dennis the formatter (#75)
* dennis the formatter * changed comment * fixup
This commit is contained in:
Dennis
GitHub
parent
47a65a151c
commit
4c1e86907a
25
flake.nix
25
flake.nix
@ -11,7 +11,6 @@
|
||||
inputs = {
|
||||
nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
|
||||
systems.url = "github:nix-systems/default";
|
||||
|
||||
nix-index-database = {
|
||||
url = "github:Mic92/nix-index-database";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
@ -94,7 +93,6 @@
|
||||
inherit (nixpkgs) lib;
|
||||
systems = [ "x86_64-linux" "aarch64-linux" ];
|
||||
forEachSystem = lib.genAttrs systems;
|
||||
|
||||
overlayList = [ self.overlays.default nix.overlays.default ];
|
||||
pkgsBySystem = forEachSystem (system: import nixpkgs {
|
||||
inherit system;
|
||||
@ -135,13 +133,13 @@
|
||||
{
|
||||
repo = "local";
|
||||
hooks = [
|
||||
{
|
||||
id = "nixfmt check";
|
||||
entry = "${nixpkgs-fmt.legacyPackages.x86_64-linux.nixpkgs-fmt}/bin/nixpkgs-fmt";
|
||||
args = [ "--check" ];
|
||||
language = "system";
|
||||
files = "\\.nix";
|
||||
}
|
||||
# {
|
||||
# id = "nixfmt check";
|
||||
# entry = "${nixpkgs-fmt.legacyPackages.x86_64-linux.nixpkgs-fmt}/bin/nixpkgs-fmt";
|
||||
# args = [ "--check" ];
|
||||
# language = "system";
|
||||
# files = "\\.nix";
|
||||
# }
|
||||
{
|
||||
id = "nix-flake-check";
|
||||
entry = "nix flake check";
|
||||
@ -175,10 +173,11 @@
|
||||
] else [
|
||||
./users/${builtins.head users}/systems/${hostname}/configuration.nix
|
||||
./users/${builtins.head users}/systems/${hostname}/hardware.nix
|
||||
]) ++ fileList "modules" ++ modules ++ lib.optional home home-manager.nixosModules.home-manager
|
||||
++ (if home then (map (user: { home-manager.users.${user} = import ./users/${user}/home.nix; }) users) else [ ]) ++ map
|
||||
(user:
|
||||
{ config, lib, pkgs, ... }@args: {
|
||||
]) ++ modules
|
||||
++ fileList "modules"
|
||||
++ lib.optional home home-manager.nixosModules.home-manager
|
||||
++ (if home then (map (user: { home-manager.users.${user} = import ./users/${user}/home.nix; }) users) else [ ])
|
||||
++ map (user: { config, lib, pkgs, ... }@args: {
|
||||
users.users.${user} = import ./users/${user} (args // { name = "${user}"; });
|
||||
boot.initrd.network.ssh.authorizedKeys = lib.mkIf server config.users.users.${user}.openssh.authorizedKeys.keys;
|
||||
sops = lib.mkIf sops {
|
||||
|
||||
@ -52,9 +52,9 @@ in {
|
||||
restic.backups =
|
||||
let
|
||||
commonOpts = {
|
||||
extraBackupArgs = [ "--exclude-file=${pkgs.writeText "restic-exclude-file" (lib.concatMapStrings (x: x + "\n") cfg.exclude)}" ];
|
||||
|
||||
initialize = true;
|
||||
extraBackupArgs = [ "--exclude-file=${pkgs.writeText "restic-exclude-file" (lib.concatMapStrings (x: x + "\n") cfg.exclude)}" ];
|
||||
pruneOpts = [ "--group-by host" "--keep-daily 7" "--keep-weekly 4" "--keep-monthly 12" ];
|
||||
passwordFile = config.sops.secrets."restic/password".path;
|
||||
paths = [
|
||||
"/etc/group"
|
||||
@ -85,8 +85,6 @@ in {
|
||||
"/var/lib/gitea/data/tmp/"
|
||||
];
|
||||
|
||||
pruneOpts = [ "--group-by host" "--keep-daily 7" "--keep-weekly 4" "--keep-monthly 12" ];
|
||||
|
||||
timerConfig = {
|
||||
OnCalendar = "*-*-* ${lib.fixedWidthString 2 "0" (toString cfg.backup_at)}:30:00";
|
||||
RandomizedDelaySec = "5m";
|
||||
@ -95,13 +93,11 @@ in {
|
||||
in
|
||||
lib.mkIf cfg.enable {
|
||||
local = commonOpts // { repository = "/var/backup"; };
|
||||
|
||||
offsite = lib.mkIf (cfg.offsite != [ ]) commonOpts // { repository = "sftp://offsite/${config.networking.hostName}"; };
|
||||
};
|
||||
};
|
||||
|
||||
sops.secrets = lib.mkIf (cfg.enable && cfg.offsite != [ ])
|
||||
{
|
||||
sops.secrets = lib.mkIf (cfg.enable && cfg.offsite != [ ]) {
|
||||
"restic/offsite/private" = {
|
||||
owner = "root";
|
||||
path = "/root/.ssh/id_offsite-backup";
|
||||
@ -130,12 +126,11 @@ in {
|
||||
'';
|
||||
|
||||
systemd = lib.mkIf cfg.enable {
|
||||
timers = lib.mkIf config.services.postgresqlBackup.enable { postgresqlBackup.timerConfig.RandomizedDelaySec = "5m"; };
|
||||
services = {
|
||||
restic-backups-local.serviceConfig.Environment = "RESTIC_PROGRESS_FPS=0.016666";
|
||||
restic-backups-offsite.serviceConfig.Environment = lib.mkIf (cfg.offsite != [ ]) "RESTIC_PROGRESS_FPS=0.016666";
|
||||
};
|
||||
|
||||
timers = lib.mkIf config.services.postgresqlBackup.enable { postgresqlBackup.timerConfig.RandomizedDelaySec = "5m"; };
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@ -5,12 +5,15 @@ in {
|
||||
options = {
|
||||
boot = {
|
||||
default = libS.mkOpinionatedOption "enable the boot builder";
|
||||
fullDiskEncryption = libS.mkOpinionatedOption "use luks full disk encrytion";
|
||||
useSystemdBoot = libS.mkOpinionatedOption "use systemd boot";
|
||||
cpuType = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
example = "amd";
|
||||
default = "";
|
||||
description = "The cpu-type installed on the server.";
|
||||
};
|
||||
|
||||
amdGPU = libS.mkOpinionatedOption "the system contains a AMD GPU";
|
||||
filesystem = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
@ -18,16 +21,16 @@ in {
|
||||
default = "ext4";
|
||||
description = "The filesystem installed.";
|
||||
};
|
||||
fullDiskEncryption = libS.mkOpinionatedOption "use luks full disk encrytion";
|
||||
useSystemdBoot = libS.mkOpinionatedOption "use systemd boot";
|
||||
};
|
||||
};
|
||||
|
||||
config.boot = lib.mkIf cfg.default {
|
||||
supportedFilesystems = [ cfg.filesystem ];
|
||||
tmp.useTmpfs = true;
|
||||
kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
|
||||
kernelParams = [ "nordrand" ] ++ lib.optional (cfg.cpuType == "amd") "kvm-amd" ++ lib.optional cfg.fullDiskEncryption "ip=<ip-addr>::<ip-gateway>:<netmask>";
|
||||
initrd = {
|
||||
# networking for netcard kernelModules = [ "e1000e" ];
|
||||
kernelModules = lib.mkIf cfg.amdGPU [ "amdgpu" ];
|
||||
|
||||
network = lib.mkIf cfg.fullDiskEncryption {
|
||||
enable = true;
|
||||
ssh = {
|
||||
@ -37,11 +40,6 @@ in {
|
||||
};
|
||||
};
|
||||
|
||||
supportedFilesystems = [ cfg.filesystem ];
|
||||
tmp.useTmpfs = true;
|
||||
kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
|
||||
kernelParams = [ "nordrand" ] ++ lib.optional (cfg.cpuType == "amd") "kvm-amd" ++ lib.optional cfg.fullDiskEncryption "ip=<ip-addr>::<ip-gateway>:<netmask>";
|
||||
|
||||
zfs = lib.mkIf (cfg.filesystem == "zfs") {
|
||||
enableUnstable = true;
|
||||
devNodes = "/dev/disk/by-id/";
|
||||
@ -49,7 +47,7 @@ in {
|
||||
};
|
||||
|
||||
loader = {
|
||||
efi = { canTouchEfiVariables = false; };
|
||||
efi.canTouchEfiVariables = false;
|
||||
generationsDir.copyKernels = true;
|
||||
systemd-boot.enable = lib.mkIf cfg.useSystemdBoot true;
|
||||
grub = lib.mkIf (!cfg.useSystemdBoot) {
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
|
||||
let cfg = config.services.fail2ban;
|
||||
in {
|
||||
options = { services.fail2ban = { recommendedDefaults = libS.mkOpinionatedOption "use fail2ban with recommended defaults"; }; };
|
||||
options.services.fail2ban.recommendedDefaults = libS.mkOpinionatedOption "use fail2ban with recommended defaults";
|
||||
|
||||
config.services.fail2ban = lib.mkIf cfg.recommendedDefaults {
|
||||
maxretry = 5;
|
||||
|
||||
@ -10,38 +10,40 @@ in {
|
||||
default = "dotfiles";
|
||||
description = "A name for the service which needs to be pulled";
|
||||
};
|
||||
|
||||
path = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.path;
|
||||
default = null;
|
||||
description = "Path that needs to be updated via git pull";
|
||||
};
|
||||
|
||||
frequency = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "systemd-timer compatible time between pulls";
|
||||
default = "1h";
|
||||
};
|
||||
|
||||
ssh-key = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "ssh-key used to pull the repository";
|
||||
};
|
||||
|
||||
triggersRebuild = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
description =
|
||||
"Whether or not the rebuild service should be triggered after pulling. Note that system.autoUpgrade must be pointed at the same directory as this service if you'd like to use this option.";
|
||||
description = "Whether or not the rebuild service should be triggered after pulling. Note that system.autoUpgrade must be pointed at the same directory as this service if you'd like to use this option.";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# implementation
|
||||
config = lib.mkIf (cfg.enable && !(builtins.isNull cfg.path)) {
|
||||
environment.systemPackages = [ pkgs.openssh pkgs.git ];
|
||||
systemd.services."autopull@${cfg.name}" = {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network.target" ];
|
||||
description = "Pull the latest data for ${cfg.name}";
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
# TODO: See how we can migrate this to DynamicUser=yes instead
|
||||
User = "root";
|
||||
WorkingDirectory = cfg.path;
|
||||
Environment = lib.mkIf (cfg.ssh-key != "") "GIT_SSH_COMMAND=${pkgs.openssh}/bin/ssh -i ${cfg.ssh-key} -o IdentitiesOnly=yes";
|
||||
@ -50,6 +52,7 @@ in {
|
||||
Wants = "nixos-upgrade.service";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.timers."autopull@${cfg.name}" = {
|
||||
wantedBy = [ "timers.target" ];
|
||||
timerConfig = {
|
||||
@ -58,6 +61,5 @@ in {
|
||||
Unit = "autopull@${cfg.name}.service";
|
||||
};
|
||||
};
|
||||
environment.systemPackages = [ pkgs.openssh pkgs.git ];
|
||||
};
|
||||
}
|
||||
|
||||
@ -2,7 +2,6 @@
|
||||
{ config, lib, ... }: {
|
||||
config = {
|
||||
services = {
|
||||
|
||||
openssh = lib.mkIf config.services.gitea.enable {
|
||||
extraConfig = ''
|
||||
Match User gitea
|
||||
@ -22,6 +21,8 @@
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall = lib.mkIf config.services.openssh.enable { allowedTCPPorts = config.services.openssh.ports ++ [ 22 ]; };
|
||||
networking.firewall = lib.mkIf config.services.openssh.enable {
|
||||
allowedTCPPorts = config.services.openssh.ports ++ [ 22 ];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@ -1,7 +1,6 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
let
|
||||
eachSite = config.services.staticpage.sites;
|
||||
|
||||
siteOpts = { lib, name, config, ... }: {
|
||||
options = {
|
||||
package = lib.mkPackageOption pkgs "page" { };
|
||||
@ -41,7 +40,6 @@ in
|
||||
{
|
||||
options.services.staticpage = {
|
||||
enable = lib.mkEnableOption "staticpage";
|
||||
|
||||
sites = lib.mkOption {
|
||||
type = lib.types.attrsOf (lib.types.submodule siteOpts);
|
||||
default = { };
|
||||
@ -57,7 +55,6 @@ in
|
||||
name = "${(if (cfg.subdomain == null) then "${cfg.domain}" else "${cfg.subdomain}.${cfg.domain}")}";
|
||||
value = {
|
||||
root = "/var/lib/www/${cfg.root}";
|
||||
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
serverAliases = lib.mkIf (cfg.subdomain == null) [ "www.${cfg.domain}" ];
|
||||
@ -68,6 +65,7 @@ in
|
||||
access_log off;
|
||||
'';
|
||||
};
|
||||
|
||||
locations."= /robots.txt" = {
|
||||
extraConfig = ''
|
||||
allow all;
|
||||
@ -75,11 +73,13 @@ in
|
||||
access_log off;
|
||||
'';
|
||||
};
|
||||
|
||||
locations."~* ^/.well-known/" = {
|
||||
extraConfig = ''
|
||||
allow all;
|
||||
'';
|
||||
};
|
||||
|
||||
locations."~* .(js|css|png|jpg|jpeg|gif|ico|svg)$" = {
|
||||
extraConfig = ''
|
||||
try_files $uri @rewrite;
|
||||
@ -87,6 +87,7 @@ in
|
||||
log_not_found off;
|
||||
'';
|
||||
};
|
||||
|
||||
locations."~ ^/sites/.*/files/styles/" = {
|
||||
extraConfig = ''
|
||||
try_files $uri @rewrite;
|
||||
@ -118,37 +119,44 @@ in
|
||||
return 403;
|
||||
'';
|
||||
};
|
||||
|
||||
locations."~ ^/sites/.*/private/" = {
|
||||
extraConfig = ''
|
||||
return 403;
|
||||
'';
|
||||
};
|
||||
|
||||
locations."~ ^/sites/[^/]+/files/.*.php$" = {
|
||||
extraConfig = ''
|
||||
deny all;
|
||||
'';
|
||||
};
|
||||
|
||||
locations."/" = {
|
||||
extraConfig = ''
|
||||
try_files $uri /index.php?$query_string;
|
||||
'';
|
||||
};
|
||||
|
||||
locations."@rewrite" = {
|
||||
extraConfig = ''
|
||||
rewrite ^ /index.php;
|
||||
'';
|
||||
};
|
||||
|
||||
locations."~ /vendor/.*.php$" = {
|
||||
extraConfig = ''
|
||||
deny all;
|
||||
return 404;
|
||||
'';
|
||||
};
|
||||
|
||||
locations."~ ^/sites/.*/files/styles/" = {
|
||||
extraConfig = ''
|
||||
try_files $uri @rewrite;
|
||||
'';
|
||||
};
|
||||
|
||||
locations."~ ^(/[a-z-]+)?/system/files/" = {
|
||||
extraConfig = ''
|
||||
try_files $uri /index.php?$query_string;
|
||||
@ -171,6 +179,7 @@ in
|
||||
(lib.mapAttrs
|
||||
(name: cfg: {
|
||||
user = "nginx";
|
||||
phpEnv."PATH" = lib.makeBinPath [ pkgs.php ];
|
||||
settings = {
|
||||
"listen.owner" = config.services.nginx.user;
|
||||
"pm" = "dynamic";
|
||||
@ -183,7 +192,6 @@ in
|
||||
"php_admin_flag[log_errors]" = true;
|
||||
"catch_workers_output" = true;
|
||||
};
|
||||
phpEnv."PATH" = lib.makeBinPath [ pkgs.php ];
|
||||
})
|
||||
(lib.filterAttrs (n: v: v.usePHP) eachSite))
|
||||
];
|
||||
|
||||
@ -1,4 +1,6 @@
|
||||
{ lib, pkgs, config, ... }: {
|
||||
security.auditd.enable = true;
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
i18n = {
|
||||
defaultLocale = "en_US.utf8";
|
||||
supportedLocales = [ "en_US.UTF-8/UTF-8" ];
|
||||
@ -26,8 +28,6 @@
|
||||
};
|
||||
};
|
||||
|
||||
security.auditd.enable = true;
|
||||
|
||||
services = {
|
||||
fail2ban = {
|
||||
enable = lib.mkIf config.networking.firewall.enable (lib.mkDefault true);
|
||||
@ -55,7 +55,6 @@
|
||||
}
|
||||
];
|
||||
|
||||
# all of these setting are recommended by lynis unless otherwise commented
|
||||
settings = {
|
||||
AllowAgentForwarding = "no";
|
||||
AllowTcpForwarding = "no";
|
||||
@ -71,14 +70,31 @@
|
||||
PermitRootLogin = "no";
|
||||
TcpKeepAlive = "no";
|
||||
X11Forwarding = lib.mkDefault false;
|
||||
KexAlgorithms = [
|
||||
"curve25519-sha256@libssh.org"
|
||||
"diffie-hellman-group-exchange-sha256"
|
||||
];
|
||||
|
||||
KexAlgorithms = [ "curve25519-sha256@libssh.org" "diffie-hellman-group-exchange-sha256" ];
|
||||
Ciphers = [
|
||||
"chacha20-poly1305@openssh.com"
|
||||
"aes256-gcm@openssh.com"
|
||||
"aes128-gcm@openssh.com"
|
||||
"aes256-ctr"
|
||||
"aes192-ctr"
|
||||
"aes128-ctr"
|
||||
];
|
||||
|
||||
Ciphers = [ "chacha20-poly1305@openssh.com" "aes256-gcm@openssh.com" "aes128-gcm@openssh.com" "aes256-ctr" "aes192-ctr" "aes128-ctr" ];
|
||||
|
||||
Macs = [ "hmac-sha2-512-etm@openssh.com" "hmac-sha2-256-etm@openssh.com" "umac-128-etm@openssh.com" "hmac-sha2-512" "hmac-sha2-256" "umac-128@openssh.com" ];
|
||||
Macs = [
|
||||
"hmac-sha2-512-etm@openssh.com"
|
||||
"hmac-sha2-256-etm@openssh.com"
|
||||
"umac-128-etm@openssh.com"
|
||||
"hmac-sha2-512"
|
||||
"hmac-sha2-256"
|
||||
"umac-128@openssh.com"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
autopull = {
|
||||
enable = true;
|
||||
path = /root/dotfiles;
|
||||
@ -86,11 +102,10 @@
|
||||
};
|
||||
};
|
||||
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
programs = {
|
||||
git = {
|
||||
enable = true;
|
||||
lfs.enable = lib.mkDefault true;
|
||||
config = {
|
||||
interactive.singlekey = true;
|
||||
pull.rebase = true;
|
||||
@ -116,17 +131,16 @@
|
||||
|
||||
zsh = {
|
||||
enable = true;
|
||||
syntaxHighlighting.enable = true;
|
||||
zsh-autoenv.enable = true;
|
||||
enableCompletion = true;
|
||||
enableBashCompletion = true;
|
||||
ohMyZsh.enable = true;
|
||||
autosuggestions = {
|
||||
enable = true;
|
||||
strategy = [ "completion" ];
|
||||
async = true;
|
||||
};
|
||||
|
||||
syntaxHighlighting.enable = true;
|
||||
zsh-autoenv.enable = true;
|
||||
enableCompletion = true;
|
||||
enableBashCompletion = true;
|
||||
ohMyZsh = { enable = true; };
|
||||
};
|
||||
|
||||
nix-ld = {
|
||||
@ -142,6 +156,7 @@
|
||||
};
|
||||
|
||||
nix = {
|
||||
diffSystem = true;
|
||||
settings = {
|
||||
experimental-features = [ "nix-command" "flakes" ];
|
||||
keep-outputs = true;
|
||||
@ -154,8 +169,6 @@
|
||||
dates = "weekly";
|
||||
options = "--delete-older-than 30d";
|
||||
};
|
||||
|
||||
diffSystem = true;
|
||||
};
|
||||
|
||||
system = {
|
||||
@ -163,8 +176,6 @@
|
||||
enable = true;
|
||||
randomizedDelaySec = "1h";
|
||||
persistent = true;
|
||||
# Running this since this is private right now.
|
||||
# Need to set up a ssh-key for github for autoUpgrade
|
||||
flake = "git+ssh://git@github.com/RAD-Development/nix-dotfiles";
|
||||
};
|
||||
};
|
||||
|
||||
@ -1,7 +1,10 @@
|
||||
{ pkgs, ... }: {
|
||||
time.timeZone = "America/New_York";
|
||||
console.keyMap = "us";
|
||||
networking.hostId = "1beb3026";
|
||||
networking = {
|
||||
hostId = "1beb3026";
|
||||
firewall.enable = false;
|
||||
};
|
||||
|
||||
boot = {
|
||||
zfs.extraPools = [ "Main" ];
|
||||
@ -14,16 +17,16 @@
|
||||
enable = true;
|
||||
recommendedDefaults = true;
|
||||
logDriver = "local";
|
||||
storageDriver = "overlay2";
|
||||
daemon."settings" = {
|
||||
experimental = true;
|
||||
data-root = "/var/lib/docker";
|
||||
exec-opts = [ "native.cgroupdriver=systemd" ];
|
||||
log-opts = {
|
||||
max-size = "10m";
|
||||
max-file = "5";
|
||||
};
|
||||
data-root = "/var/lib/docker";
|
||||
};
|
||||
storageDriver = "overlay2";
|
||||
};
|
||||
|
||||
podman = {
|
||||
@ -34,7 +37,6 @@
|
||||
|
||||
environment = {
|
||||
systemPackages = with pkgs; [ docker-compose ];
|
||||
|
||||
etc = {
|
||||
# Creates /etc/lynis/custom.prf
|
||||
"lynis/custom.prf" = {
|
||||
@ -57,11 +59,8 @@
|
||||
|
||||
services = {
|
||||
nfs.server.enable = true;
|
||||
|
||||
openssh.ports = [ 352 ];
|
||||
|
||||
smartd.enable = true;
|
||||
|
||||
sysstat.enable = true;
|
||||
|
||||
usbguard = {
|
||||
@ -82,7 +81,5 @@
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.enable = false;
|
||||
|
||||
system.stateVersion = "23.05";
|
||||
}
|
||||
|
||||
@ -1,35 +1,31 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{ config, lib, modulesPath, ... }:
|
||||
{
|
||||
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
|
||||
imports = [
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-amd" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
swapDevices = [{ device = "/dev/disk/by-uuid/9d4ef549-d426-489d-8332-0a49589c6aed"; }];
|
||||
boot = {
|
||||
kernelModules = [ "kvm-amd" ];
|
||||
extraModulePackages = [ ];
|
||||
initrd = {
|
||||
kernelModules = [ ];
|
||||
availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
|
||||
};
|
||||
};
|
||||
|
||||
fileSystems."/" = {
|
||||
fileSystems = {
|
||||
"/" = {
|
||||
device = "/dev/disk/by-uuid/c59f7261-ebab-4cc9-8f1d-3f4c2e4b1971";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" = {
|
||||
"/boot" = {
|
||||
device = "/dev/disk/by-uuid/7295-A442";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
swapDevices = [{ device = "/dev/disk/by-uuid/9d4ef549-d426-489d-8332-0a49589c6aed"; }];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp4s0.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
};
|
||||
}
|
||||
|
||||
@ -1,7 +1,18 @@
|
||||
{ config, pkgs, ... }: {
|
||||
time.timeZone = "America/New_York";
|
||||
console.keyMap = "us";
|
||||
networking.hostId = "dc2f9781";
|
||||
systemd.services.hydra-notify.serviceConfig.EnvironmentFile = config.sops.secrets."hydra/environment".path;
|
||||
networking = {
|
||||
hostId = "dc2f9781";
|
||||
firewall.enable = false;
|
||||
};
|
||||
|
||||
nixpkgs.config.packageOverrides = pkgs: {
|
||||
vaapiIntel = pkgs.vaapiIntel.override {
|
||||
enableHybridCodec = true;
|
||||
};
|
||||
};
|
||||
|
||||
boot = {
|
||||
zfs.extraPools = [ "ZFS-primary" ];
|
||||
loader.grub.device = "/dev/sda";
|
||||
@ -25,8 +36,6 @@
|
||||
}];
|
||||
};
|
||||
|
||||
nixpkgs.config.packageOverrides = pkgs: { vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; }; };
|
||||
|
||||
hardware = {
|
||||
enableAllFirmware = true;
|
||||
opengl = {
|
||||
@ -43,6 +52,7 @@
|
||||
};
|
||||
|
||||
virtualisation = {
|
||||
# Disabling Podman as topgrade apparently prefers podman over docker and now I cant update anything :(
|
||||
docker = {
|
||||
enable = true;
|
||||
recommendedDefaults = true;
|
||||
@ -58,17 +68,12 @@
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Disabling as topgrade apparently prefers podman over docker and now I cant update anything :(
|
||||
# podman = {
|
||||
# enable = true;
|
||||
# recommendedDefaults = true;
|
||||
# };
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [ docker-compose jellyfin-ffmpeg ];
|
||||
|
||||
systemd.services.hydra-notify = { serviceConfig.EnvironmentFile = config.sops.secrets."hydra/environment".path; };
|
||||
environment.systemPackages = with pkgs; [
|
||||
docker-compose
|
||||
jellyfin-ffmpeg
|
||||
];
|
||||
|
||||
services = {
|
||||
samba.enable = true;
|
||||
@ -116,8 +121,6 @@
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.enable = false;
|
||||
|
||||
sops = {
|
||||
defaultSopsFile = ./secrets.yaml;
|
||||
secrets = {
|
||||
|
||||
@ -1,37 +1,39 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{ config, lib, modulesPath, ... }:
|
||||
{
|
||||
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
|
||||
imports = [
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "mpt3sas" "ahci" "nvme" "usb_storage" "usbhid" "sd_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-amd" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
swapDevices = [{ device = "/dev/disk/by-uuid/2b01e592-2297-4eb1-854b-17a63f1d4cf6"; }];
|
||||
boot = {
|
||||
kernelModules = [ "kvm-amd" ];
|
||||
extraModulePackages = [ ];
|
||||
initrd = {
|
||||
kernelModules = [ ];
|
||||
availableKernelModules = [
|
||||
"ahci"
|
||||
"mpt3sas"
|
||||
"nvme"
|
||||
"sd_mod"
|
||||
"usb_storage"
|
||||
"usbhid"
|
||||
"xhci_pci"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
fileSystems."/" = {
|
||||
fileSystems = {
|
||||
"/" = {
|
||||
device = "/dev/disk/by-uuid/b3b709ce-fe88-4267-be47-bf991a512cbe";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" = {
|
||||
"boot" = {
|
||||
device = "/dev/disk/by-uuid/4CBA-2451";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
swapDevices = [{ device = "/dev/disk/by-uuid/2b01e592-2297-4eb1-854b-17a63f1d4cf6"; }];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.eno1.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.eno2.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp72s0f3u1u2c2.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
};
|
||||
}
|
||||
|
||||
@ -1,10 +1,7 @@
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
home.username = "alice";
|
||||
home.homeDirectory = "/home/alice";
|
||||
|
||||
home.packages = with pkgs; [
|
||||
home = {
|
||||
# # Adds the 'hello' command to your environment. It prints a friendly
|
||||
# # "Hello, world!" when run.
|
||||
# pkgs.hello
|
||||
@ -22,6 +19,9 @@
|
||||
# echo "Hello, ${config.home.username}!"
|
||||
# '')
|
||||
|
||||
username = "alice";
|
||||
homeDirectory = "/home/alice";
|
||||
packages = with pkgs; [
|
||||
ncdu
|
||||
|
||||
# Rust packages
|
||||
@ -49,10 +49,10 @@
|
||||
ripgrep
|
||||
clang
|
||||
];
|
||||
};
|
||||
|
||||
programs = {
|
||||
zsh.enable = true;
|
||||
|
||||
starship.enable = true;
|
||||
fzf = {
|
||||
enable = true;
|
||||
|
||||
@ -3,6 +3,9 @@
|
||||
{
|
||||
inherit name;
|
||||
isNormalUser = true;
|
||||
shell = lib.mkIf config.programs.${defaultShell}.enable pkgs.${defaultShell};
|
||||
hashedPasswordFile = config.sops.secrets."${name}/user-password".path or null;
|
||||
openssh.authorizedKeys.keys = publicKeys;
|
||||
extraGroups = [
|
||||
"wheel"
|
||||
"media"
|
||||
@ -15,7 +18,4 @@
|
||||
"plugdev"
|
||||
"uaccess"
|
||||
];
|
||||
shell = lib.mkIf config.programs.${defaultShell}.enable pkgs.${defaultShell};
|
||||
hashedPasswordFile = config.sops.secrets."${name}/user-password".path or null;
|
||||
openssh.authorizedKeys.keys = publicKeys;
|
||||
}
|
||||
|
||||
@ -1,10 +1,11 @@
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
home.username = "richie";
|
||||
home.homeDirectory = "/home/richie";
|
||||
|
||||
home.packages = with pkgs; [
|
||||
programs.zsh.enable = true;
|
||||
home = {
|
||||
username = "richie";
|
||||
homeDirectory = "/home/richie";
|
||||
packages = with pkgs; [
|
||||
# Rust packages
|
||||
topgrade
|
||||
trunk
|
||||
@ -32,8 +33,7 @@
|
||||
ripgrep
|
||||
clang
|
||||
];
|
||||
|
||||
programs.zsh.enable = true;
|
||||
};
|
||||
|
||||
home.stateVersion = "23.11";
|
||||
}
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user