fabian/nix_config
1
0
Fork 1
Code Issues 13 Pull requests Packages Projects Releases Wiki Activity

Compare commits

base: fabian:master
Branches Tags
fabian:master
fabian:v0.1
..
compare: fabian:v0.1
Branches Tags
fabian:master
fabian:v0.1

No commits in common. "master" and "v0.1" have entirely different histories.
master ... v0.1

43 changed files with 498 additions and 938 deletions
Show stats Expand all files Collapse all files

11
README.md
View file

@ -1,11 +0,0 @@
## Unified nix configuration
Switch server: `nixos-rebuild switch --target-host root@posixlycorrect.com --use-substitutes --show-trace --flake .\#vps`
Switch current machine: `sudo nixos-rebuild switch --flake . --show-trace`
Switch current home manager: `home-manager switch --flake . --show-trace`
Update homepage: `nix flake update --commit-lock-file --update-input homepage`
Update whole flake: `nix flake update --commit-lock-file`

168
flake.lock
View file

@ -37,11 +37,11 @@
"systems": "systems" "systems": "systems"
}, },
"locked": { "locked": {
"lastModified": 1736445563, "lastModified": 1732215451,
"narHash": "sha256-+f1MWPtja+LRlTHJP/i/3yxmnzo2LGtZmxtJJTdAp8o=", "narHash": "sha256-P2VVlzRGKBNsiHsN1yMZcSMXpwtIx9ysMFZAqKFJ14o=",
"owner": "nix-community", "owner": "nix-community",
"repo": "authentik-nix", "repo": "authentik-nix",
"rev": "bf5a5bf42189ff5f468f0ff26c9296233a97eb6c", "rev": "9d9c0a3a94a91cfed654a18239e27cf56970daa4",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -53,16 +53,16 @@
"authentik-src": { "authentik-src": {
"flake": false, "flake": false,
"locked": { "locked": {
"lastModified": 1736440980, "lastModified": 1732213300,
"narHash": "sha256-Z3rFFrXrOKaF9NpY/fInsEbzdOWnWqLfEYl7YX9hFEU=", "narHash": "sha256-4Pv35cnZGiTxe6j2O0F9L9sHzxVIC1SazeAUD5kWeBs=",
"owner": "goauthentik", "owner": "goauthentik",
"repo": "authentik", "repo": "authentik",
"rev": "9d81f0598c7735e2b4616ee865ab896056a67408", "rev": "527e584699abc93712114b05f70f59c5187caa66",
"type": "github" "type": "github"
}, },
"original": { "original": {
"owner": "goauthentik", "owner": "goauthentik",
"ref": "version/2024.12.2", "ref": "version/2024.10.4",
"repo": "authentik", "repo": "authentik",
"type": "github" "type": "github"
} }
@ -153,19 +153,24 @@
"flake-utils": "flake-utils_4", "flake-utils": "flake-utils_4",
"liburing": "liburing", "liburing": "liburing",
"nix-filter": "nix-filter", "nix-filter": "nix-filter",
"nixpkgs": "nixpkgs_4", "nixpkgs": [
"unstable"
],
"rocksdb": "rocksdb" "rocksdb": "rocksdb"
}, },
"locked": { "locked": {
"lastModified": 1721105087, "lastModified": 1721105087,
"narHash": "sha256-t74TUSswsCkOdZCKjgP74qEHKg78ShKTkP6x9/zqYX4=", "narHash": "sha256-t74TUSswsCkOdZCKjgP74qEHKg78ShKTkP6x9/zqYX4=",
"path": "/nix/store/sw263a1qb3z8qc6bb78fm4mslsz5ya7i-source", "owner": "girlbossceo",
"repo": "conduwuit",
"rev": "c29197b3f457cf72197ef5251f9815107b2526d7", "rev": "c29197b3f457cf72197ef5251f9815107b2526d7",
"type": "path" "type": "github"
}, },
"original": { "original": {
"id": "conduwuit", "owner": "girlbossceo",
"type": "indirect" "ref": "v0.4.5",
"repo": "conduwuit",
"type": "github"
} }
}, },
"crane": { "crane": {
@ -419,27 +424,6 @@
"type": "github" "type": "github"
} }
}, },
"flake-parts_2": {
"inputs": {
"nixpkgs-lib": [
"nur",
"nixpkgs"
]
},
"locked": {
"lastModified": 1733312601,
"narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
"owner": "hercules-ci",
"repo": "flake-parts",
"rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
"type": "github"
},
"original": {
"owner": "hercules-ci",
"repo": "flake-parts",
"type": "github"
}
},
"flake-utils": { "flake-utils": {
"inputs": { "inputs": {
"systems": [ "systems": [
@ -609,11 +593,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1736373539, "lastModified": 1732466619,
"narHash": "sha256-dinzAqCjenWDxuy+MqUQq0I4zUSfaCvN9rzuCmgMZJY=", "narHash": "sha256-T1e5oceypZu3Q8vzICjv1X/sGs9XfJRMW5OuXHgpB3c=",
"owner": "nix-community", "owner": "nix-community",
"repo": "home-manager", "repo": "home-manager",
"rev": "bd65bc3cde04c16755955630b344bc9e35272c56", "rev": "f3111f62a23451114433888902a55cf0692b408d",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -626,14 +610,14 @@
"homepage": { "homepage": {
"inputs": { "inputs": {
"flake-utils": "flake-utils_6", "flake-utils": "flake-utils_6",
"nixpkgs": "nixpkgs_5" "nixpkgs": "nixpkgs_4"
}, },
"locked": { "locked": {
"lastModified": 1737639979, "lastModified": 1732147487,
"narHash": "sha256-GP4bOkJMWSp55OpkBmP4VP1S2MUxmXF36fBX6/qxyOw=", "narHash": "sha256-RLJfwlKWbKIlpTG0ocVxVl8sONMI/iE9t+viBkbPP8U=",
"ref": "master", "ref": "master",
"rev": "a07048bb01ee5fb12f683366315fd3fde4f15412", "rev": "e5a63ce5af105227df8ed01447919b013cb9a0f2",
"revCount": 24, "revCount": 23,
"type": "git", "type": "git",
"url": "https://git.posixlycorrect.com/fabian/homepage.git" "url": "https://git.posixlycorrect.com/fabian/homepage.git"
}, },
@ -645,11 +629,11 @@
}, },
"impermanence": { "impermanence": {
"locked": { "locked": {
"lastModified": 1736688610, "lastModified": 1731242966,
"narHash": "sha256-1Zl9xahw399UiZSJ9Vxs1W4WRFjO1SsNdVZQD4nghz0=", "narHash": "sha256-B3C3JLbGw0FtLSWCjBxU961gLNv+BOOBC6WvstKLYMw=",
"owner": "nix-community", "owner": "nix-community",
"repo": "impermanence", "repo": "impermanence",
"rev": "c64bed13b562fc3bb454b48773d4155023ac31b7", "rev": "3ed3f0eaae9fcc0a8331e77e9319c8a4abd8a71a",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -813,7 +797,7 @@
"nixGL": { "nixGL": {
"inputs": { "inputs": {
"flake-utils": "flake-utils_7", "flake-utils": "flake-utils_7",
"nixpkgs": "nixpkgs_6" "nixpkgs": "nixpkgs_5"
}, },
"locked": { "locked": {
"lastModified": 1713543440, "lastModified": 1713543440,
@ -985,22 +969,6 @@
} }
}, },
"nixpkgs_4": { "nixpkgs_4": {
"locked": {
"lastModified": 1720768451,
"narHash": "sha256-EYekUHJE2gxeo2pM/zM9Wlqw1Uw2XTJXOSAO79ksc4Y=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "7e7c39ea35c5cdd002cd4588b03a3fb9ece6fad9",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_5": {
"locked": { "locked": {
"lastModified": 1719426051, "lastModified": 1719426051,
"narHash": "sha256-yJL9VYQhaRM7xs0M867ZFxwaONB9T2Q4LnGo1WovuR4=", "narHash": "sha256-yJL9VYQhaRM7xs0M867ZFxwaONB9T2Q4LnGo1WovuR4=",
@ -1013,7 +981,7 @@
"type": "indirect" "type": "indirect"
} }
}, },
"nixpkgs_6": { "nixpkgs_5": {
"locked": { "locked": {
"lastModified": 1660551188, "lastModified": 1660551188,
"narHash": "sha256-a1LARMMYQ8DPx1BgoI/UN4bXe12hhZkCNqdxNi6uS0g=", "narHash": "sha256-a1LARMMYQ8DPx1BgoI/UN4bXe12hhZkCNqdxNi6uS0g=",
@ -1028,13 +996,13 @@
"type": "github" "type": "github"
} }
}, },
"nixpkgs_7": { "nixpkgs_6": {
"locked": { "locked": {
"lastModified": 1737299813, "lastModified": 1732824227,
"narHash": "sha256-Qw2PwmkXDK8sPQ5YQ/y/icbQ+TYgbxfjhgnkNJyT1X8=", "narHash": "sha256-fYNXgpu1AEeLyd3fQt4Ym0tcVP7cdJ8wRoqJ+CtTRyY=",
"owner": "nixos", "owner": "nixos",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "107d5ef05c0b1119749e381451389eded30fb0d5", "rev": "c71ad5c34d51dcbda4c15f44ea4e4aa6bb6ac1e9",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -1044,34 +1012,13 @@
"type": "github" "type": "github"
} }
}, },
"nixpkgs_8": {
"locked": {
"lastModified": 1737062831,
"narHash": "sha256-Tbk1MZbtV2s5aG+iM99U8FqwxU/YNArMcWAv6clcsBc=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "5df43628fdf08d642be8ba5b3625a6c70731c19c",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nur": { "nur": {
"inputs": {
"flake-parts": "flake-parts_2",
"nixpkgs": "nixpkgs_8",
"treefmt-nix": "treefmt-nix_2"
},
"locked": { "locked": {
"lastModified": 1737464637, "lastModified": 1733015936,
"narHash": "sha256-St/dzvMCXfPPZNJME5bi86n4mEuohG9pMKp+a9l5ZqI=", "narHash": "sha256-d/wq3j57flyYQ1F3s/B2f0bHCaOKF6d7JTxzfMCGRmw=",
"owner": "nix-community", "owner": "nix-community",
"repo": "NUR", "repo": "NUR",
"rev": "a44b412c5d24f7bb55d81370501a8f9e6e824ec6", "rev": "d711073b26533360c2bc595b4e6a824b873f8e22",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -1098,11 +1045,11 @@
"treefmt-nix": "treefmt-nix" "treefmt-nix": "treefmt-nix"
}, },
"locked": { "locked": {
"lastModified": 1735164664, "lastModified": 1730284601,
"narHash": "sha256-DaWy+vo3c4TQ93tfLjUgcpPaSoDw4qV4t76Y3Mhu84I=", "narHash": "sha256-eHYcKVLIRRv3J1vjmxurS6HVdGphB53qxUeAkylYrZY=",
"owner": "nix-community", "owner": "nix-community",
"repo": "poetry2nix", "repo": "poetry2nix",
"rev": "1fb01e90771f762655be7e0e805516cd7fa4d58e", "rev": "43a898b4d76f7f3f70df77a2cc2d40096bc9d75e",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -1191,7 +1138,7 @@
"impermanence": "impermanence", "impermanence": "impermanence",
"mediawikiSkinCitizen": "mediawikiSkinCitizen", "mediawikiSkinCitizen": "mediawikiSkinCitizen",
"nixGL": "nixGL", "nixGL": "nixGL",
"nixpkgs": "nixpkgs_7", "nixpkgs": "nixpkgs_6",
"nur": "nur", "nur": "nur",
"unstable": "unstable", "unstable": "unstable",
"vpsadminos": "vpsadminos" "vpsadminos": "vpsadminos"
@ -1311,34 +1258,13 @@
"type": "github" "type": "github"
} }
}, },
"treefmt-nix_2": {
"inputs": {
"nixpkgs": [
"nur",
"nixpkgs"
]
},
"locked": {
"lastModified": 1733222881,
"narHash": "sha256-JIPcz1PrpXUCbaccEnrcUS8jjEb/1vJbZz5KkobyFdM=",
"owner": "numtide",
"repo": "treefmt-nix",
"rev": "49717b5af6f80172275d47a418c9719a31a78b53",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "treefmt-nix",
"type": "github"
}
},
"unstable": { "unstable": {
"locked": { "locked": {
"lastModified": 1737062831, "lastModified": 1732837521,
"narHash": "sha256-Tbk1MZbtV2s5aG+iM99U8FqwxU/YNArMcWAv6clcsBc=", "narHash": "sha256-jNRNr49UiuIwaarqijgdTR2qLPifxsVhlJrKzQ8XUIE=",
"owner": "nixos", "owner": "nixos",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "5df43628fdf08d642be8ba5b3625a6c70731c19c", "rev": "970e93b9f82e2a0f3675757eb0bfc73297cc6370",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -1350,11 +1276,11 @@
}, },
"vpsadminos": { "vpsadminos": {
"locked": { "locked": {
"lastModified": 1737136524, "lastModified": 1732972373,
"narHash": "sha256-wMy7IbQs87VUxJOqRSbfFIdxRRTUBQh8G1L/zwI36vY=", "narHash": "sha256-n1JQ6x5nh7/sgKKe8uWWdrw2pz2tkJm6IRpI5+I1chI=",
"owner": "vpsfreecz", "owner": "vpsfreecz",
"repo": "vpsadminos", "repo": "vpsadminos",
"rev": "0af10d77ca146293b2ed19d5dcfd98474f1fc285", "rev": "adea302cd4033be844cd033d30bc552270025331",
"type": "github" "type": "github"
}, },
"original": { "original": {

8
flake.nix
View file

@ -17,6 +17,12 @@
homepage.url = "git+https://git.posixlycorrect.com/fabian/homepage.git?ref=master"; homepage.url = "git+https://git.posixlycorrect.com/fabian/homepage.git?ref=master";
conduwuit = {
url = "github:girlbossceo/conduwuit?ref=v0.4.5";
#FIXME: Podrá volver a "nixpkgs" una vez que rocksdb.enableLiburing llegue a stable
inputs.nixpkgs.follows = "unstable";
};
authentik-nix = { authentik-nix = {
url = "github:nix-community/authentik-nix"; url = "github:nix-community/authentik-nix";
inputs.nixpkgs.follows = "nixpkgs"; inputs.nixpkgs.follows = "nixpkgs";
@ -53,7 +59,7 @@
config = import ./pkgs/config nixpkgs.lib; config = import ./pkgs/config nixpkgs.lib;
overlays = [ overlays = [
self.overlays.default self.overlays.default
nur.overlays.default nur.overlay
nixGL.overlay nixGL.overlay
]; ];
}; };

5
home/modules/baseline.nix
View file

@ -11,9 +11,7 @@ in {
enable = mkEnableOption "Basic home settings"; enable = mkEnableOption "Basic home settings";
}; };
config = mkIf cfg.enable { config = mkIf cfg.enable {
xdg = { xdg.enable = true;
enable = true;
};
home = { home = {
stateVersion = "24.05"; # DO NOT CHANGE stateVersion = "24.05"; # DO NOT CHANGE
@ -26,7 +24,6 @@ in {
killall killall
man-pages man-pages
man-pages-posix man-pages-posix
pv
tree tree
units units
unzip unzip

19
home/modules/browsers.nix Normal file
View file

@ -0,0 +1,19 @@
{
config,
lib,
pkgs,
...
}:
with lib; let
cfg = config.local.apps.browsers;
in {
options.local.apps.browsers = {
enable = mkEnableOption "Browser home settings";
};
config = mkIf cfg.enable {
home.packages = with pkgs; [
chromium
firefox
];
};
}

18
home/modules/deepState.nix
View file

@ -1,18 +0,0 @@
{
config,
lib,
pkgs,
...
}:
with lib; let
cfg = config.local.services.deepState;
in {
options.local.services.deepState.enable = mkEnableOption "trivionomicon settings";
config =
mkIf cfg.enable {
home.sessionVariables = {
FSOCIETY_TELEGRAM_BACKUP_N = "0";
FSOCIETY_TELEGRAM_BACKUP_LOCATION = "/extern/var/fsociety_backup";
};
};
}

6
home/modules/default.nix
View file

@ -8,15 +8,13 @@
./terminal ./terminal
./neovim.nix ./neovim.nix
./baseline.nix ./baseline.nix
./gaming.nix ./gaming
./yubikey.nix ./yubikey.nix
./firefox.nix ./browsers.nix
./gui ./gui
./zsh ./zsh
./gpg.nix ./gpg.nix
./defaultDesktopPack.nix ./defaultDesktopPack.nix
./accounts.nix ./accounts.nix
./syncthing.nix
./deepState.nix
]; ];
} }

2
home/modules/defaultDesktopPack.nix
View file

@ -13,7 +13,6 @@ in {
config = mkIf cfg.enable { config = mkIf cfg.enable {
home.packages = with pkgs; [ home.packages = with pkgs; [
calibre calibre
chromium
discord discord
gwenview gwenview
libreoffice-fresh libreoffice-fresh
@ -29,6 +28,7 @@ in {
vpsfree-client vpsfree-client
vscodium-fhs vscodium-fhs
zola zola
zoom-us
]; ];
}; };
} }

57
home/modules/firefox.nix
View file

@ -1,57 +0,0 @@
{
config,
lib,
pkgs,
...
}:
with lib; let
cfg = config.local.apps.firefox;
in {
options.local.apps.firefox = {
enable = mkEnableOption "firefox settings";
workspace = mkOption {
type = types.nullOr types.str;
default = null;
description = ''
i3 Workspace in which Firefox should open. If not set, Firefox will not open at startup
'';
};
makeDefaultBrowser = mkOption {
type = types.bool;
default = true;
description = ''
Take a guess
'';
};
};
config = mkIf cfg.enable (mkMerge [
{
programs.firefox.enable = true;
xsession.windowManager.i3.config.startup = optional (cfg.workspace != null) {
command = "${lib.getExe pkgs.i3-gaps} 'workspace ${cfg.workspace}; exec ${lib.getExe pkgs.firefox}'";
};
}
(mkIf cfg.makeDefaultBrowser {
xdg = {
mimeApps = {
enable = true;
defaultApplications = {
"text/html" = ["firefox"];
"text/uri-list" = ["firefox"];
"x-scheme-handler/http" = ["firefox"];
"x-scheme-handler/https" = ["firefox"];
"x-scheme-handler/about" = ["firefox"];
"x-scheme-handler/unknown" = ["firefox"];
};
};
};
home.sessionVariables.DEFAULT_BROWSER = "${lib.getExe pkgs.firefox}";
})
]);
}

5
home/modules/gaming.nix → home/modules/gaming/default.nix
View file

@ -12,6 +12,11 @@ in {
}; };
config = mkIf cfg.enable { config = mkIf cfg.enable {
home.packages = [ home.packages = [
# Steam. todo: move to the steam module later
(pkgs.callPackage ./package.nix {})
pkgs.protonup
pkgs.winetricks
pkgs.protontricks
pkgs.lutris pkgs.lutris
pkgs.openrct2 pkgs.openrct2
pkgs.prismlauncher pkgs.prismlauncher

9
home/modules/gaming/package.nix Normal file
View file

@ -0,0 +1,9 @@
{
writeShellScriptBin,
steam-run,
steam,
...
}:
writeShellScriptBin "steam" ''
exec ${steam-run}/bin/steam-run ${steam}/bin/steam -console
''

14
home/modules/gui/default.nix
View file

@ -81,9 +81,8 @@ in {
./fonts.nix ./fonts.nix
./i3.nix ./i3.nix
./polybar.nix ./polybar.nix
./startx.nix ./startx.nix # move to ly once 24.11 comes out :(
./picom.nix ./picom.nix
./theme.nix
]; ];
config = let config = let
@ -113,16 +112,5 @@ in {
polybar.enable = true; polybar.enable = true;
picom.enable = true; picom.enable = true;
}; };
xdg = {
enable = true;
mimeApps = {
enable = true;
defaultApplications = {
"application/pdf" = with pkgs; ["qpdfview"];
"x-scheme-handler/file" = with pkgs; ["kitty"];
};
};
};
}; };
} }

11
home/modules/gui/gtk.nix Normal file
View file

@ -0,0 +1,11 @@
{
config,
lib,
pkgs,
...
}: {
home.packages = with pkgs; [
gruvbox-dark-icons-gtk
libsForQt5.breeze-gtk
];
}

27
home/modules/gui/i3.nix
View file

@ -26,11 +26,8 @@ with lib; {
window = { window = {
hideEdgeBorders = "both"; hideEdgeBorders = "both";
titlebar = false;
}; };
workspaceLayout = "tabbed";
colors = { colors = {
focused = { focused = {
background = "#222222"; background = "#222222";
@ -45,43 +42,45 @@ with lib; {
# y se sobreescriba las cosas que pongo acá # y se sobreescriba las cosas que pongo acá
# NO QUITARLO. ver man home-configuration.nix # NO QUITARLO. ver man home-configuration.nix
keybindings = mkOptionDefault { keybindings = mkOptionDefault {
"${mod}+Return" = "exec ${lib.getExe pkgs.kitty} ${lib.getExe pkgs.tmux}"; "${mod}+Return" = "exec ${pkgs.kitty}/bin/kitty ${pkgs.tmux}/bin/tmux";
"${mod}+Tab" = "focus right"; "${mod}+Tab" = "focus right";
"${mod}+Shift+Tab" = "focus left"; "${mod}+Shift+Tab" = "focus left";
"${mod}+Shift+s" = "exec ${lib.getExe pkgs.maim} -s -u | ${lib.getExe pkgs.xclip} -selection clipboard -t image/png -i"; "${mod}+Shift+s" = "exec ${pkgs.maim}/bin/maim -s -u | ${pkgs.xclip}/bin/xclip -selection clipboard -t image/png -i";
"${mod}+Shift+w" = "move workspace to output right"; "${mod}+Shift+w" = "move workspace to output right";
"${mod}+l" = "exec ${lib.getExe pkgs.betterlockscreen} -l"; "${mod}+l" = "exec ${pkgs.betterlockscreen}/bin/betterlockscreen -l";
}; };
startup = [ startup = [
{ {
command = "${lib.getExe pkgs.xss-lock} --transfer-sleep-lock -- ${lib.getExe pkgs.i3lock} --nofork"; command = "${pkgs.xss-lock}/bin/xss-lock --transfer-sleep-lock -- ${pkgs.i3lock}/bin/i3lock --nofork";
notification = false; notification = false;
} }
{ {
command = "${lib.getExe pkgs.networkmanagerapplet}"; command = "${pkgs.networkmanagerapplet}/bin/nm-applet";
notification = false; notification = false;
} }
#todo: sería nice hostear esta imagen en el server y fetchearla si no existe # sería nice hostear esta imagen en el server y fetchearla si no existe
{ {
command = "${lib.getExe pkgs.feh} --bg-fill ${config.home.homeDirectory}/Pictures/wallpapers/jupiter.png"; command = "${pkgs.feh}/bin/feh --bg-fill ${config.home.homeDirectory}/Pictures/wallpapers/jupiter.png";
notification = false; notification = false;
always = true; always = true;
} }
{ {
#todo: move this to telegram module command = "${pkgs.i3-gaps}/bin/i3-msg 'workspace 1; exec ${pkgs.firefox}/bin/firefox'";
command = "${lib.getExe pkgs.i3-gaps} 'workspace 2; exec ${lib.getExe pkgs.tdesktop}'";
} }
{ {
command = "${lib.getExe pkgs.i3-gaps} 'workspace 2; exec ${lib.getExe pkgs.gajim}'"; command = "${pkgs.i3-gaps}/bin/i3-msg 'workspace 2; exec ${pkgs.tdesktop}/bin/telegram-desktop'";
} }
#{
# command = "${pkgs.i3-gaps}/bin/i3-msg 'workspace 2; exec ${pkgs.element-desktop}/bin/element-desktop'";
#}
{ {
command = "${pkgs.systemd}/bin/systemctl --user restart polybar.service"; command = "${pkgs.systemd}/bin/systemctl --user restart polybar.service";
notification = false; notification = false;
always = true; always = true;
} }
{ {
command = "${lib.getExe pkgs.autorandr} -c"; command = "${pkgs.autorandr}/bin/autorandr -c";
notification = false; notification = false;
always = true; always = true;
} }

43
home/modules/gui/theme.nix
View file

@ -1,43 +0,0 @@
{
config,
lib,
pkgs,
...
}:
with lib; {
gtk = {
enable = true;
iconTheme = {
name = "Papirus-Dark";
package = pkgs.papirus-icon-theme;
};
theme = {
package = pkgs.materia-theme;
name = "Materia-dark";
};
gtk2.extraConfig = ''
gtk-toolbar-style=GTK_TOOLBAR_BOTH_HORIZ
gtk-menu-images=1
gtk-button-images=1
'';
gtk3.extraConfig = {
gtk-application-prefer-dark-theme = 1;
};
gtk4.extraConfig = {
gtk-application-prefer-dark-theme = 1;
};
};
home.sessionVariables = {
# Use gtk in jvm apps
_JAVA_OPTIONS = concatStringsSep " " [
"-Dawt.useSystemAAFontSettings=on"
"-Dswing.aatext=true"
"-Dswing.defaultlaf=com.sun.java.swing.plaf.gtk.GTKLookAndFeel"
"-Dswing.crossplatformlaf=com.sun.java.swing.plaf.gtk.GTKLookAndFeel"
];
};
}

20
home/modules/syncthing.nix
View file

@ -1,20 +0,0 @@
{
config,
lib,
pkgs,
...
}:
with lib; let
cfg = config.local.services.syncthing;
in {
options.local.services.syncthing = {
enable = mkEnableOption "syncthing settings";
};
config = mkIf cfg.enable {
services.syncthing = {
enable = true;
tray.enable = true;
};
};
}

18
home/platforms/fabian@posixlycorrect/default.nix
View file

@ -29,12 +29,10 @@
prompt = "%B[%~] \${vcs_info_msg_0_}%b"; prompt = "%B[%~] \${vcs_info_msg_0_}%b";
}; };
accounts.enable = true; accounts.enable = true;
deepState.enable = true;
gpg = { gpg = {
enable = true; enable = true;
defaultKey = "7AA277E604A4173916BBB4E91FFAC35E1798174F"; defaultKey = "7AA277E604A4173916BBB4E91FFAC35E1798174F";
}; };
syncthing.enable = true;
}; };
apps = { apps = {
@ -42,11 +40,8 @@
neovim.enable = true; neovim.enable = true;
gaming.enable = true; gaming.enable = true;
yubikey.enable = true; yubikey.enable = true;
browsers.enable = true;
defaultDesktopPack.enable = true; defaultDesktopPack.enable = true;
firefox = {
enable = true;
workspace = "1"; #make this an int later
};
}; };
gui = { gui = {
@ -75,18 +70,7 @@
packages = with pkgs; [ packages = with pkgs; [
darktable darktable
deluge deluge
(gajim.override {
enableSecrets = true;
# enableJingle = true;
# enableSpelling = true;
enableUPnP = true;
# enableAppIndicator = true;
enableE2E = true;
enableRST = true;
})
gnucash
kdenlive kdenlive
nmap
virt-manager virt-manager
]; ];

1
pkgs/config/unfree.nix
View file

@ -8,4 +8,5 @@ with lib;
"steam-original" "steam-original"
"steam-unwrapped" "steam-unwrapped"
"steam-run" "steam-run"
"zoom"
] ]

2
sys/modules/default.nix
View file

@ -13,7 +13,5 @@
./android.nix ./android.nix
./users.nix ./users.nix
./bluetooth.nix ./bluetooth.nix
./net.nix
./steam.nix
]; ];
} }

186
sys/modules/net.nix
View file

@ -1,186 +0,0 @@
{
config,
lib,
...
}:
with lib; {
options.local.sys.nets = with lib.types;
mkOption {
readOnly = true;
type = attrsOf (submodule ({config, ...}: {
options = let
v4config = config.v4;
v6config = config.v6;
in {
hosts = mkOption {
default = {};
type = attrsOf (submodule {
options = {
v4 = mkOption {
default = null;
type = nullOr (submodule ({config, ...}: {
options = {
suffix = mkOption {
type = str;
};
address = mkOption {
type = str;
readOnly = true;
};
cidr = mkOption {
type = str;
readOnly = true;
};
single = mkOption {
type = str;
readOnly = true;
};
};
config = {
address =
if v4config.bits == 0
then config.suffix
else if v4config.bits == 32
then v4config.subnet
else "${v4config.prefix}.${config.suffix}";
cidr = "${config.address}/${toString v4config.bits}";
single = "${config.address}/32";
};
}));
};
v6 = mkOption {
default = null;
type = nullOr (submodule ({config, ...}: {
options = {
suffix = mkOption {
type = str;
};
address = mkOption {
type = str;
readOnly = true;
};
cidr = mkOption {
type = str;
readOnly = true;
};
single = mkOption {
type = str;
readOnly = true;
};
};
config = {
address = let
hextets = fragment: length (splitString ":" fragment);
separator =
if doubleColon
then "::"
else ":";
doubleColon = hextets v6config.prefix + hextets config.suffix < 8;
joined =
if v6config.bits == 128
then v6config.prefix
else if v6config.bits == 0
then config.suffix
else "${v6config.prefix}${separator}${config.suffix}";
in
joined;
cidr = "${config.address}/${toString v6config.bits}";
single = "${config.address}/128";
};
}));
};
};
});
};
v4 = mkOption {
default = null;
type = nullOr (submodule ({config, ...}: {
options = {
bits = mkOption {
type = enum [0 8 16 24 32];
};
prefix = mkOption {
type = str;
};
subnet = mkOption {
type = str;
readOnly = true;
};
cidr = mkOption {
type = str;
readOnly = true;
};
};
config = {
cidr = "${config.subnet}/${toString config.bits}";
subnet =
if config.bits != 0
then config.prefix + strings.replicate (4 - config.bits / 8) ".0"
else "0.0.0.0";
};
}));
};
v6 = mkOption {
default = null;
type = nullOr (submodule ({config, ...}: {
options = {
bits = mkOption {
type =
addCheck (ints.between 0 128) (b: mod b 4 == 0)
// {
description = "IPv6 subnet bits at nibble boundary";
};
};
prefix = mkOption {
type = str;
};
subnet = mkOption {
type = str;
readOnly = true;
};
cidr = mkOption {
type = str;
readOnly = true;
};
};
config = {
cidr = "${config.subnet}/${toString config.bits}";
subnet =
if config.bits == 128 || length (splitString "::" config.prefix) > 1
then config.prefix
else "${config.prefix}::";
};
}));
};
};
}));
};
}

30
sys/modules/steam.nix
View file

@ -1,30 +0,0 @@
{
config,
lib,
pkgs,
...
}:
with lib; let
cfg = config.local.sys.steam;
in {
options.local.sys.steam = {
enable = mkEnableOption "steam settings";
};
config = mkIf cfg.enable {
programs.steam = {
enable = true;
remotePlay.openFirewall = true;
dedicatedServer.openFirewall = true;
localNetworkGameTransfers.openFirewall = true;
};
environment = {
systemPackages = with pkgs; [
protontricks
protonup
protonup-ng
winetricks
];
};
};
}

2
sys/modules/users.nix
View file

@ -66,7 +66,7 @@ in {
shell = pkgs.zsh; shell = pkgs.zsh;
extraGroups = extraGroups =
["users" "networkmanager"] ["users" "networkmanager"]
++ optionals (v.admin) ["wheel" "libvirtd" "dialout" "adbusers"]; ++ optionals (v.admin) ["wheel" "libvirtd" "dialout" "adbusers" ];
openssh.authorizedKeys.keyFiles = v.sshKeyPublicFile; openssh.authorizedKeys.keyFiles = v.sshKeyPublicFile;
}) })
enabledUsers; enabledUsers;

1
sys/platforms/posixlycorrect/default.nix
View file

@ -19,7 +19,6 @@
graphics.enable = true; graphics.enable = true;
virtualisation.enable = true; virtualisation.enable = true;
androidSupport.enable = true; androidSupport.enable = true;
steam.enable = true;
users = { users = {
fabian = { fabian = {

72
sys/platforms/vps/default.nix
View file

@ -13,7 +13,6 @@ with lib; {
flakes.impermanence.nixosModule flakes.impermanence.nixosModule
./hardware-configuration.nix ./hardware-configuration.nix
./srv ./srv
./networkMap.nix
]; ];
local.sys = { local.sys = {
@ -25,17 +24,12 @@ with lib; {
}; };
}; };
networking = { networking.hostName = "vps";
hostName = "vps";
domain = "posixlycorrect.com";
};
services.openssh = { services.openssh = {
settings.PasswordAuthentication = false; settings.PasswordAuthentication = false;
}; };
programs.mosh.enable = true;
home-manager = { home-manager = {
useGlobalPkgs = true; useGlobalPkgs = true;
useUserPackages = true; useUserPackages = true;
@ -51,67 +45,9 @@ with lib; {
}; };
}; };
networking.firewall.allowedUDPPorts = [51820]; #TODO systemd.extraConfig = ''
DefaultTimeoutStartSec=900s
systemd = { '';
extraConfig = ''
DefaultTimeoutStartSec=900s
'';
network = let
inherit (config.local.sys) nets;
in {
enable = true;
netdevs = {
wg-vpn = {
netdevConfig = {
Name = "wg-vpn";
Kind = "wireguard";
};
wireguardConfig = {
PrivateKeyFile = "/var/trust/wg/vpn/key.priv";
ListenPort = "51820";
};
wireguardPeers = [
{
PublicKey = "wwUp3Uu/rSxbp+6J745O+cpnZHGWOJYWfWEsTjRE3yU=";
PresharedKeyFile = "/var/trust/wg/vpn/vps-posixlycorrect.psk";
AllowedIPs = ["${nets.vpn-posixlycorrect.v6.cidr}"];
}
{
PublicKey = "YFqg/ED26KygSRSmGzvUXpwnXPqMOI3R3caVfAtHVks=";
PresharedKeyFile = "/var/trust/wg/vpn/vps-pixel8.psk";
AllowedIPs = ["${nets.vpn-pixel8.v6.cidr}"];
}
];
};
};
networks = {
wg-vpn = {
name = "wg-vpn";
networkConfig = {
Address = [
nets.vpn-vps.hosts.vps.v6.cidr
];
};
routes = [
{
Destination = nets.vpn.v6.cidr;
}
{
Source = nets.vpn.v6.cidr;
}
];
};
};
};
};
time.timeZone = "Europe/Amsterdam"; time.timeZone = "Europe/Amsterdam";
} }

12
sys/platforms/vps/hardware-configuration.nix
View file

@ -14,16 +14,10 @@ in {
options = ["nofail" "noatime"]; options = ["nofail" "noatime"];
}; };
"/mnt/export2178" = { "/mnt/export2011" = {
device = "172.16.129.151:/nas/5876/immich"; device = "172.16.129.151:/nas/5876/bepasty";
fsType = "nfs"; fsType = "nfs";
options = ["nofail" "noatime"]; options = ["nofail" "noatime" "noexec"];
};
"/mnt/export2179" = {
device = "172.16.131.31:/nas/5876/syncthing";
fsType = "nfs";
options = ["nofail"];
}; };
}; };
} }

78
sys/platforms/vps/networkMap.nix
View file

@ -1,78 +0,0 @@
{
config,
pkgs,
lib,
flakes,
...
}:
with lib; {
local.sys.nets = {
default = {
v4 = {
bits = 32;
prefix = "37.205.12.34";
};
v6 = {
bits = 64;
prefix = "2a03:3b40:fe:102";
};
hosts = {
vps.v6.suffix = "1";
vps.v4.suffix = "";
};
};
vpn = {
v6 = {
bits = 48;
prefix = "2a03:3b40:2b";
};
};
vpn-vps = {
v6 = {
bits = 64;
prefix = "2a03:3b40:2b:1000";
};
hosts = {
vps.v6.suffix = "1";
};
};
vpn-posixlycorrect = {
v6 = {
bits = 64;
prefix = "2a03:3b40:2b:1001";
};
hosts = {
posixlycorrect.v6.suffix = "1";
};
};
vpn-pixel8 = {
v6 = {
bits = 64;
prefix = "2a03:3b40:2b:1002";
};
hosts = {
pixel8.v6.suffix = "1";
};
};
vpn-t14 = {
v6 = {
bits = 64;
prefix = "2a03:3b40:2b:1003";
};
hosts = {
t14.v6.suffix = "1";
};
};
};
}

110
sys/platforms/vps/srv/authentik.nix Normal file
View file

@ -0,0 +1,110 @@
{
lib,
pkgs,
flakes,
...
}:
with lib; {
imports = [flakes.authentik-nix.nixosModules.default];
options = {
services.nginx.virtualHosts = mkOption {
type = with lib.types;
attrsOf (
submodule
(
{config, ...}: {
options = {
enableAuthentik = mkOption {
default = false;
type = bool;
};
locations = mkOption {
type = attrsOf (
submodule {
config = mkIf config.enableAuthentik {
extraConfig = ''
auth_request /outpost.goauthentik.io/auth/nginx;
error_page 401 = @goauthentik_proxy_signin;
auth_request_set $auth_cookie $upstream_http_set_cookie;
add_header Set-Cookie $auth_cookie;
# translate headers from the outposts back to the actual upstream
auth_request_set $authentik_username $upstream_http_x_authentik_username;
auth_request_set $authentik_groups $upstream_http_x_authentik_groups;
auth_request_set $authentik_email $upstream_http_x_authentik_email;
auth_request_set $authentik_name $upstream_http_x_authentik_name;
auth_request_set $authentik_uid $upstream_http_x_authentik_uid;
proxy_set_header X-authentik-username $authentik_username;
proxy_set_header X-authentik-groups $authentik_groups;
proxy_set_header X-authentik-email $authentik_email;
proxy_set_header X-authentik-name $authentik_name;
proxy_set_header X-authentik-uid $authentik_uid;
'';
};
}
);
};
};
config = mkIf config.enableAuthentik {
extraConfig = ''
proxy_buffers 8 16k;
proxy_buffer_size 32k;
location /outpost.goauthentik.io {
proxy_pass http://localhost:9000/outpost.goauthentik.io;
# ensure the host of this vserver matches your external URL you've configured
# in authentik
proxy_set_header Host $host;
proxy_redirect http://localhost:9000 https://auth.posixlycorrect.com;
proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
add_header Set-Cookie $auth_cookie;
auth_request_set $auth_cookie $upstream_http_set_cookie;
# required for POST requests to work
proxy_pass_request_body off;
proxy_set_header Content-Length "";
}
location @goauthentik_proxy_signin {
internal;
add_header Set-Cookie $auth_cookie;
return 302 /outpost.goauthentik.io/start?rd=$scheme://$http_host$request_uri;
# For domain level, use the below error_page to redirect to your authentik server with the full redirect path
# return 302 https://authentik.company/outpost.goauthentik.io/start?rd=$scheme://$http_host$request_uri;
}
'';
};
}
)
);
};
};
config = {
services = {
authentik = {
enable = true;
environmentFile = "/var/trust/authentik/authentik-env";
nginx = {
enable = true;
enableACME = true;
host = "auth.posixlycorrect.com";
};
settings = {
email = {
host = "smtp.fastmail.com";
port = 587;
username = "fabianmontero@fastmail.com";
use_tls = true;
use_ssl = false;
from = "auth@posixlycorrect.com";
};
disable_startup_analytics = true;
avatars = "initials";
};
};
};
};
}

40
sys/platforms/vps/srv/bepasty.nix Normal file
View file

@ -0,0 +1,40 @@
{
lib,
pkgs,
...
}:
with lib; {
services = {
nginx = {
virtualHosts."send.posixlycorrect.com" = {
enableACME = true;
forceSSL = true;
extraConfig = ''
proxy_headers_hash_max_size 512;
proxy_headers_hash_bucket_size 128;
'';
locations."/" = {
proxyPass = "http://127.0.0.1:8989";
};
};
};
bepasty = {
enable = true;
servers = {
"send" = {
bind = "127.0.0.1:8989";
secretKeyFile = "/var/trust/bepasty/secretKeyFile";
dataDir = "/mnt/export2011/data";
defaultPermissions = "read,create,delete";
extraConfig = ''
SITENAME = 'send.posixlycorrect.com'
MAX_ALLOWED_FILE_SIZE = 4 * 1000 * 1000 * 1000
SESSION_COOKIE_SECURE = True
ASCIINEMA_THEME = 'asciinema'
'';
};
};
};
};
}

14
sys/platforms/vps/srv/default.nix
View file

@ -9,16 +9,18 @@ with lib; {
imports = [ imports = [
./net.nix ./net.nix
./mediawiki.nix ./mediawiki.nix
# ./jitsi.nix
# ./matrix.nix currently not being used
./forgejo.nix ./forgejo.nix
./vaultwarden.nix ./vaultwarden.nix
# ./bepasty.nix
# ./jellyfin.nix
./msmtp.nix ./msmtp.nix
./kuma.nix
# ./authentik.nix consumes too much RAM and serves no purpose for now
./paperless.nix ./paperless.nix
./trilium.nix ./trilium.nix
./syncthing.nix # ./firefly.nix gnucash is better
./shiori.nix ./roundcube.nix
./calibre-web.nix
./immich.nix
./wiki-js.nix
./mealie.nix
]; ];
} }

33
sys/platforms/vps/srv/firefly.nix Normal file
View file

@ -0,0 +1,33 @@
{
lib,
pkgs,
...
}:
with lib; {
services = {
nginx = {
virtualHosts."firefly.posixlycorrect.com" = {
enableACME = true;
forceSSL = true;
extraConfig = ''
proxy_headers_hash_max_size 512;
proxy_headers_hash_bucket_size 128;
'';
};
};
firefly-iii = {
enable = true;
user = "firefly-iii";
dataDir = "/var/lib/firefly-iii";
enableNginx = true;
virtualHost = "firefly.posixlycorrect.com";
settings = {
SITE_OWNER = "fabian@posixlycorrect.com";
DB_CONNECTION = "sqlite";
APP_ENV = "local";
APP_KEY_FILE = "/var/trust/firefly/key_file";
};
};
};
}

4
sys/platforms/vps/srv/forgejo.nix
View file

@ -47,10 +47,12 @@ with lib; {
LANDING_PAGE = "explore"; LANDING_PAGE = "explore";
}; };
# You can temporarily allow registration to create an admin user.
service.DISABLE_REGISTRATION = true; service.DISABLE_REGISTRATION = true;
# ver https://github.com/nektos/act
actions = { actions = {
ENABLED = true; ENABLED = false;
}; };
mailer = { mailer = {
ENABLED = false; ENABLED = false;

73
sys/platforms/vps/srv/immich.nix
View file

@ -1,73 +0,0 @@
{
lib,
pkgs,
...
}:
with lib; {
services = {
nginx = {
virtualHosts."photos.posixlycorrect.com" = {
enableACME = true;
forceSSL = true;
extraConfig = ''
proxy_headers_hash_max_size 512;
proxy_headers_hash_bucket_size 128;
'';
locations."/" = {
proxyPass = "http://localhost:2283";
};
};
};
immich = {
enable = true;
secretsFile = "/var/trust/immich/secrets.txt";
openFirewall = true;
mediaLocation = "/mnt/export2178/immich/media";
machine-learning.enable = false;
environment = {
IMMICH_TELEMETRY_EXCLUDE = "host,api,io,repo,job";
};
settings = {
machineLearning = {
enabled = false;
};
job = {
backgroundTask = {
concurrency = 1;
};
smartSearch = {
concurrency = 1;
};
metadataExtraction = {
concurrency = 1;
};
faceDetection = {
concurrency = 1;
};
search = {
concurrency = 1;
};
sidecar = {
concurrency = 1;
};
library = {
concurrency = 1;
};
migration = {
concurrency = 1;
};
thumbnailGeneration = {
concurrency = 1;
};
videoConversion = {
concurrency = 1;
};
notifications = {
concurrency = 1;
};
};
};
};
};
}

15
sys/platforms/vps/srv/calibre-web.nix → sys/platforms/vps/srv/jellyfin.nix
View file

@ -6,7 +6,7 @@
with lib; { with lib; {
services = { services = {
nginx = { nginx = {
virtualHosts."calibre.posixlycorrect.com" = { virtualHosts."stream.posixlycorrect.com" = {
enableACME = true; enableACME = true;
forceSSL = true; forceSSL = true;
extraConfig = '' extraConfig = ''
@ -14,18 +14,17 @@ with lib; {
proxy_headers_hash_bucket_size 128; proxy_headers_hash_bucket_size 128;
''; '';
locations."/" = { locations."/" = {
proxyPass = "http://[::1]:8083"; proxyPass = "http://localhost:8096";
}; };
}; };
}; };
calibre-web = { jellyfin = {
enable = true; enable = true;
openFirewall = true; user = "jellyfin";
options = { group = "jellyfin";
enableBookUploading = true; dataDir = "/mnt/export2008/jellyfin/dataDir";
calibreLibrary = "/var/lib/calibre-web/calibre_library"; cacheDir = "/mnt/export2008/jellyfin/cacheDir";
};
}; };
}; };
} }

35
sys/platforms/vps/srv/jitsi.nix Normal file
View file

@ -0,0 +1,35 @@
{
lib,
pkgs,
...
}:
with lib; {
services = {
nginx = {
virtualHosts."meet.posixlycorrect.com" = {
enableACME = true;
forceSSL = true;
extraConfig = ''
proxy_headers_hash_max_size 512;
proxy_headers_hash_bucket_size 128;
'';
};
};
jitsi-meet = {
enable = true;
hostName = "meet.posixlycorrect.com";
nginx.enable = true;
config = {
enableWelcomePage = true;
prejoinPageEnabled = true;
defaultLang = "en";
};
interfaceConfig = {
SHOW_JITSI_WATERMARK = false;
SHOW_WATERMARK_FOR_GUESTS = false;
};
};
jitsi-videobridge.openFirewall = true;
};
}

14
sys/platforms/vps/srv/shiori.nix → sys/platforms/vps/srv/kuma.nix
View file

@ -6,7 +6,7 @@
with lib; { with lib; {
services = { services = {
nginx = { nginx = {
virtualHosts."bookmarks.posixlycorrect.com" = { virtualHosts."status.posixlycorrect.com" = {
enableACME = true; enableACME = true;
forceSSL = true; forceSSL = true;
extraConfig = '' extraConfig = ''
@ -14,16 +14,16 @@ with lib; {
proxy_headers_hash_bucket_size 128; proxy_headers_hash_bucket_size 128;
''; '';
locations."/" = { locations."/" = {
proxyPass = "http://127.0.0.1:8089"; proxyPass = "http://127.0.0.1:4456";
}; };
}; };
}; };
uptime-kuma = {
shiori = {
enable = true; enable = true;
address = "127.0.0.1"; settings = {
port = 8089; HOST = "127.0.0.1";
environmentFile = "/var/trust/shiori/env"; PORT = "4456";
};
}; };
}; };
} }

58
sys/platforms/vps/srv/matrix.nix Normal file
View file

@ -0,0 +1,58 @@
{
lib,
pkgs,
config,
flakes,
...
}:
with lib; let
subdomain = "matrix.posixlycorrect.com";
baseUrl = "https://${subdomain}";
in {
# ver https://nixos.org/manual/nixos/stable/#module-services-matrix
services = {
matrix-conduit = {
enable = true;
package = flakes.conduwuit.packages.${pkgs.system}.default;
settings.global = {
address = "::1";
port = 6167;
allow_encryption = true;
allow_federation = true;
allow_registration = false;
database_backend = "rocksdb";
server_name = "posixlycorrect.com";
allow_check_for_updates = true;
new_user_displayname_suffix = "";
};
};
nginx.virtualHosts = let
clientConfig."m.homeserver".base_url = baseUrl;
serverConfig."m.server" = "${subdomain}:443";
mkWellKnown = data: ''
default_type application/json;
add_header Access-Control-Allow-Origin *;
return 200 '${builtins.toJSON data}';
'';
in {
"posixlycorrect.com" = {
locations."= /.well-known/matrix/server".extraConfig = mkWellKnown serverConfig;
locations."= /.well-known/matrix/client".extraConfig = mkWellKnown clientConfig;
};
"${subdomain}" = {
enableACME = true;
forceSSL = true;
extraConfig = ''
proxy_headers_hash_max_size 512;
proxy_headers_hash_bucket_size 128;
'';
locations."/".extraConfig = ''
return 403;
'';
locations."/_matrix".proxyPass = "http://[::1]:6167";
locations."/_synapse/client".proxyPass = "http://[::1]:6167";
};
};
};
}

37
sys/platforms/vps/srv/mealie.nix
View file

@ -1,37 +0,0 @@
{
lib,
pkgs,
...
}:
with lib; {
systemd.services.wiki-js = {
requires = ["postgresql.service"];
after = ["postgresql.service"];
};
services = {
nginx = {
virtualHosts."food.posixlycorrect.com" = {
enableACME = true;
forceSSL = true;
extraConfig = ''
proxy_headers_hash_max_size 512;
proxy_headers_hash_bucket_size 128;
'';
locations."/" = {
proxyPass = "http://127.0.0.1:9000";
};
};
};
mealie = {
enable = true;
listenAddress = "127.0.0.1";
port = 9000;
credentialsFile = "/var/trust/mealie/credentials.env";
settings = {
ALLOW_SIGNUP = "false";
};
};
};
}

6
sys/platforms/vps/srv/mediawiki.nix
View file

@ -65,6 +65,12 @@ with lib; {
SecureLinkFixer = null; SecureLinkFixer = null;
WikiEditor = null; WikiEditor = null;
ParserFunctions = null; ParserFunctions = null;
TemplateStyles = pkgs.fetchzip {
url = "https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/TemplateStyles/+archive/refs/heads/wmf/1.44.0-wmf.5.tar.gz";
sha256 = "sha256-Mb8svP8zt4d1U/NHd9Dd2oUe/SksB/zKYGNYdpmrRfc=";
stripRoot = false;
};
}; };
}; };
}; };

14
sys/platforms/vps/srv/net.nix
View file

@ -1,14 +1,11 @@
{ {
config,
lib, lib,
pkgs, pkgs,
... ...
}: }:
with lib; let with lib; {
inherit (config.local.sys) nets;
in {
networking = { networking = {
nftables.enable = false; # learn how to use this later nftables.enable = true;
firewall = { firewall = {
enable = true; enable = true;
allowedTCPPorts = [80 443]; allowedTCPPorts = [80 443];
@ -52,15 +49,10 @@ in {
}; };
}; };
}; };
fail2ban = { fail2ban = {
enable = true; enable = true;
bantime = "10m"; bantime = "10m";
ignoreIP = [ ignoreIP = ["37.205.12.34"]; # Never ban the server's own IP
nets.default.hosts.vps.v6.cidr
nets.default.hosts.vps.v4.address
nets.vpn.v6.cidr
];
bantime-increment = { bantime-increment = {
enable = true; enable = true;
formula = "ban.Time * math.exp(float(ban.Count+1)*banFactor)/math.exp(1*banFactor)"; formula = "ban.Time * math.exp(float(ban.Count+1)*banFactor)/math.exp(1*banFactor)";

62
sys/platforms/vps/srv/roundcube.nix Normal file
View file

@ -0,0 +1,62 @@
{
lib,
pkgs,
...
}:
with lib; {
services = {
nginx = {
virtualHosts."mail.posixlycorrect.com" = {
enableACME = true;
forceSSL = true;
extraConfig = ''
proxy_headers_hash_max_size 512;
proxy_headers_hash_bucket_size 128;
'';
};
};
roundcube = {
enable = true;
hostName = "mail.posixlycorrect.com";
configureNginx = true;
maxAttachmentSize = 2048; #MB
package = pkgs.roundcube.withPlugins (plugins: [
#plugins.carddav
plugins.contextmenu
plugins.custom_from
plugins.persistent_login
]);
plugins = [
"archive"
"attachment_reminder"
#"carddav"
"contextmenu"
"custom_from"
"emoticons"
#"enigma"
"hide_blockquote"
"managesieve"
"markasjunk"
"newmail_notifier"
"password"
"persistent_login"
"reconnect"
"show_additional_headers"
"userinfo"
"vcard_attachments"
"zipdownload"
];
dicts = with pkgs.aspellDicts; [
es
en
];
extraConfig = ''
$config['smtp_host'] = "ssl://smtp.fastmail.com:465";
$config['smtp_user'] = "%u";
$config['smtp_pass'] = "%p";
$config['imap_host'] = "ssl://imap.fastmail.com:993";
'';
};
};
}

42
sys/platforms/vps/srv/syncthing.nix
View file

@ -1,42 +0,0 @@
{
lib,
pkgs,
...
}:
with lib; {
services = {
syncthing = {
enable = true;
systemService = true;
overrideFolders = false;
overrideDevices = false;
openDefaultPorts = true;
guiAddress = "127.0.0.1:8384";
settings.options.urAccepted = -1;
dataDir = "/mnt/export2179/syncthing";
relay = {
enable = true;
pools = [];
providedBy = "vps.posixlycorrect.com";
};
};
};
# calibre web stuff. make this better someday, this is pure duct-tape
users.groups."calybresync".members = ["syncthing" "calibre-web"];
systemd = {
services."calybreown" = {
script = ''
chgrp -R calybresync /var/lib/calibre-web/calibre_library
chmod -R g+w /var/lib/calibre-web/calibre_library
'';
serviceConfig.Type = "oneshot";
};
timers."calybreown" = {
wantedBy = [
"timers.target"
];
timerConfig.OnCalendar = "*-*-* *:00/30:00";
};
};
}

1
sys/platforms/vps/srv/trilium.nix
View file

@ -18,7 +18,6 @@ with lib; {
trilium-server = { trilium-server = {
enable = true; enable = true;
package = pkgs.trilium-next-server;
host = "127.0.0.1"; host = "127.0.0.1";
port = 8458; port = 8458;
noAuthentication = false; noAuthentication = false;

53
sys/platforms/vps/srv/wiki-js.nix
View file

@ -1,53 +0,0 @@
{
lib,
pkgs,
...
}:
with lib; {
systemd.services.wiki-js = {
requires = ["postgresql.service"];
after = ["postgresql.service"];
};
services = {
nginx = {
virtualHosts."wjs.posixlycorrect.com" = {
enableACME = true;
forceSSL = true;
extraConfig = ''
proxy_headers_hash_max_size 512;
proxy_headers_hash_bucket_size 128;
'';
locations."/" = {
proxyPass = "http://127.0.0.1:3000";
};
};
};
wiki-js = {
enable = true;
environmentFile = "/var/trust/wiki-js/env.txt";
settings = {
bindIP = "127.0.0.1";
port = 3000;
db = {
db = "wiki-js";
user = "wiki-js";
type = "postgres";
host = "/run/postgresql";
};
};
};
postgresql = {
enable = true;
ensureDatabases = ["wiki-js"];
ensureUsers = [
{
name = "wiki-js";
ensureDBOwnership = true;
}
];
};
};
}