diff options
Diffstat (limited to 'os')
68 files changed, 0 insertions, 4549 deletions
diff --git a/os/core/audio.nix b/os/core/audio.nix deleted file mode 100644 index a7fb5db..0000000 --- a/os/core/audio.nix +++ /dev/null @@ -1,146 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.core.audio; - toggleMuteNotify = pkgs.writeShellScriptBin "toggle-mute-notify" '' - IS_MUTED=$(${pkgs.wireplumber}/bin/wpctl get-volume @DEFAULT_AUDIO_SOURCE@ | grep -c "MUTED") - - if [ "$IS_MUTED" -eq 1 ]; then - ${pkgs.libnotify}/bin/notify-send -a "MuteIndicator" -t 0 -u critical "Microphone Muted" "Mic is currently OFF" - else - ${pkgs.mako}/bin/makoctl dismiss -a "MuteIndicator" - fi - ''; -in -{ - options.os.core.audio = { - enable = lib.mkEnableOption "audio support"; - disable-devices.enable = lib.mkEnableOption "disables some random devices cluttering up"; - }; - - config = lib.mkMerge [ - (lib.mkIf cfg.enable { - services.pulseaudio.enable = false; - security.rtkit.enable = true; - - services = { - pipewire = { - enable = true; - audio.enable = true; - pulse.enable = true; - alsa = { - enable = true; - support32Bit = true; - }; - jack.enable = true; - wireplumber = { - enable = true; - extraConfig = { - "99-lock-microphone-gain" = { - "pulse.rules" = [ - { - matches = [ - { "application.name" = "~*cord*"; } - ]; - actions = { - quirks = [ "no-source-volume" ]; - }; - } - ]; - }; - "99-disable-suspend" = { - "monitor.alsa.rules" = [ - { - matches = [ - { "node.name" = "~alsa_input.*"; } - { "node.name" = "~alsa_output.*"; } - ]; - actions.update-props = { - "session.suspend-timeout-seconds" = 0; - }; - } - ]; - }; - "10-bluetooth-policy" = { - "wireplumber.profiles" = { - "main" = { - "policy.bluetooth" = "enabled"; - }; - }; - "monitor.bluez.properties" = { - "bluez5.roles" = [ - "a2dp_sink" - "a2dp_source" - "bap_sink" - "bap_source" - "hfp_hf" - "hsp_hs" - ]; - "bluez5.codecs" = [ - "sbc" - "sbc_xq" - "aac" - "ldac" - "aptx" - "aptx_hd" - ]; - }; - }; - }; - }; - }; - playerctld.enable = true; - }; - - systemd.user.services.pipewire-quantum = { - description = "Set strict low-latency PipeWire quantum"; - after = [ "wireplumber.service" ]; - bindsTo = [ "pipewire.service" ]; - wantedBy = [ "wireplumber.service" ]; - serviceConfig = { - Type = "oneshot"; - ExecStart = [ - "${pkgs.pipewire}/bin/pw-metadata -n settings 0 clock.quantum 512" - "${pkgs.pipewire}/bin/pw-metadata -n settings 0 clock.min-quantum 512" - ]; - }; - }; - - programs.noisetorch.enable = true; - - systemd.user.services.pipewire-pulse = { - serviceConfig = { - Environment = [ "LADSPA_PATH=/tmp" ]; - }; - }; - - environment.systemPackages = with pkgs; [ - toggleMuteNotify - pulsemixer - pavucontrol - crosspipe - alsa-utils - ]; - }) - - (lib.mkIf cfg.disable-devices.enable { - services.pipewire.wireplumber.extraConfig = { - "99-disable-useless-devices"."monitor.alsa.rules" = [ - { - matches = [ - { "device.name" = "~alsa_card.pci-0000_03_00.1*"; } - { "device.description" = "~USB Audio*"; } - ]; - actions.update-props = { - "device.disabled" = true; - }; - } - ]; - }; - }) - ]; -} diff --git a/os/core/bootloader.nix b/os/core/bootloader.nix deleted file mode 100644 index e8dfc11..0000000 --- a/os/core/bootloader.nix +++ /dev/null @@ -1,100 +0,0 @@ -{ - config, - lib, - ... -}: -let - cfg = config.os.core.bootloader; -in -{ - options.os.core.bootloader = { - type = lib.mkOption { - type = lib.types.enum [ - "systemd-boot" - "grub" - "none" - ]; - default = "systemd-boot"; - description = "Which bootloader to use"; - }; - - efi = lib.mkOption { - type = lib.types.bool; - default = if cfg.grub.device == "nodev" then true else false; - description = "Whether the system uses UEFI or Legacy BIOS"; - }; - - timeout = lib.mkOption { - type = lib.types.int; - default = 3; - description = "Boot menu timeout in seconds"; - }; - - grub = { - device = lib.mkOption { - type = lib.types.str; - default = "nodev"; - description = "Device to install GRUB to (e.g. /dev/nvme0n1). Use 'nodev' for UEFI."; - }; - useOSProber = lib.mkOption { - type = lib.types.bool; - default = false; - description = "Scan for other operating systems"; - }; - defaultEntry = lib.mkOption { - type = lib.types.int; - default = 0; - description = "Index of the default boot entry"; - }; - }; - - #TODO add boot.initrd.luks.reusePassphrases = true; somewhere - luks.enable = lib.mkEnableOption "LUKS encryption support"; - }; - - config = lib.mkMerge [ - # 1. Common Kernel & Initrd Settings - { - boot = { - loader = { - timeout = cfg.timeout; - efi.canTouchEfiVariables = lib.mkDefault cfg.efi; - }; - supportedFilesystems = [ - "ntfs" - "btrfs" - ]; - kernelParams = [ - "quiet" - "splash" - ]; - consoleLogLevel = 0; - initrd.availableKernelModules = [ - "aesni_intel" - "cryptd" - ]; - }; - systemd.settings.Manager.DefaultTimeoutStopSec = "5s"; - } - - # 2. Systemd-boot Implementation - (lib.mkIf (cfg.type == "systemd-boot") { - boot.loader.systemd-boot = { - enable = true; - editor = false; - consoleMode = "max"; - }; - }) - - # 3. GRUB Implementation - (lib.mkIf (cfg.type == "grub") { - boot.loader.grub = { - enable = true; - efiSupport = cfg.efi; - useOSProber = cfg.grub.useOSProber; - default = cfg.grub.defaultEntry; - enableCryptodisk = cfg.luks.enable; - }; - }) - ]; -} diff --git a/os/core/default.nix b/os/core/default.nix deleted file mode 100644 index 963436b..0000000 --- a/os/core/default.nix +++ /dev/null @@ -1,36 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.core; -in -{ - imports = [ - ./audio.nix - ./bootloader.nix - ./drivers.nix - ./fonts.nix - ./greet.nix - ./home-manager.nix - ./localization.nix - ./memory.nix - ./networking.nix - ./power.nix - ./security.nix - ./storage.nix - ./users.nix - ./zfs.nix - ]; - - options.os.core = { - allowUnfree.enable = lib.mkEnableOption "unfree software"; - flatpak.enable = lib.mkEnableOption "Flatpak support"; - }; - - config = lib.mkMerge [ - (lib.mkIf cfg.allowUnfree.enable { - nixpkgs.config.allowUnfree = true; - }) - (lib.mkIf cfg.flatpak.enable { - services.flatpak.enable = true; - }) - ]; -} diff --git a/os/core/drivers.nix b/os/core/drivers.nix deleted file mode 100644 index 6e74e98..0000000 --- a/os/core/drivers.nix +++ /dev/null @@ -1,99 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.core.drivers; -in -{ - options.os.core.drivers = { - enable = lib.mkEnableOption "enables hardware drivers"; - - cpu = lib.mkOption { - type = lib.types.enum [ - "intel" - "amd" - "none" - ]; - default = "none"; - description = "cpu manufacturer for microcode and platform-specific drivers"; - }; - - graphics = { - enable = lib.mkEnableOption "graphics support"; - amdgpu.enable = lib.mkEnableOption "amd specific gpu features"; - }; - - kernel = lib.mkOption { - type = lib.types.enum [ - "stable" - "zen" - "zfs" - "hardened" - ]; - default = "stable"; - }; - }; - - config = lib.mkIf cfg.enable ( - lib.mkMerge [ - { - hardware.enableAllFirmware = true; - services = { - smartd.enable = true; - fwupd.enable = true; - }; - environment.systemPackages = [ pkgs.rivalcfg ]; - } - - (lib.mkIf (cfg.cpu == "amd") { - hardware.cpu.amd.updateMicrocode = true; - programs.coolercontrol.enable = true; - }) - - (lib.mkIf (cfg.cpu == "intel") { - hardware.cpu.intel.updateMicrocode = true; - services.thermald.enable = true; - }) - - (lib.mkIf cfg.graphics.enable { - hardware.graphics = { - enable = true; - enable32Bit = true; - }; - hardware.sensor.iio.enable = true; - }) - - (lib.mkIf (cfg.graphics.enable && cfg.graphics.amdgpu.enable) { - services = { - lact.enable = true; - hardware.openrgb.enable = true; - }; - hardware = { - amdgpu = { - initrd.enable = true; - overdrive.enable = true; - }; - graphics.extraPackages = with pkgs; [ - rocmPackages.clr.icd - libva-utils - ]; - }; - }) - { - boot.kernelPackages = - let - kernels = { - "stable" = pkgs.linuxPackages_latest; - "zen" = pkgs.linuxPackages_zen; - "hardened" = pkgs.linuxPackages_hardened; - "zfs" = config.boot.zfs.package.latestCompatibleLinuxPackages; - }; - in - kernels.${cfg.kernel} or kernels."stable"; - } - ] - ); -} diff --git a/os/core/fonts.nix b/os/core/fonts.nix deleted file mode 100644 index ee61591..0000000 --- a/os/core/fonts.nix +++ /dev/null @@ -1,32 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.core.fonts; -in -{ - options.os.core.fonts.enable = lib.mkEnableOption "system-wide font and console configuration"; - - config = lib.mkIf cfg.enable { - console = { - keyMap = "pl"; - earlySetup = true; - font = "ter-v32n"; - packages = with pkgs; [ terminus_font ]; - }; - - fonts.packages = with pkgs; [ - terminus_font - nerd-fonts.jetbrains-mono - nerd-fonts.fira-mono - nerd-fonts.fira-code - noto-fonts - noto-fonts-cjk-sans - noto-fonts-cjk-serif - noto-fonts-color-emoji - ]; - }; -} diff --git a/os/core/greet.nix b/os/core/greet.nix deleted file mode 100644 index 1c01b68..0000000 --- a/os/core/greet.nix +++ /dev/null @@ -1,32 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.core.greet; -in -{ - options.os.core.greet.enable = lib.mkEnableOption "enables greetd daemon with tuigreet"; - config = lib.mkIf cfg.enable { - services.greetd = { - enable = true; - settings = { - default_session = { - user = "greeter"; - command = lib.concatStringsSep " " [ - "${pkgs.tuigreet}/bin/tuigreet" - "--sessions ${config.services.displayManager.sessionData.desktops}/share/xsessions:${config.services.displayManager.sessionData.desktops}/share/wayland-sessions" - "--remember" - "--remember-user-session" - "--asterisks" - "--greeting 'Welcome to NixOS!'" - "--time" - ]; - }; - }; - }; - security.pam.services.greetd.enableGnomeKeyring = true; - }; -} diff --git a/os/core/home-manager.nix b/os/core/home-manager.nix deleted file mode 100644 index 63f3dfd..0000000 --- a/os/core/home-manager.nix +++ /dev/null @@ -1,44 +0,0 @@ -{ - inputs, - config, - lib, - username, - ... -}: -let - cfg = config.os.core.home-manager; -in -{ - imports = [ inputs.home-manager.nixosModules.home-manager ]; - - options.os.core.home-manager = { - enable = lib.mkEnableOption "home Manager configuration"; - - users = lib.mkOption { - default = { }; - description = "Attribute set of users and their home-manager configurations"; - type = lib.types.attrsOf ( - lib.types.submodule { - options = { - path = lib.mkOption { - type = lib.types.path; - description = "Path to the user's home.nix file"; - }; - }; - } - ); - }; - }; - config = lib.mkIf cfg.enable { - home-manager = { - extraSpecialArgs = { inherit inputs username; }; - useGlobalPkgs = true; - useUserPackages = true; - backupFileExtension = "bak"; - - users = lib.mapAttrs (name: userCfg: { - imports = [ userCfg.path ]; - }) cfg.users; - }; - }; -} diff --git a/os/core/localization.nix b/os/core/localization.nix deleted file mode 100644 index 49933fa..0000000 --- a/os/core/localization.nix +++ /dev/null @@ -1,41 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.core.locale; -in -{ - options.os.core.locale = { - enable = lib.mkEnableOption "system localization (timezone and language)"; - - timeZone = lib.mkOption { - type = lib.types.str; - default = "Europe/Warsaw"; - description = "the system timezone."; - }; - - format = lib.mkOption { - type = lib.types.str; - default = "pl_PL.UTF-8"; - description = "the locale used for numbers, time, and measurements."; - }; - }; - config = lib.mkIf cfg.enable { - time.timeZone = cfg.timeZone; - - i18n = { - defaultLocale = "en_US.UTF-8"; - - extraLocaleSettings = { - LC_TIME = cfg.format; - LC_NUMERIC = cfg.format; - LC_MONETARY = cfg.format; - LC_PAPER = cfg.format; - LC_MEASUREMENT = cfg.format; - LC_COLLATE = cfg.format; - LC_NAME = cfg.format; - LC_ADDRESS = cfg.format; - LC_TELEPHONE = cfg.format; - LC_IDENTIFICATION = cfg.format; - }; - }; - }; -} diff --git a/os/core/memory.nix b/os/core/memory.nix deleted file mode 100644 index b20ec8a..0000000 --- a/os/core/memory.nix +++ /dev/null @@ -1,41 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.core.memory; -in -{ - options.os.core.memory = { - zram = { - enable = lib.mkEnableOption "enables zram compression"; - percent = lib.mkOption { - type = lib.types.int; - default = 25; - }; - }; - - swapfile = { - enable = lib.mkEnableOption "enables a swapfile"; - size = lib.mkOption { - type = lib.types.int; - default = 8; - }; - }; - }; - config = lib.mkMerge [ - (lib.mkIf cfg.zram.enable { - zramSwap = { - enable = true; - algorithm = "zstd"; - memoryPercent = cfg.zram.percent; - priority = 100; - }; - }) - - (lib.mkIf cfg.swapfile.enable { - swapDevices = [ { - device = "/.swapvol/swapfile"; - size = cfg.swapfile.size * 1024; - priority = 0; - } ]; - }) - ]; -} diff --git a/os/core/networking.nix b/os/core/networking.nix deleted file mode 100644 index 9e4c329..0000000 --- a/os/core/networking.nix +++ /dev/null @@ -1,186 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.core.network; -in -{ - options.os.core.network = { - enable = lib.mkEnableOption "system-wide networking setup"; - enableFirewall = lib.mkEnableOption "integrated zero-trust nftables firewall layers"; - - isVM = lib.mkOption { - type = lib.types.bool; - default = false; - description = "Set to true if this configuration is running inside a guest VM. Set to false for the bare-metal host."; - }; - - ips = lib.mkOption { - type = lib.types.attrsOf lib.types.str; - default = { - bare-metal = "10.0.0.2"; - opnsense-vm = "10.0.0.1"; - gateway-vm = "10.0.0.3"; - auth-vm = "10.0.0.4"; - database-vm = "10.0.0.5"; - monitor-vm = "10.0.0.6"; - media-vm = "10.0.0.7"; - torrent-vm = "10.0.0.8"; - storage-vm = "10.0.0.9"; - web-vm = "10.0.0.10"; - comm-vm = "10.0.0.11"; - mail-vm = "10.0.0.12"; - relay-vm = "10.0.0.13"; - gameserver-vm = "10.0.0.14"; - }; - description = "Central registry of static IP allocations for the cluster."; - }; - - profile = lib.mkOption { - type = lib.types.enum [ - "client" - "server" - ]; - default = "client"; - description = "Which networking profile configuration to apply"; - }; - - lan = lib.mkOption { - description = "Physical Home Local Area Network configuration parameters."; - type = lib.types.submodule { - options = { - ip = lib.mkOption { - type = lib.types.str; - default = "10.0.0.2"; - description = "The local static or leased IP assigned to this machine on the home network."; - }; - range = lib.mkOption { - type = lib.types.str; - default = "10.0.0.0/24"; - description = "The broader subnet block representing the physical home network."; - }; - }; - }; - }; - - wg = lib.mkOption { - description = "Standard WireGuard VPN tunnel configuration parameters."; - type = lib.types.submodule { - options = { - ip = lib.mkOption { - type = lib.types.str; - default = "10.3.0.1"; - description = "The explicit tunnel IP address assigned to this machine's WireGuard interface."; - }; - range = lib.mkOption { - type = lib.types.str; - default = "10.3.0.0/24"; - description = "The total addressable IP space assigned to the WireGuard network pool."; - }; - }; - }; - }; - - hs = lib.mkOption { - description = "Headscale mesh overlay network configuration parameters."; - type = lib.types.submodule { - options = { - ip = lib.mkOption { - type = lib.types.str; - default = "10.4.0.1"; - description = "The explicit mesh network IP address assigned to this machine via Headscale."; - }; - range = lib.mkOption { - type = lib.types.str; - default = "10.4.0.0/24"; - description = "The full mesh overlay allocation subnet block."; - }; - }; - }; - }; - }; - - config = lib.mkIf cfg.enable ( - lib.mkMerge [ - { - services.resolved.enable = true; - } - - (lib.mkIf (cfg.profile == "client") { - networking.networkmanager = { - enable = true; - dns = "systemd-resolved"; - wifi.macAddress = "random"; - wifi.backend = "iwd"; - ethernet.macAddress = "random"; - }; - - systemd.services."NetworkManager-wait-online".enable = false; - - environment.systemPackages = [ - pkgs.impala - ]; - }) - - (lib.mkIf (cfg.profile == "client" && cfg.enableFirewall) { - networking = { - firewall.enable = true; - nftables.enable = true; - }; - }) - - (lib.mkIf (cfg.profile == "server") { - networking = { - useNetworkd = true; - useDHCP = false; - }; - systemd.network = { - enable = true; - wait-online.enable = lib.mkIf (!cfg.isVM) false; - - netdevs = lib.mkIf (!cfg.isVM) { - "10-br-srv" = { - netdevConfig = { - Name = "br-srv"; - Kind = "bridge"; - }; - }; - }; - networks."20-host-management" = { - matchConfig.Name = if cfg.isVM then "eth0" else "br-srv"; - address = [ "${cfg.lan.ip}/24" ]; - gateway = [ cfg.ips.router ]; - networkConfig.LinkLocalAddressing = "no"; - }; - }; - boot.kernel.sysctl = { - "net.ipv4.ip_nonlocal_bind" = 1; - "net.ipv4.ip_forward" = 1; - }; - }) - (lib.mkIf - ( - cfg.profile == "server" - && cfg.enableFirewall - && cfg.isVM - && config.networking.hostName != "vm2-gateway" - ) - { - networking.nftables.enable = true; - networking.firewall = { - enable = true; - extraCommands = '' - nft add table ip nat 2>/dev/null || true - nft flush table ip nat - nft add chain ip nat PREROUTING { type nat hook prerouting priority dstnat \; } - nft add rule ip nat PREROUTING ip saddr ${cfg.ips.vm2-gateway} ip daddr ${cfg.lan.ip} redirect - ''; - }; - } - ) - ] - ); -} diff --git a/os/core/persistance.nix b/os/core/persistance.nix deleted file mode 100644 index 89f3702..0000000 --- a/os/core/persistance.nix +++ /dev/null @@ -1,50 +0,0 @@ -{ - config, - lib, - inputs, - ... -}: -let - cfg = config.os.srv.persistance; -in -{ - imports = [ inputs.impermanence.nixosModules.impermanence ]; - - options.os.srv.persistance.enable = lib.mkEnableOption "enables persistance drive maintnance"; - config = lib.mkMerge [ - (lib.mkIf cfg.enable { - environment.persistence."/persist" = { - hideMounts = true; - directories = [ - "/var/lib/nixos" - "/var/lib/systemd" - "/var/lib/microvm" - ]; - files = [ - "/etc/machine-id" - ]; - }; - }) - (lib.mkIf (cfg.enable && config.os.srv.ssh.server.enable) { - environment.persistence."/persist" = { - files = [ - "/etc/ssh/ssh_host_ed25519_key" - "/etc/ssh/ssh_host_ed25519_key.pub" - ]; - }; - }) - (lib.mkIf (cfg.enable && config.os.srv.crowdsec.agent.enable) { - environment.persistence."/persist" = lib.mkIf cfg.agent.enable { - hideMounts = true; - directories = [ - { - directory = "/var/lib/crowdsec"; - user = "crowdsec"; - group = "crowdsec"; - mode = "0750"; - } - ]; - }; - }) - ]; -} diff --git a/os/core/power.nix b/os/core/power.nix deleted file mode 100644 index b3dbf91..0000000 --- a/os/core/power.nix +++ /dev/null @@ -1,54 +0,0 @@ -{ - config, - lib, - ... -}: -let - cfg = config.os.core.power; -in -{ - options.os.core.power = { - enable = lib.mkEnableOption "enables power management"; - mode = lib.mkOption { - type = lib.types.enum [ - "amd" - "intel" - "none" - ]; - default = "none"; - }; - }; - - config = lib.mkIf cfg.enable ( - lib.mkMerge [ - { - powerManagement.powertop.enable = true; - boot.kernelParams = [ "nvme_core.default_ps_max_latency_us=0" ]; - } - - (lib.mkIf (cfg.mode == "amd") { - services.power-profiles-daemon.enable = true; - boot.kernelParams = [ "amd_pstate=active" ]; - }) - - (lib.mkIf (cfg.mode == "intel") { - services = { - power-profiles-daemon.enable = false; - - thermald.enable = true; - tlp = { - enable = true; - settings = { - START_CHARGE_THRESH_BAT0 = 75; - STOP_CHARGE_THRESH_BAT0 = 80; - START_CHARGE_THRESH_BAT1 = 75; - STOP_CHARGE_THRESH_BAT1 = 80; - CPU_SCALING_GOVERNOR_ON_AC = "performance"; - CPU_SCALING_GOVERNOR_ON_BAT = "powersave"; - }; - }; - }; - }) - ] - ); -} diff --git a/os/core/security.nix b/os/core/security.nix deleted file mode 100644 index 33aa919..0000000 --- a/os/core/security.nix +++ /dev/null @@ -1,72 +0,0 @@ -{ - config, - lib, - pkgs, - username, - ... -}: -let - cfg = config.os.core.security; -in -{ - options.os.core.security = { - enable = lib.mkEnableOption "core security services"; - antivirus.enable = lib.mkEnableOption "enables clamav antivirus"; - sandboxing.enable = lib.mkEnableOption "enables sandboxing stuff"; - }; - config = lib.mkIf cfg.enable ( - lib.mkMerge [ - { - security = { - polkit.enable = true; - rtkit.enable = true; - doas = { - enable = true; - extraRules = [ - { - users = [ username ]; - keepEnv = true; - persist = true; - } - ]; - }; - # sudo.enable = false; - pam.services = { - swaylock = { }; - login.enableGnomeKeyring = true; - }; - }; - # environment.systemPackages = [ pkgs.doas-sudo-shim ]; - } - (lib.mkIf cfg.sandboxing.enable { - security.apparmor = { - enable = true; - enableCache = true; - killUnconfinedConfinables = true; - packages = with pkgs; [ - apparmor-profiles - roddhjav-apparmor-rules - ]; - }; - services.dbus.apparmor = "enabled"; - specialisation.no-apparmor.configuration.security.apparmor.enable = lib.mkForce false; - - programs.firejail.enable = true; - environment.systemPackages = with pkgs; [ - apparmor-utils - apparmor-parser - apparmor-bin-utils - ]; - }) - { - services.gnome.gnome-keyring.enable = true; - - environment.systemPackages = with pkgs; [ - veracrypt - gocryptfs - keepassxc - ]; - } - ] - ); -} diff --git a/os/core/storage.nix b/os/core/storage.nix deleted file mode 100644 index 8527bac..0000000 --- a/os/core/storage.nix +++ /dev/null @@ -1,21 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.core.storage; -in -{ - options.os.core.storage = { - enable = lib.mkEnableOption "enables storage management"; - }; - config = lib.mkIf cfg.enable { - nix.settings.auto-optimise-store = true; - services.fstrim.enable = true; - services.btrfs.autoScrub = { - enable = true; - fileSystems = [ "/" ]; - }; - boot.tmp = { - useTmpfs = true; - tmpfsSize = "50%"; - }; - }; -} diff --git a/os/core/users.nix b/os/core/users.nix deleted file mode 100644 index ff45a99..0000000 --- a/os/core/users.nix +++ /dev/null @@ -1,54 +0,0 @@ -{ - config, - lib, - pkgs, - username, - ... -}: -let - cfg = config.os.core.users; -in -{ - options.os.core.users.enable = lib.mkEnableOption "enables user accounts"; - config = lib.mkIf cfg.enable { - programs.fish.enable = true; - assertions = [ - { - assertion = config.os.srv.sops.enable; - message = "required for storing the ssh key"; - } - ]; - sops.secrets = { - "users/root_password".neededForUsers = true; - "users/main_password".neededForUsers = true; - # "users/opc_password".neededForUsers = true; - }; - users = { - mutableUsers = false; - - users = { - "${username}" = { - isNormalUser = true; - hashedPasswordFile = config.sops.secrets."users/main_password".path; - shell = pkgs.fish; - extraGroups = lib.mkMerge [ - [ - "wheel" - "input" - "uinput" - ] - - (lib.mkIf (config.os.core.drivers.graphics.enable or false) [ - "video" - "render" - ]) - (lib.mkIf (config.os.core.network.enable or false) [ "networkmanager" ]) - (lib.mkIf (config.os.srv.virtualization.kvm.enable or false) [ "libvirtd" ]) - (lib.mkIf (config.os.srv.docker.enable or false) [ "docker" ]) - ]; - }; - root.hashedPasswordFile = config.sops.secrets."users/root_password".path; - }; - }; - }; -} diff --git a/os/core/zfs.nix b/os/core/zfs.nix deleted file mode 100644 index 771644d..0000000 --- a/os/core/zfs.nix +++ /dev/null @@ -1,60 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.srv.zfs; -in -{ - options.os.srv.zfs.enable = lib.mkEnableOption "enables zfs drive maintnance"; - config = lib.mkIf cfg.enable { - assertions = [ - { - assertion = config.os.core.drivers.kernel == "zfs"; - message = "ZFS requires the zfs supported kernel"; - } - { - assertion = config.os.srv.sops.enable; - message = "required for storing the ntfy token"; - } - ]; - - sops.secrets."ntfy/zed".neededForUsers = false; - - boot = { - kernelParams = [ "zfs.zfs_arc_max=${toString (32 * 1024 * 1024 * 1024)}" ]; - zfs = { - # requestEncryptionCredentials = [ "zroot" ]; - # useKeyringForCredentials = true; - extraPools = [ "tank" ]; - }; - supportedFilesystems = [ "zfs" ]; - initrd.supportedFilesystems = [ "zfs" ]; - }; - services.zfs = { - expandOnBoot = "all"; - autoScrub.enable = true; - trim.enable = true; - autoSnapshot = { - enable = true; - flags = "-k -p --utc"; - }; - zed = { - settings = { - ZED_DEBUG_LOG = "/var/log/zed.debug.log"; - - ZED_NOTIFY_INTERVAL_SECS = 3600; - ZED_NOTIFY_VERBOSE = 0; - - ZED_USE_ENCLOSURE_LEDS = 1; - ZED_SCRUB_AFTER_RESILVER = 1; - ZED_POWER_OFF_ENCLOSURE_SLOT_ON_FAULT = 1; - ZED_POWER_OFF_ENCLOSURE_SLOT_ON_DEADMAN = 1; - - ZED_NTFY_TOPIC = "zed-alerts-bibus-lab"; - ZED_NTFY_URL = "http://${config.os.core.network.ips.monitor-vm}:8085"; - }; - }; - }; - systemd.services.zfs-zed.serviceConfig.EnvironmentFile = config.sops.secrets."ntfy/zed".path; - networking.hostId = "4e3e22e1"; - - }; -} diff --git a/os/default.nix b/os/default.nix deleted file mode 100644 index 5c55a8f..0000000 --- a/os/default.nix +++ /dev/null @@ -1,9 +0,0 @@ -{ ... }: -{ - imports = [ - ./core/default.nix - ./srv/default.nix - ./wm/default.nix - ./vms/microvms.nix - ]; -} diff --git a/os/srv/authelia.nix b/os/srv/authelia.nix deleted file mode 100644 index 2c42b0a..0000000 --- a/os/srv/authelia.nix +++ /dev/null @@ -1,179 +0,0 @@ -{ - config, - lib, - masterDomain, - securityTemplates, - ... -}: -let - cfg = config.os.srv.authelia; - computedBaseDN = lib.concatStringsSep "," ( - map (domainPart: "dc=${domainPart}") (lib.splitString "." masterDomain) - ); -in -{ - options.os.srv.authelia.enable = - lib.mkEnableOption "enables authelia authentication gateway instance"; - - config = lib.mkIf cfg.enable { - assertions = [ - { - assertion = config.os.srv.sops.enable; - message = "sops must be enabled for secure cryptographic token storage"; - } - { - assertion = config.os.core.network.enableFirewall; - message = "Requires firewall"; - } - ]; - - sops.secrets = { - "authelia/jwt_secret" = { - owner = "authelia-main"; - group = "authelia-main"; - restartUnits = [ "authelia-main.service" ]; - }; - "authelia/session_secret" = { - owner = "authelia-main"; - group = "authelia-main"; - restartUnits = [ "authelia-main.service" ]; - }; - "authelia/encryption_key" = { - owner = "authelia-main"; - group = "authelia-main"; - restartUnits = [ "authelia-main.service" ]; - }; - - "authelia/oidc_hmac" = { - owner = "authelia-main"; - group = "authelia-main"; - restartUnits = [ "authelia-main.service" ]; - }; - "authelia/oidc_private_key" = { - owner = "authelia-main"; - group = "authelia-main"; - restartUnits = [ "authelia-main.service" ]; - }; - - "postgres/authelia_password" = { - owner = "authelia-main"; - group = "authelia-main"; - restartUnits = [ "authelia-main.service" ]; - }; - "redis/password" = { - owner = "authelia-main"; - group = "authelia-main"; - restartUnits = [ "authelia-main.service" ]; - }; - }; - - services.authelia.instances.main = { - enable = true; - - secrets = { - jwtSecretFile = config.sops.secrets."authelia/jwt_secret".path; - sessionSecretFile = config.sops.secrets."authelia/session_secret".path; - storageEncryptionKeyFile = config.sops.secrets."authelia/encryption_key".path; - - oidcHmacSecretFile = config.sops.secrets."authelia/oidc_hmac".path; - oidcIssuerPrivateKeyFile = config.sops.secrets."authelia/oidc_private_key".path; - }; - - settings = { - theme = "dark"; - default_2fa_method = "totp"; - - log = { - level = "info"; - format = "json"; - path = "/var/log/authelia/authelia.log"; - keep_stdout = true; - }; - - server.address = "tcp://127.0.0.1:9091"; - - telemetry.metrics = { - enabled = true; - address = "tcp://127.0.0.1:9959"; - }; - - storage = { - postgres = { - host = config.os.core.network.ips.database-vm; - port = 5432; - database = "authelia"; - username = "authelia"; - timeout = "5s"; - schema = "public"; - }; - }; - - session = { - name = "authelia_session"; - expiration = "1h"; - inactivity = "15m"; - remember_me = "1M"; - provider = { - redis = { - host = config.os.core.network.ips.database-vm; - port = 6379; - database = 0; - timeout = "5s"; - }; - }; - }; - - authentication_backend = { - ldap = { - address = "ldap://${config.os.core.network.ips.gateway-vm}:3890"; - implementation = "lldap"; - base_dn = computedBaseDN; - user = "uid=authelia,ou=people,${computedBaseDN}"; - }; - }; - - identity_providers = { - oidc = { - cors.allowed_origins = map (domain: "https://${domain}") ( - builtins.attrNames config.os.cluster.nginxProxies - ); - - clients = config.os.cluster.oidcClients; - }; - }; - - access_control = { - default_policy = "deny"; - rules = [ - { - domain = "auth.${masterDomain}"; - policy = "bypass"; - } - ] - ++ config.os.cluster.autheliaRules; - }; - - session.domain = masterDomain; - }; - - environmentVariables = { - AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE = config.sops.secrets."lldap/password".path; - AUTHELIA_SESSION_REDIS_PASSWORD_FILE = config.sops.secrets."redis/password".path; - AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE = config.sops.secrets."postreg/authelia_password".path; - }; - }; - - os.cluster.nginxProxies."auth.${masterDomain}" = { - enableACME = true; - forceSSL = true; - locations."/" = { - proxyPass = "http://${config.os.core.network.ips.gateway-vm}:9091"; - extraConfig = securityTemplates.restrictToInternal; - }; - }; - - networking.firewall.extraInputRules = '' - ip saddr ${config.os.core.network.ips.monitor-vm} tcp dport 9959 accept - ''; - }; -} diff --git a/os/srv/avahi.nix b/os/srv/avahi.nix deleted file mode 100644 index f14b33a..0000000 --- a/os/srv/avahi.nix +++ /dev/null @@ -1,41 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.srv.avahi; -in -{ - options.os.srv.avahi.enable = lib.mkEnableOption "enables avahis"; - config = lib.mkIf cfg.enable { - services.avahi = { - enable = true; - ipv4 = true; - - publish = { - enable = true; - addresses = true; - workstation = true; - }; - - nssmdns4 = true; - - extraServiceFiles = { - nfs = '' - <?xml version="1.0" standalone='no'?> - <!DOCTYPE service-group SYSTEM "avahi-service.dtd"> - <service-group> - <name replace-wildcards="yes">NFS Share on %h</name> - <service> - <type>_nfs._tcp</type> - <port>2049</port> - <txt-record>path=/data/vault</txt-record> - </service> - <service> - <type>_nfs._tcp</type> - <port>2049</port> - <txt-record>path=/data/media</txt-record> - </service> - </service-group> - ''; - }; - }; - }; -} diff --git a/os/srv/backup.nix b/os/srv/backup.nix deleted file mode 100644 index e7c07f9..0000000 --- a/os/srv/backup.nix +++ /dev/null @@ -1,97 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.srv.replication; - pgLockScript = pkgs.writeScriptBin "pg-lock" '' - #!/bin/sh - microvm -s database-vm -- sudo -u postgres psql -c "SELECT pg_backup_start('sanoid_snap');" - ''; - - pgUnlockScript = pkgs.writeScriptBin "pg-unlock" '' - #!/bin/sh - microvm -s database-vm -- sudo -u postgres psql -c "SELECT pg_backup_stop();" - ''; -in -{ - options.os.srv.replication.enable = lib.mkEnableOption "enables replications"; - config = lib.mkIf cfg.enable { - services = { - sanoid = { - enable = true; - templates.production = { - autosnap = true; - autoprune = true; - hourly = 24; - daily = 7; - weekly = 4; - monthly = 3; - }; - datasets = { - "zroot/rpool/appdata/db/postgres" = { - useTemplate = [ "production" ]; - - pre_snapshot_script = "${pgLockScript}/bin/pg-lock"; - post_snapshot_script = "${pgUnlockScript}/bin/pg-unlock"; - no_inconsistent_snapshot = true; - force_post_snapshot_script = true; - script_timeout = 30; - }; - - "zroot/rpool/appdata/db/redis".useTemplate = [ "production" ]; - - "zroot/rpool/appdata/db/couchdb".useTemplate = [ "production" ]; - - "zroot/rpool/appdata/cfg".useTemplate = [ "production" ]; - - "zroot/rpool/appdata/games".useTemplate = [ "production" ]; - - "zroot/rpool/appdata/mail".useTemplate = [ "production" ]; - - "zroot/rpool/containers".useTemplate = [ "production" ]; - }; - }; - - syncoid = { - enable = true; - commonArgs = [ - "-c" - "-p" - "--delete-target-snapshots" - "--use-hold" - "--no-sync-snap" - ]; - commands = { - "sync-databases" = { - source = "zroot/rpool/appdata/db"; - target = "tank/ztank/backup/nvme/db"; - recursive = true; - }; - - "sync-config" = { - source = "zroot/rpool/appdata/cfg"; - target = "tank/ztank/backup/nvme/cfg"; - }; - - "sync-games" = { - source = "zroot/rpool/appdata/games"; - target = "tank/ztank/backup/nvme/games"; - }; - - "sync-mail" = { - source = "zroot/rpool/appdata/mail"; - target = "tank/ztank/backup/nvme/mail"; - }; - - "sync-docker" = { - source = "zroot/rpool/containers"; - target = "tank/ztank/backup/nvme/containers"; - }; - }; - }; - }; - }; -} diff --git a/os/srv/bluetooth.nix b/os/srv/bluetooth.nix deleted file mode 100644 index 1705db6..0000000 --- a/os/srv/bluetooth.nix +++ /dev/null @@ -1,19 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.srv.bluetooth; -in -{ - options.os.srv.bluetooth.enable = lib.mkEnableOption "enables bluetooth support"; - config = lib.mkIf cfg.enable { - hardware.bluetooth = { - enable = true; - powerOnBoot = true; - }; - environment.systemPackages = [ pkgs.bluetui ]; - }; -} diff --git a/os/srv/clamav.nix b/os/srv/clamav.nix deleted file mode 100644 index d2dc49f..0000000 --- a/os/srv/clamav.nix +++ /dev/null @@ -1,21 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.srv.clamav; -in -{ - options.os.srv.clamav.enable = lib.mkEnableOption "enables clamav scanning"; - config = lib.mkIf cfg.enable { - services.clamav = { - daemon = { - enable = true; - settings = { - MaxThreads = 20; - MaxQueue = 100; - }; - }; - scanner.enable = true; - updater.enable = true; - fangfrisch.enable = true; - }; - }; -} diff --git a/os/srv/cluster.nix b/os/srv/cluster.nix deleted file mode 100644 index 6e54ee2..0000000 --- a/os/srv/cluster.nix +++ /dev/null @@ -1,16 +0,0 @@ -{ lib, ... }: { - options.os.cluster = { - nginxProxies = lib.mkOption { - type = lib.types.attrsOf lib.types.attrs; - default = { }; - }; - autheliaRules = lib.mkOption { - type = lib.types.listOf lib.types.attrs; - default = [ ]; - }; - oidcClients = lib.mkOption { - type = lib.types.listOf lib.types.attrs; - default = [ ]; - }; - }; -} diff --git a/os/srv/compat.nix b/os/srv/compat.nix deleted file mode 100644 index 1ea6105..0000000 --- a/os/srv/compat.nix +++ /dev/null @@ -1,28 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.srv.compat; -in -{ - options.os.srv.compat.enable = lib.mkEnableOption "enables compatibility with windows & x11"; - config = lib.mkIf cfg.enable { - programs.xwayland = { - enable = true; - package = pkgs.xwayland-satellite; - }; - - environment.systemPackages = with pkgs; [ - wineWow64Packages.stagingFull - winetricks - ]; - - environment.sessionVariables = { - NIXOS_OZONE_WL = "1"; - ELECTRON_ENABLE_WAYLAND = "1"; - }; - }; -} diff --git a/os/srv/crowdsec.nix b/os/srv/crowdsec.nix deleted file mode 100644 index c3df81b..0000000 --- a/os/srv/crowdsec.nix +++ /dev/null @@ -1,181 +0,0 @@ -{ - config, - lib, - masterDomain, - ... -}: -let - cfg = config.os.srv.security.crowdsec; -in -{ - options.os.srv.security.crowdsec = { - enable = lib.mkEnableOption "enables CrowdSec collaborative intrusion prevention"; - - aggregator.enable = lib.mkEnableOption "this node acting as a central LAPI aggregator for the network"; - agent.enable = lib.mkEnableOption "local log parsing and threat intelligence generation on this node"; - }; - - config = lib.mkIf cfg.enable { - assertions = [ - { - assertion = config.networking.nftables.enable; - message = "CrowdSec requires networking.nftables to be enabled for blocking."; - } - { - assertion = cfg.agent.enable || cfg.aggregator.enable; - message = "You must enable at least one CrowdSec role: 'agent.enable' or 'aggregator.enable'."; - } - ]; - - sops = { - secrets."crowdsec/env" = { - owner = "crowdsec"; - group = "crowdsec"; - restartUnits = [ "crowdsec.service" ]; - }; - - templates."local_api_credentials.yaml" = { - owner = "crowdsec"; - group = "crowdsec"; - restartUnits = [ "crowdsec.service" ]; - content = '' - url: http://${config.os.core.network.ips.gateway-vm}:8080 - login: ${config.networking.hostName} - password: ${config.sops.placeholder."crowdsec/client_password"} - ''; - }; - }; - - systemd.services.crowdsec.serviceConfig.EnvironmentFile = config.sops.secrets."crowdsec/env".path; - - services.crowdsec = { - enable = true; - autoUpdateService = true; - - openFirewall = true; - - settings = { - common = { - compress_logs = true; - log_format = "json"; - }; - prometheus = { - enabled = true; - level = "full"; - listen_addr = "0.0.0.0"; - listen_port = 6060; - }; - db_config = { - type = "postgresql"; - host = config.os.core.network.ips.database-vm; - port = 5432; - db_name = "crowdsec"; - user = "crowdsec"; - password = "$CROWDSEC_DB_PASSWORD"; - sslmode = "require"; - }; - - api = { - server = { - enable = cfg.aggregator.enable; - listen_uri = "0.0.0.0:8080"; - trusted_ips = [ - "127.0.0.1" - "10.0.0.0/24" - ]; - - auto_registration = { - enabled = cfg.aggregator.enable; - token = "$CROWDSEC_REGISTER_TOKEN"; - allowed_ranges = [ "10.0.0.0/24" ]; - }; - }; - client.credentials_path = config.sops.templates."local_api_credentials.yaml".path; - }; - lapi.client.api_url = "http://${config.os.core.network.ips.gateway-vm}:8080"; - }; - - hub = lib.mkIf cfg.agent.enable { - collections = [ - "crowdsecurity/linux" - "crowdsecurity/nginx" - "crowdsecurity/authelia" - "crowdsecurity/sshd" - ]; - }; - - localConfig = { - acquisitions = lib.mkIf cfg.agent.enable [ - { - source = "journalctl"; - journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ]; - labels.type = "syslog"; - } - { - source = "file"; - filenames = [ "/var/log/nginx/*.log" ]; - labels.type = "nginx"; - } - { - source = "file"; - filenames = [ "/var/log/authelia/authelia.log" ]; - labels.type = "authelia"; - } - ]; - - parsers.s02Enrich = lib.mkIf cfg.agent.enable [ - { - name = "myips/whitelist"; - description = "Prevent local address ranges from triggering bans"; - whitelist = { - reason = "Internal private subnets"; - cidr = [ - "10.0.0.0/24" - "10.1.0.0/24" - "10.3.0.0/24" - "10.4.0.0/24" - ]; - }; - } - ]; - - notifications = lib.mkIf cfg.aggregator.enable [ - { - name = "ntfy_alerts"; - type = "http"; - method = "POST"; - url = "https://ntfy.${masterDomain}/crowdsec-alerts"; - headers = { - Title = "CrowdSec Alert on Bibus-Lab"; - Priority = "high"; - Authorization = "$NTFY_AUTH_TOKEN"; - }; - format = '' - {{range .}} {{.Alert.Message}} (Scenario: {{.Alert.Scenario}}) from IP {{.Alert.Source.IP}} {{end}} - ''; - log_level = "info"; - } - ]; - }; - }; - - services.crowdsec-firewall-bouncer = { - enable = true; - - registerBouncer.enable = cfg.aggregator.enable; - - settings = { - mode = "nftables"; - update_frequency = "10s"; - api_url = "http://${config.os.core.network.ips.gateway-vm}:8080"; - api_key = lib.mkIf cfg.aggregator.enable "$CROWDSEC_LOCAL_BOUNCER_KEY"; - }; - }; - - users.users.crowdsec.extraGroups = lib.mkIf cfg.agent.enable [ - "systemd-journal" - "nginx" - "authelia-main" - ]; - }; -} diff --git a/os/srv/default.nix b/os/srv/default.nix deleted file mode 100644 index c89d029..0000000 --- a/os/srv/default.nix +++ /dev/null @@ -1,48 +0,0 @@ -{ ... }: -{ - imports = [ - ./authelia.nix - ./backup.nix - ./bluetooth.nix - ./clamav.nix - ./cluster.nix - ./compat.nix - ./crowdsec.nix - ./dns.nix - ./files.nix - ./gaming.nix - ./grafana.nix - ./headscale.nix - ./i2p.nix - ./kea.nix - ./lldap.nix - ./loki.nix - ./mailserver.nix - ./monero.nix - ./netdata.nix - ./nfs.nix - ./nginx.nix - ./nix-helper.nix - ./ntfy.nix - ./ntopng.nix - ./oci.nix - ./omnisearch.nix - ./postgres.nix - ./prometheus.nix - ./redis.nix - ./scrutiny.nix - ./simplex.nix - ./sops.nix - ./ssh.nix - ./sunshine.nix - ./syncthing.nix - ./tailscale.nix - ./tor.nix - ./ups.nix - ./uptime-kuma.nix - ./vector.nix - ./virtualization.nix - ./wireguard.nix - ./yggdrasil.nix - ]; -} diff --git a/os/srv/dns.nix b/os/srv/dns.nix deleted file mode 100644 index b8a973f..0000000 --- a/os/srv/dns.nix +++ /dev/null @@ -1,286 +0,0 @@ -{ - config, - lib, - masterDomain, - securityTemplates, - ... -}: -let - cfg = config.os.srv.dns; - unboundPort = 5335; -in -{ - options.os.srv.dns = { - enable = lib.mkEnableOption "enables dns scanning"; - adguardProxyConfig = lib.mkOption { - type = lib.types.attrs; - default = { }; - }; - }; - config = lib.mkIf cfg.enable { - services.unbound = { - enable = true; - settings = { - server = { - interface = [ "127.0.0.1" ]; - port = unboundPort; - - do-ip4 = true; - do-ip6 = false; - do-udp = true; - do-tcp = true; - - num-threads = 4; - msg-cache-slabs = 4; - rrset-cache-slabs = 4; - infra-cache-slabs = 4; - key-cache-slabs = 4; - - msg-cache-size = "256m"; - rrset-cache-size = "512m"; - infra-cache-numhosts = 20000; - - so-rcvbuf = "8m"; - so-sndbuf = "8m"; - so-reuseport = true; - - qname-minimisation = true; - prefetch = true; - prefetch-key = true; - harden-glue = true; - harden-dnssec-stripped = true; - hide-identity = true; - hide-version = true; - use-caps-for-id = false; # might try this later - edns-buffer-size = 1232; - - access-control = [ - "127.0.0.0/8 allow" - "0.0.0.0/0 deny" - ]; - }; - }; - }; - - services.adguardhome = { - enable = true; - mutableSettings = true; - - settings = { - http.address = "0.0.0.0:3000"; - dns = { - bind_hosts = [ - "127.0.0.1" - config.os.core.network.lan.ip - config.os.core.network.wg.ip - config.os.core.network.hs.ip - ]; - rewrites = [ - { - domain = "router.lan"; - answer = config.os.core.network.ips.opnsense-vm; - } - { - domain = "nas.lan"; - answer = config.os.core.network.ips.bare-metal; - } - { - domain = "ldap.${masterDomain}"; - answer = config.os.core.network.ips.gateway-vm; - } - ]; - port = 53; - upstream_dns = [ "127.0.0.1:${toString unboundPort}" ]; - fallback_dns = [ "9.9.9.9" ]; - bootstrap_dns = [ "9.9.9.9" ]; - cache_size = 536870912; - anonymize_client_ip = true; - }; - - filtering = { - filtering_enabled = true; - interval = 24; - }; - filters = [ - { - enabled = true; - name = "Black Mirror Blocklist"; - url = "https://raw.githubusercontent.com/T145/black-mirror/refs/heads/master/dist/ADGUARD_SOURCES.txt"; - } - { - enabled = true; - name = "Scam Blocklist by DurableNapkin"; - url = "https://raw.githubusercontent.com/durablenapkin/scamblocklist/master/adguard.txt"; - } - { - enabled = true; - name = "Neo Dev Host Blocklist"; - url = "https://raw.githubusercontent.com/neodevpro/neodevhost/master/adblocker"; - } - { - enabled = true; - name = "hBlock Blocklist"; - url = "https://hblock.molinero.dev/hosts_adblock.txt"; - } - { - enabled = true; - name = "OISD Big Blocklist"; - url = "https://big.oisd.nl"; - } - { - enabled = true; - name = "StevenBlack Unified"; - url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts"; - } - { - enabled = true; - name = "StevenBlack Fakenews"; - url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews-only/hosts"; - } - { - enabled = true; - name = "StevenBlack Gambling"; - url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/gambling-only/hosts"; - } - - #----------------------------------------------------------------------------- - - # HaGeZi's Blocklists - - { - enabled = true; - name = "HaGeZi's Ultimate Blocklist"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/ultimate.txt"; - } - { - enabled = false; # Added but disabled Pro++ as a fallback if Ultimate proves to be too aggressive - name = "HaGeZi's Pro++ DNS Blocklist"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/pro.plus.txt"; - } - { - enabled = true; - name = "HaGeZi's Fake DNS Blocklist"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/fake.txt"; - } - { - enabled = true; - name = "HaGeZi's Threat Intelligence Feeds DNS Blocklist"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/tif.txt"; - } - { - enabled = true; - name = "HaGeZi's Dynamic DNS Blocklsit"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/dyndns.txt"; - } - { - enabled = true; - name = "HaGeZi's Badware Hoster Blocklist"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/hoster.txt"; - } - { - enabled = true; - name = "HaGeZi's URL Shortener Blocklist"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/urlshortener.txt"; - } - { - enabled = true; - name = "HaGeZi's DNS Rebind Protection"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adguard/dns-rebind-protection.txt"; - } - { - enabled = true; - name = "HaGeZi's Gambling DNS Blocklist"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/gambling.txt"; - } - - #----------------------------------------------------------------------------- - - # NEWLY REGISTERED DOMAINS / ENTROPY DGAs - - { - enabled = true; - name = "HaGeZi's Newly Registered Domains 7 days ago to yesterday"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd7.txt"; - } - { - enabled = true; - name = "HaGeZi's Newly Registered Domains 14 days ago to 8 days ago"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd14-8.txt"; - } - { - enabled = true; - name = "HaGeZi's Newly Registered Domains 21 days ago to 15 days ago"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd21-15.txt"; - } - { - enabled = true; - name = "HaGeZi's Newly Registered Domains 28 days ago to 12 days ago"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd28-22.txt"; - } - { - enabled = true; - name = "HaGeZi's Newly Registered Domains 35 days ago to 29 days ago"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd35-29.txt"; - } - { - enabled = true; - name = "HaGeZi's Newly Registered High Entropy Domains"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/dga30.txt"; - } - - #----------------------------------------------------------------------------- - - # DNS BYPASS BLOCKLISTS - - { - enabled = true; - name = "HaGeZi's DNS Bypass Blocklist"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/doh-vpn-proxy-bypass.txt"; - } - { - enabled = true; - name = "DNS HTTPS Blocklist"; - url = "https://raw.githubusercontent.com/Bryantdl7/pihole-blocklists/main/dns-https-block.txt"; - } - - #----------------------------------------------------------------------------- - - # NSFW DNS BLOCKLISTS - - { - enabled = true; - name = "HaGeZi's NSFW DNS Blocklist"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nsfw.txt"; - } - { - enabled = true; - name = "oisd NSFW"; - url = "https://nsfw.oisd.nl"; - } - { - enabled = true; - name = "StevenBlack NSFW Blocklist"; - url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/porn-only/hosts"; - } - ]; - }; - }; - - os.srv.dns.adguardProxyConfig = { - "adguard.${masterDomain}" = { - enableACME = true; - forceSSL = true; - - locations."/" = { - proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3000"; - extraConfig = securityTemplates.restrictToInternal; - }; - }; - }; - - networking.firewall = { - allowedUDPPorts = [ 53 ]; - allowedTCPPorts = [ 53 ]; - }; - }; -} diff --git a/os/srv/files.nix b/os/srv/files.nix deleted file mode 100644 index 777a394..0000000 --- a/os/srv/files.nix +++ /dev/null @@ -1,55 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.srv.files; -in -{ - options.os.srv.files = { - enable = lib.mkEnableOption "enables general file management stuff"; - localsend.enable = lib.mkEnableOption "enables localsend for sharing files locally"; - krusader.enable = lib.mkEnableOption "enables krusader for easier file moving using ssh"; - }; - config = lib.mkMerge [ - (lib.mkIf cfg.enable { - # programs.thunar = { - # enable = true; - # plugins = with pkgs; [ - # ffmpegthumbnailer - # libgsf - # poppler - # freetype - # webp-pixbuf-loader - # thunar-volman - # thunar-archive-plugin - # ]; - # }; - services = { - tumbler.enable = true; - gvfs.enable = true; - }; - environment.systemPackages = with pkgs; [ - pcmanfm - file-roller - gdu - pxz - ripunzip - ]; - }) - (lib.mkIf cfg.localsend.enable { - programs.localsend = { - enable = true; - openFirewall = true; - }; - }) - (lib.mkIf cfg.krusader.enable { - environment.systemPackages = with pkgs; [ - krusader - kdePackages.kio-extras - ]; - }) - ]; -} diff --git a/os/srv/gaming.nix b/os/srv/gaming.nix deleted file mode 100644 index b9b6766..0000000 --- a/os/srv/gaming.nix +++ /dev/null @@ -1,145 +0,0 @@ -{ - config, - lib, - pkgs, - username, - inputs, - ... -}: -let - cfg = config.os.srv.gaming; -in -{ - options.os.srv.gaming = { - enable = lib.mkEnableOption "enables general gaming support"; - - tools.enable = lib.mkEnableOption "enables performance tools" // { - default = cfg.enable; - }; - launchers.enable = lib.mkEnableOption "enables 3rd party launchers" // { - default = cfg.enable; - }; - games.enable = lib.mkEnableOption "enables specific native games"; - steam = { - enable = lib.mkEnableOption "enables the steam launcher"; - enableSls = lib.mkEnableOption "enables the SLS Steam library modification"; - }; - vr.enable = lib.mkEnableOption "enables vr support"; - }; - - config = lib.mkMerge [ - # --- PERFORMANCE & TOOLING --- - (lib.mkIf cfg.tools.enable { - hardware.xone.enable = true; - programs = { - gamescope = { - enable = true; - capSysNice = true; - }; - - gamemode = { - enable = true; - enableRenice = true; - settings = { - general.renice = 10; - }; - }; - }; - environment = { - sessionVariables = { - OPTISCALER_ShortcutKey = "0x24"; # sets the optiscaler shortcut key to be home by default - }; - - systemPackages = with pkgs; [ - mangohud - theclicker - ludusavi - protonplus - ]; - }; - }) - - # --- EXTERNAL LAUNCHERS --- - (lib.mkIf cfg.launchers.enable { - environment.systemPackages = with pkgs; [ - heroic - (prismlauncher.override { - additionalLibs = with pkgs; [ ocl-icd ]; - jdks = with pkgs; [ javaPackages.compiler.temurin-bin.jdk-26 ]; - }) - ]; - }) - - # --- SPECIFIC GAMES --- - (lib.mkIf cfg.games.enable { - environment.systemPackages = with inputs.openmw-nix.packages.${pkgs.stdenv.hostPlatform.system}; [ - (pkgs.openttd-jgrpp) - - # OpenMW Specific - (pkgs.openmw) - (pkgs.tes3cmd) - delta-plugin - groundcoverify - momw-configurator - openmw-validator - s3lightfixes - umo - ]; - }) - - # --- STEAM --- - (lib.mkIf cfg.steam.enable ( - lib.mkMerge [ - { - programs.steam = { - enable = true; - localNetworkGameTransfers.openFirewall = true; - dedicatedServer.openFirewall = true; - remotePlay.openFirewall = false; - extest.enable = true; - protontricks.enable = true; - }; - environment.systemPackages = with pkgs; [ steamtinkerlaunch ]; - } - - (lib.mkIf cfg.steam.enableSls { - environment.systemPackages = [ - inputs.sls-steam.packages.${pkgs.stdenv.hostPlatform.system}.wrapped - ]; - home-manager.users.${username} = { - xdg.desktopEntries = { - steam = { - name = "Steam"; - comment = "Library modified Steam client"; - exec = "${ - lib.getExe' inputs.sls-steam.packages.${pkgs.stdenv.hostPlatform.system}.wrapped "SLSsteam" - } %U"; - icon = "steam"; - terminal = false; - type = "Application"; - categories = [ - "Game" - "Utility" - ]; - mimeType = [ "x-scheme-handler/steamcmd" ]; - }; - }; - }; - }) - ] - )) - - # --- VR SUPPORT --- - (lib.mkIf cfg.vr.enable { - services.wivrn = { - enable = true; - openFirewall = true; - highPriority = true; - steam.importOXRRuntimes = true; - # defaultRuntime = true; - }; - environment.systemPackages = [ pkgs.android-tools ]; - users.users.${username}.extraGroups = [ "adbusers" ]; - }) - ]; -} diff --git a/os/srv/grafana.nix b/os/srv/grafana.nix deleted file mode 100644 index 5428818..0000000 --- a/os/srv/grafana.nix +++ /dev/null @@ -1,109 +0,0 @@ -{ - config, - lib, - masterDomain, - securityTemplates, - ... -}: -let - cfg = config.os.srv.grafana; -in -{ - options.os.srv.grafana = { - enable = lib.mkEnableOption "enables grafana"; - proxyConfig = lib.mkOption { - type = lib.types.attrs; - default = { }; - }; - }; - config = lib.mkIf cfg.enable { - services.grafana = { - enable = true; - openFirewall = true; - - # Might use later - # declarativePlugins = [ ]; - - settings = { - server = { - protocol = "http"; - http_port = 3000; - http_addr = "0.0.0.0"; - domain = "grafana.${masterDomain}"; - root_url = "https://grafana.${masterDomain}"; - enforceDomain = true; - enable_gzip = true; - }; - database = { - wal = true; - }; - security = { - admin_user = "opc"; - # TODO: Generate password to use in sops-nix - # admin_password = "sops" - admin_email = "adikro@disroot.org"; - # TODO generate secret key and put it in sops-nix - # secret_key = "sops"; - disable_gravatar = true; - cookie_secure = true; - cookie_samesite = "lax"; - # security - allow_embedding = false; - strict_transport_security = true; - - disable_initial_admin_creation = false; - disable_brute_force_login_protection = false; - }; - # TODO setup mailing - # smtp = { enabled = true; }; - analytics.feedback_links_enabled = false; - }; - provision = { - enable = true; - datasources.settings = { - prune = true; - - datasources = [ - { - name = "Prometheus"; - type = "prometheus"; - url = "http://127.0.0.1:9090"; - access = "proxy"; - isDefault = true; - editable = false; - } - { - name = "Loki"; - type = "loki"; - url = "http://127.0.0.1:3100"; - access = "proxy"; - editable = false; - } - ]; - }; - }; - # dashboards.settings = { - # providers = [ - # { - # name = "default"; - # type = "file"; - # options.path = "/var/lib/grafana/dashboards"; - # } - # ]; - # }; - }; - - os.srv.grafana.proxyConfig = { - "grafana.${masterDomain}" = { - enableACME = true; - forceSSL = true; - - locations."/" = { - proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3000"; - proxyWebsockets = true; - extraConfig = securityTemplates.restrictToInternal; - }; - }; - }; - }; -} diff --git a/os/srv/headscale.nix b/os/srv/headscale.nix deleted file mode 100644 index 01fc06c..0000000 --- a/os/srv/headscale.nix +++ /dev/null @@ -1,76 +0,0 @@ -{ - config, - lib, - pkgs, - masterDomain, - ... -}: -let - cfg = config.os.srv.headscale; - aclPolicy = pkgs.writeText "headscale-policy.json" ( - builtins.toJSON { - groups = { - "group:admin" = [ "your-device-name" ]; - "group:friends" = [ "friend-device-name" ]; - }; - - hosts = { - "server" = "10.4.0.1"; - }; - - acls = [ - { - action = "accept"; - src = [ "group:admin" ]; - dst = [ "*:*" ]; - } - - { - action = "accept"; - src = [ "group:friends" ]; - dst = [ - "server:18080" - "server:18081" - "server:25565" - ]; - } - ]; - } - ); -in -{ - options.os.srv.headscale.enable = lib.mkEnableOption "enables headscales"; - - config = lib.mkIf cfg.enable { - services.headscale = { - enable = true; - address = "127.0.0.1"; - port = 8080; - - settings = { - server_url = "https://vpn.${masterDomain}"; - - policy.path = "${aclPolicy}"; - - dns = { - magic_dns = true; - base_domain = "vpn"; - nameservers = [ config.os.core.network.ips.vm2-gateway ]; - }; - - ip_prefixes = [ - "10.4.0.0/16" - ]; - }; - }; - - services.nginx.virtualHosts."vpn.${masterDomain}" = { - enableACME = true; - forceSSL = true; - locations."/" = { - proxyPass = "http://127.0.0.1:8080"; - proxyWebsockets = true; - }; - }; - }; -} diff --git a/os/srv/i2p.nix b/os/srv/i2p.nix deleted file mode 100644 index 5e36c20..0000000 --- a/os/srv/i2p.nix +++ /dev/null @@ -1,81 +0,0 @@ -{ - config, - lib, - masterDomain, - securityTemplates, - ... -}: -let - cfg = config.os.srv.i2p; -in -{ - options.os.srv.i2p = { - enable = lib.mkEnableOption "enables a flexible, polymorphic i2pd deployment profile"; - - mode = lib.mkOption { - type = lib.types.enum [ - "server" - "client" - ]; - default = "client"; - description = ""; - }; - }; - - config = lib.mkIf cfg.enable ( - lib.mkMerge [ - { - services.i2pd = { - enable = true; - enableIPv6 = true; - reseed.verify = true; - - yggdrasil.enable = true; - - proto = { - http.enable = true; - httpProxy.enable = true; - socksProxy = { - enable = true; - outproxyEnable = true; - }; - sam.enable = true; - i2pControl.enable = true; - }; - }; - } - - (lib.mkIf (cfg.mode == "server") { - services.i2pd = { - bandwidth = 4096; - - ntcp2.published = true; - ssu2.published = true; - - #TODO add address - yggdrasil.address = ""; - }; - - os.cluster.nginxProxies."i2p.${masterDomain}" = { - enableACME = true; - forceSSL = true; - locations."/" = { - proxyPass = "http://${config.os.core.network.ips.relay-vm}:7070"; - extraConfig = securityTemplates.restrictToInternal; - }; - }; - }) - - (lib.mkIf (cfg.mode == "client") { - services.i2pd = { - bandwidth = 512; - - ntcp2.published = false; - ssu2.published = false; - - yggdrasil.address = ""; - }; - }) - ] - ); -} diff --git a/os/srv/kea.nix b/os/srv/kea.nix deleted file mode 100644 index 168590e..0000000 --- a/os/srv/kea.nix +++ /dev/null @@ -1,58 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.srv.kea; -in -{ - options.os.srv.kea.enable = lib.mkEnableOption "enables kea dhcp server"; - config = lib.mkIf cfg.enable { - services.kea.dhcp4 = { - enable = true; - settings = { - interfaces-config = { - # To be used in a VM - interfaces = [ "eth0" ]; - dhcp-socket-type = "udp"; - }; - - lease-database = { - type = "memfile"; - persist = true; - name = "/var/lib/kea/dhcp4.leases"; - }; - - subnet4 = [ - { - id = 1; - subnet = "10.1.0.0/24"; - pools = [ { pool = "10.1.0.50 - 10.1.0.250"; } ]; - option-data = [ - { - name = "routers"; - data = "10.1.0.1"; - } - { - name = "domain-name-servers"; - data = "10.0.0.3"; - } - ]; - } - { - id = 2; - subnet = "10.2.0.0/24"; - pools = [ { pool = "10.2.0.50 - 10.2.0.250"; } ]; - option-data = [ - { - name = "routers"; - data = "10.2.0.1"; - } - { - name = "domain-name-servers"; - data = "10.0.0.3"; - } - ]; - } - ]; - }; - }; - }; -} diff --git a/os/srv/lldap.nix b/os/srv/lldap.nix deleted file mode 100644 index 6755dfe..0000000 --- a/os/srv/lldap.nix +++ /dev/null @@ -1,55 +0,0 @@ -{ - config, - lib, - masterDomain, - ... -}: -let - cfg = config.os.srv.lldap; - computedBaseDN = lib.concatStringsSep "," ( - map (domainPart: "dc=${domainPart}") (lib.splitString "." masterDomain) - ); -in -{ - options.os.srv.lldap.enable = lib.mkEnableOption "enables lldap scanning"; - config = lib.mkIf cfg.enable { - assertions = [ - { - assertion = config.os.srv.sops.enable; - message = "Required for password secure password storing"; - } - { - assertion = config.os.core.network.enableFirewall; - message = "Requires firewall"; - } - ]; - - sops.secrets = { - "lldap/password" = { - owner = "lldap"; - group = "lldap"; - }; - "lldap/env_file" = { - owner = "lldap"; - group = "lldap"; - }; - }; - - services.lldap = { - enable = true; - settings = { - ldap_base_dn = computedBaseDN; - http_host = "127.0.0.1"; - http_url = "https://lldap.${masterDomain}"; - ldap_user_email = "adikro@disroot.org"; - ldap_user_pass_file = config.sops.secrets."lldap/password".path; - silenceForceUserPassResetWarning = true; - }; - environmentFile = config.sops.secrets."lldap/env_file".path; - }; - - networking.firewall.extraInputRules = '' - ip saddr 10.0.0.0/24 tcp dport 3890 accept - ''; - }; -} diff --git a/os/srv/loki.nix b/os/srv/loki.nix deleted file mode 100644 index 84b94d8..0000000 --- a/os/srv/loki.nix +++ /dev/null @@ -1,62 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.srv.loki; -in -{ - options.os.srv.loki.enable = lib.mkEnableOption "enables loki"; - config = lib.mkIf cfg.enable { - services.loki = { - enable = true; - configuration = { - server = { - http_listen_address = "0.0.0.0"; - http_compress_responses = true; - }; - - common = { - instance_addr = "127.0.0.1"; - path_prefix = "/var/lib/loki"; - replication_factor = 1; - - storage.filesystem = { - chunks_directory = "/var/lib/loki/chunks"; - rules_directory = "/var/lib/loki/rules"; - }; - }; - - schema_config.configs = [ - { - from = "2026-01-01"; - store = "tsdb"; - object_store = "filesystem"; - schema = "v13"; - index = { - prefix = "loki_index_"; - period = "24h"; - }; - } - ]; - - ingester.wal.enabled = true; - - limits_config = { - max_entries_limit_per_query = 10000; - reject_old_samples_max_age = "720h"; - retention_period = "90d"; - volume_enabled = true; - }; - - compactor = { - enabled = true; - retention_enabled = true; - retention_delete_delay = "1h"; - compactor_window = "168h"; - }; - - querier.query_timeout = "5m"; - query_range.out_of_order_time_shifting = "5m"; - analytics.reporting_enabled = false; - }; - }; - }; -} diff --git a/os/srv/mailserver.nix b/os/srv/mailserver.nix deleted file mode 100644 index 7bcd008..0000000 --- a/os/srv/mailserver.nix +++ /dev/null @@ -1,59 +0,0 @@ -{ - config, - lib, - inputs, - masterDomain, - ... -}: -let - cfg = config.os.srv.mailserver; -in -{ - options.os.srv.mailserver.enable = lib.mkEnableOption "enables mailserver scanning"; - imports = [ inputs.nixos-mailserver.nixosModules.mailserver ]; - config = lib.mkIf cfg.enable { - assertions = [ - { - assertion = config.os.srv.sops.enable; - message = "Required for password secure password storing"; - } - { - assertion = config.os.srv.lldap.enable; - message = "required for user accounts"; - } - ]; - mailserver = { - enable = true; - fqdn = "mail.${masterDomain}"; - domains = [ masterDomain ]; - - # TODO setup ldap - ldap = { - enable = true; - uris = [ "ldap://127.0.0.1:3890" ]; - base = "ou=people,dc=yourdomain,dc=com"; - - bind = { - dn = "uid=mail-service,ou=people,dc=yourdomain,dc=com"; - passwordFile = "/var/src/secrets/ldap-mail-password"; - }; - - attributes = { - username = "uid"; - mail = "mail"; - password = "userPassword"; - uuid = "entryUUID"; - }; - - dovecot = { - userFilter = "(|(mail=%{user})(uid=%{user}))"; - passFilter = "(uid=%{user})"; - }; - - postfix = { - filter = "(mail=%s)"; - }; - }; - }; - }; -} diff --git a/os/srv/monero.nix b/os/srv/monero.nix deleted file mode 100644 index eb21abc..0000000 --- a/os/srv/monero.nix +++ /dev/null @@ -1,124 +0,0 @@ -{ - config, - lib, - pkgs, - masterDomain, - securityTemplates, - ... -}: -let - cfg = config.os.srv.monero; - banlist1 = pkgs.fetchurl { - url = "https://gui.xmr.pm/files/block.txt"; - hash = "sha256-0ik4d66js6wvrvciza0li6bsajj8dvxsqlf09hcz7hg610szdxcw"; - }; - banlist2 = pkgs.fetchurl { - url = "https://raw.githubusercontent.com/Boog900/monero-ban-list/refs/heads/main/ban_list.txt"; - hash = "sh256-01z4wm2mp4z1wq2wdkrm66j50gwk3r82m2ml4n0pwjcbajxkdc87"; - }; - - combinedBanlist = pkgs.writeText "combined-monero-banlist.txt" '' - ${builtins.readFile banlist1} - ${builtins.readFile banlist2} - ''; -in -{ - options.os.srv.monero = { - wallet.enable = lib.mkEnableOption "enables the monero wallet"; - service = { - enable = lib.mkEnableOption "enables hosting a monero node"; - public = lib.mkEnableOption "makes the RPC node public (disables authentication for general wallet syncing)"; - tor.enable = lib.mkEnableOption "exposes monero RPC via Tor Onion Service"; - i2p.enable = lib.mkEnableOption "exposes monero RPC via I2P Tunnel"; - }; - }; - - config = lib.mkMerge [ - (lib.mkIf cfg.wallet.enable { - environment.systemPackages = [ pkgs.monero-cli ]; - }) - (lib.mkIf cfg.service.enable { - assertions = [ - { - assertion = if (!cfg.service.public) then config.os.srv.sops.enable else true; - message = "sops must be enabled"; - } - { - assertion = if cfg.service.tor.enable then config.os.srv.tor.enable else true; - message = "tor must be enabled"; - } - { - assertion = if cfg.service.i2p.enable then config.os.srv.i2p.enable else true; - message = "i2p must be enabled"; - } - ]; - - sops.secrets."monero/rpc-password" = { - owner = "monero"; - restartUnits = [ "monero.service" ]; - }; - - services.monero = { - enable = true; - prune = true; - banlist = combinedBanlist; - - limits = { - upload = 1250; - download = 12500; - threads = 8; - }; - - rpc = { - address = "0.0.0.0"; - } - // lib.optionalAttrs (!cfg.service.public) { - restricted = true; - user = "admin"; - password = config.sops.secrets."monero/rpc-password".path; - }; - - }; - - services.tor = lib.mkIf cfg.service.tor.enable { - # onionServices."xmr-rpc" = { - # to = [ - # { - # port = 18081; - # address = config.os.core.network.ips.relay-vm; - # } - # ]; - # }; - }; - - services.i2pd = lib.mkIf cfg.service.i2p.enable { - # tunnels.server."xmr-rpc" = { - # port = 18081; - # address = config.os.core.network.ips.relay-vm; - # keys = "xmr-rpc-key.dat"; - # inbound.length = 3; - # outbound.length = 3; - # }; - }; - - os.cluster.nginxProxies."xmr.${masterDomain}" = { - enableACME = true; - forceSSL = true; - - locations."/" = { - proxyPass = "http://${config.os.core.network.ips.relay-vm}:18081"; - extraConfig = '' - proxy_read_timeout 600s; - proxy_send_timeout 600s; - client_max_body_size 50m; - - ${securityTemplates.restrictToInternal} - ''; - }; - }; - - # Left open for P2P syncing - networking.firewall.allowedTCPPorts = [ 18080 ]; - }) - ]; -} diff --git a/os/srv/netdata.nix b/os/srv/netdata.nix deleted file mode 100644 index a7b4300..0000000 --- a/os/srv/netdata.nix +++ /dev/null @@ -1,43 +0,0 @@ -{ - config, - lib, - masterDomain, - securityTemplates, - ... -}: -let - cfg = config.os.srv.netdata; -in -{ - options.os.srv.netdata = { - enable = lib.mkEnableOption "enables netdata monitoring"; - proxyConfig = lib.mkOption { - type = lib.types.attrs; - default = { }; - }; - }; - - config = lib.mkIf cfg.enable { - services.netdata = { - enable = true; - config.web."bind to" = "127.0.0.1"; - - python = { - enable = true; - recommendedPythonPackages = true; - }; - }; - - os.srv.netdata.proxyConfig = { - "netdata.${masterDomain}" = { - enableACME = true; - forceSSL = true; - - locations."/" = { - proxyPass = "http://${config.os.core.network.ips.host}:19999"; - extraConfig = securityTemplates.restrictToInternal; - }; - }; - }; - }; -} diff --git a/os/srv/nfs.nix b/os/srv/nfs.nix deleted file mode 100644 index 07f331e..0000000 --- a/os/srv/nfs.nix +++ /dev/null @@ -1,26 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.srv.nfs; -in -{ - options.os.srv.nfs.enable = lib.mkEnableOption "enables nfs drive sharing"; - config = lib.mkIf cfg.enable { - services.nfs.server = { - enable = true; - nproc = 4; # Lowered due to low traffic for a home server - createMountPoints = true; - - exports = '' - /data/media 10.1.0.0/24(rw,all_squash,anonuid=1000,anongid=100,async,insecure,no_subtree_check) \ - 10.3.0.0/24(rw,all_squash,anonuid=1000,anongid=100,async,insecure,no_subtree_check) \ - 10.4.0.0/24(rw,all_squash,anonuid=1000,anongid=100,async,insecure,no_subtree_check) - - /data/vault 10.1.0.0/24(rw,all_squash,anonuid=1000,anongid=100,async,insecure,no_subtree_check) \ - 10.3.0.0/24(rw,all_squash,anonuid=1000,anongid=100,async,insecure,no_subtree_check) \ - 10.4.0.0/24(rw,all_squash,anonuid=1000,anongid=100,async,insecure,no_subtree_check) - ''; - }; - - networking.firewall.allowedTCPPorts = [ 2049 ]; - }; -} diff --git a/os/srv/nginx.nix b/os/srv/nginx.nix deleted file mode 100644 index 2194ecb..0000000 --- a/os/srv/nginx.nix +++ /dev/null @@ -1,75 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: - -let - cfg = config.os.srv.nginx; -in -{ - options.os.srv.nginx = { - enable = lib.mkEnableOption "the NGINX reverse proxy service"; - - openFirewall = lib.mkOption { - type = lib.types.bool; - default = true; - description = "Whether to open ports 80 and 443 in the firewall."; - }; - }; - - config = lib.mkMerge [ - { - _module.args.securityTemplates.restrictToInternal = '' - allow 127.0.0.1; - allow ::1; - - allow ${config.os.core.network.lan.range}; - allow 10.1.0.0/24; - allow ${config.os.core.network.wg.range}; - allow ${config.os.core.network.hs.range}; - - deny all; - ''; - } - - (lib.mkIf cfg.enable { - services.nginx = { - enable = true; - package = pkgs.nginx.override { openssl = pkgs.libressl; }; - - recommendedProxySettings = true; - recommendedTlsSettings = true; - recommendedOptimisation = true; - recommendedGzipSettings = true; - virtualHosts = lib.mkMerge [ - { - "_" = { - default = true; - rejectSSL = true; - locations."/".return = "444"; - }; - } - config.os.cluster.nginxProxies - ]; - }; - - security.acme = { - acceptTerms = true; - defaults.email = "adikro@disroot.org"; - }; - - users.users.nginx.extraGroups = [ "acme" ]; - - networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ - 80 - 443 - ]; - - systemd.tmpfiles.rules = [ - "d /var/log/nginx 0750 nginx adm -" - ]; - }) - ]; -} diff --git a/os/srv/nix-helper.nix b/os/srv/nix-helper.nix deleted file mode 100644 index 5e5e133..0000000 --- a/os/srv/nix-helper.nix +++ /dev/null @@ -1,40 +0,0 @@ -{ - config, - lib, - pkgs, - username, - ... -}: -let - cfg = config.os.srv.nix-helper; -in -{ - options.os.srv.nix-helper.enable = lib.mkEnableOption "enables nix-helper"; - config = lib.mkIf cfg.enable { - nix.settings = { - trusted-users = [ - "root" - "${username}" - ]; - experimental-features = [ - "nix-command" - "flakes" - ]; - }; - - programs.nh = { - enable = true; - flake = "/etc/nixos"; - clean.extraArgs = "--keep 5"; - }; - - environment.sessionVariables = { - NH_OS_FLAKE = "/etc/nixos"; - }; - - environment.systemPackages = with pkgs; [ - nix-output-monitor - nvd - ]; - }; -} diff --git a/os/srv/ntfy.nix b/os/srv/ntfy.nix deleted file mode 100644 index 1417c81..0000000 --- a/os/srv/ntfy.nix +++ /dev/null @@ -1,59 +0,0 @@ -{ - config, - lib, - masterDomain, - ... -}: -let - cfg = config.os.srv.ntfy; -in -{ - options.os.srv.ntfy = { - enable = lib.mkEnableOption "enables ntfy"; - proxyConfig = lib.mkOption { - type = lib.types.attrs; - default = { }; - }; - }; - config = lib.mkIf cfg.enable { - services.ntfy-sh = { - enable = true; - settings = { - base-url = "https://ntfy.${masterDomain}"; - - listen-http = "127.0.0.1:2586"; - - cache-file = "/var/lib/ntfy/cache.db"; - cache-duration = "72h"; - - attachment-cache-dir = "/var/lib/ntfy/attachments"; - attachment-total-size-limit = "5G"; - attachment-file-size-limit = "15M"; - attachment-expiry-duration = "3h"; - - behind-proxy = true; - }; - }; - - os.srv.ntfy.proxyConfig = { - "uptime-kuma.${masterDomain}" = { - enableACME = true; - forceSSL = true; - - locations."/" = { - proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3001"; - extraConfig = '' - proxy_set_header Connection ""; - proxy_connect_timeout 1m; - proxy_send_timeout 1m; - proxy_read_timeout 24h; - - proxy_buffering off; - proxy_request_buffering off; - chunked_transfer_encoding on; - ''; - }; - }; - }; - }; -} diff --git a/os/srv/ntopng.nix b/os/srv/ntopng.nix deleted file mode 100644 index 692fe2c..0000000 --- a/os/srv/ntopng.nix +++ /dev/null @@ -1,43 +0,0 @@ -{ - config, - lib, - masterDomain, - securityTemplates, - ... -}: -let - cfg = config.os.srv.ntopng; -in -{ - options.os.srv.ntopng = { - enable = lib.mkEnableOption "enables ntopng monitoring"; - proxyConfig = lib.mkOption { - type = lib.types.attrs; - default = { }; - }; - }; - config = lib.mkIf cfg.enable { - services.ntopng = { - enable = true; - extraConfig = "--packet-fanout 'cluster' -g 2 -m '192.168.0.0/16,10.0.0.0/8' -X 50000 --community"; - - # TODO fill interfaces - interfaces = [ - "" # WAN Interface - "" # LAN Interface - "" # Virtual Bridge - ]; - }; - os.srv.ntopng.proxyConfig = { - "ntopng.${masterDomain}" = { - enableACME = true; - forceSSL = true; - - locations."/" = { - proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3000"; - extraConfig = securityTemplates.restrictToInternal; - }; - }; - }; - }; -} diff --git a/os/srv/oci.nix b/os/srv/oci.nix deleted file mode 100644 index ea680fd..0000000 --- a/os/srv/oci.nix +++ /dev/null @@ -1,36 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.srv.oci; -in -{ - options.os.srv.oci.enable = lib.mkEnableOption "OCI container support via Podman"; - config = lib.mkIf cfg.enable { - virtualisation = { - containers = { - enable = true; - storage.settings.driver = "zfs"; - }; - podman = { - enable = true; - dockerCompat = true; - defaultNetwork.settings.dns_enabled = true; - autoPrune = { - enable = true; - dates = "weekly"; - flags = [ "--all" ]; - }; - }; - oci-containers.backend = "podman"; - }; - - environment.systemPackages = with pkgs; [ - podman-tui - podman-compose - ]; - }; -} diff --git a/os/srv/omnisearch.nix b/os/srv/omnisearch.nix deleted file mode 100644 index ac36184..0000000 --- a/os/srv/omnisearch.nix +++ /dev/null @@ -1,73 +0,0 @@ -{ - config, - lib, - inputs, - masterDomain, - templates, - ... -}: -let - cfg = config.os.srv.omnisearch; -in -{ - imports = [ inputs.omnisearch.nixosModules.default ]; - - options.os.srv.omnisearch = { - enable = lib.mkEnableOption "enables omnisearch tracking infrastructure"; - - role = lib.mkOption { - type = lib.types.enum [ - "server" - "standalone" - ]; - default = "standalone"; - description = "Designates the deployment method"; - }; - }; - - config = lib.mkIf cfg.enable ( - lib.mkMerge [ - { - services.omnisearch = { - enable = true; - settings = { - server = { - host = "127.0.0.1"; - port = 8087; - locale = "en"; - domain = if cfg.role == "server" then "https://search.${masterDomain}" else "http://localhost:8087"; - }; - proxy = { - max_retries = 3; - randomize_username = true; - randomize_password = true; - }; - cache = { - dir = "/var/cache/omnisearch"; - ttl_search = 1800; - ttl_infobox = 86400; - }; - }; - }; - } - - (lib.mkIf (cfg.role == "server") { - assertions = [ - { - assertion = config.os.srv.nginx.enable; - message = "Required for proxying"; - } - ]; - services.nginx.virtualHosts."search.${masterDomain}" = { - enableACME = true; - forceSSL = true; - locations."/" = { - proxyPass = "http://127.0.0.1:8087"; - proxyWebsockets = true; - extraConfig = templates.restrictToInternal; - }; - }; - }) - ] - ); -} diff --git a/os/srv/postgres.nix b/os/srv/postgres.nix deleted file mode 100644 index f669f63..0000000 --- a/os/srv/postgres.nix +++ /dev/null @@ -1,72 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.srv.postgres; -in -{ - options.os.srv.postgres.enable = lib.mkEnableOption ""; - config = lib.mkIf cfg.enable { - assertions = [ - { - assertion = config.os.srv.sops.enable; - message = "Required for password secure password storing"; - } - { - assertion = config.os.core.network.enableFirewall; - message = "Requires firewall"; - } - ]; - - sops.secrets."postgres/authelia_password" = { - owner = "postgres"; - group = "postgres"; - restartUnits = [ "postgresql.service" ]; - }; - - services.postgresql = { - enable = true; - package = pkgs.postgresql_18; - - extraPlugins = [ config.services.postgresql.package.pkgs.pgvector ]; - - settings = { - listen_addresses = config.os.core.network.ips.database-vm; - - max_connections = 100; - shared_buffers = "256MB"; - work_mem = "4MB"; - }; - - ensureDatabases = [ "authelia" ]; - ensureUsers = [ - { - name = "authelia"; - ensureDBOwnership = true; - } - ]; - - initialScript = pkgs.writeText "init-postgres-passwords.sql" '' - CREATE USER authelia; - ALTER USER authelia WITH PASSWORD 'scram-sha-256'; - ''; - - authentication = pkgs.lib.mkForce '' - local all all trust - host all all 10.0.0.0/24 scram-sha-256 - ''; - }; - - systemd.services.postgresql.postStart = lib.mkAfter '' - PASS=$(cat ${config.sops.secrets."postgres/authelia_password".path}) - ${config.services.postgresql.package}/bin/psql -tAc "ALTER USER authelia WITH PASSWORD '$PASS';" - ''; - - networking.firewall.extraInputRules = '' - ip saddr 10.0.0.0/24 tcp dport 5432 accept - ''; - }; -} diff --git a/os/srv/prometheus.nix b/os/srv/prometheus.nix deleted file mode 100644 index 5b133be..0000000 --- a/os/srv/prometheus.nix +++ /dev/null @@ -1,75 +0,0 @@ -{ - config, - lib, - masterDomain, - ... -}: -let - cfg = config.os.srv.prometheus; -in -{ - options.os.srv.prometheus.enable = lib.mkEnableOption "enables prometheus"; - config = lib.mkIf cfg.enable { - services.prometheus = { - enable = true; - port = 9090; - - scrapeConfigs = [ - { - job_name = "prometheus"; - static_configs = [ { targets = [ "127.0.0.1:9090" ]; } ]; - } - { - job_name = "node-hardware"; - static_configs = [ { targets = [ "127.0.0.1:9100" ]; } ]; - } - { - job_name = "node_exporter"; - static_configs = [ { targets = [ "127.0.0.1:9100" ]; } ]; - } - { - job_name = "bare_metal_host_netdata"; - scheme = "https"; - metrics_path = "/api/v1/allmetrics"; - params = { - format = [ "prometheus" ]; - }; - static_configs = [ - { targets = [ "netdata.${masterDomain}" ]; } - ]; - } - { - job_name = "uptime_kuma"; - metrics_path = "/metrics"; - static_configs = [ { targets = [ "127.0.0.1:3001" ]; } ]; - } - { - job_name = "network-latency"; - static_configs = [ { targets = [ "127.0.0.1:9374" ]; } ]; - } - ]; - exporters = { - node = { - enable = true; - enableCollectors = [ "systemd" ]; - port = 9100; - }; - - smokeping = { - enable = true; - listenAddress = "127.0.0.1"; - - hosts = [ - "10.0.0.1" # Personal Router - "192.168.0.1" # ISP Modem Box - "84.116.254.69" # First ISP Hop - "185.182.244.39" # Regional Katowice Hub - "1.1.1.1" # Cloudflare DNS - "8.8.8.8" # Google DNS - "130.162.223.123" # OCI Instance - ]; - }; - }; - }; - }; -} diff --git a/os/srv/redis.nix b/os/srv/redis.nix deleted file mode 100644 index a51f9db..0000000 --- a/os/srv/redis.nix +++ /dev/null @@ -1,37 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.srv.redis; -in -{ - options.os.srv.redis.enable = lib.mkEnableOption ""; - config = lib.mkIf cfg.enable { - assertions = [ - { - assertion = config.os.srv.sops.enable; - message = "Required for password secure password storing"; - } - { - assertion = config.os.core.network.enableFirewall; - message = "Requires firewall"; - } - ]; - - sops.secrets."redis/password" = { - owner = "redis-main"; - restartUnits = [ "redis-servers-main.service" ]; - }; - - services.redis.servers."main" = { - enable = true; - bind = config.os.core.network.ips.database-vm; - port = 6379; - - requirePassFile = config.sops.secrets."redis/password".path; - }; - - networking.firewall.extraInputRules = '' - ip saddr 10.0.0.0/24 tcp dport 6379 accept - ''; - - }; -} diff --git a/os/srv/restic.nix b/os/srv/restic.nix deleted file mode 100644 index fb2bd19..0000000 --- a/os/srv/restic.nix +++ /dev/null @@ -1,12 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.srv.restic; -in -{ - options.os.srv.restic.enable = lib.mkEnableOption "enables restic backups"; - - config = lib.mkIf cfg.enable { - assertions = [ - ]; - }; -} diff --git a/os/srv/scrutiny.nix b/os/srv/scrutiny.nix deleted file mode 100644 index ffe8c39..0000000 --- a/os/srv/scrutiny.nix +++ /dev/null @@ -1,35 +0,0 @@ -{ - config, - lib, - masterDomain, - securityTemplates, - ... -}: -let - cfg = config.os.srv.scrutiny; -in -{ - options.os.srv.scrutiny.enable = lib.mkEnableOption "enables scrutiny monitoring"; - config = lib.mkIf cfg.enable { - services.scrutiny = { - enable = true; - settings.web.listen.host = "127.0.0.1"; - - collector = { - enable = true; - schedule = "hourly"; - settings.host.id = "bibus-lab"; - }; - }; - - services.nginx.virtualHosts."scrutiny.${masterDomain}" = { - enableACME = true; - forceSSL = true; - - locations."/" = { - proxyPass = "http://127.0.0.1:8080"; - extraConfig = securityTemplates.restrictToInternal; - }; - }; - }; -} diff --git a/os/srv/simplex.nix b/os/srv/simplex.nix deleted file mode 100644 index ca22192..0000000 --- a/os/srv/simplex.nix +++ /dev/null @@ -1,129 +0,0 @@ -{ - config, - lib, - masterDomain, - ... -}: -let - cfg = config.os.srv.simplex; - internalSmpPort = 5223; - internalXftpPort = 5224; -in -{ - options.os.srv.simplex = { - enable = lib.mkEnableOption "enables SimpleX SMP and XFTP containers via Podman"; - tor.enable = lib.mkEnableOption "enables Tor hidden services for SimpleX"; - }; - - config = lib.mkIf cfg.enable ( - lib.mkMerge [ - { - assertions = [ - { - assertion = config.os.srv.oci.enable; - message = "SimpleX requires os.srv.oci to be enabled to run containers."; - } - { - assertion = config.os.srv.nginx.enable; - message = "SimpleX requires os.srv.nginx to be enabled for clearnet proxying."; - } - { - assertion = config.os.srv.sops.enable; - message = "SimpleX requires sops for managing container passwords securely."; - } - ]; - - sops.secrets."simplex/smp-env" = { }; - sops.secrets."simplex/xftp-env" = { }; - - virtualisation.oci-containers.containers = { - simplex-smp = { - image = "simplexchat/smp-server:latest"; - ports = [ "127.0.0.1:${toString internalSmpPort}:5223" ]; - - environment = { - ADDR = "smp.${masterDomain}"; - CONFIG_DIR = "/etc/opt/simplex"; - }; - - environmentFiles = [ config.sops.secrets."simplex/smp-env".path ]; - - volumes = [ - "/var/lib/simplex/smp/config:/etc/opt/simplex:rw" - "/var/lib/simplex/smp/logs:/var/opt/simplex:rw" - "/var/lib/simplex/certs:/certificates:ro" - ]; - }; - - simplex-xftp = { - image = "simplexchat/xftp-server:latest"; - ports = [ "127.0.0.1:${toString internalXftpPort}:443" ]; - - environment = { - ADDR = "xftp.${masterDomain}"; - QUOTA = "10gb"; - }; - - environemntFiles = [ config.sops.secrets."simplex/xftp-env".path ]; - volumes = [ - "/var/lib/simplex/xftp/config:/etc/opt/simplex-xftp:rw" - "/var/lib/simplex/xftp/logs:/var/opt/simplex-xftp:rw" - "/var/lib/simplex/xftp/files:/srv/xftp:rw" - ]; - }; - }; - - systemd.tmpfiles.rules = [ - "d /var/lib/simplex/smp/config 0755 root root -" - "d /var/lib/simplex/smp/logs 0755 root root -" - "d /var/lib/simplex/rsa_certs 0755 root root -" - - "d /var/lib/simplex/xftp/config 0755 root root -" - "d /var/lib/simplex/xftp/logs 0755 root root -" - "d /var/lib/simplex/xftp/files 0755 root root -" - ]; - - networking.firewall.allowedTCPPorts = [ - 5223 - 5224 - ]; - } - - (lib.mkIf cfg.tor.enable { - assertions = [ - { - assertion = config.os.srv.tor.enable; - message = "SimpleX Tor support requires os.srv.tor to be enabled."; - } - ]; - - services.tor.relay.onionServices = { - simplex-smp = { - version = 3; - map = [ - { - port = 5223; - target = { - addr = "127.0.0.1"; - port = internalSmpPort; - }; - } - ]; - }; - simplex-xftp = { - version = 3; - map = [ - { - port = 5224; - target = { - addr = "127.0.0.1"; - port = internalXftpPort; - }; - } - ]; - }; - }; - }) - ] - ); -} diff --git a/os/srv/sops.nix b/os/srv/sops.nix deleted file mode 100644 index 3ca2d16..0000000 --- a/os/srv/sops.nix +++ /dev/null @@ -1,36 +0,0 @@ -{ - config, - lib, - pkgs, - inputs, - username, - ... -}: -let - cfg = config.os.srv.sops; -in -{ - imports = [ inputs.sops-nix.nixosModules.sops ]; - - options.os.srv.sops.enable = lib.mkEnableOption "enables sops-nix"; - config = lib.mkIf cfg.enable { - sops = { - defaultSopsFile = ../../secrets/common.yaml; - defaultSopsFormat = "yaml"; - age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; - - secrets = { - # "syncthing/gui_password".owner = username; - "syncthing/encryption/keepass".owner = username; - "syncthing/encryption/sync".owner = username; - "obs/websocket_password".owner = username; - }; - }; - - environment.systemPackages = with pkgs; [ - sops - age - ssh-to-age - ]; - }; -} diff --git a/os/srv/ssh.nix b/os/srv/ssh.nix deleted file mode 100644 index 63b2034..0000000 --- a/os/srv/ssh.nix +++ /dev/null @@ -1,95 +0,0 @@ -{ - config, - lib, - username, - ... -}: -let - cfg = config.os.srv.ssh; - keys.main = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC610CJfgc3yII7MpLVqzEzQGa8Tsm+dih+CTXHXTnv4"; -in -{ - options.os.srv.ssh = { - server.enable = lib.mkEnableOption "enables the ssh server module"; - client = { - enable = lib.mkEnableOption "enables the ssh client module"; - createAliases = lib.mkEnableOption "enables system-wide SSH shortcuts"; - }; - enableSigning = lib.mkEnableOption "enables signing git commits with ssh keys"; - }; - - config = lib.mkMerge [ - (lib.mkIf cfg.server.enable { - services.openssh = { - enable = true; - - listenAddresses = [ - { - addr = "127.0.0.1"; - port = 22; - } - ] - ++ lib.optional (config.os.core.network ? lan.ip) { - addr = config.os.core.network.lan.ip; - port = 22; - } - ++ lib.optional (config.os.core.network ? wg.ip) { - addr = config.os.core.network.wg.ip; - port = 22; - } - ++ lib.optional (config.os.core.network ? hs.ip) { - addr = config.os.core.network.hs.ip; - port = 22; - }; - hostKeys = [ - { - path = "/etc/ssh/ssh_host_ed25519_key"; - type = "ed25519"; - } - ]; - settings = { - PasswordAuthentication = false; - KbdInteractiveAuthentication = false; - PermitRootLogin = "no"; - - PubkeyAcceptedAlgorithms = "ssh-ed25519"; - }; - }; - - users.users = ( - lib.optionalAttrs (username != "" && username != null) { - ${username}.openssh.authorizedKeys.keys = [ - "${keys.main} adikro@disroot.org" - ]; - } - ); - }) - - (lib.mkIf cfg.client.enable { - programs.ssh.startAgent = true; - services.gnome.gcr-ssh-agent.enable = false; - }) - - (lib.mkIf (cfg.client.enable && cfg.client.createAliases) { - # TODO use hjem - programs.ssh.extraConfig = '' - Host github.com codeberg.org - IdentityFile /home/${username}/.ssh/main_id_ed25519.pub - IdentitiesOnly yes - User git - - Host oci - HostName 130.162.223.123 - User opc - ''; - systemd.tmpfiles.rules = [ - "d /home/${username}/.ssh 0700 ${username} users - -" - "f /home/${username}/.ssh/main_id_ed25519.pub 0644 ${username} users - ${keys.main}" - ]; - }) - - (lib.mkIf cfg.enableSigning { - environment.etc."ssh/allowed_signers".text = "adikro@disroot.org ${keys.main}"; - }) - ]; -} diff --git a/os/srv/sunshine.nix b/os/srv/sunshine.nix deleted file mode 100644 index a347568..0000000 --- a/os/srv/sunshine.nix +++ /dev/null @@ -1,42 +0,0 @@ -{ - config, - lib, - pkgs, - username, - ... -}: -let - cfgSunshine = config.os.srv.sunshine; - cfgMoonlight = config.os.srv.moonlight; -in -{ - options.os.srv = { - sunshine.enable = lib.mkEnableOption "enables sunshine streaming server"; - moonlight.enable = lib.mkEnableOption "enables moonlight streaming client"; - }; - - config = lib.mkMerge [ - (lib.mkIf cfgSunshine.enable { - services.sunshine = { - enable = true; - capSysAdmin = true; - openFirewall = true; - autoStart = false; - }; - - hardware.uinput.enable = true; - - users.users.${username}.extraGroups = [ - "video" - "input" - "render" - ]; - }) - - (lib.mkIf cfgMoonlight.enable { - environment.systemPackages = [ - pkgs.moonlight-qt - ]; - }) - ]; -} diff --git a/os/srv/syncthing.nix b/os/srv/syncthing.nix deleted file mode 100644 index 0c5e53e..0000000 --- a/os/srv/syncthing.nix +++ /dev/null @@ -1,136 +0,0 @@ -{ - config, - lib, - username, - ... -}: -let - cfg = config.os.srv.syncthing; - allFolders = { - "openmw-config" = { - path = "/home/${username}/.config/openmw"; - id = "openmw-config"; - devices = [ "oci" ]; - versioning = { - type = "simple"; - params.keep = "3"; - }; - ignorePatterns = [ - "settings.cfg" - "*.log" - ]; - }; - - "openmw-mods" = { - path = "/home/${username}/games/openmw"; - id = "openmw-mods"; - devices = [ "oci" ]; - versioning = { - type = "trashcan"; - params.cleanoutDays = "7"; - }; - }; - - "game-saves" = { - path = "/home/${username}/.saves"; - id = "game-saves"; - devices = [ "oci" ]; - versioning = { - type = "staggered"; - params = { - cleanInterval = "3600"; - maxAge = "2592000"; - }; - }; - }; - - "keepass" = { - path = "/home/${username}/.keepass"; - id = "keepass"; - devices = [ - { - name = "oci"; - encryptionPasswordFile = config.sops.secrets."syncthing/encryption/keepass".path; - } - ]; - versioning = { - type = "staggered"; - params = { - cleanInterval = "3600"; - maxAge = "31536000"; - }; - }; - }; - - "sync" = { - path = "/home/${username}/sync"; - id = "sync"; - devices = [ - { - name = "oci"; - encryptionPasswordFile = config.sops.secrets."syncthing/encryption/sync".path; - } - ]; - versioning = { - type = "staggered"; - params = { - cleanInterval = "3600"; - maxAge = "15552000"; - }; - }; - }; - - "music" = { - path = "/storage/music"; - id = "music"; - devices = [ "oci" ]; - versioning = { - type = "trashcan"; - params.cleanoutDays = "14"; - }; - }; - }; - activeFoldersSet = lib.filterAttrs (name: _: builtins.elem name cfg.activeFolders) allFolders; - - syncDirs = lib.mapAttrsToList (_: folder: folder.path) activeFoldersSet; -in -{ - options.os.srv.syncthing = { - enable = lib.mkEnableOption "enables syncthing syncing"; - - activeFolders = lib.mkOption { - type = lib.types.listOf ( - lib.types.enum [ - "openmw-config" - "openmw-mods" - "game-saves" - "keepass" - "sync" - "music" - ] - ); - default = [ - "keepass" - "sync" - ]; - description = "List of Syncthing folders to enable and sync on this specific machine."; - }; - }; - config = lib.mkIf cfg.enable { - systemd.tmpfiles.rules = map (path: "d ${path} 0755 ${username} users -") syncDirs; - - services.syncthing = { - enable = true; - user = username; - dataDir = "/home/${username}/.local/share/syncthing"; - configDir = "/home/${username}/.config/syncthing"; - # guiPasswordFile = config.sops.secrets."syncthing/gui_password".path; - - settings = { - devices."oci".id = "DQXGVDC-KGPM6RK-5NDEBJJ-R7PEWYZ-N6Z3WFZ-TSVJG5X-235SHG4-4BEJNQJ"; - - folders = activeFoldersSet; - }; - }; - }; -} diff --git a/os/srv/tailscale.nix b/os/srv/tailscale.nix deleted file mode 100644 index 5c8d72e..0000000 --- a/os/srv/tailscale.nix +++ /dev/null @@ -1,19 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.srv.tailscale; -in -{ - options.os.srv.tailscale.enable = lib.mkEnableOption "enables tailscale vpn"; - - config = lib.mkIf cfg.enable { - services.tailscale = { - enable = true; - openFirewall = true; - useRoutingFeatures = "client"; - }; - networking.firewall = { - trustedInterfaces = [ "tailscale0" ]; - checkReversePath = "loose"; - }; - }; -} diff --git a/os/srv/tor.nix b/os/srv/tor.nix deleted file mode 100644 index 8777fba..0000000 --- a/os/srv/tor.nix +++ /dev/null @@ -1,31 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.srv.tor; -in -{ - options.os.srv.tor = { - enable = lib.mkEnableOption "enables tor services"; - enableBrowser = lib.mkEnableOption "enables the tor browser"; - }; - - config = lib.mkMerge [ - (lib.mkIf cfg.enable { - services.tor = { - enable = true; - client = { - enable = true; - dns.enable = true; - transparentProxy.enable = true; - }; - }; - }) - (lib.mkIf cfg.enableBrowser { - environment.systemPackages = [ pkgs.tor-browser ]; - }) - ]; -} diff --git a/os/srv/ups.nix b/os/srv/ups.nix deleted file mode 100644 index 260f346..0000000 --- a/os/srv/ups.nix +++ /dev/null @@ -1,35 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.srv.ups; -in -{ - options.os.srv.ups.enable = lib.mkEnableOption "enables smooth shutdown on power loss"; - config = lib.mkIf cfg.enable { - power.ups = { - enable = true; - mode = "standalone"; - - ups.main = { - driver = "usbhid-ups"; - port = "auto"; - description = "Main Server UPS"; - }; - users.upsmon = { - # TODO make password - passwordFile = "sops"; - upsmon = "master"; - }; - upsmon.monitor.main = { - system = "main@localhost"; - user = "upsmon"; - # TODO password - passwordFile = "sops"; - type = "master"; - }; - # settings = { - # MINSUPPLIES = 1; - # POWERDOWNFLAG = "/run/killpower"; - # }; - }; - }; -} diff --git a/os/srv/uptime-kuma.nix b/os/srv/uptime-kuma.nix deleted file mode 100644 index 7bf8dd0..0000000 --- a/os/srv/uptime-kuma.nix +++ /dev/null @@ -1,41 +0,0 @@ -{ - config, - lib, - masterDomain, - securityTemplates, - ... -}: -let - cfg = config.os.srv.uptime-kuma; -in -{ - options.os.srv.uptime-kuma = { - enable = lib.mkEnableOption "enables uptime-kuma"; - proxyConfig = lib.mkOption { - type = lib.types.attrs; - default = { }; - }; - }; - config = lib.mkIf cfg.enable { - services.uptime-kuma = { - enable = true; - appriseSupport = true; - settings = { - HOST = "127.0.0.1"; - UPTIME_KUMA_DB_TYPE = "sqlite"; - }; - }; - - os.srv.uptime-kuma.proxyConfig = { - "uptime-kuma.${masterDomain}" = { - enableACME = true; - forceSSL = true; - - locations."/" = { - proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3001"; - extraConfig = securityTemplates.restrictToInternal; - }; - }; - }; - }; -} diff --git a/os/srv/vector.nix b/os/srv/vector.nix deleted file mode 100644 index a216a19..0000000 --- a/os/srv/vector.nix +++ /dev/null @@ -1,79 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.srv.vector; -in -{ - options.os.srv.vector = { - enable = lib.mkEnableOption "Vector observability data framework"; - agent.enable = lib.mkEnableOption "local client daemon to pull journals & stream upstream"; - aggregator.enable = lib.mkEnableOption "central receiver role to bundle, parse, and push to Loki"; - }; - - config = lib.mkIf cfg.enable { - services.vector = { - enable = true; - journaldAccess = lib.mkIf cfg.agent.enable true; - validateConfig = true; - - settings = lib.mkMerge [ - (lib.mkIf cfg.agent.enable { - sources.systemd_journal = { - type = "journald"; - exclude_units = [ "vector.service" ]; - }; - - transforms.filter_logs = { - type = "filter"; - inputs = [ "systemd_journal" ]; - condition = ''.status != "debug" && .status != "trace"''; - }; - - sinks.to_aggregator = { - type = "vector"; - inputs = [ "filter_logs" ]; - address = "${config.os.core.network.ips.vm3-monitor}:9000"; - }; - }) - - (lib.mkIf cfg.aggregator.enable { - sources.upstream_agents = { - type = "vector"; - address = "0.0.0.0:9000"; - version = "2"; - }; - - sources.opnsense_syslog = { - type = "syslog"; - address = "${cfg.aggregator.listenAddress}:5140"; - mode = "udp"; - }; - - sinks.loki_backend = { - type = "loki"; - inputs = [ - "upstream_agents" - "opnsense_syslog" - ]; - endpoint = "http://127.0.0.1:3100"; - labels = { - host = "{{ host }}"; - unit = "{{`{{_SYSTEMD_UNIT}}`}}"; - source_type = "{{ type }}"; - }; - buffer = { - type = "disk"; - max_size = 5 * (1024 * 1024 * 1024); - when_full = "block"; - }; - }; - encoding.codec = "json"; - }) - ]; - }; - - networking.firewall = lib.mkIf cfg.aggregator.enable { - allowedTCPPorts = [ 9000 ]; - allowedUDPPorts = [ 5140 ]; - }; - }; -} diff --git a/os/srv/virtualization.nix b/os/srv/virtualization.nix deleted file mode 100644 index 8ff9f3f..0000000 --- a/os/srv/virtualization.nix +++ /dev/null @@ -1,40 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.srv.virtualization; -in -{ - options.os.srv.virtualization = { - kvm.enable = lib.mkEnableOption "KVM/QEMU virtualization with Virt-Manager"; - waydroid.enable = lib.mkEnableOption "Waydroid Container Virtualization"; - }; - config = lib.mkMerge [ - (lib.mkIf cfg.kvm.enable { - virtualisation.libvirtd = { - enable = true; - qemu.package = pkgs.qemu_kvm; - qemu.swtpm.enable = true; - }; - systemd.services.libvirt-guests.enable = false; - programs.virt-manager.enable = true; - - boot.initrd.kernelModules = - (lib.optional (config.os.core.drivers.cpu == "amd") "kvm-amd") - ++ (lib.optional (config.os.core.drivers.cpu == "intel") "kvm-intel"); - }) - (lib.mkIf cfg.waydroid.enable { - virtualisation.waydroid = { - enable = true; - package = pkgs.waydroid-nftables; - }; - - environment.systemPackages = with pkgs; [ - waydroid-helper - ]; - }) - ]; -} diff --git a/os/srv/wireguard.nix b/os/srv/wireguard.nix deleted file mode 100644 index c758174..0000000 --- a/os/srv/wireguard.nix +++ /dev/null @@ -1,152 +0,0 @@ -{ - config, - lib, - hostname, - masterDomain, - ... -}: -let - cfg = config.os.srv.wireguard; -in -{ - options.os.srv.wireguard = { - enable = lib.mkEnableOption "enables wireguard vpn"; - - role = lib.mkOption { - type = lib.types.enum [ - "server" - "client" - ]; - default = "client"; - description = "where the machine is accepting connections or connecting"; - }; - - server = { - externalInterface = lib.mkOption { - type = lib.types.str; - default = "eth0"; - description = "The public WAN interface of the server"; - }; - publicKey = lib.mkOption { - type = lib.types.nullOr lib.types.str; - default = null; - description = "The public key of your primary WireGuard server node."; - }; - - peers = lib.mkOption { - type = lib.types.listOf ( - lib.types.submodule { - options = { - name = lib.mkOption { type = lib.types.str; }; - publicKey = lib.mkOption { type = lib.types.str; }; - }; - } - ); - default = [ ]; - description = "List of client peers authorized to connect to this server"; - }; - }; - - client = { - index = lib.mkOption { - type = lib.types.nullOr lib.types.int; - default = null; - description = "The assigned host index number for the client IP address"; - }; - - routeAllTraffic = lib.mkOption { - type = lib.types.bool; - default = false; - description = "Routes 100% of your internet traffic through the server when active"; - }; - }; - }; - - config = lib.mkIf cfg.enable ( - lib.mkMerge [ - { - assertions = [ - { - assertion = config.os.srv.sops.enable; - message = "required for wg private key"; - } - ]; - - sops.secrets."wg_private_key/${hostname}" = { - owner = "root"; - group = "root"; - mode = "0600"; - }; - } - - (lib.mkIf (cfg.role == "server") { - assertions = [ - { - assertion = config.os.srv.firewall.enable; - message = "required for opening ports and passthrough"; - } - ]; - boot.kernel.sysctl."net.ipv4.ip_forward" = 1; - networking.firewall.allowedUDPPorts = [ 51280 ]; - - networking.nftables = { - tables.wg-nat = { - family = "inet"; - content = '' - chain forward { - type filter hook forward priority 0; policy accept; - iifname "wg0" accept - oifname "wg0" accept - } - chain postrouting { - type nat hook postrouting priority 100; policy accept; - oifname "${cfg.server.externalInterface}" masquerade - } - ''; - }; - }; - - networking.wireguard.interfaces.wg0 = { - ips = [ "10.3.0.1/24" ]; - listenPort = 51280; - privateKeyFile = config.sops.secrets."wg_private_key/${hostname}".path; - - peers = lib.imap1 (i: peer: { - publicKey = peer.publicKey; - allowedIPs = [ "10.3.0.${toString (i + 1)}/32" ]; - persistentKeepalive = 25; - }) cfg.server.peers; - }; - }) - - (lib.mkIf (cfg.role == "client") { - assertions = [ - { - assertion = cfg.client.index != null; - message = "WireGuard client role requires a valid 'client.index' integer designation."; - } - ]; - - networking.nameservers = [ - config.os.core.network.ips.vm2-gateway - "9.9.9.9" - ]; - - networking.wireguard.interfaces.wg0 = { - ips = [ "10.3.0.${toString cfg.client.index + 1}/24" ]; - privateKeyFile = config.sops.secrets."wg_private_key/${hostname}".path; - - peers = [ - { - publicKey = cfg.server.publicKey; - endpoint = "${masterDomain}:51280"; - persistentKeepalive = 25; - - allowedIPs = if cfg.client.routeAllTraffic then [ "0.0.0.0/0" ] else [ "10.255.0.0/16" ]; - } - ]; - }; - }) - ] - ); -} diff --git a/os/srv/yggdrasil.nix b/os/srv/yggdrasil.nix deleted file mode 100644 index 6fe91af..0000000 --- a/os/srv/yggdrasil.nix +++ /dev/null @@ -1,44 +0,0 @@ -{ - config, - lib, - ... -}: -let - cfg = config.os.srv.yggdrasil; -in -{ - options.os.srv.yggdrasil.enable = lib.mkEnableOption "enables yggdrasil"; - - config = lib.mkIf cfg.enable { - services = { - yggdrasil = { - enable = true; - openMulticastPort = true; - - settings = { - # PrivateKeyPath = config.sops.secrets."yggdrasil-private-key".path; - IfName = "ygg0"; - NodeInfoPrivacy = true; - Peers = [ - "tcp://ip6.fvm.mywire.org:8080?key=000000000143db657d1d6f80b5066dd109a4cb31f7dc6cb5d56050fffb014217" - "tcp://ygg1.mk16.de:1337?key=0000000087ee9949eeab56bd430ee8f324cad55abf3993ed9b9be63ce693e18a" - "tcp://62.210.85.80:39565" - - "tls://ygg1.mk16.de:1338?key=0000000087ee9949eeab56bd430ee8f324cad55abf3993ed9b9be63ce693e18a" - "tls://103.109.234.106:443?key=000000035621c71b5610434589df051aed2688510f904ae79860668dc0fbf182" - "tls://s2.i2pd.xyz:39575" - - "quic://ygg1.mk16.de:1339?key=0000000087ee9949eeab56bd430ee8f324cad55abf3993ed9b9be63ce693e18a" - "quic://ygg6.mk16.de:1339?key=0000005e5ced06fd4d465bc651c5deb6d70cbe82d36efb68c0450268eaaa5384" - "quic://[2a0b:4142:e9e::2]:65535" - ]; - Listen = [ - "tls://0.0.0.0:0" - "tcp://[::]:9001" - ]; - }; - }; - yggdrasil-jumper.enable = true; - }; - }; -} diff --git a/os/vms/microvms.nix b/os/vms/microvms.nix deleted file mode 100644 index e2e1a0f..0000000 --- a/os/vms/microvms.nix +++ /dev/null @@ -1,37 +0,0 @@ -{ - config, - lib, - inputs, - ... -}: -let - cfg = config.os.vms; - sharedSecrets = [ - { - tag = "shared-secrets"; - proto = "virtiofs"; - source = "/etc/nixos/secrets"; - mountPoint = "/etc/nixos/secrets"; - } - ]; -in -{ - imports = [ inputs.microvm.nixosModules.host ]; - - options.os.vms = { - net-core.enable = lib.mkEnableOption "enables the net-core virtual machine"; - }; - - config = lib.mkMerge [ - (lib.mkIf cfg.net-core.enable { - microvm.vms.net-core = { - autostart = true; - config = { - imports = [ ../vms/net-core.nix ]; - microvm.shares = sharedSecrets; - }; - }; - }) - - ]; -} diff --git a/os/vms/net-core.nix b/os/vms/net-core.nix deleted file mode 100644 index a9a1c47..0000000 --- a/os/vms/net-core.nix +++ /dev/null @@ -1,30 +0,0 @@ -{ pkgs, inputs, ... }: -{ - system.stateVersion = "26.11"; - - imports = [ - inputs.microvm.nixosModules.microvm - ../core/default.nix - ]; - - os = { - core = { - allowUnfree.enable = true; - locale.enable = true; - }; - srv = { - ssh = { - server = { - enable = true; - microvm = true; - }; - }; - firewall.enable = true; - sops.enable = true; - }; - }; - - networking.hostName = "net-core"; - - environment.systemPackages = [ pkgs.vis ]; -} diff --git a/os/vms/opnsense.nix b/os/vms/opnsense.nix deleted file mode 100644 index b9f2978..0000000 --- a/os/vms/opnsense.nix +++ /dev/null @@ -1,95 +0,0 @@ -{ - config, - lib, - inputs, - ... -}: -let - cfg = config.os.srv.opnsense; - makePciArgs = - ids: - builtins.concatLists ( - map (id: [ - "-device" - "vfio-pci,host=${id},rombar=0" - ]) ids - ); -in -{ - imports = [ inputs.microvm.nixosModules.host ]; - - options.os.srv.opnsense = { - enable = lib.mkEnableOption "enables an opnsense microvm"; - - pciIDs = lib.mkOption { - type = lib.types.listOf lib.types.str; - default = [ ]; - example = [ - "03:00.0" - "03:00.1" - ]; - description = "List of PCI bus addresses to pass through directly to OPNsense."; - }; - - vendorIDs = lib.mkOption { - type = lib.types.listOf lib.types.str; - default = [ ]; - example = [ "8086:1563" ]; - description = "List of Vendor:Device IDs to bind explicitly to the vfio-pci driver."; - }; - - imagePath = lib.mkOption { - type = lib.types.path; - default = /var/lib/microvm/images/opnsense.qcow2; - description = "Path to the OPNsense qcow2 drive image block."; - }; - }; - - config = lib.mkIf cfg.enable { - boot = { - kernelParams = [ - "intel_iommu=on" - "iommu=pt" - ]; - kernelModules = [ - "vfio_pci" - "vfio" - "vfio_iommu_type1" - ]; - extraModprobeConfig = '' - options vfio-pci ids=${lib.concatStringsSep "," (lib.unique cfg.vendorIDs)} - ''; - }; - - microvm.vms.opnsense = { - autostart = true; - config = { - imports = [ inputs.microvm.nixosModules.microvm ]; - - networking.hostName = "opnsense"; - - microvm = { - vcpu = 4; - mem = 4096; - hypervisor = "qemu"; - - interfaces = [ - { - type = "bridge"; - id = "vtnet0"; - bridge = "br-srv"; - } - ]; - - qemu.extraArgs = [ - "-machine" - "q35,accel=kvm,kernel-irqchip=on" - "-cpu" - "host,migratable=off,+invtsc" - ] - ++ (makePciArgs cfg.pciIDs); - }; - }; - }; - }; -} diff --git a/os/wm/default.nix b/os/wm/default.nix deleted file mode 100644 index a470171..0000000 --- a/os/wm/default.nix +++ /dev/null @@ -1,37 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.wm; -in -{ - imports = [ ./niri.nix ]; - - options.os.wm.enable = lib.mkEnableOption "enables shared wm features"; - - config = lib.mkIf cfg.enable { - services.dbus.enable = true; - - xdg.portal = { - enable = true; - xdgOpenUsePortal = true; - - extraPortals = [ - pkgs.xdg-desktop-portal-gnome - pkgs.xdg-desktop-portal-gtk - ]; - - config = { - common.default = [ "gtk" ]; - niri = { - "org.freedesktop.impl.portal.ScreenCast" = [ "gnome" ]; - "org.freedesktop.impl.portal.Screenshot" = [ "gnome" ]; - "default" = [ "gtk" ]; - }; - }; - }; - }; -} diff --git a/os/wm/niri.nix b/os/wm/niri.nix deleted file mode 100644 index 58d27af..0000000 --- a/os/wm/niri.nix +++ /dev/null @@ -1,28 +0,0 @@ -{ - inputs, - config, - lib, - username, - pkgs, - ... -}: -let - cfg = config.os.wm.niri; -in -{ - imports = [ inputs.niri.nixosModules.niri ]; - - options.os.wm.niri.enable = lib.mkEnableOption "Niri"; - - config = lib.mkIf cfg.enable { - nixpkgs.overlays = [ inputs.niri.overlays.niri ]; - - programs.niri = { - enable = true; - package = pkgs.niri-unstable; - }; - - os.srv.compat.enable = true; - home-manager.users.${username}.hm.env.niri.enable = true; - }; -} |