tidy files, switch to alejandra for formatting, add private aliases to mailserver
This commit is contained in:
Chaos
parent
e2a2608a2b
commit
6f5832750a
|
|
@ -1,4 +1,4 @@
|
||||||
{ }: rec {
|
{}: rec {
|
||||||
# Mountpoints
|
# Mountpoints
|
||||||
root_mountpoint = "/";
|
root_mountpoint = "/";
|
||||||
boot_mountpoint = "/boot";
|
boot_mountpoint = "/boot";
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
{ ... }: rec {
|
{}: rec {
|
||||||
# Mountpoints
|
# Mountpoints
|
||||||
mountpoint = "/usb";
|
mountpoint = "/usb";
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,9 @@
|
||||||
{ nixosConfigurations, deploy-rs, ... }:
|
{
|
||||||
let activateNixOS_x64_64-linux = deploy-rs.lib.x86_64-linux.activate.nixos;
|
nixosConfigurations,
|
||||||
|
deploy-rs,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
|
activateNixOS_x64_64-linux = deploy-rs.lib.x86_64-linux.activate.nixos;
|
||||||
in {
|
in {
|
||||||
tablet = {
|
tablet = {
|
||||||
hostname = "tablet.internal.genderfucked.monster";
|
hostname = "tablet.internal.genderfucked.monster";
|
||||||
|
|
|
||||||
|
|
@ -1,31 +1,33 @@
|
||||||
{ stdenv, bash, parted, cryptsetup, e2fsprogs }:
|
{
|
||||||
let usb_data = import ../hosts/lappy/hardware/usb_data.nix { };
|
stdenv,
|
||||||
in stdenv.mkDerivation {
|
bash,
|
||||||
name = "mk-enc-usb";
|
parted,
|
||||||
src = ./mk-enc-usb.sh;
|
cryptsetup,
|
||||||
unpackPhase = ''
|
e2fsprogs,
|
||||||
for srcFile in $src; do
|
}: let
|
||||||
cp $srcFile $(stripHash $srcFile)
|
usb_data = import ../hosts/lappy/hardware/usb_data.nix {};
|
||||||
done
|
in
|
||||||
'';
|
stdenv.mkDerivation {
|
||||||
|
name = "mk-enc-usb";
|
||||||
|
src = ./mk-enc-usb.sh;
|
||||||
|
unpackPhase = ''
|
||||||
|
for srcFile in $src; do
|
||||||
|
cp $srcFile $(stripHash $srcFile)
|
||||||
|
done
|
||||||
|
'';
|
||||||
|
|
||||||
inherit bash;
|
inherit bash parted cryptsetup e2fsprogs;
|
||||||
inherit parted;
|
|
||||||
inherit cryptsetup;
|
|
||||||
inherit e2fsprogs;
|
|
||||||
|
|
||||||
patchPhase = ''
|
patchPhase = ''
|
||||||
substituteAllInPlace mk-enc-usb.sh
|
substituteAllInPlace mk-enc-usb.sh
|
||||||
substituteInPlace mk-enc-usb.sh \
|
substituteInPlace mk-enc-usb.sh \
|
||||||
--replace "@TEST@" "nyaaaaa" \
|
--replace "@USB_ENCRYPTED_PARTLABEL@" "${usb_data.encrypted_partlabel}" \
|
||||||
--replace "@USB_ENCRYPTED_PARTLABEL@" "${usb_data.encrypted_partlabel}" \
|
--replace "@USB_UNENCRYPTED_LABEL@" "${usb_data.unencrypted_label}"
|
||||||
--replace "@USB_UNENCRYPTED_LABEL@" "${usb_data.unencrypted_label}"
|
'';
|
||||||
|
|
||||||
'';
|
installPhase = ''
|
||||||
|
mkdir -p $out/bin
|
||||||
installPhase = ''
|
cp mk-enc-usb.sh $out/bin/mk-enc-usb
|
||||||
mkdir -p $out/bin
|
chmod +x $out/bin/mk-enc-usb
|
||||||
cp mk-enc-usb.sh $out/bin/mk-enc-usb
|
'';
|
||||||
chmod +x $out/bin/mk-enc-usb
|
}
|
||||||
'';
|
|
||||||
}
|
|
||||||
|
|
|
||||||
|
|
@ -1,31 +1,35 @@
|
||||||
{ stdenv, bash, parted, cryptsetup, e2fsprogs, dosfstools }:
|
{
|
||||||
let ssd_data = import ../hosts/normal-enc/hardware/ssd_data.nix { };
|
stdenv,
|
||||||
in stdenv.mkDerivation {
|
bash,
|
||||||
name = "mk-normal-enc-ssd";
|
parted,
|
||||||
src = ./mk-normal-enc-ssd.sh;
|
cryptsetup,
|
||||||
unpackPhase = ''
|
e2fsprogs,
|
||||||
for srcFile in $src; do
|
dosfstools,
|
||||||
cp $srcFile $(stripHash $srcFile)
|
}: let
|
||||||
done
|
ssd_data = import ../hosts/normal-enc/hardware/ssd_data.nix {};
|
||||||
'';
|
in
|
||||||
|
stdenv.mkDerivation {
|
||||||
|
name = "mk-normal-enc-ssd";
|
||||||
|
src = ./mk-normal-enc-ssd.sh;
|
||||||
|
unpackPhase = ''
|
||||||
|
for srcFile in $src; do
|
||||||
|
cp $srcFile $(stripHash $srcFile)
|
||||||
|
done
|
||||||
|
'';
|
||||||
|
|
||||||
inherit bash;
|
inherit bash parted cryptsetup e2fsprogs dosfstools;
|
||||||
inherit parted;
|
|
||||||
inherit cryptsetup;
|
|
||||||
inherit e2fsprogs;
|
|
||||||
inherit dosfstools;
|
|
||||||
|
|
||||||
patchPhase = ''
|
patchPhase = ''
|
||||||
substituteAllInPlace mk-normal-enc-ssd.sh
|
substituteAllInPlace mk-normal-enc-ssd.sh
|
||||||
substituteInPlace mk-normal-enc-ssd.sh \
|
substituteInPlace mk-normal-enc-ssd.sh \
|
||||||
--replace "@SSD_ENCRYPTED_PARTLABEL@" "${ssd_data.encrypted_root_partlabel}" \
|
--replace "@SSD_ENCRYPTED_PARTLABEL@" "${ssd_data.encrypted_root_partlabel}" \
|
||||||
--replace "@SSD_UNENCRYPTED_LABEL@" "${ssd_data.unencrypted_root_label}" \
|
--replace "@SSD_UNENCRYPTED_LABEL@" "${ssd_data.unencrypted_root_label}" \
|
||||||
--replace "@SSD_BOOT_LABEL@" "${ssd_data.boot_label}"
|
--replace "@SSD_BOOT_LABEL@" "${ssd_data.boot_label}"
|
||||||
'';
|
'';
|
||||||
|
|
||||||
installPhase = ''
|
installPhase = ''
|
||||||
mkdir -p $out/bin
|
mkdir -p $out/bin
|
||||||
cp mk-normal-enc-ssd.sh $out/bin/mk-normal-enc-ssd
|
cp mk-normal-enc-ssd.sh $out/bin/mk-normal-enc-ssd
|
||||||
chmod +x $out/bin/mk-normal-enc-ssd
|
chmod +x $out/bin/mk-normal-enc-ssd
|
||||||
'';
|
'';
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,11 @@
|
||||||
{ lib, pkgs, nixpkgs, config, tree, ... }:
|
{
|
||||||
let
|
lib,
|
||||||
|
pkgs,
|
||||||
|
nixpkgs,
|
||||||
|
config,
|
||||||
|
tree,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
wifiInterface = "shenanigans0";
|
wifiInterface = "shenanigans0";
|
||||||
wifiMac = "00:0F:55:A8:2B:8E";
|
wifiMac = "00:0F:55:A8:2B:8E";
|
||||||
|
|
||||||
|
|
@ -9,7 +15,7 @@ let
|
||||||
ssid = "Shenanigans";
|
ssid = "Shenanigans";
|
||||||
password = "password123";
|
password = "password123";
|
||||||
in {
|
in {
|
||||||
boot.extraModulePackages = with config.boot.kernelPackages; [ rtl8812au ];
|
boot.extraModulePackages = with config.boot.kernelPackages; [rtl8812au];
|
||||||
nixpkgs.config.allowBroken = true;
|
nixpkgs.config.allowBroken = true;
|
||||||
|
|
||||||
services.udev.extraRules = ''
|
services.udev.extraRules = ''
|
||||||
|
|
@ -21,15 +27,19 @@ in {
|
||||||
}", NAME="${usbethInterface}"
|
}", NAME="${usbethInterface}"
|
||||||
'';
|
'';
|
||||||
|
|
||||||
networking.interfaces."${wifiInterface}".ipv4.addresses = [{
|
networking.interfaces."${wifiInterface}".ipv4.addresses = [
|
||||||
address = "192.168.2.1";
|
{
|
||||||
prefixLength = 24;
|
address = "192.168.2.1";
|
||||||
}];
|
prefixLength = 24;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
|
||||||
networking.interfaces."${usbethInterface}".ipv4.addresses = [{
|
networking.interfaces."${usbethInterface}".ipv4.addresses = [
|
||||||
address = "192.168.2.1";
|
{
|
||||||
prefixLength = 24;
|
address = "192.168.2.1";
|
||||||
}];
|
prefixLength = 24;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
|
||||||
networking.networkmanager.unmanaged = [
|
networking.networkmanager.unmanaged = [
|
||||||
# Wifi
|
# Wifi
|
||||||
|
|
@ -39,11 +49,12 @@ in {
|
||||||
"mac:${usbethMac}"
|
"mac:${usbethMac}"
|
||||||
];
|
];
|
||||||
|
|
||||||
systemd.services.wifi-relay = let inherit (pkgs) iptables gnugrep;
|
systemd.services.wifi-relay = let
|
||||||
|
inherit (pkgs) iptables gnugrep;
|
||||||
in {
|
in {
|
||||||
description = "iptables rules for wifi-relay";
|
description = "iptables rules for wifi-relay";
|
||||||
after = [ "dhcpd4.service" ];
|
after = ["dhcpd4.service"];
|
||||||
wantedBy = [ "multi-user.target" ];
|
wantedBy = ["multi-user.target"];
|
||||||
script = ''
|
script = ''
|
||||||
${iptables}/bin/iptables -w -t nat -I POSTROUTING -s 192.168.2.0/24 ! -o ${wifiInterface} -j MASQUERADE
|
${iptables}/bin/iptables -w -t nat -I POSTROUTING -s 192.168.2.0/24 ! -o ${wifiInterface} -j MASQUERADE
|
||||||
${iptables}/bin/iptables -w -I FORWARD -i ${wifiInterface} -s 192.168.2.0/24 -j ACCEPT
|
${iptables}/bin/iptables -w -I FORWARD -i ${wifiInterface} -s 192.168.2.0/24 -j ACCEPT
|
||||||
|
|
@ -55,13 +66,13 @@ in {
|
||||||
};
|
};
|
||||||
|
|
||||||
networking.firewall = {
|
networking.firewall = {
|
||||||
trustedInterfaces = [ wifiInterface usbethInterface ];
|
trustedInterfaces = [wifiInterface usbethInterface];
|
||||||
checkReversePath = lib.mkForce false;
|
checkReversePath = lib.mkForce false;
|
||||||
allowedTCPPorts = [ 53 80 443 ];
|
allowedTCPPorts = [53 80 443];
|
||||||
};
|
};
|
||||||
|
|
||||||
boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
|
boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
|
||||||
networking.firewall.allowedUDPPorts = [ 53 67 ];
|
networking.firewall.allowedUDPPorts = [53 67];
|
||||||
|
|
||||||
services.hostapd = {
|
services.hostapd = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
@ -72,7 +83,7 @@ in {
|
||||||
|
|
||||||
services.dhcpd4 = {
|
services.dhcpd4 = {
|
||||||
enable = true;
|
enable = true;
|
||||||
interfaces = [ "${usbethInterface}" ];
|
interfaces = ["${usbethInterface}"];
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
subnet 192.168.2.0 netmask 255.255.255.0 {
|
subnet 192.168.2.0 netmask 255.255.255.0 {
|
||||||
range 192.168.2.100 192.168.2.200;
|
range 192.168.2.100 192.168.2.200;
|
||||||
|
|
|
||||||
18
flake.lock
18
flake.lock
|
|
@ -138,11 +138,11 @@
|
||||||
"utils": "utils_4"
|
"utils": "utils_4"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1670058827,
|
"lastModified": 1670157315,
|
||||||
"narHash": "sha256-T+yyncPpZWeIkFrG/Cgj21iopULY3BZGWIhcT5ZmCgM=",
|
"narHash": "sha256-GMeuuDKTaqnYFGQA3ZqlLoeeWi30RdJZV+ukOnTCu+w=",
|
||||||
"owner": "nix-community",
|
"owner": "nix-community",
|
||||||
"repo": "home-manager",
|
"repo": "home-manager",
|
||||||
"rev": "eb3598cf44aa10f2a16fe38488a102c0f474d766",
|
"rev": "17bbfcb82458ac2270dec71ce1f7044deb4f1ca3",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
|
@ -191,11 +191,11 @@
|
||||||
},
|
},
|
||||||
"nixpkgs-unstable": {
|
"nixpkgs-unstable": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1669791787,
|
"lastModified": 1670064435,
|
||||||
"narHash": "sha256-KBfoA2fOI5+wCrm7PR+j7jHqXeTkVRPQ0m5fcKchyuU=",
|
"narHash": "sha256-+ELoY30UN+Pl3Yn7RWRPabykwebsVK/kYE9JsIsUMxQ=",
|
||||||
"owner": "nixos",
|
"owner": "nixos",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"rev": "e76c78d20685a043d23f5f9e0ccd2203997f1fb1",
|
"rev": "61a8a98e6d557e6dd7ed0cdb54c3a3e3bbc5e25c",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
|
@ -240,11 +240,11 @@
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1669922720,
|
"lastModified": 1670085069,
|
||||||
"narHash": "sha256-xzoKL4RtKRECdrWHAM14OBaNdJRToc+AA9zmUWuo5eY=",
|
"narHash": "sha256-IO9HcAjncPp/0sUGcCUWVwa0XoBVFQKx+oY+8EBRcTc=",
|
||||||
"owner": "kittywitch",
|
"owner": "kittywitch",
|
||||||
"repo": "tree",
|
"repo": "tree",
|
||||||
"rev": "fbe8ae96d7f4fb369d32dbbe8434606b23354caf",
|
"rev": "501675588cb663a9bd18056002de697f4e91b667",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
|
|
||||||
|
|
@ -13,8 +13,7 @@
|
||||||
tree-input.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
tree-input.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
||||||
|
|
||||||
# update whenever
|
# update whenever
|
||||||
nixpkgs-fixed.url =
|
nixpkgs-fixed.url = "github:nixos/nixpkgs/?branch=nixos-unstable&rev=e76c78d20685a043d23f5f9e0ccd2203997f1fb1";
|
||||||
"github:nixos/nixpkgs/?branch=nixos-unstable&rev=e76c78d20685a043d23f5f9e0ccd2203997f1fb1";
|
|
||||||
|
|
||||||
nur.url = "github:nix-community/NUR";
|
nur.url = "github:nix-community/NUR";
|
||||||
|
|
||||||
|
|
@ -31,5 +30,5 @@
|
||||||
gitlab_artifacts_sync.inputs.nixpkgs.follows = "nixpkgs-fixed";
|
gitlab_artifacts_sync.inputs.nixpkgs.follows = "nixpkgs-fixed";
|
||||||
};
|
};
|
||||||
|
|
||||||
outputs = { ... }@inputs: import ./outputs.nix inputs;
|
outputs = {...} @ inputs: import ./outputs.nix inputs;
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,7 +0,0 @@
|
||||||
{ pkgs, ... }: {
|
|
||||||
home.packages = with pkgs;
|
|
||||||
[
|
|
||||||
# NOINLINE
|
|
||||||
aegisub
|
|
||||||
];
|
|
||||||
}
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
{ pkgs, ... }: {
|
{...}: {
|
||||||
programs.aria2 = {
|
programs.aria2 = {
|
||||||
enable = true;
|
enable = true;
|
||||||
settings = {
|
settings = {
|
||||||
|
|
@ -10,9 +10,7 @@
|
||||||
dht-entry-point = "dht.transmissionbt.com:6881";
|
dht-entry-point = "dht.transmissionbt.com:6881";
|
||||||
dht-entry-point6 = "dht.transmissionbt.com:6881";
|
dht-entry-point6 = "dht.transmissionbt.com:6881";
|
||||||
enable-peer-exchange = true;
|
enable-peer-exchange = true;
|
||||||
bt-tracker =
|
bt-tracker = "udp://tracker.coppersurfer.tk:6969/announce,udp://tracker.leechers-paradise.org:6969/announce,udp://tracker.opentrackr.org:1337/announce,udp://9.rarbg.to:2710/announce,udp://exodus.desync.com:6969/announce,udp://tracker.openbittorrent.com:80/announce,udp://tracker.tiny-vps.com:6969/announce,udp://retracker.lanta-net.ru:2710/announce,udp://tracker.torrent.eu.org:451/announce,udp://tracker.cyberia.is:6969/announce,udp://torrentclub.tech:6969/announce,udp://open.stealth.si:80/announce,udp://denis.stalker.upeer.me:6969/announce,udp://tracker.moeking.me:6969/announce,udp://open.demonii.si:1337/announce,udp://ipv4.tracker.harry.lu:80/announce,udp://tracker3.itzmx.com:6961/announce,udp://explodie.org:6969/announce,udp://valakas.rollo.dnsabr.com:2710/announce,udp://tracker.nyaa.uk:6969/announce,udp://tracker.iamhansen.xyz:2000/announce,udp://tracker.filepit.to:6969/announce,udp://tracker-udp.gbitt.info:80/announce,udp://retracker.netbynet.ru:2710/announce,udp://retracker.akado-ural.ru:80/announce,udp://opentor.org:2710/announce,udp://tracker.yoshi210.com:6969/announce,udp://tracker.filemail.com:6969/announce,udp://tracker.ds.is:6969/announce,udp://newtoncity.org:6969/announce,udp://bt2.archive.org:6969/announce,udp://bt1.archive.org:6969/announce,https://tracker.fastdownload.xyz:443/announce,https://opentracker.xyz:443/announce,https://opentracker.co:443/announce,http://tracker.bt4g.com:2095/announce,http://opentracker.xyz:80/announce,http://open.trackerlist.xyz:80/announce,http://h4.trakx.nibba.trade:80/announce,udp://xxxtor.com:2710/announce,udp://tracker.uw0.xyz:6969/announce,udp://tracker.tvunderground.org.ru:3218/announce,udp://tracker.nextrp.ru:6969/announce,udp://tracker.msm8916.com:6969/announce,udp://tracker.lelux.fi:6969/announce,udp://retracker.sevstar.net:2710/announce,udp://npserver.intranet.pw:4201/announce,https://tracker.nanoha.org:443/announce,https://tracker.hama3.net:443/announce,http://www.proxmox.com:6969/announce,http://tracker.tvunderground.org.ru:3218/announce,http://tracker.opentrackr.org:1337/announce,http://tracker.bz:80/announce,http://torrentclub.tech:6969/announce,http://t.nyaatracker.com:80/announce,http://retracker.sevstar.net:2710/announce,http://open.acgtracker.com:1096/announce,http://explodie.org:6969/announce,udp://tracker4.itzmx.com:2710/announce,udp://tracker2.itzmx.com:6961/announce,udp://tracker.swateam.org.uk:2710/announce,udp://tr.bangumi.moe:6969/announce,udp://qg.lorzl.gq:2710/announce,udp://chihaya.toss.li:9696/announce,https://tracker.vectahosting.eu:2053/announce,https://tracker.lelux.fi:443/announce,https://tracker.gbitt.info:443/announce,https://opentracker.acgnx.se:443/announce,http://www.loushao.net:8080/announce,http://vps02.net.orel.ru:80/announce,http://tracker4.itzmx.com:2710/announce,http://tracker3.itzmx.com:6961/announce,http://tracker2.itzmx.com:6961/announce,http://tracker1.itzmx.com:8080/announce,http://tracker01.loveapp.com:6789/announce,http://tracker.yoshi210.com:6969/announce,http://tracker.torrentyorg.pl:80/announce,http://tracker.lelux.fi:80/announce,http://tracker.gbitt.info:80/announce,http://tracker.frozen-layer.net:6969/announce,http://sukebei.tracker.wf:8888/announce,http://pow7.com:80/announce,http://opentracker.acgnx.se:80/announce,http://open.acgnxtracker.com:80/announce,http://newtoncity.org:6969/announce,http://mail2.zelenaya.net:80/announce,http://bt-tracker.gamexp.ru:2710/announce,http://acg.rip:6699/announce";
|
||||||
"udp://tracker.coppersurfer.tk:6969/announce,udp://tracker.leechers-paradise.org:6969/announce,udp://tracker.opentrackr.org:1337/announce,udp://9.rarbg.to:2710/announce,udp://exodus.desync.com:6969/announce,udp://tracker.openbittorrent.com:80/announce,udp://tracker.tiny-vps.com:6969/announce,udp://retracker.lanta-net.ru:2710/announce,udp://tracker.torrent.eu.org:451/announce,udp://tracker.cyberia.is:6969/announce,udp://torrentclub.tech:6969/announce,udp://open.stealth.si:80/announce,udp://denis.stalker.upeer.me:6969/announce,udp://tracker.moeking.me:6969/announce,udp://open.demonii.si:1337/announce,udp://ipv4.tracker.harry.lu:80/announce,udp://tracker3.itzmx.com:6961/announce,udp://explodie.org:6969/announce,udp://valakas.rollo.dnsabr.com:2710/announce,udp://tracker.nyaa.uk:6969/announce,udp://tracker.iamhansen.xyz:2000/announce,udp://tracker.filepit.to:6969/announce,udp://tracker-udp.gbitt.info:80/announce,udp://retracker.netbynet.ru:2710/announce,udp://retracker.akado-ural.ru:80/announce,udp://opentor.org:2710/announce,udp://tracker.yoshi210.com:6969/announce,udp://tracker.filemail.com:6969/announce,udp://tracker.ds.is:6969/announce,udp://newtoncity.org:6969/announce,udp://bt2.archive.org:6969/announce,udp://bt1.archive.org:6969/announce,https://tracker.fastdownload.xyz:443/announce,https://opentracker.xyz:443/announce,https://opentracker.co:443/announce,http://tracker.bt4g.com:2095/announce,http://opentracker.xyz:80/announce,http://open.trackerlist.xyz:80/announce,http://h4.trakx.nibba.trade:80/announce,udp://xxxtor.com:2710/announce,udp://tracker.uw0.xyz:6969/announce,udp://tracker.tvunderground.org.ru:3218/announce,udp://tracker.nextrp.ru:6969/announce,udp://tracker.msm8916.com:6969/announce,udp://tracker.lelux.fi:6969/announce,udp://retracker.sevstar.net:2710/announce,udp://npserver.intranet.pw:4201/announce,https://tracker.nanoha.org:443/announce,https://tracker.hama3.net:443/announce,http://www.proxmox.com:6969/announce,http://tracker.tvunderground.org.ru:3218/announce,http://tracker.opentrackr.org:1337/announce,http://tracker.bz:80/announce,http://torrentclub.tech:6969/announce,http://t.nyaatracker.com:80/announce,http://retracker.sevstar.net:2710/announce,http://open.acgtracker.com:1096/announce,http://explodie.org:6969/announce,udp://tracker4.itzmx.com:2710/announce,udp://tracker2.itzmx.com:6961/announce,udp://tracker.swateam.org.uk:2710/announce,udp://tr.bangumi.moe:6969/announce,udp://qg.lorzl.gq:2710/announce,udp://chihaya.toss.li:9696/announce,https://tracker.vectahosting.eu:2053/announce,https://tracker.lelux.fi:443/announce,https://tracker.gbitt.info:443/announce,https://opentracker.acgnx.se:443/announce,http://www.loushao.net:8080/announce,http://vps02.net.orel.ru:80/announce,http://tracker4.itzmx.com:2710/announce,http://tracker3.itzmx.com:6961/announce,http://tracker2.itzmx.com:6961/announce,http://tracker1.itzmx.com:8080/announce,http://tracker01.loveapp.com:6789/announce,http://tracker.yoshi210.com:6969/announce,http://tracker.torrentyorg.pl:80/announce,http://tracker.lelux.fi:80/announce,http://tracker.gbitt.info:80/announce,http://tracker.frozen-layer.net:6969/announce,http://sukebei.tracker.wf:8888/announce,http://pow7.com:80/announce,http://opentracker.acgnx.se:80/announce,http://open.acgnxtracker.com:80/announce,http://newtoncity.org:6969/announce,http://mail2.zelenaya.net:80/announce,http://bt-tracker.gamexp.ru:2710/announce,http://acg.rip:6699/announce";
|
|
||||||
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
{ config, pkgs, ... }: { home.packages = with pkgs; [ gnome.file-roller ]; }
|
{pkgs, ...}: {home.packages = with pkgs; [gnome.file-roller];}
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,9 @@
|
||||||
{ config, nixosConfig, pkgs, ... }:
|
{
|
||||||
let isGnome = nixosConfig.services.xserver.desktopManager.gnome.enable;
|
nixosConfig,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
|
isGnome = nixosConfig.services.xserver.desktopManager.gnome.enable;
|
||||||
in {
|
in {
|
||||||
programs.firefox = {
|
programs.firefox = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
@ -79,7 +83,7 @@ in {
|
||||||
"browser.safebrowsing.malware.enabled" = false;
|
"browser.safebrowsing.malware.enabled" = false;
|
||||||
"browser.safebrowsing.downloads.enabled" = false;
|
"browser.safebrowsing.downloads.enabled" = false;
|
||||||
|
|
||||||
# don't let websites replace right click
|
# don't let websites replace right click
|
||||||
"dom.event.contextmenu.enabled" = false;
|
"dom.event.contextmenu.enabled" = false;
|
||||||
|
|
||||||
# disable geoip
|
# disable geoip
|
||||||
|
|
@ -106,9 +110,8 @@ in {
|
||||||
];
|
];
|
||||||
newElementCount = 22;
|
newElementCount = 22;
|
||||||
placements = {
|
placements = {
|
||||||
PersonalToolbar = [ "import-button" "personal-bookmarks" ];
|
PersonalToolbar = ["import-button" "personal-bookmarks"];
|
||||||
TabsToolbar =
|
TabsToolbar = ["tabbrowser-tabs" "new-tab-button" "alltabs-button"];
|
||||||
[ "tabbrowser-tabs" "new-tab-button" "alltabs-button" ];
|
|
||||||
nav-bar = [
|
nav-bar = [
|
||||||
"back-button"
|
"back-button"
|
||||||
"forward-button"
|
"forward-button"
|
||||||
|
|
@ -120,7 +123,7 @@ in {
|
||||||
"_7a7a4a92-a2a0-41d1-9fd7-1e92480d612d_-browser-action"
|
"_7a7a4a92-a2a0-41d1-9fd7-1e92480d612d_-browser-action"
|
||||||
"offline-qr-code_rugk_github_io-browser-action"
|
"offline-qr-code_rugk_github_io-browser-action"
|
||||||
];
|
];
|
||||||
toolbar-menubar = [ "menubar-items" ];
|
toolbar-menubar = ["menubar-items"];
|
||||||
widget-overflow-fixed-list = [
|
widget-overflow-fixed-list = [
|
||||||
"a11y_css_ffoodd-browser-action"
|
"a11y_css_ffoodd-browser-action"
|
||||||
"dontfuckwithpaste_raim_ist-browser-action"
|
"dontfuckwithpaste_raim_ist-browser-action"
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,4 @@
|
||||||
{ config, nixosConfig, ... }:
|
{nixosConfig, ...}: {
|
||||||
|
|
||||||
{
|
|
||||||
wayland.windowManager.sway.extraSessionCommands = ''
|
wayland.windowManager.sway.extraSessionCommands = ''
|
||||||
export KITTY_CACHE_DIRECTORY="/tmp/kitty";
|
export KITTY_CACHE_DIRECTORY="/tmp/kitty";
|
||||||
'';
|
'';
|
||||||
|
|
@ -9,7 +7,9 @@
|
||||||
font.name = "Comic Code";
|
font.name = "Comic Code";
|
||||||
settings = {
|
settings = {
|
||||||
font_size =
|
font_size =
|
||||||
if nixosConfig.networking.hostName == "tablet" then 12 else 20;
|
if nixosConfig.networking.hostName == "tablet"
|
||||||
|
then 12
|
||||||
|
else 20;
|
||||||
bold_font = "auto";
|
bold_font = "auto";
|
||||||
italic_font = "auto";
|
italic_font = "auto";
|
||||||
bold_italic_font = "auto";
|
bold_italic_font = "auto";
|
||||||
|
|
|
||||||
|
|
@ -1,11 +1,10 @@
|
||||||
{ config, pkgs, ... }:
|
{pkgs, ...}: let
|
||||||
let
|
listen-password-file =
|
||||||
listen-password-file = if pkgs.stdenv.isLinux then
|
if pkgs.stdenv.isLinux
|
||||||
"/secrets/music_stream_password"
|
then "/secrets/music_stream_password"
|
||||||
else
|
else "$HOME/.secrets/music_stream_password";
|
||||||
"$HOME/.secrets/music_stream_password";
|
|
||||||
in {
|
in {
|
||||||
home.packages = with pkgs; [ mpv ffmpeg yt-dlp ];
|
home.packages = with pkgs; [mpv ffmpeg yt-dlp];
|
||||||
programs.mpv = {
|
programs.mpv = {
|
||||||
enable = true;
|
enable = true;
|
||||||
config = {
|
config = {
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
{ pkgs, ... }: { home.packages = with pkgs; [ mullvad-vpn ]; }
|
{pkgs, ...}: {home.packages = with pkgs; [mullvad-vpn];}
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
{ inputs, pkgs, ... }: { home.packages = with pkgs; [ musicutil ]; }
|
{pkgs, ...}: {home.packages = with pkgs; [musicutil];}
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
{ config, pkgs, ... }: { home.packages = with pkgs; [ gnome.nautilus ]; }
|
{pkgs, ...}: {home.packages = with pkgs; [gnome.nautilus];}
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
{ config, pkgs, ... }: { home.packages = with pkgs; [ nicotine-plus ]; }
|
{pkgs, ...}: {home.packages = with pkgs; [nicotine-plus];}
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
{ pkgs, ... }: { home.packages = with pkgs; [ obsidian ]; }
|
{pkgs, ...}: {home.packages = with pkgs; [obsidian];}
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
{ pkgs, ... }: { home.packages = with pkgs; [ pavucontrol ]; }
|
{pkgs, ...}: {home.packages = with pkgs; [pavucontrol];}
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
{ pkgs, ... }: {
|
{pkgs, ...}: {
|
||||||
home.packages = with pkgs; [ quasselClient ];
|
home.packages = with pkgs; [quasselClient];
|
||||||
xdg.configFile."quassel-irc.org/style.qss".source = ./quassel-style.qss;
|
xdg.configFile."quassel-irc.org/style.qss".source = ./quassel-style.qss;
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
{ config, pkgs, ... }: { home.packages = with pkgs; [ rclone ]; }
|
{pkgs, ...}: {home.packages = with pkgs; [rclone];}
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
{ config, pkgs, ... }: { home.packages = with pkgs; [ restic ]; }
|
{pkgs, ...}: {home.packages = with pkgs; [restic];}
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,5 @@
|
||||||
{ pkgs, ... }: {
|
{pkgs, ...}: {
|
||||||
home.packages = with pkgs; [ rofi ];
|
home.packages = with pkgs; [rofi];
|
||||||
home.file.".local/share/rofi/themes/rofi-nord.rasi".source = ./rofi-nord.rasi;
|
home.file.".local/share/rofi/themes/rofi-nord.rasi".source = ./rofi-nord.rasi;
|
||||||
home.file.".config/rofi/config.rasi".source = ./config.rasi;
|
home.file.".config/rofi/config.rasi".source = ./config.rasi;
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
{ config, pkgs, ... }: { home.packages = with pkgs; [ strawberry ]; }
|
{pkgs, ...}: {home.packages = with pkgs; [strawberry];}
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
{ config, pkgs, ... }: { home.packages = with pkgs; [ kotatogram-desktop ]; }
|
{pkgs, ...}: {home.packages = with pkgs; [kotatogram-desktop];}
|
||||||
|
|
|
||||||
|
|
@ -1,7 +1,7 @@
|
||||||
{ config, pkgs, ... }: {
|
{pkgs, ...}: {
|
||||||
home.packages = with pkgs; [
|
home.packages = with pkgs; [
|
||||||
vivaldi
|
vivaldi
|
||||||
vivaldi-ffmpeg-codecs
|
vivaldi-ffmpeg-codecs
|
||||||
#vivaldi-widevine
|
#vivaldi-widevine
|
||||||
];
|
];
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
{ pkgs, ... }: { home.packages = with pkgs; [ gitlab_archiver ]; }
|
{pkgs, ...}: {home.packages = with pkgs; [gitlab_archiver];}
|
||||||
|
|
|
||||||
|
|
@ -1,10 +1,11 @@
|
||||||
{ lib, ... }: {
|
{lib, ...}: {
|
||||||
programs.ssh.enable = true;
|
programs.ssh.enable = true;
|
||||||
programs.ssh.matchBlocks = (lib.mkMerge
|
programs.ssh.matchBlocks =
|
||||||
(lib.forEach [ "hetzner-vm" "storage" "vault" "buildbox" ] (hostname: {
|
lib.mkMerge
|
||||||
|
(lib.forEach ["hetzner-vm" "storage" "vault" "buildbox"] (hostname: {
|
||||||
"${hostname}" = {
|
"${hostname}" = {
|
||||||
user = "root";
|
user = "root";
|
||||||
hostname = "${hostname}.servers.genderfucked.monster";
|
hostname = "${hostname}.servers.genderfucked.monster";
|
||||||
};
|
};
|
||||||
})));
|
}));
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,7 +1,7 @@
|
||||||
{ config, pkgs, ... }:
|
{pkgs, ...}: let
|
||||||
let usb_data = import ../../data/usb_data.nix { };
|
usb_data = import ../../data/usb_data.nix {};
|
||||||
in {
|
in {
|
||||||
home.packages = with pkgs; [ exa bat ripgrep vault age ];
|
home.packages = with pkgs; [exa bat ripgrep vault age];
|
||||||
programs.zsh = {
|
programs.zsh = {
|
||||||
enable = true;
|
enable = true;
|
||||||
enableSyntaxHighlighting = true;
|
enableSyntaxHighlighting = true;
|
||||||
|
|
@ -9,10 +9,10 @@ in {
|
||||||
oh-my-zsh = {
|
oh-my-zsh = {
|
||||||
enable = true;
|
enable = true;
|
||||||
theme = "afowler";
|
theme = "afowler";
|
||||||
plugins = [ ];
|
plugins = [];
|
||||||
};
|
};
|
||||||
shellAliases = {
|
shellAliases = {
|
||||||
nixdirfmt = "nixfmt $(fd -e nix)";
|
nixdirfmt = "alejandra .";
|
||||||
exa = "exa --time-style long-iso";
|
exa = "exa --time-style long-iso";
|
||||||
ls = "exa -G";
|
ls = "exa -G";
|
||||||
la = "exa -Ga";
|
la = "exa -Ga";
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
{ config, lib, ... }: {
|
{...}: {
|
||||||
services.blueman-applet.enable = true;
|
services.blueman-applet.enable = true;
|
||||||
services.mpris-proxy.enable = true;
|
services.mpris-proxy.enable = true;
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
{ pkgs, ... }: {
|
{pkgs, ...}: {
|
||||||
home.packages = with pkgs; [
|
home.packages = with pkgs; [
|
||||||
libarchive
|
libarchive
|
||||||
zip
|
zip
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
{ pkgs, ... }: { home.packages = with pkgs; [ gdb lldb ]; }
|
{pkgs, ...}: {home.packages = with pkgs; [gdb lldb];}
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
{ pkgs, inputs, ... }: { home.packages = with pkgs.deploy-rs; [ deploy-rs ]; }
|
{pkgs, ...}: {home.packages = with pkgs.deploy-rs; [deploy-rs];}
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
{ pkgs, ... }: { home.packages = with pkgs; [ nano ]; }
|
{pkgs, ...}: {home.packages = with pkgs; [nano];}
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
{ pkgs, inputs, ... }: {
|
{pkgs, ...}: {
|
||||||
home.packages = with pkgs; [
|
home.packages = with pkgs; [
|
||||||
jq
|
jq
|
||||||
ripgrep
|
ripgrep
|
||||||
|
|
@ -7,6 +7,6 @@
|
||||||
tmux
|
tmux
|
||||||
socat
|
socat
|
||||||
file
|
file
|
||||||
(pkgs.busybox.override { enableAppletSymlinks = false; })
|
(pkgs.busybox.override {enableAppletSymlinks = false;})
|
||||||
];
|
];
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,10 +1,10 @@
|
||||||
{ pkgs, ... }: {
|
{pkgs, ...}: {
|
||||||
programs.git = {
|
programs.git = {
|
||||||
enable = true;
|
enable = true;
|
||||||
lfs.enable = true;
|
lfs.enable = true;
|
||||||
package = pkgs.gitAndTools.gitFull;
|
package = pkgs.gitAndTools.gitFull;
|
||||||
userName = "Chaos";
|
userName = "Chaos";
|
||||||
userEmail = "chaoticryptidz@owo.monster";
|
userEmail = "chaoticryptidz@owo.monster";
|
||||||
extraConfig = { credential = { helper = "store"; }; };
|
extraConfig = {credential = {helper = "store";};};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,3 +1,3 @@
|
||||||
{ pkgs, ... }: {
|
{pkgs, ...}: {
|
||||||
home.packages = with pkgs; [ neofetch inxi htop usbutils iotop ];
|
home.packages = with pkgs; [neofetch inxi htop usbutils iotop];
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
{ pkgs, ... }: {
|
{pkgs, ...}: {
|
||||||
home.packages = with pkgs; [
|
home.packages = with pkgs; [
|
||||||
curl
|
curl
|
||||||
wget
|
wget
|
||||||
|
|
|
||||||
|
|
@ -1 +0,0 @@
|
||||||
{ pkgs, ... }: { home.packages = with pkgs; [ gitAndTools.gitFull ]; }
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
{ tree, ... }: {
|
{tree, ...}: {
|
||||||
# basically everything apart from home.all.dev.debugging and home.all.dev.deploy-rs
|
# basically everything apart from home.all.dev.debugging and home.all.dev.deploy-rs
|
||||||
imports = with tree; [
|
imports = with tree; [
|
||||||
home.dev.all.archives
|
home.dev.all.archives
|
||||||
|
|
@ -7,6 +7,5 @@
|
||||||
home.dev.all.git
|
home.dev.all.git
|
||||||
home.dev.all.info
|
home.dev.all.info
|
||||||
home.dev.all.network
|
home.dev.all.network
|
||||||
home.dev.all.vcs
|
|
||||||
];
|
];
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
{ pkgs, ... }: { home.packages = with pkgs; [ melonDS ]; }
|
{pkgs, ...}: {home.packages = with pkgs; [melonDS];}
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
{ pkgs, ... }: { home.packages = with pkgs; [ multimc jdk17 ]; }
|
{pkgs, ...}: {home.packages = with pkgs; [multimc jdk17];}
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
{ config, pkgs, ... }: { home.packages = with pkgs; [ osu-lazer ]; }
|
{pkgs, ...}: {home.packages = with pkgs; [osu-lazer];}
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
{ pkgs, ... }: { home.packages = with pkgs; [ lutris ]; }
|
{pkgs, ...}: {home.packages = with pkgs; [lutris];}
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
{ pkgs, ... }: { home.packages = with pkgs; [ steam ]; }
|
{pkgs, ...}: {home.packages = with pkgs; [steam];}
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,8 @@
|
||||||
{ nixosConfig, pkgs, ... }: {
|
{
|
||||||
|
nixosConfig,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
gtk = {
|
gtk = {
|
||||||
enable = true;
|
enable = true;
|
||||||
iconTheme = {
|
iconTheme = {
|
||||||
|
|
@ -11,7 +15,10 @@
|
||||||
};
|
};
|
||||||
font = {
|
font = {
|
||||||
name = "Comic Code";
|
name = "Comic Code";
|
||||||
size = if nixosConfig.networking.hostName == "tablet" then 10 else 16;
|
size =
|
||||||
|
if nixosConfig.networking.hostName == "tablet"
|
||||||
|
then 10
|
||||||
|
else 16;
|
||||||
package = pkgs.comic-code;
|
package = pkgs.comic-code;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,4 @@
|
||||||
{ config, pkgs, ... }:
|
{pkgs, ...}: {
|
||||||
|
|
||||||
{
|
|
||||||
qt = {
|
qt = {
|
||||||
enable = true;
|
enable = true;
|
||||||
platformTheme = "gtk";
|
platformTheme = "gtk";
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
{ pkgs, ... }: { home.packages = with pkgs; [ xdg-utils ]; }
|
{pkgs, ...}: {home.packages = with pkgs; [xdg-utils];}
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,10 @@
|
||||||
{ tree, nixosConfig, pkgs, lib, inputs, ... }:
|
{
|
||||||
let
|
tree,
|
||||||
|
nixosConfig,
|
||||||
|
pkgs,
|
||||||
|
inputs,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
hm = inputs.home-manager.lib.hm;
|
hm = inputs.home-manager.lib.hm;
|
||||||
|
|
||||||
font-sizes-all = {
|
font-sizes-all = {
|
||||||
|
|
@ -13,19 +18,18 @@ let
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
font-sizes = if nixosConfig.networking.hostName == "tablet" then
|
font-sizes =
|
||||||
font-sizes-all.tablet
|
if nixosConfig.networking.hostName == "tablet"
|
||||||
else
|
then font-sizes-all.tablet
|
||||||
font-sizes-all.default;
|
else font-sizes-all.default;
|
||||||
|
|
||||||
in {
|
in {
|
||||||
imports = with tree; [ home.apps.kitty home.apps.rofi ];
|
imports = with tree; [home.apps.kitty home.apps.rofi];
|
||||||
|
|
||||||
home.packages = with pkgs; [ dconf2nix gnome.dconf-editor xclip ];
|
home.packages = with pkgs; [dconf2nix gnome.dconf-editor xclip];
|
||||||
|
|
||||||
dconf.enable = true;
|
dconf.enable = true;
|
||||||
dconf.settings = {
|
dconf.settings = {
|
||||||
"org/gnome/mutter" = { dynamic-workspaces = false; };
|
"org/gnome/mutter" = {dynamic-workspaces = false;};
|
||||||
|
|
||||||
"org/gnome/desktop/interface" = {
|
"org/gnome/desktop/interface" = {
|
||||||
# Clock at Top Bar
|
# Clock at Top Bar
|
||||||
|
|
@ -52,14 +56,14 @@ in {
|
||||||
};
|
};
|
||||||
"org/gnome/desktop/input-sources" = {
|
"org/gnome/desktop/input-sources" = {
|
||||||
# TODO: see if this changes when using gnome wayland?
|
# TODO: see if this changes when using gnome wayland?
|
||||||
sources = [ (hm.gvariant.mkTuple [ "xkb" "gb" ]) ];
|
sources = [(hm.gvariant.mkTuple ["xkb" "gb"])];
|
||||||
per-window = false;
|
per-window = false;
|
||||||
};
|
};
|
||||||
"org/gnome/desktop/media-handling" = {
|
"org/gnome/desktop/media-handling" = {
|
||||||
# growl i hate this until i sometimes dont in which case i love it
|
# growl i hate this until i sometimes dont in which case i love it
|
||||||
automount = false;
|
automount = false;
|
||||||
};
|
};
|
||||||
"org/gnome/desktop/notifications" = { show-in-lockscreen = false; };
|
"org/gnome/desktop/notifications" = {show-in-lockscreen = false;};
|
||||||
"org/gnome/desktop/peripherals/mouse" = {
|
"org/gnome/desktop/peripherals/mouse" = {
|
||||||
# NO!
|
# NO!
|
||||||
natural-scroll = false;
|
natural-scroll = false;
|
||||||
|
|
@ -81,36 +85,36 @@ in {
|
||||||
remove-old-trash-files = true;
|
remove-old-trash-files = true;
|
||||||
};
|
};
|
||||||
# use location services to set time
|
# use location services to set time
|
||||||
"org/gnome/system/location" = { enabled = true; };
|
"org/gnome/system/location" = {enabled = true;};
|
||||||
"org/gnome/desktop/datetime" = { automatic-timezone = true; };
|
"org/gnome/desktop/datetime" = {automatic-timezone = true;};
|
||||||
"org/gnome/desktop/wm/keybindings" = {
|
"org/gnome/desktop/wm/keybindings" = {
|
||||||
# mostly just i3wm stock keybinds
|
# mostly just i3wm stock keybinds
|
||||||
close = [ "<Shift><Alt>q" ];
|
close = ["<Shift><Alt>q"];
|
||||||
maximize = [ "<Shift><Alt>f" ];
|
maximize = ["<Shift><Alt>f"];
|
||||||
toggle-fullscreen = [ "<Alt>f" ];
|
toggle-fullscreen = ["<Alt>f"];
|
||||||
|
|
||||||
# Workspace Switch
|
# Workspace Switch
|
||||||
switch-to-workspace-1 = [ "<Alt>1" ];
|
switch-to-workspace-1 = ["<Alt>1"];
|
||||||
switch-to-workspace-2 = [ "<Alt>2" ];
|
switch-to-workspace-2 = ["<Alt>2"];
|
||||||
switch-to-workspace-3 = [ "<Alt>3" ];
|
switch-to-workspace-3 = ["<Alt>3"];
|
||||||
switch-to-workspace-4 = [ "<Alt>4" ];
|
switch-to-workspace-4 = ["<Alt>4"];
|
||||||
switch-to-workspace-5 = [ "<Alt>5" ];
|
switch-to-workspace-5 = ["<Alt>5"];
|
||||||
switch-to-workspace-6 = [ "<Alt>6" ];
|
switch-to-workspace-6 = ["<Alt>6"];
|
||||||
switch-to-workspace-7 = [ "<Alt>7" ];
|
switch-to-workspace-7 = ["<Alt>7"];
|
||||||
switch-to-workspace-8 = [ "<Alt>8" ];
|
switch-to-workspace-8 = ["<Alt>8"];
|
||||||
switch-to-workspace-9 = [ "<Alt>9" ];
|
switch-to-workspace-9 = ["<Alt>9"];
|
||||||
|
|
||||||
# Workspace Move Window
|
# Workspace Move Window
|
||||||
# TODO: Hardcoded for UK keyboards
|
# TODO: Hardcoded for UK keyboards
|
||||||
move-to-workspace-1 = [ "<Shift><Alt>exclam" ];
|
move-to-workspace-1 = ["<Shift><Alt>exclam"];
|
||||||
move-to-workspace-2 = [ "<Shift><Alt>quotedbl" ];
|
move-to-workspace-2 = ["<Shift><Alt>quotedbl"];
|
||||||
move-to-workspace-3 = [ "<Shift><Alt>sterling" ];
|
move-to-workspace-3 = ["<Shift><Alt>sterling"];
|
||||||
move-to-workspace-4 = [ "<Shift><Alt>dollar" ];
|
move-to-workspace-4 = ["<Shift><Alt>dollar"];
|
||||||
move-to-workspace-5 = [ "<Shift><Alt>percent" ];
|
move-to-workspace-5 = ["<Shift><Alt>percent"];
|
||||||
move-to-workspace-6 = [ "<Shift><Alt>asciicircum" ];
|
move-to-workspace-6 = ["<Shift><Alt>asciicircum"];
|
||||||
move-to-workspace-7 = [ "<Shift><Alt>ampersand" ];
|
move-to-workspace-7 = ["<Shift><Alt>ampersand"];
|
||||||
move-to-workspace-8 = [ "<Shift><Alt>asterisk" ];
|
move-to-workspace-8 = ["<Shift><Alt>asterisk"];
|
||||||
move-to-workspace-9 = [ "<Shift><Alt>parenleft" ];
|
move-to-workspace-9 = ["<Shift><Alt>parenleft"];
|
||||||
};
|
};
|
||||||
"org/gnome/desktop/wm/preferences" = {
|
"org/gnome/desktop/wm/preferences" = {
|
||||||
num-workspaces = 9;
|
num-workspaces = 9;
|
||||||
|
|
@ -118,10 +122,10 @@ in {
|
||||||
titlebar-uses-system-font = true;
|
titlebar-uses-system-font = true;
|
||||||
};
|
};
|
||||||
"org/gnome/settings-daemon/plugins/media-keys" = {
|
"org/gnome/settings-daemon/plugins/media-keys" = {
|
||||||
area-screenshot = [ ];
|
area-screenshot = [];
|
||||||
area-screenshot-clip = [ "<Shift>Print" ];
|
area-screenshot-clip = ["<Shift>Print"];
|
||||||
screenshot = [ ];
|
screenshot = [];
|
||||||
screenshot-clip = [ "Print" ];
|
screenshot-clip = ["Print"];
|
||||||
custom-keybindings = [
|
custom-keybindings = [
|
||||||
# Rofi & Kitty
|
# Rofi & Kitty
|
||||||
"/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/rofi/"
|
"/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/rofi/"
|
||||||
|
|
@ -139,7 +143,7 @@ in {
|
||||||
name = "kitty";
|
name = "kitty";
|
||||||
};
|
};
|
||||||
"org/gnome/shell" = {
|
"org/gnome/shell" = {
|
||||||
enabled-extensions = [ "just-perfection-desktop@just-perfection" ];
|
enabled-extensions = ["just-perfection-desktop@just-perfection"];
|
||||||
};
|
};
|
||||||
"org/gnome/shell/extensions/just-perfection" = {
|
"org/gnome/shell/extensions/just-perfection" = {
|
||||||
activities-button = true;
|
activities-button = true;
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,4 @@
|
||||||
{ config, lib, ... }:
|
{...}: {
|
||||||
|
|
||||||
{
|
|
||||||
services.gammastep = {
|
services.gammastep = {
|
||||||
enable = true;
|
enable = true;
|
||||||
tray = true;
|
tray = true;
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
{ config, pkgs, lib, ... }: {
|
{...}: {
|
||||||
programs.mako = {
|
programs.mako = {
|
||||||
enable = true;
|
enable = true;
|
||||||
defaultTimeout = 3000;
|
defaultTimeout = 3000;
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,12 @@
|
||||||
{ config, pkgs, lib, tree, ... }: {
|
{
|
||||||
|
config,
|
||||||
|
pkgs,
|
||||||
|
lib,
|
||||||
|
tree,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
# import default terminal
|
# import default terminal
|
||||||
imports = with tree; [ home.apps.kitty home.apps.rofi ];
|
imports = with tree; [home.apps.kitty home.apps.rofi];
|
||||||
|
|
||||||
home.sessionVariables = {
|
home.sessionVariables = {
|
||||||
XDG_CURRENT_DESKTOP = "sway";
|
XDG_CURRENT_DESKTOP = "sway";
|
||||||
|
|
@ -9,6 +15,7 @@
|
||||||
SDL_VIDEODRIVER = "wayland";
|
SDL_VIDEODRIVER = "wayland";
|
||||||
QT_QPA_PLATFORM = "wayland";
|
QT_QPA_PLATFORM = "wayland";
|
||||||
QT_WAYLAND_DISABLE_WINDOWDECORATION = 1;
|
QT_WAYLAND_DISABLE_WINDOWDECORATION = 1;
|
||||||
|
# For Ghidra to make windows work properly
|
||||||
_JAVA_AWT_WM_NONREPARENTING = 1;
|
_JAVA_AWT_WM_NONREPARENTING = 1;
|
||||||
XCURSOR_SIZE = 64;
|
XCURSOR_SIZE = 64;
|
||||||
QT_AUTO_SCREEN_SCALE_FACTOR = 1;
|
QT_AUTO_SCREEN_SCALE_FACTOR = 1;
|
||||||
|
|
@ -44,25 +51,23 @@
|
||||||
{
|
{
|
||||||
position = "top";
|
position = "top";
|
||||||
fonts = {
|
fonts = {
|
||||||
names = [ "Comic Code" ];
|
names = ["Comic Code"];
|
||||||
size = 14.0;
|
size = 14.0;
|
||||||
};
|
};
|
||||||
statusCommand = lib.escapeShellArgs [
|
statusCommand = lib.escapeShellArgs [
|
||||||
#"/home/chaoticryptidz/Projects/gobar/gobar "
|
|
||||||
"${pkgs.gobar}/bin/gobar"
|
"${pkgs.gobar}/bin/gobar"
|
||||||
"-config"
|
"-config"
|
||||||
"cpu\\|mem\\|weather\\(Leighton\\ Buzzard\\)\\|bat\\(BAT0\\)\\|time"
|
"cpu\\|mem\\|weather\\(Leighton\\ Buzzard\\)\\|bat\\(BAT0\\)\\|time"
|
||||||
];
|
];
|
||||||
|
|
||||||
}
|
}
|
||||||
{ command = "${pkgs.waybar}/bin/waybar"; }
|
{command = "${pkgs.waybar}/bin/waybar";}
|
||||||
];
|
];
|
||||||
|
|
||||||
output = { "*" = { bg = "~/.local/share/wallpaper.jpg fill"; }; };
|
output = {"*" = {bg = "~/.local/share/wallpaper.jpg fill";};};
|
||||||
input = { "*" = { xkb_layout = "gb"; }; };
|
input = {"*" = {xkb_layout = "gb";};};
|
||||||
|
|
||||||
fonts = {
|
fonts = {
|
||||||
names = [ "Comic Code" ];
|
names = ["Comic Code"];
|
||||||
size = 18.0;
|
size = 18.0;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
@ -81,7 +86,7 @@
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
|
|
||||||
seat = { "*" = { "xcursor_theme" = "Adwaita 24"; }; };
|
seat = {"*" = {"xcursor_theme" = "Adwaita 24";};};
|
||||||
|
|
||||||
gaps = {
|
gaps = {
|
||||||
top = 10;
|
top = 10;
|
||||||
|
|
@ -98,49 +103,45 @@
|
||||||
titlebar = false;
|
titlebar = false;
|
||||||
};
|
};
|
||||||
|
|
||||||
keybindings = {
|
keybindings =
|
||||||
"${cfg.modifier}+Return" = "exec ${cfg.terminal}";
|
{
|
||||||
|
"${cfg.modifier}+Return" = "exec ${cfg.terminal}";
|
||||||
|
|
||||||
"${cfg.modifier}+Left" = "focus left";
|
"${cfg.modifier}+Left" = "focus left";
|
||||||
"${cfg.modifier}+Down" = "focus down";
|
"${cfg.modifier}+Down" = "focus down";
|
||||||
"${cfg.modifier}+Up" = "focus up";
|
"${cfg.modifier}+Up" = "focus up";
|
||||||
"${cfg.modifier}+Right" = "focus right";
|
"${cfg.modifier}+Right" = "focus right";
|
||||||
|
|
||||||
"${cfg.modifier}+Shift+Left" = "move left";
|
"${cfg.modifier}+Shift+Left" = "move left";
|
||||||
"${cfg.modifier}+Shift+Down" = "move down";
|
"${cfg.modifier}+Shift+Down" = "move down";
|
||||||
"${cfg.modifier}+Shift+Up" = "move up";
|
"${cfg.modifier}+Shift+Up" = "move up";
|
||||||
"${cfg.modifier}+Shift+Right" = "move right";
|
"${cfg.modifier}+Shift+Right" = "move right";
|
||||||
|
|
||||||
"${cfg.modifier}+Shift+space" = "floating toggle";
|
"${cfg.modifier}+Shift+space" = "floating toggle";
|
||||||
"${cfg.modifier}+space" = "focus mode_toggle";
|
"${cfg.modifier}+space" = "focus mode_toggle";
|
||||||
|
|
||||||
"XF86AudioRaiseVolume" =
|
"XF86AudioRaiseVolume" = "exec ${pactl} set-sink-volume @DEFAULT_SINK@ +5%";
|
||||||
"exec ${pactl} set-sink-volume @DEFAULT_SINK@ +5%";
|
"XF86AudioLowerVolume" = "exec ${pactl} set-sink-volume @DEFAULT_SINK@ -5%";
|
||||||
"XF86AudioLowerVolume" =
|
"XF86AudioMute" = "exec ${pactl} set-sink-mute @DEFAULT_SINK@ toggle";
|
||||||
"exec ${pactl} set-sink-volume @DEFAULT_SINK@ -5%";
|
"XF86AudioMicMute" = "exec ${pactl} set-source-mute @DEFAULT_SOURCE@ toggle";
|
||||||
"XF86AudioMute" = "exec ${pactl} set-sink-mute @DEFAULT_SINK@ toggle";
|
"XF86MonBrightnessDown" = "exec sudo xbacklight -time 1 -dec +5";
|
||||||
"XF86AudioMicMute" =
|
"XF86MonBrightnessUp" = "exec sudo xbacklight -time 1 -inc +5";
|
||||||
"exec ${pactl} set-source-mute @DEFAULT_SOURCE@ toggle";
|
"Print" = "exec ${pkgs.grim}/bin/grim -t png - | ${pkgs.wl-clipboard}/bin/wl-copy -t image/png";
|
||||||
"XF86MonBrightnessDown" = "exec sudo xbacklight -time 1 -dec +5";
|
"Shift+Print" = ''
|
||||||
"XF86MonBrightnessUp" = "exec sudo xbacklight -time 1 -inc +5";
|
exec ${pkgs.grim}/bin/grim -t png -g "$(${pkgs.slurp}/bin/slurp -d)" - | ${pkgs.wl-clipboard}/bin/wl-copy -t image/png'';
|
||||||
"Print" =
|
|
||||||
"exec ${pkgs.grim}/bin/grim -t png - | ${pkgs.wl-clipboard}/bin/wl-copy -t image/png";
|
|
||||||
"Shift+Print" = ''
|
|
||||||
exec ${pkgs.grim}/bin/grim -t png -g "$(${pkgs.slurp}/bin/slurp -d)" - | ${pkgs.wl-clipboard}/bin/wl-copy -t image/png'';
|
|
||||||
|
|
||||||
"${cfg.modifier}+d" = "exec ${menu}";
|
"${cfg.modifier}+d" = "exec ${menu}";
|
||||||
"${cfg.modifier}+f" = "fullscreen";
|
"${cfg.modifier}+f" = "fullscreen";
|
||||||
|
|
||||||
"${cfg.modifier}+Shift+q" = "kill";
|
"${cfg.modifier}+Shift+q" = "kill";
|
||||||
"${cfg.modifier}+Shift+c" = "reload";
|
"${cfg.modifier}+Shift+c" = "reload";
|
||||||
|
|
||||||
"${cfg.modifier}+r" = "mode resize";
|
"${cfg.modifier}+r" = "mode resize";
|
||||||
} // (lib.foldl lib.recursiveUpdate { } (map (workspace: {
|
}
|
||||||
"${cfg.modifier}+${workspace}" = "workspace ${workspace}";
|
// (lib.foldl lib.recursiveUpdate {} (map (workspace: {
|
||||||
"${cfg.modifier}+Shift+${workspace}" =
|
"${cfg.modifier}+${workspace}" = "workspace ${workspace}";
|
||||||
"move container to workspace ${workspace}";
|
"${cfg.modifier}+Shift+${workspace}" = "move container to workspace ${workspace}";
|
||||||
}) [ "1" "2" "3" "4" "5" "6" "7" "8" "9" ]));
|
}) ["1" "2" "3" "4" "5" "6" "7" "8" "9"]));
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,12 +1,13 @@
|
||||||
_: {
|
{...}: {
|
||||||
programs.waybar = {
|
programs.waybar = {
|
||||||
enable = true;
|
enable = true;
|
||||||
settings = [{
|
settings = [
|
||||||
position = "bottom";
|
{
|
||||||
|
position = "bottom";
|
||||||
modules-left = [ ];
|
modules-left = [];
|
||||||
modules-center = [ ];
|
modules-center = [];
|
||||||
modules-right = [ "tray" ];
|
modules-right = ["tray"];
|
||||||
}];
|
}
|
||||||
|
];
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
_: {
|
{...}: {
|
||||||
programs.zsh.profileExtra = ''
|
programs.zsh.profileExtra = ''
|
||||||
# If running from tty1 start sway
|
# If running from tty1 start sway
|
||||||
if [ "$(tty)" = "/dev/tty1" ]; then
|
if [ "$(tty)" = "/dev/tty1" ]; then
|
||||||
|
|
|
||||||
|
|
@ -1,16 +1,20 @@
|
||||||
{ config, lib, ... }: {
|
{
|
||||||
systemd.user.tmpfiles.rules = (map (dir:
|
config,
|
||||||
"d ${config.home.homeDirectory}/${dir} - ${config.home.username} users") [
|
lib,
|
||||||
"Projects"
|
...
|
||||||
"Temp"
|
}: {
|
||||||
"Music"
|
systemd.user.tmpfiles.rules = map (dir: "d ${config.home.homeDirectory}/${dir} - ${config.home.username} users") [
|
||||||
"Mounts"
|
"Projects"
|
||||||
"Mounts/Storage"
|
"Temp"
|
||||||
"Mounts/Storage-Public"
|
"Music"
|
||||||
"Mounts/Backups"
|
"Mounts"
|
||||||
"Mounts/Backups-Crypt"
|
"Mounts/Storage"
|
||||||
"Mounts/Photos-Crypt"
|
"Mounts/Storage-Public"
|
||||||
"Mounts/Temp1"
|
"Mounts/Backups"
|
||||||
"Mounts/Temp2"
|
"Mounts/Backups-Crypt"
|
||||||
]);
|
"Mounts/Photos-Crypt"
|
||||||
|
"Mounts/Public"
|
||||||
|
"Mounts/Temp1"
|
||||||
|
"Mounts/Temp2"
|
||||||
|
];
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,7 +1,17 @@
|
||||||
{ config, nixosConfig, pkgs, ... }:
|
{
|
||||||
let
|
config,
|
||||||
font-size = if nixosConfig.networking.hostName == "tablet" then 18 else 24;
|
nixosConfig,
|
||||||
zoom-level = if nixosConfig.networking.hostName == "tablet" then -2 else 0;
|
pkgs,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
|
font-size =
|
||||||
|
if nixosConfig.networking.hostName == "tablet"
|
||||||
|
then 18
|
||||||
|
else 24;
|
||||||
|
zoom-level =
|
||||||
|
if nixosConfig.networking.hostName == "tablet"
|
||||||
|
then -2
|
||||||
|
else 0;
|
||||||
in {
|
in {
|
||||||
programs.vscode-mod = {
|
programs.vscode-mod = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,4 @@
|
||||||
{ config, pkgs, ... }:
|
{pkgs, ...}: {
|
||||||
|
home.packages = with pkgs; [go gopls go-outline gotools];
|
||||||
{
|
programs.vscode-mod.extensions = with pkgs; [vscode-extensions.golang.go];
|
||||||
home.packages = with pkgs; [ go gopls go-outline gotools ];
|
|
||||||
programs.vscode-mod.extensions = with pkgs; [ vscode-extensions.golang.go ];
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,14 +1,16 @@
|
||||||
{ config, pkgs, ... }:
|
{pkgs, ...}: {
|
||||||
|
home.packages = with pkgs; [alejandra];
|
||||||
{
|
|
||||||
home.packages = with pkgs; [ nixfmt ];
|
|
||||||
|
|
||||||
programs.vscode-mod.extensions = with pkgs; [
|
programs.vscode-mod.extensions = with pkgs; [
|
||||||
vscode-extensions.bbenoist.nix
|
vscode-extensions.bbenoist.nix
|
||||||
vscode-extensions.brettm12345.nixfmt-vscode
|
vscode-extensions.kamadorueda.alejandra
|
||||||
];
|
];
|
||||||
|
|
||||||
programs.vscode-mod.userSettings."[nix]" = {
|
programs.vscode-mod.userSettings."[nix]" = {
|
||||||
"editor.defaultFormatter" = "brettm12345.nixfmt-vscode";
|
"editor.defaultFormatter" = "kamadorueda.alejandra";
|
||||||
|
"editor.formatOnSave" = true;
|
||||||
|
};
|
||||||
|
programs.vscode-mod.userSettings = {
|
||||||
|
"alejandra.program" = "alejandra";
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,5 @@
|
||||||
{ pkgs, ... }: {
|
{pkgs, ...}: {
|
||||||
programs.vscode-mod.extensions = with pkgs;
|
programs.vscode-mod.extensions = with pkgs; [vscode-extensions.matklad.rust-analyzer];
|
||||||
[ vscode-extensions.matklad.rust-analyzer ];
|
home.packages = with pkgs; [rustc cargo clippy rust-analyzer rustfmt];
|
||||||
home.packages = with pkgs; [ rustc cargo clippy rust-analyzer rustfmt ];
|
home.sessionVariables = {RUST_SRC_PATH = pkgs.rustPlatform.rustLibSrc;};
|
||||||
home.sessionVariables = { RUST_SRC_PATH = pkgs.rustPlatform.rustLibSrc; };
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,8 +1,8 @@
|
||||||
{ pkgs, ... }: {
|
{pkgs, ...}: {
|
||||||
home.packages = with pkgs; [
|
home.packages = with pkgs; [
|
||||||
binwalk
|
binwalk
|
||||||
file
|
file
|
||||||
binutils # strings
|
binutils
|
||||||
diffoscope
|
diffoscope
|
||||||
];
|
];
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,11 +1,11 @@
|
||||||
{ ... }:
|
{...}: let
|
||||||
let usb_data = (import ../data/usb_data.nix { });
|
usb_data = import ../data/usb_data.nix {};
|
||||||
in {
|
in {
|
||||||
programs.ssh.matchBlocks."*".identityFile = "${usb_data.ssh_priv_path}";
|
programs.ssh.matchBlocks."*".identityFile = "${usb_data.ssh_priv_path}";
|
||||||
programs.git.extraConfig = {
|
programs.git.extraConfig = {
|
||||||
gpg.format = "ssh";
|
gpg.format = "ssh";
|
||||||
commit.gpgsign = "true";
|
commit.gpgsign = "true";
|
||||||
tag.gpgsign = "true";
|
tag.gpgsign = "true";
|
||||||
user = { signingKey = "${usb_data.ssh_priv_path}"; };
|
user = {signingKey = "${usb_data.ssh_priv_path}";};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,10 @@
|
||||||
{ modulesPath, tree, config, pkgs, lib, ... }:
|
{
|
||||||
let secrets = config.services.secrets.secrets;
|
tree,
|
||||||
|
config,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
|
secrets = config.services.secrets.secrets;
|
||||||
in {
|
in {
|
||||||
imports = with tree; [
|
imports = with tree; [
|
||||||
users.root
|
users.root
|
||||||
|
|
@ -87,9 +92,9 @@ in {
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.services.mdadm-monitor = {
|
systemd.services.mdadm-monitor = {
|
||||||
requires = [ "network.target" ];
|
requires = ["network.target"];
|
||||||
wantedBy = [ "multi-user.target" ];
|
wantedBy = ["multi-user.target"];
|
||||||
path = with pkgs; [ mdadm msmtp ];
|
path = with pkgs; [mdadm msmtp];
|
||||||
script = ''
|
script = ''
|
||||||
exec mdadm --monitor --scan
|
exec mdadm --monitor --scan
|
||||||
'';
|
'';
|
||||||
|
|
@ -100,7 +105,7 @@ in {
|
||||||
};
|
};
|
||||||
|
|
||||||
home-manager.users.root = {
|
home-manager.users.root = {
|
||||||
imports = with tree; [ home.base home.dev.small ];
|
imports = with tree; [home.base home.dev.small];
|
||||||
home.stateVersion = "22.05";
|
home.stateVersion = "22.05";
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
@ -109,4 +114,3 @@ in {
|
||||||
|
|
||||||
system.stateVersion = "22.05";
|
system.stateVersion = "22.05";
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,8 +1,7 @@
|
||||||
{ config, lib, pkgs, modulesPath, ... }: {
|
{config, ...}: {
|
||||||
boot.initrd.kernelModules = [ "dm-snapshot" ];
|
boot.initrd.kernelModules = ["dm-snapshot"];
|
||||||
boot.initrd.availableKernelModules =
|
boot.initrd.availableKernelModules = ["xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod"];
|
||||||
[ "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
|
boot.kernelModules = ["kvm-amd"];
|
||||||
boot.kernelModules = [ "kvm-amd" ];
|
|
||||||
|
|
||||||
boot.initrd.services.swraid.mdadmConf =
|
boot.initrd.services.swraid.mdadmConf =
|
||||||
config.environment.etc."mdadm.conf".text;
|
config.environment.etc."mdadm.conf".text;
|
||||||
|
|
@ -22,6 +21,6 @@
|
||||||
efiSupport = false;
|
efiSupport = false;
|
||||||
version = 2;
|
version = 2;
|
||||||
device = "nodev";
|
device = "nodev";
|
||||||
devices = [ "/dev/sda" "/dev/sdb" ];
|
devices = ["/dev/sda" "/dev/sdb"];
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,15 +1,15 @@
|
||||||
{ ... }: {
|
{...}: {
|
||||||
systemd.services.systemd-networkd-wait-online.enable = false;
|
systemd.services.systemd-networkd-wait-online.enable = false;
|
||||||
|
|
||||||
networking = {
|
networking = {
|
||||||
resolvconf.useLocalResolver = false;
|
resolvconf.useLocalResolver = false;
|
||||||
networkmanager.dns = "none";
|
networkmanager.dns = "none";
|
||||||
};
|
};
|
||||||
networking.nameservers = [ "1.1.1.1" ];
|
networking.nameservers = ["1.1.1.1"];
|
||||||
|
|
||||||
networking.firewall.enable = true;
|
networking.firewall.enable = true;
|
||||||
networking.firewall.allowPing = true;
|
networking.firewall.allowPing = true;
|
||||||
networking.firewall.allowedTCPPorts = [ 22 ];
|
networking.firewall.allowedTCPPorts = [22];
|
||||||
|
|
||||||
networking.enableIPv6 = true;
|
networking.enableIPv6 = true;
|
||||||
networking.usePredictableInterfaceNames = false;
|
networking.usePredictableInterfaceNames = false;
|
||||||
|
|
@ -18,8 +18,8 @@
|
||||||
enable = true;
|
enable = true;
|
||||||
networks.eth0 = {
|
networks.eth0 = {
|
||||||
name = "eth0";
|
name = "eth0";
|
||||||
address = [ "144.76.97.18" ];
|
address = ["144.76.97.18"];
|
||||||
gateway = [ "144.76.97.1" ];
|
gateway = ["144.76.97.1"];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
{ pkgs, ... }: {
|
{...}: {
|
||||||
services.secrets = {
|
services.secrets = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,26 +1,36 @@
|
||||||
{ self, nixpkgs-unstable, nix-darwin-unstable, tree, ... }@inputs:
|
{
|
||||||
let
|
self,
|
||||||
|
nixpkgs-unstable,
|
||||||
defaultSpecialArgs = defaults.defaultSpecialArgs // {
|
nix-darwin-unstable,
|
||||||
inputs = inputs // {
|
tree,
|
||||||
# set these to the correct versions from inputs
|
...
|
||||||
nixpkgs = inputs.nixpkgs-unstable;
|
} @ inputs: let
|
||||||
home-manager = inputs.home-manager-unstable;
|
defaultSpecialArgs =
|
||||||
darwin = inputs.nix-darwin-unstable;
|
defaults.defaultSpecialArgs
|
||||||
|
// {
|
||||||
|
inputs =
|
||||||
|
inputs
|
||||||
|
// {
|
||||||
|
# set these to the correct versions from inputs
|
||||||
|
nixpkgs = inputs.nixpkgs-unstable;
|
||||||
|
home-manager = inputs.home-manager-unstable;
|
||||||
|
darwin = inputs.nix-darwin-unstable;
|
||||||
|
};
|
||||||
};
|
};
|
||||||
};
|
|
||||||
|
|
||||||
defaultModules = defaults.defaultModules ++ [
|
defaultModules =
|
||||||
# NO_INLINE
|
defaults.defaultModules
|
||||||
tree.impure.profiles.base-darwin
|
++ [
|
||||||
inputs.home-manager-unstable.darwinModules.home-manager
|
# NO_INLINE
|
||||||
];
|
tree.impure.profiles.base-darwin
|
||||||
|
inputs.home-manager-unstable.darwinModules.home-manager
|
||||||
|
];
|
||||||
|
|
||||||
darwinSystem = nix-darwin-unstable.lib.darwinSystem;
|
darwinSystem = nix-darwin-unstable.lib.darwinSystem;
|
||||||
in {
|
in {
|
||||||
"MacMini" = darwinSystem {
|
"MacMini" = darwinSystem {
|
||||||
specialArgs = defaultSpecialArgs;
|
specialArgs = defaultSpecialArgs;
|
||||||
system = "aarch64-darwin";
|
system = "aarch64-darwin";
|
||||||
modules = defaultModules ++ [ ./macmini/default.nix ];
|
modules = defaultModules ++ [./macmini/default.nix];
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
{ ... }@inputs: {
|
{...} @ inputs: {
|
||||||
nixosConfigurations = import ./nixos.nix inputs;
|
nixosConfigurations = import ./nixos.nix inputs;
|
||||||
#darwinConfigurations = import ./darwin.nix inputs;
|
#darwinConfigurations = import ./darwin.nix inputs;
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,9 +1,9 @@
|
||||||
{ modulesPath, ... }: {
|
{modulesPath, ...}: {
|
||||||
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
|
imports = [(modulesPath + "/profiles/qemu-guest.nix")];
|
||||||
|
|
||||||
boot.loader.grub.enable = true;
|
boot.loader.grub.enable = true;
|
||||||
boot.loader.grub.device = "/dev/sda";
|
boot.loader.grub.device = "/dev/sda";
|
||||||
boot.initrd.kernelModules = [ "nvme" ];
|
boot.initrd.kernelModules = ["nvme"];
|
||||||
fileSystems."/" = {
|
fileSystems."/" = {
|
||||||
device = "/dev/sda1";
|
device = "/dev/sda1";
|
||||||
fsType = "ext4";
|
fsType = "ext4";
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,11 @@
|
||||||
{ modulesPath, tree, config, pkgs, lib, ... }:
|
|
||||||
|
|
||||||
{
|
{
|
||||||
|
modulesPath,
|
||||||
|
tree,
|
||||||
|
config,
|
||||||
|
pkgs,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
imports = with tree; [
|
imports = with tree; [
|
||||||
users.root
|
users.root
|
||||||
|
|
||||||
|
|
@ -19,7 +24,6 @@
|
||||||
hosts.hetzner-vm.profiles.mpd
|
hosts.hetzner-vm.profiles.mpd
|
||||||
hosts.hetzner-vm.profiles.mailserver
|
hosts.hetzner-vm.profiles.mailserver
|
||||||
hosts.hetzner-vm.profiles.gitlab-static-sites
|
hosts.hetzner-vm.profiles.gitlab-static-sites
|
||||||
#hosts.hetzner-vm.profiles.lappy-dev
|
|
||||||
hosts.hetzner-vm.profiles.misskey
|
hosts.hetzner-vm.profiles.misskey
|
||||||
hosts.hetzner-vm.profiles.wireguard
|
hosts.hetzner-vm.profiles.wireguard
|
||||||
|
|
||||||
|
|
@ -28,10 +32,10 @@
|
||||||
./secrets.nix
|
./secrets.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
networking.firewall.allowedTCPPorts = [80 443];
|
||||||
|
|
||||||
home-manager.users.root = {
|
home-manager.users.root = {
|
||||||
imports = with tree; [ home.base home.dev.small ];
|
imports = with tree; [home.base home.dev.small];
|
||||||
home.stateVersion = "22.05";
|
home.stateVersion = "22.05";
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
@ -40,4 +44,3 @@
|
||||||
|
|
||||||
system.stateVersion = "22.05";
|
system.stateVersion = "22.05";
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,16 +1,20 @@
|
||||||
{ config, lib, ... }:
|
{
|
||||||
with lib;
|
config,
|
||||||
let cfg = config.mailserver;
|
lib,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
with lib; let
|
||||||
|
cfg = config.mailserver;
|
||||||
in {
|
in {
|
||||||
options.mailserver = {
|
options.mailserver = {
|
||||||
enable = mkEnableOption "mailserver";
|
enable = mkEnableOption "mailserver";
|
||||||
|
|
||||||
fqdn = mkOption { type = types.str; };
|
fqdn = mkOption {type = types.str;};
|
||||||
|
|
||||||
domains = mkOption { type = types.listOf types.str; };
|
domains = mkOption {type = types.listOf types.str;};
|
||||||
|
|
||||||
ssl_config = mkOption {
|
ssl_config = mkOption {
|
||||||
type = (types.submodule {
|
type = types.submodule {
|
||||||
options = {
|
options = {
|
||||||
useACME = mkOption {
|
useACME = mkOption {
|
||||||
type = types.bool;
|
type = types.bool;
|
||||||
|
|
@ -25,8 +29,8 @@ in {
|
||||||
default = "/var/lib/acme/${cfg.fqdn}/key.pem";
|
default = "/var/lib/acme/${cfg.fqdn}/key.pem";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
});
|
};
|
||||||
default = { };
|
default = {};
|
||||||
};
|
};
|
||||||
|
|
||||||
debug_mode = mkOption {
|
debug_mode = mkOption {
|
||||||
|
|
@ -46,23 +50,33 @@ in {
|
||||||
|
|
||||||
accounts = mkOption {
|
accounts = mkOption {
|
||||||
# where name = email for login
|
# where name = email for login
|
||||||
type = types.attrsOf (types.submodule ({ config, name, ... }: {
|
type = types.attrsOf (types.submodule ({
|
||||||
|
config,
|
||||||
|
name,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
options = {
|
options = {
|
||||||
name = mkOption {
|
name = mkOption {
|
||||||
type = types.str;
|
type = types.str;
|
||||||
default = name;
|
default = name;
|
||||||
};
|
};
|
||||||
passwordFile = mkOption { type = types.str; };
|
passwordFile = mkOption {type = types.str;};
|
||||||
aliases = mkOption { type = types.listOf types.str; };
|
aliases = mkOption {type = types.listOf types.str;};
|
||||||
sieveScript = mkOption { type = types.nullOr types.lines; };
|
sieveScript = mkOption {type = types.nullOr types.lines;};
|
||||||
};
|
};
|
||||||
}));
|
}));
|
||||||
};
|
};
|
||||||
|
|
||||||
|
extra_aliases_file = mkOption {
|
||||||
|
type = types.nullOr types.str;
|
||||||
|
default = null;
|
||||||
|
};
|
||||||
|
|
||||||
sieve_directory = mkOption {
|
sieve_directory = mkOption {
|
||||||
type = types.str;
|
type = types.str;
|
||||||
default = "/var/sieve";
|
default = "/var/sieve";
|
||||||
};
|
};
|
||||||
|
|
||||||
dkim_directory = mkOption {
|
dkim_directory = mkOption {
|
||||||
type = types.str;
|
type = types.str;
|
||||||
default = "/var/dkim";
|
default = "/var/dkim";
|
||||||
|
|
@ -79,23 +93,31 @@ in {
|
||||||
};
|
};
|
||||||
|
|
||||||
vmail_config = mkOption {
|
vmail_config = mkOption {
|
||||||
type = (types.submodule {
|
type = types.submodule {
|
||||||
options = {
|
options = {
|
||||||
user_group_name = mkOption {
|
user = mkOption {
|
||||||
type = types.str;
|
type = types.str;
|
||||||
default = "vmail";
|
default = "vmail";
|
||||||
};
|
};
|
||||||
user_group_id = mkOption {
|
group = mkOption {
|
||||||
|
type = types.str;
|
||||||
|
default = "${cfg.vmail_config.user}";
|
||||||
|
};
|
||||||
|
user_id = mkOption {
|
||||||
type = types.number;
|
type = types.number;
|
||||||
default = 5000;
|
default = 5000;
|
||||||
};
|
};
|
||||||
|
group_id = mkOption {
|
||||||
|
type = types.number;
|
||||||
|
default = cfg.vmail_config.user_id;
|
||||||
|
};
|
||||||
directory = mkOption {
|
directory = mkOption {
|
||||||
type = types.str;
|
type = types.str;
|
||||||
default = "/home/${cfg.vmail_config.user_group_name}";
|
default = "/home/${cfg.vmail_config.user}";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
});
|
};
|
||||||
default = { };
|
default = {};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,13 +1,20 @@
|
||||||
{ config, pkgs, lib, ... }:
|
{
|
||||||
let
|
config,
|
||||||
|
pkgs,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
mail_config = config.mailserver;
|
mail_config = config.mailserver;
|
||||||
|
|
||||||
|
vmail_config = mail_config.vmail_config;
|
||||||
|
|
||||||
passwdDir = "/run/dovecot2";
|
passwdDir = "/run/dovecot2";
|
||||||
passwdFile = "${passwdDir}/passwd";
|
passwdFile = "${passwdDir}/passwd";
|
||||||
|
|
||||||
bool2int = x: if x then "1" else "0";
|
bool2int = x:
|
||||||
|
if x
|
||||||
# maildir in format "/${domain}/${user}"
|
then "1"
|
||||||
dovecotMaildir = "maildir:${mail_config.vmail_config.directory}/%d/%n";
|
else "0";
|
||||||
|
|
||||||
postfixCfg = config.services.postfix;
|
postfixCfg = config.services.postfix;
|
||||||
dovecot2Cfg = config.services.dovecot2;
|
dovecot2Cfg = config.services.dovecot2;
|
||||||
|
|
@ -29,7 +36,7 @@ let
|
||||||
|
|
||||||
for f in ${
|
for f in ${
|
||||||
builtins.toString
|
builtins.toString
|
||||||
(lib.mapAttrsToList (name: value: passwordFiles."${name}")
|
(lib.mapAttrsToList (name: value: value.passwordFile)
|
||||||
mail_config.accounts)
|
mail_config.accounts)
|
||||||
}; do
|
}; do
|
||||||
if [ ! -f "$f" ]; then
|
if [ ! -f "$f" ]; then
|
||||||
|
|
@ -39,13 +46,10 @@ let
|
||||||
done
|
done
|
||||||
|
|
||||||
cat <<EOF > ${passwdFile}
|
cat <<EOF > ${passwdFile}
|
||||||
${lib.concatStringsSep "\n" (lib.mapAttrsToList (name: value:
|
${
|
||||||
"${name}:${"$(head -n 1 ${passwordFiles."${name}"})"}:${
|
lib.concatStringsSep "\n"
|
||||||
builtins.toString mail_config.vmail_config.user_group_id
|
(lib.mapAttrsToList (name: value: "${name}:$(head -n 1 ${value.passwordFile})") mail_config.accounts)
|
||||||
}:${
|
}
|
||||||
builtins.toString mail_config.vmail_config.user_group_id
|
|
||||||
}::${mail_config.vmail_config.directory}:/run/current-system/sw/bin/nologin:")
|
|
||||||
mail_config.accounts)}
|
|
||||||
EOF
|
EOF
|
||||||
|
|
||||||
chmod 600 ${passwdFile}
|
chmod 600 ${passwdFile}
|
||||||
|
|
@ -54,7 +58,7 @@ let
|
||||||
pipeBin = pkgs.stdenv.mkDerivation {
|
pipeBin = pkgs.stdenv.mkDerivation {
|
||||||
name = "pipe_bin";
|
name = "pipe_bin";
|
||||||
src = ./pipe_bin;
|
src = ./pipe_bin;
|
||||||
buildInputs = with pkgs; [ makeWrapper coreutils bash rspamd ];
|
buildInputs = with pkgs; [makeWrapper coreutils bash rspamd];
|
||||||
buildCommand = ''
|
buildCommand = ''
|
||||||
mkdir -p $out/pipe/bin
|
mkdir -p $out/pipe/bin
|
||||||
cp $src/* $out/pipe/bin/
|
cp $src/* $out/pipe/bin/
|
||||||
|
|
@ -68,21 +72,25 @@ let
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
in {
|
in {
|
||||||
config = (lib.mkIf (mail_config.enable) {
|
config = lib.mkIf (mail_config.enable) {
|
||||||
services.dovecot2 = {
|
services.dovecot2 = {
|
||||||
enable = true;
|
enable = true;
|
||||||
enableImap = true;
|
enableImap = true;
|
||||||
enablePop3 = false;
|
enableLmtp = true;
|
||||||
enablePAM = false;
|
|
||||||
enableQuota = true;
|
enableQuota = true;
|
||||||
mailGroup = mail_config.vmail_config.user_group_name;
|
enablePop3 = false;
|
||||||
mailUser = mail_config.vmail_config.user_group_name;
|
enablePAM = false; # Not using PAM for Auth
|
||||||
mailLocation = dovecotMaildir;
|
|
||||||
|
mailUser = vmail_config.user;
|
||||||
|
mailGroup = vmail_config.group;
|
||||||
|
mailLocation = "maildir:${vmail_config.directory}/%d/%n";
|
||||||
|
|
||||||
sslServerCert = mail_config.ssl_config.cert;
|
sslServerCert = mail_config.ssl_config.cert;
|
||||||
sslServerKey = mail_config.ssl_config.key;
|
sslServerKey = mail_config.ssl_config.key;
|
||||||
enableLmtp = true;
|
|
||||||
modules = [ pkgs.dovecot_pigeonhole ];
|
# For Sieve
|
||||||
protocols = [ "sieve" ];
|
modules = with pkgs; [dovecot_pigeonhole];
|
||||||
|
protocols = ["sieve"];
|
||||||
|
|
||||||
sieveScripts = {
|
sieveScripts = {
|
||||||
after = builtins.toFile "spam.sieve" ''
|
after = builtins.toFile "spam.sieve" ''
|
||||||
|
|
@ -136,7 +144,6 @@ in {
|
||||||
mail_plugins = $mail_plugins imap_sieve
|
mail_plugins = $mail_plugins imap_sieve
|
||||||
}
|
}
|
||||||
|
|
||||||
mail_access_groups = "${mail_config.vmail_config.user_group_name}"
|
|
||||||
ssl = required
|
ssl = required
|
||||||
ssl_min_protocol = TLSv1.2
|
ssl_min_protocol = TLSv1.2
|
||||||
ssl_prefer_server_ciphers = yes
|
ssl_prefer_server_ciphers = yes
|
||||||
|
|
@ -156,12 +163,14 @@ in {
|
||||||
mail_plugins = $mail_plugins sieve
|
mail_plugins = $mail_plugins sieve
|
||||||
}
|
}
|
||||||
|
|
||||||
passdb {
|
mail_access_groups = "${vmail_config.group}"
|
||||||
driver = passwd-file
|
|
||||||
args = ${passwdFile}
|
|
||||||
}
|
|
||||||
|
|
||||||
userdb {
|
userdb {
|
||||||
|
driver = static
|
||||||
|
args = uid=${toString vmail_config.user_id} gid=${toString vmail_config.group_id}
|
||||||
|
}
|
||||||
|
|
||||||
|
passdb {
|
||||||
driver = passwd-file
|
driver = passwd-file
|
||||||
args = ${passwdFile}
|
args = ${passwdFile}
|
||||||
}
|
}
|
||||||
|
|
@ -212,6 +221,6 @@ in {
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.services.postfix.restartTriggers = [ genPasswdScript ];
|
systemd.services.postfix.restartTriggers = [genPasswdScript];
|
||||||
});
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,18 +1,26 @@
|
||||||
{ ... }: {
|
{
|
||||||
networking.firewall = {
|
lib,
|
||||||
allowedTCPPorts = [
|
config,
|
||||||
# SMTP
|
...
|
||||||
25
|
}: let
|
||||||
# Submission
|
mail_config = config.mailserver;
|
||||||
587
|
in {
|
||||||
# Submission w/ SSL
|
config = lib.mkIf config.mailserver.enable {
|
||||||
465
|
networking.firewall = {
|
||||||
# IMAP
|
allowedTCPPorts = [
|
||||||
143
|
# SMTP
|
||||||
# IMAP w/ SSL
|
25
|
||||||
993
|
# Submission
|
||||||
# Sieve
|
587
|
||||||
4190
|
# Submission w/ SSL
|
||||||
];
|
465
|
||||||
|
# IMAP
|
||||||
|
143
|
||||||
|
# IMAP w/ SSL
|
||||||
|
993
|
||||||
|
# Sieve
|
||||||
|
4190
|
||||||
|
];
|
||||||
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,10 @@
|
||||||
{ config, lib, pkgs, ... }:
|
{
|
||||||
let
|
config,
|
||||||
|
lib,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
with lib; let
|
||||||
mail_config = config.mailserver;
|
mail_config = config.mailserver;
|
||||||
dkimUser = config.services.opendkim.user;
|
dkimUser = config.services.opendkim.user;
|
||||||
dkimGroup = config.services.opendkim.group;
|
dkimGroup = config.services.opendkim.group;
|
||||||
|
|
@ -9,69 +14,71 @@ let
|
||||||
|
|
||||||
domains = mail_config.domains;
|
domains = mail_config.domains;
|
||||||
|
|
||||||
createDomainDkimCert = dom:
|
createDomainDkimCert = dom: let
|
||||||
let
|
dkim_key = "${keyDir}/${dom}.${selector}.key";
|
||||||
dkim_key = "${keyDir}/${dom}.${selector}.key";
|
dkim_txt = "${keyDir}/${dom}.${selector}.txt";
|
||||||
dkim_txt = "${keyDir}/${dom}.${selector}.txt";
|
in ''
|
||||||
in ''
|
if [ ! -f "${dkim_key}" ]
|
||||||
if [ ! -f "${dkim_key}" ]
|
then
|
||||||
then
|
${pkgs.opendkim}/bin/opendkim-genkey -s "${selector}" \
|
||||||
${pkgs.opendkim}/bin/opendkim-genkey -s "${selector}" \
|
-d "${dom}" \
|
||||||
-d "${dom}" \
|
--bits="1024" \
|
||||||
--bits="1024" \
|
--directory="${keyDir}"
|
||||||
--directory="${keyDir}"
|
mv "${keyDir}/${selector}.private" "${dkim_key}"
|
||||||
mv "${keyDir}/${selector}.private" "${dkim_key}"
|
mv "${keyDir}/${selector}.txt" "${dkim_txt}"
|
||||||
mv "${keyDir}/${selector}.txt" "${dkim_txt}"
|
echo "Generated key for domain ${dom} selector ${selector}"
|
||||||
echo "Generated key for domain ${dom} selector ${selector}"
|
fi
|
||||||
fi
|
'';
|
||||||
'';
|
|
||||||
|
|
||||||
createAllCerts =
|
createAllCerts =
|
||||||
lib.concatStringsSep "\n" (map createDomainDkimCert mail_config.domains);
|
concatStringsSep "\n" (map createDomainDkimCert mail_config.domains);
|
||||||
|
|
||||||
keyTable = pkgs.writeText "opendkim-KeyTable" (lib.concatStringsSep "\n"
|
keyTable = pkgs.writeText "opendkim-KeyTable" (concatStringsSep "\n"
|
||||||
(lib.flip map domains
|
(flip map domains
|
||||||
(dom: "${dom} ${dom}:${selector}:${keyDir}/${dom}.${selector}.key")));
|
(dom: "${dom} ${dom}:${selector}:${keyDir}/${dom}.${selector}.key")));
|
||||||
|
|
||||||
signingTable = pkgs.writeText "opendkim-SigningTable"
|
signingTable =
|
||||||
(lib.concatStringsSep "\n" (lib.flip map domains (dom: "${dom} ${dom}")));
|
pkgs.writeText "opendkim-SigningTable"
|
||||||
|
(concatStringsSep "\n" (flip map domains (dom: "${dom} ${dom}")));
|
||||||
|
|
||||||
dkim = config.services.opendkim;
|
dkim = config.services.opendkim;
|
||||||
args = [ "-f" "-l" ]
|
args =
|
||||||
++ lib.optionals (dkim.configFile != null) [ "-x" dkim.configFile ];
|
["-f" "-l"]
|
||||||
|
++ optionals (dkim.configFile != null) ["-x" dkim.configFile];
|
||||||
in {
|
in {
|
||||||
config = (lib.mkIf (mail_config.enable) {
|
config = mkIf (mail_config.enable) {
|
||||||
services.opendkim = {
|
services.opendkim = {
|
||||||
enable = true;
|
enable = true;
|
||||||
selector = selector;
|
selector = selector;
|
||||||
keyPath = keyDir;
|
keyPath = keyDir;
|
||||||
domains = "csl:${builtins.concatStringsSep "," domains}";
|
domains = "csl:${builtins.concatStringsSep "," domains}";
|
||||||
configFile = pkgs.writeText "opendkim.conf" (''
|
configFile = pkgs.writeText "opendkim.conf" (''
|
||||||
Canonicalization relaxed/relaxed
|
Canonicalization relaxed/relaxed
|
||||||
UMask 0002
|
UMask 0002
|
||||||
Socket ${dkim.socket}
|
Socket ${dkim.socket}
|
||||||
KeyTable file:${keyTable}
|
KeyTable file:${keyTable}
|
||||||
SigningTable file:${signingTable}
|
SigningTable file:${signingTable}
|
||||||
'' + (lib.optionalString mail_config.debug_mode ''
|
''
|
||||||
Syslog yes
|
+ (optionalString mail_config.debug_mode ''
|
||||||
SyslogSuccess yes
|
Syslog yes
|
||||||
LogWhy yes
|
SyslogSuccess yes
|
||||||
''));
|
LogWhy yes
|
||||||
|
''));
|
||||||
};
|
};
|
||||||
|
|
||||||
users.users =
|
users.users = optionalAttrs (config.services.postfix.user == "postfix") {
|
||||||
lib.optionalAttrs (config.services.postfix.user == "postfix") {
|
postfix.extraGroups = ["${dkimGroup}"];
|
||||||
postfix.extraGroups = [ "${dkimGroup}" ];
|
};
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services.opendkim = {
|
systemd.services.opendkim = {
|
||||||
preStart = lib.mkForce createAllCerts;
|
preStart = mkForce createAllCerts;
|
||||||
serviceConfig = {
|
serviceConfig = {
|
||||||
ExecStart = lib.mkForce
|
ExecStart =
|
||||||
"${pkgs.opendkim}/bin/opendkim ${lib.escapeShellArgs args}";
|
mkForce
|
||||||
PermissionsStartOnly = lib.mkForce false;
|
"${pkgs.opendkim}/bin/opendkim ${escapeShellArgs args}";
|
||||||
|
PermissionsStartOnly = mkForce false;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
systemd.tmpfiles.rules = [ "d '${keyDir}' - ${dkimUser} ${dkimGroup} - -" ];
|
systemd.tmpfiles.rules = ["d '${keyDir}' - ${dkimUser} ${dkimGroup} - -"];
|
||||||
});
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,16 +1,18 @@
|
||||||
{ config, pkgs, lib, ... }:
|
{
|
||||||
|
config,
|
||||||
let
|
pkgs,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
mail_config = config.mailserver;
|
mail_config = config.mailserver;
|
||||||
submissionHeaderCleanupRules =
|
submissionHeaderCleanupRules = pkgs.writeText "submission_header_cleanup_rules" ''
|
||||||
pkgs.writeText "submission_header_cleanup_rules" (''
|
/^Received:/ IGNORE
|
||||||
/^Received:/ IGNORE
|
/^X-Originating-IP:/ IGNORE
|
||||||
/^X-Originating-IP:/ IGNORE
|
/^X-Mailer:/ IGNORE
|
||||||
/^X-Mailer:/ IGNORE
|
/^User-Agent:/ IGNORE
|
||||||
/^User-Agent:/ IGNORE
|
/^X-Enigmail:/ IGNORE
|
||||||
/^X-Enigmail:/ IGNORE
|
/^Message-ID:\s+<(.*?)@.*?>/ REPLACE Message-ID: <$1@${mail_config.fqdn}>
|
||||||
/^Message-ID:\s+<(.*?)@.*?>/ REPLACE Message-ID: <$1@${mail_config.fqdn}>
|
'';
|
||||||
'');
|
|
||||||
|
|
||||||
inetSocket = addr: port: "inet:[${toString port}@${addr}]";
|
inetSocket = addr: port: "inet:[${toString port}@${addr}]";
|
||||||
unixSocket = sock: "unix:${sock}";
|
unixSocket = sock: "unix:${sock}";
|
||||||
|
|
@ -22,30 +24,29 @@ let
|
||||||
|
|
||||||
# valiases_postfix :: Map String [String]
|
# valiases_postfix :: Map String [String]
|
||||||
valiases_postfix = mergeLookupTables (lib.flatten (lib.mapAttrsToList
|
valiases_postfix = mergeLookupTables (lib.flatten (lib.mapAttrsToList
|
||||||
(name: value:
|
(name: value: let
|
||||||
let to = name;
|
to = name;
|
||||||
in map (from: { "${from}" = to; }) (value.aliases ++ lib.singleton name))
|
in
|
||||||
|
map (from: {"${from}" = to;}) (value.aliases ++ lib.singleton name))
|
||||||
mail_config.accounts));
|
mail_config.accounts));
|
||||||
|
|
||||||
# all_valiases_postfix :: Map String [String]
|
# all_valiases_postfix :: Map String [String]
|
||||||
all_valiases_postfix = mergeLookupTables [ valiases_postfix ];
|
all_valiases_postfix = mergeLookupTables [valiases_postfix];
|
||||||
|
|
||||||
# lookupTableToString :: Map String [String] -> String
|
# lookupTableToString :: Map String [String] -> String
|
||||||
lookupTableToString = attrs:
|
lookupTableToString = attrs: let
|
||||||
let valueToString = value: lib.concatStringsSep ", " value;
|
valueToString = value: lib.concatStringsSep ", " value;
|
||||||
in lib.concatStringsSep "\n"
|
in
|
||||||
|
lib.concatStringsSep "\n"
|
||||||
(lib.mapAttrsToList (name: value: "${name} ${valueToString value}") attrs);
|
(lib.mapAttrsToList (name: value: "${name} ${valueToString value}") attrs);
|
||||||
|
|
||||||
# valiases_file :: Path
|
|
||||||
valiases_file = let
|
|
||||||
content = lookupTableToString (mergeLookupTables [ all_valiases_postfix ]);
|
|
||||||
in builtins.toFile "valias" content;
|
|
||||||
|
|
||||||
# vhosts_file :: Path
|
|
||||||
vhosts_file =
|
vhosts_file =
|
||||||
builtins.toFile "vhosts" (lib.concatStringsSep "\n" mail_config.domains);
|
builtins.toFile "vhosts" (lib.concatStringsSep "\n" mail_config.domains);
|
||||||
vaccounts_file =
|
|
||||||
builtins.toFile "vaccounts" (lookupTableToString all_valiases_postfix);
|
aliases_accounts_file = let
|
||||||
|
content = lookupTableToString (mergeLookupTables [all_valiases_postfix]);
|
||||||
|
in
|
||||||
|
builtins.toFile "aliases_accounts" content;
|
||||||
|
|
||||||
mappedFile = name: "hash:/var/lib/postfix/conf/${name}";
|
mappedFile = name: "hash:/var/lib/postfix/conf/${name}";
|
||||||
|
|
||||||
|
|
@ -61,27 +62,42 @@ let
|
||||||
smtpd_client_restrictions = "permit_sasl_authenticated,reject";
|
smtpd_client_restrictions = "permit_sasl_authenticated,reject";
|
||||||
smtpd_sender_login_maps = "hash:/etc/postfix/vaccounts";
|
smtpd_sender_login_maps = "hash:/etc/postfix/vaccounts";
|
||||||
smtpd_sender_restrictions = "reject_sender_login_mismatch";
|
smtpd_sender_restrictions = "reject_sender_login_mismatch";
|
||||||
smtpd_recipient_restrictions =
|
smtpd_recipient_restrictions = "reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,reject";
|
||||||
"reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,reject";
|
|
||||||
cleanup_service_name = "submission-header-cleanup";
|
cleanup_service_name = "submission-header-cleanup";
|
||||||
};
|
};
|
||||||
|
|
||||||
tls_allowed = "TLSv1.3, TLSv1.2, TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
|
tls_allowed = "TLSv1.3, TLSv1.2, TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
|
||||||
tls_disallow = "MD5, DES, ADH, RC4, PSD, SRP, 3DES, eNULL, aNULL";
|
tls_disallow = "MD5, DES, ADH, RC4, PSD, SRP, 3DES, eNULL, aNULL";
|
||||||
in {
|
in {
|
||||||
config = (lib.mkIf (mail_config.enable) {
|
config = lib.mkIf (mail_config.enable) {
|
||||||
|
systemd.tmpfiles.rules = lib.mkIf (mail_config.extra_aliases_file != null) [
|
||||||
|
# folder to store the extra aliases file
|
||||||
|
"f /run/postfix_extra_aliases 660 root root"
|
||||||
|
];
|
||||||
|
|
||||||
|
systemd.services.postfix-extra-aliases-setup = lib.mkIf (mail_config.extra_aliases_file != null) {
|
||||||
|
wantedBy = ["multi-user.target"];
|
||||||
|
partOf = ["postfix.service"];
|
||||||
|
before = ["postfix-setup.service"];
|
||||||
|
script = ''
|
||||||
|
cat ${aliases_accounts_file} ${mail_config.extra_aliases_file} > /run/postfix_extra_aliases
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
services.postfix = {
|
services.postfix = {
|
||||||
enable = true;
|
enable = true;
|
||||||
hostname = "${mail_config.fqdn}";
|
hostname = "${mail_config.fqdn}";
|
||||||
networksStyle = "host";
|
networksStyle = "host";
|
||||||
mapFiles."valias" = valiases_file;
|
|
||||||
mapFiles."vaccounts" = vaccounts_file;
|
mapFiles."aliases_accounts" =
|
||||||
|
if (mail_config.extra_aliases_file == null)
|
||||||
|
then aliases_accounts_file
|
||||||
|
else "/run/postfix_extra_aliases";
|
||||||
|
|
||||||
sslCert = mail_config.ssl_config.cert;
|
sslCert = mail_config.ssl_config.cert;
|
||||||
sslKey = mail_config.ssl_config.key;
|
sslKey = mail_config.ssl_config.key;
|
||||||
enableSubmission = true;
|
enableSubmission = true;
|
||||||
enableSubmissions = true;
|
enableSubmissions = true;
|
||||||
virtual =
|
|
||||||
lookupTableToString (mergeLookupTables [ all_valiases_postfix ]);
|
|
||||||
|
|
||||||
config = {
|
config = {
|
||||||
# Extra Config
|
# Extra Config
|
||||||
|
|
@ -91,13 +107,12 @@ in {
|
||||||
disable_vrfy_command = true;
|
disable_vrfy_command = true;
|
||||||
message_size_limit = "20971520";
|
message_size_limit = "20971520";
|
||||||
|
|
||||||
virtual_uid_maps =
|
virtual_uid_maps = "static:${toString mail_config.vmail_config.user_id}";
|
||||||
"static:${toString mail_config.vmail_config.user_group_id}";
|
virtual_gid_maps = "static:${toString mail_config.vmail_config.group_id}";
|
||||||
virtual_gid_maps =
|
|
||||||
"static:${toString mail_config.vmail_config.user_group_id}";
|
|
||||||
virtual_mailbox_base = "${mail_config.vmail_config.directory}";
|
virtual_mailbox_base = "${mail_config.vmail_config.directory}";
|
||||||
virtual_mailbox_domains = vhosts_file;
|
virtual_mailbox_domains = vhosts_file;
|
||||||
virtual_mailbox_maps = mappedFile "valias";
|
virtual_mailbox_maps = mappedFile "aliases_accounts";
|
||||||
|
virtual_alias_maps = mappedFile "aliases_accounts";
|
||||||
virtual_transport = "lmtp:unix:/run/dovecot2/dovecot-lmtp";
|
virtual_transport = "lmtp:unix:/run/dovecot2/dovecot-lmtp";
|
||||||
lmtp_destination_recipient_limit = "1";
|
lmtp_destination_recipient_limit = "1";
|
||||||
|
|
||||||
|
|
@ -118,11 +133,7 @@ in {
|
||||||
"check_policy_service unix:private/policy-spf"
|
"check_policy_service unix:private/policy-spf"
|
||||||
];
|
];
|
||||||
|
|
||||||
# TLS settings, inspired by https://github.com/jeaye/nix-files
|
|
||||||
# Submission by mail clients is handled in submissionOptions
|
|
||||||
smtpd_tls_security_level = "may";
|
smtpd_tls_security_level = "may";
|
||||||
|
|
||||||
# strong might suffice and is computationally less expensive
|
|
||||||
smtpd_tls_eecdh_grade = "ultra";
|
smtpd_tls_eecdh_grade = "ultra";
|
||||||
|
|
||||||
# Only Alow Modern TLS
|
# Only Alow Modern TLS
|
||||||
|
|
@ -155,12 +166,10 @@ in {
|
||||||
"unix:/run/opendkim/opendkim.sock"
|
"unix:/run/opendkim/opendkim.sock"
|
||||||
"unix:/run/rspamd/rspamd-milter.sock"
|
"unix:/run/rspamd/rspamd-milter.sock"
|
||||||
];
|
];
|
||||||
non_smtpd_milters = [ "unix:/run/opendkim/opendkim.sock" ];
|
non_smtpd_milters = ["unix:/run/opendkim/opendkim.sock"];
|
||||||
|
|
||||||
milter_protocol = "6";
|
milter_protocol = "6";
|
||||||
milter_mail_macros =
|
milter_mail_macros = "i {mail_addr} {client_addr} {client_name} {auth_type} {auth_authen} {auth_author} {mail_addr} {mail_host} {mail_mailer}";
|
||||||
"i {mail_addr} {client_addr} {client_name} {auth_type} {auth_authen} {auth_author} {mail_addr} {mail_host} {mail_mailer}";
|
|
||||||
|
|
||||||
};
|
};
|
||||||
|
|
||||||
submissionOptions = submissionOptions;
|
submissionOptions = submissionOptions;
|
||||||
|
|
@ -170,7 +179,7 @@ in {
|
||||||
"lmtp" = {
|
"lmtp" = {
|
||||||
# Add headers when delivering, see http://www.postfix.org/smtp.8.html
|
# Add headers when delivering, see http://www.postfix.org/smtp.8.html
|
||||||
# D => Delivered-To, O => X-Original-To, R => Return-Path
|
# D => Delivered-To, O => X-Original-To, R => Return-Path
|
||||||
args = [ "flags=O" ];
|
args = ["flags=O"];
|
||||||
};
|
};
|
||||||
"policy-spf" = {
|
"policy-spf" = {
|
||||||
type = "unix";
|
type = "unix";
|
||||||
|
|
@ -189,9 +198,9 @@ in {
|
||||||
chroot = false;
|
chroot = false;
|
||||||
maxproc = 0;
|
maxproc = 0;
|
||||||
command = "cleanup";
|
command = "cleanup";
|
||||||
args = [ "-o" "header_checks=pcre:${submissionHeaderCleanupRules}" ];
|
args = ["-o" "header_checks=pcre:${submissionHeaderCleanupRules}"];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
});
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,16 +1,17 @@
|
||||||
{ config, pkgs, lib, ... }:
|
{
|
||||||
|
config,
|
||||||
let
|
lib,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
mail_config = config.mailserver;
|
mail_config = config.mailserver;
|
||||||
|
|
||||||
ports = (import ../../ports.nix { });
|
ports = import ../../ports.nix {};
|
||||||
|
|
||||||
postfixCfg = config.services.postfix;
|
postfixCfg = config.services.postfix;
|
||||||
rspamdCfg = config.services.rspamd;
|
rspamdCfg = config.services.rspamd;
|
||||||
rspamdSocket = "rspamd.service";
|
rspamdSocket = "rspamd.service";
|
||||||
in {
|
in {
|
||||||
config = (lib.mkIf (mail_config.enable) {
|
config = lib.mkIf (mail_config.enable) {
|
||||||
|
|
||||||
services.rspamd = {
|
services.rspamd = {
|
||||||
enable = true;
|
enable = true;
|
||||||
debug = mail_config.debug_mode;
|
debug = mail_config.debug_mode;
|
||||||
|
|
@ -51,10 +52,12 @@ in {
|
||||||
|
|
||||||
workers.rspamd_proxy = {
|
workers.rspamd_proxy = {
|
||||||
type = "rspamd_proxy";
|
type = "rspamd_proxy";
|
||||||
bindSockets = [{
|
bindSockets = [
|
||||||
socket = "/run/rspamd/rspamd-milter.sock";
|
{
|
||||||
mode = "0664";
|
socket = "/run/rspamd/rspamd-milter.sock";
|
||||||
}];
|
mode = "0664";
|
||||||
|
}
|
||||||
|
];
|
||||||
count = 1;
|
count = 1;
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
milter = yes;
|
milter = yes;
|
||||||
|
|
@ -69,13 +72,14 @@ in {
|
||||||
workers.controller = {
|
workers.controller = {
|
||||||
type = "controller";
|
type = "controller";
|
||||||
count = 1;
|
count = 1;
|
||||||
bindSockets = [{
|
bindSockets = [
|
||||||
socket = "/run/rspamd/worker-controller.sock";
|
{
|
||||||
mode = "0666";
|
socket = "/run/rspamd/worker-controller.sock";
|
||||||
}];
|
mode = "0666";
|
||||||
includes = [ ];
|
}
|
||||||
|
];
|
||||||
|
includes = [];
|
||||||
};
|
};
|
||||||
|
|
||||||
};
|
};
|
||||||
|
|
||||||
services.redis.servers.rspamd = {
|
services.redis.servers.rspamd = {
|
||||||
|
|
@ -84,16 +88,15 @@ in {
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.services.rspamd = {
|
systemd.services.rspamd = {
|
||||||
requires = [ "redis-rspamd.service" ];
|
requires = ["redis-rspamd.service"];
|
||||||
after = [ "redis-rspamd.service" ];
|
after = ["redis-rspamd.service"];
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.services.postfix = {
|
systemd.services.postfix = {
|
||||||
after = [ rspamdSocket ];
|
after = [rspamdSocket];
|
||||||
requires = [ rspamdSocket ];
|
requires = [rspamdSocket];
|
||||||
};
|
};
|
||||||
|
|
||||||
users.extraUsers.${postfixCfg.user}.extraGroups = [ rspamdCfg.group ];
|
users.extraUsers.${postfixCfg.user}.extraGroups = [rspamdCfg.group];
|
||||||
});
|
};
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,10 +1,12 @@
|
||||||
{ config, pkgs, lib, ... }:
|
{
|
||||||
let
|
config,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
mail_config = config.mailserver;
|
mail_config = config.mailserver;
|
||||||
acmeRoot = "/var/lib/acme/acme-challenge";
|
acmeRoot = "/var/lib/acme/acme-challenge";
|
||||||
|
|
||||||
in {
|
in {
|
||||||
config = (lib.mkIf (mail_config.enable && mail_config.ssl_config.useACME) {
|
config = lib.mkIf (mail_config.enable && mail_config.ssl_config.useACME) {
|
||||||
services.nginx = {
|
services.nginx = {
|
||||||
enable = true;
|
enable = true;
|
||||||
virtualHosts."${mail_config.fqdn}" = {
|
virtualHosts."${mail_config.fqdn}" = {
|
||||||
|
|
@ -17,7 +19,7 @@ in {
|
||||||
};
|
};
|
||||||
|
|
||||||
security.acme.certs."${mail_config.fqdn}" = {
|
security.acme.certs."${mail_config.fqdn}" = {
|
||||||
reloadServices = [ "postfix.service" "dovecot2.service" ];
|
reloadServices = ["postfix.service" "dovecot2.service"];
|
||||||
};
|
};
|
||||||
});
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,63 +1,74 @@
|
||||||
{ config, pkgs, lib, ... }:
|
{
|
||||||
let
|
config,
|
||||||
|
pkgs,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
mail_config = config.mailserver;
|
mail_config = config.mailserver;
|
||||||
|
|
||||||
v = mail_config.vmail_config;
|
vmail_config = mail_config.vmail_config;
|
||||||
|
vmail_user = vmail_config.user;
|
||||||
|
vmail_group = vmail_config.group;
|
||||||
|
|
||||||
sieve_directory = mail_config.sieve_directory;
|
sieve_directory = mail_config.sieve_directory;
|
||||||
|
|
||||||
virtualMailUsersActivationScript =
|
virtualMailUsersActivationScript = pkgs.writeScript "activate-virtual-mail-users" ''
|
||||||
pkgs.writeScript "activate-virtual-mail-users" ''
|
#!${pkgs.stdenv.shell}
|
||||||
#!${pkgs.stdenv.shell}
|
|
||||||
|
|
||||||
set -euo pipefail
|
set -euo pipefail
|
||||||
|
|
||||||
# Create directory to store user sieve scripts if it doesn't exist
|
# Create directory to store user sieve scripts if it doesn't exist
|
||||||
if (! test -d "${sieve_directory}"); then
|
if (! test -d "${sieve_directory}"); then
|
||||||
mkdir "${sieve_directory}"
|
mkdir "${sieve_directory}"
|
||||||
chown "${v.user_group_name}:${v.user_group_name}" "${sieve_directory}"
|
chown "${vmail_user}:${vmail_group}" "${sieve_directory}"
|
||||||
chmod 770 "${sieve_directory}"
|
chmod 770 "${sieve_directory}"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# Copy user's sieve script to the correct location (if it exists). If it
|
|
||||||
# is null, remove the file.
|
|
||||||
${lib.concatMapStringsSep "\n" ({ name, sieveScript }:
|
|
||||||
if lib.isString sieveScript then ''
|
|
||||||
if (! test -d "${sieve_directory}/${name}"); then
|
|
||||||
mkdir -p "${sieve_directory}/${name}"
|
|
||||||
chown "${v.user_group_name}:${v.user_group_name}" "${sieve_directory}/${name}"
|
|
||||||
chmod 770 "${sieve_directory}/${name}"
|
|
||||||
fi
|
|
||||||
cat << 'EOF' > "${sieve_directory}/${name}/default.sieve"
|
|
||||||
${sieveScript}
|
|
||||||
EOF
|
|
||||||
chown "${v.user_group_name}:${v.user_group_name}" "${sieve_directory}/${name}/default.sieve"
|
|
||||||
'' else ''
|
|
||||||
if (test -f "${sieve_directory}/${name}/default.sieve"); then
|
|
||||||
rm "${sieve_directory}/${name}/default.sieve"
|
|
||||||
fi
|
|
||||||
if (test -f "${sieve_directory}/${name}.svbin"); then
|
|
||||||
rm "${sieve_directory}/${name}/default.svbin"
|
|
||||||
fi
|
|
||||||
'') (map (user: { inherit (user) name sieveScript; })
|
|
||||||
(lib.attrValues mail_config.accounts))}
|
|
||||||
'';
|
|
||||||
|
|
||||||
|
# Copy user's sieve script to the correct location (if it exists). If it
|
||||||
|
# is null, remove the file.
|
||||||
|
${lib.concatMapStringsSep "\n" ({
|
||||||
|
name,
|
||||||
|
sieveScript,
|
||||||
|
}:
|
||||||
|
if lib.isString sieveScript
|
||||||
|
then ''
|
||||||
|
if (! test -d "${sieve_directory}/${name}"); then
|
||||||
|
mkdir -p "${sieve_directory}/${name}"
|
||||||
|
chown "${vmail_user}:${vmail_group}" "${sieve_directory}/${name}"
|
||||||
|
chmod 770 "${sieve_directory}/${name}"
|
||||||
|
fi
|
||||||
|
cat << 'EOF' > "${sieve_directory}/${name}/default.sieve"
|
||||||
|
${sieveScript}
|
||||||
|
EOF
|
||||||
|
chown "${vmail_user}:${vmail_group}" "${sieve_directory}/${name}/default.sieve"
|
||||||
|
''
|
||||||
|
else ''
|
||||||
|
if (test -f "${sieve_directory}/${name}/default.sieve"); then
|
||||||
|
rm "${sieve_directory}/${name}/default.sieve"
|
||||||
|
fi
|
||||||
|
if (test -f "${sieve_directory}/${name}.svbin"); then
|
||||||
|
rm "${sieve_directory}/${name}/default.svbin"
|
||||||
|
fi
|
||||||
|
'') (map (user: {inherit (user) name sieveScript;})
|
||||||
|
(lib.attrValues mail_config.accounts))}
|
||||||
|
'';
|
||||||
in {
|
in {
|
||||||
config = (lib.mkIf (mail_config.enable) {
|
config = lib.mkIf (mail_config.enable) {
|
||||||
users.users."${v.user_group_name}" = {
|
users.users."${vmail_user}" = {
|
||||||
name = "${v.user_group_name}";
|
|
||||||
isSystemUser = true;
|
isSystemUser = true;
|
||||||
uid = v.user_group_id;
|
|
||||||
home = v.directory;
|
home = vmail_config.directory;
|
||||||
createHome = true;
|
createHome = true;
|
||||||
group = "${v.user_group_name}";
|
|
||||||
|
uid = vmail_config.user_id;
|
||||||
|
group = "${vmail_group}";
|
||||||
};
|
};
|
||||||
users.groups."${v.user_group_name}" = { gid = v.user_group_id; };
|
users.groups."${vmail_group}" = {gid = vmail_config.group_id;};
|
||||||
systemd.services.activate-virtual-mail-users = {
|
systemd.services.activate-virtual-mail-users = {
|
||||||
wantedBy = [ "multi-user.target" ];
|
wantedBy = ["multi-user.target"];
|
||||||
before = [ "dovecot2.service" ];
|
before = ["dovecot2.service"];
|
||||||
serviceConfig = { ExecStart = virtualMailUsersActivationScript; };
|
serviceConfig = {ExecStart = virtualMailUsersActivationScript;};
|
||||||
enable = true;
|
enable = true;
|
||||||
};
|
};
|
||||||
});
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,7 +1,11 @@
|
||||||
{ config, lib, ... }:
|
{
|
||||||
let mail_config = config.mailserver;
|
config,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
|
mail_config = config.mailserver;
|
||||||
in {
|
in {
|
||||||
config = (lib.mkIf (mail_config.enable && mail_config.enable_roundcube) {
|
config = lib.mkIf (mail_config.enable && mail_config.enable_roundcube) {
|
||||||
services.roundcube = {
|
services.roundcube = {
|
||||||
enable = true;
|
enable = true;
|
||||||
hostName = "${mail_config.roundcube_url}";
|
hostName = "${mail_config.roundcube_url}";
|
||||||
|
|
@ -14,5 +18,5 @@ in {
|
||||||
${mail_config.extra_roundcube_config}
|
${mail_config.extra_roundcube_config}
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
});
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,58 +1,69 @@
|
||||||
{ config, lib, pkgs, ... }:
|
{
|
||||||
with lib;
|
config,
|
||||||
let
|
lib,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
with lib; let
|
||||||
cfg = config.services.piped;
|
cfg = config.services.piped;
|
||||||
|
|
||||||
backend_config = {
|
backend_config =
|
||||||
PORT = cfg.internalBackendPort;
|
{
|
||||||
HTTP_WORKERS = cfg.httpWorkers;
|
PORT = cfg.internalBackendPort;
|
||||||
PROXY_PART = "https://${cfg.proxyDomain}";
|
HTTP_WORKERS = cfg.httpWorkers;
|
||||||
API_URL = "https://${cfg.backendDomain}";
|
PROXY_PART = "https://${cfg.proxyDomain}";
|
||||||
FRONTEND_URL = "https://${cfg.frontendDomain}";
|
API_URL = "https://${cfg.backendDomain}";
|
||||||
DISABLE_REGISTRATION = cfg.disableRegistrations;
|
FRONTEND_URL = "https://${cfg.frontendDomain}";
|
||||||
COMPROMISED_PASSWORD_CHECK = cfg.enableCompromisedPasswordCheck;
|
DISABLE_REGISTRATION = cfg.disableRegistrations;
|
||||||
FEED_RETENTION = cfg.feedRetentionDays;
|
COMPROMISED_PASSWORD_CHECK = cfg.enableCompromisedPasswordCheck;
|
||||||
SUBSCRIPTIONS_EXPIRY = cfg.subscriptionRetentionDays;
|
FEED_RETENTION = cfg.feedRetentionDays;
|
||||||
SPONSORBLOCK_SERVERS = lib.concatStringsSep "," cfg.sponsorblockServers;
|
SUBSCRIPTIONS_EXPIRY = cfg.subscriptionRetentionDays;
|
||||||
DISABLE_RYD = cfg.disableRYD;
|
SPONSORBLOCK_SERVERS = concatStringsSep "," cfg.sponsorblockServers;
|
||||||
DISABLE_LBRY = cfg.disableLBRYStreams;
|
DISABLE_RYD = cfg.disableRYD;
|
||||||
RYD_PROXY_URL = cfg.rydAPIURL;
|
DISABLE_LBRY = cfg.disableLBRYStreams;
|
||||||
SENTRY_DSN = cfg.sentryDSN;
|
RYD_PROXY_URL = cfg.rydAPIURL;
|
||||||
"hibernate.connection.url" = "jdbc:postgresql://localhost:5432/piped";
|
SENTRY_DSN = cfg.sentryDSN;
|
||||||
"hibernate.connection.driver_class" = "org.postgresql.Driver";
|
"hibernate.connection.url" = "jdbc:postgresql://localhost:5432/piped";
|
||||||
"hibernate.dialect" = "org.hibernate.dialect.PostgreSQLDialect";
|
"hibernate.connection.driver_class" = "org.postgresql.Driver";
|
||||||
"hibernate.connection.username" = "piped";
|
"hibernate.dialect" = "org.hibernate.dialect.PostgreSQLDialect";
|
||||||
"hibernate.connection.password" = "password";
|
"hibernate.connection.username" = "piped";
|
||||||
} // (optionalAttrs cfg.enableCaptcha {
|
"hibernate.connection.password" = "password";
|
||||||
CAPTCHA_API_URL = cfg.captchaAPIURL;
|
}
|
||||||
# This is substituted in the PreStart of piped-backend.service
|
// (optionalAttrs cfg.enableCaptcha {
|
||||||
CAPTCHA_API_KEY = if cfg.captchaAPIKeyFile != "" then
|
CAPTCHA_API_URL = cfg.captchaAPIURL;
|
||||||
"CAPTCHA_API_KEY_FILE"
|
# This is substituted in the PreStart of piped-backend.service
|
||||||
else
|
CAPTCHA_API_KEY =
|
||||||
cfg.captchaAPIKey;
|
if cfg.captchaAPIKeyFile != ""
|
||||||
}) // (optionalAttrs cfg.enableFederation {
|
then "CAPTCHA_API_KEY_FILE"
|
||||||
MATRIX_SERVER = cfg.matrixServerAddr;
|
else cfg.captchaAPIKey;
|
||||||
# also substituted
|
})
|
||||||
MATRIX_TOKEN = if cfg.matrixTokenFile != "" then
|
// (optionalAttrs cfg.enableFederation {
|
||||||
"MATRIX_TOKEN_FILE"
|
MATRIX_SERVER = cfg.matrixServerAddr;
|
||||||
else
|
# also substituted
|
||||||
cfg.matrixToken;
|
MATRIX_TOKEN =
|
||||||
});
|
if cfg.matrixTokenFile != ""
|
||||||
|
then "MATRIX_TOKEN_FILE"
|
||||||
|
else cfg.matrixToken;
|
||||||
|
});
|
||||||
|
|
||||||
cfgToString = v: if builtins.isBool v then boolToString v else toString v;
|
cfgToString = v:
|
||||||
backend_config_file = pkgs.writeText "config.properties"
|
if builtins.isBool v
|
||||||
|
then boolToString v
|
||||||
|
else toString v;
|
||||||
|
backend_config_file =
|
||||||
|
pkgs.writeText "config.properties"
|
||||||
(concatStringsSep "\n"
|
(concatStringsSep "\n"
|
||||||
(mapAttrsToList (n: v: "${n}:${cfgToString v}") backend_config));
|
(mapAttrsToList (n: v: "${n}:${cfgToString v}") backend_config));
|
||||||
|
|
||||||
in {
|
in {
|
||||||
config = lib.mkIf (cfg.enable && !cfg.disableBackend) {
|
config = lib.mkIf (cfg.enable && !cfg.disableBackend) {
|
||||||
systemd.tmpfiles.rules = [ "d /run/piped-backend - piped piped" ];
|
systemd.tmpfiles.rules = ["d /run/piped-backend - piped piped"];
|
||||||
|
|
||||||
systemd.services.piped-backend = {
|
systemd.services.piped-backend = {
|
||||||
wantedBy = [ "multi-user.target" ];
|
wantedBy = ["multi-user.target"];
|
||||||
serviceConfig = {
|
serviceConfig = {
|
||||||
WorkingDirectory = "/run/piped-backend";
|
WorkingDirectory = "/run/piped-backend";
|
||||||
ExecStartPre = let confFile = "/run/piped-backend/config.properties";
|
ExecStartPre = let
|
||||||
|
confFile = "/run/piped-backend/config.properties";
|
||||||
in "${pkgs.writeShellScript "piped-backend-init" ''
|
in "${pkgs.writeShellScript "piped-backend-init" ''
|
||||||
[ -f "${confFile}" ] && rm ${confFile}
|
[ -f "${confFile}" ] && rm ${confFile}
|
||||||
cp ${backend_config_file} ${confFile}
|
cp ${backend_config_file} ${confFile}
|
||||||
|
|
@ -61,9 +72,9 @@ in {
|
||||||
sed -i "s/CAPTCHA_API_KEY_FILE/$(cat cfg.captchaAPIKeyFile | sed "s#/#\\\/#")/" ${confFile}
|
sed -i "s/CAPTCHA_API_KEY_FILE/$(cat cfg.captchaAPIKeyFile | sed "s#/#\\\/#")/" ${confFile}
|
||||||
''}
|
''}
|
||||||
${optionalString
|
${optionalString
|
||||||
(cfg.enableFederation && cfg.matrixTokenFile != "") ''
|
(cfg.enableFederation && cfg.matrixTokenFile != "") ''
|
||||||
sed -i "s/MATRIX_TOKEN_FILE/$(cat cfg.matrixTokenFile | sed "s#/#\\\/#")/" ${confFile}
|
sed -i "s/MATRIX_TOKEN_FILE/$(cat cfg.matrixTokenFile | sed "s#/#\\\/#")/" ${confFile}
|
||||||
''}
|
''}
|
||||||
''}";
|
''}";
|
||||||
ExecStart = "${pkgs.piped-backend}/bin/piped-backend";
|
ExecStart = "${pkgs.piped-backend}/bin/piped-backend";
|
||||||
|
|
||||||
|
|
@ -76,18 +87,18 @@ in {
|
||||||
ProtectHome = true;
|
ProtectHome = true;
|
||||||
ProtectKernelLogs = true;
|
ProtectKernelLogs = true;
|
||||||
ProtectProc = "invisible";
|
ProtectProc = "invisible";
|
||||||
RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
|
RestrictAddressFamilies = ["AF_UNIX" "AF_INET" "AF_INET6"];
|
||||||
RestrictNamespaces = true;
|
RestrictNamespaces = true;
|
||||||
SystemCallArchitectures = "native";
|
SystemCallArchitectures = "native";
|
||||||
SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
|
SystemCallFilter = ["@system-service" "~@privileged" "~@resources"];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.services.piped-password = {
|
systemd.services.piped-password = {
|
||||||
serviceConfig.Type = "oneshot";
|
serviceConfig.Type = "oneshot";
|
||||||
wantedBy = [ "piped-backend.service" ];
|
wantedBy = ["piped-backend.service"];
|
||||||
wants = [ "postgresql.service" ];
|
wants = ["postgresql.service"];
|
||||||
after = [ "postgresql.service" ];
|
after = ["postgresql.service"];
|
||||||
script = ''
|
script = ''
|
||||||
${pkgs.postgresql}/bin/psql -c "ALTER USER piped WITH PASSWORD 'password';"
|
${pkgs.postgresql}/bin/psql -c "ALTER USER piped WITH PASSWORD 'password';"
|
||||||
'';
|
'';
|
||||||
|
|
@ -96,11 +107,13 @@ in {
|
||||||
|
|
||||||
services.postgresql = {
|
services.postgresql = {
|
||||||
enable = true;
|
enable = true;
|
||||||
ensureUsers = [{
|
ensureUsers = [
|
||||||
name = "piped";
|
{
|
||||||
ensurePermissions."DATABASE piped" = "ALL PRIVILEGES";
|
name = "piped";
|
||||||
}];
|
ensurePermissions."DATABASE piped" = "ALL PRIVILEGES";
|
||||||
ensureDatabases = [ "piped" ];
|
}
|
||||||
|
];
|
||||||
|
ensureDatabases = ["piped"];
|
||||||
};
|
};
|
||||||
|
|
||||||
services.nginx.virtualHosts."${cfg.backendDomain}" = {
|
services.nginx.virtualHosts."${cfg.backendDomain}" = {
|
||||||
|
|
|
||||||
|
|
@ -1,17 +1,22 @@
|
||||||
{ config, lib, pkgs, ... }:
|
{
|
||||||
with lib;
|
config,
|
||||||
let cfg = config.services.piped;
|
lib,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
with lib; let
|
||||||
|
cfg = config.services.piped;
|
||||||
in {
|
in {
|
||||||
options.services.piped = {
|
options.services.piped = {
|
||||||
enable = mkEnableOption "piped";
|
enable = mkEnableOption "piped";
|
||||||
|
|
||||||
frontendDomain = mkOption { type = types.str; };
|
frontendDomain = mkOption {type = types.str;};
|
||||||
backendDomain = mkOption {
|
backendDomain = mkOption {
|
||||||
type = types.nullOr types.str;
|
type = types.nullOr types.str;
|
||||||
default = null;
|
default = null;
|
||||||
description = "Set to null to use project default backend";
|
description = "Set to null to use project default backend";
|
||||||
};
|
};
|
||||||
proxyDomain = mkOption { type = types.str; };
|
proxyDomain = mkOption {type = types.str;};
|
||||||
#rydProxyDomain = mkOption { type = types.str; };
|
#rydProxyDomain = mkOption { type = types.str; };
|
||||||
|
|
||||||
disableFrontend = mkOption {
|
disableFrontend = mkOption {
|
||||||
|
|
@ -58,8 +63,7 @@ in {
|
||||||
|
|
||||||
sponsorblockServers = mkOption {
|
sponsorblockServers = mkOption {
|
||||||
type = types.listOf types.str;
|
type = types.listOf types.str;
|
||||||
default =
|
default = ["https://sponsor.ajay.app" "https://sponsorblock.kavin.rocks"];
|
||||||
[ "https://sponsor.ajay.app" "https://sponsorblock.kavin.rocks" ];
|
|
||||||
description = "Days subscriptions are stored for unauthenticated users";
|
description = "Days subscriptions are stored for unauthenticated users";
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
@ -72,15 +76,13 @@ in {
|
||||||
disableLBRYStreams = mkOption {
|
disableLBRYStreams = mkOption {
|
||||||
type = types.bool;
|
type = types.bool;
|
||||||
default = false;
|
default = false;
|
||||||
description =
|
description = "Disable showing streams provided by LBRY Youtube Partnership";
|
||||||
"Disable showing streams provided by LBRY Youtube Partnership";
|
|
||||||
};
|
};
|
||||||
|
|
||||||
enableCompromisedPasswordCheck = mkOption {
|
enableCompromisedPasswordCheck = mkOption {
|
||||||
type = types.bool;
|
type = types.bool;
|
||||||
default = true;
|
default = true;
|
||||||
description =
|
description = "Use the haveibeenpwned API to check if user password have been compromised";
|
||||||
"Use the haveibeenpwned API to check if user password have been compromised";
|
|
||||||
};
|
};
|
||||||
|
|
||||||
enableCaptcha = mkOption {
|
enableCaptcha = mkOption {
|
||||||
|
|
@ -174,11 +176,11 @@ in {
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
config = lib.mkIf (cfg.enable && (!cfg.disableBackend || !cfg.disableProxy)) {
|
config = mkIf (cfg.enable && (!cfg.disableBackend || !cfg.disableProxy)) {
|
||||||
users.users."piped" = {
|
users.users."piped" = {
|
||||||
isSystemUser = true;
|
isSystemUser = true;
|
||||||
group = "piped";
|
group = "piped";
|
||||||
};
|
};
|
||||||
users.groups.piped = { };
|
users.groups.piped = {};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,15 +1,19 @@
|
||||||
{ config, lib, pkgs, ... }:
|
{
|
||||||
with lib;
|
config,
|
||||||
let
|
lib,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
with lib; let
|
||||||
cfg = config.services.piped;
|
cfg = config.services.piped;
|
||||||
frontend-package =
|
frontend-package =
|
||||||
(pkgs.piped-frontend.override { backendDomain = cfg.backendDomain; });
|
pkgs.piped-frontend.override {backendDomain = cfg.backendDomain;};
|
||||||
in {
|
in {
|
||||||
config = lib.mkIf (cfg.enable && !cfg.disableFrontend) {
|
config = mkIf (cfg.enable && !cfg.disableFrontend) {
|
||||||
services.nginx.virtualHosts."${cfg.frontendDomain}" = {
|
services.nginx.virtualHosts."${cfg.frontendDomain}" = {
|
||||||
forceSSL = true;
|
forceSSL = true;
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
locations."/" = { root = "${frontend-package}/share/piped-frontend"; };
|
locations."/" = {root = "${frontend-package}/share/piped-frontend";};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,10 @@
|
||||||
{ config, lib, pkgs, ... }:
|
{
|
||||||
with lib;
|
config,
|
||||||
let
|
lib,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
with lib; let
|
||||||
cfg = config.services.piped;
|
cfg = config.services.piped;
|
||||||
|
|
||||||
proxy_nginx_extras = ''
|
proxy_nginx_extras = ''
|
||||||
|
|
@ -23,11 +27,11 @@ let
|
||||||
access_log off;
|
access_log off;
|
||||||
'';
|
'';
|
||||||
in {
|
in {
|
||||||
config = lib.mkIf (cfg.enable && !cfg.disableProxy) {
|
config = mkIf (cfg.enable && !cfg.disableProxy) {
|
||||||
systemd.services.piped-proxy = {
|
systemd.services.piped-proxy = {
|
||||||
wantedBy = [ "multi-user.target" ];
|
wantedBy = ["multi-user.target"];
|
||||||
environment.BIND = "0.0.0.0:${toString cfg.internalProxyPort}";
|
environment.BIND = "0.0.0.0:${toString cfg.internalProxyPort}";
|
||||||
environment.IPV4_ONLY = lib.mkIf cfg.proxyIPv4Only "1";
|
environment.IPV4_ONLY = mkIf cfg.proxyIPv4Only "1";
|
||||||
serviceConfig = {
|
serviceConfig = {
|
||||||
WorkingDirectory = "/run/piped-proxy";
|
WorkingDirectory = "/run/piped-proxy";
|
||||||
ExecStart = "${pkgs.piped-proxy}/bin/piped-proxy";
|
ExecStart = "${pkgs.piped-proxy}/bin/piped-proxy";
|
||||||
|
|
@ -41,10 +45,10 @@ in {
|
||||||
ProtectHome = true;
|
ProtectHome = true;
|
||||||
ProtectKernelLogs = true;
|
ProtectKernelLogs = true;
|
||||||
ProtectProc = "invisible";
|
ProtectProc = "invisible";
|
||||||
RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
|
RestrictAddressFamilies = ["AF_UNIX" "AF_INET" "AF_INET6"];
|
||||||
RestrictNamespaces = true;
|
RestrictNamespaces = true;
|
||||||
SystemCallArchitectures = "native";
|
SystemCallArchitectures = "native";
|
||||||
SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
|
SystemCallFilter = ["@system-service" "~@privileged" "~@resources"];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
@ -53,15 +57,19 @@ in {
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
locations."/" = {
|
locations."/" = {
|
||||||
proxyPass = "http://localhost:${toString cfg.internalProxyPort}";
|
proxyPass = "http://localhost:${toString cfg.internalProxyPort}";
|
||||||
extraConfig = proxy_nginx_extras + ''
|
extraConfig =
|
||||||
add_header Cache-Control "public, max-age=604800";
|
proxy_nginx_extras
|
||||||
'';
|
+ ''
|
||||||
|
add_header Cache-Control "public, max-age=604800";
|
||||||
|
'';
|
||||||
};
|
};
|
||||||
locations."~ (/videoplayback|/api/v4/|/api/manifest/)" = {
|
locations."~ (/videoplayback|/api/v4/|/api/manifest/)" = {
|
||||||
proxyPass = "http://localhost:${toString cfg.internalProxyPort}";
|
proxyPass = "http://localhost:${toString cfg.internalProxyPort}";
|
||||||
extraConfig = proxy_nginx_extras + ''
|
extraConfig =
|
||||||
add_header Cache-Control private always;
|
proxy_nginx_extras
|
||||||
'';
|
+ ''
|
||||||
|
add_header Cache-Control private always;
|
||||||
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -1,9 +1,9 @@
|
||||||
{ ... }: {
|
{...}: {
|
||||||
systemd.services.systemd-networkd-wait-online.enable = false;
|
systemd.services.systemd-networkd-wait-online.enable = false;
|
||||||
|
|
||||||
networking.firewall.enable = true;
|
networking.firewall.enable = true;
|
||||||
networking.firewall.allowPing = true;
|
networking.firewall.allowPing = true;
|
||||||
networking.firewall.allowedTCPPorts = [ 22 ];
|
networking.firewall.allowedTCPPorts = [22];
|
||||||
|
|
||||||
networking.enableIPv6 = true;
|
networking.enableIPv6 = true;
|
||||||
networking.usePredictableInterfaceNames = false;
|
networking.usePredictableInterfaceNames = false;
|
||||||
|
|
@ -12,8 +12,8 @@
|
||||||
enable = true;
|
enable = true;
|
||||||
networks.eth0 = {
|
networks.eth0 = {
|
||||||
name = "eth0";
|
name = "eth0";
|
||||||
address = [ "2a01:4f9:c010:8beb::1/64" ];
|
address = ["2a01:4f9:c010:8beb::1/64"];
|
||||||
gateway = [ "fe80::1" ];
|
gateway = ["fe80::1"];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
{ }: {
|
{}: {
|
||||||
mpd = 6600; # default
|
mpd = 6600; # default
|
||||||
mpd-opus = 8012;
|
mpd-opus = 8012;
|
||||||
mpd-flac = 8013;
|
mpd-flac = 8013;
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,5 @@
|
||||||
{ config, ... }:
|
{config, ...}: let
|
||||||
let secrets = config.services.secrets.secrets;
|
secrets = config.services.secrets.secrets;
|
||||||
in {
|
in {
|
||||||
services.gitlab_artifacts_sync = {
|
services.gitlab_artifacts_sync = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
@ -8,7 +8,7 @@ in {
|
||||||
{
|
{
|
||||||
repoName = "ChaotiCryptidz/VaultUI";
|
repoName = "ChaotiCryptidz/VaultUI";
|
||||||
domain = "vaultui.owo.monster";
|
domain = "vaultui.owo.monster";
|
||||||
domainOptions = { withTryFiles = true; };
|
domainOptions = {withTryFiles = true;};
|
||||||
}
|
}
|
||||||
{
|
{
|
||||||
repoName = "ChaotiCryptidz/music_library_website";
|
repoName = "ChaotiCryptidz/music_library_website";
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,5 @@
|
||||||
{ inputs, pkgs, ... }:
|
{...}: let
|
||||||
let ports = (import ../ports.nix { });
|
ports = import ../ports.nix {};
|
||||||
in {
|
in {
|
||||||
services.invidious = {
|
services.invidious = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
@ -15,14 +15,14 @@ in {
|
||||||
default_user_preferences = {
|
default_user_preferences = {
|
||||||
locale = "en-US";
|
locale = "en-US";
|
||||||
region = "GB";
|
region = "GB";
|
||||||
captions = [ "English (auto-generated)" "English" "" ];
|
captions = ["English (auto-generated)" "English" ""];
|
||||||
dark_mode = true;
|
dark_mode = true;
|
||||||
feed_menu = [ "Subscriptions" "Popular" ];
|
feed_menu = ["Subscriptions" "Popular"];
|
||||||
default_home = "Subscriptions";
|
default_home = "Subscriptions";
|
||||||
max_results = 30;
|
max_results = 30;
|
||||||
annotations = true;
|
annotations = true;
|
||||||
annotations_subscribed = true;
|
annotations_subscribed = true;
|
||||||
comments = [ ];
|
comments = [];
|
||||||
player_style = "invidious";
|
player_style = "invidious";
|
||||||
related_videos = true;
|
related_videos = true;
|
||||||
autoplay = true;
|
autoplay = true;
|
||||||
|
|
|
||||||
|
|
@ -1,10 +0,0 @@
|
||||||
{ ... }: {
|
|
||||||
services.nginx.virtualHosts."lappy-dev.owo.monster" = {
|
|
||||||
forceSSL = true;
|
|
||||||
enableACME = true;
|
|
||||||
locations = {
|
|
||||||
"/".proxyPass =
|
|
||||||
"http://lappy.tailscale-internal.genderfucked.monster:8088";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -1,10 +1,10 @@
|
||||||
{ config, ... }:
|
{config, ...}: let
|
||||||
let secrets = config.services.secrets.secrets;
|
secrets = config.services.secrets.secrets;
|
||||||
in {
|
in {
|
||||||
config.mailserver = {
|
config.mailserver = {
|
||||||
enable = true;
|
enable = true;
|
||||||
fqdn = "mail.owo.monster";
|
fqdn = "mail.owo.monster";
|
||||||
domains = [ "owo.monster" "kitteh.pw" ];
|
domains = ["owo.monster" "kitteh.pw"];
|
||||||
|
|
||||||
debug_mode = true;
|
debug_mode = true;
|
||||||
extra_roundcube_config = ''
|
extra_roundcube_config = ''
|
||||||
|
|
@ -14,6 +14,8 @@ in {
|
||||||
$config['username_domain_forced'] = true;
|
$config['username_domain_forced'] = true;
|
||||||
'';
|
'';
|
||||||
|
|
||||||
|
extra_aliases_file = "/tmp/e";
|
||||||
|
|
||||||
accounts = {
|
accounts = {
|
||||||
"chaos@owo.monster" = {
|
"chaos@owo.monster" = {
|
||||||
name = "chaos@owo.monster";
|
name = "chaos@owo.monster";
|
||||||
|
|
@ -22,7 +24,7 @@ in {
|
||||||
"all@owo.monster"
|
"all@owo.monster"
|
||||||
"chaoticryptidz@owo.monster"
|
"chaoticryptidz@owo.monster"
|
||||||
|
|
||||||
# TODO: legacy - to be deprecated by 2023-01-01
|
# TODO: legacy - to be deprecated by 2023-01-01
|
||||||
"kitteh@owo.monster"
|
"kitteh@owo.monster"
|
||||||
"kitteh@kitteh.pw"
|
"kitteh@kitteh.pw"
|
||||||
];
|
];
|
||||||
|
|
@ -31,13 +33,13 @@ in {
|
||||||
"misskey@owo.monster" = {
|
"misskey@owo.monster" = {
|
||||||
name = "misskey@owo.monster";
|
name = "misskey@owo.monster";
|
||||||
passwordFile = "${secrets.misskey_mail_passwd.path}";
|
passwordFile = "${secrets.misskey_mail_passwd.path}";
|
||||||
aliases = [ ];
|
aliases = [];
|
||||||
sieveScript = null;
|
sieveScript = null;
|
||||||
};
|
};
|
||||||
"system@owo.monster" = {
|
"system@owo.monster" = {
|
||||||
name = "system@owo.monster";
|
name = "system@owo.monster";
|
||||||
passwordFile = "${secrets.system_mail_passwd.path}";
|
passwordFile = "${secrets.system_mail_passwd.path}";
|
||||||
aliases = [ ];
|
aliases = [];
|
||||||
sieveScript = null;
|
sieveScript = null;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,9 @@
|
||||||
{ pkgs, tree, ... }:
|
{
|
||||||
let
|
pkgs,
|
||||||
ports = (import ../ports.nix { });
|
tree,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
|
ports = import ../ports.nix {};
|
||||||
|
|
||||||
misskeyDomain = "social.owo.monster";
|
misskeyDomain = "social.owo.monster";
|
||||||
|
|
||||||
|
|
@ -41,9 +44,9 @@ let
|
||||||
outgoingAddressFamily = "dual";
|
outgoingAddressFamily = "dual";
|
||||||
};
|
};
|
||||||
|
|
||||||
misskeyConfigFile = builtins.toFile "default.yml"
|
misskeyConfigFile =
|
||||||
(pkgs.lib.generators.toYAML { } misskeyConfig);
|
builtins.toFile "default.yml"
|
||||||
|
(pkgs.lib.generators.toYAML {} misskeyConfig);
|
||||||
in {
|
in {
|
||||||
users.users."misskey" = {
|
users.users."misskey" = {
|
||||||
isNormalUser = true;
|
isNormalUser = true;
|
||||||
|
|
@ -54,16 +57,16 @@ in {
|
||||||
home.packages = misskeyPackages;
|
home.packages = misskeyPackages;
|
||||||
home.stateVersion = "22.05";
|
home.stateVersion = "22.05";
|
||||||
|
|
||||||
imports = with tree; [ home.base home.dev.small ];
|
imports = with tree; [home.base home.dev.small];
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.tmpfiles.rules = [ "d /home/misskey/misskey-files - misskey users" ];
|
systemd.tmpfiles.rules = ["d /home/misskey/misskey-files - misskey users"];
|
||||||
|
|
||||||
systemd.services.misskey-files = {
|
systemd.services.misskey-files = {
|
||||||
serviceConfig.Type = "oneshot";
|
serviceConfig.Type = "oneshot";
|
||||||
wantedBy = [ "misskey.service" ];
|
wantedBy = ["misskey.service"];
|
||||||
after = [ "home-manager-misskey.service" "network.target" ];
|
after = ["home-manager-misskey.service" "network.target"];
|
||||||
path = with pkgs; [ bash git rsync ] ++ misskeyPackages;
|
path = with pkgs; [bash git rsync] ++ misskeyPackages;
|
||||||
|
|
||||||
script = ''
|
script = ''
|
||||||
mkdir -p /home/misskey/misskey || true
|
mkdir -p /home/misskey/misskey || true
|
||||||
|
|
@ -85,9 +88,9 @@ in {
|
||||||
|
|
||||||
systemd.services.misskey-password = {
|
systemd.services.misskey-password = {
|
||||||
serviceConfig.Type = "oneshot";
|
serviceConfig.Type = "oneshot";
|
||||||
wantedBy = [ "misskey.service" ];
|
wantedBy = ["misskey.service"];
|
||||||
wants = [ "postgresql.service" ];
|
wants = ["postgresql.service"];
|
||||||
after = [ "postgresql.service" ];
|
after = ["postgresql.service"];
|
||||||
script = ''
|
script = ''
|
||||||
${pkgs.postgresql}/bin/psql -c "ALTER USER misskey WITH PASSWORD 'password';"
|
${pkgs.postgresql}/bin/psql -c "ALTER USER misskey WITH PASSWORD 'password';"
|
||||||
'';
|
'';
|
||||||
|
|
@ -95,17 +98,16 @@ in {
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.services.misskey = {
|
systemd.services.misskey = {
|
||||||
wantedBy = [ "multi-user.target" ];
|
wantedBy = ["multi-user.target"];
|
||||||
after = [ "misskey-password.service" "misskey-files.service" ];
|
after = ["misskey-password.service" "misskey-files.service"];
|
||||||
wants = [ "postgresql.service" "redis-misskey.service" ];
|
wants = ["postgresql.service" "redis-misskey.service"];
|
||||||
path = with pkgs; [ bash git ] ++ misskeyPackages;
|
path = with pkgs; [bash git] ++ misskeyPackages;
|
||||||
environment.NODE_ENV = "production";
|
environment.NODE_ENV = "production";
|
||||||
serviceConfig = {
|
serviceConfig = {
|
||||||
User = "misskey";
|
User = "misskey";
|
||||||
WorkingDirectory = "/home/misskey/misskey";
|
WorkingDirectory = "/home/misskey/misskey";
|
||||||
ExecStartPre = "${pkgs.yarn}/bin/yarn migrate";
|
ExecStartPre = "${pkgs.yarn}/bin/yarn migrate";
|
||||||
ExecStart =
|
ExecStart = "${pkgs.nodejs}/bin/node --experimental-json-modules packages/backend/built/index.js";
|
||||||
"${pkgs.nodejs}/bin/node --experimental-json-modules packages/backend/built/index.js";
|
|
||||||
#TimeoutSec = 60;
|
#TimeoutSec = 60;
|
||||||
#StandardOutput = "syslog";
|
#StandardOutput = "syslog";
|
||||||
#StandardError = "syslog";
|
#StandardError = "syslog";
|
||||||
|
|
@ -127,11 +129,13 @@ in {
|
||||||
|
|
||||||
services.postgresql = {
|
services.postgresql = {
|
||||||
enable = true;
|
enable = true;
|
||||||
ensureUsers = [{
|
ensureUsers = [
|
||||||
name = "misskey";
|
{
|
||||||
ensurePermissions."DATABASE misskey" = "ALL PRIVILEGES";
|
name = "misskey";
|
||||||
}];
|
ensurePermissions."DATABASE misskey" = "ALL PRIVILEGES";
|
||||||
ensureDatabases = [ "misskey" ];
|
}
|
||||||
|
];
|
||||||
|
ensureDatabases = ["misskey"];
|
||||||
initialScript = pkgs.writeText "init" ''
|
initialScript = pkgs.writeText "init" ''
|
||||||
create user misskey with password 'password';
|
create user misskey with password 'password';
|
||||||
grant all privileges on database misskey to misskey;
|
grant all privileges on database misskey to misskey;
|
||||||
|
|
@ -143,4 +147,3 @@ in {
|
||||||
port = ports.misskey-redis;
|
port = ports.misskey-redis;
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,10 +1,10 @@
|
||||||
{ tree, ... }: {
|
{tree, ...}: {
|
||||||
imports = with tree;
|
imports = with tree;
|
||||||
[
|
[
|
||||||
# systemwide pulseaudio w/ recv native localhost
|
# systemwide pulseaudio w/ recv native localhost
|
||||||
# to broadcast to all speakers over rtp
|
# to broadcast to all speakers over rtp
|
||||||
profiles.sound.pulseaudio.pulse-systemwide
|
profiles.sound.pulseaudio.pulse-systemwide
|
||||||
profiles.sound.pulseaudio.pulse-recv-native-localhost
|
profiles.sound.pulseaudio.pulse-recv-native-localhost
|
||||||
] ++ [ ./hosts/lappy.nix ./hosts/raspberry.nix ];
|
]
|
||||||
|
++ [./hosts/lappy.nix ./hosts/raspberry.nix];
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,4 @@
|
||||||
{ pkgs, ... }:
|
{pkgs, ...}: let
|
||||||
let
|
|
||||||
sink_name = "roc-lappy";
|
sink_name = "roc-lappy";
|
||||||
description = "Lappy ROC Output";
|
description = "Lappy ROC Output";
|
||||||
ip_addr = "100.115.10.34";
|
ip_addr = "100.115.10.34";
|
||||||
|
|
@ -12,4 +11,3 @@ in {
|
||||||
}
|
}
|
||||||
'';
|
'';
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,4 @@
|
||||||
{ pkgs, ... }:
|
{pkgs, ...}: let
|
||||||
let
|
|
||||||
sink_name = "roc-raspberry";
|
sink_name = "roc-raspberry";
|
||||||
description = "Raspberry ROC Output";
|
description = "Raspberry ROC Output";
|
||||||
ip_addr = "100.118.202.64";
|
ip_addr = "100.118.202.64";
|
||||||
|
|
|
||||||
|
|
@ -1,18 +1,23 @@
|
||||||
{ config, pkgs, lib, tree, ... }:
|
{
|
||||||
let
|
config,
|
||||||
ports = (import ../ports.nix { });
|
pkgs,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
|
ports = import ../ports.nix {};
|
||||||
secrets = config.services.secrets.secrets;
|
secrets = config.services.secrets.secrets;
|
||||||
in {
|
in {
|
||||||
environment.systemPackages = with pkgs; [ mpc_cli ];
|
environment.systemPackages = with pkgs; [mpc_cli];
|
||||||
|
|
||||||
services.mpd = {
|
services.mpd = {
|
||||||
enable = true;
|
enable = true;
|
||||||
network.listenAddress = "0.0.0.0";
|
network.listenAddress = "0.0.0.0";
|
||||||
musicDirectory = "https://storage-webdav.owo.monster/music_ro/";
|
musicDirectory = "https://storage-webdav.owo.monster/music_ro/";
|
||||||
credentials = [{
|
credentials = [
|
||||||
passwordFile = "${secrets.mpd_control_password.path}";
|
{
|
||||||
permissions = [ "read" "add" "control" "admin" ];
|
passwordFile = "${secrets.mpd_control_password.path}";
|
||||||
}];
|
permissions = ["read" "add" "control" "admin"];
|
||||||
|
}
|
||||||
|
];
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
host_permissions "127.0.0.1 read,add,control,admin"
|
host_permissions "127.0.0.1 read,add,control,admin"
|
||||||
samplerate_converter "0"
|
samplerate_converter "0"
|
||||||
|
|
@ -53,18 +58,18 @@ in {
|
||||||
proxyPass = "http://127.0.0.1:${toString ports.mpd-opus}";
|
proxyPass = "http://127.0.0.1:${toString ports.mpd-opus}";
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
auth_basic "Music Password";
|
auth_basic "Music Password";
|
||||||
auth_basic_user_file ${secrets.music_stream_passwd.path};
|
auth_basic_user_file ${secrets.music_stream_passwd.path};
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
"/flac" = {
|
"/flac" = {
|
||||||
proxyPass = "http://127.0.0.1:${toString ports.mpd-flac}";
|
proxyPass = "http://127.0.0.1:${toString ports.mpd-flac}";
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
auth_basic "Music Password";
|
auth_basic "Music Password";
|
||||||
auth_basic_user_file ${secrets.music_stream_passwd.path};
|
auth_basic_user_file ${secrets.music_stream_passwd.path};
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [ 6600 ];
|
networking.firewall.allowedTCPPorts = [6600];
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,5 @@
|
||||||
{ ... }:
|
{...}: let
|
||||||
let ports = (import ../ports.nix { });
|
ports = import ../ports.nix {};
|
||||||
in {
|
in {
|
||||||
services.piped = {
|
services.piped = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
|
||||||
|
|
@ -1,14 +1,16 @@
|
||||||
_: {
|
{...}: {
|
||||||
services.quassel = {
|
services.quassel = {
|
||||||
enable = true;
|
enable = true;
|
||||||
interfaces = [ "0.0.0.0" ];
|
interfaces = ["0.0.0.0"];
|
||||||
};
|
};
|
||||||
|
|
||||||
services.postgresql.ensureDatabases = [ "quassel" ];
|
services.postgresql.ensureDatabases = ["quassel"];
|
||||||
services.postgresql.ensureUsers = [{
|
services.postgresql.ensureUsers = [
|
||||||
name = "quassel";
|
{
|
||||||
ensurePermissions."DATABASE quassel" = "ALL PRIVILEGES";
|
name = "quassel";
|
||||||
}];
|
ensurePermissions."DATABASE quassel" = "ALL PRIVILEGES";
|
||||||
|
}
|
||||||
|
];
|
||||||
services.postgresql.authentication = "host quassel quassel localhost trust";
|
services.postgresql.authentication = "host quassel quassel localhost trust";
|
||||||
networking.firewall.allowedTCPPorts = [ 4242 ];
|
networking.firewall.allowedTCPPorts = [4242];
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,17 +1,21 @@
|
||||||
{ lib, config, pkgs, ... }:
|
{
|
||||||
let
|
lib,
|
||||||
|
config,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
secrets = config.services.secrets.secrets;
|
secrets = config.services.secrets.secrets;
|
||||||
mail_config = config.mailserver;
|
mail_config = config.mailserver;
|
||||||
|
|
||||||
backupPrepareCommand = "${
|
backupPrepareCommand = "${
|
||||||
(pkgs.writeShellScriptBin "backupPrepareCommand" ''
|
(pkgs.writeShellScriptBin "backupPrepareCommand" ''
|
||||||
systemctl start ${
|
systemctl start ${
|
||||||
lib.concatStringsSep " "
|
lib.concatStringsSep " "
|
||||||
(lib.forEach config.services.postgresqlBackup.databases
|
(lib.forEach config.services.postgresqlBackup.databases
|
||||||
(db: "postgresqlBackup-${db}"))
|
(db: "postgresqlBackup-${db}"))
|
||||||
} --wait
|
} --wait
|
||||||
'')
|
'')
|
||||||
}/bin/backupPrepareCommand";
|
}/bin/backupPrepareCommand";
|
||||||
in {
|
in {
|
||||||
environment.systemPackages = [
|
environment.systemPackages = [
|
||||||
(pkgs.writeShellScriptBin "restic-hetzner-vm" ''
|
(pkgs.writeShellScriptBin "restic-hetzner-vm" ''
|
||||||
|
|
@ -58,7 +62,7 @@ in {
|
||||||
services.postgresqlBackup = {
|
services.postgresqlBackup = {
|
||||||
enable = true;
|
enable = true;
|
||||||
backupAll = false;
|
backupAll = false;
|
||||||
databases = [ "postgres" "invidious" "misskey" "quassel" "roundcube" ];
|
databases = ["postgres" "invidious" "misskey" "quassel" "roundcube"];
|
||||||
compression = "zstd";
|
compression = "zstd";
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,9 +1,9 @@
|
||||||
{ config, ... }:
|
{config, ...}: let
|
||||||
let secrets = config.services.secrets.secrets;
|
secrets = config.services.secrets.secrets;
|
||||||
in {
|
in {
|
||||||
networking.wg-quick.interfaces = {
|
networking.wg-quick.interfaces = {
|
||||||
wg0 = {
|
wg0 = {
|
||||||
address = [ "10.69.42.1/32" ];
|
address = ["10.69.42.1/32"];
|
||||||
listenPort = 51820;
|
listenPort = 51820;
|
||||||
privateKeyFile = "${secrets.wg_privkey.path}";
|
privateKeyFile = "${secrets.wg_privkey.path}";
|
||||||
peers = [
|
peers = [
|
||||||
|
|
@ -11,29 +11,29 @@ in {
|
||||||
{
|
{
|
||||||
publicKey = "jXA0DeprEaL/ARQ3K81l8xWuUI5C/90DcY3bIfcIjz8=";
|
publicKey = "jXA0DeprEaL/ARQ3K81l8xWuUI5C/90DcY3bIfcIjz8=";
|
||||||
presharedKeyFile = "${secrets.wg_preshared_tablet.path}";
|
presharedKeyFile = "${secrets.wg_preshared_tablet.path}";
|
||||||
allowedIPs = [ "10.69.42.2/32" ];
|
allowedIPs = ["10.69.42.2/32"];
|
||||||
}
|
}
|
||||||
# vault
|
# vault
|
||||||
{
|
{
|
||||||
publicKey = "IGq+WanFM/bKNUkwjO/0AAtDhJLvtvU+mVxH27QyHTc=";
|
publicKey = "IGq+WanFM/bKNUkwjO/0AAtDhJLvtvU+mVxH27QyHTc=";
|
||||||
presharedKeyFile = "${secrets.wg_preshared_vault.path}";
|
presharedKeyFile = "${secrets.wg_preshared_vault.path}";
|
||||||
endpoint = "vault.servers.genderfucked.monster:51820";
|
endpoint = "vault.servers.genderfucked.monster:51820";
|
||||||
allowedIPs = [ "10.69.42.3/32" ];
|
allowedIPs = ["10.69.42.3/32"];
|
||||||
}
|
}
|
||||||
# storage
|
# storage
|
||||||
{
|
{
|
||||||
publicKey = "biNNeCkjAWi2jUVoL5+1pBtXGa3OFZi4DltB2dqGjGg=";
|
publicKey = "biNNeCkjAWi2jUVoL5+1pBtXGa3OFZi4DltB2dqGjGg=";
|
||||||
presharedKeyFile = "${secrets.wg_preshared_storage.path}";
|
presharedKeyFile = "${secrets.wg_preshared_storage.path}";
|
||||||
allowedIPs = [ "10.69.42.4/32" ];
|
allowedIPs = ["10.69.42.4/32"];
|
||||||
}
|
}
|
||||||
# iphone8
|
# iphone8
|
||||||
{
|
{
|
||||||
publicKey = "2BgT08bDKh8WlFFSeRArI9a1GpFgUyqEApvJy4KgAmw=";
|
publicKey = "2BgT08bDKh8WlFFSeRArI9a1GpFgUyqEApvJy4KgAmw=";
|
||||||
presharedKeyFile = "${secrets.wg_preshared_iphone8.path}";
|
presharedKeyFile = "${secrets.wg_preshared_iphone8.path}";
|
||||||
allowedIPs = [ "10.69.42.5/32" ];
|
allowedIPs = ["10.69.42.5/32"];
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
networking.firewall.allowedUDPPorts = [ 51820 ];
|
networking.firewall.allowedUDPPorts = [51820];
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,12 +1,11 @@
|
||||||
{ pkgs, ... }: {
|
{pkgs, ...}: {
|
||||||
services.secrets = {
|
services.secrets = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
||||||
extraPackages = with pkgs;
|
extraPackages = with pkgs; [
|
||||||
[
|
# for music & mail passwd files
|
||||||
# for music & mail passwd files
|
apacheHttpd
|
||||||
apacheHttpd
|
];
|
||||||
];
|
|
||||||
|
|
||||||
secrets = {
|
secrets = {
|
||||||
mpd_control_password = {
|
mpd_control_password = {
|
||||||
|
|
@ -16,6 +15,13 @@
|
||||||
simple_get "/api-keys/mpd" .password > $secretFile
|
simple_get "/api-keys/mpd" .password > $secretFile
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
private_mail_aliases = {
|
||||||
|
user = "root";
|
||||||
|
group = "root";
|
||||||
|
fetchScript = ''
|
||||||
|
kv_get "/infra/private-mail-aliases" | jq .data.data | jq -r 'to_entries|map("\(.key) \(.value.to)")[]' > $secretFile
|
||||||
|
'';
|
||||||
|
};
|
||||||
music_stream_passwd = {
|
music_stream_passwd = {
|
||||||
user = "nginx";
|
user = "nginx";
|
||||||
group = "nginx";
|
group = "nginx";
|
||||||
|
|
@ -71,31 +77,31 @@
|
||||||
};
|
};
|
||||||
wg_privkey = {
|
wg_privkey = {
|
||||||
fetchScript = ''
|
fetchScript = ''
|
||||||
simple_get "/private-public-keys/wireguard/chaos-internal/hetzner-vm" .private > $secretFile
|
simple_get "/private-public-keys/wireguard/chaos-internal/hetzner-vm" .private > $secretFile
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
wg_preshared_tablet = {
|
wg_preshared_tablet = {
|
||||||
path = "/secrets/wg_preshared_tablet";
|
path = "/secrets/wg_preshared_tablet";
|
||||||
fetchScript = ''
|
fetchScript = ''
|
||||||
simple_get "/private-public-keys/wireguard/chaos-internal/hetzner-vm" .preshared_keys.tablet > $secretFile
|
simple_get "/private-public-keys/wireguard/chaos-internal/hetzner-vm" .preshared_keys.tablet > $secretFile
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
wg_preshared_vault = {
|
wg_preshared_vault = {
|
||||||
path = "/secrets/wg_preshared_vault";
|
path = "/secrets/wg_preshared_vault";
|
||||||
fetchScript = ''
|
fetchScript = ''
|
||||||
simple_get "/private-public-keys/wireguard/chaos-internal/hetzner-vm" .preshared_keys.vault > $secretFile
|
simple_get "/private-public-keys/wireguard/chaos-internal/hetzner-vm" .preshared_keys.vault > $secretFile
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
wg_preshared_storage = {
|
wg_preshared_storage = {
|
||||||
path = "/secrets/wg_preshared_storage";
|
path = "/secrets/wg_preshared_storage";
|
||||||
fetchScript = ''
|
fetchScript = ''
|
||||||
simple_get "/private-public-keys/wireguard/chaos-internal/hetzner-vm" .preshared_keys.storage > $secretFile
|
simple_get "/private-public-keys/wireguard/chaos-internal/hetzner-vm" .preshared_keys.storage > $secretFile
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
wg_preshared_iphone8 = {
|
wg_preshared_iphone8 = {
|
||||||
path = "/secrets/wg_preshared_iphone8";
|
path = "/secrets/wg_preshared_iphone8";
|
||||||
fetchScript = ''
|
fetchScript = ''
|
||||||
simple_get "/private-public-keys/wireguard/chaos-internal/hetzner-vm" .preshared_keys.iphone8 > $secretFile
|
simple_get "/private-public-keys/wireguard/chaos-internal/hetzner-vm" .preshared_keys.iphone8 > $secretFile
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,8 @@
|
||||||
{ pkgs, tree, ... }: {
|
{
|
||||||
|
pkgs,
|
||||||
|
tree,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
users.users.chaos = {
|
users.users.chaos = {
|
||||||
name = "chaos";
|
name = "chaos";
|
||||||
home = "/Users/chaos";
|
home = "/Users/chaos";
|
||||||
|
|
@ -16,5 +20,4 @@
|
||||||
home.apps.mpv
|
home.apps.mpv
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Reference in a new issue