib.mkIf cfg.enable { sops = { - defaultSopsFile = ../../secrets.yaml; + defaultSopsFile = ../../secrets/common.yaml; defaultSopsFormat = "yaml"; age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; secrets = { - "syncthing/gui_password".owner = username; + # "syncthing/gui_password".owner = username; "syncthing/encryption/keepass".owner = username; "syncthing/encryption/sync".owner = username; "obs/websocket_password".owner = username; - "yggdrasil-private-key" = { - owner = "root"; - group = "wheel"; - mode = "0440"; - }; }; }; diff --git a/os/srv/ssh.nix b/os/srv/ssh.nix index ec39bbd..d36df00 100644 --- a/os/srv/ssh.nix +++ b/os/srv/ssh.nix @@ -13,7 +13,7 @@ in server = { enable = lib.mkEnableOption "enables the ssh server module"; enableInitrd = lib.mkEnableOption "enables ssh access during initrd"; - enableWireguard = lib.mkEnableOption "only allows connections from wireguard"; + microvm.enable = lib.mkEnableOption "enables ssh for microvms"; }; client = { enable = lib.mkEnableOption "enables the ssh client module"; @@ -27,6 +27,24 @@ in services.openssh = { enable = true; + listenAddresses = [ + { + addr = "127.0.0.1"; + port = 22; + } + { + addr = config.os.core.network.lan.ip; + port = 22; + } + { + addr = config.os.core.network.wg.ip; + port = 22; + } + { + addr = config.os.core.network.hs.ip; + port = 22; + } + ]; hostKeys = [ { path = "/etc/ssh/ssh_host_ed25519_key"; @@ -36,17 +54,27 @@ in settings = { PasswordAuthentication = false; KbdInteractiveAuthentication = false; - PermitRootLogin = "no"; + PermitRootLogin = if cfg.server.microvm.enable then "prohibit-password" else "no"; PubkeyAcceptedAlgorithms = "ssh-ed25519"; }; }; - users.users.${username}.openssh.authorizedKeys.keys = [ + users.users = ( + lib.optionalAttrs (username != "" && username != null) { + ${username}.openssh.authorizedKeys.keys = [ + "${keys.main} adikro@disroot.org" + ]; + } + ); + }) + + (lib.mkIf (cfg.server.enable && cfg.server.microvm.enable) { + users.users.root.openssh.authorizedKeys.keys = [ "${keys.main} adikro@disroot.org" ]; - }) + (lib.mkIf (cfg.server.enable && cfg.server.enableInitrd) { assertions = [ { @@ -75,13 +103,6 @@ in kernelParams = [ "ip=dhcp" ]; }; }) - (lib.mkIf (cfg.server.enable && cfg.server.enableWireguard) { - services.openssh.listenAddresses = [ - { - addr = "10.255.0.1"; - } - ]; - }) (lib.mkIf cfg.client.enable { programs.ssh.startAgent = true; @@ -89,6 +110,7 @@ in }) (lib.mkIf (cfg.client.enable && cfg.client.createAliases) { + # TODO use hjem programs.ssh.extraConfig = '' Host github.com codeberg.org IdentityFile /home/${username}/.ssh/main_id_ed25519.pub @@ -98,14 +120,6 @@ in Host oci HostName 130.162.223.123 User opc - - Host bibus - HostName bibus.top - User opc - - Host bibus-local - HostName 10.255.0.1 - user opc ''; systemd.tmpfiles.rules = [ "d /home/${username}/.ssh 0700 ${username} users - -" diff --git a/os/srv/syncthing.nix b/os/srv/syncthing.nix index bcbf665..0c5e53e 100644 --- a/os/srv/syncthing.nix +++ b/os/srv/syncthing.nix @@ -124,7 +124,7 @@ in user = username; dataDir = "/home/${username}/.local/share/syncthing"; configDir = "/home/${username}/.config/syncthing"; - guiPasswordFile = config.sops.secrets."syncthing/gui_password".path; + # guiPasswordFile = config.sops.secrets."syncthing/gui_password".path; settings = { devices."oci".id = "DQXGVDC-KGPM6RK-5NDEBJJ-R7PEWYZ-N6Z3WFZ-TSVJG5X-235SHG4-4BEJNQJ"; diff --git a/os/srv/ups.nix b/os/srv/ups.nix index 8a36007..260f346 100644 --- a/os/srv/ups.nix +++ b/os/srv/ups.nix @@ -26,10 +26,10 @@ in passwordFile = "sops"; type = "master"; }; - settings = { - MINSUPPLIES = 1; - POWERDOWNFLAG = "/run/killpower"; - }; + # settings = { + # MINSUPPLIES = 1; + # POWERDOWNFLAG = "/run/killpower"; + # }; }; }; } diff --git a/os/srv/wireguard.nix b/os/srv/wireguard.nix index 15675a4..363ac9f 100644 --- a/os/srv/wireguard.nix +++ b/os/srv/wireguard.nix @@ -27,6 +27,11 @@ in default = "eth0"; description = "The public WAN interface of the server"; }; + publicKey = lib.mkOption { + type = lib.types.nullOr lib.types.str; + default = null; + description = "The public key of your primary WireGuard server node."; + }; peers = lib.mkOption { type = lib.types.listOf ( @@ -93,17 +98,16 @@ in iifname "wg0" accept oifname "wg0" accept } - chain postrouting { type nat hook postrouting priority 100; policy accept; - iifname "wg0" oifname "${cfg.server.externalInterface}" masquerade + oifname "${cfg.server.externalInterface}" masquerade } ''; }; }; networking.wireguard.interfaces.wg0 = { - ips = [ "10.255.1.1/16" ]; + ips = [ "10.255.1.1/24" ]; listenPort = 51280; privateKeyFile = config.sops.secrets."wg_private_key/${hostname}".path; @@ -129,13 +133,12 @@ in ]; networking.wireguard.interfaces.wg0 = { - ips = [ "10.255.0.${toString cfg.client.index}/16" ]; + ips = [ "10.255.0.${toString cfg.client.index}/24" ]; privateKeyFile = config.sops.secrets."wg_private_key/${hostname}".path; peers = [ { - # TODO get the server public key - publicKey = ""; + publicKey = cfg.server.publicKey; endpoint = "${masterDomain}:51280"; persistentKeepalive = 25; diff --git a/os/srv/yggdrasil.nix b/os/srv/yggdrasil.nix index 1a18380..6fe91af 100644 --- a/os/srv/yggdrasil.nix +++ b/os/srv/yggdrasil.nix @@ -16,7 +16,7 @@ in openMulticastPort = true; settings = { - PrivateKeyPath = config.sops.secrets."yggdrasil-private-key".path; + # PrivateKeyPath = config.sops.secrets."yggdrasil-private-key".path; IfName = "ygg0"; NodeInfoPrivacy = true; Peers = [ diff --git a/os/vms/default.nix b/os/vms/default.nix deleted file mode 100644 index e69de29..0000000 --- a/os/vms/default.nix +++ /dev/null diff --git a/os/vms/microvms.nix b/os/vms/microvms.nix new file mode 100644 index 0000000..0a24c60 --- /dev/null +++ b/os/vms/microvms.nix @@ -0,0 +1,40 @@ +{ + config, + lib, + inputs, + ... +}: +let + cfg = config.os.vms; + sharedSecrets = [ + { + tag = "shared-secrets"; + proto = "virtiofs"; + source = "/etc/nixos/secrets"; + mountPoint = "/etc/nixos/secrets"; + } + ]; +in +{ + imports = [ inputs.microvm.nixosModules.host ]; + + options.os.vms = { + net-core.enable = lib.mkEnableOption "enables the net-core virtual machine"; + }; + + config = lib.mkMerge [ + (lib.mkIf cfg.enable { + }) + + (lib.mkIf cfg.net-core.enable { + microvm.vms.net-core = { + autostart = true; + config = { + imports = [ ../vms/net-core.nix ]; + microvm.shares = sharedSecrets; + }; + }; + }) + + ]; +} diff --git a/os/vms/net-core.nix b/os/vms/net-core.nix new file mode 100644 index 0000000..392aaf5 --- /dev/null +++ b/os/vms/net-core.nix @@ -0,0 +1,34 @@ +{ + pkgs, + inputs, + ... +}: +{ + system.stateVersion = "26.11"; + + imports = [ + inputs.microvm.nixosModules.microvm + ../core/default.nix + ]; + + os = { + core = { + allowUnfree.enable = true; + locale.enable = true; + }; + srv = { + ssh = { + server = { + enable = true; + microvm = true; + }; + }; + firewall.enable = true; + sops.enable = true; + }; + }; + + networking.hostName = "net-core"; + + environment.systemPackages = [ pkgs.vis ]; +} diff --git a/os/srv/opnsense.nix b/os/vms/opnsense.nix index 7855e46..b9f2978 100644 --- a/os/srv/opnsense.nix +++ b/os/vms/opnsense.nix @@ -11,49 +11,41 @@ let builtins.concatLists ( map (id: [ "-device" - "vfio-pci,host=${id}" + "vfio-pci,host=${id},rombar=0" ]) ids ); in { imports = [ inputs.microvm.nixosModules.host ]; + options.os.srv.opnsense = { enable = lib.mkEnableOption "enables an opnsense microvm"; + pciIDs = lib.mkOption { type = lib.types.listOf lib.types.str; default = [ ]; example = [ - "01:00.0" - "01:00.1" - "01:00.2" - "01:00.3" + "03:00.0" + "03:00.1" ]; - description = "List of PCI bus addresses to pass through to the VM."; + description = "List of PCI bus addresses to pass through directly to OPNsense."; }; + vendorIDs = lib.mkOption { type = lib.types.listOf lib.types.str; default = [ ]; - example = [ "8086:1521" ]; - description = "List of Vendor:Device IDs to bind to the vfio-pci driver."; + example = [ "8086:1563" ]; + description = "List of Vendor:Device IDs to bind explicitly to the vfio-pci driver."; }; + imagePath = lib.mkOption { type = lib.types.path; default = /var/lib/microvm/images/opnsense.qcow2; - description = "Path to the OPNsense qcow2 image"; + description = "Path to the OPNsense qcow2 drive image block."; }; }; - config = lib.mkIf cfg.enable { - networking = { - bridges."br-lan".interfaces = [ ]; - # TODO configure this - interfaces."br-lan".ipv4.addresses = [ - { - address = "10.0.0.2"; - prefixLenght = 16; - } - ]; - }; + config = lib.mkIf cfg.enable { boot = { kernelParams = [ "intel_iommu=on" @@ -65,9 +57,10 @@ in "vfio_iommu_type1" ]; extraModprobeConfig = '' - options vfio-pci ids=${lib.concatStringsSep "," cfg.vendorIDs} + options vfio-pci ids=${lib.concatStringsSep "," (lib.unique cfg.vendorIDs)} ''; }; + microvm.vms.opnsense = { autostart = true; config = { @@ -76,15 +69,15 @@ in networking.hostName = "opnsense"; microvm = { - vcpu = 2; + vcpu = 4; mem = 4096; hypervisor = "qemu"; interfaces = [ { type = "bridge"; - id = "vm-lan"; - bridge = "br-lan"; + id = "vtnet0"; + bridge = "br-srv"; } ]; @@ -92,7 +85,7 @@ in "-machine" "q35,accel=kvm,kernel-irqchip=on" "-cpu" - "host" + "host,migratable=off,+invtsc" ] ++ (makePciArgs cfg.pciIDs); }; diff --git a/.sops.yaml b/secrets/.sops.yaml index 7b3f869..85295f3 100644 --- a/.sops.yaml +++ b/secrets/.sops.yaml @@ -3,12 +3,26 @@ keys: - &host_szpont age1s39d4mdrjhkf8cy8eea02p836r7s875fj8f7w3z4ld2stmaac49qd075ww - &host_thinkpad age12htxy05mlkaqx7q6m5wufkqnnvhmhe4nfsr5ljlwkdk0u59f7ujq7537fw - &host_pendrive age1sx8ut0arwlrp7n7qvlaele8mq93pyvzc0ddetlk47cnyx935gcusdceq9q + - &host_bibus-lab creation_rules: - - path_regex: ^secrets\.yaml$ + - path_regex: ^common\.yaml$ key_groups: - age: - *admin_age - *host_szpont - *host_thinkpad - *host_pendrive + + - path_regex: ^server\.yaml$ + key_groups: + - pgp: [] + age: + - *admin_age + - *host_bibus-lab + + - path_regex: ^microvms/net-core\.yaml$ + key_groups: + - pgp: [] + age: + - *admin_age diff --git a/secrets.yaml b/secrets/common.yaml index c1f9da9..1e8ade4 100644 --- a/secrets.yaml +++ b/secrets/common.yaml @@ -1,19 +1,12 @@ users: main_password: ENC[AES256_GCM,data:0WYWpS1n2eqdCqMwLqy8TBcGuyY1yWlZLS1+LTCSWEzMAFa9HXWY9pOoxdYLVG6Tn5E+jQzcLaNX9t9y0GYzf2NX+6QYN0AMLQ==,iv:spOeU0Yna2bzPp8VDnd2mukUg6P98VyyjATECeyeJi4=,tag:JEbQzW79B6XJXfCdEsgJ2w==,type:str] root_password: ENC[AES256_GCM,data:xG2NjC5EbrO1nUeo7WfoqOHX+XBJeVV/OaqwBKkmAq7zrPUU5H4ZfVBJMHPDcPZ+okck1BrMV+XH0XTynE6JhP9JKJlrHT5xZg==,iv:kYktNS69/H8dtQ/YB5Q5iNObus9lRjAgYhShqnZrk+w=,tag:nGriexQvFUEPu2NOpRYZCA==,type:str] - opc_password: ENC[AES256_GCM,data:Wbaj9XYRl8PwlA2jLLWUjk3hTLOd3ztNQR9hY0qenTEdzR76JzcY1j8xxScp1n9fLq8JSoZXxmqrxYYm6tTxRrdiMn28fMTGWg==,iv:1igAzbUeS0/nD+Rw8LHHMP8m/pcnHOwe02i3RsnoRlE=,tag:BlO2QSvvjfhf/9fxT63eTA==,type:str] obs: websocket_password: ENC[AES256_GCM,data:JkKC2b6Hs2orWJ3MN9hk6W2V2vH2A/FCdxuI13fwwOrcA1E8HaMH,iv:IvMrKDxWMxkCBAHEy9mLDd3JS1Pie3XuESXr7gp6D/E=,tag:6yfqG7Dv2ElPFCMKZX2dvg==,type:str] -wg_private_key: - warp_private_key: null syncthing: - gui_password: ENC[AES256_GCM,data:kdF3/NRv8ftgIM3MhE9N4HZzsvBYGvYYzfCiUgmHPHfhfffdkCQvjDw4QCIgxRaemAEkT2/I6tR882zOft2xlY0+C25J/lulPYhsdyjaRHPXI54cX1H9939OcEWFOaTtCkKHxC+2EkTRbbPDnJRknmOdRTc80V9QxwBsID7yu65H,iv:Ur2TPQRQGiYXzbid3kJUivrDPbzBHknzx0EQZ8Mzy5I=,tag:dchOE5ehZQrWcIjZAujpQQ==,type:str] encryption: keepass: ENC[AES256_GCM,data:OLU0tYB9TTKZ5V1Mzj5FDE9YdCpj0ajJaoxzqd7HtTmaBqETjs7CjYriq7kCOgSEVBtwzek/NA1vetwuMQhI8Q==,iv:P9aBZCIbj23aOvuMBtAjAZ2L+0lUT5Xjk7XRikbc9u0=,tag:xnWUxctkKVTUOV0AtpnTug==,type:str] sync: ENC[AES256_GCM,data:XaD+8knm2VLHGFE5AOc9V4GSJ4opGNcz7ujCH2rfMVTtQ270QzohMsQoKMjSM18a44AxZ/vtnZjLtTo+ZOWYcA==,iv:wchjwjuICqY6CQyQQmxS++9H5YECCVjURUlB2ebFSO8=,tag:v8CxGv7ZnV3WsTz5wEZFMQ==,type:str] -monero: - rpc_password: ENC[AES256_GCM,data:E8MHTkXuceVSr6DpzHkMM3sXmoOE6NUWe3FanvW+zkUXYnI7KmGCEi2DZDmwiLnkmtkXI2jMzOoKY9axcrwSgFv9lcuGIs85tiPVHWNJtd4QlaJIhn5iAdhq+Xuk4wSTVP1Jw91trvNR4TsyYeF1+IkTWfJLBWeaS3U1Aqukfe9pcK9hKJHis8bzzOKBcRjkN81XLBT+bI+54LG6syFSQlf+nzOnySFukd48HR/ljWRnquzzXdfLqFEy95wSDKv5Gz0ZaT4e5d5DlpEBwfh/3yrugtaN1v2Vs4t2xFjWdxT/pTnJL429OL5U8Xd5WPdwFPnCr5+mGtOg1gbWsfCUNME=,iv:11KbCd1n7eOakN0ERNGyyPOBK8birzRqONqKMNXbOfQ=,tag:ZCfM74YrfNBlbICJyA4umA==,type:str] -yggdrasil-private-key: ENC[AES256_GCM,data:lyyOlWDvYa33Koc8DmhcRwgMI8KOsqmD9oc1gORb/RZiAXiKsmlXRFuiu3ba8CA1uAahJpK897ambZiFVi8qlgMrK7irfmqVyoF3r9luQJGyjrp9dvypSkRuQKLnp2Aj3FoIyXBM+mFwZpbAyGxTCTvylXhoqZo=,iv:2b4OwPNQt1WeF36oolSDIFwu3ux+f39/9+7brfgxqbg=,tag:rH8A5TYv+aG2sDKjJkZokw==,type:str] initrd_ssh_key: ENC[AES256_GCM,data:HJ9MedAZ7VrGzGk7Pv9jYtpTZjQQiUxauq+fivpX3RFBEwe9AdLHA0IA0L2wkKwa8LrmlSgHHSmnu9L4SthXW0zFQCDT83MnViu9vv4Mk1992y730C2rlquzLvO4jl0/+egZ8GH4NcKKzwJcUCaHdGU5K+ZOb5ruL7UHTF1d+KFe/1KPOfzuoOOchIGCUZAQAJfbSE/uNRappQQruEwryI7+5HgBr0i2cFCR3miIt+Vnsv+xNspGulTKYjW+QE82rz4GCbRJOBXA3hptlwh5U4qrjP4okCZCZaV87iZzYUiuMFLWrguJ9RRQWC+SGCuGY8eTOwWyiOKlQd9or3uo3ZBT3tLEfotFruau2W6R+T1MWjeZWgNehiJPoP0qKjTfUYGvGCq6WUjaAlf7X1WHrMLMAuz4LxWSL07bOfdTiIrLRIByhT9inneGMYhZre+gCDLjhrUT6n+CBb5aHxxwRyrYqQT7Yu1nVjEzcbHutvVaGd7CHDyixlzJsvoIHnm0yRJEWbSWpLHyBHx0zRfo,iv:E59H7MnvioKuFmvIE59cniPB3cRfAUYsLs0L5CiIses=,tag:wcRbTC9PZmZ5vK63IYb0Gg==,type:str] sops: age: @@ -84,7 +77,7 @@ sops: IgxU1S4n2rkbDNtL+Dojo8AGQjpyZ+L1GzxWyFpS7XiYKgBL6oOy/A== -----END AGE ENCRYPTED FILE----- recipient: age1sx8ut0arwlrp7n7qvlaele8mq93pyvzc0ddetlk47cnyx935gcusdceq9q - lastmodified: "2026-05-31T21:30:01Z" - mac: ENC[AES256_GCM,data:vUS7RwZh83bdhlPHUAtXO/UBRZUgeICZin4R51feDBZIvPATyrB0JfKcjltGojW6g6kMtRhhR0z9HBsMfiul1MLJGRtFFycDsRuek0F/b0/a9EIPL73cmdgMPpCLZ43JEENTW3M324avlCvoaHoo6bkDEKyuHGo7hgVT6V4R9Ic=,iv:c0Ul3fyepOw0026u7AbRkXmzOiqXlQky6krcidDjMeY=,tag:HcFyJyU/VmB/frlnShwaJw==,type:str] + lastmodified: "2026-06-11T22:19:15Z" + mac: ENC[AES256_GCM,data:qoYjcD2ggOKnEwIrgy6sNqPsYxKLMiC/HItvT23+fvq6Pbwk+e7Mwefom9TC31YZJyheL1MmnxZRNHsHWYP28i12SWiLaNKmNz5ISOqvkThCtFurteNPnuBYK72Sp4AnVulcGEPQl2p39cXobGZx2ZUnnNoOM13og1nP7tBuvu0=,iv:lapS0RUr9T1C7kClQBwHFl1h2NrB/d0Mc4MFN+un3eA=,tag:tvyHicRdhKixel2Jq0b2HA==,type:str] unencrypted_suffix: _unencrypted version: 3.13.1 diff --git a/secrets/server.yaml b/secrets/server.yaml new file mode 100644 index 0000000..85e3408 --- /dev/null +++ b/secrets/server.yaml @@ -0,0 +1,54 @@ +users: + root_password: ENC[AES256_GCM,data:EEPDEwHfX0ibvTT6kqeVf5loiwr32AByq70o+dZ6hLlKAq4imqQjoPPscKA/+/F1eQtQC0otH0MwwcTkIYxP3qMznRgV/1PKyw==,iv:IuMUK21dVlgLWca+UmERVzAvXbvWKMNtzy7BouOSfSc=,tag:8E3N5CzzwZL6oWpt734skg==,type:str] + opc_password: ENC[AES256_GCM,data:86q1+GCR6Affj58WfVYkIxj4WTio3r3lcGmTpl+i8jMrbnJj2EorKqiL83PMKW178Z3JmkCL3NG+CGQun8B+IqaH1091y/z/Sg==,iv:5zXUyq3k6gm5J4o5GOL+QXt/GCpu/a0JMoaQTyDYz7c=,tag:XM1rXeuNP8W+skfxkZJ3RA==,type:str] +syncthing: + gui_password: ENC[AES256_GCM,data:K0+/oMVTGSXum9jQ81LGfi20YqpkpvCMlbWUxLmSZPVwJtDnkd4ug+uTMnHPgSNwfbTauIk8icqFdtwrULwOUWQaxckwVrdqftUmAwQlzklPkB19iUHTEgcbCRiF6tPRU+P/tre4pTjzC3m8hD9UJNbS21NL0oJ3JsRRKv+sAr5J,iv:AIi+4mNPrTXziTtjFao2q8VMzo7duebMNRY+ACGJO7Q=,tag:zQJH2Bhcz6Lwununu6Fdtg==,type:str] +monero: + rpc_password: ENC[AES256_GCM,data:YN1Rm7BhjSZBK3Btsgf9Agq3LKDxBOotei0WJcjsQrgGK7z9fPY48zBphiINeqYgL6mFK7jebWp+c6nedtpcS9AbyDRP73rdSsJJ3X375O4HGLjArdvW49IfPPiBLUboIfIDIFYWK7sYnwpXVFUDXHAZJLSo96bQuaCV57tTOLJ6UdaY6epJou6Rez/CuE79t3EFa7yLW2LZ5jInTtK14b/AzjTF4fuGF45hHxVjWZVjkFQs7CSooUV9G6sKQwl8NFmuUfpplodp+zTUOvyBqFPfOpedhL+QJYU47PYZJx8lenhEKd1EYDKliIYb73bM7nY2YwuANtjkmXZ0e+F0Cpc=,iv:tWhj1r4DZldlnlGQdX+Mep9aVaAQvnAkQMJqLFAvbsc=,tag:g8tvZFSeFBgu+RRFB3RT1w==,type:str] +initrd_ssh_key: ENC[AES256_GCM,data:2N+0OOjm07hq9wFoqAWwhzwttlSTKaNpybtNSgyAYwIa5u/3Cjwy1kYo7Fo+aY/1AEY2q5E3BlE7D1na9qTcaJ6Q5YPHsYv89vcIBOCB0nIJlN6KlO6Hne0izDE6nSi9ppusIX7i2xos5/fE8NKdJVYJ8SWH5sny34NkcJZVIN+pd0sBtRP0cd8ZjfV6hezizKoOmh5jOxBNSGtkSTkJDsEbfxYjwl2JHjC6K8pJN1x4xe6J/5t4WKorNF8JZzQLTk82cOgoO3o0h2hCefkT/hFNOKW6b4FT4TyM7oJVrn5LOcjqsUQm0YYyGQ2kAcKDfRsQ8wgwokcjniux8SCqZsoDrq3IR7yNmPfzUkx4RJ7yFHBcVIJOLCrRAwK5hGTMoytirwUfLvs7eHO85gto5xUoa8O2FF90WQ9+GMdBdwNOWsJoOXKDtVUeLdNLp5K5/bhB41nfF/jlFseyLfSNTmDuhIG663eKn37RXC+ZPwKBej7BsWCz/DT9o+LU0Kntzm/oCvN23Vfbzedggirt,iv:KBFxJOBOF9aQZliXQhpz5oAYP5F3Had+sLras/BO6S0=,tag:T+YzDJwQm5ge/3KLSRVNQQ==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IG1sa2VtNzY4eDI1NTE5IDdUNlZNQXNz + aE1TanFOVWxCS2dWeGRsdElTaHBEMGx5d1V4ZmgvVXBneUhiU0FmdmpqMHlPbk81 + b2FvRmNZY3loRlhJRDZheFRYdEJoZXpCajQweHZIZlZIc1ZLMXFXVjhyWTBmb2Qz + cnNTWitoclJzazVYRlJlOUZkbmlxZU9KcG9iSWdBekVLRXBVR3NPa3A0eHZJUGIx + b1Y0clRPZ0lic0NvZVR5a0I1bVlFcUg2TEN5RC9BRVloeDNGamJmNXBmcVNlaUJ5 + YVdqblAxcXROSDhhMWlvbmZXOW42TFZYUlhoNDhqSURXZ0Z3Q2JUNlJZdDRxZmR1 + SjJwUktrUzViZUp0KzFYMVNlcWd6UWdha0RsU1ZxdVVUeXZFR2xGMW5GY0V3UEcr + SHlqcElWMThDcWhtc2RPSVlyRVNqNTl4ZmlJYmNVWlVmankxQUpHVXdrTHVUVkh4 + T3I0QldLck1FTHA2dmliWmdUbWNTbi9yckJBdlZHY3dtMEo2QytEcUZuTk40Tnk3 + RjRCSXZoNWM4RUdjVE1mSWx4RXBOc3pTZGlIUHBsOUtMVm50c2RtaTFlNU40YTl5 + b1YxWHlmNktlTkpBYzVGU3BQdnlZQWxRUVJMVUpPNy9RL2RPKzc3ZEJ4RVZRRzgx + dlBWcVd0aVh5aC9vYjhreVJ0SnRZQ0U4Uk4zQWFHMlRSbVNwRmV2V0xCOUlXRnY3 + RVpWT2dIMm9OK3lPdFRrWjVaRGdkM2RJWXI2bHBhYXJoL2JlaWVCSlllWk1uZnRC + MThUa3NqT1pUUWdtendCc0RUNUdudXQ5d1JNOG9EU0RLczJkZElKWXpIeDZ2RUVM + dExoU0ZmZFUzUWpJQmdwVXpCQWkwRk1kTWJTczBBVmtSdkcvOHhDUmpTYXl6aWxN + UzlicU1FZFh3MW5ZMzV3djBaYTBLblA2cmlOdlRKNU01VDJPMU1uRCsySVhwSGR3 + WTczekJmQ0tJTC9vblVFWDF4elJob2Q2T1NIdkRoOG1OaW1vSHRja3VYTjVMdGJK + WmoxZGhlTnU1UlNSZFlQR2JITGFkWHN5RXNPV3dqaXFYMXFwTENtSW1GU1VSY0NZ + R2RCU2dKazU2NEJJaUlNUzBuTHI4M3F2dk4ycGFucW9kSmwvTnBVMEtkT0g3WnNG + RThtY1ZFOGdPakZZdUVTNWY0WWVlS2twR245dmFMVFdBUHNkOWRWY1NZRFZzckJz + blZ4RjhMZXVUa3FENTk3Q3QvSGIzS0ZOZ1gxUDBVSzU4YkpVd2tvK0RoQVNLRi9t + VVpURHRweHE4SElnY1QxNjdnY0YzOS9DbldvMjlVRUtqVFM4YVVCK2VJTmZDb2xL + bG9rMkZhTTQrdkwvQm9KRzMwWTgzYThhWVZ4bTR4M3l6QVdMMjJjUExSbi9Tc0ZL + b001WU1RaUh5bHlpSUJqRm1iQ1lEejg1MjBoTEN2V1c0NHBSbUlCWDhWN09qbldS + WEVmSG5NMi9QVXZDa0ZORlVaTE1vaTZCaFYySWkwOHpHWXIzakwzdXNOWjRnRy9o + cEtVZVorV0hWQ0xpcmRydEprRUZxVzJlbDVuOHpGSndzUUI0Ynppd2YwNXBmaC95 + NFF3TW1MTzMyaENZbnhZcXA5dGpVL3hKVzZiYWhnTXdLYW5aVkRFSUV4SWxEYjJ4 + bXQvVFREZE9rYmgxNlFwZjBoeE5ZL3lVNTBVZmM3YnhjbCtzeWEwdUM4Um9aZVc0 + cnhSQUtKOUtlSERsRURkckcvOU11bktRc1FaNHhCS1lVanlDOHhhVWFUYW9kaFox + c1pvSHZZR21INUJJclJWR2VDdVNyQTF1UVA5OUcxMVpJSjZRZzNBM2FkVU5acW5a + b0hRRVBYQmNReTJmMzZLNkJlZFNKQURLU2lHdTVVTWRRamFpbXdJS3ZEREdoR3Za + Y2poVTRUb1prTk0zelZpNFEyQmFMeHRyQklUcGVVTWhPcXYxMkp3NGRqMUNlQQpn + clNpSmQwQ2xHcXc4N01acUZLU05BTysyYVI4OTN0MWZZK1VJMmNtMWcwCi0tLSB2 + VmlGWVBIbmVQL0NjWXRYbjJIbEp0TzRWL2FVNG1RT3pEZm9uaEZPVnM0CmjDyouV + 0kCrs1bgZCu9IUJscXs/YbtUCkdtGmV9TuKvOYvXisvnf/oUwFq26znbD7XZXgn1 + CbbGwecDG5/u+t0= + -----END AGE ENCRYPTED FILE----- + recipient: age1pq1uq3cqs3h5wmr3yqvu2hjlsu5hsyg0md44efmwxjpkfreafvkg0d53mupsghxqjjd25p3h73ekpuuszhx8ef5npu5552yp7ahjqkye76xj7zf5aznzn8wp4xypcrqjuy8k9pt3xcsy27g85dnlczvpcded4lzk3q6kwefn6txnakxpdxj9hxa83xpumqldkp2ufmkrgpzd627hdfr9d95kep3nynp0f5xdzghp0h7wx0cugc85h2gwcznjjn9gy2j4rp2lqauq5rej9kxp4gxxayp032pd7tnpwn5qmfmqfqewj4u835ha6a9x8p5pg6qc2f6vg02ajr3dkznj75c3q9pf65a92w5ke87vepg7hnjprdfpcm5wxy6f34nj3aqpafpuj33qscc8gfzcv2lx2d53hy53nzgexhnppg0zqphj0ye0l4rvgqvpvrgvvtewv7qszcw4wqeuqkuefwmk7ad50p7m2jaeyg6e7my5kayq0g9nw02rf93tusqpdzgv7lm8g9fca9yy92rldefxqtxnp0u24966ukgzszg2rzszxwjwcd5wqls2m8lqq53jkd4kn64fsyj0ppzswryv2pkgvmhygx4zcfh5zcp5fgggsafqkvnars3seht3f3mc3ms8xzap6mqld4kn49ypfu8kqyvuz53ucpultcvegl5tfnue3mjmygz306jvzry99fprj72q6ulmlp9z07gazafsu0zx0kewyc73a26urg874yrz3znx7xssewpued7h9qevxf3zt8jr2q9xd7af93egep87hjnh0q68gt45lqvg9qvz0scxxu4fx4nvxacsuqsx234tkeqtttfs6tkxrrked76j0pu4acga2ptkzafjtjkgsuyt3vdrwzs05rvjhztwsymkkpanlpjdpeekt8ffpfhdwwj6zfdw3fwz65fc6fehygws636yfeem5e88kz98xvtefffw2v7lzsv29sjfacsz4a5w9aw2ee0ys98ddej5qyq8p3ne3spny8qvwszfd987xgx30u64927cflmsktjs7nemmzg3wtfvxwg9vhrcmxyw2upznrewt8gfkw4zjadcgjeea79a9dkvlch3la724camwch2u3aaw26k57xrnm0v5effjstxnqzgl9fd9k92v6uj9kky7ltvf65zup5hgwn3865ypa73sfaugqrfygzwkkjt4p6j5tafsgchjyespwg9dfx5rkhqq8e8xgd6d2u2msn39zqzp46juyezkeupdd09rzfzj9xee0szszuvdz7l6ddkfn6jjczq5j638fh5cxywj5dq7tenp3q8rlyv9xujggnajyl08e4hycn5tw7gq37mwl3hjrsm6ppaqg9gd359r3zf9vnxg5whqfecq6tenk293qdj54myqd6znse8ng2vrnz2tw7vvgnywgxa35r22t436xnxxq8f39kssdfpytsqnsyyzm6j0pqzuurn9jw9w2qxg5vga9aq4l8q6fnf2zu2pezmpup9at9cxzp24f7enz3gr2nta9x4sz5r9dqvxpcv2fpk8ser3d5wnhq4367w7q4ywmmax346ghudlmjwgec9x27nggge2rpqwumkqufx24lt3guk9xqvvjv3q38ckxvzc27gzuef3xpjxpzfc48vqsuewd6x6lg9464tj28gyjr55fvg07zn3m2hfyggwuy8wq4cy6fn07pwy4xpkv46vk97xe5skuuzmn389kuteuc4v7y3986j3hcfnypxa8f5snan6yrlt2rp95549765zg9jxezge9r9lk9dqlcf2vlpjhf3cn87xs5srw9f3g208f4p9p4wsmfdnfwfln4qfxkx4m82nm7f7n5ur5yd3yd53zrssqmxjuvqucfk8hwetka0g9p7ldxm7a623axn7zps3xe8g8kx5eputp7f9atwv0a7nmq + lastmodified: "2026-06-11T22:19:34Z" + mac: ENC[AES256_GCM,data:VrMecvL3kiRUyOH9I3hC7OI521F8IfmrG9ehbU8bY/rD7E640DgZlSdvebkveB4MlLr9Ml9EIquWfyKbYBfrGmOuMKdVydG2SUcP9gziN2WB5ZbCNB6/ZZEcgl3dRSzrCZ3S9Zz6U+KedZAEDBnQEgLy9xoMergqjRXY2b/FYWY=,iv:R/1YX+X1oXdIJOASKTDi96htspfkSI/bdYrpjSYrDzc=,tag:Y7mw9Yd+2cB1SB9w9vojlg==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.1 |