From 39a2b09c27bb74c9e59d1772764f901e3c8fb9e4 Mon Sep 17 00:00:00 2001 From: adi Date: Wed, 29 Jul 2026 17:09:58 +0200 Subject: revamped flake.nix, removed homelab specific modules --- flake.lock | 811 +++---------------------------- flake.nix | 164 +++---- hosts/bibus-lab/configuration.nix | 13 - hosts/bibus-lab/disko.nix | 249 ---------- hosts/desktop/1 | 119 ----- hosts/desktop/hardware-configuration.nix | 71 --- modules/audio.nix | 96 ++++ modules/bluetooth.nix | 19 + modules/bootloader.nix | 100 ++++ modules/compat.nix | 28 ++ modules/drivers.nix | 99 ++++ modules/files.nix | 55 +++ modules/fonts.nix | 32 ++ modules/gaming.nix | 145 ++++++ modules/greet.nix | 32 ++ modules/i2p.nix | 81 +++ modules/localization.nix | 41 ++ modules/memory.nix | 41 ++ modules/monero.nix | 124 +++++ modules/networking.nix | 186 +++++++ modules/niri.nix | 28 ++ modules/nix-helper.nix | 40 ++ modules/omnisearch.nix | 73 +++ modules/persistance.nix | 50 ++ modules/power.nix | 54 ++ modules/security.nix | 72 +++ modules/sops.nix | 36 ++ modules/ssh.nix | 95 ++++ modules/storage.nix | 21 + modules/syncthing.nix | 136 ++++++ modules/tor.nix | 31 ++ modules/users.nix | 54 ++ modules/virtualization.nix | 40 ++ os/core/audio.nix | 146 ------ os/core/bootloader.nix | 100 ---- os/core/default.nix | 36 -- os/core/drivers.nix | 99 ---- os/core/fonts.nix | 32 -- os/core/greet.nix | 32 -- os/core/home-manager.nix | 44 -- os/core/localization.nix | 41 -- os/core/memory.nix | 41 -- os/core/networking.nix | 186 ------- os/core/persistance.nix | 50 -- os/core/power.nix | 54 -- os/core/security.nix | 72 --- os/core/storage.nix | 21 - os/core/users.nix | 54 -- os/core/zfs.nix | 60 --- os/default.nix | 9 - os/srv/authelia.nix | 179 ------- os/srv/avahi.nix | 41 -- os/srv/backup.nix | 97 ---- os/srv/bluetooth.nix | 19 - os/srv/clamav.nix | 21 - os/srv/cluster.nix | 16 - os/srv/compat.nix | 28 -- os/srv/crowdsec.nix | 181 ------- os/srv/default.nix | 48 -- os/srv/dns.nix | 286 ----------- os/srv/files.nix | 55 --- os/srv/gaming.nix | 145 ------ os/srv/grafana.nix | 109 ----- os/srv/headscale.nix | 76 --- os/srv/i2p.nix | 81 --- os/srv/kea.nix | 58 --- os/srv/lldap.nix | 55 --- os/srv/loki.nix | 62 --- os/srv/mailserver.nix | 59 --- os/srv/monero.nix | 124 ----- os/srv/netdata.nix | 43 -- os/srv/nfs.nix | 26 - os/srv/nginx.nix | 75 --- os/srv/nix-helper.nix | 40 -- os/srv/ntfy.nix | 59 --- os/srv/ntopng.nix | 43 -- os/srv/oci.nix | 36 -- os/srv/omnisearch.nix | 73 --- os/srv/postgres.nix | 72 --- os/srv/prometheus.nix | 75 --- os/srv/redis.nix | 37 -- os/srv/restic.nix | 12 - os/srv/scrutiny.nix | 35 -- os/srv/simplex.nix | 129 ----- os/srv/sops.nix | 36 -- os/srv/ssh.nix | 95 ---- os/srv/sunshine.nix | 42 -- os/srv/syncthing.nix | 136 ------ os/srv/tailscale.nix | 19 - os/srv/tor.nix | 31 -- os/srv/ups.nix | 35 -- os/srv/uptime-kuma.nix | 41 -- os/srv/vector.nix | 79 --- os/srv/virtualization.nix | 40 -- os/srv/wireguard.nix | 152 ------ os/srv/yggdrasil.nix | 44 -- os/vms/microvms.nix | 37 -- os/vms/net-core.nix | 30 -- os/vms/opnsense.nix | 95 ---- os/wm/default.nix | 37 -- os/wm/niri.nix | 28 -- 101 files changed, 1949 insertions(+), 5836 deletions(-) delete mode 100644 hosts/bibus-lab/configuration.nix delete mode 100644 hosts/bibus-lab/disko.nix delete mode 100644 hosts/desktop/1 delete mode 100644 hosts/desktop/hardware-configuration.nix create mode 100644 modules/audio.nix create mode 100644 modules/bluetooth.nix create mode 100644 modules/bootloader.nix create mode 100644 modules/compat.nix create mode 100644 modules/drivers.nix create mode 100644 modules/files.nix create mode 100644 modules/fonts.nix create mode 100644 modules/gaming.nix create mode 100644 modules/greet.nix create mode 100644 modules/i2p.nix create mode 100644 modules/localization.nix create mode 100644 modules/memory.nix create mode 100644 modules/monero.nix create mode 100644 modules/networking.nix create mode 100644 modules/niri.nix create mode 100644 modules/nix-helper.nix create mode 100644 modules/omnisearch.nix create mode 100644 modules/persistance.nix create mode 100644 modules/power.nix create mode 100644 modules/security.nix create mode 100644 modules/sops.nix create mode 100644 modules/ssh.nix create mode 100644 modules/storage.nix create mode 100644 modules/syncthing.nix create mode 100644 modules/tor.nix create mode 100644 modules/users.nix create mode 100644 modules/virtualization.nix delete mode 100644 os/core/audio.nix delete mode 100644 os/core/bootloader.nix delete mode 100644 os/core/default.nix delete mode 100644 os/core/drivers.nix delete mode 100644 os/core/fonts.nix delete mode 100644 os/core/greet.nix delete mode 100644 os/core/home-manager.nix delete mode 100644 os/core/localization.nix delete mode 100644 os/core/memory.nix delete mode 100644 os/core/networking.nix delete mode 100644 os/core/persistance.nix delete mode 100644 os/core/power.nix delete mode 100644 os/core/security.nix delete mode 100644 os/core/storage.nix delete mode 100644 os/core/users.nix delete mode 100644 os/core/zfs.nix delete mode 100644 os/default.nix delete mode 100644 os/srv/authelia.nix delete mode 100644 os/srv/avahi.nix delete mode 100644 os/srv/backup.nix delete mode 100644 os/srv/bluetooth.nix delete mode 100644 os/srv/clamav.nix delete mode 100644 os/srv/cluster.nix delete mode 100644 os/srv/compat.nix delete mode 100644 os/srv/crowdsec.nix delete mode 100644 os/srv/default.nix delete mode 100644 os/srv/dns.nix delete mode 100644 os/srv/files.nix delete mode 100644 os/srv/gaming.nix delete mode 100644 os/srv/grafana.nix delete mode 100644 os/srv/headscale.nix delete mode 100644 os/srv/i2p.nix delete mode 100644 os/srv/kea.nix delete mode 100644 os/srv/lldap.nix delete mode 100644 os/srv/loki.nix delete mode 100644 os/srv/mailserver.nix delete mode 100644 os/srv/monero.nix delete mode 100644 os/srv/netdata.nix delete mode 100644 os/srv/nfs.nix delete mode 100644 os/srv/nginx.nix delete mode 100644 os/srv/nix-helper.nix delete mode 100644 os/srv/ntfy.nix delete mode 100644 os/srv/ntopng.nix delete mode 100644 os/srv/oci.nix delete mode 100644 os/srv/omnisearch.nix delete mode 100644 os/srv/postgres.nix delete mode 100644 os/srv/prometheus.nix delete mode 100644 os/srv/redis.nix delete mode 100644 os/srv/restic.nix delete mode 100644 os/srv/scrutiny.nix delete mode 100644 os/srv/simplex.nix delete mode 100644 os/srv/sops.nix delete mode 100644 os/srv/ssh.nix delete mode 100644 os/srv/sunshine.nix delete mode 100644 os/srv/syncthing.nix delete mode 100644 os/srv/tailscale.nix delete mode 100644 os/srv/tor.nix delete mode 100644 os/srv/ups.nix delete mode 100644 os/srv/uptime-kuma.nix delete mode 100644 os/srv/vector.nix delete mode 100644 os/srv/virtualization.nix delete mode 100644 os/srv/wireguard.nix delete mode 100644 os/srv/yggdrasil.nix delete mode 100644 os/vms/microvms.nix delete mode 100644 os/vms/net-core.nix delete mode 100644 os/vms/opnsense.nix delete mode 100644 os/wm/default.nix delete mode 100644 os/wm/niri.nix diff --git a/flake.lock b/flake.lock index ced4b22..c5ffb4d 100644 --- a/flake.lock +++ b/flake.lock @@ -18,22 +18,6 @@ "url": "https://git.bwaaa.monster/beaker" } }, - "blobs": { - "flake": false, - "locked": { - "lastModified": 1604995301, - "narHash": "sha256-wcLzgLec6SGJA8fx1OEN1yV/Py5b+U5iyYpksUY/yLw=", - "owner": "simple-nixos-mailserver", - "repo": "blobs", - "rev": "2cccdf1ca48316f2cfd1c9a0017e8de5a7156265", - "type": "gitlab" - }, - "original": { - "owner": "simple-nixos-mailserver", - "repo": "blobs", - "type": "gitlab" - } - }, "disko": { "inputs": { "nixpkgs": [ @@ -56,35 +40,12 @@ } }, "fenix": { - "inputs": { - "nixpkgs": [ - "fsel", - "naersk", - "nixpkgs" - ], - "rust-analyzer-src": "rust-analyzer-src" - }, - "locked": { - "lastModified": 1752475459, - "narHash": "sha256-z6QEu4ZFuHiqdOPbYss4/Q8B0BFhacR8ts6jO/F/aOU=", - "owner": "nix-community", - "repo": "fenix", - "rev": "bf0d6f70f4c9a9cf8845f992105652173f4b617f", - "type": "github" - }, - "original": { - "owner": "nix-community", - "repo": "fenix", - "type": "github" - } - }, - "fenix_2": { "inputs": { "nixpkgs": [ "openmw-nix", "nixpkgs" ], - "rust-analyzer-src": "rust-analyzer-src_2" + "rust-analyzer-src": "rust-analyzer-src" }, "locked": { "lastModified": 1759560021, @@ -101,38 +62,6 @@ } }, "flake-compat": { - "flake": false, - "locked": { - "lastModified": 1767039857, - "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=", - "owner": "NixOS", - "repo": "flake-compat", - "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab", - "type": "github" - }, - "original": { - "owner": "NixOS", - "repo": "flake-compat", - "type": "github" - } - }, - "flake-compat_2": { - "flake": false, - "locked": { - "lastModified": 1777699697, - "narHash": "sha256-Eg9b/rq/ECYwNwEXs5i9wHyhxNI0JrYx2srdI2uZMaQ=", - "ref": "refs/heads/main", - "rev": "382052b74656a369c5408822af3f2501e9b1af81", - "revCount": 94, - "type": "git", - "url": "https://git.lix.systems/lix-project/flake-compat.git" - }, - "original": { - "type": "git", - "url": "https://git.lix.systems/lix-project/flake-compat.git" - } - }, - "flake-compat_3": { "flake": false, "locked": { "lastModified": 1650374568, @@ -148,35 +77,16 @@ "type": "github" } }, - "flake-compat_4": { - "flake": false, - "locked": { - "lastModified": 1767039857, - "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=", - "owner": "edolstra", - "repo": "flake-compat", - "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab", - "type": "github" - }, - "original": { - "owner": "edolstra", - "repo": "flake-compat", - "type": "github" - } - }, "flake-parts": { "inputs": { - "nixpkgs-lib": [ - "nixvim", - "nixpkgs" - ] + "nixpkgs-lib": "nixpkgs-lib" }, "locked": { - "lastModified": 1778716662, - "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=", + "lastModified": 1782949081, + "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb", + "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e", "type": "github" }, "original": { @@ -187,28 +97,7 @@ }, "flake-parts_2": { "inputs": { - "nixpkgs-lib": [ - "nvf", - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1778716662, - "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=", - "owner": "hercules-ci", - "repo": "flake-parts", - "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb", - "type": "github" - }, - "original": { - "owner": "hercules-ci", - "repo": "flake-parts", - "type": "github" - } - }, - "flake-parts_3": { - "inputs": { - "nixpkgs-lib": "nixpkgs-lib" + "nixpkgs-lib": "nixpkgs-lib_2" }, "locked": { "lastModified": 1768135262, @@ -229,11 +118,11 @@ "systems": "systems" }, "locked": { - "lastModified": 1731533236, - "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", + "lastModified": 1694529238, + "narHash": "sha256-zsNZZGTGnMOf9YpHKJqMSsa0dXbfmxeoJ7xHlrt+xmY=", "owner": "numtide", "repo": "flake-utils", - "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", + "rev": "ff7b65b44d01cf9ba6a71320833626af21126384", "type": "github" }, "original": { @@ -244,7 +133,7 @@ }, "flake-utils-plus": { "inputs": { - "flake-utils": "flake-utils_2" + "flake-utils": "flake-utils" }, "locked": { "lastModified": 1715533576, @@ -261,134 +150,27 @@ "type": "github" } }, - "flake-utils_2": { + "hjem": { "inputs": { - "systems": "systems_4" - }, - "locked": { - "lastModified": 1694529238, - "narHash": "sha256-zsNZZGTGnMOf9YpHKJqMSsa0dXbfmxeoJ7xHlrt+xmY=", - "owner": "numtide", - "repo": "flake-utils", - "rev": "ff7b65b44d01cf9ba6a71320833626af21126384", - "type": "github" - }, - "original": { - "owner": "numtide", - "repo": "flake-utils", - "type": "github" - } - }, - "flake-utils_3": { - "inputs": { - "systems": "systems_6" - }, - "locked": { - "lastModified": 1731533236, - "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", - "owner": "numtide", - "repo": "flake-utils", - "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", - "type": "github" - }, - "original": { - "owner": "numtide", - "repo": "flake-utils", - "type": "github" - } - }, - "fsel": { - "inputs": { - "flake-utils": "flake-utils", - "naersk": "naersk", "nixpkgs": [ "nixpkgs" ] }, "locked": { - "lastModified": 1781478132, - "narHash": "sha256-XGKD/DId5Eont4ytPV7LfGvykDRalMWx4pbkRVUNzxY=", - "owner": "Mjoyufull", - "repo": "fsel", - "rev": "8a12d4f35e78297f3e2d55e026185710bff38338", + "lastModified": 1784896036, + "narHash": "sha256-EAadJywc5P9CSIB7212S5jpQX48aTfYUbsJeAIbQaVI=", + "owner": "feel-co", + "repo": "hjem", + "rev": "08d2b170a74a102c230c9651d8989fe6b39dfad8", "type": "github" }, "original": { - "owner": "Mjoyufull", - "repo": "fsel", - "type": "github" - } - }, - "git-hooks": { - "inputs": { - "flake-compat": [ - "nixos-mailserver", - "flake-compat" - ], - "gitignore": "gitignore", - "nixpkgs": [ - "nixos-mailserver", - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1778507602, - "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=", - "owner": "cachix", - "repo": "git-hooks.nix", - "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a", - "type": "github" - }, - "original": { - "owner": "cachix", - "repo": "git-hooks.nix", - "type": "github" - } - }, - "gitignore": { - "inputs": { - "nixpkgs": [ - "nixos-mailserver", - "git-hooks", - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1709087332, - "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=", - "owner": "hercules-ci", - "repo": "gitignore.nix", - "rev": "637db329424fd7e46cf4185293b9cc8c88c95394", - "type": "github" - }, - "original": { - "owner": "hercules-ci", - "repo": "gitignore.nix", + "owner": "feel-co", + "repo": "hjem", "type": "github" } }, "home-manager": { - "inputs": { - "nixpkgs": [ - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1782657028, - "narHash": "sha256-PHTCpYZCMzJYS3phhywqRAZphKVr2zjvlGYa+H20ZZ4=", - "owner": "nix-community", - "repo": "home-manager", - "rev": "4ad9aaae70c9aaab504127f926c0fa9cfbc2b365", - "type": "github" - }, - "original": { - "owner": "nix-community", - "ref": "master", - "repo": "home-manager", - "type": "github" - } - }, - "home-manager_2": { "inputs": { "nixpkgs": [ "impermanence", @@ -409,7 +191,7 @@ "type": "github" } }, - "home-manager_3": { + "home-manager_2": { "inputs": { "nixpkgs": [ "otter-launcher", @@ -432,7 +214,7 @@ }, "impermanence": { "inputs": { - "home-manager": "home-manager_2", + "home-manager": "home-manager", "nixpkgs": [ "nixpkgs" ] @@ -451,42 +233,6 @@ "type": "github" } }, - "microvm": { - "inputs": { - "nixpkgs": [ - "nixpkgs" - ], - "spectrum": "spectrum" - }, - "locked": { - "lastModified": 1782324740, - "narHash": "sha256-EpaYlgijQUv8nvbhMStQEFoO7aDWxJmVTOlsoHWqHpg=", - "owner": "microvm-nix", - "repo": "microvm.nix", - "rev": "49a3e9fe33d33f189d24dafca36096766faa60ad", - "type": "github" - }, - "original": { - "owner": "microvm-nix", - "repo": "microvm.nix", - "type": "github" - } - }, - "mnw": { - "locked": { - "lastModified": 1780772958, - "narHash": "sha256-VKKe8r4pwCGWZ3Yr9CPN129R4S3CKLSrlYqdYz3vKpM=", - "owner": "Gerg-L", - "repo": "mnw", - "rev": "0871dbf63a53610c95db04439ed8ea4d6ec9c160", - "type": "github" - }, - "original": { - "owner": "Gerg-L", - "repo": "mnw", - "type": "github" - } - }, "mygui": { "locked": { "lastModified": 1716480759, @@ -503,93 +249,16 @@ "type": "github" } }, - "naersk": { - "inputs": { - "fenix": "fenix", - "nixpkgs": "nixpkgs" - }, - "locked": { - "lastModified": 1776200608, - "narHash": "sha256-broZ6RFQr4Fv0wT73gGmzNX14A43TmTFF8g4wDKlNss=", - "owner": "nix-community", - "repo": "naersk", - "rev": "8b23250ab45c2a38cd91031aee26478ca4d0a28e", - "type": "github" - }, - "original": { - "owner": "nix-community", - "repo": "naersk", - "type": "github" - } - }, - "niri": { - "inputs": { - "niri-stable": "niri-stable", - "niri-unstable": "niri-unstable", - "nixpkgs": [ - "nixpkgs" - ], - "nixpkgs-stable": "nixpkgs-stable", - "xwayland-satellite-stable": "xwayland-satellite-stable", - "xwayland-satellite-unstable": "xwayland-satellite-unstable" - }, - "locked": { - "lastModified": 1782592242, - "narHash": "sha256-kgINba6Ilpj3rdTi2BeKlQBs6ZxTdu3Gb49U5gDUVhg=", - "owner": "sodiboo", - "repo": "niri-flake", - "rev": "9e26dfe0fb8d61475b6f9e8d63477fe92509f1db", - "type": "github" - }, - "original": { - "owner": "sodiboo", - "repo": "niri-flake", - "type": "github" - } - }, - "niri-stable": { - "flake": false, - "locked": { - "lastModified": 1756556321, - "narHash": "sha256-RLD89dfjN0RVO86C/Mot0T7aduCygPGaYbog566F0Qo=", - "owner": "YaLTeR", - "repo": "niri", - "rev": "01be0e65f4eb91a9cd624ac0b76aaeab765c7294", - "type": "github" - }, - "original": { - "owner": "YaLTeR", - "ref": "v25.08", - "repo": "niri", - "type": "github" - } - }, - "niri-unstable": { - "flake": false, - "locked": { - "lastModified": 1781781064, - "narHash": "sha256-Ii/koEm/sRyg65qbAQWqEgboSEIhdH0EL4KglAc14p0=", - "owner": "YaLTeR", - "repo": "niri", - "rev": "49fc6117fd6c043adaa2ead316b82db5ed735d36", - "type": "github" - }, - "original": { - "owner": "YaLTeR", - "repo": "niri", - "type": "github" - } - }, "nixos-hardware": { "inputs": { - "nixpkgs": "nixpkgs_2" + "nixpkgs": "nixpkgs" }, "locked": { - "lastModified": 1782562157, - "narHash": "sha256-a7+T6QSeowynwZ1ZJJbP8T8ntAytvrui8kFGJmIZt2c=", + "lastModified": 1784723954, + "narHash": "sha256-1CfD8ZUjCkTgjsneLZ/lxCHhgDfqxxE7/GX0MmsgiqA=", "owner": "NixOS", "repo": "nixos-hardware", - "rev": "a9cf7546a938c737b079e738de73934a13de9784", + "rev": "a017f5b72210026af5b3ac5949f08d94380a6fbd", "type": "github" }, "original": { @@ -599,47 +268,35 @@ "type": "github" } }, - "nixos-mailserver": { - "inputs": { - "blobs": "blobs", - "flake-compat": "flake-compat", - "git-hooks": "git-hooks", - "nixpkgs": [ - "nixpkgs" - ] - }, + "nixpkgs": { "locked": { - "lastModified": 1781892035, - "narHash": "sha256-e46EhlHo0jupcYCLE4QJRitd3+y+RgIQYNcfcCdLbKg=", - "owner": "simple-nixos-mailserver", - "repo": "nixos-mailserver", - "rev": "c37fd9c40877450716692b6478e6dda330dfc46a", - "type": "gitlab" + "lastModified": 1767892417, + "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=", + "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba", + "type": "tarball", + "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz" }, "original": { - "owner": "simple-nixos-mailserver", - "ref": "main", - "repo": "nixos-mailserver", - "type": "gitlab" + "type": "tarball", + "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz" } }, - "nixpkgs": { + "nixpkgs-lib": { "locked": { - "lastModified": 1752077645, - "narHash": "sha256-HM791ZQtXV93xtCY+ZxG1REzhQenSQO020cu6rHtAPk=", - "owner": "NixOS", - "repo": "nixpkgs", - "rev": "be9e214982e20b8310878ac2baa063a961c1bdf6", + "lastModified": 1782614948, + "narHash": "sha256-ePjCwr1sNm9NYUqywL7QfK3JnlS015msC+eBu2zKlp8=", + "owner": "nix-community", + "repo": "nixpkgs.lib", + "rev": "db3f255737b94216eb71cce308e2912cf6bc2d7c", "type": "github" }, "original": { - "owner": "NixOS", - "ref": "nixpkgs-unstable", - "repo": "nixpkgs", + "owner": "nix-community", + "repo": "nixpkgs.lib", "type": "github" } }, - "nixpkgs-lib": { + "nixpkgs-lib_2": { "locked": { "lastModified": 1765674936, "narHash": "sha256-k00uTP4JNfmejrCLJOwdObYC9jHRrr/5M/a/8L2EIdo=", @@ -656,27 +313,11 @@ }, "nixpkgs-stable": { "locked": { - "lastModified": 1782498288, - "narHash": "sha256-8/X3yyTXiE82b38n32ItbOqfWOVBl+gKa8fILyZfR4Q=", + "lastModified": 1784856561, + "narHash": "sha256-J+Bx1Z6Oeoj2FgnBhRMKyUhhtDoOpTgXYaVLZpDjW4A=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "3cac626ec5e3703e835f227687e88aa9e2f25701", - "type": "github" - }, - "original": { - "owner": "NixOS", - "ref": "nixos-25.11", - "repo": "nixpkgs", - "type": "github" - } - }, - "nixpkgs-stable_2": { - "locked": { - "lastModified": 1782535326, - "narHash": "sha256-ZeRxu4yn6shd3SNF5ZUQb4r7BaVo1zBKMjRhfoNSBmw=", - "owner": "NixOS", - "repo": "nixpkgs", - "rev": "714a5f8c4ead6b31148d829288440ed033ccc041", + "rev": "597283ad8aa0b331c788e97c4c262d58877074ef", "type": "github" }, "original": { @@ -688,24 +329,11 @@ }, "nixpkgs_2": { "locked": { - "lastModified": 1767892417, - "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=", - "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba", - "type": "tarball", - "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz" - }, - "original": { - "type": "tarball", - "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz" - } - }, - "nixpkgs_3": { - "locked": { - "lastModified": 1782467914, - "narHash": "sha256-pGvFkM8N0xEkIIXDe5YYfbEAvHrk4IxBrjB/x8OomhE=", + "lastModified": 1784796856, + "narHash": "sha256-wWFrV5/Qbm+lyt5x20E/bSbfJiGKMo4RCxZV8cl/WZI=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "e73de5be04e0eff4190a1432b946d469c794e7b4", + "rev": "e2587caef70cea85dd97d7daab492899902dbf5d", "type": "github" }, "original": { @@ -715,87 +343,38 @@ "type": "github" } }, - "nixpkgs_4": { + "nixpkgs_3": { "locked": { - "lastModified": 1744536153, - "narHash": "sha256-awS2zRgF4uTwrOKwwiJcByDzDOdo3Q1rPZbiHQg/N38=", + "lastModified": 1773734432, + "narHash": "sha256-IF5ppUWh6gHGHYDbtVUyhwy/i7D261P7fWD1bPefOsw=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "18dd725c29603f582cf1900e0d25f9f1063dbf11", + "rev": "cda48547b432e8d3b18b4180ba07473762ec8558", "type": "github" }, "original": { "owner": "NixOS", - "ref": "nixpkgs-unstable", + "ref": "nixos-unstable", "repo": "nixpkgs", "type": "github" } }, - "nixvim": { - "inputs": { - "flake-parts": "flake-parts", - "nixpkgs": [ - "nixpkgs" - ], - "systems": "systems_2" - }, - "locked": { - "lastModified": 1782254890, - "narHash": "sha256-kjsEECqhpPnJWqhooXp6tWh2qGQftCPAo2G1GvZtKdw=", - "owner": "nix-community", - "repo": "nixvim", - "rev": "dbf9550dba8448b03e11d58e5695d6c44a464554", - "type": "github" - }, - "original": { - "owner": "nix-community", - "repo": "nixvim", - "type": "github" - } - }, - "nvf": { - "inputs": { - "flake-compat": "flake-compat_2", - "flake-parts": "flake-parts_2", - "mnw": "mnw", - "nixpkgs": [ - "nixpkgs" - ], - "systems": "systems_3" - }, - "locked": { - "lastModified": 1782660650, - "narHash": "sha256-d4Ndt82q9bhL+iKFr1reufZyE/MTdULzN3kEkXsNG88=", - "owner": "NotAShelf", - "repo": "nvf", - "rev": "18d2d23191250c7f597d85da07d860eb05f9e1be", - "type": "github" - }, - "original": { - "owner": "NotAShelf", - "repo": "nvf", - "type": "github" - } - }, "omnisearch": { "inputs": { "beaker-src": "beaker-src", - "nixpkgs": [ - "nixpkgs" - ] + "nixpkgs": "nixpkgs_3" }, "locked": { - "lastModified": 1778546173, - "narHash": "sha256-nhSXc+jaOYlDGr5beX+LMcw0BeA5SdWH28aCrV1QMPg=", + "lastModified": 1783357409, + "narHash": "sha256-eolp0Msb3ACNatbenEJftjFlUoh/RfZDizv3GdetEsM=", "ref": "refs/heads/master", - "rev": "24f9909badd4e7aa1f3aeef717b93e9b71c20a4e", - "revCount": 123, + "rev": "9c68a8ae6fb32f8a1660da392b9985a4ab3e7cb4", + "revCount": 135, "shallow": false, "type": "git", "url": "https://git.bwaaa.monster/omnisearch" }, "original": { - "rev": "24f9909badd4e7aa1f3aeef717b93e9b71c20a4e", "shallow": false, "type": "git", "url": "https://git.bwaaa.monster/omnisearch" @@ -803,7 +382,7 @@ }, "openmw-nix": { "inputs": { - "fenix": "fenix_2", + "fenix": "fenix", "mygui": "mygui", "nixpkgs": [ "nixpkgs" @@ -826,19 +405,19 @@ }, "otter-launcher": { "inputs": { - "flake-parts": "flake-parts_3", - "home-manager": "home-manager_3", + "flake-parts": "flake-parts_2", + "home-manager": "home-manager_2", "nixpkgs": [ "nixpkgs" ], - "systems": "systems_5" + "systems": "systems_2" }, "locked": { - "lastModified": 1780973227, - "narHash": "sha256-vlNT2248Oxg3++bk8ZkozsU4wDbxOkh6dl3GeoBmmXE=", + "lastModified": 1783875707, + "narHash": "sha256-Ryg3PqFcGydelQpgPF0j8GMaXaGDrNTSesEy6fDw/eg=", "owner": "kuokuo123", "repo": "otter-launcher", - "rev": "764a38d1de308da3268222692652a0a85bb71eee", + "rev": "242e5da4f0acc0b4301be7b4546f5afb3e4b23d6", "type": "github" }, "original": { @@ -850,45 +429,20 @@ "root": { "inputs": { "disko": "disko", - "fsel": "fsel", - "home-manager": "home-manager", + "flake-parts": "flake-parts", + "hjem": "hjem", "impermanence": "impermanence", - "microvm": "microvm", - "niri": "niri", "nixos-hardware": "nixos-hardware", - "nixos-mailserver": "nixos-mailserver", - "nixpkgs": "nixpkgs_3", - "nixpkgs-stable": "nixpkgs-stable_2", - "nixvim": "nixvim", - "nvf": "nvf", + "nixpkgs": "nixpkgs_2", + "nixpkgs-stable": "nixpkgs-stable", "omnisearch": "omnisearch", "openmw-nix": "openmw-nix", "otter-launcher": "otter-launcher", - "satty": "satty", "sls-steam": "sls-steam", - "sops-nix": "sops-nix", - "waybar": "waybar", - "yazi": "yazi" + "sops-nix": "sops-nix" } }, "rust-analyzer-src": { - "flake": false, - "locked": { - "lastModified": 1752428706, - "narHash": "sha256-EJcdxw3aXfP8Ex1Nm3s0awyH9egQvB2Gu+QEnJn2Sfg=", - "owner": "rust-lang", - "repo": "rust-analyzer", - "rev": "591e3b7624be97e4443ea7b5542c191311aa141d", - "type": "github" - }, - "original": { - "owner": "rust-lang", - "ref": "nightly", - "repo": "rust-analyzer", - "type": "github" - } - }, - "rust-analyzer-src_2": { "flake": false, "locked": { "lastModified": 1759301569, @@ -905,66 +459,6 @@ "type": "github" } }, - "rust-overlay": { - "inputs": { - "nixpkgs": "nixpkgs_4" - }, - "locked": { - "lastModified": 1748140821, - "narHash": "sha256-GZcjWLQtDifSYMd1ueLDmuVTcQQdD5mONIBTqABooOk=", - "owner": "oxalica", - "repo": "rust-overlay", - "rev": "476b2ba7dc99ddbf70b1f45357dbbdbdbdfb4422", - "type": "github" - }, - "original": { - "owner": "oxalica", - "repo": "rust-overlay", - "type": "github" - } - }, - "rust-overlay_2": { - "inputs": { - "nixpkgs": [ - "yazi", - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1779851998, - "narHash": "sha256-UkkMh3bX9QW4Luqkm98nUaOqKWrU6i65mUnph3WeSSw=", - "owner": "oxalica", - "repo": "rust-overlay", - "rev": "6cddd512fa2bf7231f098d3a2f92f6e4cff71e0a", - "type": "github" - }, - "original": { - "owner": "oxalica", - "repo": "rust-overlay", - "type": "github" - } - }, - "satty": { - "inputs": { - "nixpkgs": [ - "nixpkgs" - ], - "rust-overlay": "rust-overlay" - }, - "locked": { - "lastModified": 1782542860, - "narHash": "sha256-79L/yxMuJHS+Dfpt7y4wXvgNJILux0jv6mnVFxanqKc=", - "owner": "gabm", - "repo": "Satty", - "rev": "ff0c0d350d233f446c868e7ca4c13cfb67d0c43d", - "type": "github" - }, - "original": { - "owner": "gabm", - "repo": "Satty", - "type": "github" - } - }, "sls-steam": { "inputs": { "nixpkgs": [ @@ -972,11 +466,11 @@ ] }, "locked": { - "lastModified": 1782389855, - "narHash": "sha256-LhalI4N/bv20fvi0ag+f6ESWLS5VbOdzJKLoEGnJDMk=", + "lastModified": 1785003674, + "narHash": "sha256-XZ0VVFYOBudkEtnfnLoSu0dfXt2ENDQMk5QT7J8f9/w=", "owner": "AceSLS", "repo": "SLSsteam", - "rev": "ceb07e711cc0e831b2851236b46629827f87bbc4", + "rev": "9927612e5d0acb43f9ff6818fcfbbbadedfdd818", "type": "github" }, "original": { @@ -987,7 +481,7 @@ }, "snowfall-lib": { "inputs": { - "flake-compat": "flake-compat_3", + "flake-compat": "flake-compat", "flake-utils-plus": "flake-utils-plus", "nixpkgs": [ "openmw-nix", @@ -1015,11 +509,11 @@ ] }, "locked": { - "lastModified": 1782165805, - "narHash": "sha256-478kKQBvK6SYTOdN2h9jhKJv94nbXRbFMfuL1WshErg=", + "lastModified": 1783174389, + "narHash": "sha256-aCWC8ngycU7OdJrU2+Je3qf+1a2ykuBvpPhZT/9tXMc=", "owner": "Mic92", "repo": "sops-nix", - "rev": "56b24064fdcaedca53553b1a6d607fd23b613a24", + "rev": "f1406619a3884cd5c47992a70b8b35c9c0fcb4c9", "type": "github" }, "original": { @@ -1028,22 +522,6 @@ "type": "github" } }, - "spectrum": { - "flake": false, - "locked": { - "lastModified": 1778940603, - "narHash": "sha256-voSM8dZNlaOWN3kbYFky+FNY6fFQOEw0xF+ZMpZKkCQ=", - "ref": "refs/heads/main", - "rev": "367dd227f539267eae2b62770b4c17b88ac8c1f1", - "revCount": 1265, - "type": "git", - "url": "https://spectrum-os.org/git/spectrum" - }, - "original": { - "type": "git", - "url": "https://spectrum-os.org/git/spectrum" - } - }, "systems": { "locked": { "lastModified": 1681028828, @@ -1060,52 +538,6 @@ } }, "systems_2": { - "locked": { - "lastModified": 1774449309, - "narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=", - "owner": "nix-systems", - "repo": "default", - "rev": "c29398b59d2048c4ab79345812849c9bd15e9150", - "type": "github" - }, - "original": { - "owner": "nix-systems", - "ref": "future-26.11", - "repo": "default", - "type": "github" - } - }, - "systems_3": { - "locked": { - "lastModified": 1681028828, - "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", - "owner": "nix-systems", - "repo": "default", - "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", - "type": "github" - }, - "original": { - "owner": "nix-systems", - "repo": "default", - "type": "github" - } - }, - "systems_4": { - "locked": { - "lastModified": 1681028828, - "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", - "owner": "nix-systems", - "repo": "default", - "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", - "type": "github" - }, - "original": { - "owner": "nix-systems", - "repo": "default", - "type": "github" - } - }, - "systems_5": { "locked": { "lastModified": 1689347949, "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=", @@ -1119,97 +551,6 @@ "repo": "default-linux", "type": "github" } - }, - "systems_6": { - "locked": { - "lastModified": 1681028828, - "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", - "owner": "nix-systems", - "repo": "default", - "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", - "type": "github" - }, - "original": { - "owner": "nix-systems", - "repo": "default", - "type": "github" - } - }, - "waybar": { - "inputs": { - "flake-compat": "flake-compat_4", - "nixpkgs": [ - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1777929458, - "narHash": "sha256-51R3mIt8cLNvh/X5qe9vOqeJCj0U9KRyemVE5y+OhiU=", - "owner": "Alexays", - "repo": "Waybar", - "rev": "05945748dccce28bf96d26d8f64a9e69a8dd49ba", - "type": "github" - }, - "original": { - "owner": "Alexays", - "repo": "Waybar", - "type": "github" - } - }, - "xwayland-satellite-stable": { - "flake": false, - "locked": { - "lastModified": 1755491097, - "narHash": "sha256-m+9tUfsmBeF2Gn4HWa6vSITZ4Gz1eA1F5Kh62B0N4oE=", - "owner": "Supreeeme", - "repo": "xwayland-satellite", - "rev": "388d291e82ffbc73be18169d39470f340707edaa", - "type": "github" - }, - "original": { - "owner": "Supreeeme", - "ref": "v0.7", - "repo": "xwayland-satellite", - "type": "github" - } - }, - "xwayland-satellite-unstable": { - "flake": false, - "locked": { - "lastModified": 1781226823, - "narHash": "sha256-28696iIw8uE0ZUyFTtzhEM8xMh85clCYypMxkvUi+sc=", - "owner": "Supreeeme", - "repo": "xwayland-satellite", - "rev": "8575d0ef55d70f9b4c46b6bffb3accf912217e1e", - "type": "github" - }, - "original": { - "owner": "Supreeeme", - "repo": "xwayland-satellite", - "type": "github" - } - }, - "yazi": { - "inputs": { - "flake-utils": "flake-utils_3", - "nixpkgs": [ - "nixpkgs" - ], - "rust-overlay": "rust-overlay_2" - }, - "locked": { - "lastModified": 1782583823, - "narHash": "sha256-S52dg5T6iRjuED2e0bxzWeVM1Einbz5rJbB5wcruop4=", - "owner": "sxyazi", - "repo": "yazi", - "rev": "21550a7eb5086ba34f8eabf8aaab85f601d34a74", - "type": "github" - }, - "original": { - "owner": "sxyazi", - "repo": "yazi", - "type": "github" - } } }, "root": "root", diff --git a/flake.nix b/flake.nix index 7e6ca6e..c6b85d8 100644 --- a/flake.nix +++ b/flake.nix @@ -5,22 +5,17 @@ nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; nixpkgs-stable.url = "github:NixOS/nixpkgs/nixos-26.05"; - # Hardware and gaming - nixos-hardware.url = "github:NixOS/nixos-hardware/master"; + flake-parts.url = "github:hercules-ci/flake-parts"; - impermanence = { - url = "github:nix-community/impermanence"; - inputs.nixpkgs.follows = "nixpkgs"; - }; + nixos-hardware.url = "github:NixOS/nixos-hardware/master"; - nixos-mailserver = { - # url = "gitlab:simple-nixos-mailserver/nixos-mailserver/nixos-26.05"; - url = "gitlab:simple-nixos-mailserver/nixos-mailserver/main"; + hjem = { + url = "github:feel-co/hjem"; inputs.nixpkgs.follows = "nixpkgs"; }; - microvm = { - url = "github:microvm-nix/microvm.nix"; + impermanence = { + url = "github:nix-community/impermanence"; inputs.nixpkgs.follows = "nixpkgs"; }; @@ -34,117 +29,86 @@ inputs.nixpkgs.follows = "nixpkgs"; }; - # System Utilities sops-nix = { url = "github:Mic92/sops-nix"; inputs.nixpkgs.follows = "nixpkgs"; }; - home-manager = { - url = "github:nix-community/home-manager/master"; - inputs.nixpkgs.follows = "nixpkgs"; - }; - disko = { url = "github:nix-community/disko/latest"; inputs.nixpkgs.follows = "nixpkgs"; }; - # UI and apps - niri = { - url = "github:sodiboo/niri-flake"; - inputs.nixpkgs.follows = "nixpkgs"; - }; - - waybar = { - url = "github:Alexays/Waybar"; - inputs.nixpkgs.follows = "nixpkgs"; - }; - - yazi = { - url = "github:sxyazi/yazi"; - inputs.nixpkgs.follows = "nixpkgs"; - }; - - satty = { - url = "github:gabm/Satty"; - inputs.nixpkgs.follows = "nixpkgs"; - }; - - # Other omnisearch = { - url = "git+https://git.bwaaa.monster/omnisearch?shallow=0&rev=24f9909badd4e7aa1f3aeef717b93e9b71c20a4e"; - inputs.nixpkgs.follows = "nixpkgs"; + url = "git+https://git.bwaaa.monster/omnisearch?shallow=0"; + # inputs.nixpkgs.follows = "nixpkgs"; }; otter-launcher = { url = "github:kuokuo123/otter-launcher"; inputs.nixpkgs.follows = "nixpkgs"; }; + }; - fsel = { - url = "github:Mjoyufull/fsel"; - inputs.nixpkgs.follows = "nixpkgs"; - }; + outputs = + inputs@{ flake-parts, ... }: + flake-parts.lib.mkFlake { inherit inputs; } { - nixvim = { - url = "github:nix-community/nixvim"; - inputs.nixpkgs.follows = "nixpkgs"; - }; + imports = [ + (inputs.flake-parts.lib.importTree ./modules) + ]; - nvf = { - url = "github:NotAShelf/nvf"; - inputs.nixpkgs.follows = "nixpkgs"; - }; - }; + perSystem = { pkgs, ... }: { + formatter = pkgs.nixfmt-rfc-style; + }; - outputs = - { - self, - nixpkgs, - nixpkgs-stable, - ... - }@inputs: - let - unstablePkgs = import nixpkgs { }; - stablePkgs = import nixpkgs-stable { }; - mkHost = - { - hostname, - user ? "adam", - isStable ? false, - path ? ./hosts/${hostname}/configuration.nix, - }: - nixpkgs.lib.nixosSystem { - specialArgs = { - inherit inputs; - username = user; - pkgs-unstable = unstablePkgs; - pkgs-stable = stablePkgs; - masterDomain = "bibus.top"; - }; - modules = [ - path - { networking.hostName = hostname; } - ]; - }; - in - { - nixosConfigurations = { - szpont = mkHost { - hostname = "szpont"; - path = ./hosts/desktop/configuration.nix; - }; - thinkpad = mkHost { hostname = "thinkpad"; }; - pendrive = mkHost { - hostname = "pendrive"; - user = "user"; - }; - bibus-lab = mkHost { - hostname = "bibus-lab"; - user = "opc"; - isStable = true; + flake = { + nixosModules.default = { + imports = [ inputs.hjem.nixosModules.default ]; }; + + nixosConfigurations = + let + mkHost = + { + hostname, + user ? "adam", + pkgsInput ? inputs.nixpkgs, + path ? ./hosts/${hostname}/configuration.nix, + }: + pkgsInput.lib.nixosSystem { + specialArgs = { + inherit inputs; + username = user; + pkgs-unstable = import inputs.nixpkgs { + system = "x86_64-linux"; + config.allowUnfree = true; + }; + pkgs-stable = import inputs.nixpkgs-stable { + system = "x86_64-linux"; + config.allowUnfree = true; + }; + }; + modules = [ + inputs.hjem.nixosModules.default + inputs.disko.nixosModules.disko + inputs.impermanence.nixosModules.impermanence + inputs.sops-nix.nixosModules.sops + + path + { networking.hostName = hostname; } + ]; + }; + in + { + szpont = mkHost { hostname = "szpont"; }; + thinkpad = mkHost { hostname = "thinkpad"; }; + pendrive = mkHost { + hostname = "pendrive"; + user = "user"; + pkgsInput = inputs.nixpkgs-stable; + }; + }; }; }; } diff --git a/hosts/bibus-lab/configuration.nix b/hosts/bibus-lab/configuration.nix deleted file mode 100644 index bace2f6..0000000 --- a/hosts/bibus-lab/configuration.nix +++ /dev/null @@ -1,13 +0,0 @@ -{ inputs, ... }: -{ - system.stateVersion = "26.11"; - - imports = [ - inputs.disko.nixosModules.disko - ./disko.nix - - ../../os/default.nix - ]; - - hardware.facter.reportPath = ./facter.json; -} diff --git a/hosts/bibus-lab/disko.nix b/hosts/bibus-lab/disko.nix deleted file mode 100644 index 203ec95..0000000 --- a/hosts/bibus-lab/disko.nix +++ /dev/null @@ -1,249 +0,0 @@ -{ - disko.devices = { - main = { - type = "disk"; - # TODO fill id - device = "/dev/disk/by-id/CHANGEME"; - content = { - type = "gpt"; - partitions = { - ESP = { - size = "2G"; - type = "EF00"; - content = { - type = "filesystem"; - format = "vfat"; - mountpoint = "/boot"; - }; - }; - zfs = { - size = "100%"; - content = { - type = "zfs"; - pool = "zroot"; - }; - }; - }; - }; - }; - hdd1 = { - type = "disk"; - # TODO fill id - device = "/dev/disk/by-id/CHANGEME"; - content = { - type = "gpt"; - partitions = { - zfs = { - size = "100%"; - content = { - type = "zfs"; - pool = "tank"; - }; - }; - }; - }; - }; - hdd2 = { - type = "disk"; - # TODO fill id - device = "/dev/disk/by-id/CHANGEME"; - content = { - type = "gpt"; - partitions = { - zfs = { - size = "100%"; - content = { - type = "zfs"; - pool = "tank"; - }; - }; - }; - }; - }; - hdd3 = { - type = "disk"; - # TODO fill id - device = "/dev/disk/by-id/CHANGEME"; - content = { - type = "gpt"; - partitions = { - zfs = { - size = "100%"; - content = { - type = "zfs"; - pool = "tank"; - }; - }; - }; - }; - }; - zpool = { - zroot = { - type = "zpool"; - rootTmpfs = true; - datasets = { - "rpool" = { - type = "zfs_fs"; - options = { - mountpoint = "none"; - compression = "zstd"; - atime = "off"; - }; - }; - "rpool/root" = { - type = "zfs_fs"; - mountpoint = "/"; - options.mountpoint = "legacy"; - }; - "rpool/nix" = { - type = "zfs_fs"; - mountpoint = "/nix"; - options.mountpoint = "legacy"; - }; - "rpool/home" = { - type = "zfs_fs"; - mountpoint = "/home"; - }; - "rpool/persist" = { - type = "zfs_fs"; - mountpoint = "/persist"; - options.mountpoint = "legacy"; - }; - "rpool/log" = { - type = "zfs_fs"; - mountpoint = "/var/log"; - options.mountpoint = "legacy"; - }; - "rpool/var" = { - type = "zfs_fs"; - options.mountpoint = "none"; - }; - "rpool/var/acme" = { - type = "zfs_fs"; - mountpoint = "/var/lib/acme"; - }; - "rpool/containers" = { - type = "zfs_fs"; - mountpoint = "/var/lib/containers"; - }; - "rpool/appdata" = { - type = "zfs_fs"; - options.mountpoint = "none"; - }; - "rpool/appdata/cfg" = { - type = "zfs_fs"; - mountpoint = "/var/lib/appdata/cfg"; - }; - "rpool/appdata/db" = { - type = "zfs_fs"; - mountpoint = "/var/lib/appdata/db"; - options.canmount = "off"; - }; - "rpool/appdata/db/postgres" = { - type = "zfs_fs"; - mountpoint = "/var/lib/appdata/db/postgres"; - options = { - recordsize = "8K"; - logbias = "latency"; - }; - }; - "rpool/appdata/db/couchdb" = { - type = "zfs_fs"; - mountpoint = "/var/lib/appdata/db/couchdb"; - options.recordsize = "64K"; - }; - "rpool/appdata/db/redis" = { - type = "zfs_fs"; - mountpoint = "/var/lib/appdata/db/redis"; - options = { - recordsize = "128K"; - compression = "lz4"; - }; - }; - "rpool/appdata/monero" = { - type = "zfs_fs"; - mountpoint = "/var/lib/monero"; - options = { - compression = "off"; - recordsize = "8K"; - }; - }; - "rpool/appdata/mail" = { - type = "zfs_fs"; - mountpoint = "/var/vmail"; - options = { - atime = "on"; - recordsize = "64K"; - }; - }; - "rpool/appdata/games" = { - type = "zfs_fs"; - mountpoint = "/var/lib/games"; - options.recordsize = "64K"; - }; - }; - }; - tank = { - type = "zpool"; - mode = "raidz1"; - - datasets = { - "ztank" = { - type = "zfs_fs"; - mountpoint = "none"; - options = { - compression = "zstd"; - atime = "off"; - }; - }; - "ztank/media" = { - type = "zfs_fs"; - mountpoint = "/data/media"; - options = { - compression = "none"; - recordsize = "1M"; - }; - }; - "ztank/vault" = { - type = "zfs_fs"; - mountpoint = "/data/vault"; - options.xattr = "sa"; - }; - "ztank/seafile" = { - type = "zfs_fs"; - mountpoint = "none"; - options.recordsize = "128K"; - }; - "ztank/seafile/personal" = { - type = "zfs_fs"; - mountpoint = "/data/seafile/personal"; - }; - "ztank/seafile/shared" = { - type = "zfs_fs"; - mountpoint = "/data/seafile/shared"; - refquota = "1T"; - }; - "ztank/dl" = { - type = "zfs_fs"; - options.mountpoint = "none"; - }; - "ztank/dl/active" = { - type = "zfs_fs"; - mountpoint = "/data/dl/active"; - options.recordsize = "16K"; - }; - "ztank/dl/complete" = { - type = "zfs_fs"; - mountpoint = "/data/dl/complete"; - options.recordsize = "1M"; - }; - "ztank/backup" = { - type = "zfs_fs"; - mountpoint = "/data/backup"; - options.recordsize = "1M"; - }; - }; - }; - }; - }; -} diff --git a/hosts/desktop/1 b/hosts/desktop/1 deleted file mode 100644 index 088098d..0000000 --- a/hosts/desktop/1 +++ /dev/null @@ -1,119 +0,0 @@ -{ config, username, ... }: -{ - system.stateVersion = "25.05"; - - imports = [ - ./hardware-configuration.nix - ../../os/default.nix - ]; - - os = { - core = { - allowUnfree.enable = true; - flatpak.enable = true; - - audio = { - enable = true; - disable-devices.enable = true; - }; - bootloader = { - type = "systemd-boot"; - timeout = 0; - }; - drivers = { - enable = true; - kernel = "zen"; - cpu = "amd"; - graphics = { - enable = true; - amdgpu.enable = true; - }; - }; - fonts.enable = true; - greet.enable = true; - home-manager = { - enable = true; - users.${username}.path = ./home.nix; - }; - locale.enable = true; - memory = { - zram.enable = true; - swapfile = { - enable = true; - size = 16; - }; - }; - network.enable = true; - security = { - enable = true; - sandboxing.enable = true; - }; - storage.enable = true; - users.enable = true; - }; - srv = { - bluetooth.enable = true; - tailscale.enable = true; - ssh = { - server.enable = true; - client = { - enable = true; - createAliases = true; - }; - enableSigning = true; - }; - firewall.enable = true; - yggdrasil.enable = true; - i2p.enable = true; - tor = { - enable = true; - enableBrowser = true; - }; - files = { - enable = true; - localsend.enable = true; - krusader.enable = true; - }; - gaming = { - enable = true; - steam = { - enable = true; - enableSls = true; - }; - vr.enable = true; - }; - sunshine.enable = true; - virtualization.kvm.enable = true; - nix-helper.enable = true; - monero.wallet.enable = true; - sops.enable = true; - syncthing = { - enable = true; - activeFolders = [ - "openmw-config" - "openmw-mods" - "game-saves" - "keepass" - "sync" - "music" - ]; - }; - omnisearch.enable = true; - }; - wm = { - enable = true; - niri.enable = true; - }; - }; - - boot = { - kernelModules = [ - "nct6687" - "binder_linux" - "ashem_linux" - ]; - extraModulePackages = [ - config.boot.kernelPackages.nct6687d - ]; - }; -} diff --git a/hosts/desktop/hardware-configuration.nix b/hosts/desktop/hardware-configuration.nix deleted file mode 100644 index 6685e8e..0000000 --- a/hosts/desktop/hardware-configuration.nix +++ /dev/null @@ -1,71 +0,0 @@ -# Do not modify this file! It was generated by ‘nixos-generate-config’ -# and may be overwritten by future invocations. Please make changes -# to /etc/nixos/configuration.nix instead. -{ - config, - lib, - pkgs, - modulesPath, - ... -}: - -{ - imports = [ - (modulesPath + "/installer/scan/not-detected.nix") - ]; - - boot.initrd.availableKernelModules = [ - "nvme" - "ahci" - "xhci_pci" - "usbhid" - "usb_storage" - "sd_mod" - ]; - boot.initrd.kernelModules = [ ]; - boot.kernelModules = [ "kvm-amd" ]; - boot.extraModulePackages = [ ]; - - fileSystems."/" = { - device = "/dev/disk/by-uuid/aa9c6208-2cc3-413c-a52a-5e0fdf93e748"; - fsType = "btrfs"; - options = [ "noatime" ]; - }; - - fileSystems."/boot" = { - device = "/dev/disk/by-uuid/A687-03D4"; - fsType = "vfat"; - options = [ - "fmask=0022" - "dmask=0022" - ]; - }; - - fileSystems."/home" = { - device = "/dev/disk/by-uuid/694036da-fc6e-4c7c-8765-7b90fb9a04c8"; - fsType = "btrfs"; - options = [ "noatime" ]; - }; - - fileSystems."/storage" = { - device = "/dev/disk/by-uuid/c0dc7c4d-1800-4c84-a04c-5ea7f5e86c4b"; - fsType = "ext4"; - options = [ - "nofail" - "noatime" - ]; - }; - - swapDevices = [ ]; - - # Enables DHCP on each ethernet and wireless interface. In case of scripted networking - # (the default) this is the recommended approach. When using systemd-networkd it's - # still possible to use this option, but it's recommended to use it in conjunction - # with explicit per-interface declarations with `networking.interfaces..useDHCP`. - networking.useDHCP = lib.mkDefault true; - # networking.interfaces.enp14s0.useDHCP = lib.mkDefault true; - # networking.interfaces.wlp15s0.useDHCP = lib.mkDefault true; - - nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; - hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; -} diff --git a/modules/audio.nix b/modules/audio.nix new file mode 100644 index 0000000..e926076 --- /dev/null +++ b/modules/audio.nix @@ -0,0 +1,96 @@ +{ + flake.nixosModules.audio = { config, lib, pkgs, ... }: + let + cfg = config.os.core.audio; + in + { + options.os.core.audio = { + enable = lib.mkEnableOption "audio support"; + disable-devices.enable = lib.mkEnableOption "disables some random devices cluttering up"; + noise-cancellation.enable = lib.mkEnableOption "RNNoise background noise cancellation"; + }; + + config = lib.mkMerge [ + (lib.mkIf cfg.enable { + services.pulseaudio.enable = false; + security.rtkit.enable = true; + + services.pipewire = { + enable = true; + audio.enable = true; + pulse.enable = true; + alsa = { + enable = true; + support32Bit = true; + }; + jack.enable = true; + + wireplumber = { + enable = true; + extraConfig."99-lock-microphone-gain"."pulse.rules" = [{ + matches = [ { "application.name" = "~*cord*"; } ]; + actions.quirks = [ "no-source-volume" ]; + }]; + }; + }; + services.playerctld.enable = true; + + environment.systemPackages = with pkgs; [ + crosspipe + pulsemixer + pavucontrol + alsa-utils + ]; + }) + + (lib.mkIf cfg.disable-devices.enable { + services.pipewire.wireplumber.extraConfig = { + "99-disable-devices"."monitor.alsa.rules" = [{ + matches = [ + { "device.name" = "~alsa_card.pci-0000_03_00.1*"; } + { "device.description" = "~USB Audio*"; } + ]; + actions.update-props."device.disabled" = true; + }]; + }; + }) + + (lib.mkIf cfg.noise-cancellation.enable { + services.pipewire.extraConfig.pipewire."99-rnnoise" = { + "context.modules" = [ + { + name = "libpipewire-module-filter-chain"; + args = { + "node.description" = "Noise Canceling Source"; + "media.name" = "Noise Canceling Source"; + "filter.graph".nodes = [ + { + type = "ladspa"; + name = "rnnoise"; + plugin = "${pkgs.rnnoise-plugin}/lib/ladspa/librnnoise_ladspa.so"; + label = "noise_suppressor_mono"; + control = { + "VAD Threshold (%)" = 50.0; + "VAD Grace Period (ms)" = 200.0; + "Retroactive VAD Grace Period (ms)" = 0.0; + }; + } + ]; + "capture.props" = { + "node.name" = "effect_input.rnnoise"; + "node.passive" = true; + "audio.position" = [ "MONO" ]; + }; + "playback.props" = { + "node.name" = "effect_output.rnnoise"; + "media.class" = "Audio/Source"; + "audio.position" = [ "MONO" ]; + }; + }; + } + ]; + }; + }) + ]; + }; +} diff --git a/modules/bluetooth.nix b/modules/bluetooth.nix new file mode 100644 index 0000000..1705db6 --- /dev/null +++ b/modules/bluetooth.nix @@ -0,0 +1,19 @@ +{ + config, + lib, + pkgs, + ... +}: +let + cfg = config.os.srv.bluetooth; +in +{ + options.os.srv.bluetooth.enable = lib.mkEnableOption "enables bluetooth support"; + config = lib.mkIf cfg.enable { + hardware.bluetooth = { + enable = true; + powerOnBoot = true; + }; + environment.systemPackages = [ pkgs.bluetui ]; + }; +} diff --git a/modules/bootloader.nix b/modules/bootloader.nix new file mode 100644 index 0000000..e8dfc11 --- /dev/null +++ b/modules/bootloader.nix @@ -0,0 +1,100 @@ +{ + config, + lib, + ... +}: +let + cfg = config.os.core.bootloader; +in +{ + options.os.core.bootloader = { + type = lib.mkOption { + type = lib.types.enum [ + "systemd-boot" + "grub" + "none" + ]; + default = "systemd-boot"; + description = "Which bootloader to use"; + }; + + efi = lib.mkOption { + type = lib.types.bool; + default = if cfg.grub.device == "nodev" then true else false; + description = "Whether the system uses UEFI or Legacy BIOS"; + }; + + timeout = lib.mkOption { + type = lib.types.int; + default = 3; + description = "Boot menu timeout in seconds"; + }; + + grub = { + device = lib.mkOption { + type = lib.types.str; + default = "nodev"; + description = "Device to install GRUB to (e.g. /dev/nvme0n1). Use 'nodev' for UEFI."; + }; + useOSProber = lib.mkOption { + type = lib.types.bool; + default = false; + description = "Scan for other operating systems"; + }; + defaultEntry = lib.mkOption { + type = lib.types.int; + default = 0; + description = "Index of the default boot entry"; + }; + }; + + #TODO add boot.initrd.luks.reusePassphrases = true; somewhere + luks.enable = lib.mkEnableOption "LUKS encryption support"; + }; + + config = lib.mkMerge [ + # 1. Common Kernel & Initrd Settings + { + boot = { + loader = { + timeout = cfg.timeout; + efi.canTouchEfiVariables = lib.mkDefault cfg.efi; + }; + supportedFilesystems = [ + "ntfs" + "btrfs" + ]; + kernelParams = [ + "quiet" + "splash" + ]; + consoleLogLevel = 0; + initrd.availableKernelModules = [ + "aesni_intel" + "cryptd" + ]; + }; + systemd.settings.Manager.DefaultTimeoutStopSec = "5s"; + } + + # 2. Systemd-boot Implementation + (lib.mkIf (cfg.type == "systemd-boot") { + boot.loader.systemd-boot = { + enable = true; + editor = false; + consoleMode = "max"; + }; + }) + + # 3. GRUB Implementation + (lib.mkIf (cfg.type == "grub") { + boot.loader.grub = { + enable = true; + efiSupport = cfg.efi; + useOSProber = cfg.grub.useOSProber; + default = cfg.grub.defaultEntry; + enableCryptodisk = cfg.luks.enable; + }; + }) + ]; +} diff --git a/modules/compat.nix b/modules/compat.nix new file mode 100644 index 0000000..1ea6105 --- /dev/null +++ b/modules/compat.nix @@ -0,0 +1,28 @@ +{ + config, + lib, + pkgs, + ... +}: +let + cfg = config.os.srv.compat; +in +{ + options.os.srv.compat.enable = lib.mkEnableOption "enables compatibility with windows & x11"; + config = lib.mkIf cfg.enable { + programs.xwayland = { + enable = true; + package = pkgs.xwayland-satellite; + }; + + environment.systemPackages = with pkgs; [ + wineWow64Packages.stagingFull + winetricks + ]; + + environment.sessionVariables = { + NIXOS_OZONE_WL = "1"; + ELECTRON_ENABLE_WAYLAND = "1"; + }; + }; +} diff --git a/modules/drivers.nix b/modules/drivers.nix new file mode 100644 index 0000000..6e74e98 --- /dev/null +++ b/modules/drivers.nix @@ -0,0 +1,99 @@ +{ + config, + lib, + pkgs, + ... +}: +let + cfg = config.os.core.drivers; +in +{ + options.os.core.drivers = { + enable = lib.mkEnableOption "enables hardware drivers"; + + cpu = lib.mkOption { + type = lib.types.enum [ + "intel" + "amd" + "none" + ]; + default = "none"; + description = "cpu manufacturer for microcode and platform-specific drivers"; + }; + + graphics = { + enable = lib.mkEnableOption "graphics support"; + amdgpu.enable = lib.mkEnableOption "amd specific gpu features"; + }; + + kernel = lib.mkOption { + type = lib.types.enum [ + "stable" + "zen" + "zfs" + "hardened" + ]; + default = "stable"; + }; + }; + + config = lib.mkIf cfg.enable ( + lib.mkMerge [ + { + hardware.enableAllFirmware = true; + services = { + smartd.enable = true; + fwupd.enable = true; + }; + environment.systemPackages = [ pkgs.rivalcfg ]; + } + + (lib.mkIf (cfg.cpu == "amd") { + hardware.cpu.amd.updateMicrocode = true; + programs.coolercontrol.enable = true; + }) + + (lib.mkIf (cfg.cpu == "intel") { + hardware.cpu.intel.updateMicrocode = true; + services.thermald.enable = true; + }) + + (lib.mkIf cfg.graphics.enable { + hardware.graphics = { + enable = true; + enable32Bit = true; + }; + hardware.sensor.iio.enable = true; + }) + + (lib.mkIf (cfg.graphics.enable && cfg.graphics.amdgpu.enable) { + services = { + lact.enable = true; + hardware.openrgb.enable = true; + }; + hardware = { + amdgpu = { + initrd.enable = true; + overdrive.enable = true; + }; + graphics.extraPackages = with pkgs; [ + rocmPackages.clr.icd + libva-utils + ]; + }; + }) + { + boot.kernelPackages = + let + kernels = { + "stable" = pkgs.linuxPackages_latest; + "zen" = pkgs.linuxPackages_zen; + "hardened" = pkgs.linuxPackages_hardened; + "zfs" = config.boot.zfs.package.latestCompatibleLinuxPackages; + }; + in + kernels.${cfg.kernel} or kernels."stable"; + } + ] + ); +} diff --git a/modules/files.nix b/modules/files.nix new file mode 100644 index 0000000..777a394 --- /dev/null +++ b/modules/files.nix @@ -0,0 +1,55 @@ +{ + config, + lib, + pkgs, + ... +}: +let + cfg = config.os.srv.files; +in +{ + options.os.srv.files = { + enable = lib.mkEnableOption "enables general file management stuff"; + localsend.enable = lib.mkEnableOption "enables localsend for sharing files locally"; + krusader.enable = lib.mkEnableOption "enables krusader for easier file moving using ssh"; + }; + config = lib.mkMerge [ + (lib.mkIf cfg.enable { + # programs.thunar = { + # enable = true; + # plugins = with pkgs; [ + # ffmpegthumbnailer + # libgsf + # poppler + # freetype + # webp-pixbuf-loader + # thunar-volman + # thunar-archive-plugin + # ]; + # }; + services = { + tumbler.enable = true; + gvfs.enable = true; + }; + environment.systemPackages = with pkgs; [ + pcmanfm + file-roller + gdu + pxz + ripunzip + ]; + }) + (lib.mkIf cfg.localsend.enable { + programs.localsend = { + enable = true; + openFirewall = true; + }; + }) + (lib.mkIf cfg.krusader.enable { + environment.systemPackages = with pkgs; [ + krusader + kdePackages.kio-extras + ]; + }) + ]; +} diff --git a/modules/fonts.nix b/modules/fonts.nix new file mode 100644 index 0000000..344ff63 --- /dev/null +++ b/modules/fonts.nix @@ -0,0 +1,32 @@ +{ + config, + lib, + pkgs, + ... +}: +let + cfg = config.os.core.fonts; +in +{ + options.os.core.fonts.enable = lib.mkEnableOption "system-wide font and console configuration"; + + config = lib.mkIf cfg.enable { + # console = { + # keyMap = "pl"; + # earlySetup = true; + # font = "ter-v32n"; + # packages = with pkgs; [ terminus_font ]; + # }; + + fonts.packages = with pkgs; [ + nerd-fonts.jetbrains-mono + nerd-fonts.fira-mono + nerd-fonts.fira-code + + noto-fonts + noto-fonts-cjk-sans + noto-fonts-cjk-serif + noto-fonts-color-emoji + ]; + }; +} diff --git a/modules/gaming.nix b/modules/gaming.nix new file mode 100644 index 0000000..b9b6766 --- /dev/null +++ b/modules/gaming.nix @@ -0,0 +1,145 @@ +{ + config, + lib, + pkgs, + username, + inputs, + ... +}: +let + cfg = config.os.srv.gaming; +in +{ + options.os.srv.gaming = { + enable = lib.mkEnableOption "enables general gaming support"; + + tools.enable = lib.mkEnableOption "enables performance tools" // { + default = cfg.enable; + }; + launchers.enable = lib.mkEnableOption "enables 3rd party launchers" // { + default = cfg.enable; + }; + games.enable = lib.mkEnableOption "enables specific native games"; + steam = { + enable = lib.mkEnableOption "enables the steam launcher"; + enableSls = lib.mkEnableOption "enables the SLS Steam library modification"; + }; + vr.enable = lib.mkEnableOption "enables vr support"; + }; + + config = lib.mkMerge [ + # --- PERFORMANCE & TOOLING --- + (lib.mkIf cfg.tools.enable { + hardware.xone.enable = true; + programs = { + gamescope = { + enable = true; + capSysNice = true; + }; + + gamemode = { + enable = true; + enableRenice = true; + settings = { + general.renice = 10; + }; + }; + }; + environment = { + sessionVariables = { + OPTISCALER_ShortcutKey = "0x24"; # sets the optiscaler shortcut key to be home by default + }; + + systemPackages = with pkgs; [ + mangohud + theclicker + ludusavi + protonplus + ]; + }; + }) + + # --- EXTERNAL LAUNCHERS --- + (lib.mkIf cfg.launchers.enable { + environment.systemPackages = with pkgs; [ + heroic + (prismlauncher.override { + additionalLibs = with pkgs; [ ocl-icd ]; + jdks = with pkgs; [ javaPackages.compiler.temurin-bin.jdk-26 ]; + }) + ]; + }) + + # --- SPECIFIC GAMES --- + (lib.mkIf cfg.games.enable { + environment.systemPackages = with inputs.openmw-nix.packages.${pkgs.stdenv.hostPlatform.system}; [ + (pkgs.openttd-jgrpp) + + # OpenMW Specific + (pkgs.openmw) + (pkgs.tes3cmd) + delta-plugin + groundcoverify + momw-configurator + openmw-validator + s3lightfixes + umo + ]; + }) + + # --- STEAM --- + (lib.mkIf cfg.steam.enable ( + lib.mkMerge [ + { + programs.steam = { + enable = true; + localNetworkGameTransfers.openFirewall = true; + dedicatedServer.openFirewall = true; + remotePlay.openFirewall = false; + extest.enable = true; + protontricks.enable = true; + }; + environment.systemPackages = with pkgs; [ steamtinkerlaunch ]; + } + + (lib.mkIf cfg.steam.enableSls { + environment.systemPackages = [ + inputs.sls-steam.packages.${pkgs.stdenv.hostPlatform.system}.wrapped + ]; + home-manager.users.${username} = { + xdg.desktopEntries = { + steam = { + name = "Steam"; + comment = "Library modified Steam client"; + exec = "${ + lib.getExe' inputs.sls-steam.packages.${pkgs.stdenv.hostPlatform.system}.wrapped "SLSsteam" + } %U"; + icon = "steam"; + terminal = false; + type = "Application"; + categories = [ + "Game" + "Utility" + ]; + mimeType = [ "x-scheme-handler/steamcmd" ]; + }; + }; + }; + }) + ] + )) + + # --- VR SUPPORT --- + (lib.mkIf cfg.vr.enable { + services.wivrn = { + enable = true; + openFirewall = true; + highPriority = true; + steam.importOXRRuntimes = true; + # defaultRuntime = true; + }; + environment.systemPackages = [ pkgs.android-tools ]; + users.users.${username}.extraGroups = [ "adbusers" ]; + }) + ]; +} diff --git a/modules/greet.nix b/modules/greet.nix new file mode 100644 index 0000000..1c01b68 --- /dev/null +++ b/modules/greet.nix @@ -0,0 +1,32 @@ +{ + config, + lib, + pkgs, + ... +}: +let + cfg = config.os.core.greet; +in +{ + options.os.core.greet.enable = lib.mkEnableOption "enables greetd daemon with tuigreet"; + config = lib.mkIf cfg.enable { + services.greetd = { + enable = true; + settings = { + default_session = { + user = "greeter"; + command = lib.concatStringsSep " " [ + "${pkgs.tuigreet}/bin/tuigreet" + "--sessions ${config.services.displayManager.sessionData.desktops}/share/xsessions:${config.services.displayManager.sessionData.desktops}/share/wayland-sessions" + "--remember" + "--remember-user-session" + "--asterisks" + "--greeting 'Welcome to NixOS!'" + "--time" + ]; + }; + }; + }; + security.pam.services.greetd.enableGnomeKeyring = true; + }; +} diff --git a/modules/i2p.nix b/modules/i2p.nix new file mode 100644 index 0000000..5e36c20 --- /dev/null +++ b/modules/i2p.nix @@ -0,0 +1,81 @@ +{ + config, + lib, + masterDomain, + securityTemplates, + ... +}: +let + cfg = config.os.srv.i2p; +in +{ + options.os.srv.i2p = { + enable = lib.mkEnableOption "enables a flexible, polymorphic i2pd deployment profile"; + + mode = lib.mkOption { + type = lib.types.enum [ + "server" + "client" + ]; + default = "client"; + description = ""; + }; + }; + + config = lib.mkIf cfg.enable ( + lib.mkMerge [ + { + services.i2pd = { + enable = true; + enableIPv6 = true; + reseed.verify = true; + + yggdrasil.enable = true; + + proto = { + http.enable = true; + httpProxy.enable = true; + socksProxy = { + enable = true; + outproxyEnable = true; + }; + sam.enable = true; + i2pControl.enable = true; + }; + }; + } + + (lib.mkIf (cfg.mode == "server") { + services.i2pd = { + bandwidth = 4096; + + ntcp2.published = true; + ssu2.published = true; + + #TODO add address + yggdrasil.address = ""; + }; + + os.cluster.nginxProxies."i2p.${masterDomain}" = { + enableACME = true; + forceSSL = true; + locations."/" = { + proxyPass = "http://${config.os.core.network.ips.relay-vm}:7070"; + extraConfig = securityTemplates.restrictToInternal; + }; + }; + }) + + (lib.mkIf (cfg.mode == "client") { + services.i2pd = { + bandwidth = 512; + + ntcp2.published = false; + ssu2.published = false; + + yggdrasil.address = ""; + }; + }) + ] + ); +} diff --git a/modules/localization.nix b/modules/localization.nix new file mode 100644 index 0000000..49933fa --- /dev/null +++ b/modules/localization.nix @@ -0,0 +1,41 @@ +{ config, lib, ... }: +let + cfg = config.os.core.locale; +in +{ + options.os.core.locale = { + enable = lib.mkEnableOption "system localization (timezone and language)"; + + timeZone = lib.mkOption { + type = lib.types.str; + default = "Europe/Warsaw"; + description = "the system timezone."; + }; + + format = lib.mkOption { + type = lib.types.str; + default = "pl_PL.UTF-8"; + description = "the locale used for numbers, time, and measurements."; + }; + }; + config = lib.mkIf cfg.enable { + time.timeZone = cfg.timeZone; + + i18n = { + defaultLocale = "en_US.UTF-8"; + + extraLocaleSettings = { + LC_TIME = cfg.format; + LC_NUMERIC = cfg.format; + LC_MONETARY = cfg.format; + LC_PAPER = cfg.format; + LC_MEASUREMENT = cfg.format; + LC_COLLATE = cfg.format; + LC_NAME = cfg.format; + LC_ADDRESS = cfg.format; + LC_TELEPHONE = cfg.format; + LC_IDENTIFICATION = cfg.format; + }; + }; + }; +} diff --git a/modules/memory.nix b/modules/memory.nix new file mode 100644 index 0000000..b20ec8a --- /dev/null +++ b/modules/memory.nix @@ -0,0 +1,41 @@ +{ config, lib, ... }: +let + cfg = config.os.core.memory; +in +{ + options.os.core.memory = { + zram = { + enable = lib.mkEnableOption "enables zram compression"; + percent = lib.mkOption { + type = lib.types.int; + default = 25; + }; + }; + + swapfile = { + enable = lib.mkEnableOption "enables a swapfile"; + size = lib.mkOption { + type = lib.types.int; + default = 8; + }; + }; + }; + config = lib.mkMerge [ + (lib.mkIf cfg.zram.enable { + zramSwap = { + enable = true; + algorithm = "zstd"; + memoryPercent = cfg.zram.percent; + priority = 100; + }; + }) + + (lib.mkIf cfg.swapfile.enable { + swapDevices = [ { + device = "/.swapvol/swapfile"; + size = cfg.swapfile.size * 1024; + priority = 0; + } ]; + }) + ]; +} diff --git a/modules/monero.nix b/modules/monero.nix new file mode 100644 index 0000000..eb21abc --- /dev/null +++ b/modules/monero.nix @@ -0,0 +1,124 @@ +{ + config, + lib, + pkgs, + masterDomain, + securityTemplates, + ... +}: +let + cfg = config.os.srv.monero; + banlist1 = pkgs.fetchurl { + url = "https://gui.xmr.pm/files/block.txt"; + hash = "sha256-0ik4d66js6wvrvciza0li6bsajj8dvxsqlf09hcz7hg610szdxcw"; + }; + banlist2 = pkgs.fetchurl { + url = "https://raw.githubusercontent.com/Boog900/monero-ban-list/refs/heads/main/ban_list.txt"; + hash = "sh256-01z4wm2mp4z1wq2wdkrm66j50gwk3r82m2ml4n0pwjcbajxkdc87"; + }; + + combinedBanlist = pkgs.writeText "combined-monero-banlist.txt" '' + ${builtins.readFile banlist1} + ${builtins.readFile banlist2} + ''; +in +{ + options.os.srv.monero = { + wallet.enable = lib.mkEnableOption "enables the monero wallet"; + service = { + enable = lib.mkEnableOption "enables hosting a monero node"; + public = lib.mkEnableOption "makes the RPC node public (disables authentication for general wallet syncing)"; + tor.enable = lib.mkEnableOption "exposes monero RPC via Tor Onion Service"; + i2p.enable = lib.mkEnableOption "exposes monero RPC via I2P Tunnel"; + }; + }; + + config = lib.mkMerge [ + (lib.mkIf cfg.wallet.enable { + environment.systemPackages = [ pkgs.monero-cli ]; + }) + (lib.mkIf cfg.service.enable { + assertions = [ + { + assertion = if (!cfg.service.public) then config.os.srv.sops.enable else true; + message = "sops must be enabled"; + } + { + assertion = if cfg.service.tor.enable then config.os.srv.tor.enable else true; + message = "tor must be enabled"; + } + { + assertion = if cfg.service.i2p.enable then config.os.srv.i2p.enable else true; + message = "i2p must be enabled"; + } + ]; + + sops.secrets."monero/rpc-password" = { + owner = "monero"; + restartUnits = [ "monero.service" ]; + }; + + services.monero = { + enable = true; + prune = true; + banlist = combinedBanlist; + + limits = { + upload = 1250; + download = 12500; + threads = 8; + }; + + rpc = { + address = "0.0.0.0"; + } + // lib.optionalAttrs (!cfg.service.public) { + restricted = true; + user = "admin"; + password = config.sops.secrets."monero/rpc-password".path; + }; + + }; + + services.tor = lib.mkIf cfg.service.tor.enable { + # onionServices."xmr-rpc" = { + # to = [ + # { + # port = 18081; + # address = config.os.core.network.ips.relay-vm; + # } + # ]; + # }; + }; + + services.i2pd = lib.mkIf cfg.service.i2p.enable { + # tunnels.server."xmr-rpc" = { + # port = 18081; + # address = config.os.core.network.ips.relay-vm; + # keys = "xmr-rpc-key.dat"; + # inbound.length = 3; + # outbound.length = 3; + # }; + }; + + os.cluster.nginxProxies."xmr.${masterDomain}" = { + enableACME = true; + forceSSL = true; + + locations."/" = { + proxyPass = "http://${config.os.core.network.ips.relay-vm}:18081"; + extraConfig = '' + proxy_read_timeout 600s; + proxy_send_timeout 600s; + client_max_body_size 50m; + + ${securityTemplates.restrictToInternal} + ''; + }; + }; + + # Left open for P2P syncing + networking.firewall.allowedTCPPorts = [ 18080 ]; + }) + ]; +} diff --git a/modules/networking.nix b/modules/networking.nix new file mode 100644 index 0000000..9e4c329 --- /dev/null +++ b/modules/networking.nix @@ -0,0 +1,186 @@ +{ + config, + lib, + pkgs, + ... +}: +let + cfg = config.os.core.network; +in +{ + options.os.core.network = { + enable = lib.mkEnableOption "system-wide networking setup"; + enableFirewall = lib.mkEnableOption "integrated zero-trust nftables firewall layers"; + + isVM = lib.mkOption { + type = lib.types.bool; + default = false; + description = "Set to true if this configuration is running inside a guest VM. Set to false for the bare-metal host."; + }; + + ips = lib.mkOption { + type = lib.types.attrsOf lib.types.str; + default = { + bare-metal = "10.0.0.2"; + opnsense-vm = "10.0.0.1"; + gateway-vm = "10.0.0.3"; + auth-vm = "10.0.0.4"; + database-vm = "10.0.0.5"; + monitor-vm = "10.0.0.6"; + media-vm = "10.0.0.7"; + torrent-vm = "10.0.0.8"; + storage-vm = "10.0.0.9"; + web-vm = "10.0.0.10"; + comm-vm = "10.0.0.11"; + mail-vm = "10.0.0.12"; + relay-vm = "10.0.0.13"; + gameserver-vm = "10.0.0.14"; + }; + description = "Central registry of static IP allocations for the cluster."; + }; + + profile = lib.mkOption { + type = lib.types.enum [ + "client" + "server" + ]; + default = "client"; + description = "Which networking profile configuration to apply"; + }; + + lan = lib.mkOption { + description = "Physical Home Local Area Network configuration parameters."; + type = lib.types.submodule { + options = { + ip = lib.mkOption { + type = lib.types.str; + default = "10.0.0.2"; + description = "The local static or leased IP assigned to this machine on the home network."; + }; + range = lib.mkOption { + type = lib.types.str; + default = "10.0.0.0/24"; + description = "The broader subnet block representing the physical home network."; + }; + }; + }; + }; + + wg = lib.mkOption { + description = "Standard WireGuard VPN tunnel configuration parameters."; + type = lib.types.submodule { + options = { + ip = lib.mkOption { + type = lib.types.str; + default = "10.3.0.1"; + description = "The explicit tunnel IP address assigned to this machine's WireGuard interface."; + }; + range = lib.mkOption { + type = lib.types.str; + default = "10.3.0.0/24"; + description = "The total addressable IP space assigned to the WireGuard network pool."; + }; + }; + }; + }; + + hs = lib.mkOption { + description = "Headscale mesh overlay network configuration parameters."; + type = lib.types.submodule { + options = { + ip = lib.mkOption { + type = lib.types.str; + default = "10.4.0.1"; + description = "The explicit mesh network IP address assigned to this machine via Headscale."; + }; + range = lib.mkOption { + type = lib.types.str; + default = "10.4.0.0/24"; + description = "The full mesh overlay allocation subnet block."; + }; + }; + }; + }; + }; + + config = lib.mkIf cfg.enable ( + lib.mkMerge [ + { + services.resolved.enable = true; + } + + (lib.mkIf (cfg.profile == "client") { + networking.networkmanager = { + enable = true; + dns = "systemd-resolved"; + wifi.macAddress = "random"; + wifi.backend = "iwd"; + ethernet.macAddress = "random"; + }; + + systemd.services."NetworkManager-wait-online".enable = false; + + environment.systemPackages = [ + pkgs.impala + ]; + }) + + (lib.mkIf (cfg.profile == "client" && cfg.enableFirewall) { + networking = { + firewall.enable = true; + nftables.enable = true; + }; + }) + + (lib.mkIf (cfg.profile == "server") { + networking = { + useNetworkd = true; + useDHCP = false; + }; + systemd.network = { + enable = true; + wait-online.enable = lib.mkIf (!cfg.isVM) false; + + netdevs = lib.mkIf (!cfg.isVM) { + "10-br-srv" = { + netdevConfig = { + Name = "br-srv"; + Kind = "bridge"; + }; + }; + }; + networks."20-host-management" = { + matchConfig.Name = if cfg.isVM then "eth0" else "br-srv"; + address = [ "${cfg.lan.ip}/24" ]; + gateway = [ cfg.ips.router ]; + networkConfig.LinkLocalAddressing = "no"; + }; + }; + boot.kernel.sysctl = { + "net.ipv4.ip_nonlocal_bind" = 1; + "net.ipv4.ip_forward" = 1; + }; + }) + (lib.mkIf + ( + cfg.profile == "server" + && cfg.enableFirewall + && cfg.isVM + && config.networking.hostName != "vm2-gateway" + ) + { + networking.nftables.enable = true; + networking.firewall = { + enable = true; + extraCommands = '' + nft add table ip nat 2>/dev/null || true + nft flush table ip nat + nft add chain ip nat PREROUTING { type nat hook prerouting priority dstnat \; } + nft add rule ip nat PREROUTING ip saddr ${cfg.ips.vm2-gateway} ip daddr ${cfg.lan.ip} redirect + ''; + }; + } + ) + ] + ); +} diff --git a/modules/niri.nix b/modules/niri.nix new file mode 100644 index 0000000..58d27af --- /dev/null +++ b/modules/niri.nix @@ -0,0 +1,28 @@ +{ + inputs, + config, + lib, + username, + pkgs, + ... +}: +let + cfg = config.os.wm.niri; +in +{ + imports = [ inputs.niri.nixosModules.niri ]; + + options.os.wm.niri.enable = lib.mkEnableOption "Niri"; + + config = lib.mkIf cfg.enable { + nixpkgs.overlays = [ inputs.niri.overlays.niri ]; + + programs.niri = { + enable = true; + package = pkgs.niri-unstable; + }; + + os.srv.compat.enable = true; + home-manager.users.${username}.hm.env.niri.enable = true; + }; +} diff --git a/modules/nix-helper.nix b/modules/nix-helper.nix new file mode 100644 index 0000000..5e5e133 --- /dev/null +++ b/modules/nix-helper.nix @@ -0,0 +1,40 @@ +{ + config, + lib, + pkgs, + username, + ... +}: +let + cfg = config.os.srv.nix-helper; +in +{ + options.os.srv.nix-helper.enable = lib.mkEnableOption "enables nix-helper"; + config = lib.mkIf cfg.enable { + nix.settings = { + trusted-users = [ + "root" + "${username}" + ]; + experimental-features = [ + "nix-command" + "flakes" + ]; + }; + + programs.nh = { + enable = true; + flake = "/etc/nixos"; + clean.extraArgs = "--keep 5"; + }; + + environment.sessionVariables = { + NH_OS_FLAKE = "/etc/nixos"; + }; + + environment.systemPackages = with pkgs; [ + nix-output-monitor + nvd + ]; + }; +} diff --git a/modules/omnisearch.nix b/modules/omnisearch.nix new file mode 100644 index 0000000..ac36184 --- /dev/null +++ b/modules/omnisearch.nix @@ -0,0 +1,73 @@ +{ + config, + lib, + inputs, + masterDomain, + templates, + ... +}: +let + cfg = config.os.srv.omnisearch; +in +{ + imports = [ inputs.omnisearch.nixosModules.default ]; + + options.os.srv.omnisearch = { + enable = lib.mkEnableOption "enables omnisearch tracking infrastructure"; + + role = lib.mkOption { + type = lib.types.enum [ + "server" + "standalone" + ]; + default = "standalone"; + description = "Designates the deployment method"; + }; + }; + + config = lib.mkIf cfg.enable ( + lib.mkMerge [ + { + services.omnisearch = { + enable = true; + settings = { + server = { + host = "127.0.0.1"; + port = 8087; + locale = "en"; + domain = if cfg.role == "server" then "https://search.${masterDomain}" else "http://localhost:8087"; + }; + proxy = { + max_retries = 3; + randomize_username = true; + randomize_password = true; + }; + cache = { + dir = "/var/cache/omnisearch"; + ttl_search = 1800; + ttl_infobox = 86400; + }; + }; + }; + } + + (lib.mkIf (cfg.role == "server") { + assertions = [ + { + assertion = config.os.srv.nginx.enable; + message = "Required for proxying"; + } + ]; + services.nginx.virtualHosts."search.${masterDomain}" = { + enableACME = true; + forceSSL = true; + locations."/" = { + proxyPass = "http://127.0.0.1:8087"; + proxyWebsockets = true; + extraConfig = templates.restrictToInternal; + }; + }; + }) + ] + ); +} diff --git a/modules/persistance.nix b/modules/persistance.nix new file mode 100644 index 0000000..89f3702 --- /dev/null +++ b/modules/persistance.nix @@ -0,0 +1,50 @@ +{ + config, + lib, + inputs, + ... +}: +let + cfg = config.os.srv.persistance; +in +{ + imports = [ inputs.impermanence.nixosModules.impermanence ]; + + options.os.srv.persistance.enable = lib.mkEnableOption "enables persistance drive maintnance"; + config = lib.mkMerge [ + (lib.mkIf cfg.enable { + environment.persistence."/persist" = { + hideMounts = true; + directories = [ + "/var/lib/nixos" + "/var/lib/systemd" + "/var/lib/microvm" + ]; + files = [ + "/etc/machine-id" + ]; + }; + }) + (lib.mkIf (cfg.enable && config.os.srv.ssh.server.enable) { + environment.persistence."/persist" = { + files = [ + "/etc/ssh/ssh_host_ed25519_key" + "/etc/ssh/ssh_host_ed25519_key.pub" + ]; + }; + }) + (lib.mkIf (cfg.enable && config.os.srv.crowdsec.agent.enable) { + environment.persistence."/persist" = lib.mkIf cfg.agent.enable { + hideMounts = true; + directories = [ + { + directory = "/var/lib/crowdsec"; + user = "crowdsec"; + group = "crowdsec"; + mode = "0750"; + } + ]; + }; + }) + ]; +} diff --git a/modules/power.nix b/modules/power.nix new file mode 100644 index 0000000..b3dbf91 --- /dev/null +++ b/modules/power.nix @@ -0,0 +1,54 @@ +{ + config, + lib, + ... +}: +let + cfg = config.os.core.power; +in +{ + options.os.core.power = { + enable = lib.mkEnableOption "enables power management"; + mode = lib.mkOption { + type = lib.types.enum [ + "amd" + "intel" + "none" + ]; + default = "none"; + }; + }; + + config = lib.mkIf cfg.enable ( + lib.mkMerge [ + { + powerManagement.powertop.enable = true; + boot.kernelParams = [ "nvme_core.default_ps_max_latency_us=0" ]; + } + + (lib.mkIf (cfg.mode == "amd") { + services.power-profiles-daemon.enable = true; + boot.kernelParams = [ "amd_pstate=active" ]; + }) + + (lib.mkIf (cfg.mode == "intel") { + services = { + power-profiles-daemon.enable = false; + + thermald.enable = true; + tlp = { + enable = true; + settings = { + START_CHARGE_THRESH_BAT0 = 75; + STOP_CHARGE_THRESH_BAT0 = 80; + START_CHARGE_THRESH_BAT1 = 75; + STOP_CHARGE_THRESH_BAT1 = 80; + CPU_SCALING_GOVERNOR_ON_AC = "performance"; + CPU_SCALING_GOVERNOR_ON_BAT = "powersave"; + }; + }; + }; + }) + ] + ); +} diff --git a/modules/security.nix b/modules/security.nix new file mode 100644 index 0000000..33aa919 --- /dev/null +++ b/modules/security.nix @@ -0,0 +1,72 @@ +{ + config, + lib, + pkgs, + username, + ... +}: +let + cfg = config.os.core.security; +in +{ + options.os.core.security = { + enable = lib.mkEnableOption "core security services"; + antivirus.enable = lib.mkEnableOption "enables clamav antivirus"; + sandboxing.enable = lib.mkEnableOption "enables sandboxing stuff"; + }; + config = lib.mkIf cfg.enable ( + lib.mkMerge [ + { + security = { + polkit.enable = true; + rtkit.enable = true; + doas = { + enable = true; + extraRules = [ + { + users = [ username ]; + keepEnv = true; + persist = true; + } + ]; + }; + # sudo.enable = false; + pam.services = { + swaylock = { }; + login.enableGnomeKeyring = true; + }; + }; + # environment.systemPackages = [ pkgs.doas-sudo-shim ]; + } + (lib.mkIf cfg.sandboxing.enable { + security.apparmor = { + enable = true; + enableCache = true; + killUnconfinedConfinables = true; + packages = with pkgs; [ + apparmor-profiles + roddhjav-apparmor-rules + ]; + }; + services.dbus.apparmor = "enabled"; + specialisation.no-apparmor.configuration.security.apparmor.enable = lib.mkForce false; + + programs.firejail.enable = true; + environment.systemPackages = with pkgs; [ + apparmor-utils + apparmor-parser + apparmor-bin-utils + ]; + }) + { + services.gnome.gnome-keyring.enable = true; + + environment.systemPackages = with pkgs; [ + veracrypt + gocryptfs + keepassxc + ]; + } + ] + ); +} diff --git a/modules/sops.nix b/modules/sops.nix new file mode 100644 index 0000000..3ca2d16 --- /dev/null +++ b/modules/sops.nix @@ -0,0 +1,36 @@ +{ + config, + lib, + pkgs, + inputs, + username, + ... +}: +let + cfg = config.os.srv.sops; +in +{ + imports = [ inputs.sops-nix.nixosModules.sops ]; + + options.os.srv.sops.enable = lib.mkEnableOption "enables sops-nix"; + config = lib.mkIf cfg.enable { + sops = { + defaultSopsFile = ../../secrets/common.yaml; + defaultSopsFormat = "yaml"; + age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + + secrets = { + # "syncthing/gui_password".owner = username; + "syncthing/encryption/keepass".owner = username; + "syncthing/encryption/sync".owner = username; + "obs/websocket_password".owner = username; + }; + }; + + environment.systemPackages = with pkgs; [ + sops + age + ssh-to-age + ]; + }; +} diff --git a/modules/ssh.nix b/modules/ssh.nix new file mode 100644 index 0000000..63b2034 --- /dev/null +++ b/modules/ssh.nix @@ -0,0 +1,95 @@ +{ + config, + lib, + username, + ... +}: +let + cfg = config.os.srv.ssh; + keys.main = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC610CJfgc3yII7MpLVqzEzQGa8Tsm+dih+CTXHXTnv4"; +in +{ + options.os.srv.ssh = { + server.enable = lib.mkEnableOption "enables the ssh server module"; + client = { + enable = lib.mkEnableOption "enables the ssh client module"; + createAliases = lib.mkEnableOption "enables system-wide SSH shortcuts"; + }; + enableSigning = lib.mkEnableOption "enables signing git commits with ssh keys"; + }; + + config = lib.mkMerge [ + (lib.mkIf cfg.server.enable { + services.openssh = { + enable = true; + + listenAddresses = [ + { + addr = "127.0.0.1"; + port = 22; + } + ] + ++ lib.optional (config.os.core.network ? lan.ip) { + addr = config.os.core.network.lan.ip; + port = 22; + } + ++ lib.optional (config.os.core.network ? wg.ip) { + addr = config.os.core.network.wg.ip; + port = 22; + } + ++ lib.optional (config.os.core.network ? hs.ip) { + addr = config.os.core.network.hs.ip; + port = 22; + }; + hostKeys = [ + { + path = "/etc/ssh/ssh_host_ed25519_key"; + type = "ed25519"; + } + ]; + settings = { + PasswordAuthentication = false; + KbdInteractiveAuthentication = false; + PermitRootLogin = "no"; + + PubkeyAcceptedAlgorithms = "ssh-ed25519"; + }; + }; + + users.users = ( + lib.optionalAttrs (username != "" && username != null) { + ${username}.openssh.authorizedKeys.keys = [ + "${keys.main} adikro@disroot.org" + ]; + } + ); + }) + + (lib.mkIf cfg.client.enable { + programs.ssh.startAgent = true; + services.gnome.gcr-ssh-agent.enable = false; + }) + + (lib.mkIf (cfg.client.enable && cfg.client.createAliases) { + # TODO use hjem + programs.ssh.extraConfig = '' + Host github.com codeberg.org + IdentityFile /home/${username}/.ssh/main_id_ed25519.pub + IdentitiesOnly yes + User git + + Host oci + HostName 130.162.223.123 + User opc + ''; + systemd.tmpfiles.rules = [ + "d /home/${username}/.ssh 0700 ${username} users - -" + "f /home/${username}/.ssh/main_id_ed25519.pub 0644 ${username} users - ${keys.main}" + ]; + }) + + (lib.mkIf cfg.enableSigning { + environment.etc."ssh/allowed_signers".text = "adikro@disroot.org ${keys.main}"; + }) + ]; +} diff --git a/modules/storage.nix b/modules/storage.nix new file mode 100644 index 0000000..8527bac --- /dev/null +++ b/modules/storage.nix @@ -0,0 +1,21 @@ +{ config, lib, ... }: +let + cfg = config.os.core.storage; +in +{ + options.os.core.storage = { + enable = lib.mkEnableOption "enables storage management"; + }; + config = lib.mkIf cfg.enable { + nix.settings.auto-optimise-store = true; + services.fstrim.enable = true; + services.btrfs.autoScrub = { + enable = true; + fileSystems = [ "/" ]; + }; + boot.tmp = { + useTmpfs = true; + tmpfsSize = "50%"; + }; + }; +} diff --git a/modules/syncthing.nix b/modules/syncthing.nix new file mode 100644 index 0000000..0c5e53e --- /dev/null +++ b/modules/syncthing.nix @@ -0,0 +1,136 @@ +{ + config, + lib, + username, + ... +}: +let + cfg = config.os.srv.syncthing; + allFolders = { + "openmw-config" = { + path = "/home/${username}/.config/openmw"; + id = "openmw-config"; + devices = [ "oci" ]; + versioning = { + type = "simple"; + params.keep = "3"; + }; + ignorePatterns = [ + "settings.cfg" + "*.log" + ]; + }; + + "openmw-mods" = { + path = "/home/${username}/games/openmw"; + id = "openmw-mods"; + devices = [ "oci" ]; + versioning = { + type = "trashcan"; + params.cleanoutDays = "7"; + }; + }; + + "game-saves" = { + path = "/home/${username}/.saves"; + id = "game-saves"; + devices = [ "oci" ]; + versioning = { + type = "staggered"; + params = { + cleanInterval = "3600"; + maxAge = "2592000"; + }; + }; + }; + + "keepass" = { + path = "/home/${username}/.keepass"; + id = "keepass"; + devices = [ + { + name = "oci"; + encryptionPasswordFile = config.sops.secrets."syncthing/encryption/keepass".path; + } + ]; + versioning = { + type = "staggered"; + params = { + cleanInterval = "3600"; + maxAge = "31536000"; + }; + }; + }; + + "sync" = { + path = "/home/${username}/sync"; + id = "sync"; + devices = [ + { + name = "oci"; + encryptionPasswordFile = config.sops.secrets."syncthing/encryption/sync".path; + } + ]; + versioning = { + type = "staggered"; + params = { + cleanInterval = "3600"; + maxAge = "15552000"; + }; + }; + }; + + "music" = { + path = "/storage/music"; + id = "music"; + devices = [ "oci" ]; + versioning = { + type = "trashcan"; + params.cleanoutDays = "14"; + }; + }; + }; + activeFoldersSet = lib.filterAttrs (name: _: builtins.elem name cfg.activeFolders) allFolders; + + syncDirs = lib.mapAttrsToList (_: folder: folder.path) activeFoldersSet; +in +{ + options.os.srv.syncthing = { + enable = lib.mkEnableOption "enables syncthing syncing"; + + activeFolders = lib.mkOption { + type = lib.types.listOf ( + lib.types.enum [ + "openmw-config" + "openmw-mods" + "game-saves" + "keepass" + "sync" + "music" + ] + ); + default = [ + "keepass" + "sync" + ]; + description = "List of Syncthing folders to enable and sync on this specific machine."; + }; + }; + config = lib.mkIf cfg.enable { + systemd.tmpfiles.rules = map (path: "d ${path} 0755 ${username} users -") syncDirs; + + services.syncthing = { + enable = true; + user = username; + dataDir = "/home/${username}/.local/share/syncthing"; + configDir = "/home/${username}/.config/syncthing"; + # guiPasswordFile = config.sops.secrets."syncthing/gui_password".path; + + settings = { + devices."oci".id = "DQXGVDC-KGPM6RK-5NDEBJJ-R7PEWYZ-N6Z3WFZ-TSVJG5X-235SHG4-4BEJNQJ"; + + folders = activeFoldersSet; + }; + }; + }; +} diff --git a/modules/tor.nix b/modules/tor.nix new file mode 100644 index 0000000..8777fba --- /dev/null +++ b/modules/tor.nix @@ -0,0 +1,31 @@ +{ + config, + lib, + pkgs, + ... +}: +let + cfg = config.os.srv.tor; +in +{ + options.os.srv.tor = { + enable = lib.mkEnableOption "enables tor services"; + enableBrowser = lib.mkEnableOption "enables the tor browser"; + }; + + config = lib.mkMerge [ + (lib.mkIf cfg.enable { + services.tor = { + enable = true; + client = { + enable = true; + dns.enable = true; + transparentProxy.enable = true; + }; + }; + }) + (lib.mkIf cfg.enableBrowser { + environment.systemPackages = [ pkgs.tor-browser ]; + }) + ]; +} diff --git a/modules/users.nix b/modules/users.nix new file mode 100644 index 0000000..ff45a99 --- /dev/null +++ b/modules/users.nix @@ -0,0 +1,54 @@ +{ + config, + lib, + pkgs, + username, + ... +}: +let + cfg = config.os.core.users; +in +{ + options.os.core.users.enable = lib.mkEnableOption "enables user accounts"; + config = lib.mkIf cfg.enable { + programs.fish.enable = true; + assertions = [ + { + assertion = config.os.srv.sops.enable; + message = "required for storing the ssh key"; + } + ]; + sops.secrets = { + "users/root_password".neededForUsers = true; + "users/main_password".neededForUsers = true; + # "users/opc_password".neededForUsers = true; + }; + users = { + mutableUsers = false; + + users = { + "${username}" = { + isNormalUser = true; + hashedPasswordFile = config.sops.secrets."users/main_password".path; + shell = pkgs.fish; + extraGroups = lib.mkMerge [ + [ + "wheel" + "input" + "uinput" + ] + + (lib.mkIf (config.os.core.drivers.graphics.enable or false) [ + "video" + "render" + ]) + (lib.mkIf (config.os.core.network.enable or false) [ "networkmanager" ]) + (lib.mkIf (config.os.srv.virtualization.kvm.enable or false) [ "libvirtd" ]) + (lib.mkIf (config.os.srv.docker.enable or false) [ "docker" ]) + ]; + }; + root.hashedPasswordFile = config.sops.secrets."users/root_password".path; + }; + }; + }; +} diff --git a/modules/virtualization.nix b/modules/virtualization.nix new file mode 100644 index 0000000..8ff9f3f --- /dev/null +++ b/modules/virtualization.nix @@ -0,0 +1,40 @@ +{ + config, + lib, + pkgs, + ... +}: +let + cfg = config.os.srv.virtualization; +in +{ + options.os.srv.virtualization = { + kvm.enable = lib.mkEnableOption "KVM/QEMU virtualization with Virt-Manager"; + waydroid.enable = lib.mkEnableOption "Waydroid Container Virtualization"; + }; + config = lib.mkMerge [ + (lib.mkIf cfg.kvm.enable { + virtualisation.libvirtd = { + enable = true; + qemu.package = pkgs.qemu_kvm; + qemu.swtpm.enable = true; + }; + systemd.services.libvirt-guests.enable = false; + programs.virt-manager.enable = true; + + boot.initrd.kernelModules = + (lib.optional (config.os.core.drivers.cpu == "amd") "kvm-amd") + ++ (lib.optional (config.os.core.drivers.cpu == "intel") "kvm-intel"); + }) + (lib.mkIf cfg.waydroid.enable { + virtualisation.waydroid = { + enable = true; + package = pkgs.waydroid-nftables; + }; + + environment.systemPackages = with pkgs; [ + waydroid-helper + ]; + }) + ]; +} diff --git a/os/core/audio.nix b/os/core/audio.nix deleted file mode 100644 index a7fb5db..0000000 --- a/os/core/audio.nix +++ /dev/null @@ -1,146 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.core.audio; - toggleMuteNotify = pkgs.writeShellScriptBin "toggle-mute-notify" '' - IS_MUTED=$(${pkgs.wireplumber}/bin/wpctl get-volume @DEFAULT_AUDIO_SOURCE@ | grep -c "MUTED") - - if [ "$IS_MUTED" -eq 1 ]; then - ${pkgs.libnotify}/bin/notify-send -a "MuteIndicator" -t 0 -u critical "Microphone Muted" "Mic is currently OFF" - else - ${pkgs.mako}/bin/makoctl dismiss -a "MuteIndicator" - fi - ''; -in -{ - options.os.core.audio = { - enable = lib.mkEnableOption "audio support"; - disable-devices.enable = lib.mkEnableOption "disables some random devices cluttering up"; - }; - - config = lib.mkMerge [ - (lib.mkIf cfg.enable { - services.pulseaudio.enable = false; - security.rtkit.enable = true; - - services = { - pipewire = { - enable = true; - audio.enable = true; - pulse.enable = true; - alsa = { - enable = true; - support32Bit = true; - }; - jack.enable = true; - wireplumber = { - enable = true; - extraConfig = { - "99-lock-microphone-gain" = { - "pulse.rules" = [ - { - matches = [ - { "application.name" = "~*cord*"; } - ]; - actions = { - quirks = [ "no-source-volume" ]; - }; - } - ]; - }; - "99-disable-suspend" = { - "monitor.alsa.rules" = [ - { - matches = [ - { "node.name" = "~alsa_input.*"; } - { "node.name" = "~alsa_output.*"; } - ]; - actions.update-props = { - "session.suspend-timeout-seconds" = 0; - }; - } - ]; - }; - "10-bluetooth-policy" = { - "wireplumber.profiles" = { - "main" = { - "policy.bluetooth" = "enabled"; - }; - }; - "monitor.bluez.properties" = { - "bluez5.roles" = [ - "a2dp_sink" - "a2dp_source" - "bap_sink" - "bap_source" - "hfp_hf" - "hsp_hs" - ]; - "bluez5.codecs" = [ - "sbc" - "sbc_xq" - "aac" - "ldac" - "aptx" - "aptx_hd" - ]; - }; - }; - }; - }; - }; - playerctld.enable = true; - }; - - systemd.user.services.pipewire-quantum = { - description = "Set strict low-latency PipeWire quantum"; - after = [ "wireplumber.service" ]; - bindsTo = [ "pipewire.service" ]; - wantedBy = [ "wireplumber.service" ]; - serviceConfig = { - Type = "oneshot"; - ExecStart = [ - "${pkgs.pipewire}/bin/pw-metadata -n settings 0 clock.quantum 512" - "${pkgs.pipewire}/bin/pw-metadata -n settings 0 clock.min-quantum 512" - ]; - }; - }; - - programs.noisetorch.enable = true; - - systemd.user.services.pipewire-pulse = { - serviceConfig = { - Environment = [ "LADSPA_PATH=/tmp" ]; - }; - }; - - environment.systemPackages = with pkgs; [ - toggleMuteNotify - pulsemixer - pavucontrol - crosspipe - alsa-utils - ]; - }) - - (lib.mkIf cfg.disable-devices.enable { - services.pipewire.wireplumber.extraConfig = { - "99-disable-useless-devices"."monitor.alsa.rules" = [ - { - matches = [ - { "device.name" = "~alsa_card.pci-0000_03_00.1*"; } - { "device.description" = "~USB Audio*"; } - ]; - actions.update-props = { - "device.disabled" = true; - }; - } - ]; - }; - }) - ]; -} diff --git a/os/core/bootloader.nix b/os/core/bootloader.nix deleted file mode 100644 index e8dfc11..0000000 --- a/os/core/bootloader.nix +++ /dev/null @@ -1,100 +0,0 @@ -{ - config, - lib, - ... -}: -let - cfg = config.os.core.bootloader; -in -{ - options.os.core.bootloader = { - type = lib.mkOption { - type = lib.types.enum [ - "systemd-boot" - "grub" - "none" - ]; - default = "systemd-boot"; - description = "Which bootloader to use"; - }; - - efi = lib.mkOption { - type = lib.types.bool; - default = if cfg.grub.device == "nodev" then true else false; - description = "Whether the system uses UEFI or Legacy BIOS"; - }; - - timeout = lib.mkOption { - type = lib.types.int; - default = 3; - description = "Boot menu timeout in seconds"; - }; - - grub = { - device = lib.mkOption { - type = lib.types.str; - default = "nodev"; - description = "Device to install GRUB to (e.g. /dev/nvme0n1). Use 'nodev' for UEFI."; - }; - useOSProber = lib.mkOption { - type = lib.types.bool; - default = false; - description = "Scan for other operating systems"; - }; - defaultEntry = lib.mkOption { - type = lib.types.int; - default = 0; - description = "Index of the default boot entry"; - }; - }; - - #TODO add boot.initrd.luks.reusePassphrases = true; somewhere - luks.enable = lib.mkEnableOption "LUKS encryption support"; - }; - - config = lib.mkMerge [ - # 1. Common Kernel & Initrd Settings - { - boot = { - loader = { - timeout = cfg.timeout; - efi.canTouchEfiVariables = lib.mkDefault cfg.efi; - }; - supportedFilesystems = [ - "ntfs" - "btrfs" - ]; - kernelParams = [ - "quiet" - "splash" - ]; - consoleLogLevel = 0; - initrd.availableKernelModules = [ - "aesni_intel" - "cryptd" - ]; - }; - systemd.settings.Manager.DefaultTimeoutStopSec = "5s"; - } - - # 2. Systemd-boot Implementation - (lib.mkIf (cfg.type == "systemd-boot") { - boot.loader.systemd-boot = { - enable = true; - editor = false; - consoleMode = "max"; - }; - }) - - # 3. GRUB Implementation - (lib.mkIf (cfg.type == "grub") { - boot.loader.grub = { - enable = true; - efiSupport = cfg.efi; - useOSProber = cfg.grub.useOSProber; - default = cfg.grub.defaultEntry; - enableCryptodisk = cfg.luks.enable; - }; - }) - ]; -} diff --git a/os/core/default.nix b/os/core/default.nix deleted file mode 100644 index 963436b..0000000 --- a/os/core/default.nix +++ /dev/null @@ -1,36 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.core; -in -{ - imports = [ - ./audio.nix - ./bootloader.nix - ./drivers.nix - ./fonts.nix - ./greet.nix - ./home-manager.nix - ./localization.nix - ./memory.nix - ./networking.nix - ./power.nix - ./security.nix - ./storage.nix - ./users.nix - ./zfs.nix - ]; - - options.os.core = { - allowUnfree.enable = lib.mkEnableOption "unfree software"; - flatpak.enable = lib.mkEnableOption "Flatpak support"; - }; - - config = lib.mkMerge [ - (lib.mkIf cfg.allowUnfree.enable { - nixpkgs.config.allowUnfree = true; - }) - (lib.mkIf cfg.flatpak.enable { - services.flatpak.enable = true; - }) - ]; -} diff --git a/os/core/drivers.nix b/os/core/drivers.nix deleted file mode 100644 index 6e74e98..0000000 --- a/os/core/drivers.nix +++ /dev/null @@ -1,99 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.core.drivers; -in -{ - options.os.core.drivers = { - enable = lib.mkEnableOption "enables hardware drivers"; - - cpu = lib.mkOption { - type = lib.types.enum [ - "intel" - "amd" - "none" - ]; - default = "none"; - description = "cpu manufacturer for microcode and platform-specific drivers"; - }; - - graphics = { - enable = lib.mkEnableOption "graphics support"; - amdgpu.enable = lib.mkEnableOption "amd specific gpu features"; - }; - - kernel = lib.mkOption { - type = lib.types.enum [ - "stable" - "zen" - "zfs" - "hardened" - ]; - default = "stable"; - }; - }; - - config = lib.mkIf cfg.enable ( - lib.mkMerge [ - { - hardware.enableAllFirmware = true; - services = { - smartd.enable = true; - fwupd.enable = true; - }; - environment.systemPackages = [ pkgs.rivalcfg ]; - } - - (lib.mkIf (cfg.cpu == "amd") { - hardware.cpu.amd.updateMicrocode = true; - programs.coolercontrol.enable = true; - }) - - (lib.mkIf (cfg.cpu == "intel") { - hardware.cpu.intel.updateMicrocode = true; - services.thermald.enable = true; - }) - - (lib.mkIf cfg.graphics.enable { - hardware.graphics = { - enable = true; - enable32Bit = true; - }; - hardware.sensor.iio.enable = true; - }) - - (lib.mkIf (cfg.graphics.enable && cfg.graphics.amdgpu.enable) { - services = { - lact.enable = true; - hardware.openrgb.enable = true; - }; - hardware = { - amdgpu = { - initrd.enable = true; - overdrive.enable = true; - }; - graphics.extraPackages = with pkgs; [ - rocmPackages.clr.icd - libva-utils - ]; - }; - }) - { - boot.kernelPackages = - let - kernels = { - "stable" = pkgs.linuxPackages_latest; - "zen" = pkgs.linuxPackages_zen; - "hardened" = pkgs.linuxPackages_hardened; - "zfs" = config.boot.zfs.package.latestCompatibleLinuxPackages; - }; - in - kernels.${cfg.kernel} or kernels."stable"; - } - ] - ); -} diff --git a/os/core/fonts.nix b/os/core/fonts.nix deleted file mode 100644 index ee61591..0000000 --- a/os/core/fonts.nix +++ /dev/null @@ -1,32 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.core.fonts; -in -{ - options.os.core.fonts.enable = lib.mkEnableOption "system-wide font and console configuration"; - - config = lib.mkIf cfg.enable { - console = { - keyMap = "pl"; - earlySetup = true; - font = "ter-v32n"; - packages = with pkgs; [ terminus_font ]; - }; - - fonts.packages = with pkgs; [ - terminus_font - nerd-fonts.jetbrains-mono - nerd-fonts.fira-mono - nerd-fonts.fira-code - noto-fonts - noto-fonts-cjk-sans - noto-fonts-cjk-serif - noto-fonts-color-emoji - ]; - }; -} diff --git a/os/core/greet.nix b/os/core/greet.nix deleted file mode 100644 index 1c01b68..0000000 --- a/os/core/greet.nix +++ /dev/null @@ -1,32 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.core.greet; -in -{ - options.os.core.greet.enable = lib.mkEnableOption "enables greetd daemon with tuigreet"; - config = lib.mkIf cfg.enable { - services.greetd = { - enable = true; - settings = { - default_session = { - user = "greeter"; - command = lib.concatStringsSep " " [ - "${pkgs.tuigreet}/bin/tuigreet" - "--sessions ${config.services.displayManager.sessionData.desktops}/share/xsessions:${config.services.displayManager.sessionData.desktops}/share/wayland-sessions" - "--remember" - "--remember-user-session" - "--asterisks" - "--greeting 'Welcome to NixOS!'" - "--time" - ]; - }; - }; - }; - security.pam.services.greetd.enableGnomeKeyring = true; - }; -} diff --git a/os/core/home-manager.nix b/os/core/home-manager.nix deleted file mode 100644 index 63f3dfd..0000000 --- a/os/core/home-manager.nix +++ /dev/null @@ -1,44 +0,0 @@ -{ - inputs, - config, - lib, - username, - ... -}: -let - cfg = config.os.core.home-manager; -in -{ - imports = [ inputs.home-manager.nixosModules.home-manager ]; - - options.os.core.home-manager = { - enable = lib.mkEnableOption "home Manager configuration"; - - users = lib.mkOption { - default = { }; - description = "Attribute set of users and their home-manager configurations"; - type = lib.types.attrsOf ( - lib.types.submodule { - options = { - path = lib.mkOption { - type = lib.types.path; - description = "Path to the user's home.nix file"; - }; - }; - } - ); - }; - }; - config = lib.mkIf cfg.enable { - home-manager = { - extraSpecialArgs = { inherit inputs username; }; - useGlobalPkgs = true; - useUserPackages = true; - backupFileExtension = "bak"; - - users = lib.mapAttrs (name: userCfg: { - imports = [ userCfg.path ]; - }) cfg.users; - }; - }; -} diff --git a/os/core/localization.nix b/os/core/localization.nix deleted file mode 100644 index 49933fa..0000000 --- a/os/core/localization.nix +++ /dev/null @@ -1,41 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.core.locale; -in -{ - options.os.core.locale = { - enable = lib.mkEnableOption "system localization (timezone and language)"; - - timeZone = lib.mkOption { - type = lib.types.str; - default = "Europe/Warsaw"; - description = "the system timezone."; - }; - - format = lib.mkOption { - type = lib.types.str; - default = "pl_PL.UTF-8"; - description = "the locale used for numbers, time, and measurements."; - }; - }; - config = lib.mkIf cfg.enable { - time.timeZone = cfg.timeZone; - - i18n = { - defaultLocale = "en_US.UTF-8"; - - extraLocaleSettings = { - LC_TIME = cfg.format; - LC_NUMERIC = cfg.format; - LC_MONETARY = cfg.format; - LC_PAPER = cfg.format; - LC_MEASUREMENT = cfg.format; - LC_COLLATE = cfg.format; - LC_NAME = cfg.format; - LC_ADDRESS = cfg.format; - LC_TELEPHONE = cfg.format; - LC_IDENTIFICATION = cfg.format; - }; - }; - }; -} diff --git a/os/core/memory.nix b/os/core/memory.nix deleted file mode 100644 index b20ec8a..0000000 --- a/os/core/memory.nix +++ /dev/null @@ -1,41 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.core.memory; -in -{ - options.os.core.memory = { - zram = { - enable = lib.mkEnableOption "enables zram compression"; - percent = lib.mkOption { - type = lib.types.int; - default = 25; - }; - }; - - swapfile = { - enable = lib.mkEnableOption "enables a swapfile"; - size = lib.mkOption { - type = lib.types.int; - default = 8; - }; - }; - }; - config = lib.mkMerge [ - (lib.mkIf cfg.zram.enable { - zramSwap = { - enable = true; - algorithm = "zstd"; - memoryPercent = cfg.zram.percent; - priority = 100; - }; - }) - - (lib.mkIf cfg.swapfile.enable { - swapDevices = [ { - device = "/.swapvol/swapfile"; - size = cfg.swapfile.size * 1024; - priority = 0; - } ]; - }) - ]; -} diff --git a/os/core/networking.nix b/os/core/networking.nix deleted file mode 100644 index 9e4c329..0000000 --- a/os/core/networking.nix +++ /dev/null @@ -1,186 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.core.network; -in -{ - options.os.core.network = { - enable = lib.mkEnableOption "system-wide networking setup"; - enableFirewall = lib.mkEnableOption "integrated zero-trust nftables firewall layers"; - - isVM = lib.mkOption { - type = lib.types.bool; - default = false; - description = "Set to true if this configuration is running inside a guest VM. Set to false for the bare-metal host."; - }; - - ips = lib.mkOption { - type = lib.types.attrsOf lib.types.str; - default = { - bare-metal = "10.0.0.2"; - opnsense-vm = "10.0.0.1"; - gateway-vm = "10.0.0.3"; - auth-vm = "10.0.0.4"; - database-vm = "10.0.0.5"; - monitor-vm = "10.0.0.6"; - media-vm = "10.0.0.7"; - torrent-vm = "10.0.0.8"; - storage-vm = "10.0.0.9"; - web-vm = "10.0.0.10"; - comm-vm = "10.0.0.11"; - mail-vm = "10.0.0.12"; - relay-vm = "10.0.0.13"; - gameserver-vm = "10.0.0.14"; - }; - description = "Central registry of static IP allocations for the cluster."; - }; - - profile = lib.mkOption { - type = lib.types.enum [ - "client" - "server" - ]; - default = "client"; - description = "Which networking profile configuration to apply"; - }; - - lan = lib.mkOption { - description = "Physical Home Local Area Network configuration parameters."; - type = lib.types.submodule { - options = { - ip = lib.mkOption { - type = lib.types.str; - default = "10.0.0.2"; - description = "The local static or leased IP assigned to this machine on the home network."; - }; - range = lib.mkOption { - type = lib.types.str; - default = "10.0.0.0/24"; - description = "The broader subnet block representing the physical home network."; - }; - }; - }; - }; - - wg = lib.mkOption { - description = "Standard WireGuard VPN tunnel configuration parameters."; - type = lib.types.submodule { - options = { - ip = lib.mkOption { - type = lib.types.str; - default = "10.3.0.1"; - description = "The explicit tunnel IP address assigned to this machine's WireGuard interface."; - }; - range = lib.mkOption { - type = lib.types.str; - default = "10.3.0.0/24"; - description = "The total addressable IP space assigned to the WireGuard network pool."; - }; - }; - }; - }; - - hs = lib.mkOption { - description = "Headscale mesh overlay network configuration parameters."; - type = lib.types.submodule { - options = { - ip = lib.mkOption { - type = lib.types.str; - default = "10.4.0.1"; - description = "The explicit mesh network IP address assigned to this machine via Headscale."; - }; - range = lib.mkOption { - type = lib.types.str; - default = "10.4.0.0/24"; - description = "The full mesh overlay allocation subnet block."; - }; - }; - }; - }; - }; - - config = lib.mkIf cfg.enable ( - lib.mkMerge [ - { - services.resolved.enable = true; - } - - (lib.mkIf (cfg.profile == "client") { - networking.networkmanager = { - enable = true; - dns = "systemd-resolved"; - wifi.macAddress = "random"; - wifi.backend = "iwd"; - ethernet.macAddress = "random"; - }; - - systemd.services."NetworkManager-wait-online".enable = false; - - environment.systemPackages = [ - pkgs.impala - ]; - }) - - (lib.mkIf (cfg.profile == "client" && cfg.enableFirewall) { - networking = { - firewall.enable = true; - nftables.enable = true; - }; - }) - - (lib.mkIf (cfg.profile == "server") { - networking = { - useNetworkd = true; - useDHCP = false; - }; - systemd.network = { - enable = true; - wait-online.enable = lib.mkIf (!cfg.isVM) false; - - netdevs = lib.mkIf (!cfg.isVM) { - "10-br-srv" = { - netdevConfig = { - Name = "br-srv"; - Kind = "bridge"; - }; - }; - }; - networks."20-host-management" = { - matchConfig.Name = if cfg.isVM then "eth0" else "br-srv"; - address = [ "${cfg.lan.ip}/24" ]; - gateway = [ cfg.ips.router ]; - networkConfig.LinkLocalAddressing = "no"; - }; - }; - boot.kernel.sysctl = { - "net.ipv4.ip_nonlocal_bind" = 1; - "net.ipv4.ip_forward" = 1; - }; - }) - (lib.mkIf - ( - cfg.profile == "server" - && cfg.enableFirewall - && cfg.isVM - && config.networking.hostName != "vm2-gateway" - ) - { - networking.nftables.enable = true; - networking.firewall = { - enable = true; - extraCommands = '' - nft add table ip nat 2>/dev/null || true - nft flush table ip nat - nft add chain ip nat PREROUTING { type nat hook prerouting priority dstnat \; } - nft add rule ip nat PREROUTING ip saddr ${cfg.ips.vm2-gateway} ip daddr ${cfg.lan.ip} redirect - ''; - }; - } - ) - ] - ); -} diff --git a/os/core/persistance.nix b/os/core/persistance.nix deleted file mode 100644 index 89f3702..0000000 --- a/os/core/persistance.nix +++ /dev/null @@ -1,50 +0,0 @@ -{ - config, - lib, - inputs, - ... -}: -let - cfg = config.os.srv.persistance; -in -{ - imports = [ inputs.impermanence.nixosModules.impermanence ]; - - options.os.srv.persistance.enable = lib.mkEnableOption "enables persistance drive maintnance"; - config = lib.mkMerge [ - (lib.mkIf cfg.enable { - environment.persistence."/persist" = { - hideMounts = true; - directories = [ - "/var/lib/nixos" - "/var/lib/systemd" - "/var/lib/microvm" - ]; - files = [ - "/etc/machine-id" - ]; - }; - }) - (lib.mkIf (cfg.enable && config.os.srv.ssh.server.enable) { - environment.persistence."/persist" = { - files = [ - "/etc/ssh/ssh_host_ed25519_key" - "/etc/ssh/ssh_host_ed25519_key.pub" - ]; - }; - }) - (lib.mkIf (cfg.enable && config.os.srv.crowdsec.agent.enable) { - environment.persistence."/persist" = lib.mkIf cfg.agent.enable { - hideMounts = true; - directories = [ - { - directory = "/var/lib/crowdsec"; - user = "crowdsec"; - group = "crowdsec"; - mode = "0750"; - } - ]; - }; - }) - ]; -} diff --git a/os/core/power.nix b/os/core/power.nix deleted file mode 100644 index b3dbf91..0000000 --- a/os/core/power.nix +++ /dev/null @@ -1,54 +0,0 @@ -{ - config, - lib, - ... -}: -let - cfg = config.os.core.power; -in -{ - options.os.core.power = { - enable = lib.mkEnableOption "enables power management"; - mode = lib.mkOption { - type = lib.types.enum [ - "amd" - "intel" - "none" - ]; - default = "none"; - }; - }; - - config = lib.mkIf cfg.enable ( - lib.mkMerge [ - { - powerManagement.powertop.enable = true; - boot.kernelParams = [ "nvme_core.default_ps_max_latency_us=0" ]; - } - - (lib.mkIf (cfg.mode == "amd") { - services.power-profiles-daemon.enable = true; - boot.kernelParams = [ "amd_pstate=active" ]; - }) - - (lib.mkIf (cfg.mode == "intel") { - services = { - power-profiles-daemon.enable = false; - - thermald.enable = true; - tlp = { - enable = true; - settings = { - START_CHARGE_THRESH_BAT0 = 75; - STOP_CHARGE_THRESH_BAT0 = 80; - START_CHARGE_THRESH_BAT1 = 75; - STOP_CHARGE_THRESH_BAT1 = 80; - CPU_SCALING_GOVERNOR_ON_AC = "performance"; - CPU_SCALING_GOVERNOR_ON_BAT = "powersave"; - }; - }; - }; - }) - ] - ); -} diff --git a/os/core/security.nix b/os/core/security.nix deleted file mode 100644 index 33aa919..0000000 --- a/os/core/security.nix +++ /dev/null @@ -1,72 +0,0 @@ -{ - config, - lib, - pkgs, - username, - ... -}: -let - cfg = config.os.core.security; -in -{ - options.os.core.security = { - enable = lib.mkEnableOption "core security services"; - antivirus.enable = lib.mkEnableOption "enables clamav antivirus"; - sandboxing.enable = lib.mkEnableOption "enables sandboxing stuff"; - }; - config = lib.mkIf cfg.enable ( - lib.mkMerge [ - { - security = { - polkit.enable = true; - rtkit.enable = true; - doas = { - enable = true; - extraRules = [ - { - users = [ username ]; - keepEnv = true; - persist = true; - } - ]; - }; - # sudo.enable = false; - pam.services = { - swaylock = { }; - login.enableGnomeKeyring = true; - }; - }; - # environment.systemPackages = [ pkgs.doas-sudo-shim ]; - } - (lib.mkIf cfg.sandboxing.enable { - security.apparmor = { - enable = true; - enableCache = true; - killUnconfinedConfinables = true; - packages = with pkgs; [ - apparmor-profiles - roddhjav-apparmor-rules - ]; - }; - services.dbus.apparmor = "enabled"; - specialisation.no-apparmor.configuration.security.apparmor.enable = lib.mkForce false; - - programs.firejail.enable = true; - environment.systemPackages = with pkgs; [ - apparmor-utils - apparmor-parser - apparmor-bin-utils - ]; - }) - { - services.gnome.gnome-keyring.enable = true; - - environment.systemPackages = with pkgs; [ - veracrypt - gocryptfs - keepassxc - ]; - } - ] - ); -} diff --git a/os/core/storage.nix b/os/core/storage.nix deleted file mode 100644 index 8527bac..0000000 --- a/os/core/storage.nix +++ /dev/null @@ -1,21 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.core.storage; -in -{ - options.os.core.storage = { - enable = lib.mkEnableOption "enables storage management"; - }; - config = lib.mkIf cfg.enable { - nix.settings.auto-optimise-store = true; - services.fstrim.enable = true; - services.btrfs.autoScrub = { - enable = true; - fileSystems = [ "/" ]; - }; - boot.tmp = { - useTmpfs = true; - tmpfsSize = "50%"; - }; - }; -} diff --git a/os/core/users.nix b/os/core/users.nix deleted file mode 100644 index ff45a99..0000000 --- a/os/core/users.nix +++ /dev/null @@ -1,54 +0,0 @@ -{ - config, - lib, - pkgs, - username, - ... -}: -let - cfg = config.os.core.users; -in -{ - options.os.core.users.enable = lib.mkEnableOption "enables user accounts"; - config = lib.mkIf cfg.enable { - programs.fish.enable = true; - assertions = [ - { - assertion = config.os.srv.sops.enable; - message = "required for storing the ssh key"; - } - ]; - sops.secrets = { - "users/root_password".neededForUsers = true; - "users/main_password".neededForUsers = true; - # "users/opc_password".neededForUsers = true; - }; - users = { - mutableUsers = false; - - users = { - "${username}" = { - isNormalUser = true; - hashedPasswordFile = config.sops.secrets."users/main_password".path; - shell = pkgs.fish; - extraGroups = lib.mkMerge [ - [ - "wheel" - "input" - "uinput" - ] - - (lib.mkIf (config.os.core.drivers.graphics.enable or false) [ - "video" - "render" - ]) - (lib.mkIf (config.os.core.network.enable or false) [ "networkmanager" ]) - (lib.mkIf (config.os.srv.virtualization.kvm.enable or false) [ "libvirtd" ]) - (lib.mkIf (config.os.srv.docker.enable or false) [ "docker" ]) - ]; - }; - root.hashedPasswordFile = config.sops.secrets."users/root_password".path; - }; - }; - }; -} diff --git a/os/core/zfs.nix b/os/core/zfs.nix deleted file mode 100644 index 771644d..0000000 --- a/os/core/zfs.nix +++ /dev/null @@ -1,60 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.srv.zfs; -in -{ - options.os.srv.zfs.enable = lib.mkEnableOption "enables zfs drive maintnance"; - config = lib.mkIf cfg.enable { - assertions = [ - { - assertion = config.os.core.drivers.kernel == "zfs"; - message = "ZFS requires the zfs supported kernel"; - } - { - assertion = config.os.srv.sops.enable; - message = "required for storing the ntfy token"; - } - ]; - - sops.secrets."ntfy/zed".neededForUsers = false; - - boot = { - kernelParams = [ "zfs.zfs_arc_max=${toString (32 * 1024 * 1024 * 1024)}" ]; - zfs = { - # requestEncryptionCredentials = [ "zroot" ]; - # useKeyringForCredentials = true; - extraPools = [ "tank" ]; - }; - supportedFilesystems = [ "zfs" ]; - initrd.supportedFilesystems = [ "zfs" ]; - }; - services.zfs = { - expandOnBoot = "all"; - autoScrub.enable = true; - trim.enable = true; - autoSnapshot = { - enable = true; - flags = "-k -p --utc"; - }; - zed = { - settings = { - ZED_DEBUG_LOG = "/var/log/zed.debug.log"; - - ZED_NOTIFY_INTERVAL_SECS = 3600; - ZED_NOTIFY_VERBOSE = 0; - - ZED_USE_ENCLOSURE_LEDS = 1; - ZED_SCRUB_AFTER_RESILVER = 1; - ZED_POWER_OFF_ENCLOSURE_SLOT_ON_FAULT = 1; - ZED_POWER_OFF_ENCLOSURE_SLOT_ON_DEADMAN = 1; - - ZED_NTFY_TOPIC = "zed-alerts-bibus-lab"; - ZED_NTFY_URL = "http://${config.os.core.network.ips.monitor-vm}:8085"; - }; - }; - }; - systemd.services.zfs-zed.serviceConfig.EnvironmentFile = config.sops.secrets."ntfy/zed".path; - networking.hostId = "4e3e22e1"; - - }; -} diff --git a/os/default.nix b/os/default.nix deleted file mode 100644 index 5c55a8f..0000000 --- a/os/default.nix +++ /dev/null @@ -1,9 +0,0 @@ -{ ... }: -{ - imports = [ - ./core/default.nix - ./srv/default.nix - ./wm/default.nix - ./vms/microvms.nix - ]; -} diff --git a/os/srv/authelia.nix b/os/srv/authelia.nix deleted file mode 100644 index 2c42b0a..0000000 --- a/os/srv/authelia.nix +++ /dev/null @@ -1,179 +0,0 @@ -{ - config, - lib, - masterDomain, - securityTemplates, - ... -}: -let - cfg = config.os.srv.authelia; - computedBaseDN = lib.concatStringsSep "," ( - map (domainPart: "dc=${domainPart}") (lib.splitString "." masterDomain) - ); -in -{ - options.os.srv.authelia.enable = - lib.mkEnableOption "enables authelia authentication gateway instance"; - - config = lib.mkIf cfg.enable { - assertions = [ - { - assertion = config.os.srv.sops.enable; - message = "sops must be enabled for secure cryptographic token storage"; - } - { - assertion = config.os.core.network.enableFirewall; - message = "Requires firewall"; - } - ]; - - sops.secrets = { - "authelia/jwt_secret" = { - owner = "authelia-main"; - group = "authelia-main"; - restartUnits = [ "authelia-main.service" ]; - }; - "authelia/session_secret" = { - owner = "authelia-main"; - group = "authelia-main"; - restartUnits = [ "authelia-main.service" ]; - }; - "authelia/encryption_key" = { - owner = "authelia-main"; - group = "authelia-main"; - restartUnits = [ "authelia-main.service" ]; - }; - - "authelia/oidc_hmac" = { - owner = "authelia-main"; - group = "authelia-main"; - restartUnits = [ "authelia-main.service" ]; - }; - "authelia/oidc_private_key" = { - owner = "authelia-main"; - group = "authelia-main"; - restartUnits = [ "authelia-main.service" ]; - }; - - "postgres/authelia_password" = { - owner = "authelia-main"; - group = "authelia-main"; - restartUnits = [ "authelia-main.service" ]; - }; - "redis/password" = { - owner = "authelia-main"; - group = "authelia-main"; - restartUnits = [ "authelia-main.service" ]; - }; - }; - - services.authelia.instances.main = { - enable = true; - - secrets = { - jwtSecretFile = config.sops.secrets."authelia/jwt_secret".path; - sessionSecretFile = config.sops.secrets."authelia/session_secret".path; - storageEncryptionKeyFile = config.sops.secrets."authelia/encryption_key".path; - - oidcHmacSecretFile = config.sops.secrets."authelia/oidc_hmac".path; - oidcIssuerPrivateKeyFile = config.sops.secrets."authelia/oidc_private_key".path; - }; - - settings = { - theme = "dark"; - default_2fa_method = "totp"; - - log = { - level = "info"; - format = "json"; - path = "/var/log/authelia/authelia.log"; - keep_stdout = true; - }; - - server.address = "tcp://127.0.0.1:9091"; - - telemetry.metrics = { - enabled = true; - address = "tcp://127.0.0.1:9959"; - }; - - storage = { - postgres = { - host = config.os.core.network.ips.database-vm; - port = 5432; - database = "authelia"; - username = "authelia"; - timeout = "5s"; - schema = "public"; - }; - }; - - session = { - name = "authelia_session"; - expiration = "1h"; - inactivity = "15m"; - remember_me = "1M"; - provider = { - redis = { - host = config.os.core.network.ips.database-vm; - port = 6379; - database = 0; - timeout = "5s"; - }; - }; - }; - - authentication_backend = { - ldap = { - address = "ldap://${config.os.core.network.ips.gateway-vm}:3890"; - implementation = "lldap"; - base_dn = computedBaseDN; - user = "uid=authelia,ou=people,${computedBaseDN}"; - }; - }; - - identity_providers = { - oidc = { - cors.allowed_origins = map (domain: "https://${domain}") ( - builtins.attrNames config.os.cluster.nginxProxies - ); - - clients = config.os.cluster.oidcClients; - }; - }; - - access_control = { - default_policy = "deny"; - rules = [ - { - domain = "auth.${masterDomain}"; - policy = "bypass"; - } - ] - ++ config.os.cluster.autheliaRules; - }; - - session.domain = masterDomain; - }; - - environmentVariables = { - AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE = config.sops.secrets."lldap/password".path; - AUTHELIA_SESSION_REDIS_PASSWORD_FILE = config.sops.secrets."redis/password".path; - AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE = config.sops.secrets."postreg/authelia_password".path; - }; - }; - - os.cluster.nginxProxies."auth.${masterDomain}" = { - enableACME = true; - forceSSL = true; - locations."/" = { - proxyPass = "http://${config.os.core.network.ips.gateway-vm}:9091"; - extraConfig = securityTemplates.restrictToInternal; - }; - }; - - networking.firewall.extraInputRules = '' - ip saddr ${config.os.core.network.ips.monitor-vm} tcp dport 9959 accept - ''; - }; -} diff --git a/os/srv/avahi.nix b/os/srv/avahi.nix deleted file mode 100644 index f14b33a..0000000 --- a/os/srv/avahi.nix +++ /dev/null @@ -1,41 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.srv.avahi; -in -{ - options.os.srv.avahi.enable = lib.mkEnableOption "enables avahis"; - config = lib.mkIf cfg.enable { - services.avahi = { - enable = true; - ipv4 = true; - - publish = { - enable = true; - addresses = true; - workstation = true; - }; - - nssmdns4 = true; - - extraServiceFiles = { - nfs = '' - - - - NFS Share on %h - - _nfs._tcp - 2049 - path=/data/vault - - - _nfs._tcp - 2049 - path=/data/media - - - ''; - }; - }; - }; -} diff --git a/os/srv/backup.nix b/os/srv/backup.nix deleted file mode 100644 index e7c07f9..0000000 --- a/os/srv/backup.nix +++ /dev/null @@ -1,97 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.srv.replication; - pgLockScript = pkgs.writeScriptBin "pg-lock" '' - #!/bin/sh - microvm -s database-vm -- sudo -u postgres psql -c "SELECT pg_backup_start('sanoid_snap');" - ''; - - pgUnlockScript = pkgs.writeScriptBin "pg-unlock" '' - #!/bin/sh - microvm -s database-vm -- sudo -u postgres psql -c "SELECT pg_backup_stop();" - ''; -in -{ - options.os.srv.replication.enable = lib.mkEnableOption "enables replications"; - config = lib.mkIf cfg.enable { - services = { - sanoid = { - enable = true; - templates.production = { - autosnap = true; - autoprune = true; - hourly = 24; - daily = 7; - weekly = 4; - monthly = 3; - }; - datasets = { - "zroot/rpool/appdata/db/postgres" = { - useTemplate = [ "production" ]; - - pre_snapshot_script = "${pgLockScript}/bin/pg-lock"; - post_snapshot_script = "${pgUnlockScript}/bin/pg-unlock"; - no_inconsistent_snapshot = true; - force_post_snapshot_script = true; - script_timeout = 30; - }; - - "zroot/rpool/appdata/db/redis".useTemplate = [ "production" ]; - - "zroot/rpool/appdata/db/couchdb".useTemplate = [ "production" ]; - - "zroot/rpool/appdata/cfg".useTemplate = [ "production" ]; - - "zroot/rpool/appdata/games".useTemplate = [ "production" ]; - - "zroot/rpool/appdata/mail".useTemplate = [ "production" ]; - - "zroot/rpool/containers".useTemplate = [ "production" ]; - }; - }; - - syncoid = { - enable = true; - commonArgs = [ - "-c" - "-p" - "--delete-target-snapshots" - "--use-hold" - "--no-sync-snap" - ]; - commands = { - "sync-databases" = { - source = "zroot/rpool/appdata/db"; - target = "tank/ztank/backup/nvme/db"; - recursive = true; - }; - - "sync-config" = { - source = "zroot/rpool/appdata/cfg"; - target = "tank/ztank/backup/nvme/cfg"; - }; - - "sync-games" = { - source = "zroot/rpool/appdata/games"; - target = "tank/ztank/backup/nvme/games"; - }; - - "sync-mail" = { - source = "zroot/rpool/appdata/mail"; - target = "tank/ztank/backup/nvme/mail"; - }; - - "sync-docker" = { - source = "zroot/rpool/containers"; - target = "tank/ztank/backup/nvme/containers"; - }; - }; - }; - }; - }; -} diff --git a/os/srv/bluetooth.nix b/os/srv/bluetooth.nix deleted file mode 100644 index 1705db6..0000000 --- a/os/srv/bluetooth.nix +++ /dev/null @@ -1,19 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.srv.bluetooth; -in -{ - options.os.srv.bluetooth.enable = lib.mkEnableOption "enables bluetooth support"; - config = lib.mkIf cfg.enable { - hardware.bluetooth = { - enable = true; - powerOnBoot = true; - }; - environment.systemPackages = [ pkgs.bluetui ]; - }; -} diff --git a/os/srv/clamav.nix b/os/srv/clamav.nix deleted file mode 100644 index d2dc49f..0000000 --- a/os/srv/clamav.nix +++ /dev/null @@ -1,21 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.srv.clamav; -in -{ - options.os.srv.clamav.enable = lib.mkEnableOption "enables clamav scanning"; - config = lib.mkIf cfg.enable { - services.clamav = { - daemon = { - enable = true; - settings = { - MaxThreads = 20; - MaxQueue = 100; - }; - }; - scanner.enable = true; - updater.enable = true; - fangfrisch.enable = true; - }; - }; -} diff --git a/os/srv/cluster.nix b/os/srv/cluster.nix deleted file mode 100644 index 6e54ee2..0000000 --- a/os/srv/cluster.nix +++ /dev/null @@ -1,16 +0,0 @@ -{ lib, ... }: { - options.os.cluster = { - nginxProxies = lib.mkOption { - type = lib.types.attrsOf lib.types.attrs; - default = { }; - }; - autheliaRules = lib.mkOption { - type = lib.types.listOf lib.types.attrs; - default = [ ]; - }; - oidcClients = lib.mkOption { - type = lib.types.listOf lib.types.attrs; - default = [ ]; - }; - }; -} diff --git a/os/srv/compat.nix b/os/srv/compat.nix deleted file mode 100644 index 1ea6105..0000000 --- a/os/srv/compat.nix +++ /dev/null @@ -1,28 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.srv.compat; -in -{ - options.os.srv.compat.enable = lib.mkEnableOption "enables compatibility with windows & x11"; - config = lib.mkIf cfg.enable { - programs.xwayland = { - enable = true; - package = pkgs.xwayland-satellite; - }; - - environment.systemPackages = with pkgs; [ - wineWow64Packages.stagingFull - winetricks - ]; - - environment.sessionVariables = { - NIXOS_OZONE_WL = "1"; - ELECTRON_ENABLE_WAYLAND = "1"; - }; - }; -} diff --git a/os/srv/crowdsec.nix b/os/srv/crowdsec.nix deleted file mode 100644 index c3df81b..0000000 --- a/os/srv/crowdsec.nix +++ /dev/null @@ -1,181 +0,0 @@ -{ - config, - lib, - masterDomain, - ... -}: -let - cfg = config.os.srv.security.crowdsec; -in -{ - options.os.srv.security.crowdsec = { - enable = lib.mkEnableOption "enables CrowdSec collaborative intrusion prevention"; - - aggregator.enable = lib.mkEnableOption "this node acting as a central LAPI aggregator for the network"; - agent.enable = lib.mkEnableOption "local log parsing and threat intelligence generation on this node"; - }; - - config = lib.mkIf cfg.enable { - assertions = [ - { - assertion = config.networking.nftables.enable; - message = "CrowdSec requires networking.nftables to be enabled for blocking."; - } - { - assertion = cfg.agent.enable || cfg.aggregator.enable; - message = "You must enable at least one CrowdSec role: 'agent.enable' or 'aggregator.enable'."; - } - ]; - - sops = { - secrets."crowdsec/env" = { - owner = "crowdsec"; - group = "crowdsec"; - restartUnits = [ "crowdsec.service" ]; - }; - - templates."local_api_credentials.yaml" = { - owner = "crowdsec"; - group = "crowdsec"; - restartUnits = [ "crowdsec.service" ]; - content = '' - url: http://${config.os.core.network.ips.gateway-vm}:8080 - login: ${config.networking.hostName} - password: ${config.sops.placeholder."crowdsec/client_password"} - ''; - }; - }; - - systemd.services.crowdsec.serviceConfig.EnvironmentFile = config.sops.secrets."crowdsec/env".path; - - services.crowdsec = { - enable = true; - autoUpdateService = true; - - openFirewall = true; - - settings = { - common = { - compress_logs = true; - log_format = "json"; - }; - prometheus = { - enabled = true; - level = "full"; - listen_addr = "0.0.0.0"; - listen_port = 6060; - }; - db_config = { - type = "postgresql"; - host = config.os.core.network.ips.database-vm; - port = 5432; - db_name = "crowdsec"; - user = "crowdsec"; - password = "$CROWDSEC_DB_PASSWORD"; - sslmode = "require"; - }; - - api = { - server = { - enable = cfg.aggregator.enable; - listen_uri = "0.0.0.0:8080"; - trusted_ips = [ - "127.0.0.1" - "10.0.0.0/24" - ]; - - auto_registration = { - enabled = cfg.aggregator.enable; - token = "$CROWDSEC_REGISTER_TOKEN"; - allowed_ranges = [ "10.0.0.0/24" ]; - }; - }; - client.credentials_path = config.sops.templates."local_api_credentials.yaml".path; - }; - lapi.client.api_url = "http://${config.os.core.network.ips.gateway-vm}:8080"; - }; - - hub = lib.mkIf cfg.agent.enable { - collections = [ - "crowdsecurity/linux" - "crowdsecurity/nginx" - "crowdsecurity/authelia" - "crowdsecurity/sshd" - ]; - }; - - localConfig = { - acquisitions = lib.mkIf cfg.agent.enable [ - { - source = "journalctl"; - journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ]; - labels.type = "syslog"; - } - { - source = "file"; - filenames = [ "/var/log/nginx/*.log" ]; - labels.type = "nginx"; - } - { - source = "file"; - filenames = [ "/var/log/authelia/authelia.log" ]; - labels.type = "authelia"; - } - ]; - - parsers.s02Enrich = lib.mkIf cfg.agent.enable [ - { - name = "myips/whitelist"; - description = "Prevent local address ranges from triggering bans"; - whitelist = { - reason = "Internal private subnets"; - cidr = [ - "10.0.0.0/24" - "10.1.0.0/24" - "10.3.0.0/24" - "10.4.0.0/24" - ]; - }; - } - ]; - - notifications = lib.mkIf cfg.aggregator.enable [ - { - name = "ntfy_alerts"; - type = "http"; - method = "POST"; - url = "https://ntfy.${masterDomain}/crowdsec-alerts"; - headers = { - Title = "CrowdSec Alert on Bibus-Lab"; - Priority = "high"; - Authorization = "$NTFY_AUTH_TOKEN"; - }; - format = '' - {{range .}} {{.Alert.Message}} (Scenario: {{.Alert.Scenario}}) from IP {{.Alert.Source.IP}} {{end}} - ''; - log_level = "info"; - } - ]; - }; - }; - - services.crowdsec-firewall-bouncer = { - enable = true; - - registerBouncer.enable = cfg.aggregator.enable; - - settings = { - mode = "nftables"; - update_frequency = "10s"; - api_url = "http://${config.os.core.network.ips.gateway-vm}:8080"; - api_key = lib.mkIf cfg.aggregator.enable "$CROWDSEC_LOCAL_BOUNCER_KEY"; - }; - }; - - users.users.crowdsec.extraGroups = lib.mkIf cfg.agent.enable [ - "systemd-journal" - "nginx" - "authelia-main" - ]; - }; -} diff --git a/os/srv/default.nix b/os/srv/default.nix deleted file mode 100644 index c89d029..0000000 --- a/os/srv/default.nix +++ /dev/null @@ -1,48 +0,0 @@ -{ ... }: -{ - imports = [ - ./authelia.nix - ./backup.nix - ./bluetooth.nix - ./clamav.nix - ./cluster.nix - ./compat.nix - ./crowdsec.nix - ./dns.nix - ./files.nix - ./gaming.nix - ./grafana.nix - ./headscale.nix - ./i2p.nix - ./kea.nix - ./lldap.nix - ./loki.nix - ./mailserver.nix - ./monero.nix - ./netdata.nix - ./nfs.nix - ./nginx.nix - ./nix-helper.nix - ./ntfy.nix - ./ntopng.nix - ./oci.nix - ./omnisearch.nix - ./postgres.nix - ./prometheus.nix - ./redis.nix - ./scrutiny.nix - ./simplex.nix - ./sops.nix - ./ssh.nix - ./sunshine.nix - ./syncthing.nix - ./tailscale.nix - ./tor.nix - ./ups.nix - ./uptime-kuma.nix - ./vector.nix - ./virtualization.nix - ./wireguard.nix - ./yggdrasil.nix - ]; -} diff --git a/os/srv/dns.nix b/os/srv/dns.nix deleted file mode 100644 index b8a973f..0000000 --- a/os/srv/dns.nix +++ /dev/null @@ -1,286 +0,0 @@ -{ - config, - lib, - masterDomain, - securityTemplates, - ... -}: -let - cfg = config.os.srv.dns; - unboundPort = 5335; -in -{ - options.os.srv.dns = { - enable = lib.mkEnableOption "enables dns scanning"; - adguardProxyConfig = lib.mkOption { - type = lib.types.attrs; - default = { }; - }; - }; - config = lib.mkIf cfg.enable { - services.unbound = { - enable = true; - settings = { - server = { - interface = [ "127.0.0.1" ]; - port = unboundPort; - - do-ip4 = true; - do-ip6 = false; - do-udp = true; - do-tcp = true; - - num-threads = 4; - msg-cache-slabs = 4; - rrset-cache-slabs = 4; - infra-cache-slabs = 4; - key-cache-slabs = 4; - - msg-cache-size = "256m"; - rrset-cache-size = "512m"; - infra-cache-numhosts = 20000; - - so-rcvbuf = "8m"; - so-sndbuf = "8m"; - so-reuseport = true; - - qname-minimisation = true; - prefetch = true; - prefetch-key = true; - harden-glue = true; - harden-dnssec-stripped = true; - hide-identity = true; - hide-version = true; - use-caps-for-id = false; # might try this later - edns-buffer-size = 1232; - - access-control = [ - "127.0.0.0/8 allow" - "0.0.0.0/0 deny" - ]; - }; - }; - }; - - services.adguardhome = { - enable = true; - mutableSettings = true; - - settings = { - http.address = "0.0.0.0:3000"; - dns = { - bind_hosts = [ - "127.0.0.1" - config.os.core.network.lan.ip - config.os.core.network.wg.ip - config.os.core.network.hs.ip - ]; - rewrites = [ - { - domain = "router.lan"; - answer = config.os.core.network.ips.opnsense-vm; - } - { - domain = "nas.lan"; - answer = config.os.core.network.ips.bare-metal; - } - { - domain = "ldap.${masterDomain}"; - answer = config.os.core.network.ips.gateway-vm; - } - ]; - port = 53; - upstream_dns = [ "127.0.0.1:${toString unboundPort}" ]; - fallback_dns = [ "9.9.9.9" ]; - bootstrap_dns = [ "9.9.9.9" ]; - cache_size = 536870912; - anonymize_client_ip = true; - }; - - filtering = { - filtering_enabled = true; - interval = 24; - }; - filters = [ - { - enabled = true; - name = "Black Mirror Blocklist"; - url = "https://raw.githubusercontent.com/T145/black-mirror/refs/heads/master/dist/ADGUARD_SOURCES.txt"; - } - { - enabled = true; - name = "Scam Blocklist by DurableNapkin"; - url = "https://raw.githubusercontent.com/durablenapkin/scamblocklist/master/adguard.txt"; - } - { - enabled = true; - name = "Neo Dev Host Blocklist"; - url = "https://raw.githubusercontent.com/neodevpro/neodevhost/master/adblocker"; - } - { - enabled = true; - name = "hBlock Blocklist"; - url = "https://hblock.molinero.dev/hosts_adblock.txt"; - } - { - enabled = true; - name = "OISD Big Blocklist"; - url = "https://big.oisd.nl"; - } - { - enabled = true; - name = "StevenBlack Unified"; - url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts"; - } - { - enabled = true; - name = "StevenBlack Fakenews"; - url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews-only/hosts"; - } - { - enabled = true; - name = "StevenBlack Gambling"; - url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/gambling-only/hosts"; - } - - #----------------------------------------------------------------------------- - - # HaGeZi's Blocklists - - { - enabled = true; - name = "HaGeZi's Ultimate Blocklist"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/ultimate.txt"; - } - { - enabled = false; # Added but disabled Pro++ as a fallback if Ultimate proves to be too aggressive - name = "HaGeZi's Pro++ DNS Blocklist"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/pro.plus.txt"; - } - { - enabled = true; - name = "HaGeZi's Fake DNS Blocklist"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/fake.txt"; - } - { - enabled = true; - name = "HaGeZi's Threat Intelligence Feeds DNS Blocklist"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/tif.txt"; - } - { - enabled = true; - name = "HaGeZi's Dynamic DNS Blocklsit"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/dyndns.txt"; - } - { - enabled = true; - name = "HaGeZi's Badware Hoster Blocklist"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/hoster.txt"; - } - { - enabled = true; - name = "HaGeZi's URL Shortener Blocklist"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/urlshortener.txt"; - } - { - enabled = true; - name = "HaGeZi's DNS Rebind Protection"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adguard/dns-rebind-protection.txt"; - } - { - enabled = true; - name = "HaGeZi's Gambling DNS Blocklist"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/gambling.txt"; - } - - #----------------------------------------------------------------------------- - - # NEWLY REGISTERED DOMAINS / ENTROPY DGAs - - { - enabled = true; - name = "HaGeZi's Newly Registered Domains 7 days ago to yesterday"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd7.txt"; - } - { - enabled = true; - name = "HaGeZi's Newly Registered Domains 14 days ago to 8 days ago"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd14-8.txt"; - } - { - enabled = true; - name = "HaGeZi's Newly Registered Domains 21 days ago to 15 days ago"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd21-15.txt"; - } - { - enabled = true; - name = "HaGeZi's Newly Registered Domains 28 days ago to 12 days ago"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd28-22.txt"; - } - { - enabled = true; - name = "HaGeZi's Newly Registered Domains 35 days ago to 29 days ago"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd35-29.txt"; - } - { - enabled = true; - name = "HaGeZi's Newly Registered High Entropy Domains"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/dga30.txt"; - } - - #----------------------------------------------------------------------------- - - # DNS BYPASS BLOCKLISTS - - { - enabled = true; - name = "HaGeZi's DNS Bypass Blocklist"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/doh-vpn-proxy-bypass.txt"; - } - { - enabled = true; - name = "DNS HTTPS Blocklist"; - url = "https://raw.githubusercontent.com/Bryantdl7/pihole-blocklists/main/dns-https-block.txt"; - } - - #----------------------------------------------------------------------------- - - # NSFW DNS BLOCKLISTS - - { - enabled = true; - name = "HaGeZi's NSFW DNS Blocklist"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nsfw.txt"; - } - { - enabled = true; - name = "oisd NSFW"; - url = "https://nsfw.oisd.nl"; - } - { - enabled = true; - name = "StevenBlack NSFW Blocklist"; - url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/porn-only/hosts"; - } - ]; - }; - }; - - os.srv.dns.adguardProxyConfig = { - "adguard.${masterDomain}" = { - enableACME = true; - forceSSL = true; - - locations."/" = { - proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3000"; - extraConfig = securityTemplates.restrictToInternal; - }; - }; - }; - - networking.firewall = { - allowedUDPPorts = [ 53 ]; - allowedTCPPorts = [ 53 ]; - }; - }; -} diff --git a/os/srv/files.nix b/os/srv/files.nix deleted file mode 100644 index 777a394..0000000 --- a/os/srv/files.nix +++ /dev/null @@ -1,55 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.srv.files; -in -{ - options.os.srv.files = { - enable = lib.mkEnableOption "enables general file management stuff"; - localsend.enable = lib.mkEnableOption "enables localsend for sharing files locally"; - krusader.enable = lib.mkEnableOption "enables krusader for easier file moving using ssh"; - }; - config = lib.mkMerge [ - (lib.mkIf cfg.enable { - # programs.thunar = { - # enable = true; - # plugins = with pkgs; [ - # ffmpegthumbnailer - # libgsf - # poppler - # freetype - # webp-pixbuf-loader - # thunar-volman - # thunar-archive-plugin - # ]; - # }; - services = { - tumbler.enable = true; - gvfs.enable = true; - }; - environment.systemPackages = with pkgs; [ - pcmanfm - file-roller - gdu - pxz - ripunzip - ]; - }) - (lib.mkIf cfg.localsend.enable { - programs.localsend = { - enable = true; - openFirewall = true; - }; - }) - (lib.mkIf cfg.krusader.enable { - environment.systemPackages = with pkgs; [ - krusader - kdePackages.kio-extras - ]; - }) - ]; -} diff --git a/os/srv/gaming.nix b/os/srv/gaming.nix deleted file mode 100644 index b9b6766..0000000 --- a/os/srv/gaming.nix +++ /dev/null @@ -1,145 +0,0 @@ -{ - config, - lib, - pkgs, - username, - inputs, - ... -}: -let - cfg = config.os.srv.gaming; -in -{ - options.os.srv.gaming = { - enable = lib.mkEnableOption "enables general gaming support"; - - tools.enable = lib.mkEnableOption "enables performance tools" // { - default = cfg.enable; - }; - launchers.enable = lib.mkEnableOption "enables 3rd party launchers" // { - default = cfg.enable; - }; - games.enable = lib.mkEnableOption "enables specific native games"; - steam = { - enable = lib.mkEnableOption "enables the steam launcher"; - enableSls = lib.mkEnableOption "enables the SLS Steam library modification"; - }; - vr.enable = lib.mkEnableOption "enables vr support"; - }; - - config = lib.mkMerge [ - # --- PERFORMANCE & TOOLING --- - (lib.mkIf cfg.tools.enable { - hardware.xone.enable = true; - programs = { - gamescope = { - enable = true; - capSysNice = true; - }; - - gamemode = { - enable = true; - enableRenice = true; - settings = { - general.renice = 10; - }; - }; - }; - environment = { - sessionVariables = { - OPTISCALER_ShortcutKey = "0x24"; # sets the optiscaler shortcut key to be home by default - }; - - systemPackages = with pkgs; [ - mangohud - theclicker - ludusavi - protonplus - ]; - }; - }) - - # --- EXTERNAL LAUNCHERS --- - (lib.mkIf cfg.launchers.enable { - environment.systemPackages = with pkgs; [ - heroic - (prismlauncher.override { - additionalLibs = with pkgs; [ ocl-icd ]; - jdks = with pkgs; [ javaPackages.compiler.temurin-bin.jdk-26 ]; - }) - ]; - }) - - # --- SPECIFIC GAMES --- - (lib.mkIf cfg.games.enable { - environment.systemPackages = with inputs.openmw-nix.packages.${pkgs.stdenv.hostPlatform.system}; [ - (pkgs.openttd-jgrpp) - - # OpenMW Specific - (pkgs.openmw) - (pkgs.tes3cmd) - delta-plugin - groundcoverify - momw-configurator - openmw-validator - s3lightfixes - umo - ]; - }) - - # --- STEAM --- - (lib.mkIf cfg.steam.enable ( - lib.mkMerge [ - { - programs.steam = { - enable = true; - localNetworkGameTransfers.openFirewall = true; - dedicatedServer.openFirewall = true; - remotePlay.openFirewall = false; - extest.enable = true; - protontricks.enable = true; - }; - environment.systemPackages = with pkgs; [ steamtinkerlaunch ]; - } - - (lib.mkIf cfg.steam.enableSls { - environment.systemPackages = [ - inputs.sls-steam.packages.${pkgs.stdenv.hostPlatform.system}.wrapped - ]; - home-manager.users.${username} = { - xdg.desktopEntries = { - steam = { - name = "Steam"; - comment = "Library modified Steam client"; - exec = "${ - lib.getExe' inputs.sls-steam.packages.${pkgs.stdenv.hostPlatform.system}.wrapped "SLSsteam" - } %U"; - icon = "steam"; - terminal = false; - type = "Application"; - categories = [ - "Game" - "Utility" - ]; - mimeType = [ "x-scheme-handler/steamcmd" ]; - }; - }; - }; - }) - ] - )) - - # --- VR SUPPORT --- - (lib.mkIf cfg.vr.enable { - services.wivrn = { - enable = true; - openFirewall = true; - highPriority = true; - steam.importOXRRuntimes = true; - # defaultRuntime = true; - }; - environment.systemPackages = [ pkgs.android-tools ]; - users.users.${username}.extraGroups = [ "adbusers" ]; - }) - ]; -} diff --git a/os/srv/grafana.nix b/os/srv/grafana.nix deleted file mode 100644 index 5428818..0000000 --- a/os/srv/grafana.nix +++ /dev/null @@ -1,109 +0,0 @@ -{ - config, - lib, - masterDomain, - securityTemplates, - ... -}: -let - cfg = config.os.srv.grafana; -in -{ - options.os.srv.grafana = { - enable = lib.mkEnableOption "enables grafana"; - proxyConfig = lib.mkOption { - type = lib.types.attrs; - default = { }; - }; - }; - config = lib.mkIf cfg.enable { - services.grafana = { - enable = true; - openFirewall = true; - - # Might use later - # declarativePlugins = [ ]; - - settings = { - server = { - protocol = "http"; - http_port = 3000; - http_addr = "0.0.0.0"; - domain = "grafana.${masterDomain}"; - root_url = "https://grafana.${masterDomain}"; - enforceDomain = true; - enable_gzip = true; - }; - database = { - wal = true; - }; - security = { - admin_user = "opc"; - # TODO: Generate password to use in sops-nix - # admin_password = "sops" - admin_email = "adikro@disroot.org"; - # TODO generate secret key and put it in sops-nix - # secret_key = "sops"; - disable_gravatar = true; - cookie_secure = true; - cookie_samesite = "lax"; - # security - allow_embedding = false; - strict_transport_security = true; - - disable_initial_admin_creation = false; - disable_brute_force_login_protection = false; - }; - # TODO setup mailing - # smtp = { enabled = true; }; - analytics.feedback_links_enabled = false; - }; - provision = { - enable = true; - datasources.settings = { - prune = true; - - datasources = [ - { - name = "Prometheus"; - type = "prometheus"; - url = "http://127.0.0.1:9090"; - access = "proxy"; - isDefault = true; - editable = false; - } - { - name = "Loki"; - type = "loki"; - url = "http://127.0.0.1:3100"; - access = "proxy"; - editable = false; - } - ]; - }; - }; - # dashboards.settings = { - # providers = [ - # { - # name = "default"; - # type = "file"; - # options.path = "/var/lib/grafana/dashboards"; - # } - # ]; - # }; - }; - - os.srv.grafana.proxyConfig = { - "grafana.${masterDomain}" = { - enableACME = true; - forceSSL = true; - - locations."/" = { - proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3000"; - proxyWebsockets = true; - extraConfig = securityTemplates.restrictToInternal; - }; - }; - }; - }; -} diff --git a/os/srv/headscale.nix b/os/srv/headscale.nix deleted file mode 100644 index 01fc06c..0000000 --- a/os/srv/headscale.nix +++ /dev/null @@ -1,76 +0,0 @@ -{ - config, - lib, - pkgs, - masterDomain, - ... -}: -let - cfg = config.os.srv.headscale; - aclPolicy = pkgs.writeText "headscale-policy.json" ( - builtins.toJSON { - groups = { - "group:admin" = [ "your-device-name" ]; - "group:friends" = [ "friend-device-name" ]; - }; - - hosts = { - "server" = "10.4.0.1"; - }; - - acls = [ - { - action = "accept"; - src = [ "group:admin" ]; - dst = [ "*:*" ]; - } - - { - action = "accept"; - src = [ "group:friends" ]; - dst = [ - "server:18080" - "server:18081" - "server:25565" - ]; - } - ]; - } - ); -in -{ - options.os.srv.headscale.enable = lib.mkEnableOption "enables headscales"; - - config = lib.mkIf cfg.enable { - services.headscale = { - enable = true; - address = "127.0.0.1"; - port = 8080; - - settings = { - server_url = "https://vpn.${masterDomain}"; - - policy.path = "${aclPolicy}"; - - dns = { - magic_dns = true; - base_domain = "vpn"; - nameservers = [ config.os.core.network.ips.vm2-gateway ]; - }; - - ip_prefixes = [ - "10.4.0.0/16" - ]; - }; - }; - - services.nginx.virtualHosts."vpn.${masterDomain}" = { - enableACME = true; - forceSSL = true; - locations."/" = { - proxyPass = "http://127.0.0.1:8080"; - proxyWebsockets = true; - }; - }; - }; -} diff --git a/os/srv/i2p.nix b/os/srv/i2p.nix deleted file mode 100644 index 5e36c20..0000000 --- a/os/srv/i2p.nix +++ /dev/null @@ -1,81 +0,0 @@ -{ - config, - lib, - masterDomain, - securityTemplates, - ... -}: -let - cfg = config.os.srv.i2p; -in -{ - options.os.srv.i2p = { - enable = lib.mkEnableOption "enables a flexible, polymorphic i2pd deployment profile"; - - mode = lib.mkOption { - type = lib.types.enum [ - "server" - "client" - ]; - default = "client"; - description = ""; - }; - }; - - config = lib.mkIf cfg.enable ( - lib.mkMerge [ - { - services.i2pd = { - enable = true; - enableIPv6 = true; - reseed.verify = true; - - yggdrasil.enable = true; - - proto = { - http.enable = true; - httpProxy.enable = true; - socksProxy = { - enable = true; - outproxyEnable = true; - }; - sam.enable = true; - i2pControl.enable = true; - }; - }; - } - - (lib.mkIf (cfg.mode == "server") { - services.i2pd = { - bandwidth = 4096; - - ntcp2.published = true; - ssu2.published = true; - - #TODO add address - yggdrasil.address = ""; - }; - - os.cluster.nginxProxies."i2p.${masterDomain}" = { - enableACME = true; - forceSSL = true; - locations."/" = { - proxyPass = "http://${config.os.core.network.ips.relay-vm}:7070"; - extraConfig = securityTemplates.restrictToInternal; - }; - }; - }) - - (lib.mkIf (cfg.mode == "client") { - services.i2pd = { - bandwidth = 512; - - ntcp2.published = false; - ssu2.published = false; - - yggdrasil.address = ""; - }; - }) - ] - ); -} diff --git a/os/srv/kea.nix b/os/srv/kea.nix deleted file mode 100644 index 168590e..0000000 --- a/os/srv/kea.nix +++ /dev/null @@ -1,58 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.srv.kea; -in -{ - options.os.srv.kea.enable = lib.mkEnableOption "enables kea dhcp server"; - config = lib.mkIf cfg.enable { - services.kea.dhcp4 = { - enable = true; - settings = { - interfaces-config = { - # To be used in a VM - interfaces = [ "eth0" ]; - dhcp-socket-type = "udp"; - }; - - lease-database = { - type = "memfile"; - persist = true; - name = "/var/lib/kea/dhcp4.leases"; - }; - - subnet4 = [ - { - id = 1; - subnet = "10.1.0.0/24"; - pools = [ { pool = "10.1.0.50 - 10.1.0.250"; } ]; - option-data = [ - { - name = "routers"; - data = "10.1.0.1"; - } - { - name = "domain-name-servers"; - data = "10.0.0.3"; - } - ]; - } - { - id = 2; - subnet = "10.2.0.0/24"; - pools = [ { pool = "10.2.0.50 - 10.2.0.250"; } ]; - option-data = [ - { - name = "routers"; - data = "10.2.0.1"; - } - { - name = "domain-name-servers"; - data = "10.0.0.3"; - } - ]; - } - ]; - }; - }; - }; -} diff --git a/os/srv/lldap.nix b/os/srv/lldap.nix deleted file mode 100644 index 6755dfe..0000000 --- a/os/srv/lldap.nix +++ /dev/null @@ -1,55 +0,0 @@ -{ - config, - lib, - masterDomain, - ... -}: -let - cfg = config.os.srv.lldap; - computedBaseDN = lib.concatStringsSep "," ( - map (domainPart: "dc=${domainPart}") (lib.splitString "." masterDomain) - ); -in -{ - options.os.srv.lldap.enable = lib.mkEnableOption "enables lldap scanning"; - config = lib.mkIf cfg.enable { - assertions = [ - { - assertion = config.os.srv.sops.enable; - message = "Required for password secure password storing"; - } - { - assertion = config.os.core.network.enableFirewall; - message = "Requires firewall"; - } - ]; - - sops.secrets = { - "lldap/password" = { - owner = "lldap"; - group = "lldap"; - }; - "lldap/env_file" = { - owner = "lldap"; - group = "lldap"; - }; - }; - - services.lldap = { - enable = true; - settings = { - ldap_base_dn = computedBaseDN; - http_host = "127.0.0.1"; - http_url = "https://lldap.${masterDomain}"; - ldap_user_email = "adikro@disroot.org"; - ldap_user_pass_file = config.sops.secrets."lldap/password".path; - silenceForceUserPassResetWarning = true; - }; - environmentFile = config.sops.secrets."lldap/env_file".path; - }; - - networking.firewall.extraInputRules = '' - ip saddr 10.0.0.0/24 tcp dport 3890 accept - ''; - }; -} diff --git a/os/srv/loki.nix b/os/srv/loki.nix deleted file mode 100644 index 84b94d8..0000000 --- a/os/srv/loki.nix +++ /dev/null @@ -1,62 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.srv.loki; -in -{ - options.os.srv.loki.enable = lib.mkEnableOption "enables loki"; - config = lib.mkIf cfg.enable { - services.loki = { - enable = true; - configuration = { - server = { - http_listen_address = "0.0.0.0"; - http_compress_responses = true; - }; - - common = { - instance_addr = "127.0.0.1"; - path_prefix = "/var/lib/loki"; - replication_factor = 1; - - storage.filesystem = { - chunks_directory = "/var/lib/loki/chunks"; - rules_directory = "/var/lib/loki/rules"; - }; - }; - - schema_config.configs = [ - { - from = "2026-01-01"; - store = "tsdb"; - object_store = "filesystem"; - schema = "v13"; - index = { - prefix = "loki_index_"; - period = "24h"; - }; - } - ]; - - ingester.wal.enabled = true; - - limits_config = { - max_entries_limit_per_query = 10000; - reject_old_samples_max_age = "720h"; - retention_period = "90d"; - volume_enabled = true; - }; - - compactor = { - enabled = true; - retention_enabled = true; - retention_delete_delay = "1h"; - compactor_window = "168h"; - }; - - querier.query_timeout = "5m"; - query_range.out_of_order_time_shifting = "5m"; - analytics.reporting_enabled = false; - }; - }; - }; -} diff --git a/os/srv/mailserver.nix b/os/srv/mailserver.nix deleted file mode 100644 index 7bcd008..0000000 --- a/os/srv/mailserver.nix +++ /dev/null @@ -1,59 +0,0 @@ -{ - config, - lib, - inputs, - masterDomain, - ... -}: -let - cfg = config.os.srv.mailserver; -in -{ - options.os.srv.mailserver.enable = lib.mkEnableOption "enables mailserver scanning"; - imports = [ inputs.nixos-mailserver.nixosModules.mailserver ]; - config = lib.mkIf cfg.enable { - assertions = [ - { - assertion = config.os.srv.sops.enable; - message = "Required for password secure password storing"; - } - { - assertion = config.os.srv.lldap.enable; - message = "required for user accounts"; - } - ]; - mailserver = { - enable = true; - fqdn = "mail.${masterDomain}"; - domains = [ masterDomain ]; - - # TODO setup ldap - ldap = { - enable = true; - uris = [ "ldap://127.0.0.1:3890" ]; - base = "ou=people,dc=yourdomain,dc=com"; - - bind = { - dn = "uid=mail-service,ou=people,dc=yourdomain,dc=com"; - passwordFile = "/var/src/secrets/ldap-mail-password"; - }; - - attributes = { - username = "uid"; - mail = "mail"; - password = "userPassword"; - uuid = "entryUUID"; - }; - - dovecot = { - userFilter = "(|(mail=%{user})(uid=%{user}))"; - passFilter = "(uid=%{user})"; - }; - - postfix = { - filter = "(mail=%s)"; - }; - }; - }; - }; -} diff --git a/os/srv/monero.nix b/os/srv/monero.nix deleted file mode 100644 index eb21abc..0000000 --- a/os/srv/monero.nix +++ /dev/null @@ -1,124 +0,0 @@ -{ - config, - lib, - pkgs, - masterDomain, - securityTemplates, - ... -}: -let - cfg = config.os.srv.monero; - banlist1 = pkgs.fetchurl { - url = "https://gui.xmr.pm/files/block.txt"; - hash = "sha256-0ik4d66js6wvrvciza0li6bsajj8dvxsqlf09hcz7hg610szdxcw"; - }; - banlist2 = pkgs.fetchurl { - url = "https://raw.githubusercontent.com/Boog900/monero-ban-list/refs/heads/main/ban_list.txt"; - hash = "sh256-01z4wm2mp4z1wq2wdkrm66j50gwk3r82m2ml4n0pwjcbajxkdc87"; - }; - - combinedBanlist = pkgs.writeText "combined-monero-banlist.txt" '' - ${builtins.readFile banlist1} - ${builtins.readFile banlist2} - ''; -in -{ - options.os.srv.monero = { - wallet.enable = lib.mkEnableOption "enables the monero wallet"; - service = { - enable = lib.mkEnableOption "enables hosting a monero node"; - public = lib.mkEnableOption "makes the RPC node public (disables authentication for general wallet syncing)"; - tor.enable = lib.mkEnableOption "exposes monero RPC via Tor Onion Service"; - i2p.enable = lib.mkEnableOption "exposes monero RPC via I2P Tunnel"; - }; - }; - - config = lib.mkMerge [ - (lib.mkIf cfg.wallet.enable { - environment.systemPackages = [ pkgs.monero-cli ]; - }) - (lib.mkIf cfg.service.enable { - assertions = [ - { - assertion = if (!cfg.service.public) then config.os.srv.sops.enable else true; - message = "sops must be enabled"; - } - { - assertion = if cfg.service.tor.enable then config.os.srv.tor.enable else true; - message = "tor must be enabled"; - } - { - assertion = if cfg.service.i2p.enable then config.os.srv.i2p.enable else true; - message = "i2p must be enabled"; - } - ]; - - sops.secrets."monero/rpc-password" = { - owner = "monero"; - restartUnits = [ "monero.service" ]; - }; - - services.monero = { - enable = true; - prune = true; - banlist = combinedBanlist; - - limits = { - upload = 1250; - download = 12500; - threads = 8; - }; - - rpc = { - address = "0.0.0.0"; - } - // lib.optionalAttrs (!cfg.service.public) { - restricted = true; - user = "admin"; - password = config.sops.secrets."monero/rpc-password".path; - }; - - }; - - services.tor = lib.mkIf cfg.service.tor.enable { - # onionServices."xmr-rpc" = { - # to = [ - # { - # port = 18081; - # address = config.os.core.network.ips.relay-vm; - # } - # ]; - # }; - }; - - services.i2pd = lib.mkIf cfg.service.i2p.enable { - # tunnels.server."xmr-rpc" = { - # port = 18081; - # address = config.os.core.network.ips.relay-vm; - # keys = "xmr-rpc-key.dat"; - # inbound.length = 3; - # outbound.length = 3; - # }; - }; - - os.cluster.nginxProxies."xmr.${masterDomain}" = { - enableACME = true; - forceSSL = true; - - locations."/" = { - proxyPass = "http://${config.os.core.network.ips.relay-vm}:18081"; - extraConfig = '' - proxy_read_timeout 600s; - proxy_send_timeout 600s; - client_max_body_size 50m; - - ${securityTemplates.restrictToInternal} - ''; - }; - }; - - # Left open for P2P syncing - networking.firewall.allowedTCPPorts = [ 18080 ]; - }) - ]; -} diff --git a/os/srv/netdata.nix b/os/srv/netdata.nix deleted file mode 100644 index a7b4300..0000000 --- a/os/srv/netdata.nix +++ /dev/null @@ -1,43 +0,0 @@ -{ - config, - lib, - masterDomain, - securityTemplates, - ... -}: -let - cfg = config.os.srv.netdata; -in -{ - options.os.srv.netdata = { - enable = lib.mkEnableOption "enables netdata monitoring"; - proxyConfig = lib.mkOption { - type = lib.types.attrs; - default = { }; - }; - }; - - config = lib.mkIf cfg.enable { - services.netdata = { - enable = true; - config.web."bind to" = "127.0.0.1"; - - python = { - enable = true; - recommendedPythonPackages = true; - }; - }; - - os.srv.netdata.proxyConfig = { - "netdata.${masterDomain}" = { - enableACME = true; - forceSSL = true; - - locations."/" = { - proxyPass = "http://${config.os.core.network.ips.host}:19999"; - extraConfig = securityTemplates.restrictToInternal; - }; - }; - }; - }; -} diff --git a/os/srv/nfs.nix b/os/srv/nfs.nix deleted file mode 100644 index 07f331e..0000000 --- a/os/srv/nfs.nix +++ /dev/null @@ -1,26 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.srv.nfs; -in -{ - options.os.srv.nfs.enable = lib.mkEnableOption "enables nfs drive sharing"; - config = lib.mkIf cfg.enable { - services.nfs.server = { - enable = true; - nproc = 4; # Lowered due to low traffic for a home server - createMountPoints = true; - - exports = '' - /data/media 10.1.0.0/24(rw,all_squash,anonuid=1000,anongid=100,async,insecure,no_subtree_check) \ - 10.3.0.0/24(rw,all_squash,anonuid=1000,anongid=100,async,insecure,no_subtree_check) \ - 10.4.0.0/24(rw,all_squash,anonuid=1000,anongid=100,async,insecure,no_subtree_check) - - /data/vault 10.1.0.0/24(rw,all_squash,anonuid=1000,anongid=100,async,insecure,no_subtree_check) \ - 10.3.0.0/24(rw,all_squash,anonuid=1000,anongid=100,async,insecure,no_subtree_check) \ - 10.4.0.0/24(rw,all_squash,anonuid=1000,anongid=100,async,insecure,no_subtree_check) - ''; - }; - - networking.firewall.allowedTCPPorts = [ 2049 ]; - }; -} diff --git a/os/srv/nginx.nix b/os/srv/nginx.nix deleted file mode 100644 index 2194ecb..0000000 --- a/os/srv/nginx.nix +++ /dev/null @@ -1,75 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: - -let - cfg = config.os.srv.nginx; -in -{ - options.os.srv.nginx = { - enable = lib.mkEnableOption "the NGINX reverse proxy service"; - - openFirewall = lib.mkOption { - type = lib.types.bool; - default = true; - description = "Whether to open ports 80 and 443 in the firewall."; - }; - }; - - config = lib.mkMerge [ - { - _module.args.securityTemplates.restrictToInternal = '' - allow 127.0.0.1; - allow ::1; - - allow ${config.os.core.network.lan.range}; - allow 10.1.0.0/24; - allow ${config.os.core.network.wg.range}; - allow ${config.os.core.network.hs.range}; - - deny all; - ''; - } - - (lib.mkIf cfg.enable { - services.nginx = { - enable = true; - package = pkgs.nginx.override { openssl = pkgs.libressl; }; - - recommendedProxySettings = true; - recommendedTlsSettings = true; - recommendedOptimisation = true; - recommendedGzipSettings = true; - virtualHosts = lib.mkMerge [ - { - "_" = { - default = true; - rejectSSL = true; - locations."/".return = "444"; - }; - } - config.os.cluster.nginxProxies - ]; - }; - - security.acme = { - acceptTerms = true; - defaults.email = "adikro@disroot.org"; - }; - - users.users.nginx.extraGroups = [ "acme" ]; - - networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ - 80 - 443 - ]; - - systemd.tmpfiles.rules = [ - "d /var/log/nginx 0750 nginx adm -" - ]; - }) - ]; -} diff --git a/os/srv/nix-helper.nix b/os/srv/nix-helper.nix deleted file mode 100644 index 5e5e133..0000000 --- a/os/srv/nix-helper.nix +++ /dev/null @@ -1,40 +0,0 @@ -{ - config, - lib, - pkgs, - username, - ... -}: -let - cfg = config.os.srv.nix-helper; -in -{ - options.os.srv.nix-helper.enable = lib.mkEnableOption "enables nix-helper"; - config = lib.mkIf cfg.enable { - nix.settings = { - trusted-users = [ - "root" - "${username}" - ]; - experimental-features = [ - "nix-command" - "flakes" - ]; - }; - - programs.nh = { - enable = true; - flake = "/etc/nixos"; - clean.extraArgs = "--keep 5"; - }; - - environment.sessionVariables = { - NH_OS_FLAKE = "/etc/nixos"; - }; - - environment.systemPackages = with pkgs; [ - nix-output-monitor - nvd - ]; - }; -} diff --git a/os/srv/ntfy.nix b/os/srv/ntfy.nix deleted file mode 100644 index 1417c81..0000000 --- a/os/srv/ntfy.nix +++ /dev/null @@ -1,59 +0,0 @@ -{ - config, - lib, - masterDomain, - ... -}: -let - cfg = config.os.srv.ntfy; -in -{ - options.os.srv.ntfy = { - enable = lib.mkEnableOption "enables ntfy"; - proxyConfig = lib.mkOption { - type = lib.types.attrs; - default = { }; - }; - }; - config = lib.mkIf cfg.enable { - services.ntfy-sh = { - enable = true; - settings = { - base-url = "https://ntfy.${masterDomain}"; - - listen-http = "127.0.0.1:2586"; - - cache-file = "/var/lib/ntfy/cache.db"; - cache-duration = "72h"; - - attachment-cache-dir = "/var/lib/ntfy/attachments"; - attachment-total-size-limit = "5G"; - attachment-file-size-limit = "15M"; - attachment-expiry-duration = "3h"; - - behind-proxy = true; - }; - }; - - os.srv.ntfy.proxyConfig = { - "uptime-kuma.${masterDomain}" = { - enableACME = true; - forceSSL = true; - - locations."/" = { - proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3001"; - extraConfig = '' - proxy_set_header Connection ""; - proxy_connect_timeout 1m; - proxy_send_timeout 1m; - proxy_read_timeout 24h; - - proxy_buffering off; - proxy_request_buffering off; - chunked_transfer_encoding on; - ''; - }; - }; - }; - }; -} diff --git a/os/srv/ntopng.nix b/os/srv/ntopng.nix deleted file mode 100644 index 692fe2c..0000000 --- a/os/srv/ntopng.nix +++ /dev/null @@ -1,43 +0,0 @@ -{ - config, - lib, - masterDomain, - securityTemplates, - ... -}: -let - cfg = config.os.srv.ntopng; -in -{ - options.os.srv.ntopng = { - enable = lib.mkEnableOption "enables ntopng monitoring"; - proxyConfig = lib.mkOption { - type = lib.types.attrs; - default = { }; - }; - }; - config = lib.mkIf cfg.enable { - services.ntopng = { - enable = true; - extraConfig = "--packet-fanout 'cluster' -g 2 -m '192.168.0.0/16,10.0.0.0/8' -X 50000 --community"; - - # TODO fill interfaces - interfaces = [ - "" # WAN Interface - "" # LAN Interface - "" # Virtual Bridge - ]; - }; - os.srv.ntopng.proxyConfig = { - "ntopng.${masterDomain}" = { - enableACME = true; - forceSSL = true; - - locations."/" = { - proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3000"; - extraConfig = securityTemplates.restrictToInternal; - }; - }; - }; - }; -} diff --git a/os/srv/oci.nix b/os/srv/oci.nix deleted file mode 100644 index ea680fd..0000000 --- a/os/srv/oci.nix +++ /dev/null @@ -1,36 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.srv.oci; -in -{ - options.os.srv.oci.enable = lib.mkEnableOption "OCI container support via Podman"; - config = lib.mkIf cfg.enable { - virtualisation = { - containers = { - enable = true; - storage.settings.driver = "zfs"; - }; - podman = { - enable = true; - dockerCompat = true; - defaultNetwork.settings.dns_enabled = true; - autoPrune = { - enable = true; - dates = "weekly"; - flags = [ "--all" ]; - }; - }; - oci-containers.backend = "podman"; - }; - - environment.systemPackages = with pkgs; [ - podman-tui - podman-compose - ]; - }; -} diff --git a/os/srv/omnisearch.nix b/os/srv/omnisearch.nix deleted file mode 100644 index ac36184..0000000 --- a/os/srv/omnisearch.nix +++ /dev/null @@ -1,73 +0,0 @@ -{ - config, - lib, - inputs, - masterDomain, - templates, - ... -}: -let - cfg = config.os.srv.omnisearch; -in -{ - imports = [ inputs.omnisearch.nixosModules.default ]; - - options.os.srv.omnisearch = { - enable = lib.mkEnableOption "enables omnisearch tracking infrastructure"; - - role = lib.mkOption { - type = lib.types.enum [ - "server" - "standalone" - ]; - default = "standalone"; - description = "Designates the deployment method"; - }; - }; - - config = lib.mkIf cfg.enable ( - lib.mkMerge [ - { - services.omnisearch = { - enable = true; - settings = { - server = { - host = "127.0.0.1"; - port = 8087; - locale = "en"; - domain = if cfg.role == "server" then "https://search.${masterDomain}" else "http://localhost:8087"; - }; - proxy = { - max_retries = 3; - randomize_username = true; - randomize_password = true; - }; - cache = { - dir = "/var/cache/omnisearch"; - ttl_search = 1800; - ttl_infobox = 86400; - }; - }; - }; - } - - (lib.mkIf (cfg.role == "server") { - assertions = [ - { - assertion = config.os.srv.nginx.enable; - message = "Required for proxying"; - } - ]; - services.nginx.virtualHosts."search.${masterDomain}" = { - enableACME = true; - forceSSL = true; - locations."/" = { - proxyPass = "http://127.0.0.1:8087"; - proxyWebsockets = true; - extraConfig = templates.restrictToInternal; - }; - }; - }) - ] - ); -} diff --git a/os/srv/postgres.nix b/os/srv/postgres.nix deleted file mode 100644 index f669f63..0000000 --- a/os/srv/postgres.nix +++ /dev/null @@ -1,72 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.srv.postgres; -in -{ - options.os.srv.postgres.enable = lib.mkEnableOption ""; - config = lib.mkIf cfg.enable { - assertions = [ - { - assertion = config.os.srv.sops.enable; - message = "Required for password secure password storing"; - } - { - assertion = config.os.core.network.enableFirewall; - message = "Requires firewall"; - } - ]; - - sops.secrets."postgres/authelia_password" = { - owner = "postgres"; - group = "postgres"; - restartUnits = [ "postgresql.service" ]; - }; - - services.postgresql = { - enable = true; - package = pkgs.postgresql_18; - - extraPlugins = [ config.services.postgresql.package.pkgs.pgvector ]; - - settings = { - listen_addresses = config.os.core.network.ips.database-vm; - - max_connections = 100; - shared_buffers = "256MB"; - work_mem = "4MB"; - }; - - ensureDatabases = [ "authelia" ]; - ensureUsers = [ - { - name = "authelia"; - ensureDBOwnership = true; - } - ]; - - initialScript = pkgs.writeText "init-postgres-passwords.sql" '' - CREATE USER authelia; - ALTER USER authelia WITH PASSWORD 'scram-sha-256'; - ''; - - authentication = pkgs.lib.mkForce '' - local all all trust - host all all 10.0.0.0/24 scram-sha-256 - ''; - }; - - systemd.services.postgresql.postStart = lib.mkAfter '' - PASS=$(cat ${config.sops.secrets."postgres/authelia_password".path}) - ${config.services.postgresql.package}/bin/psql -tAc "ALTER USER authelia WITH PASSWORD '$PASS';" - ''; - - networking.firewall.extraInputRules = '' - ip saddr 10.0.0.0/24 tcp dport 5432 accept - ''; - }; -} diff --git a/os/srv/prometheus.nix b/os/srv/prometheus.nix deleted file mode 100644 index 5b133be..0000000 --- a/os/srv/prometheus.nix +++ /dev/null @@ -1,75 +0,0 @@ -{ - config, - lib, - masterDomain, - ... -}: -let - cfg = config.os.srv.prometheus; -in -{ - options.os.srv.prometheus.enable = lib.mkEnableOption "enables prometheus"; - config = lib.mkIf cfg.enable { - services.prometheus = { - enable = true; - port = 9090; - - scrapeConfigs = [ - { - job_name = "prometheus"; - static_configs = [ { targets = [ "127.0.0.1:9090" ]; } ]; - } - { - job_name = "node-hardware"; - static_configs = [ { targets = [ "127.0.0.1:9100" ]; } ]; - } - { - job_name = "node_exporter"; - static_configs = [ { targets = [ "127.0.0.1:9100" ]; } ]; - } - { - job_name = "bare_metal_host_netdata"; - scheme = "https"; - metrics_path = "/api/v1/allmetrics"; - params = { - format = [ "prometheus" ]; - }; - static_configs = [ - { targets = [ "netdata.${masterDomain}" ]; } - ]; - } - { - job_name = "uptime_kuma"; - metrics_path = "/metrics"; - static_configs = [ { targets = [ "127.0.0.1:3001" ]; } ]; - } - { - job_name = "network-latency"; - static_configs = [ { targets = [ "127.0.0.1:9374" ]; } ]; - } - ]; - exporters = { - node = { - enable = true; - enableCollectors = [ "systemd" ]; - port = 9100; - }; - - smokeping = { - enable = true; - listenAddress = "127.0.0.1"; - - hosts = [ - "10.0.0.1" # Personal Router - "192.168.0.1" # ISP Modem Box - "84.116.254.69" # First ISP Hop - "185.182.244.39" # Regional Katowice Hub - "1.1.1.1" # Cloudflare DNS - "8.8.8.8" # Google DNS - "130.162.223.123" # OCI Instance - ]; - }; - }; - }; - }; -} diff --git a/os/srv/redis.nix b/os/srv/redis.nix deleted file mode 100644 index a51f9db..0000000 --- a/os/srv/redis.nix +++ /dev/null @@ -1,37 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.srv.redis; -in -{ - options.os.srv.redis.enable = lib.mkEnableOption ""; - config = lib.mkIf cfg.enable { - assertions = [ - { - assertion = config.os.srv.sops.enable; - message = "Required for password secure password storing"; - } - { - assertion = config.os.core.network.enableFirewall; - message = "Requires firewall"; - } - ]; - - sops.secrets."redis/password" = { - owner = "redis-main"; - restartUnits = [ "redis-servers-main.service" ]; - }; - - services.redis.servers."main" = { - enable = true; - bind = config.os.core.network.ips.database-vm; - port = 6379; - - requirePassFile = config.sops.secrets."redis/password".path; - }; - - networking.firewall.extraInputRules = '' - ip saddr 10.0.0.0/24 tcp dport 6379 accept - ''; - - }; -} diff --git a/os/srv/restic.nix b/os/srv/restic.nix deleted file mode 100644 index fb2bd19..0000000 --- a/os/srv/restic.nix +++ /dev/null @@ -1,12 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.srv.restic; -in -{ - options.os.srv.restic.enable = lib.mkEnableOption "enables restic backups"; - - config = lib.mkIf cfg.enable { - assertions = [ - ]; - }; -} diff --git a/os/srv/scrutiny.nix b/os/srv/scrutiny.nix deleted file mode 100644 index ffe8c39..0000000 --- a/os/srv/scrutiny.nix +++ /dev/null @@ -1,35 +0,0 @@ -{ - config, - lib, - masterDomain, - securityTemplates, - ... -}: -let - cfg = config.os.srv.scrutiny; -in -{ - options.os.srv.scrutiny.enable = lib.mkEnableOption "enables scrutiny monitoring"; - config = lib.mkIf cfg.enable { - services.scrutiny = { - enable = true; - settings.web.listen.host = "127.0.0.1"; - - collector = { - enable = true; - schedule = "hourly"; - settings.host.id = "bibus-lab"; - }; - }; - - services.nginx.virtualHosts."scrutiny.${masterDomain}" = { - enableACME = true; - forceSSL = true; - - locations."/" = { - proxyPass = "http://127.0.0.1:8080"; - extraConfig = securityTemplates.restrictToInternal; - }; - }; - }; -} diff --git a/os/srv/simplex.nix b/os/srv/simplex.nix deleted file mode 100644 index ca22192..0000000 --- a/os/srv/simplex.nix +++ /dev/null @@ -1,129 +0,0 @@ -{ - config, - lib, - masterDomain, - ... -}: -let - cfg = config.os.srv.simplex; - internalSmpPort = 5223; - internalXftpPort = 5224; -in -{ - options.os.srv.simplex = { - enable = lib.mkEnableOption "enables SimpleX SMP and XFTP containers via Podman"; - tor.enable = lib.mkEnableOption "enables Tor hidden services for SimpleX"; - }; - - config = lib.mkIf cfg.enable ( - lib.mkMerge [ - { - assertions = [ - { - assertion = config.os.srv.oci.enable; - message = "SimpleX requires os.srv.oci to be enabled to run containers."; - } - { - assertion = config.os.srv.nginx.enable; - message = "SimpleX requires os.srv.nginx to be enabled for clearnet proxying."; - } - { - assertion = config.os.srv.sops.enable; - message = "SimpleX requires sops for managing container passwords securely."; - } - ]; - - sops.secrets."simplex/smp-env" = { }; - sops.secrets."simplex/xftp-env" = { }; - - virtualisation.oci-containers.containers = { - simplex-smp = { - image = "simplexchat/smp-server:latest"; - ports = [ "127.0.0.1:${toString internalSmpPort}:5223" ]; - - environment = { - ADDR = "smp.${masterDomain}"; - CONFIG_DIR = "/etc/opt/simplex"; - }; - - environmentFiles = [ config.sops.secrets."simplex/smp-env".path ]; - - volumes = [ - "/var/lib/simplex/smp/config:/etc/opt/simplex:rw" - "/var/lib/simplex/smp/logs:/var/opt/simplex:rw" - "/var/lib/simplex/certs:/certificates:ro" - ]; - }; - - simplex-xftp = { - image = "simplexchat/xftp-server:latest"; - ports = [ "127.0.0.1:${toString internalXftpPort}:443" ]; - - environment = { - ADDR = "xftp.${masterDomain}"; - QUOTA = "10gb"; - }; - - environemntFiles = [ config.sops.secrets."simplex/xftp-env".path ]; - volumes = [ - "/var/lib/simplex/xftp/config:/etc/opt/simplex-xftp:rw" - "/var/lib/simplex/xftp/logs:/var/opt/simplex-xftp:rw" - "/var/lib/simplex/xftp/files:/srv/xftp:rw" - ]; - }; - }; - - systemd.tmpfiles.rules = [ - "d /var/lib/simplex/smp/config 0755 root root -" - "d /var/lib/simplex/smp/logs 0755 root root -" - "d /var/lib/simplex/rsa_certs 0755 root root -" - - "d /var/lib/simplex/xftp/config 0755 root root -" - "d /var/lib/simplex/xftp/logs 0755 root root -" - "d /var/lib/simplex/xftp/files 0755 root root -" - ]; - - networking.firewall.allowedTCPPorts = [ - 5223 - 5224 - ]; - } - - (lib.mkIf cfg.tor.enable { - assertions = [ - { - assertion = config.os.srv.tor.enable; - message = "SimpleX Tor support requires os.srv.tor to be enabled."; - } - ]; - - services.tor.relay.onionServices = { - simplex-smp = { - version = 3; - map = [ - { - port = 5223; - target = { - addr = "127.0.0.1"; - port = internalSmpPort; - }; - } - ]; - }; - simplex-xftp = { - version = 3; - map = [ - { - port = 5224; - target = { - addr = "127.0.0.1"; - port = internalXftpPort; - }; - } - ]; - }; - }; - }) - ] - ); -} diff --git a/os/srv/sops.nix b/os/srv/sops.nix deleted file mode 100644 index 3ca2d16..0000000 --- a/os/srv/sops.nix +++ /dev/null @@ -1,36 +0,0 @@ -{ - config, - lib, - pkgs, - inputs, - username, - ... -}: -let - cfg = config.os.srv.sops; -in -{ - imports = [ inputs.sops-nix.nixosModules.sops ]; - - options.os.srv.sops.enable = lib.mkEnableOption "enables sops-nix"; - config = lib.mkIf cfg.enable { - sops = { - defaultSopsFile = ../../secrets/common.yaml; - defaultSopsFormat = "yaml"; - age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; - - secrets = { - # "syncthing/gui_password".owner = username; - "syncthing/encryption/keepass".owner = username; - "syncthing/encryption/sync".owner = username; - "obs/websocket_password".owner = username; - }; - }; - - environment.systemPackages = with pkgs; [ - sops - age - ssh-to-age - ]; - }; -} diff --git a/os/srv/ssh.nix b/os/srv/ssh.nix deleted file mode 100644 index 63b2034..0000000 --- a/os/srv/ssh.nix +++ /dev/null @@ -1,95 +0,0 @@ -{ - config, - lib, - username, - ... -}: -let - cfg = config.os.srv.ssh; - keys.main = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC610CJfgc3yII7MpLVqzEzQGa8Tsm+dih+CTXHXTnv4"; -in -{ - options.os.srv.ssh = { - server.enable = lib.mkEnableOption "enables the ssh server module"; - client = { - enable = lib.mkEnableOption "enables the ssh client module"; - createAliases = lib.mkEnableOption "enables system-wide SSH shortcuts"; - }; - enableSigning = lib.mkEnableOption "enables signing git commits with ssh keys"; - }; - - config = lib.mkMerge [ - (lib.mkIf cfg.server.enable { - services.openssh = { - enable = true; - - listenAddresses = [ - { - addr = "127.0.0.1"; - port = 22; - } - ] - ++ lib.optional (config.os.core.network ? lan.ip) { - addr = config.os.core.network.lan.ip; - port = 22; - } - ++ lib.optional (config.os.core.network ? wg.ip) { - addr = config.os.core.network.wg.ip; - port = 22; - } - ++ lib.optional (config.os.core.network ? hs.ip) { - addr = config.os.core.network.hs.ip; - port = 22; - }; - hostKeys = [ - { - path = "/etc/ssh/ssh_host_ed25519_key"; - type = "ed25519"; - } - ]; - settings = { - PasswordAuthentication = false; - KbdInteractiveAuthentication = false; - PermitRootLogin = "no"; - - PubkeyAcceptedAlgorithms = "ssh-ed25519"; - }; - }; - - users.users = ( - lib.optionalAttrs (username != "" && username != null) { - ${username}.openssh.authorizedKeys.keys = [ - "${keys.main} adikro@disroot.org" - ]; - } - ); - }) - - (lib.mkIf cfg.client.enable { - programs.ssh.startAgent = true; - services.gnome.gcr-ssh-agent.enable = false; - }) - - (lib.mkIf (cfg.client.enable && cfg.client.createAliases) { - # TODO use hjem - programs.ssh.extraConfig = '' - Host github.com codeberg.org - IdentityFile /home/${username}/.ssh/main_id_ed25519.pub - IdentitiesOnly yes - User git - - Host oci - HostName 130.162.223.123 - User opc - ''; - systemd.tmpfiles.rules = [ - "d /home/${username}/.ssh 0700 ${username} users - -" - "f /home/${username}/.ssh/main_id_ed25519.pub 0644 ${username} users - ${keys.main}" - ]; - }) - - (lib.mkIf cfg.enableSigning { - environment.etc."ssh/allowed_signers".text = "adikro@disroot.org ${keys.main}"; - }) - ]; -} diff --git a/os/srv/sunshine.nix b/os/srv/sunshine.nix deleted file mode 100644 index a347568..0000000 --- a/os/srv/sunshine.nix +++ /dev/null @@ -1,42 +0,0 @@ -{ - config, - lib, - pkgs, - username, - ... -}: -let - cfgSunshine = config.os.srv.sunshine; - cfgMoonlight = config.os.srv.moonlight; -in -{ - options.os.srv = { - sunshine.enable = lib.mkEnableOption "enables sunshine streaming server"; - moonlight.enable = lib.mkEnableOption "enables moonlight streaming client"; - }; - - config = lib.mkMerge [ - (lib.mkIf cfgSunshine.enable { - services.sunshine = { - enable = true; - capSysAdmin = true; - openFirewall = true; - autoStart = false; - }; - - hardware.uinput.enable = true; - - users.users.${username}.extraGroups = [ - "video" - "input" - "render" - ]; - }) - - (lib.mkIf cfgMoonlight.enable { - environment.systemPackages = [ - pkgs.moonlight-qt - ]; - }) - ]; -} diff --git a/os/srv/syncthing.nix b/os/srv/syncthing.nix deleted file mode 100644 index 0c5e53e..0000000 --- a/os/srv/syncthing.nix +++ /dev/null @@ -1,136 +0,0 @@ -{ - config, - lib, - username, - ... -}: -let - cfg = config.os.srv.syncthing; - allFolders = { - "openmw-config" = { - path = "/home/${username}/.config/openmw"; - id = "openmw-config"; - devices = [ "oci" ]; - versioning = { - type = "simple"; - params.keep = "3"; - }; - ignorePatterns = [ - "settings.cfg" - "*.log" - ]; - }; - - "openmw-mods" = { - path = "/home/${username}/games/openmw"; - id = "openmw-mods"; - devices = [ "oci" ]; - versioning = { - type = "trashcan"; - params.cleanoutDays = "7"; - }; - }; - - "game-saves" = { - path = "/home/${username}/.saves"; - id = "game-saves"; - devices = [ "oci" ]; - versioning = { - type = "staggered"; - params = { - cleanInterval = "3600"; - maxAge = "2592000"; - }; - }; - }; - - "keepass" = { - path = "/home/${username}/.keepass"; - id = "keepass"; - devices = [ - { - name = "oci"; - encryptionPasswordFile = config.sops.secrets."syncthing/encryption/keepass".path; - } - ]; - versioning = { - type = "staggered"; - params = { - cleanInterval = "3600"; - maxAge = "31536000"; - }; - }; - }; - - "sync" = { - path = "/home/${username}/sync"; - id = "sync"; - devices = [ - { - name = "oci"; - encryptionPasswordFile = config.sops.secrets."syncthing/encryption/sync".path; - } - ]; - versioning = { - type = "staggered"; - params = { - cleanInterval = "3600"; - maxAge = "15552000"; - }; - }; - }; - - "music" = { - path = "/storage/music"; - id = "music"; - devices = [ "oci" ]; - versioning = { - type = "trashcan"; - params.cleanoutDays = "14"; - }; - }; - }; - activeFoldersSet = lib.filterAttrs (name: _: builtins.elem name cfg.activeFolders) allFolders; - - syncDirs = lib.mapAttrsToList (_: folder: folder.path) activeFoldersSet; -in -{ - options.os.srv.syncthing = { - enable = lib.mkEnableOption "enables syncthing syncing"; - - activeFolders = lib.mkOption { - type = lib.types.listOf ( - lib.types.enum [ - "openmw-config" - "openmw-mods" - "game-saves" - "keepass" - "sync" - "music" - ] - ); - default = [ - "keepass" - "sync" - ]; - description = "List of Syncthing folders to enable and sync on this specific machine."; - }; - }; - config = lib.mkIf cfg.enable { - systemd.tmpfiles.rules = map (path: "d ${path} 0755 ${username} users -") syncDirs; - - services.syncthing = { - enable = true; - user = username; - dataDir = "/home/${username}/.local/share/syncthing"; - configDir = "/home/${username}/.config/syncthing"; - # guiPasswordFile = config.sops.secrets."syncthing/gui_password".path; - - settings = { - devices."oci".id = "DQXGVDC-KGPM6RK-5NDEBJJ-R7PEWYZ-N6Z3WFZ-TSVJG5X-235SHG4-4BEJNQJ"; - - folders = activeFoldersSet; - }; - }; - }; -} diff --git a/os/srv/tailscale.nix b/os/srv/tailscale.nix deleted file mode 100644 index 5c8d72e..0000000 --- a/os/srv/tailscale.nix +++ /dev/null @@ -1,19 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.srv.tailscale; -in -{ - options.os.srv.tailscale.enable = lib.mkEnableOption "enables tailscale vpn"; - - config = lib.mkIf cfg.enable { - services.tailscale = { - enable = true; - openFirewall = true; - useRoutingFeatures = "client"; - }; - networking.firewall = { - trustedInterfaces = [ "tailscale0" ]; - checkReversePath = "loose"; - }; - }; -} diff --git a/os/srv/tor.nix b/os/srv/tor.nix deleted file mode 100644 index 8777fba..0000000 --- a/os/srv/tor.nix +++ /dev/null @@ -1,31 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.srv.tor; -in -{ - options.os.srv.tor = { - enable = lib.mkEnableOption "enables tor services"; - enableBrowser = lib.mkEnableOption "enables the tor browser"; - }; - - config = lib.mkMerge [ - (lib.mkIf cfg.enable { - services.tor = { - enable = true; - client = { - enable = true; - dns.enable = true; - transparentProxy.enable = true; - }; - }; - }) - (lib.mkIf cfg.enableBrowser { - environment.systemPackages = [ pkgs.tor-browser ]; - }) - ]; -} diff --git a/os/srv/ups.nix b/os/srv/ups.nix deleted file mode 100644 index 260f346..0000000 --- a/os/srv/ups.nix +++ /dev/null @@ -1,35 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.srv.ups; -in -{ - options.os.srv.ups.enable = lib.mkEnableOption "enables smooth shutdown on power loss"; - config = lib.mkIf cfg.enable { - power.ups = { - enable = true; - mode = "standalone"; - - ups.main = { - driver = "usbhid-ups"; - port = "auto"; - description = "Main Server UPS"; - }; - users.upsmon = { - # TODO make password - passwordFile = "sops"; - upsmon = "master"; - }; - upsmon.monitor.main = { - system = "main@localhost"; - user = "upsmon"; - # TODO password - passwordFile = "sops"; - type = "master"; - }; - # settings = { - # MINSUPPLIES = 1; - # POWERDOWNFLAG = "/run/killpower"; - # }; - }; - }; -} diff --git a/os/srv/uptime-kuma.nix b/os/srv/uptime-kuma.nix deleted file mode 100644 index 7bf8dd0..0000000 --- a/os/srv/uptime-kuma.nix +++ /dev/null @@ -1,41 +0,0 @@ -{ - config, - lib, - masterDomain, - securityTemplates, - ... -}: -let - cfg = config.os.srv.uptime-kuma; -in -{ - options.os.srv.uptime-kuma = { - enable = lib.mkEnableOption "enables uptime-kuma"; - proxyConfig = lib.mkOption { - type = lib.types.attrs; - default = { }; - }; - }; - config = lib.mkIf cfg.enable { - services.uptime-kuma = { - enable = true; - appriseSupport = true; - settings = { - HOST = "127.0.0.1"; - UPTIME_KUMA_DB_TYPE = "sqlite"; - }; - }; - - os.srv.uptime-kuma.proxyConfig = { - "uptime-kuma.${masterDomain}" = { - enableACME = true; - forceSSL = true; - - locations."/" = { - proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3001"; - extraConfig = securityTemplates.restrictToInternal; - }; - }; - }; - }; -} diff --git a/os/srv/vector.nix b/os/srv/vector.nix deleted file mode 100644 index a216a19..0000000 --- a/os/srv/vector.nix +++ /dev/null @@ -1,79 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.srv.vector; -in -{ - options.os.srv.vector = { - enable = lib.mkEnableOption "Vector observability data framework"; - agent.enable = lib.mkEnableOption "local client daemon to pull journals & stream upstream"; - aggregator.enable = lib.mkEnableOption "central receiver role to bundle, parse, and push to Loki"; - }; - - config = lib.mkIf cfg.enable { - services.vector = { - enable = true; - journaldAccess = lib.mkIf cfg.agent.enable true; - validateConfig = true; - - settings = lib.mkMerge [ - (lib.mkIf cfg.agent.enable { - sources.systemd_journal = { - type = "journald"; - exclude_units = [ "vector.service" ]; - }; - - transforms.filter_logs = { - type = "filter"; - inputs = [ "systemd_journal" ]; - condition = ''.status != "debug" && .status != "trace"''; - }; - - sinks.to_aggregator = { - type = "vector"; - inputs = [ "filter_logs" ]; - address = "${config.os.core.network.ips.vm3-monitor}:9000"; - }; - }) - - (lib.mkIf cfg.aggregator.enable { - sources.upstream_agents = { - type = "vector"; - address = "0.0.0.0:9000"; - version = "2"; - }; - - sources.opnsense_syslog = { - type = "syslog"; - address = "${cfg.aggregator.listenAddress}:5140"; - mode = "udp"; - }; - - sinks.loki_backend = { - type = "loki"; - inputs = [ - "upstream_agents" - "opnsense_syslog" - ]; - endpoint = "http://127.0.0.1:3100"; - labels = { - host = "{{ host }}"; - unit = "{{`{{_SYSTEMD_UNIT}}`}}"; - source_type = "{{ type }}"; - }; - buffer = { - type = "disk"; - max_size = 5 * (1024 * 1024 * 1024); - when_full = "block"; - }; - }; - encoding.codec = "json"; - }) - ]; - }; - - networking.firewall = lib.mkIf cfg.aggregator.enable { - allowedTCPPorts = [ 9000 ]; - allowedUDPPorts = [ 5140 ]; - }; - }; -} diff --git a/os/srv/virtualization.nix b/os/srv/virtualization.nix deleted file mode 100644 index 8ff9f3f..0000000 --- a/os/srv/virtualization.nix +++ /dev/null @@ -1,40 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.srv.virtualization; -in -{ - options.os.srv.virtualization = { - kvm.enable = lib.mkEnableOption "KVM/QEMU virtualization with Virt-Manager"; - waydroid.enable = lib.mkEnableOption "Waydroid Container Virtualization"; - }; - config = lib.mkMerge [ - (lib.mkIf cfg.kvm.enable { - virtualisation.libvirtd = { - enable = true; - qemu.package = pkgs.qemu_kvm; - qemu.swtpm.enable = true; - }; - systemd.services.libvirt-guests.enable = false; - programs.virt-manager.enable = true; - - boot.initrd.kernelModules = - (lib.optional (config.os.core.drivers.cpu == "amd") "kvm-amd") - ++ (lib.optional (config.os.core.drivers.cpu == "intel") "kvm-intel"); - }) - (lib.mkIf cfg.waydroid.enable { - virtualisation.waydroid = { - enable = true; - package = pkgs.waydroid-nftables; - }; - - environment.systemPackages = with pkgs; [ - waydroid-helper - ]; - }) - ]; -} diff --git a/os/srv/wireguard.nix b/os/srv/wireguard.nix deleted file mode 100644 index c758174..0000000 --- a/os/srv/wireguard.nix +++ /dev/null @@ -1,152 +0,0 @@ -{ - config, - lib, - hostname, - masterDomain, - ... -}: -let - cfg = config.os.srv.wireguard; -in -{ - options.os.srv.wireguard = { - enable = lib.mkEnableOption "enables wireguard vpn"; - - role = lib.mkOption { - type = lib.types.enum [ - "server" - "client" - ]; - default = "client"; - description = "where the machine is accepting connections or connecting"; - }; - - server = { - externalInterface = lib.mkOption { - type = lib.types.str; - default = "eth0"; - description = "The public WAN interface of the server"; - }; - publicKey = lib.mkOption { - type = lib.types.nullOr lib.types.str; - default = null; - description = "The public key of your primary WireGuard server node."; - }; - - peers = lib.mkOption { - type = lib.types.listOf ( - lib.types.submodule { - options = { - name = lib.mkOption { type = lib.types.str; }; - publicKey = lib.mkOption { type = lib.types.str; }; - }; - } - ); - default = [ ]; - description = "List of client peers authorized to connect to this server"; - }; - }; - - client = { - index = lib.mkOption { - type = lib.types.nullOr lib.types.int; - default = null; - description = "The assigned host index number for the client IP address"; - }; - - routeAllTraffic = lib.mkOption { - type = lib.types.bool; - default = false; - description = "Routes 100% of your internet traffic through the server when active"; - }; - }; - }; - - config = lib.mkIf cfg.enable ( - lib.mkMerge [ - { - assertions = [ - { - assertion = config.os.srv.sops.enable; - message = "required for wg private key"; - } - ]; - - sops.secrets."wg_private_key/${hostname}" = { - owner = "root"; - group = "root"; - mode = "0600"; - }; - } - - (lib.mkIf (cfg.role == "server") { - assertions = [ - { - assertion = config.os.srv.firewall.enable; - message = "required for opening ports and passthrough"; - } - ]; - boot.kernel.sysctl."net.ipv4.ip_forward" = 1; - networking.firewall.allowedUDPPorts = [ 51280 ]; - - networking.nftables = { - tables.wg-nat = { - family = "inet"; - content = '' - chain forward { - type filter hook forward priority 0; policy accept; - iifname "wg0" accept - oifname "wg0" accept - } - chain postrouting { - type nat hook postrouting priority 100; policy accept; - oifname "${cfg.server.externalInterface}" masquerade - } - ''; - }; - }; - - networking.wireguard.interfaces.wg0 = { - ips = [ "10.3.0.1/24" ]; - listenPort = 51280; - privateKeyFile = config.sops.secrets."wg_private_key/${hostname}".path; - - peers = lib.imap1 (i: peer: { - publicKey = peer.publicKey; - allowedIPs = [ "10.3.0.${toString (i + 1)}/32" ]; - persistentKeepalive = 25; - }) cfg.server.peers; - }; - }) - - (lib.mkIf (cfg.role == "client") { - assertions = [ - { - assertion = cfg.client.index != null; - message = "WireGuard client role requires a valid 'client.index' integer designation."; - } - ]; - - networking.nameservers = [ - config.os.core.network.ips.vm2-gateway - "9.9.9.9" - ]; - - networking.wireguard.interfaces.wg0 = { - ips = [ "10.3.0.${toString cfg.client.index + 1}/24" ]; - privateKeyFile = config.sops.secrets."wg_private_key/${hostname}".path; - - peers = [ - { - publicKey = cfg.server.publicKey; - endpoint = "${masterDomain}:51280"; - persistentKeepalive = 25; - - allowedIPs = if cfg.client.routeAllTraffic then [ "0.0.0.0/0" ] else [ "10.255.0.0/16" ]; - } - ]; - }; - }) - ] - ); -} diff --git a/os/srv/yggdrasil.nix b/os/srv/yggdrasil.nix deleted file mode 100644 index 6fe91af..0000000 --- a/os/srv/yggdrasil.nix +++ /dev/null @@ -1,44 +0,0 @@ -{ - config, - lib, - ... -}: -let - cfg = config.os.srv.yggdrasil; -in -{ - options.os.srv.yggdrasil.enable = lib.mkEnableOption "enables yggdrasil"; - - config = lib.mkIf cfg.enable { - services = { - yggdrasil = { - enable = true; - openMulticastPort = true; - - settings = { - # PrivateKeyPath = config.sops.secrets."yggdrasil-private-key".path; - IfName = "ygg0"; - NodeInfoPrivacy = true; - Peers = [ - "tcp://ip6.fvm.mywire.org:8080?key=000000000143db657d1d6f80b5066dd109a4cb31f7dc6cb5d56050fffb014217" - "tcp://ygg1.mk16.de:1337?key=0000000087ee9949eeab56bd430ee8f324cad55abf3993ed9b9be63ce693e18a" - "tcp://62.210.85.80:39565" - - "tls://ygg1.mk16.de:1338?key=0000000087ee9949eeab56bd430ee8f324cad55abf3993ed9b9be63ce693e18a" - "tls://103.109.234.106:443?key=000000035621c71b5610434589df051aed2688510f904ae79860668dc0fbf182" - "tls://s2.i2pd.xyz:39575" - - "quic://ygg1.mk16.de:1339?key=0000000087ee9949eeab56bd430ee8f324cad55abf3993ed9b9be63ce693e18a" - "quic://ygg6.mk16.de:1339?key=0000005e5ced06fd4d465bc651c5deb6d70cbe82d36efb68c0450268eaaa5384" - "quic://[2a0b:4142:e9e::2]:65535" - ]; - Listen = [ - "tls://0.0.0.0:0" - "tcp://[::]:9001" - ]; - }; - }; - yggdrasil-jumper.enable = true; - }; - }; -} diff --git a/os/vms/microvms.nix b/os/vms/microvms.nix deleted file mode 100644 index e2e1a0f..0000000 --- a/os/vms/microvms.nix +++ /dev/null @@ -1,37 +0,0 @@ -{ - config, - lib, - inputs, - ... -}: -let - cfg = config.os.vms; - sharedSecrets = [ - { - tag = "shared-secrets"; - proto = "virtiofs"; - source = "/etc/nixos/secrets"; - mountPoint = "/etc/nixos/secrets"; - } - ]; -in -{ - imports = [ inputs.microvm.nixosModules.host ]; - - options.os.vms = { - net-core.enable = lib.mkEnableOption "enables the net-core virtual machine"; - }; - - config = lib.mkMerge [ - (lib.mkIf cfg.net-core.enable { - microvm.vms.net-core = { - autostart = true; - config = { - imports = [ ../vms/net-core.nix ]; - microvm.shares = sharedSecrets; - }; - }; - }) - - ]; -} diff --git a/os/vms/net-core.nix b/os/vms/net-core.nix deleted file mode 100644 index a9a1c47..0000000 --- a/os/vms/net-core.nix +++ /dev/null @@ -1,30 +0,0 @@ -{ pkgs, inputs, ... }: -{ - system.stateVersion = "26.11"; - - imports = [ - inputs.microvm.nixosModules.microvm - ../core/default.nix - ]; - - os = { - core = { - allowUnfree.enable = true; - locale.enable = true; - }; - srv = { - ssh = { - server = { - enable = true; - microvm = true; - }; - }; - firewall.enable = true; - sops.enable = true; - }; - }; - - networking.hostName = "net-core"; - - environment.systemPackages = [ pkgs.vis ]; -} diff --git a/os/vms/opnsense.nix b/os/vms/opnsense.nix deleted file mode 100644 index b9f2978..0000000 --- a/os/vms/opnsense.nix +++ /dev/null @@ -1,95 +0,0 @@ -{ - config, - lib, - inputs, - ... -}: -let - cfg = config.os.srv.opnsense; - makePciArgs = - ids: - builtins.concatLists ( - map (id: [ - "-device" - "vfio-pci,host=${id},rombar=0" - ]) ids - ); -in -{ - imports = [ inputs.microvm.nixosModules.host ]; - - options.os.srv.opnsense = { - enable = lib.mkEnableOption "enables an opnsense microvm"; - - pciIDs = lib.mkOption { - type = lib.types.listOf lib.types.str; - default = [ ]; - example = [ - "03:00.0" - "03:00.1" - ]; - description = "List of PCI bus addresses to pass through directly to OPNsense."; - }; - - vendorIDs = lib.mkOption { - type = lib.types.listOf lib.types.str; - default = [ ]; - example = [ "8086:1563" ]; - description = "List of Vendor:Device IDs to bind explicitly to the vfio-pci driver."; - }; - - imagePath = lib.mkOption { - type = lib.types.path; - default = /var/lib/microvm/images/opnsense.qcow2; - description = "Path to the OPNsense qcow2 drive image block."; - }; - }; - - config = lib.mkIf cfg.enable { - boot = { - kernelParams = [ - "intel_iommu=on" - "iommu=pt" - ]; - kernelModules = [ - "vfio_pci" - "vfio" - "vfio_iommu_type1" - ]; - extraModprobeConfig = '' - options vfio-pci ids=${lib.concatStringsSep "," (lib.unique cfg.vendorIDs)} - ''; - }; - - microvm.vms.opnsense = { - autostart = true; - config = { - imports = [ inputs.microvm.nixosModules.microvm ]; - - networking.hostName = "opnsense"; - - microvm = { - vcpu = 4; - mem = 4096; - hypervisor = "qemu"; - - interfaces = [ - { - type = "bridge"; - id = "vtnet0"; - bridge = "br-srv"; - } - ]; - - qemu.extraArgs = [ - "-machine" - "q35,accel=kvm,kernel-irqchip=on" - "-cpu" - "host,migratable=off,+invtsc" - ] - ++ (makePciArgs cfg.pciIDs); - }; - }; - }; - }; -} diff --git a/os/wm/default.nix b/os/wm/default.nix deleted file mode 100644 index a470171..0000000 --- a/os/wm/default.nix +++ /dev/null @@ -1,37 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.os.wm; -in -{ - imports = [ ./niri.nix ]; - - options.os.wm.enable = lib.mkEnableOption "enables shared wm features"; - - config = lib.mkIf cfg.enable { - services.dbus.enable = true; - - xdg.portal = { - enable = true; - xdgOpenUsePortal = true; - - extraPortals = [ - pkgs.xdg-desktop-portal-gnome - pkgs.xdg-desktop-portal-gtk - ]; - - config = { - common.default = [ "gtk" ]; - niri = { - "org.freedesktop.impl.portal.ScreenCast" = [ "gnome" ]; - "org.freedesktop.impl.portal.Screenshot" = [ "gnome" ]; - "default" = [ "gtk" ]; - }; - }; - }; - }; -} diff --git a/os/wm/niri.nix b/os/wm/niri.nix deleted file mode 100644 index 58d27af..0000000 --- a/os/wm/niri.nix +++ /dev/null @@ -1,28 +0,0 @@ -{ - inputs, - config, - lib, - username, - pkgs, - ... -}: -let - cfg = config.os.wm.niri; -in -{ - imports = [ inputs.niri.nixosModules.niri ]; - - options.os.wm.niri.enable = lib.mkEnableOption "Niri"; - - config = lib.mkIf cfg.enable { - nixpkgs.overlays = [ inputs.niri.overlays.niri ]; - - programs.niri = { - enable = true; - package = pkgs.niri-unstable; - }; - - os.srv.compat.enable = true; - home-manager.users.${username}.hm.env.niri.enable = true; - }; -} -- cgit v1.3