tidy files, switch to alejandra for formatting, add private aliases to mailserver
This commit is contained in:
Chaos
parent
e2a2608a2b
commit
6f5832750a
|
|
@ -1,4 +1,4 @@
|
||||||
{ ... }: rec {
|
{}: rec {
|
||||||
# Mountpoints
|
# Mountpoints
|
||||||
mountpoint = "/usb";
|
mountpoint = "/usb";
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,9 @@
|
||||||
{ nixosConfigurations, deploy-rs, ... }:
|
{
|
||||||
let activateNixOS_x64_64-linux = deploy-rs.lib.x86_64-linux.activate.nixos;
|
nixosConfigurations,
|
||||||
|
deploy-rs,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
|
activateNixOS_x64_64-linux = deploy-rs.lib.x86_64-linux.activate.nixos;
|
||||||
in {
|
in {
|
||||||
tablet = {
|
tablet = {
|
||||||
hostname = "tablet.internal.genderfucked.monster";
|
hostname = "tablet.internal.genderfucked.monster";
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,13 @@
|
||||||
{ stdenv, bash, parted, cryptsetup, e2fsprogs }:
|
{
|
||||||
let usb_data = import ../hosts/lappy/hardware/usb_data.nix { };
|
stdenv,
|
||||||
in stdenv.mkDerivation {
|
bash,
|
||||||
|
parted,
|
||||||
|
cryptsetup,
|
||||||
|
e2fsprogs,
|
||||||
|
}: let
|
||||||
|
usb_data = import ../hosts/lappy/hardware/usb_data.nix {};
|
||||||
|
in
|
||||||
|
stdenv.mkDerivation {
|
||||||
name = "mk-enc-usb";
|
name = "mk-enc-usb";
|
||||||
src = ./mk-enc-usb.sh;
|
src = ./mk-enc-usb.sh;
|
||||||
unpackPhase = ''
|
unpackPhase = ''
|
||||||
|
|
@ -9,18 +16,13 @@ in stdenv.mkDerivation {
|
||||||
done
|
done
|
||||||
'';
|
'';
|
||||||
|
|
||||||
inherit bash;
|
inherit bash parted cryptsetup e2fsprogs;
|
||||||
inherit parted;
|
|
||||||
inherit cryptsetup;
|
|
||||||
inherit e2fsprogs;
|
|
||||||
|
|
||||||
patchPhase = ''
|
patchPhase = ''
|
||||||
substituteAllInPlace mk-enc-usb.sh
|
substituteAllInPlace mk-enc-usb.sh
|
||||||
substituteInPlace mk-enc-usb.sh \
|
substituteInPlace mk-enc-usb.sh \
|
||||||
--replace "@TEST@" "nyaaaaa" \
|
|
||||||
--replace "@USB_ENCRYPTED_PARTLABEL@" "${usb_data.encrypted_partlabel}" \
|
--replace "@USB_ENCRYPTED_PARTLABEL@" "${usb_data.encrypted_partlabel}" \
|
||||||
--replace "@USB_UNENCRYPTED_LABEL@" "${usb_data.unencrypted_label}"
|
--replace "@USB_UNENCRYPTED_LABEL@" "${usb_data.unencrypted_label}"
|
||||||
|
|
||||||
'';
|
'';
|
||||||
|
|
||||||
installPhase = ''
|
installPhase = ''
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,14 @@
|
||||||
{ stdenv, bash, parted, cryptsetup, e2fsprogs, dosfstools }:
|
{
|
||||||
let ssd_data = import ../hosts/normal-enc/hardware/ssd_data.nix { };
|
stdenv,
|
||||||
in stdenv.mkDerivation {
|
bash,
|
||||||
|
parted,
|
||||||
|
cryptsetup,
|
||||||
|
e2fsprogs,
|
||||||
|
dosfstools,
|
||||||
|
}: let
|
||||||
|
ssd_data = import ../hosts/normal-enc/hardware/ssd_data.nix {};
|
||||||
|
in
|
||||||
|
stdenv.mkDerivation {
|
||||||
name = "mk-normal-enc-ssd";
|
name = "mk-normal-enc-ssd";
|
||||||
src = ./mk-normal-enc-ssd.sh;
|
src = ./mk-normal-enc-ssd.sh;
|
||||||
unpackPhase = ''
|
unpackPhase = ''
|
||||||
|
|
@ -9,11 +17,7 @@ in stdenv.mkDerivation {
|
||||||
done
|
done
|
||||||
'';
|
'';
|
||||||
|
|
||||||
inherit bash;
|
inherit bash parted cryptsetup e2fsprogs dosfstools;
|
||||||
inherit parted;
|
|
||||||
inherit cryptsetup;
|
|
||||||
inherit e2fsprogs;
|
|
||||||
inherit dosfstools;
|
|
||||||
|
|
||||||
patchPhase = ''
|
patchPhase = ''
|
||||||
substituteAllInPlace mk-normal-enc-ssd.sh
|
substituteAllInPlace mk-normal-enc-ssd.sh
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,11 @@
|
||||||
{ lib, pkgs, nixpkgs, config, tree, ... }:
|
{
|
||||||
let
|
lib,
|
||||||
|
pkgs,
|
||||||
|
nixpkgs,
|
||||||
|
config,
|
||||||
|
tree,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
wifiInterface = "shenanigans0";
|
wifiInterface = "shenanigans0";
|
||||||
wifiMac = "00:0F:55:A8:2B:8E";
|
wifiMac = "00:0F:55:A8:2B:8E";
|
||||||
|
|
||||||
|
|
@ -21,15 +27,19 @@ in {
|
||||||
}", NAME="${usbethInterface}"
|
}", NAME="${usbethInterface}"
|
||||||
'';
|
'';
|
||||||
|
|
||||||
networking.interfaces."${wifiInterface}".ipv4.addresses = [{
|
networking.interfaces."${wifiInterface}".ipv4.addresses = [
|
||||||
|
{
|
||||||
address = "192.168.2.1";
|
address = "192.168.2.1";
|
||||||
prefixLength = 24;
|
prefixLength = 24;
|
||||||
}];
|
}
|
||||||
|
];
|
||||||
|
|
||||||
networking.interfaces."${usbethInterface}".ipv4.addresses = [{
|
networking.interfaces."${usbethInterface}".ipv4.addresses = [
|
||||||
|
{
|
||||||
address = "192.168.2.1";
|
address = "192.168.2.1";
|
||||||
prefixLength = 24;
|
prefixLength = 24;
|
||||||
}];
|
}
|
||||||
|
];
|
||||||
|
|
||||||
networking.networkmanager.unmanaged = [
|
networking.networkmanager.unmanaged = [
|
||||||
# Wifi
|
# Wifi
|
||||||
|
|
@ -39,7 +49,8 @@ in {
|
||||||
"mac:${usbethMac}"
|
"mac:${usbethMac}"
|
||||||
];
|
];
|
||||||
|
|
||||||
systemd.services.wifi-relay = let inherit (pkgs) iptables gnugrep;
|
systemd.services.wifi-relay = let
|
||||||
|
inherit (pkgs) iptables gnugrep;
|
||||||
in {
|
in {
|
||||||
description = "iptables rules for wifi-relay";
|
description = "iptables rules for wifi-relay";
|
||||||
after = ["dhcpd4.service"];
|
after = ["dhcpd4.service"];
|
||||||
|
|
|
||||||
18
flake.lock
18
flake.lock
|
|
@ -138,11 +138,11 @@
|
||||||
"utils": "utils_4"
|
"utils": "utils_4"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1670058827,
|
"lastModified": 1670157315,
|
||||||
"narHash": "sha256-T+yyncPpZWeIkFrG/Cgj21iopULY3BZGWIhcT5ZmCgM=",
|
"narHash": "sha256-GMeuuDKTaqnYFGQA3ZqlLoeeWi30RdJZV+ukOnTCu+w=",
|
||||||
"owner": "nix-community",
|
"owner": "nix-community",
|
||||||
"repo": "home-manager",
|
"repo": "home-manager",
|
||||||
"rev": "eb3598cf44aa10f2a16fe38488a102c0f474d766",
|
"rev": "17bbfcb82458ac2270dec71ce1f7044deb4f1ca3",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
|
@ -191,11 +191,11 @@
|
||||||
},
|
},
|
||||||
"nixpkgs-unstable": {
|
"nixpkgs-unstable": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1669791787,
|
"lastModified": 1670064435,
|
||||||
"narHash": "sha256-KBfoA2fOI5+wCrm7PR+j7jHqXeTkVRPQ0m5fcKchyuU=",
|
"narHash": "sha256-+ELoY30UN+Pl3Yn7RWRPabykwebsVK/kYE9JsIsUMxQ=",
|
||||||
"owner": "nixos",
|
"owner": "nixos",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"rev": "e76c78d20685a043d23f5f9e0ccd2203997f1fb1",
|
"rev": "61a8a98e6d557e6dd7ed0cdb54c3a3e3bbc5e25c",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
|
@ -240,11 +240,11 @@
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1669922720,
|
"lastModified": 1670085069,
|
||||||
"narHash": "sha256-xzoKL4RtKRECdrWHAM14OBaNdJRToc+AA9zmUWuo5eY=",
|
"narHash": "sha256-IO9HcAjncPp/0sUGcCUWVwa0XoBVFQKx+oY+8EBRcTc=",
|
||||||
"owner": "kittywitch",
|
"owner": "kittywitch",
|
||||||
"repo": "tree",
|
"repo": "tree",
|
||||||
"rev": "fbe8ae96d7f4fb369d32dbbe8434606b23354caf",
|
"rev": "501675588cb663a9bd18056002de697f4e91b667",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
|
|
||||||
|
|
@ -13,8 +13,7 @@
|
||||||
tree-input.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
tree-input.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
||||||
|
|
||||||
# update whenever
|
# update whenever
|
||||||
nixpkgs-fixed.url =
|
nixpkgs-fixed.url = "github:nixos/nixpkgs/?branch=nixos-unstable&rev=e76c78d20685a043d23f5f9e0ccd2203997f1fb1";
|
||||||
"github:nixos/nixpkgs/?branch=nixos-unstable&rev=e76c78d20685a043d23f5f9e0ccd2203997f1fb1";
|
|
||||||
|
|
||||||
nur.url = "github:nix-community/NUR";
|
nur.url = "github:nix-community/NUR";
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,7 +0,0 @@
|
||||||
{ pkgs, ... }: {
|
|
||||||
home.packages = with pkgs;
|
|
||||||
[
|
|
||||||
# NOINLINE
|
|
||||||
aegisub
|
|
||||||
];
|
|
||||||
}
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
{ pkgs, ... }: {
|
{...}: {
|
||||||
programs.aria2 = {
|
programs.aria2 = {
|
||||||
enable = true;
|
enable = true;
|
||||||
settings = {
|
settings = {
|
||||||
|
|
@ -10,9 +10,7 @@
|
||||||
dht-entry-point = "dht.transmissionbt.com:6881";
|
dht-entry-point = "dht.transmissionbt.com:6881";
|
||||||
dht-entry-point6 = "dht.transmissionbt.com:6881";
|
dht-entry-point6 = "dht.transmissionbt.com:6881";
|
||||||
enable-peer-exchange = true;
|
enable-peer-exchange = true;
|
||||||
bt-tracker =
|
bt-tracker = "udp://tracker.coppersurfer.tk:6969/announce,udp://tracker.leechers-paradise.org:6969/announce,udp://tracker.opentrackr.org:1337/announce,udp://9.rarbg.to:2710/announce,udp://exodus.desync.com:6969/announce,udp://tracker.openbittorrent.com:80/announce,udp://tracker.tiny-vps.com:6969/announce,udp://retracker.lanta-net.ru:2710/announce,udp://tracker.torrent.eu.org:451/announce,udp://tracker.cyberia.is:6969/announce,udp://torrentclub.tech:6969/announce,udp://open.stealth.si:80/announce,udp://denis.stalker.upeer.me:6969/announce,udp://tracker.moeking.me:6969/announce,udp://open.demonii.si:1337/announce,udp://ipv4.tracker.harry.lu:80/announce,udp://tracker3.itzmx.com:6961/announce,udp://explodie.org:6969/announce,udp://valakas.rollo.dnsabr.com:2710/announce,udp://tracker.nyaa.uk:6969/announce,udp://tracker.iamhansen.xyz:2000/announce,udp://tracker.filepit.to:6969/announce,udp://tracker-udp.gbitt.info:80/announce,udp://retracker.netbynet.ru:2710/announce,udp://retracker.akado-ural.ru:80/announce,udp://opentor.org:2710/announce,udp://tracker.yoshi210.com:6969/announce,udp://tracker.filemail.com:6969/announce,udp://tracker.ds.is:6969/announce,udp://newtoncity.org:6969/announce,udp://bt2.archive.org:6969/announce,udp://bt1.archive.org:6969/announce,https://tracker.fastdownload.xyz:443/announce,https://opentracker.xyz:443/announce,https://opentracker.co:443/announce,http://tracker.bt4g.com:2095/announce,http://opentracker.xyz:80/announce,http://open.trackerlist.xyz:80/announce,http://h4.trakx.nibba.trade:80/announce,udp://xxxtor.com:2710/announce,udp://tracker.uw0.xyz:6969/announce,udp://tracker.tvunderground.org.ru:3218/announce,udp://tracker.nextrp.ru:6969/announce,udp://tracker.msm8916.com:6969/announce,udp://tracker.lelux.fi:6969/announce,udp://retracker.sevstar.net:2710/announce,udp://npserver.intranet.pw:4201/announce,https://tracker.nanoha.org:443/announce,https://tracker.hama3.net:443/announce,http://www.proxmox.com:6969/announce,http://tracker.tvunderground.org.ru:3218/announce,http://tracker.opentrackr.org:1337/announce,http://tracker.bz:80/announce,http://torrentclub.tech:6969/announce,http://t.nyaatracker.com:80/announce,http://retracker.sevstar.net:2710/announce,http://open.acgtracker.com:1096/announce,http://explodie.org:6969/announce,udp://tracker4.itzmx.com:2710/announce,udp://tracker2.itzmx.com:6961/announce,udp://tracker.swateam.org.uk:2710/announce,udp://tr.bangumi.moe:6969/announce,udp://qg.lorzl.gq:2710/announce,udp://chihaya.toss.li:9696/announce,https://tracker.vectahosting.eu:2053/announce,https://tracker.lelux.fi:443/announce,https://tracker.gbitt.info:443/announce,https://opentracker.acgnx.se:443/announce,http://www.loushao.net:8080/announce,http://vps02.net.orel.ru:80/announce,http://tracker4.itzmx.com:2710/announce,http://tracker3.itzmx.com:6961/announce,http://tracker2.itzmx.com:6961/announce,http://tracker1.itzmx.com:8080/announce,http://tracker01.loveapp.com:6789/announce,http://tracker.yoshi210.com:6969/announce,http://tracker.torrentyorg.pl:80/announce,http://tracker.lelux.fi:80/announce,http://tracker.gbitt.info:80/announce,http://tracker.frozen-layer.net:6969/announce,http://sukebei.tracker.wf:8888/announce,http://pow7.com:80/announce,http://opentracker.acgnx.se:80/announce,http://open.acgnxtracker.com:80/announce,http://newtoncity.org:6969/announce,http://mail2.zelenaya.net:80/announce,http://bt-tracker.gamexp.ru:2710/announce,http://acg.rip:6699/announce";
|
||||||
"udp://tracker.coppersurfer.tk:6969/announce,udp://tracker.leechers-paradise.org:6969/announce,udp://tracker.opentrackr.org:1337/announce,udp://9.rarbg.to:2710/announce,udp://exodus.desync.com:6969/announce,udp://tracker.openbittorrent.com:80/announce,udp://tracker.tiny-vps.com:6969/announce,udp://retracker.lanta-net.ru:2710/announce,udp://tracker.torrent.eu.org:451/announce,udp://tracker.cyberia.is:6969/announce,udp://torrentclub.tech:6969/announce,udp://open.stealth.si:80/announce,udp://denis.stalker.upeer.me:6969/announce,udp://tracker.moeking.me:6969/announce,udp://open.demonii.si:1337/announce,udp://ipv4.tracker.harry.lu:80/announce,udp://tracker3.itzmx.com:6961/announce,udp://explodie.org:6969/announce,udp://valakas.rollo.dnsabr.com:2710/announce,udp://tracker.nyaa.uk:6969/announce,udp://tracker.iamhansen.xyz:2000/announce,udp://tracker.filepit.to:6969/announce,udp://tracker-udp.gbitt.info:80/announce,udp://retracker.netbynet.ru:2710/announce,udp://retracker.akado-ural.ru:80/announce,udp://opentor.org:2710/announce,udp://tracker.yoshi210.com:6969/announce,udp://tracker.filemail.com:6969/announce,udp://tracker.ds.is:6969/announce,udp://newtoncity.org:6969/announce,udp://bt2.archive.org:6969/announce,udp://bt1.archive.org:6969/announce,https://tracker.fastdownload.xyz:443/announce,https://opentracker.xyz:443/announce,https://opentracker.co:443/announce,http://tracker.bt4g.com:2095/announce,http://opentracker.xyz:80/announce,http://open.trackerlist.xyz:80/announce,http://h4.trakx.nibba.trade:80/announce,udp://xxxtor.com:2710/announce,udp://tracker.uw0.xyz:6969/announce,udp://tracker.tvunderground.org.ru:3218/announce,udp://tracker.nextrp.ru:6969/announce,udp://tracker.msm8916.com:6969/announce,udp://tracker.lelux.fi:6969/announce,udp://retracker.sevstar.net:2710/announce,udp://npserver.intranet.pw:4201/announce,https://tracker.nanoha.org:443/announce,https://tracker.hama3.net:443/announce,http://www.proxmox.com:6969/announce,http://tracker.tvunderground.org.ru:3218/announce,http://tracker.opentrackr.org:1337/announce,http://tracker.bz:80/announce,http://torrentclub.tech:6969/announce,http://t.nyaatracker.com:80/announce,http://retracker.sevstar.net:2710/announce,http://open.acgtracker.com:1096/announce,http://explodie.org:6969/announce,udp://tracker4.itzmx.com:2710/announce,udp://tracker2.itzmx.com:6961/announce,udp://tracker.swateam.org.uk:2710/announce,udp://tr.bangumi.moe:6969/announce,udp://qg.lorzl.gq:2710/announce,udp://chihaya.toss.li:9696/announce,https://tracker.vectahosting.eu:2053/announce,https://tracker.lelux.fi:443/announce,https://tracker.gbitt.info:443/announce,https://opentracker.acgnx.se:443/announce,http://www.loushao.net:8080/announce,http://vps02.net.orel.ru:80/announce,http://tracker4.itzmx.com:2710/announce,http://tracker3.itzmx.com:6961/announce,http://tracker2.itzmx.com:6961/announce,http://tracker1.itzmx.com:8080/announce,http://tracker01.loveapp.com:6789/announce,http://tracker.yoshi210.com:6969/announce,http://tracker.torrentyorg.pl:80/announce,http://tracker.lelux.fi:80/announce,http://tracker.gbitt.info:80/announce,http://tracker.frozen-layer.net:6969/announce,http://sukebei.tracker.wf:8888/announce,http://pow7.com:80/announce,http://opentracker.acgnx.se:80/announce,http://open.acgnxtracker.com:80/announce,http://newtoncity.org:6969/announce,http://mail2.zelenaya.net:80/announce,http://bt-tracker.gamexp.ru:2710/announce,http://acg.rip:6699/announce";
|
|
||||||
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
{ config, pkgs, ... }: { home.packages = with pkgs; [ gnome.file-roller ]; }
|
{pkgs, ...}: {home.packages = with pkgs; [gnome.file-roller];}
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,9 @@
|
||||||
{ config, nixosConfig, pkgs, ... }:
|
{
|
||||||
let isGnome = nixosConfig.services.xserver.desktopManager.gnome.enable;
|
nixosConfig,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
|
isGnome = nixosConfig.services.xserver.desktopManager.gnome.enable;
|
||||||
in {
|
in {
|
||||||
programs.firefox = {
|
programs.firefox = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
@ -107,8 +111,7 @@ in {
|
||||||
newElementCount = 22;
|
newElementCount = 22;
|
||||||
placements = {
|
placements = {
|
||||||
PersonalToolbar = ["import-button" "personal-bookmarks"];
|
PersonalToolbar = ["import-button" "personal-bookmarks"];
|
||||||
TabsToolbar =
|
TabsToolbar = ["tabbrowser-tabs" "new-tab-button" "alltabs-button"];
|
||||||
[ "tabbrowser-tabs" "new-tab-button" "alltabs-button" ];
|
|
||||||
nav-bar = [
|
nav-bar = [
|
||||||
"back-button"
|
"back-button"
|
||||||
"forward-button"
|
"forward-button"
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,4 @@
|
||||||
{ config, nixosConfig, ... }:
|
{nixosConfig, ...}: {
|
||||||
|
|
||||||
{
|
|
||||||
wayland.windowManager.sway.extraSessionCommands = ''
|
wayland.windowManager.sway.extraSessionCommands = ''
|
||||||
export KITTY_CACHE_DIRECTORY="/tmp/kitty";
|
export KITTY_CACHE_DIRECTORY="/tmp/kitty";
|
||||||
'';
|
'';
|
||||||
|
|
@ -9,7 +7,9 @@
|
||||||
font.name = "Comic Code";
|
font.name = "Comic Code";
|
||||||
settings = {
|
settings = {
|
||||||
font_size =
|
font_size =
|
||||||
if nixosConfig.networking.hostName == "tablet" then 12 else 20;
|
if nixosConfig.networking.hostName == "tablet"
|
||||||
|
then 12
|
||||||
|
else 20;
|
||||||
bold_font = "auto";
|
bold_font = "auto";
|
||||||
italic_font = "auto";
|
italic_font = "auto";
|
||||||
bold_italic_font = "auto";
|
bold_italic_font = "auto";
|
||||||
|
|
|
||||||
|
|
@ -1,9 +1,8 @@
|
||||||
{ config, pkgs, ... }:
|
{pkgs, ...}: let
|
||||||
let
|
listen-password-file =
|
||||||
listen-password-file = if pkgs.stdenv.isLinux then
|
if pkgs.stdenv.isLinux
|
||||||
"/secrets/music_stream_password"
|
then "/secrets/music_stream_password"
|
||||||
else
|
else "$HOME/.secrets/music_stream_password";
|
||||||
"$HOME/.secrets/music_stream_password";
|
|
||||||
in {
|
in {
|
||||||
home.packages = with pkgs; [mpv ffmpeg yt-dlp];
|
home.packages = with pkgs; [mpv ffmpeg yt-dlp];
|
||||||
programs.mpv = {
|
programs.mpv = {
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
{ inputs, pkgs, ... }: { home.packages = with pkgs; [ musicutil ]; }
|
{pkgs, ...}: {home.packages = with pkgs; [musicutil];}
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
{ config, pkgs, ... }: { home.packages = with pkgs; [ gnome.nautilus ]; }
|
{pkgs, ...}: {home.packages = with pkgs; [gnome.nautilus];}
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
{ config, pkgs, ... }: { home.packages = with pkgs; [ nicotine-plus ]; }
|
{pkgs, ...}: {home.packages = with pkgs; [nicotine-plus];}
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
{ config, pkgs, ... }: { home.packages = with pkgs; [ rclone ]; }
|
{pkgs, ...}: {home.packages = with pkgs; [rclone];}
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
{ config, pkgs, ... }: { home.packages = with pkgs; [ restic ]; }
|
{pkgs, ...}: {home.packages = with pkgs; [restic];}
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
{ config, pkgs, ... }: { home.packages = with pkgs; [ strawberry ]; }
|
{pkgs, ...}: {home.packages = with pkgs; [strawberry];}
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
{ config, pkgs, ... }: { home.packages = with pkgs; [ kotatogram-desktop ]; }
|
{pkgs, ...}: {home.packages = with pkgs; [kotatogram-desktop];}
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
{ config, pkgs, ... }: {
|
{pkgs, ...}: {
|
||||||
home.packages = with pkgs; [
|
home.packages = with pkgs; [
|
||||||
vivaldi
|
vivaldi
|
||||||
vivaldi-ffmpeg-codecs
|
vivaldi-ffmpeg-codecs
|
||||||
|
|
|
||||||
|
|
@ -1,10 +1,11 @@
|
||||||
{lib, ...}: {
|
{lib, ...}: {
|
||||||
programs.ssh.enable = true;
|
programs.ssh.enable = true;
|
||||||
programs.ssh.matchBlocks = (lib.mkMerge
|
programs.ssh.matchBlocks =
|
||||||
|
lib.mkMerge
|
||||||
(lib.forEach ["hetzner-vm" "storage" "vault" "buildbox"] (hostname: {
|
(lib.forEach ["hetzner-vm" "storage" "vault" "buildbox"] (hostname: {
|
||||||
"${hostname}" = {
|
"${hostname}" = {
|
||||||
user = "root";
|
user = "root";
|
||||||
hostname = "${hostname}.servers.genderfucked.monster";
|
hostname = "${hostname}.servers.genderfucked.monster";
|
||||||
};
|
};
|
||||||
})));
|
}));
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,5 @@
|
||||||
{ config, pkgs, ... }:
|
{pkgs, ...}: let
|
||||||
let usb_data = import ../../data/usb_data.nix { };
|
usb_data = import ../../data/usb_data.nix {};
|
||||||
in {
|
in {
|
||||||
home.packages = with pkgs; [exa bat ripgrep vault age];
|
home.packages = with pkgs; [exa bat ripgrep vault age];
|
||||||
programs.zsh = {
|
programs.zsh = {
|
||||||
|
|
@ -12,7 +12,7 @@ in {
|
||||||
plugins = [];
|
plugins = [];
|
||||||
};
|
};
|
||||||
shellAliases = {
|
shellAliases = {
|
||||||
nixdirfmt = "nixfmt $(fd -e nix)";
|
nixdirfmt = "alejandra .";
|
||||||
exa = "exa --time-style long-iso";
|
exa = "exa --time-style long-iso";
|
||||||
ls = "exa -G";
|
ls = "exa -G";
|
||||||
la = "exa -Ga";
|
la = "exa -Ga";
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
{ config, lib, ... }: {
|
{...}: {
|
||||||
services.blueman-applet.enable = true;
|
services.blueman-applet.enable = true;
|
||||||
services.mpris-proxy.enable = true;
|
services.mpris-proxy.enable = true;
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
{ pkgs, inputs, ... }: { home.packages = with pkgs.deploy-rs; [ deploy-rs ]; }
|
{pkgs, ...}: {home.packages = with pkgs.deploy-rs; [deploy-rs];}
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
{ pkgs, inputs, ... }: {
|
{pkgs, ...}: {
|
||||||
home.packages = with pkgs; [
|
home.packages = with pkgs; [
|
||||||
jq
|
jq
|
||||||
ripgrep
|
ripgrep
|
||||||
|
|
|
||||||
|
|
@ -1 +0,0 @@
|
||||||
{ pkgs, ... }: { home.packages = with pkgs; [ gitAndTools.gitFull ]; }
|
|
||||||
|
|
@ -7,6 +7,5 @@
|
||||||
home.dev.all.git
|
home.dev.all.git
|
||||||
home.dev.all.info
|
home.dev.all.info
|
||||||
home.dev.all.network
|
home.dev.all.network
|
||||||
home.dev.all.vcs
|
|
||||||
];
|
];
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
{ config, pkgs, ... }: { home.packages = with pkgs; [ osu-lazer ]; }
|
{pkgs, ...}: {home.packages = with pkgs; [osu-lazer];}
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,8 @@
|
||||||
{ nixosConfig, pkgs, ... }: {
|
{
|
||||||
|
nixosConfig,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
gtk = {
|
gtk = {
|
||||||
enable = true;
|
enable = true;
|
||||||
iconTheme = {
|
iconTheme = {
|
||||||
|
|
@ -11,7 +15,10 @@
|
||||||
};
|
};
|
||||||
font = {
|
font = {
|
||||||
name = "Comic Code";
|
name = "Comic Code";
|
||||||
size = if nixosConfig.networking.hostName == "tablet" then 10 else 16;
|
size =
|
||||||
|
if nixosConfig.networking.hostName == "tablet"
|
||||||
|
then 10
|
||||||
|
else 16;
|
||||||
package = pkgs.comic-code;
|
package = pkgs.comic-code;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,4 @@
|
||||||
{ config, pkgs, ... }:
|
{pkgs, ...}: {
|
||||||
|
|
||||||
{
|
|
||||||
qt = {
|
qt = {
|
||||||
enable = true;
|
enable = true;
|
||||||
platformTheme = "gtk";
|
platformTheme = "gtk";
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,10 @@
|
||||||
{ tree, nixosConfig, pkgs, lib, inputs, ... }:
|
{
|
||||||
let
|
tree,
|
||||||
|
nixosConfig,
|
||||||
|
pkgs,
|
||||||
|
inputs,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
hm = inputs.home-manager.lib.hm;
|
hm = inputs.home-manager.lib.hm;
|
||||||
|
|
||||||
font-sizes-all = {
|
font-sizes-all = {
|
||||||
|
|
@ -13,11 +18,10 @@ let
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
font-sizes = if nixosConfig.networking.hostName == "tablet" then
|
font-sizes =
|
||||||
font-sizes-all.tablet
|
if nixosConfig.networking.hostName == "tablet"
|
||||||
else
|
then font-sizes-all.tablet
|
||||||
font-sizes-all.default;
|
else font-sizes-all.default;
|
||||||
|
|
||||||
in {
|
in {
|
||||||
imports = with tree; [home.apps.kitty home.apps.rofi];
|
imports = with tree; [home.apps.kitty home.apps.rofi];
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,4 @@
|
||||||
{ config, lib, ... }:
|
{...}: {
|
||||||
|
|
||||||
{
|
|
||||||
services.gammastep = {
|
services.gammastep = {
|
||||||
enable = true;
|
enable = true;
|
||||||
tray = true;
|
tray = true;
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
{ config, pkgs, lib, ... }: {
|
{...}: {
|
||||||
programs.mako = {
|
programs.mako = {
|
||||||
enable = true;
|
enable = true;
|
||||||
defaultTimeout = 3000;
|
defaultTimeout = 3000;
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,10 @@
|
||||||
{ config, pkgs, lib, tree, ... }: {
|
{
|
||||||
|
config,
|
||||||
|
pkgs,
|
||||||
|
lib,
|
||||||
|
tree,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
# import default terminal
|
# import default terminal
|
||||||
imports = with tree; [home.apps.kitty home.apps.rofi];
|
imports = with tree; [home.apps.kitty home.apps.rofi];
|
||||||
|
|
||||||
|
|
@ -9,6 +15,7 @@
|
||||||
SDL_VIDEODRIVER = "wayland";
|
SDL_VIDEODRIVER = "wayland";
|
||||||
QT_QPA_PLATFORM = "wayland";
|
QT_QPA_PLATFORM = "wayland";
|
||||||
QT_WAYLAND_DISABLE_WINDOWDECORATION = 1;
|
QT_WAYLAND_DISABLE_WINDOWDECORATION = 1;
|
||||||
|
# For Ghidra to make windows work properly
|
||||||
_JAVA_AWT_WM_NONREPARENTING = 1;
|
_JAVA_AWT_WM_NONREPARENTING = 1;
|
||||||
XCURSOR_SIZE = 64;
|
XCURSOR_SIZE = 64;
|
||||||
QT_AUTO_SCREEN_SCALE_FACTOR = 1;
|
QT_AUTO_SCREEN_SCALE_FACTOR = 1;
|
||||||
|
|
@ -48,12 +55,10 @@
|
||||||
size = 14.0;
|
size = 14.0;
|
||||||
};
|
};
|
||||||
statusCommand = lib.escapeShellArgs [
|
statusCommand = lib.escapeShellArgs [
|
||||||
#"/home/chaoticryptidz/Projects/gobar/gobar "
|
|
||||||
"${pkgs.gobar}/bin/gobar"
|
"${pkgs.gobar}/bin/gobar"
|
||||||
"-config"
|
"-config"
|
||||||
"cpu\\|mem\\|weather\\(Leighton\\ Buzzard\\)\\|bat\\(BAT0\\)\\|time"
|
"cpu\\|mem\\|weather\\(Leighton\\ Buzzard\\)\\|bat\\(BAT0\\)\\|time"
|
||||||
];
|
];
|
||||||
|
|
||||||
}
|
}
|
||||||
{command = "${pkgs.waybar}/bin/waybar";}
|
{command = "${pkgs.waybar}/bin/waybar";}
|
||||||
];
|
];
|
||||||
|
|
@ -98,7 +103,8 @@
|
||||||
titlebar = false;
|
titlebar = false;
|
||||||
};
|
};
|
||||||
|
|
||||||
keybindings = {
|
keybindings =
|
||||||
|
{
|
||||||
"${cfg.modifier}+Return" = "exec ${cfg.terminal}";
|
"${cfg.modifier}+Return" = "exec ${cfg.terminal}";
|
||||||
|
|
||||||
"${cfg.modifier}+Left" = "focus left";
|
"${cfg.modifier}+Left" = "focus left";
|
||||||
|
|
@ -114,17 +120,13 @@
|
||||||
"${cfg.modifier}+Shift+space" = "floating toggle";
|
"${cfg.modifier}+Shift+space" = "floating toggle";
|
||||||
"${cfg.modifier}+space" = "focus mode_toggle";
|
"${cfg.modifier}+space" = "focus mode_toggle";
|
||||||
|
|
||||||
"XF86AudioRaiseVolume" =
|
"XF86AudioRaiseVolume" = "exec ${pactl} set-sink-volume @DEFAULT_SINK@ +5%";
|
||||||
"exec ${pactl} set-sink-volume @DEFAULT_SINK@ +5%";
|
"XF86AudioLowerVolume" = "exec ${pactl} set-sink-volume @DEFAULT_SINK@ -5%";
|
||||||
"XF86AudioLowerVolume" =
|
|
||||||
"exec ${pactl} set-sink-volume @DEFAULT_SINK@ -5%";
|
|
||||||
"XF86AudioMute" = "exec ${pactl} set-sink-mute @DEFAULT_SINK@ toggle";
|
"XF86AudioMute" = "exec ${pactl} set-sink-mute @DEFAULT_SINK@ toggle";
|
||||||
"XF86AudioMicMute" =
|
"XF86AudioMicMute" = "exec ${pactl} set-source-mute @DEFAULT_SOURCE@ toggle";
|
||||||
"exec ${pactl} set-source-mute @DEFAULT_SOURCE@ toggle";
|
|
||||||
"XF86MonBrightnessDown" = "exec sudo xbacklight -time 1 -dec +5";
|
"XF86MonBrightnessDown" = "exec sudo xbacklight -time 1 -dec +5";
|
||||||
"XF86MonBrightnessUp" = "exec sudo xbacklight -time 1 -inc +5";
|
"XF86MonBrightnessUp" = "exec sudo xbacklight -time 1 -inc +5";
|
||||||
"Print" =
|
"Print" = "exec ${pkgs.grim}/bin/grim -t png - | ${pkgs.wl-clipboard}/bin/wl-copy -t image/png";
|
||||||
"exec ${pkgs.grim}/bin/grim -t png - | ${pkgs.wl-clipboard}/bin/wl-copy -t image/png";
|
|
||||||
"Shift+Print" = ''
|
"Shift+Print" = ''
|
||||||
exec ${pkgs.grim}/bin/grim -t png -g "$(${pkgs.slurp}/bin/slurp -d)" - | ${pkgs.wl-clipboard}/bin/wl-copy -t image/png'';
|
exec ${pkgs.grim}/bin/grim -t png -g "$(${pkgs.slurp}/bin/slurp -d)" - | ${pkgs.wl-clipboard}/bin/wl-copy -t image/png'';
|
||||||
|
|
||||||
|
|
@ -135,12 +137,11 @@
|
||||||
"${cfg.modifier}+Shift+c" = "reload";
|
"${cfg.modifier}+Shift+c" = "reload";
|
||||||
|
|
||||||
"${cfg.modifier}+r" = "mode resize";
|
"${cfg.modifier}+r" = "mode resize";
|
||||||
} // (lib.foldl lib.recursiveUpdate { } (map (workspace: {
|
}
|
||||||
|
// (lib.foldl lib.recursiveUpdate {} (map (workspace: {
|
||||||
"${cfg.modifier}+${workspace}" = "workspace ${workspace}";
|
"${cfg.modifier}+${workspace}" = "workspace ${workspace}";
|
||||||
"${cfg.modifier}+Shift+${workspace}" =
|
"${cfg.modifier}+Shift+${workspace}" = "move container to workspace ${workspace}";
|
||||||
"move container to workspace ${workspace}";
|
|
||||||
}) ["1" "2" "3" "4" "5" "6" "7" "8" "9"]));
|
}) ["1" "2" "3" "4" "5" "6" "7" "8" "9"]));
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,12 +1,13 @@
|
||||||
_: {
|
{...}: {
|
||||||
programs.waybar = {
|
programs.waybar = {
|
||||||
enable = true;
|
enable = true;
|
||||||
settings = [{
|
settings = [
|
||||||
|
{
|
||||||
position = "bottom";
|
position = "bottom";
|
||||||
|
|
||||||
modules-left = [];
|
modules-left = [];
|
||||||
modules-center = [];
|
modules-center = [];
|
||||||
modules-right = ["tray"];
|
modules-right = ["tray"];
|
||||||
}];
|
}
|
||||||
|
];
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
_: {
|
{...}: {
|
||||||
programs.zsh.profileExtra = ''
|
programs.zsh.profileExtra = ''
|
||||||
# If running from tty1 start sway
|
# If running from tty1 start sway
|
||||||
if [ "$(tty)" = "/dev/tty1" ]; then
|
if [ "$(tty)" = "/dev/tty1" ]; then
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,9 @@
|
||||||
{ config, lib, ... }: {
|
{
|
||||||
systemd.user.tmpfiles.rules = (map (dir:
|
config,
|
||||||
"d ${config.home.homeDirectory}/${dir} - ${config.home.username} users") [
|
lib,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
|
systemd.user.tmpfiles.rules = map (dir: "d ${config.home.homeDirectory}/${dir} - ${config.home.username} users") [
|
||||||
"Projects"
|
"Projects"
|
||||||
"Temp"
|
"Temp"
|
||||||
"Music"
|
"Music"
|
||||||
|
|
@ -10,7 +13,8 @@
|
||||||
"Mounts/Backups"
|
"Mounts/Backups"
|
||||||
"Mounts/Backups-Crypt"
|
"Mounts/Backups-Crypt"
|
||||||
"Mounts/Photos-Crypt"
|
"Mounts/Photos-Crypt"
|
||||||
|
"Mounts/Public"
|
||||||
"Mounts/Temp1"
|
"Mounts/Temp1"
|
||||||
"Mounts/Temp2"
|
"Mounts/Temp2"
|
||||||
]);
|
];
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,7 +1,17 @@
|
||||||
{ config, nixosConfig, pkgs, ... }:
|
{
|
||||||
let
|
config,
|
||||||
font-size = if nixosConfig.networking.hostName == "tablet" then 18 else 24;
|
nixosConfig,
|
||||||
zoom-level = if nixosConfig.networking.hostName == "tablet" then -2 else 0;
|
pkgs,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
|
font-size =
|
||||||
|
if nixosConfig.networking.hostName == "tablet"
|
||||||
|
then 18
|
||||||
|
else 24;
|
||||||
|
zoom-level =
|
||||||
|
if nixosConfig.networking.hostName == "tablet"
|
||||||
|
then -2
|
||||||
|
else 0;
|
||||||
in {
|
in {
|
||||||
programs.vscode-mod = {
|
programs.vscode-mod = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,4 @@
|
||||||
{ config, pkgs, ... }:
|
{pkgs, ...}: {
|
||||||
|
|
||||||
{
|
|
||||||
home.packages = with pkgs; [go gopls go-outline gotools];
|
home.packages = with pkgs; [go gopls go-outline gotools];
|
||||||
programs.vscode-mod.extensions = with pkgs; [vscode-extensions.golang.go];
|
programs.vscode-mod.extensions = with pkgs; [vscode-extensions.golang.go];
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,14 +1,16 @@
|
||||||
{ config, pkgs, ... }:
|
{pkgs, ...}: {
|
||||||
|
home.packages = with pkgs; [alejandra];
|
||||||
{
|
|
||||||
home.packages = with pkgs; [ nixfmt ];
|
|
||||||
|
|
||||||
programs.vscode-mod.extensions = with pkgs; [
|
programs.vscode-mod.extensions = with pkgs; [
|
||||||
vscode-extensions.bbenoist.nix
|
vscode-extensions.bbenoist.nix
|
||||||
vscode-extensions.brettm12345.nixfmt-vscode
|
vscode-extensions.kamadorueda.alejandra
|
||||||
];
|
];
|
||||||
|
|
||||||
programs.vscode-mod.userSettings."[nix]" = {
|
programs.vscode-mod.userSettings."[nix]" = {
|
||||||
"editor.defaultFormatter" = "brettm12345.nixfmt-vscode";
|
"editor.defaultFormatter" = "kamadorueda.alejandra";
|
||||||
|
"editor.formatOnSave" = true;
|
||||||
|
};
|
||||||
|
programs.vscode-mod.userSettings = {
|
||||||
|
"alejandra.program" = "alejandra";
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,5 @@
|
||||||
{pkgs, ...}: {
|
{pkgs, ...}: {
|
||||||
programs.vscode-mod.extensions = with pkgs;
|
programs.vscode-mod.extensions = with pkgs; [vscode-extensions.matklad.rust-analyzer];
|
||||||
[ vscode-extensions.matklad.rust-analyzer ];
|
|
||||||
home.packages = with pkgs; [rustc cargo clippy rust-analyzer rustfmt];
|
home.packages = with pkgs; [rustc cargo clippy rust-analyzer rustfmt];
|
||||||
home.sessionVariables = {RUST_SRC_PATH = pkgs.rustPlatform.rustLibSrc;};
|
home.sessionVariables = {RUST_SRC_PATH = pkgs.rustPlatform.rustLibSrc;};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -2,7 +2,7 @@
|
||||||
home.packages = with pkgs; [
|
home.packages = with pkgs; [
|
||||||
binwalk
|
binwalk
|
||||||
file
|
file
|
||||||
binutils # strings
|
binutils
|
||||||
diffoscope
|
diffoscope
|
||||||
];
|
];
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,5 @@
|
||||||
{ ... }:
|
{...}: let
|
||||||
let usb_data = (import ../data/usb_data.nix { });
|
usb_data = import ../data/usb_data.nix {};
|
||||||
in {
|
in {
|
||||||
programs.ssh.matchBlocks."*".identityFile = "${usb_data.ssh_priv_path}";
|
programs.ssh.matchBlocks."*".identityFile = "${usb_data.ssh_priv_path}";
|
||||||
programs.git.extraConfig = {
|
programs.git.extraConfig = {
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,10 @@
|
||||||
{ modulesPath, tree, config, pkgs, lib, ... }:
|
{
|
||||||
let secrets = config.services.secrets.secrets;
|
tree,
|
||||||
|
config,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
|
secrets = config.services.secrets.secrets;
|
||||||
in {
|
in {
|
||||||
imports = with tree; [
|
imports = with tree; [
|
||||||
users.root
|
users.root
|
||||||
|
|
@ -109,4 +114,3 @@ in {
|
||||||
|
|
||||||
system.stateVersion = "22.05";
|
system.stateVersion = "22.05";
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,7 +1,6 @@
|
||||||
{ config, lib, pkgs, modulesPath, ... }: {
|
{config, ...}: {
|
||||||
boot.initrd.kernelModules = ["dm-snapshot"];
|
boot.initrd.kernelModules = ["dm-snapshot"];
|
||||||
boot.initrd.availableKernelModules =
|
boot.initrd.availableKernelModules = ["xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod"];
|
||||||
[ "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
|
|
||||||
boot.kernelModules = ["kvm-amd"];
|
boot.kernelModules = ["kvm-amd"];
|
||||||
|
|
||||||
boot.initrd.services.swraid.mdadmConf =
|
boot.initrd.services.swraid.mdadmConf =
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
{ pkgs, ... }: {
|
{...}: {
|
||||||
services.secrets = {
|
services.secrets = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,8 +1,16 @@
|
||||||
{ self, nixpkgs-unstable, nix-darwin-unstable, tree, ... }@inputs:
|
{
|
||||||
let
|
self,
|
||||||
|
nixpkgs-unstable,
|
||||||
defaultSpecialArgs = defaults.defaultSpecialArgs // {
|
nix-darwin-unstable,
|
||||||
inputs = inputs // {
|
tree,
|
||||||
|
...
|
||||||
|
} @ inputs: let
|
||||||
|
defaultSpecialArgs =
|
||||||
|
defaults.defaultSpecialArgs
|
||||||
|
// {
|
||||||
|
inputs =
|
||||||
|
inputs
|
||||||
|
// {
|
||||||
# set these to the correct versions from inputs
|
# set these to the correct versions from inputs
|
||||||
nixpkgs = inputs.nixpkgs-unstable;
|
nixpkgs = inputs.nixpkgs-unstable;
|
||||||
home-manager = inputs.home-manager-unstable;
|
home-manager = inputs.home-manager-unstable;
|
||||||
|
|
@ -10,7 +18,9 @@ let
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
defaultModules = defaults.defaultModules ++ [
|
defaultModules =
|
||||||
|
defaults.defaultModules
|
||||||
|
++ [
|
||||||
# NO_INLINE
|
# NO_INLINE
|
||||||
tree.impure.profiles.base-darwin
|
tree.impure.profiles.base-darwin
|
||||||
inputs.home-manager-unstable.darwinModules.home-manager
|
inputs.home-manager-unstable.darwinModules.home-manager
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,11 @@
|
||||||
{ modulesPath, tree, config, pkgs, lib, ... }:
|
|
||||||
|
|
||||||
{
|
{
|
||||||
|
modulesPath,
|
||||||
|
tree,
|
||||||
|
config,
|
||||||
|
pkgs,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
imports = with tree; [
|
imports = with tree; [
|
||||||
users.root
|
users.root
|
||||||
|
|
||||||
|
|
@ -19,7 +24,6 @@
|
||||||
hosts.hetzner-vm.profiles.mpd
|
hosts.hetzner-vm.profiles.mpd
|
||||||
hosts.hetzner-vm.profiles.mailserver
|
hosts.hetzner-vm.profiles.mailserver
|
||||||
hosts.hetzner-vm.profiles.gitlab-static-sites
|
hosts.hetzner-vm.profiles.gitlab-static-sites
|
||||||
#hosts.hetzner-vm.profiles.lappy-dev
|
|
||||||
hosts.hetzner-vm.profiles.misskey
|
hosts.hetzner-vm.profiles.misskey
|
||||||
hosts.hetzner-vm.profiles.wireguard
|
hosts.hetzner-vm.profiles.wireguard
|
||||||
|
|
||||||
|
|
@ -40,4 +44,3 @@
|
||||||
|
|
||||||
system.stateVersion = "22.05";
|
system.stateVersion = "22.05";
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,10 @@
|
||||||
{ config, lib, ... }:
|
{
|
||||||
with lib;
|
config,
|
||||||
let cfg = config.mailserver;
|
lib,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
with lib; let
|
||||||
|
cfg = config.mailserver;
|
||||||
in {
|
in {
|
||||||
options.mailserver = {
|
options.mailserver = {
|
||||||
enable = mkEnableOption "mailserver";
|
enable = mkEnableOption "mailserver";
|
||||||
|
|
@ -10,7 +14,7 @@ in {
|
||||||
domains = mkOption {type = types.listOf types.str;};
|
domains = mkOption {type = types.listOf types.str;};
|
||||||
|
|
||||||
ssl_config = mkOption {
|
ssl_config = mkOption {
|
||||||
type = (types.submodule {
|
type = types.submodule {
|
||||||
options = {
|
options = {
|
||||||
useACME = mkOption {
|
useACME = mkOption {
|
||||||
type = types.bool;
|
type = types.bool;
|
||||||
|
|
@ -25,7 +29,7 @@ in {
|
||||||
default = "/var/lib/acme/${cfg.fqdn}/key.pem";
|
default = "/var/lib/acme/${cfg.fqdn}/key.pem";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
});
|
};
|
||||||
default = {};
|
default = {};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
@ -46,7 +50,11 @@ in {
|
||||||
|
|
||||||
accounts = mkOption {
|
accounts = mkOption {
|
||||||
# where name = email for login
|
# where name = email for login
|
||||||
type = types.attrsOf (types.submodule ({ config, name, ... }: {
|
type = types.attrsOf (types.submodule ({
|
||||||
|
config,
|
||||||
|
name,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
options = {
|
options = {
|
||||||
name = mkOption {
|
name = mkOption {
|
||||||
type = types.str;
|
type = types.str;
|
||||||
|
|
@ -59,10 +67,16 @@ in {
|
||||||
}));
|
}));
|
||||||
};
|
};
|
||||||
|
|
||||||
|
extra_aliases_file = mkOption {
|
||||||
|
type = types.nullOr types.str;
|
||||||
|
default = null;
|
||||||
|
};
|
||||||
|
|
||||||
sieve_directory = mkOption {
|
sieve_directory = mkOption {
|
||||||
type = types.str;
|
type = types.str;
|
||||||
default = "/var/sieve";
|
default = "/var/sieve";
|
||||||
};
|
};
|
||||||
|
|
||||||
dkim_directory = mkOption {
|
dkim_directory = mkOption {
|
||||||
type = types.str;
|
type = types.str;
|
||||||
default = "/var/dkim";
|
default = "/var/dkim";
|
||||||
|
|
@ -79,22 +93,30 @@ in {
|
||||||
};
|
};
|
||||||
|
|
||||||
vmail_config = mkOption {
|
vmail_config = mkOption {
|
||||||
type = (types.submodule {
|
type = types.submodule {
|
||||||
options = {
|
options = {
|
||||||
user_group_name = mkOption {
|
user = mkOption {
|
||||||
type = types.str;
|
type = types.str;
|
||||||
default = "vmail";
|
default = "vmail";
|
||||||
};
|
};
|
||||||
user_group_id = mkOption {
|
group = mkOption {
|
||||||
|
type = types.str;
|
||||||
|
default = "${cfg.vmail_config.user}";
|
||||||
|
};
|
||||||
|
user_id = mkOption {
|
||||||
type = types.number;
|
type = types.number;
|
||||||
default = 5000;
|
default = 5000;
|
||||||
};
|
};
|
||||||
|
group_id = mkOption {
|
||||||
|
type = types.number;
|
||||||
|
default = cfg.vmail_config.user_id;
|
||||||
|
};
|
||||||
directory = mkOption {
|
directory = mkOption {
|
||||||
type = types.str;
|
type = types.str;
|
||||||
default = "/home/${cfg.vmail_config.user_group_name}";
|
default = "/home/${cfg.vmail_config.user}";
|
||||||
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
});
|
|
||||||
default = {};
|
default = {};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -1,13 +1,20 @@
|
||||||
{ config, pkgs, lib, ... }:
|
{
|
||||||
let
|
config,
|
||||||
|
pkgs,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
mail_config = config.mailserver;
|
mail_config = config.mailserver;
|
||||||
|
|
||||||
|
vmail_config = mail_config.vmail_config;
|
||||||
|
|
||||||
passwdDir = "/run/dovecot2";
|
passwdDir = "/run/dovecot2";
|
||||||
passwdFile = "${passwdDir}/passwd";
|
passwdFile = "${passwdDir}/passwd";
|
||||||
|
|
||||||
bool2int = x: if x then "1" else "0";
|
bool2int = x:
|
||||||
|
if x
|
||||||
# maildir in format "/${domain}/${user}"
|
then "1"
|
||||||
dovecotMaildir = "maildir:${mail_config.vmail_config.directory}/%d/%n";
|
else "0";
|
||||||
|
|
||||||
postfixCfg = config.services.postfix;
|
postfixCfg = config.services.postfix;
|
||||||
dovecot2Cfg = config.services.dovecot2;
|
dovecot2Cfg = config.services.dovecot2;
|
||||||
|
|
@ -29,7 +36,7 @@ let
|
||||||
|
|
||||||
for f in ${
|
for f in ${
|
||||||
builtins.toString
|
builtins.toString
|
||||||
(lib.mapAttrsToList (name: value: passwordFiles."${name}")
|
(lib.mapAttrsToList (name: value: value.passwordFile)
|
||||||
mail_config.accounts)
|
mail_config.accounts)
|
||||||
}; do
|
}; do
|
||||||
if [ ! -f "$f" ]; then
|
if [ ! -f "$f" ]; then
|
||||||
|
|
@ -39,13 +46,10 @@ let
|
||||||
done
|
done
|
||||||
|
|
||||||
cat <<EOF > ${passwdFile}
|
cat <<EOF > ${passwdFile}
|
||||||
${lib.concatStringsSep "\n" (lib.mapAttrsToList (name: value:
|
${
|
||||||
"${name}:${"$(head -n 1 ${passwordFiles."${name}"})"}:${
|
lib.concatStringsSep "\n"
|
||||||
builtins.toString mail_config.vmail_config.user_group_id
|
(lib.mapAttrsToList (name: value: "${name}:$(head -n 1 ${value.passwordFile})") mail_config.accounts)
|
||||||
}:${
|
}
|
||||||
builtins.toString mail_config.vmail_config.user_group_id
|
|
||||||
}::${mail_config.vmail_config.directory}:/run/current-system/sw/bin/nologin:")
|
|
||||||
mail_config.accounts)}
|
|
||||||
EOF
|
EOF
|
||||||
|
|
||||||
chmod 600 ${passwdFile}
|
chmod 600 ${passwdFile}
|
||||||
|
|
@ -68,20 +72,24 @@ let
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
in {
|
in {
|
||||||
config = (lib.mkIf (mail_config.enable) {
|
config = lib.mkIf (mail_config.enable) {
|
||||||
services.dovecot2 = {
|
services.dovecot2 = {
|
||||||
enable = true;
|
enable = true;
|
||||||
enableImap = true;
|
enableImap = true;
|
||||||
enablePop3 = false;
|
enableLmtp = true;
|
||||||
enablePAM = false;
|
|
||||||
enableQuota = true;
|
enableQuota = true;
|
||||||
mailGroup = mail_config.vmail_config.user_group_name;
|
enablePop3 = false;
|
||||||
mailUser = mail_config.vmail_config.user_group_name;
|
enablePAM = false; # Not using PAM for Auth
|
||||||
mailLocation = dovecotMaildir;
|
|
||||||
|
mailUser = vmail_config.user;
|
||||||
|
mailGroup = vmail_config.group;
|
||||||
|
mailLocation = "maildir:${vmail_config.directory}/%d/%n";
|
||||||
|
|
||||||
sslServerCert = mail_config.ssl_config.cert;
|
sslServerCert = mail_config.ssl_config.cert;
|
||||||
sslServerKey = mail_config.ssl_config.key;
|
sslServerKey = mail_config.ssl_config.key;
|
||||||
enableLmtp = true;
|
|
||||||
modules = [ pkgs.dovecot_pigeonhole ];
|
# For Sieve
|
||||||
|
modules = with pkgs; [dovecot_pigeonhole];
|
||||||
protocols = ["sieve"];
|
protocols = ["sieve"];
|
||||||
|
|
||||||
sieveScripts = {
|
sieveScripts = {
|
||||||
|
|
@ -136,7 +144,6 @@ in {
|
||||||
mail_plugins = $mail_plugins imap_sieve
|
mail_plugins = $mail_plugins imap_sieve
|
||||||
}
|
}
|
||||||
|
|
||||||
mail_access_groups = "${mail_config.vmail_config.user_group_name}"
|
|
||||||
ssl = required
|
ssl = required
|
||||||
ssl_min_protocol = TLSv1.2
|
ssl_min_protocol = TLSv1.2
|
||||||
ssl_prefer_server_ciphers = yes
|
ssl_prefer_server_ciphers = yes
|
||||||
|
|
@ -156,12 +163,14 @@ in {
|
||||||
mail_plugins = $mail_plugins sieve
|
mail_plugins = $mail_plugins sieve
|
||||||
}
|
}
|
||||||
|
|
||||||
passdb {
|
mail_access_groups = "${vmail_config.group}"
|
||||||
driver = passwd-file
|
|
||||||
args = ${passwdFile}
|
|
||||||
}
|
|
||||||
|
|
||||||
userdb {
|
userdb {
|
||||||
|
driver = static
|
||||||
|
args = uid=${toString vmail_config.user_id} gid=${toString vmail_config.group_id}
|
||||||
|
}
|
||||||
|
|
||||||
|
passdb {
|
||||||
driver = passwd-file
|
driver = passwd-file
|
||||||
args = ${passwdFile}
|
args = ${passwdFile}
|
||||||
}
|
}
|
||||||
|
|
@ -213,5 +222,5 @@ in {
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.services.postfix.restartTriggers = [genPasswdScript];
|
systemd.services.postfix.restartTriggers = [genPasswdScript];
|
||||||
});
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,11 @@
|
||||||
{ ... }: {
|
{
|
||||||
|
lib,
|
||||||
|
config,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
|
mail_config = config.mailserver;
|
||||||
|
in {
|
||||||
|
config = lib.mkIf config.mailserver.enable {
|
||||||
networking.firewall = {
|
networking.firewall = {
|
||||||
allowedTCPPorts = [
|
allowedTCPPorts = [
|
||||||
# SMTP
|
# SMTP
|
||||||
|
|
@ -15,4 +22,5 @@
|
||||||
4190
|
4190
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,10 @@
|
||||||
{ config, lib, pkgs, ... }:
|
{
|
||||||
let
|
config,
|
||||||
|
lib,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
with lib; let
|
||||||
mail_config = config.mailserver;
|
mail_config = config.mailserver;
|
||||||
dkimUser = config.services.opendkim.user;
|
dkimUser = config.services.opendkim.user;
|
||||||
dkimGroup = config.services.opendkim.group;
|
dkimGroup = config.services.opendkim.group;
|
||||||
|
|
@ -9,8 +14,7 @@ let
|
||||||
|
|
||||||
domains = mail_config.domains;
|
domains = mail_config.domains;
|
||||||
|
|
||||||
createDomainDkimCert = dom:
|
createDomainDkimCert = dom: let
|
||||||
let
|
|
||||||
dkim_key = "${keyDir}/${dom}.${selector}.key";
|
dkim_key = "${keyDir}/${dom}.${selector}.key";
|
||||||
dkim_txt = "${keyDir}/${dom}.${selector}.txt";
|
dkim_txt = "${keyDir}/${dom}.${selector}.txt";
|
||||||
in ''
|
in ''
|
||||||
|
|
@ -27,20 +31,22 @@ let
|
||||||
'';
|
'';
|
||||||
|
|
||||||
createAllCerts =
|
createAllCerts =
|
||||||
lib.concatStringsSep "\n" (map createDomainDkimCert mail_config.domains);
|
concatStringsSep "\n" (map createDomainDkimCert mail_config.domains);
|
||||||
|
|
||||||
keyTable = pkgs.writeText "opendkim-KeyTable" (lib.concatStringsSep "\n"
|
keyTable = pkgs.writeText "opendkim-KeyTable" (concatStringsSep "\n"
|
||||||
(lib.flip map domains
|
(flip map domains
|
||||||
(dom: "${dom} ${dom}:${selector}:${keyDir}/${dom}.${selector}.key")));
|
(dom: "${dom} ${dom}:${selector}:${keyDir}/${dom}.${selector}.key")));
|
||||||
|
|
||||||
signingTable = pkgs.writeText "opendkim-SigningTable"
|
signingTable =
|
||||||
(lib.concatStringsSep "\n" (lib.flip map domains (dom: "${dom} ${dom}")));
|
pkgs.writeText "opendkim-SigningTable"
|
||||||
|
(concatStringsSep "\n" (flip map domains (dom: "${dom} ${dom}")));
|
||||||
|
|
||||||
dkim = config.services.opendkim;
|
dkim = config.services.opendkim;
|
||||||
args = [ "-f" "-l" ]
|
args =
|
||||||
++ lib.optionals (dkim.configFile != null) [ "-x" dkim.configFile ];
|
["-f" "-l"]
|
||||||
|
++ optionals (dkim.configFile != null) ["-x" dkim.configFile];
|
||||||
in {
|
in {
|
||||||
config = (lib.mkIf (mail_config.enable) {
|
config = mkIf (mail_config.enable) {
|
||||||
services.opendkim = {
|
services.opendkim = {
|
||||||
enable = true;
|
enable = true;
|
||||||
selector = selector;
|
selector = selector;
|
||||||
|
|
@ -52,26 +58,27 @@ in {
|
||||||
Socket ${dkim.socket}
|
Socket ${dkim.socket}
|
||||||
KeyTable file:${keyTable}
|
KeyTable file:${keyTable}
|
||||||
SigningTable file:${signingTable}
|
SigningTable file:${signingTable}
|
||||||
'' + (lib.optionalString mail_config.debug_mode ''
|
''
|
||||||
|
+ (optionalString mail_config.debug_mode ''
|
||||||
Syslog yes
|
Syslog yes
|
||||||
SyslogSuccess yes
|
SyslogSuccess yes
|
||||||
LogWhy yes
|
LogWhy yes
|
||||||
''));
|
''));
|
||||||
};
|
};
|
||||||
|
|
||||||
users.users =
|
users.users = optionalAttrs (config.services.postfix.user == "postfix") {
|
||||||
lib.optionalAttrs (config.services.postfix.user == "postfix") {
|
|
||||||
postfix.extraGroups = ["${dkimGroup}"];
|
postfix.extraGroups = ["${dkimGroup}"];
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.services.opendkim = {
|
systemd.services.opendkim = {
|
||||||
preStart = lib.mkForce createAllCerts;
|
preStart = mkForce createAllCerts;
|
||||||
serviceConfig = {
|
serviceConfig = {
|
||||||
ExecStart = lib.mkForce
|
ExecStart =
|
||||||
"${pkgs.opendkim}/bin/opendkim ${lib.escapeShellArgs args}";
|
mkForce
|
||||||
PermissionsStartOnly = lib.mkForce false;
|
"${pkgs.opendkim}/bin/opendkim ${escapeShellArgs args}";
|
||||||
|
PermissionsStartOnly = mkForce false;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
systemd.tmpfiles.rules = ["d '${keyDir}' - ${dkimUser} ${dkimGroup} - -"];
|
systemd.tmpfiles.rules = ["d '${keyDir}' - ${dkimUser} ${dkimGroup} - -"];
|
||||||
});
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,16 +1,18 @@
|
||||||
{ config, pkgs, lib, ... }:
|
{
|
||||||
|
config,
|
||||||
let
|
pkgs,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
mail_config = config.mailserver;
|
mail_config = config.mailserver;
|
||||||
submissionHeaderCleanupRules =
|
submissionHeaderCleanupRules = pkgs.writeText "submission_header_cleanup_rules" ''
|
||||||
pkgs.writeText "submission_header_cleanup_rules" (''
|
|
||||||
/^Received:/ IGNORE
|
/^Received:/ IGNORE
|
||||||
/^X-Originating-IP:/ IGNORE
|
/^X-Originating-IP:/ IGNORE
|
||||||
/^X-Mailer:/ IGNORE
|
/^X-Mailer:/ IGNORE
|
||||||
/^User-Agent:/ IGNORE
|
/^User-Agent:/ IGNORE
|
||||||
/^X-Enigmail:/ IGNORE
|
/^X-Enigmail:/ IGNORE
|
||||||
/^Message-ID:\s+<(.*?)@.*?>/ REPLACE Message-ID: <$1@${mail_config.fqdn}>
|
/^Message-ID:\s+<(.*?)@.*?>/ REPLACE Message-ID: <$1@${mail_config.fqdn}>
|
||||||
'');
|
'';
|
||||||
|
|
||||||
inetSocket = addr: port: "inet:[${toString port}@${addr}]";
|
inetSocket = addr: port: "inet:[${toString port}@${addr}]";
|
||||||
unixSocket = sock: "unix:${sock}";
|
unixSocket = sock: "unix:${sock}";
|
||||||
|
|
@ -22,30 +24,29 @@ let
|
||||||
|
|
||||||
# valiases_postfix :: Map String [String]
|
# valiases_postfix :: Map String [String]
|
||||||
valiases_postfix = mergeLookupTables (lib.flatten (lib.mapAttrsToList
|
valiases_postfix = mergeLookupTables (lib.flatten (lib.mapAttrsToList
|
||||||
(name: value:
|
(name: value: let
|
||||||
let to = name;
|
to = name;
|
||||||
in map (from: { "${from}" = to; }) (value.aliases ++ lib.singleton name))
|
in
|
||||||
|
map (from: {"${from}" = to;}) (value.aliases ++ lib.singleton name))
|
||||||
mail_config.accounts));
|
mail_config.accounts));
|
||||||
|
|
||||||
# all_valiases_postfix :: Map String [String]
|
# all_valiases_postfix :: Map String [String]
|
||||||
all_valiases_postfix = mergeLookupTables [valiases_postfix];
|
all_valiases_postfix = mergeLookupTables [valiases_postfix];
|
||||||
|
|
||||||
# lookupTableToString :: Map String [String] -> String
|
# lookupTableToString :: Map String [String] -> String
|
||||||
lookupTableToString = attrs:
|
lookupTableToString = attrs: let
|
||||||
let valueToString = value: lib.concatStringsSep ", " value;
|
valueToString = value: lib.concatStringsSep ", " value;
|
||||||
in lib.concatStringsSep "\n"
|
in
|
||||||
|
lib.concatStringsSep "\n"
|
||||||
(lib.mapAttrsToList (name: value: "${name} ${valueToString value}") attrs);
|
(lib.mapAttrsToList (name: value: "${name} ${valueToString value}") attrs);
|
||||||
|
|
||||||
# valiases_file :: Path
|
|
||||||
valiases_file = let
|
|
||||||
content = lookupTableToString (mergeLookupTables [ all_valiases_postfix ]);
|
|
||||||
in builtins.toFile "valias" content;
|
|
||||||
|
|
||||||
# vhosts_file :: Path
|
|
||||||
vhosts_file =
|
vhosts_file =
|
||||||
builtins.toFile "vhosts" (lib.concatStringsSep "\n" mail_config.domains);
|
builtins.toFile "vhosts" (lib.concatStringsSep "\n" mail_config.domains);
|
||||||
vaccounts_file =
|
|
||||||
builtins.toFile "vaccounts" (lookupTableToString all_valiases_postfix);
|
aliases_accounts_file = let
|
||||||
|
content = lookupTableToString (mergeLookupTables [all_valiases_postfix]);
|
||||||
|
in
|
||||||
|
builtins.toFile "aliases_accounts" content;
|
||||||
|
|
||||||
mappedFile = name: "hash:/var/lib/postfix/conf/${name}";
|
mappedFile = name: "hash:/var/lib/postfix/conf/${name}";
|
||||||
|
|
||||||
|
|
@ -61,27 +62,42 @@ let
|
||||||
smtpd_client_restrictions = "permit_sasl_authenticated,reject";
|
smtpd_client_restrictions = "permit_sasl_authenticated,reject";
|
||||||
smtpd_sender_login_maps = "hash:/etc/postfix/vaccounts";
|
smtpd_sender_login_maps = "hash:/etc/postfix/vaccounts";
|
||||||
smtpd_sender_restrictions = "reject_sender_login_mismatch";
|
smtpd_sender_restrictions = "reject_sender_login_mismatch";
|
||||||
smtpd_recipient_restrictions =
|
smtpd_recipient_restrictions = "reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,reject";
|
||||||
"reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,reject";
|
|
||||||
cleanup_service_name = "submission-header-cleanup";
|
cleanup_service_name = "submission-header-cleanup";
|
||||||
};
|
};
|
||||||
|
|
||||||
tls_allowed = "TLSv1.3, TLSv1.2, TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
|
tls_allowed = "TLSv1.3, TLSv1.2, TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
|
||||||
tls_disallow = "MD5, DES, ADH, RC4, PSD, SRP, 3DES, eNULL, aNULL";
|
tls_disallow = "MD5, DES, ADH, RC4, PSD, SRP, 3DES, eNULL, aNULL";
|
||||||
in {
|
in {
|
||||||
config = (lib.mkIf (mail_config.enable) {
|
config = lib.mkIf (mail_config.enable) {
|
||||||
|
systemd.tmpfiles.rules = lib.mkIf (mail_config.extra_aliases_file != null) [
|
||||||
|
# folder to store the extra aliases file
|
||||||
|
"f /run/postfix_extra_aliases 660 root root"
|
||||||
|
];
|
||||||
|
|
||||||
|
systemd.services.postfix-extra-aliases-setup = lib.mkIf (mail_config.extra_aliases_file != null) {
|
||||||
|
wantedBy = ["multi-user.target"];
|
||||||
|
partOf = ["postfix.service"];
|
||||||
|
before = ["postfix-setup.service"];
|
||||||
|
script = ''
|
||||||
|
cat ${aliases_accounts_file} ${mail_config.extra_aliases_file} > /run/postfix_extra_aliases
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
services.postfix = {
|
services.postfix = {
|
||||||
enable = true;
|
enable = true;
|
||||||
hostname = "${mail_config.fqdn}";
|
hostname = "${mail_config.fqdn}";
|
||||||
networksStyle = "host";
|
networksStyle = "host";
|
||||||
mapFiles."valias" = valiases_file;
|
|
||||||
mapFiles."vaccounts" = vaccounts_file;
|
mapFiles."aliases_accounts" =
|
||||||
|
if (mail_config.extra_aliases_file == null)
|
||||||
|
then aliases_accounts_file
|
||||||
|
else "/run/postfix_extra_aliases";
|
||||||
|
|
||||||
sslCert = mail_config.ssl_config.cert;
|
sslCert = mail_config.ssl_config.cert;
|
||||||
sslKey = mail_config.ssl_config.key;
|
sslKey = mail_config.ssl_config.key;
|
||||||
enableSubmission = true;
|
enableSubmission = true;
|
||||||
enableSubmissions = true;
|
enableSubmissions = true;
|
||||||
virtual =
|
|
||||||
lookupTableToString (mergeLookupTables [ all_valiases_postfix ]);
|
|
||||||
|
|
||||||
config = {
|
config = {
|
||||||
# Extra Config
|
# Extra Config
|
||||||
|
|
@ -91,13 +107,12 @@ in {
|
||||||
disable_vrfy_command = true;
|
disable_vrfy_command = true;
|
||||||
message_size_limit = "20971520";
|
message_size_limit = "20971520";
|
||||||
|
|
||||||
virtual_uid_maps =
|
virtual_uid_maps = "static:${toString mail_config.vmail_config.user_id}";
|
||||||
"static:${toString mail_config.vmail_config.user_group_id}";
|
virtual_gid_maps = "static:${toString mail_config.vmail_config.group_id}";
|
||||||
virtual_gid_maps =
|
|
||||||
"static:${toString mail_config.vmail_config.user_group_id}";
|
|
||||||
virtual_mailbox_base = "${mail_config.vmail_config.directory}";
|
virtual_mailbox_base = "${mail_config.vmail_config.directory}";
|
||||||
virtual_mailbox_domains = vhosts_file;
|
virtual_mailbox_domains = vhosts_file;
|
||||||
virtual_mailbox_maps = mappedFile "valias";
|
virtual_mailbox_maps = mappedFile "aliases_accounts";
|
||||||
|
virtual_alias_maps = mappedFile "aliases_accounts";
|
||||||
virtual_transport = "lmtp:unix:/run/dovecot2/dovecot-lmtp";
|
virtual_transport = "lmtp:unix:/run/dovecot2/dovecot-lmtp";
|
||||||
lmtp_destination_recipient_limit = "1";
|
lmtp_destination_recipient_limit = "1";
|
||||||
|
|
||||||
|
|
@ -118,11 +133,7 @@ in {
|
||||||
"check_policy_service unix:private/policy-spf"
|
"check_policy_service unix:private/policy-spf"
|
||||||
];
|
];
|
||||||
|
|
||||||
# TLS settings, inspired by https://github.com/jeaye/nix-files
|
|
||||||
# Submission by mail clients is handled in submissionOptions
|
|
||||||
smtpd_tls_security_level = "may";
|
smtpd_tls_security_level = "may";
|
||||||
|
|
||||||
# strong might suffice and is computationally less expensive
|
|
||||||
smtpd_tls_eecdh_grade = "ultra";
|
smtpd_tls_eecdh_grade = "ultra";
|
||||||
|
|
||||||
# Only Alow Modern TLS
|
# Only Alow Modern TLS
|
||||||
|
|
@ -158,9 +169,7 @@ in {
|
||||||
non_smtpd_milters = ["unix:/run/opendkim/opendkim.sock"];
|
non_smtpd_milters = ["unix:/run/opendkim/opendkim.sock"];
|
||||||
|
|
||||||
milter_protocol = "6";
|
milter_protocol = "6";
|
||||||
milter_mail_macros =
|
milter_mail_macros = "i {mail_addr} {client_addr} {client_name} {auth_type} {auth_authen} {auth_author} {mail_addr} {mail_host} {mail_mailer}";
|
||||||
"i {mail_addr} {client_addr} {client_name} {auth_type} {auth_authen} {auth_author} {mail_addr} {mail_host} {mail_mailer}";
|
|
||||||
|
|
||||||
};
|
};
|
||||||
|
|
||||||
submissionOptions = submissionOptions;
|
submissionOptions = submissionOptions;
|
||||||
|
|
@ -193,5 +202,5 @@ in {
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
});
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,16 +1,17 @@
|
||||||
{ config, pkgs, lib, ... }:
|
{
|
||||||
|
config,
|
||||||
let
|
lib,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
mail_config = config.mailserver;
|
mail_config = config.mailserver;
|
||||||
|
|
||||||
ports = (import ../../ports.nix { });
|
ports = import ../../ports.nix {};
|
||||||
|
|
||||||
postfixCfg = config.services.postfix;
|
postfixCfg = config.services.postfix;
|
||||||
rspamdCfg = config.services.rspamd;
|
rspamdCfg = config.services.rspamd;
|
||||||
rspamdSocket = "rspamd.service";
|
rspamdSocket = "rspamd.service";
|
||||||
in {
|
in {
|
||||||
config = (lib.mkIf (mail_config.enable) {
|
config = lib.mkIf (mail_config.enable) {
|
||||||
|
|
||||||
services.rspamd = {
|
services.rspamd = {
|
||||||
enable = true;
|
enable = true;
|
||||||
debug = mail_config.debug_mode;
|
debug = mail_config.debug_mode;
|
||||||
|
|
@ -51,10 +52,12 @@ in {
|
||||||
|
|
||||||
workers.rspamd_proxy = {
|
workers.rspamd_proxy = {
|
||||||
type = "rspamd_proxy";
|
type = "rspamd_proxy";
|
||||||
bindSockets = [{
|
bindSockets = [
|
||||||
|
{
|
||||||
socket = "/run/rspamd/rspamd-milter.sock";
|
socket = "/run/rspamd/rspamd-milter.sock";
|
||||||
mode = "0664";
|
mode = "0664";
|
||||||
}];
|
}
|
||||||
|
];
|
||||||
count = 1;
|
count = 1;
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
milter = yes;
|
milter = yes;
|
||||||
|
|
@ -69,13 +72,14 @@ in {
|
||||||
workers.controller = {
|
workers.controller = {
|
||||||
type = "controller";
|
type = "controller";
|
||||||
count = 1;
|
count = 1;
|
||||||
bindSockets = [{
|
bindSockets = [
|
||||||
|
{
|
||||||
socket = "/run/rspamd/worker-controller.sock";
|
socket = "/run/rspamd/worker-controller.sock";
|
||||||
mode = "0666";
|
mode = "0666";
|
||||||
}];
|
}
|
||||||
|
];
|
||||||
includes = [];
|
includes = [];
|
||||||
};
|
};
|
||||||
|
|
||||||
};
|
};
|
||||||
|
|
||||||
services.redis.servers.rspamd = {
|
services.redis.servers.rspamd = {
|
||||||
|
|
@ -94,6 +98,5 @@ in {
|
||||||
};
|
};
|
||||||
|
|
||||||
users.extraUsers.${postfixCfg.user}.extraGroups = [rspamdCfg.group];
|
users.extraUsers.${postfixCfg.user}.extraGroups = [rspamdCfg.group];
|
||||||
});
|
};
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,10 +1,12 @@
|
||||||
{ config, pkgs, lib, ... }:
|
{
|
||||||
let
|
config,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
mail_config = config.mailserver;
|
mail_config = config.mailserver;
|
||||||
acmeRoot = "/var/lib/acme/acme-challenge";
|
acmeRoot = "/var/lib/acme/acme-challenge";
|
||||||
|
|
||||||
in {
|
in {
|
||||||
config = (lib.mkIf (mail_config.enable && mail_config.ssl_config.useACME) {
|
config = lib.mkIf (mail_config.enable && mail_config.ssl_config.useACME) {
|
||||||
services.nginx = {
|
services.nginx = {
|
||||||
enable = true;
|
enable = true;
|
||||||
virtualHosts."${mail_config.fqdn}" = {
|
virtualHosts."${mail_config.fqdn}" = {
|
||||||
|
|
@ -19,5 +21,5 @@ in {
|
||||||
security.acme.certs."${mail_config.fqdn}" = {
|
security.acme.certs."${mail_config.fqdn}" = {
|
||||||
reloadServices = ["postfix.service" "dovecot2.service"];
|
reloadServices = ["postfix.service" "dovecot2.service"];
|
||||||
};
|
};
|
||||||
});
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,12 +1,18 @@
|
||||||
{ config, pkgs, lib, ... }:
|
{
|
||||||
let
|
config,
|
||||||
|
pkgs,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
mail_config = config.mailserver;
|
mail_config = config.mailserver;
|
||||||
|
|
||||||
v = mail_config.vmail_config;
|
vmail_config = mail_config.vmail_config;
|
||||||
|
vmail_user = vmail_config.user;
|
||||||
|
vmail_group = vmail_config.group;
|
||||||
|
|
||||||
sieve_directory = mail_config.sieve_directory;
|
sieve_directory = mail_config.sieve_directory;
|
||||||
|
|
||||||
virtualMailUsersActivationScript =
|
virtualMailUsersActivationScript = pkgs.writeScript "activate-virtual-mail-users" ''
|
||||||
pkgs.writeScript "activate-virtual-mail-users" ''
|
|
||||||
#!${pkgs.stdenv.shell}
|
#!${pkgs.stdenv.shell}
|
||||||
|
|
||||||
set -euo pipefail
|
set -euo pipefail
|
||||||
|
|
@ -14,24 +20,29 @@ let
|
||||||
# Create directory to store user sieve scripts if it doesn't exist
|
# Create directory to store user sieve scripts if it doesn't exist
|
||||||
if (! test -d "${sieve_directory}"); then
|
if (! test -d "${sieve_directory}"); then
|
||||||
mkdir "${sieve_directory}"
|
mkdir "${sieve_directory}"
|
||||||
chown "${v.user_group_name}:${v.user_group_name}" "${sieve_directory}"
|
chown "${vmail_user}:${vmail_group}" "${sieve_directory}"
|
||||||
chmod 770 "${sieve_directory}"
|
chmod 770 "${sieve_directory}"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# Copy user's sieve script to the correct location (if it exists). If it
|
# Copy user's sieve script to the correct location (if it exists). If it
|
||||||
# is null, remove the file.
|
# is null, remove the file.
|
||||||
${lib.concatMapStringsSep "\n" ({ name, sieveScript }:
|
${lib.concatMapStringsSep "\n" ({
|
||||||
if lib.isString sieveScript then ''
|
name,
|
||||||
|
sieveScript,
|
||||||
|
}:
|
||||||
|
if lib.isString sieveScript
|
||||||
|
then ''
|
||||||
if (! test -d "${sieve_directory}/${name}"); then
|
if (! test -d "${sieve_directory}/${name}"); then
|
||||||
mkdir -p "${sieve_directory}/${name}"
|
mkdir -p "${sieve_directory}/${name}"
|
||||||
chown "${v.user_group_name}:${v.user_group_name}" "${sieve_directory}/${name}"
|
chown "${vmail_user}:${vmail_group}" "${sieve_directory}/${name}"
|
||||||
chmod 770 "${sieve_directory}/${name}"
|
chmod 770 "${sieve_directory}/${name}"
|
||||||
fi
|
fi
|
||||||
cat << 'EOF' > "${sieve_directory}/${name}/default.sieve"
|
cat << 'EOF' > "${sieve_directory}/${name}/default.sieve"
|
||||||
${sieveScript}
|
${sieveScript}
|
||||||
EOF
|
EOF
|
||||||
chown "${v.user_group_name}:${v.user_group_name}" "${sieve_directory}/${name}/default.sieve"
|
chown "${vmail_user}:${vmail_group}" "${sieve_directory}/${name}/default.sieve"
|
||||||
'' else ''
|
''
|
||||||
|
else ''
|
||||||
if (test -f "${sieve_directory}/${name}/default.sieve"); then
|
if (test -f "${sieve_directory}/${name}/default.sieve"); then
|
||||||
rm "${sieve_directory}/${name}/default.sieve"
|
rm "${sieve_directory}/${name}/default.sieve"
|
||||||
fi
|
fi
|
||||||
|
|
@ -41,23 +52,23 @@ let
|
||||||
'') (map (user: {inherit (user) name sieveScript;})
|
'') (map (user: {inherit (user) name sieveScript;})
|
||||||
(lib.attrValues mail_config.accounts))}
|
(lib.attrValues mail_config.accounts))}
|
||||||
'';
|
'';
|
||||||
|
|
||||||
in {
|
in {
|
||||||
config = (lib.mkIf (mail_config.enable) {
|
config = lib.mkIf (mail_config.enable) {
|
||||||
users.users."${v.user_group_name}" = {
|
users.users."${vmail_user}" = {
|
||||||
name = "${v.user_group_name}";
|
|
||||||
isSystemUser = true;
|
isSystemUser = true;
|
||||||
uid = v.user_group_id;
|
|
||||||
home = v.directory;
|
home = vmail_config.directory;
|
||||||
createHome = true;
|
createHome = true;
|
||||||
group = "${v.user_group_name}";
|
|
||||||
|
uid = vmail_config.user_id;
|
||||||
|
group = "${vmail_group}";
|
||||||
};
|
};
|
||||||
users.groups."${v.user_group_name}" = { gid = v.user_group_id; };
|
users.groups."${vmail_group}" = {gid = vmail_config.group_id;};
|
||||||
systemd.services.activate-virtual-mail-users = {
|
systemd.services.activate-virtual-mail-users = {
|
||||||
wantedBy = ["multi-user.target"];
|
wantedBy = ["multi-user.target"];
|
||||||
before = ["dovecot2.service"];
|
before = ["dovecot2.service"];
|
||||||
serviceConfig = {ExecStart = virtualMailUsersActivationScript;};
|
serviceConfig = {ExecStart = virtualMailUsersActivationScript;};
|
||||||
enable = true;
|
enable = true;
|
||||||
};
|
};
|
||||||
});
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,7 +1,11 @@
|
||||||
{ config, lib, ... }:
|
{
|
||||||
let mail_config = config.mailserver;
|
config,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
|
mail_config = config.mailserver;
|
||||||
in {
|
in {
|
||||||
config = (lib.mkIf (mail_config.enable && mail_config.enable_roundcube) {
|
config = lib.mkIf (mail_config.enable && mail_config.enable_roundcube) {
|
||||||
services.roundcube = {
|
services.roundcube = {
|
||||||
enable = true;
|
enable = true;
|
||||||
hostName = "${mail_config.roundcube_url}";
|
hostName = "${mail_config.roundcube_url}";
|
||||||
|
|
@ -14,5 +18,5 @@ in {
|
||||||
${mail_config.extra_roundcube_config}
|
${mail_config.extra_roundcube_config}
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
});
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,9 +1,14 @@
|
||||||
{ config, lib, pkgs, ... }:
|
{
|
||||||
with lib;
|
config,
|
||||||
let
|
lib,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
with lib; let
|
||||||
cfg = config.services.piped;
|
cfg = config.services.piped;
|
||||||
|
|
||||||
backend_config = {
|
backend_config =
|
||||||
|
{
|
||||||
PORT = cfg.internalBackendPort;
|
PORT = cfg.internalBackendPort;
|
||||||
HTTP_WORKERS = cfg.httpWorkers;
|
HTTP_WORKERS = cfg.httpWorkers;
|
||||||
PROXY_PART = "https://${cfg.proxyDomain}";
|
PROXY_PART = "https://${cfg.proxyDomain}";
|
||||||
|
|
@ -13,7 +18,7 @@ let
|
||||||
COMPROMISED_PASSWORD_CHECK = cfg.enableCompromisedPasswordCheck;
|
COMPROMISED_PASSWORD_CHECK = cfg.enableCompromisedPasswordCheck;
|
||||||
FEED_RETENTION = cfg.feedRetentionDays;
|
FEED_RETENTION = cfg.feedRetentionDays;
|
||||||
SUBSCRIPTIONS_EXPIRY = cfg.subscriptionRetentionDays;
|
SUBSCRIPTIONS_EXPIRY = cfg.subscriptionRetentionDays;
|
||||||
SPONSORBLOCK_SERVERS = lib.concatStringsSep "," cfg.sponsorblockServers;
|
SPONSORBLOCK_SERVERS = concatStringsSep "," cfg.sponsorblockServers;
|
||||||
DISABLE_RYD = cfg.disableRYD;
|
DISABLE_RYD = cfg.disableRYD;
|
||||||
DISABLE_LBRY = cfg.disableLBRYStreams;
|
DISABLE_LBRY = cfg.disableLBRYStreams;
|
||||||
RYD_PROXY_URL = cfg.rydAPIURL;
|
RYD_PROXY_URL = cfg.rydAPIURL;
|
||||||
|
|
@ -23,27 +28,32 @@ let
|
||||||
"hibernate.dialect" = "org.hibernate.dialect.PostgreSQLDialect";
|
"hibernate.dialect" = "org.hibernate.dialect.PostgreSQLDialect";
|
||||||
"hibernate.connection.username" = "piped";
|
"hibernate.connection.username" = "piped";
|
||||||
"hibernate.connection.password" = "password";
|
"hibernate.connection.password" = "password";
|
||||||
} // (optionalAttrs cfg.enableCaptcha {
|
}
|
||||||
|
// (optionalAttrs cfg.enableCaptcha {
|
||||||
CAPTCHA_API_URL = cfg.captchaAPIURL;
|
CAPTCHA_API_URL = cfg.captchaAPIURL;
|
||||||
# This is substituted in the PreStart of piped-backend.service
|
# This is substituted in the PreStart of piped-backend.service
|
||||||
CAPTCHA_API_KEY = if cfg.captchaAPIKeyFile != "" then
|
CAPTCHA_API_KEY =
|
||||||
"CAPTCHA_API_KEY_FILE"
|
if cfg.captchaAPIKeyFile != ""
|
||||||
else
|
then "CAPTCHA_API_KEY_FILE"
|
||||||
cfg.captchaAPIKey;
|
else cfg.captchaAPIKey;
|
||||||
}) // (optionalAttrs cfg.enableFederation {
|
})
|
||||||
|
// (optionalAttrs cfg.enableFederation {
|
||||||
MATRIX_SERVER = cfg.matrixServerAddr;
|
MATRIX_SERVER = cfg.matrixServerAddr;
|
||||||
# also substituted
|
# also substituted
|
||||||
MATRIX_TOKEN = if cfg.matrixTokenFile != "" then
|
MATRIX_TOKEN =
|
||||||
"MATRIX_TOKEN_FILE"
|
if cfg.matrixTokenFile != ""
|
||||||
else
|
then "MATRIX_TOKEN_FILE"
|
||||||
cfg.matrixToken;
|
else cfg.matrixToken;
|
||||||
});
|
});
|
||||||
|
|
||||||
cfgToString = v: if builtins.isBool v then boolToString v else toString v;
|
cfgToString = v:
|
||||||
backend_config_file = pkgs.writeText "config.properties"
|
if builtins.isBool v
|
||||||
|
then boolToString v
|
||||||
|
else toString v;
|
||||||
|
backend_config_file =
|
||||||
|
pkgs.writeText "config.properties"
|
||||||
(concatStringsSep "\n"
|
(concatStringsSep "\n"
|
||||||
(mapAttrsToList (n: v: "${n}:${cfgToString v}") backend_config));
|
(mapAttrsToList (n: v: "${n}:${cfgToString v}") backend_config));
|
||||||
|
|
||||||
in {
|
in {
|
||||||
config = lib.mkIf (cfg.enable && !cfg.disableBackend) {
|
config = lib.mkIf (cfg.enable && !cfg.disableBackend) {
|
||||||
systemd.tmpfiles.rules = ["d /run/piped-backend - piped piped"];
|
systemd.tmpfiles.rules = ["d /run/piped-backend - piped piped"];
|
||||||
|
|
@ -52,7 +62,8 @@ in {
|
||||||
wantedBy = ["multi-user.target"];
|
wantedBy = ["multi-user.target"];
|
||||||
serviceConfig = {
|
serviceConfig = {
|
||||||
WorkingDirectory = "/run/piped-backend";
|
WorkingDirectory = "/run/piped-backend";
|
||||||
ExecStartPre = let confFile = "/run/piped-backend/config.properties";
|
ExecStartPre = let
|
||||||
|
confFile = "/run/piped-backend/config.properties";
|
||||||
in "${pkgs.writeShellScript "piped-backend-init" ''
|
in "${pkgs.writeShellScript "piped-backend-init" ''
|
||||||
[ -f "${confFile}" ] && rm ${confFile}
|
[ -f "${confFile}" ] && rm ${confFile}
|
||||||
cp ${backend_config_file} ${confFile}
|
cp ${backend_config_file} ${confFile}
|
||||||
|
|
@ -96,10 +107,12 @@ in {
|
||||||
|
|
||||||
services.postgresql = {
|
services.postgresql = {
|
||||||
enable = true;
|
enable = true;
|
||||||
ensureUsers = [{
|
ensureUsers = [
|
||||||
|
{
|
||||||
name = "piped";
|
name = "piped";
|
||||||
ensurePermissions."DATABASE piped" = "ALL PRIVILEGES";
|
ensurePermissions."DATABASE piped" = "ALL PRIVILEGES";
|
||||||
}];
|
}
|
||||||
|
];
|
||||||
ensureDatabases = ["piped"];
|
ensureDatabases = ["piped"];
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,11 @@
|
||||||
{ config, lib, pkgs, ... }:
|
{
|
||||||
with lib;
|
config,
|
||||||
let cfg = config.services.piped;
|
lib,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
with lib; let
|
||||||
|
cfg = config.services.piped;
|
||||||
in {
|
in {
|
||||||
options.services.piped = {
|
options.services.piped = {
|
||||||
enable = mkEnableOption "piped";
|
enable = mkEnableOption "piped";
|
||||||
|
|
@ -58,8 +63,7 @@ in {
|
||||||
|
|
||||||
sponsorblockServers = mkOption {
|
sponsorblockServers = mkOption {
|
||||||
type = types.listOf types.str;
|
type = types.listOf types.str;
|
||||||
default =
|
default = ["https://sponsor.ajay.app" "https://sponsorblock.kavin.rocks"];
|
||||||
[ "https://sponsor.ajay.app" "https://sponsorblock.kavin.rocks" ];
|
|
||||||
description = "Days subscriptions are stored for unauthenticated users";
|
description = "Days subscriptions are stored for unauthenticated users";
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
@ -72,15 +76,13 @@ in {
|
||||||
disableLBRYStreams = mkOption {
|
disableLBRYStreams = mkOption {
|
||||||
type = types.bool;
|
type = types.bool;
|
||||||
default = false;
|
default = false;
|
||||||
description =
|
description = "Disable showing streams provided by LBRY Youtube Partnership";
|
||||||
"Disable showing streams provided by LBRY Youtube Partnership";
|
|
||||||
};
|
};
|
||||||
|
|
||||||
enableCompromisedPasswordCheck = mkOption {
|
enableCompromisedPasswordCheck = mkOption {
|
||||||
type = types.bool;
|
type = types.bool;
|
||||||
default = true;
|
default = true;
|
||||||
description =
|
description = "Use the haveibeenpwned API to check if user password have been compromised";
|
||||||
"Use the haveibeenpwned API to check if user password have been compromised";
|
|
||||||
};
|
};
|
||||||
|
|
||||||
enableCaptcha = mkOption {
|
enableCaptcha = mkOption {
|
||||||
|
|
@ -174,7 +176,7 @@ in {
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
config = lib.mkIf (cfg.enable && (!cfg.disableBackend || !cfg.disableProxy)) {
|
config = mkIf (cfg.enable && (!cfg.disableBackend || !cfg.disableProxy)) {
|
||||||
users.users."piped" = {
|
users.users."piped" = {
|
||||||
isSystemUser = true;
|
isSystemUser = true;
|
||||||
group = "piped";
|
group = "piped";
|
||||||
|
|
|
||||||
|
|
@ -1,11 +1,15 @@
|
||||||
{ config, lib, pkgs, ... }:
|
{
|
||||||
with lib;
|
config,
|
||||||
let
|
lib,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
with lib; let
|
||||||
cfg = config.services.piped;
|
cfg = config.services.piped;
|
||||||
frontend-package =
|
frontend-package =
|
||||||
(pkgs.piped-frontend.override { backendDomain = cfg.backendDomain; });
|
pkgs.piped-frontend.override {backendDomain = cfg.backendDomain;};
|
||||||
in {
|
in {
|
||||||
config = lib.mkIf (cfg.enable && !cfg.disableFrontend) {
|
config = mkIf (cfg.enable && !cfg.disableFrontend) {
|
||||||
services.nginx.virtualHosts."${cfg.frontendDomain}" = {
|
services.nginx.virtualHosts."${cfg.frontendDomain}" = {
|
||||||
forceSSL = true;
|
forceSSL = true;
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,10 @@
|
||||||
{ config, lib, pkgs, ... }:
|
{
|
||||||
with lib;
|
config,
|
||||||
let
|
lib,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
with lib; let
|
||||||
cfg = config.services.piped;
|
cfg = config.services.piped;
|
||||||
|
|
||||||
proxy_nginx_extras = ''
|
proxy_nginx_extras = ''
|
||||||
|
|
@ -23,11 +27,11 @@ let
|
||||||
access_log off;
|
access_log off;
|
||||||
'';
|
'';
|
||||||
in {
|
in {
|
||||||
config = lib.mkIf (cfg.enable && !cfg.disableProxy) {
|
config = mkIf (cfg.enable && !cfg.disableProxy) {
|
||||||
systemd.services.piped-proxy = {
|
systemd.services.piped-proxy = {
|
||||||
wantedBy = ["multi-user.target"];
|
wantedBy = ["multi-user.target"];
|
||||||
environment.BIND = "0.0.0.0:${toString cfg.internalProxyPort}";
|
environment.BIND = "0.0.0.0:${toString cfg.internalProxyPort}";
|
||||||
environment.IPV4_ONLY = lib.mkIf cfg.proxyIPv4Only "1";
|
environment.IPV4_ONLY = mkIf cfg.proxyIPv4Only "1";
|
||||||
serviceConfig = {
|
serviceConfig = {
|
||||||
WorkingDirectory = "/run/piped-proxy";
|
WorkingDirectory = "/run/piped-proxy";
|
||||||
ExecStart = "${pkgs.piped-proxy}/bin/piped-proxy";
|
ExecStart = "${pkgs.piped-proxy}/bin/piped-proxy";
|
||||||
|
|
@ -53,13 +57,17 @@ in {
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
locations."/" = {
|
locations."/" = {
|
||||||
proxyPass = "http://localhost:${toString cfg.internalProxyPort}";
|
proxyPass = "http://localhost:${toString cfg.internalProxyPort}";
|
||||||
extraConfig = proxy_nginx_extras + ''
|
extraConfig =
|
||||||
|
proxy_nginx_extras
|
||||||
|
+ ''
|
||||||
add_header Cache-Control "public, max-age=604800";
|
add_header Cache-Control "public, max-age=604800";
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
locations."~ (/videoplayback|/api/v4/|/api/manifest/)" = {
|
locations."~ (/videoplayback|/api/v4/|/api/manifest/)" = {
|
||||||
proxyPass = "http://localhost:${toString cfg.internalProxyPort}";
|
proxyPass = "http://localhost:${toString cfg.internalProxyPort}";
|
||||||
extraConfig = proxy_nginx_extras + ''
|
extraConfig =
|
||||||
|
proxy_nginx_extras
|
||||||
|
+ ''
|
||||||
add_header Cache-Control private always;
|
add_header Cache-Control private always;
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,5 @@
|
||||||
{ config, ... }:
|
{config, ...}: let
|
||||||
let secrets = config.services.secrets.secrets;
|
secrets = config.services.secrets.secrets;
|
||||||
in {
|
in {
|
||||||
services.gitlab_artifacts_sync = {
|
services.gitlab_artifacts_sync = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,5 @@
|
||||||
{ inputs, pkgs, ... }:
|
{...}: let
|
||||||
let ports = (import ../ports.nix { });
|
ports = import ../ports.nix {};
|
||||||
in {
|
in {
|
||||||
services.invidious = {
|
services.invidious = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
|
||||||
|
|
@ -1,10 +0,0 @@
|
||||||
{ ... }: {
|
|
||||||
services.nginx.virtualHosts."lappy-dev.owo.monster" = {
|
|
||||||
forceSSL = true;
|
|
||||||
enableACME = true;
|
|
||||||
locations = {
|
|
||||||
"/".proxyPass =
|
|
||||||
"http://lappy.tailscale-internal.genderfucked.monster:8088";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -1,5 +1,5 @@
|
||||||
{ config, ... }:
|
{config, ...}: let
|
||||||
let secrets = config.services.secrets.secrets;
|
secrets = config.services.secrets.secrets;
|
||||||
in {
|
in {
|
||||||
config.mailserver = {
|
config.mailserver = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
@ -14,6 +14,8 @@ in {
|
||||||
$config['username_domain_forced'] = true;
|
$config['username_domain_forced'] = true;
|
||||||
'';
|
'';
|
||||||
|
|
||||||
|
extra_aliases_file = "/tmp/e";
|
||||||
|
|
||||||
accounts = {
|
accounts = {
|
||||||
"chaos@owo.monster" = {
|
"chaos@owo.monster" = {
|
||||||
name = "chaos@owo.monster";
|
name = "chaos@owo.monster";
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,9 @@
|
||||||
{ pkgs, tree, ... }:
|
{
|
||||||
let
|
pkgs,
|
||||||
ports = (import ../ports.nix { });
|
tree,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
|
ports = import ../ports.nix {};
|
||||||
|
|
||||||
misskeyDomain = "social.owo.monster";
|
misskeyDomain = "social.owo.monster";
|
||||||
|
|
||||||
|
|
@ -41,9 +44,9 @@ let
|
||||||
outgoingAddressFamily = "dual";
|
outgoingAddressFamily = "dual";
|
||||||
};
|
};
|
||||||
|
|
||||||
misskeyConfigFile = builtins.toFile "default.yml"
|
misskeyConfigFile =
|
||||||
|
builtins.toFile "default.yml"
|
||||||
(pkgs.lib.generators.toYAML {} misskeyConfig);
|
(pkgs.lib.generators.toYAML {} misskeyConfig);
|
||||||
|
|
||||||
in {
|
in {
|
||||||
users.users."misskey" = {
|
users.users."misskey" = {
|
||||||
isNormalUser = true;
|
isNormalUser = true;
|
||||||
|
|
@ -104,8 +107,7 @@ in {
|
||||||
User = "misskey";
|
User = "misskey";
|
||||||
WorkingDirectory = "/home/misskey/misskey";
|
WorkingDirectory = "/home/misskey/misskey";
|
||||||
ExecStartPre = "${pkgs.yarn}/bin/yarn migrate";
|
ExecStartPre = "${pkgs.yarn}/bin/yarn migrate";
|
||||||
ExecStart =
|
ExecStart = "${pkgs.nodejs}/bin/node --experimental-json-modules packages/backend/built/index.js";
|
||||||
"${pkgs.nodejs}/bin/node --experimental-json-modules packages/backend/built/index.js";
|
|
||||||
#TimeoutSec = 60;
|
#TimeoutSec = 60;
|
||||||
#StandardOutput = "syslog";
|
#StandardOutput = "syslog";
|
||||||
#StandardError = "syslog";
|
#StandardError = "syslog";
|
||||||
|
|
@ -127,10 +129,12 @@ in {
|
||||||
|
|
||||||
services.postgresql = {
|
services.postgresql = {
|
||||||
enable = true;
|
enable = true;
|
||||||
ensureUsers = [{
|
ensureUsers = [
|
||||||
|
{
|
||||||
name = "misskey";
|
name = "misskey";
|
||||||
ensurePermissions."DATABASE misskey" = "ALL PRIVILEGES";
|
ensurePermissions."DATABASE misskey" = "ALL PRIVILEGES";
|
||||||
}];
|
}
|
||||||
|
];
|
||||||
ensureDatabases = ["misskey"];
|
ensureDatabases = ["misskey"];
|
||||||
initialScript = pkgs.writeText "init" ''
|
initialScript = pkgs.writeText "init" ''
|
||||||
create user misskey with password 'password';
|
create user misskey with password 'password';
|
||||||
|
|
@ -143,4 +147,3 @@ in {
|
||||||
port = ports.misskey-redis;
|
port = ports.misskey-redis;
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -5,6 +5,6 @@
|
||||||
# to broadcast to all speakers over rtp
|
# to broadcast to all speakers over rtp
|
||||||
profiles.sound.pulseaudio.pulse-systemwide
|
profiles.sound.pulseaudio.pulse-systemwide
|
||||||
profiles.sound.pulseaudio.pulse-recv-native-localhost
|
profiles.sound.pulseaudio.pulse-recv-native-localhost
|
||||||
] ++ [ ./hosts/lappy.nix ./hosts/raspberry.nix ];
|
]
|
||||||
|
++ [./hosts/lappy.nix ./hosts/raspberry.nix];
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,4 @@
|
||||||
{ pkgs, ... }:
|
{pkgs, ...}: let
|
||||||
let
|
|
||||||
sink_name = "roc-lappy";
|
sink_name = "roc-lappy";
|
||||||
description = "Lappy ROC Output";
|
description = "Lappy ROC Output";
|
||||||
ip_addr = "100.115.10.34";
|
ip_addr = "100.115.10.34";
|
||||||
|
|
@ -12,4 +11,3 @@ in {
|
||||||
}
|
}
|
||||||
'';
|
'';
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,4 @@
|
||||||
{ pkgs, ... }:
|
{pkgs, ...}: let
|
||||||
let
|
|
||||||
sink_name = "roc-raspberry";
|
sink_name = "roc-raspberry";
|
||||||
description = "Raspberry ROC Output";
|
description = "Raspberry ROC Output";
|
||||||
ip_addr = "100.118.202.64";
|
ip_addr = "100.118.202.64";
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,9 @@
|
||||||
{ config, pkgs, lib, tree, ... }:
|
{
|
||||||
let
|
config,
|
||||||
ports = (import ../ports.nix { });
|
pkgs,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
|
ports = import ../ports.nix {};
|
||||||
secrets = config.services.secrets.secrets;
|
secrets = config.services.secrets.secrets;
|
||||||
in {
|
in {
|
||||||
environment.systemPackages = with pkgs; [mpc_cli];
|
environment.systemPackages = with pkgs; [mpc_cli];
|
||||||
|
|
@ -9,10 +12,12 @@ in {
|
||||||
enable = true;
|
enable = true;
|
||||||
network.listenAddress = "0.0.0.0";
|
network.listenAddress = "0.0.0.0";
|
||||||
musicDirectory = "https://storage-webdav.owo.monster/music_ro/";
|
musicDirectory = "https://storage-webdav.owo.monster/music_ro/";
|
||||||
credentials = [{
|
credentials = [
|
||||||
|
{
|
||||||
passwordFile = "${secrets.mpd_control_password.path}";
|
passwordFile = "${secrets.mpd_control_password.path}";
|
||||||
permissions = ["read" "add" "control" "admin"];
|
permissions = ["read" "add" "control" "admin"];
|
||||||
}];
|
}
|
||||||
|
];
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
host_permissions "127.0.0.1 read,add,control,admin"
|
host_permissions "127.0.0.1 read,add,control,admin"
|
||||||
samplerate_converter "0"
|
samplerate_converter "0"
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,5 @@
|
||||||
{ ... }:
|
{...}: let
|
||||||
let ports = (import ../ports.nix { });
|
ports = import ../ports.nix {};
|
||||||
in {
|
in {
|
||||||
services.piped = {
|
services.piped = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
|
||||||
|
|
@ -1,14 +1,16 @@
|
||||||
_: {
|
{...}: {
|
||||||
services.quassel = {
|
services.quassel = {
|
||||||
enable = true;
|
enable = true;
|
||||||
interfaces = ["0.0.0.0"];
|
interfaces = ["0.0.0.0"];
|
||||||
};
|
};
|
||||||
|
|
||||||
services.postgresql.ensureDatabases = ["quassel"];
|
services.postgresql.ensureDatabases = ["quassel"];
|
||||||
services.postgresql.ensureUsers = [{
|
services.postgresql.ensureUsers = [
|
||||||
|
{
|
||||||
name = "quassel";
|
name = "quassel";
|
||||||
ensurePermissions."DATABASE quassel" = "ALL PRIVILEGES";
|
ensurePermissions."DATABASE quassel" = "ALL PRIVILEGES";
|
||||||
}];
|
}
|
||||||
|
];
|
||||||
services.postgresql.authentication = "host quassel quassel localhost trust";
|
services.postgresql.authentication = "host quassel quassel localhost trust";
|
||||||
networking.firewall.allowedTCPPorts = [4242];
|
networking.firewall.allowedTCPPorts = [4242];
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,9 @@
|
||||||
{ lib, config, pkgs, ... }:
|
{
|
||||||
let
|
lib,
|
||||||
|
config,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
secrets = config.services.secrets.secrets;
|
secrets = config.services.secrets.secrets;
|
||||||
mail_config = config.mailserver;
|
mail_config = config.mailserver;
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,5 @@
|
||||||
{ config, ... }:
|
{config, ...}: let
|
||||||
let secrets = config.services.secrets.secrets;
|
secrets = config.services.secrets.secrets;
|
||||||
in {
|
in {
|
||||||
networking.wg-quick.interfaces = {
|
networking.wg-quick.interfaces = {
|
||||||
wg0 = {
|
wg0 = {
|
||||||
|
|
|
||||||
|
|
@ -2,8 +2,7 @@
|
||||||
services.secrets = {
|
services.secrets = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
||||||
extraPackages = with pkgs;
|
extraPackages = with pkgs; [
|
||||||
[
|
|
||||||
# for music & mail passwd files
|
# for music & mail passwd files
|
||||||
apacheHttpd
|
apacheHttpd
|
||||||
];
|
];
|
||||||
|
|
@ -16,6 +15,13 @@
|
||||||
simple_get "/api-keys/mpd" .password > $secretFile
|
simple_get "/api-keys/mpd" .password > $secretFile
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
private_mail_aliases = {
|
||||||
|
user = "root";
|
||||||
|
group = "root";
|
||||||
|
fetchScript = ''
|
||||||
|
kv_get "/infra/private-mail-aliases" | jq .data.data | jq -r 'to_entries|map("\(.key) \(.value.to)")[]' > $secretFile
|
||||||
|
'';
|
||||||
|
};
|
||||||
music_stream_passwd = {
|
music_stream_passwd = {
|
||||||
user = "nginx";
|
user = "nginx";
|
||||||
group = "nginx";
|
group = "nginx";
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,8 @@
|
||||||
{ pkgs, tree, ... }: {
|
{
|
||||||
|
pkgs,
|
||||||
|
tree,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
users.users.chaos = {
|
users.users.chaos = {
|
||||||
name = "chaos";
|
name = "chaos";
|
||||||
home = "/Users/chaos";
|
home = "/Users/chaos";
|
||||||
|
|
@ -16,5 +20,4 @@
|
||||||
home.apps.mpv
|
home.apps.mpv
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,12 @@
|
||||||
{ config, tree, modulesPath, pkgs, lib, ... }: {
|
{
|
||||||
|
config,
|
||||||
|
tree,
|
||||||
|
modulesPath,
|
||||||
|
pkgs,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
imports = [
|
imports = [
|
||||||
|
|
||||||
# (modulesPath + "/profiles/qemu-guest.nix")
|
# (modulesPath + "/profiles/qemu-guest.nix")
|
||||||
|
|
||||||
(modulesPath + "/installer/cd-dvd/installation-cd-minimal.nix")
|
(modulesPath + "/installer/cd-dvd/installation-cd-minimal.nix")
|
||||||
|
|
|
||||||
|
|
@ -1,10 +1,15 @@
|
||||||
{ self, nixpkgs-unstable, ... }@inputs:
|
{
|
||||||
let
|
self,
|
||||||
|
nixpkgs-unstable,
|
||||||
|
...
|
||||||
|
} @ inputs: let
|
||||||
mkTree = inputs.tree-input.tree;
|
mkTree = inputs.tree-input.tree;
|
||||||
metaTree = mkTree ((import ../treeConfig.nix {}) // {inherit inputs;});
|
metaTree = mkTree ((import ../treeConfig.nix {}) // {inherit inputs;});
|
||||||
tree = metaTree.impure;
|
tree = metaTree.impure;
|
||||||
|
|
||||||
patchedInputs = inputs // {
|
patchedInputs =
|
||||||
|
inputs
|
||||||
|
// {
|
||||||
# set these to the correct versions from inputs
|
# set these to the correct versions from inputs
|
||||||
nixpkgs = inputs.nixpkgs-unstable;
|
nixpkgs = inputs.nixpkgs-unstable;
|
||||||
home-manager = inputs.home-manager-unstable;
|
home-manager = inputs.home-manager-unstable;
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,9 @@
|
||||||
{ lib, pkgs, config, ... }: {
|
{
|
||||||
|
lib,
|
||||||
|
pkgs,
|
||||||
|
config,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
boot.loader.grub.enable = false;
|
boot.loader.grub.enable = false;
|
||||||
boot.loader.generic-extlinux-compatible.enable = true;
|
boot.loader.generic-extlinux-compatible.enable = true;
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,11 @@
|
||||||
{ tree, modulesPath, config, pkgs, lib, ... }:
|
|
||||||
|
|
||||||
{
|
{
|
||||||
|
tree,
|
||||||
|
modulesPath,
|
||||||
|
config,
|
||||||
|
pkgs,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
imports = with tree; [
|
imports = with tree; [
|
||||||
users.root
|
users.root
|
||||||
users.chaos
|
users.chaos
|
||||||
|
|
@ -34,4 +39,3 @@
|
||||||
|
|
||||||
system.stateVersion = "21.11";
|
system.stateVersion = "21.11";
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,8 @@
|
||||||
{ tree, pkgs, ... }: {
|
{
|
||||||
|
tree,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
imports = with tree; [
|
imports = with tree; [
|
||||||
profiles.connectivity.bluetooth
|
profiles.connectivity.bluetooth
|
||||||
profiles.sound.pulseaudio.pulse-bluetooth
|
profiles.sound.pulseaudio.pulse-bluetooth
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,4 @@
|
||||||
{ pkgs, ... }:
|
{pkgs, ...}: let
|
||||||
let
|
|
||||||
mpd-server = "hetzner-vm.tailscale-internal.genderfucked.monster";
|
mpd-server = "hetzner-vm.tailscale-internal.genderfucked.monster";
|
||||||
sync-with-mpd-server = pkgs.writeShellScriptBin "sync-with-mpd-server" ''
|
sync-with-mpd-server = pkgs.writeShellScriptBin "sync-with-mpd-server" ''
|
||||||
#!/usr/bin/env bash
|
#!/usr/bin/env bash
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,6 @@
|
||||||
{ pkgs, ... }:
|
{pkgs, ...}: let
|
||||||
let
|
process-media-controls =
|
||||||
process-media-controls = pkgs.writeText "process-media-controls"
|
pkgs.writeText "process-media-controls"
|
||||||
(builtins.readFile ./process-media-controls.py);
|
(builtins.readFile ./process-media-controls.py);
|
||||||
in {
|
in {
|
||||||
systemd.services.process-media-controls = {
|
systemd.services.process-media-controls = {
|
||||||
|
|
@ -9,7 +9,8 @@ in {
|
||||||
wantedBy = ["multi-user.target"];
|
wantedBy = ["multi-user.target"];
|
||||||
path = [pkgs.pulseaudio];
|
path = [pkgs.pulseaudio];
|
||||||
script = let
|
script = let
|
||||||
python = pkgs.python39.withPackages
|
python =
|
||||||
|
pkgs.python39.withPackages
|
||||||
(ps: with ps; [pkgs.python39Packages.evdev]);
|
(ps: with ps; [pkgs.python39Packages.evdev]);
|
||||||
in ''
|
in ''
|
||||||
export PULSE_SERVER=127.0.0.1
|
export PULSE_SERVER=127.0.0.1
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,8 @@
|
||||||
{ lib, tree, ... }:
|
{
|
||||||
let
|
lib,
|
||||||
|
tree,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
externalInterface = "eth0";
|
externalInterface = "eth0";
|
||||||
wifiInterface = "wlan0";
|
wifiInterface = "wlan0";
|
||||||
ssid = "Test Wifi";
|
ssid = "Test Wifi";
|
||||||
|
|
@ -7,8 +10,7 @@ let
|
||||||
in {
|
in {
|
||||||
imports = with tree; [profiles.dnscrypt];
|
imports = with tree; [profiles.dnscrypt];
|
||||||
|
|
||||||
services.dnscrypt-proxy2.settings."listen_addresses" =
|
services.dnscrypt-proxy2.settings."listen_addresses" = ["0.0.0.0:53" "[::]:53"];
|
||||||
[ "0.0.0.0:53" "[::]:53" ];
|
|
||||||
|
|
||||||
services.hostapd = {
|
services.hostapd = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,11 @@
|
||||||
{ tree, modulesPath, config, pkgs, lib, ... }:
|
|
||||||
|
|
||||||
{
|
{
|
||||||
|
tree,
|
||||||
|
modulesPath,
|
||||||
|
config,
|
||||||
|
pkgs,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
imports = with tree; [
|
imports = with tree; [
|
||||||
users.root
|
users.root
|
||||||
users.chaos
|
users.chaos
|
||||||
|
|
@ -47,4 +52,3 @@
|
||||||
|
|
||||||
system.stateVersion = "21.11";
|
system.stateVersion = "21.11";
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,7 +1,6 @@
|
||||||
{ config, ... }:
|
{config, ...}: let
|
||||||
let
|
|
||||||
secrets = config.services.secrets.secrets;
|
secrets = config.services.secrets.secrets;
|
||||||
ports = (import ../ports.nix { });
|
ports = import ../ports.nix {};
|
||||||
in {
|
in {
|
||||||
systemd.tmpfiles.rules = [
|
systemd.tmpfiles.rules = [
|
||||||
"d /caches - storage storage"
|
"d /caches - storage storage"
|
||||||
|
|
@ -122,12 +121,9 @@ in {
|
||||||
forceSSL = true;
|
forceSSL = true;
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
locations = {
|
locations = {
|
||||||
"/main/".proxyPass =
|
"/main/".proxyPass = "http://localhost:${toString ports.rclone_serve_webdav_main}";
|
||||||
"http://localhost:${toString ports.rclone_serve_webdav_main}";
|
"/media/".proxyPass = "http://localhost:${toString ports.rclone_serve_webdav_media}";
|
||||||
"/media/".proxyPass =
|
"/music_ro/".proxyPass = "http://localhost:${toString ports.rclone_serve_webdav_music_ro}";
|
||||||
"http://localhost:${toString ports.rclone_serve_webdav_media}";
|
|
||||||
"/music_ro/".proxyPass =
|
|
||||||
"http://localhost:${toString ports.rclone_serve_webdav_music_ro}";
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
@ -135,10 +131,8 @@ in {
|
||||||
forceSSL = true;
|
forceSSL = true;
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
locations = {
|
locations = {
|
||||||
"/Music/".proxyPass =
|
"/Music/".proxyPass = "http://localhost:${toString ports.rclone_serve_http_music}";
|
||||||
"http://localhost:${toString ports.rclone_serve_http_music}";
|
"/Public/".proxyPass = "http://localhost:${toString ports.rclone_serve_http_public}";
|
||||||
"/Public/".proxyPass =
|
|
||||||
"http://localhost:${toString ports.rclone_serve_http_public}";
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
@ -146,12 +140,9 @@ in {
|
||||||
forceSSL = true;
|
forceSSL = true;
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
locations = {
|
locations = {
|
||||||
"/HetznerVM/".proxyPass =
|
"/HetznerVM/".proxyPass = "http://localhost:${toString ports.rclone_serve_restic_hvm}";
|
||||||
"http://localhost:${toString ports.rclone_serve_restic_hvm}";
|
"/Music/".proxyPass = "http://localhost:${toString ports.rclone_serve_restic_music}";
|
||||||
"/Music/".proxyPass =
|
"/Vault/".proxyPass = "http://localhost:${toString ports.rclone_serve_restic_vault}";
|
||||||
"http://localhost:${toString ports.rclone_serve_restic_music}";
|
|
||||||
"/Vault/".proxyPass =
|
|
||||||
"http://localhost:${toString ports.rclone_serve_restic_vault}";
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,9 @@
|
||||||
{ config, lib, ... }:
|
{
|
||||||
let secrets = config.services.secrets.secrets;
|
config,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
|
secrets = config.services.secrets.secrets;
|
||||||
in {
|
in {
|
||||||
services.rclone-sync = let
|
services.rclone-sync = let
|
||||||
sync_defaults = {
|
sync_defaults = {
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,5 @@
|
||||||
{ config, ... }:
|
{config, ...}: let
|
||||||
let secrets = config.services.secrets.secrets;
|
secrets = config.services.secrets.secrets;
|
||||||
in {
|
in {
|
||||||
networking.wg-quick.interfaces = {
|
networking.wg-quick.interfaces = {
|
||||||
wg0 = {
|
wg0 = {
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,4 @@
|
||||||
{pkgs, ...}: {
|
{pkgs, ...}: {
|
||||||
|
|
||||||
services.secrets = {
|
services.secrets = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,8 +1,13 @@
|
||||||
{ modulesPath, tree, config, pkgs, lib, ... }:
|
{
|
||||||
let
|
modulesPath,
|
||||||
|
tree,
|
||||||
|
config,
|
||||||
|
pkgs,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
secrets = config.services.secrets.secrets;
|
secrets = config.services.secrets.secrets;
|
||||||
ports = (import ./ports.nix { });
|
ports = import ./ports.nix {};
|
||||||
|
|
||||||
in {
|
in {
|
||||||
imports = with tree; [
|
imports = with tree; [
|
||||||
users.root
|
users.root
|
||||||
|
|
@ -85,4 +90,3 @@ in {
|
||||||
|
|
||||||
system.stateVersion = "22.05";
|
system.stateVersion = "22.05";
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,4 @@
|
||||||
{ tree, ... }:
|
{tree, ...}: let
|
||||||
let
|
|
||||||
usb_data = import ../../data/usb_data.nix {};
|
usb_data = import ../../data/usb_data.nix {};
|
||||||
drive_data = import ../../data/normal_drive_data.nix {};
|
drive_data = import ../../data/normal_drive_data.nix {};
|
||||||
in {
|
in {
|
||||||
|
|
@ -8,7 +7,8 @@ in {
|
||||||
systemd-boot.enable = true;
|
systemd-boot.enable = true;
|
||||||
efi.canTouchEfiVariables = true;
|
efi.canTouchEfiVariables = true;
|
||||||
};
|
};
|
||||||
initrd.availableKernelModules = [ # defaults from nixos-generate-config
|
initrd.availableKernelModules = [
|
||||||
|
# defaults from nixos-generate-config
|
||||||
"xhci_pci"
|
"xhci_pci"
|
||||||
"nvme"
|
"nvme"
|
||||||
"usbhid"
|
"usbhid"
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,9 @@
|
||||||
{ config, pkgs, ... }:
|
{
|
||||||
let secrets = config.services.secrets.secrets;
|
config,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
|
secrets = config.services.secrets.secrets;
|
||||||
in {
|
in {
|
||||||
environment.systemPackages = with pkgs; [wireguard-tools];
|
environment.systemPackages = with pkgs; [wireguard-tools];
|
||||||
networking.wg-quick.interfaces = {
|
networking.wg-quick.interfaces = {
|
||||||
|
|
@ -10,13 +14,15 @@ in {
|
||||||
mtu = 1280;
|
mtu = 1280;
|
||||||
privateKeyFile = "${secrets.wg_harry_priv.path}";
|
privateKeyFile = "${secrets.wg_harry_priv.path}";
|
||||||
|
|
||||||
peers = [{
|
peers = [
|
||||||
|
{
|
||||||
publicKey = "7B6KSFqTHM7A7Nv24GIeUhDDh2XnlT7UqG5U+Si+zmc=";
|
publicKey = "7B6KSFqTHM7A7Nv24GIeUhDDh2XnlT7UqG5U+Si+zmc=";
|
||||||
presharedKeyFile = "${secrets.wg_harry_preshared.path}";
|
presharedKeyFile = "${secrets.wg_harry_preshared.path}";
|
||||||
allowedIPs = ["0.0.0.0/0" "::/0"];
|
allowedIPs = ["0.0.0.0/0" "::/0"];
|
||||||
endpoint = "185.186.9.1:8081";
|
endpoint = "185.186.9.1:8081";
|
||||||
persistentKeepalive = 25;
|
persistentKeepalive = 25;
|
||||||
}];
|
}
|
||||||
|
];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,12 +1,13 @@
|
||||||
{pkgs, ...}: {
|
{pkgs, ...}: {
|
||||||
services.postgresql = {
|
services.postgresql = {
|
||||||
enable = true;
|
enable = true;
|
||||||
ensureUsers = [{
|
ensureUsers = [
|
||||||
|
{
|
||||||
name = "misskey";
|
name = "misskey";
|
||||||
ensurePermissions."DATABASE misskey" = "ALL PRIVILEGES";
|
ensurePermissions."DATABASE misskey" = "ALL PRIVILEGES";
|
||||||
}];
|
}
|
||||||
|
];
|
||||||
ensureDatabases = ["misskey"];
|
ensureDatabases = ["misskey"];
|
||||||
|
|
||||||
};
|
};
|
||||||
services.redis.servers."misskey" = {
|
services.redis.servers."misskey" = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
|
||||||
|
|
@ -1,7 +1,6 @@
|
||||||
{ config, ... }:
|
{config, ...}: let
|
||||||
let secrets = config.services.secrets.secrets;
|
secrets = config.services.secrets.secrets;
|
||||||
in {
|
in {
|
||||||
|
|
||||||
networking.firewall.trustedInterfaces = ["wg0"];
|
networking.firewall.trustedInterfaces = ["wg0"];
|
||||||
networking.wg-quick.interfaces = {
|
networking.wg-quick.interfaces = {
|
||||||
wg0 = {
|
wg0 = {
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,10 @@
|
||||||
{ tree, config, pkgs, lib, ... }: {
|
{
|
||||||
|
tree,
|
||||||
|
config,
|
||||||
|
pkgs,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
imports = with tree; [
|
imports = with tree; [
|
||||||
users.root
|
users.root
|
||||||
users.chaos
|
users.chaos
|
||||||
|
|
@ -9,6 +15,10 @@
|
||||||
presets.nixos.laptop
|
presets.nixos.laptop
|
||||||
presets.nixos.encrypted-usb
|
presets.nixos.encrypted-usb
|
||||||
|
|
||||||
|
hosts.tablet.profiles.wireguard
|
||||||
|
hosts.tablet.profiles.harry-vpn
|
||||||
|
hosts.tablet.profiles.misskey-dev
|
||||||
|
|
||||||
./secrets.nix
|
./secrets.nix
|
||||||
./profiles/wireguard.nix
|
./profiles/wireguard.nix
|
||||||
./profiles/harry-vpn.nix
|
./profiles/harry-vpn.nix
|
||||||
|
|
@ -36,7 +46,8 @@
|
||||||
networking.firewall.enable = true;
|
networking.firewall.enable = true;
|
||||||
networking.firewall.allowPing = true;
|
networking.firewall.allowPing = true;
|
||||||
|
|
||||||
nix.buildMachines = [{
|
nix.buildMachines = [
|
||||||
|
{
|
||||||
hostName = "buildbox.servers.genderfucked.monster";
|
hostName = "buildbox.servers.genderfucked.monster";
|
||||||
system = "x86_64-linux";
|
system = "x86_64-linux";
|
||||||
# if the builder supports building for multiple architectures,
|
# if the builder supports building for multiple architectures,
|
||||||
|
|
@ -44,13 +55,13 @@
|
||||||
# systems = ["x86_64-linux" "aarch64-linux"];
|
# systems = ["x86_64-linux" "aarch64-linux"];
|
||||||
sshUser = "root";
|
sshUser = "root";
|
||||||
sshKey = "/usb/ssh-keys/chaos.priv";
|
sshKey = "/usb/ssh-keys/chaos.priv";
|
||||||
publicHostKey =
|
publicHostKey = "c3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSUpXZGI5SVl3dFBSRm9rK2JTWUpmSnlRTlJSSithVEtIT3VOTkNLY2FMUHggcm9vdEBuaXhvcwo=";
|
||||||
"c3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSUpXZGI5SVl3dFBSRm9rK2JTWUpmSnlRTlJSSithVEtIT3VOTkNLY2FMUHggcm9vdEBuaXhvcwo=";
|
|
||||||
maxJobs = 16;
|
maxJobs = 16;
|
||||||
speedFactor = 4;
|
speedFactor = 4;
|
||||||
supportedFeatures = ["nixos-test" "benchmark" "big-parallel" "kvm"];
|
supportedFeatures = ["nixos-test" "benchmark" "big-parallel" "kvm"];
|
||||||
mandatoryFeatures = [];
|
mandatoryFeatures = [];
|
||||||
}];
|
}
|
||||||
|
];
|
||||||
nix.distributedBuilds = true; # true;
|
nix.distributedBuilds = true; # true;
|
||||||
nix.extraOptions = "builders-use-substitutes = true";
|
nix.extraOptions = "builders-use-substitutes = true";
|
||||||
|
|
||||||
|
|
@ -94,4 +105,3 @@
|
||||||
|
|
||||||
system.stateVersion = "22.05";
|
system.stateVersion = "22.05";
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
||||||
29
hosts/vault/profiles/restic.nix
Normal file
29
hosts/vault/profiles/restic.nix
Normal file
|
|
@ -0,0 +1,29 @@
|
||||||
|
{
|
||||||
|
pkgs,
|
||||||
|
config,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
|
secrets = config.services.secrets.secrets;
|
||||||
|
in {
|
||||||
|
services.restic.backups.vault = {
|
||||||
|
user = "root";
|
||||||
|
paths = ["/var/lib/vault" "/var/lib/acme"];
|
||||||
|
timerConfig = {
|
||||||
|
OnBootSec = "1m";
|
||||||
|
OnCalendar = "daily";
|
||||||
|
};
|
||||||
|
# env contains fixed repository with auth
|
||||||
|
repository = "rest:https://storage-restic.owo.monster/HetznerVM";
|
||||||
|
passwordFile = "${secrets.restic_password.path}";
|
||||||
|
environmentFile = "${secrets.restic_env.path}";
|
||||||
|
};
|
||||||
|
|
||||||
|
environment.systemPackages = [
|
||||||
|
(pkgs.writeShellScriptBin "restic-vault" ''
|
||||||
|
env \
|
||||||
|
RESTIC_PASSWORD_FILE=${secrets.restic_password.path} \
|
||||||
|
$(cat ${secrets.restic_env.path}) \
|
||||||
|
${pkgs.restic}/bin/restic $@
|
||||||
|
'')
|
||||||
|
];
|
||||||
|
}
|
||||||
19
hosts/vault/profiles/vault.nix
Normal file
19
hosts/vault/profiles/vault.nix
Normal file
|
|
@ -0,0 +1,19 @@
|
||||||
|
{pkgs, ...}: {
|
||||||
|
services.vault = {
|
||||||
|
enable = true;
|
||||||
|
package = pkgs.vault-bin;
|
||||||
|
address = "127.0.0.1:8200";
|
||||||
|
storageBackend = "file";
|
||||||
|
extraConfig = ''
|
||||||
|
ui = true
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
networking.firewall.allowedTCPPorts = [80 443];
|
||||||
|
|
||||||
|
services.nginx.virtualHosts."vault.owo.monster" = {
|
||||||
|
forceSSL = true;
|
||||||
|
enableACME = true;
|
||||||
|
locations = {"/" = {proxyPass = "http://127.0.0.1:8200";};};
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
@ -1,17 +1,17 @@
|
||||||
{ ... }:
|
{config, ...}: let
|
||||||
let secrets-db = (import ../secrets-db.nix { });
|
secrets = config.services.secrets.secrets;
|
||||||
in {
|
in {
|
||||||
networking.wg-quick.interfaces = {
|
networking.wg-quick.interfaces = {
|
||||||
wg0 = {
|
wg0 = {
|
||||||
address = ["10.69.42.3/32"];
|
address = ["10.69.42.3/32"];
|
||||||
listenPort = 51820;
|
listenPort = 51820;
|
||||||
privateKeyFile = "${secrets-db.wg_priv.path}";
|
privateKeyFile = "${secrets.wg_priv.path}";
|
||||||
|
|
||||||
peers = [
|
peers = [
|
||||||
# hetzner-vm
|
# hetzner-vm
|
||||||
{
|
{
|
||||||
publicKey = "UJr+EmUM7KWkIy0nk0JA38ibvcLC++6iuOKkHdrx9Dc=";
|
publicKey = "UJr+EmUM7KWkIy0nk0JA38ibvcLC++6iuOKkHdrx9Dc=";
|
||||||
presharedKeyFile = "${secrets-db.wg_preshared_hetzner-vm.path}";
|
presharedKeyFile = "${secrets.wg_preshared_hetzner-vm.path}";
|
||||||
allowedIPs = ["10.69.42.1/32"];
|
allowedIPs = ["10.69.42.1/32"];
|
||||||
endpoint = "hetzner-vm.servers.genderfucked.monster:51820";
|
endpoint = "hetzner-vm.servers.genderfucked.monster:51820";
|
||||||
persistentKeepalive = 25;
|
persistentKeepalive = 25;
|
||||||
|
|
@ -19,20 +19,20 @@ in {
|
||||||
# tablet
|
# tablet
|
||||||
{
|
{
|
||||||
publicKey = "jXA0DeprEaL/ARQ3K81l8xWuUI5C/90DcY3bIfcIjz8=";
|
publicKey = "jXA0DeprEaL/ARQ3K81l8xWuUI5C/90DcY3bIfcIjz8=";
|
||||||
presharedKeyFile = "${secrets-db.wg_preshared_tablet.path}";
|
presharedKeyFile = "${secrets.wg_preshared_tablet.path}";
|
||||||
allowedIPs = ["10.69.42.2/32"];
|
allowedIPs = ["10.69.42.2/32"];
|
||||||
}
|
}
|
||||||
# storage
|
# storage
|
||||||
{
|
{
|
||||||
publicKey = "biNNeCkjAWi2jUVoL5+1pBtXGa3OFZi4DltB2dqGjGg=";
|
publicKey = "biNNeCkjAWi2jUVoL5+1pBtXGa3OFZi4DltB2dqGjGg=";
|
||||||
presharedKeyFile = "${secrets-db.wg_preshared_storage.path}";
|
presharedKeyFile = "${secrets.wg_preshared_storage.path}";
|
||||||
endpoint = "storage.servers.genderfucked.monster:51820";
|
endpoint = "storage.servers.genderfucked.monster:51820";
|
||||||
allowedIPs = ["10.69.42.4/32"];
|
allowedIPs = ["10.69.42.4/32"];
|
||||||
}
|
}
|
||||||
# iphone8
|
# iphone8
|
||||||
{
|
{
|
||||||
publicKey = "2BgT08bDKh8WlFFSeRArI9a1GpFgUyqEApvJy4KgAmw=";
|
publicKey = "2BgT08bDKh8WlFFSeRArI9a1GpFgUyqEApvJy4KgAmw=";
|
||||||
presharedKeyFile = "${secrets-db.wg_preshared_iphone8.path}";
|
presharedKeyFile = "${secrets.wg_preshared_iphone8.path}";
|
||||||
allowedIPs = ["10.69.42.5/32"];
|
allowedIPs = ["10.69.42.5/32"];
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
|
|
|
||||||
|
|
@ -1,44 +0,0 @@
|
||||||
{ }: {
|
|
||||||
restic_password = {
|
|
||||||
user = "root";
|
|
||||||
group = "root";
|
|
||||||
permissions = "660";
|
|
||||||
path = "/secrets/restic_password";
|
|
||||||
};
|
|
||||||
restic_env = {
|
|
||||||
user = "root";
|
|
||||||
group = "root";
|
|
||||||
permissions = "660";
|
|
||||||
path = "/secrets/restic_env";
|
|
||||||
};
|
|
||||||
wg_priv = {
|
|
||||||
user = "root";
|
|
||||||
group = "root";
|
|
||||||
permissions = "660";
|
|
||||||
path = "/secrets/wg_priv";
|
|
||||||
};
|
|
||||||
wg_preshared_hetzner-vm = {
|
|
||||||
user = "root";
|
|
||||||
group = "root";
|
|
||||||
permissions = "660";
|
|
||||||
path = "/secrets/wg_preshared_hetzner-vm";
|
|
||||||
};
|
|
||||||
wg_preshared_tablet = {
|
|
||||||
user = "root";
|
|
||||||
group = "root";
|
|
||||||
permissions = "660";
|
|
||||||
path = "/secrets/wg_preshared_tablet";
|
|
||||||
};
|
|
||||||
wg_preshared_storage = {
|
|
||||||
user = "root";
|
|
||||||
group = "root";
|
|
||||||
permissions = "660";
|
|
||||||
path = "/secrets/wg_preshared_storage";
|
|
||||||
};
|
|
||||||
wg_preshared_iphone8 = {
|
|
||||||
user = "root";
|
|
||||||
group = "root";
|
|
||||||
permissions = "660";
|
|
||||||
path = "/secrets/wg_preshared_iphone8";
|
|
||||||
};
|
|
||||||
}
|
|
||||||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Reference in a new issue