jahanson/mochi
1
0
Fork 0
Code Issues 1 Pull requests 3 Projects Releases Packages Wiki Activity Actions

statix

Browse source
This commit is contained in:
Joseph Hanson 2024-07-30 18:47:59 -05:00
parent b6132b689e
commit fb545ba987
Signed by: jahanson
SSH key fingerprint: SHA256:vy6dKBECV522aPAwklFM3ReKAVB086rT3oWwiuiFG7o
16 changed files with 314 additions and 264 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
nixos/home/modules/shell/git/default.nix
View file

@ -18,10 +18,10 @@ in
config = lib.mkMerge [ config = lib.mkMerge [
(lib.mkIf cfg.enable { (lib.mkIf cfg.enable {
programs.gh.enable = true; programs = {
programs.gpg.enable = true; gh.enable = true;
gpg.enable = true;
programs.git = { git = {
enable = true; enable = true;
userName = cfg.username; userName = cfg.username;
@ -58,6 +58,7 @@ in
".venv" ".venv"
]; ];
}; };
};
home.packages = [ home.packages = [
pkgs.git-filter-repo pkgs.git-filter-repo

17
nixos/hosts/durincore/default.nix
View file

@ -12,21 +12,26 @@
extraModulePackages = [ ]; extraModulePackages = [ ];
}; };
fileSystems."/" = fileSystems = {
{ device = "rpool/root"; "/" =
{
device = "rpool/root";
fsType = "zfs"; fsType = "zfs";
}; };
fileSystems."/home" = "/home" =
{ device = "rpool/home"; {
device = "rpool/home";
fsType = "zfs"; fsType = "zfs";
}; };
fileSystems."/boot" = "/boot" =
{ device = "/dev/disk/by-uuid/F1B9-CA7C"; {
device = "/dev/disk/by-uuid/F1B9-CA7C";
fsType = "vfat"; fsType = "vfat";
options = [ "fmask=0077" "dmask=0077" ]; options = [ "fmask=0077" "dmask=0077" ];
}; };
};
swapDevices = [ ]; swapDevices = [ ];

18
nixos/hosts/gandalf/default.nix
View file

@ -79,13 +79,17 @@ in
# NFS # NFS
nfs.enable = true; nfs.enable = true;
# Samba # Samba
samba.enable = true; samba = {
samba.shares = import ./config/samba-shares.nix { }; enable = true;
samba.extraConfig = import ./config/samba-config.nix { }; shares = import ./config/samba-shares.nix { };
resticBackup.local.enable = false; extraConfig = import ./config/samba-config.nix { };
resticBackup.remote.enable = false; };
resticBackup.local.noWarning = true; resticBackup = {
resticBackup.remote.noWarning = true; local.enable = false;
remote.enable = false;
local.noWarning = true;
remote.noWarning = true;
};
# Borg # Borg
borgbackup = { borgbackup = {
enable = true; enable = true;

26
nixos/hosts/legiondary/default.nix
View file

@ -5,7 +5,8 @@
{ {
imports = imports =
[ (modulesPath + "/installer/scan/not-detected.nix") [
(modulesPath + "/installer/scan/not-detected.nix")
]; ];
networking.hostId = "2132e3bf"; networking.hostId = "2132e3bf";
@ -17,25 +18,32 @@
extraModulePackages = [ ]; extraModulePackages = [ ];
}; };
fileSystems."/" = fileSystems =
{ device = "zroot/root"; {
"/" =
{
device = "zroot/root";
fsType = "zfs"; fsType = "zfs";
}; };
fileSystems."/nix" = "/nix" =
{ device = "zroot/nix"; {
device = "zroot/nix";
fsType = "zfs"; fsType = "zfs";
}; };
fileSystems."/var" = "/var" =
{ device = "zroot/var"; {
device = "zroot/var";
fsType = "zfs"; fsType = "zfs";
}; };
fileSystems."/home" = "/home" =
{ device = "zroot/home"; {
device = "zroot/home";
fsType = "zfs"; fsType = "zfs";
}; };
};
# fileSystems."/boot" = # fileSystems."/boot" =
# { device = "/dev/disk/by-uuid/E532-B74A"; # { device = "/dev/disk/by-uuid/E532-B74A";

18
nixos/hosts/telchar/default.nix
View file

@ -18,25 +18,27 @@
extraModulePackages = [ ]; extraModulePackages = [ ];
}; };
fileSystems."/" = { fileSystems = {
"/" = {
device = "zroot/root"; device = "zroot/root";
fsType = "zfs"; fsType = "zfs";
}; };
fileSystems."/nix" = { "/nix" = {
device = "zroot/nix"; device = "zroot/nix";
fsType = "zfs"; fsType = "zfs";
}; };
fileSystems."/var" = { "/var" = {
device = "zroot/var"; device = "zroot/var";
fsType = "zfs"; fsType = "zfs";
}; };
fileSystems."/home" = { "/home" = {
device = "zroot/home"; device = "zroot/home";
fsType = "zfs"; fsType = "zfs";
}; };
};
swapDevices = [ ]; swapDevices = [ ];
virtualisation.docker.enable = true; virtualisation.docker.enable = true;
@ -45,10 +47,12 @@
# System settings and services. # System settings and services.
mySystem = { mySystem = {
purpose = "Development"; purpose = "Development";
system.motd.networkInterfaces = [ "wlp1s0" ]; system = {
motd.networkInterfaces = [ "wlp1s0" ];
fingerprint-reader-on-laptop-lid.enable = true;
borg.pika-backup.enable = true;
};
security._1password.enable = true; security._1password.enable = true;
system.fingerprint-reader-on-laptop-lid.enable = true;
framework_wifi_swap.enable = true; framework_wifi_swap.enable = true;
system.borg.pika-backup.enable = true;
}; };
} }

25
nixos/hosts/telperion/default.nix
View file

@ -17,26 +17,27 @@
kernelModules = [ "kvm-intel" ]; kernelModules = [ "kvm-intel" ];
extraModulePackages = [ ]; extraModulePackages = [ ];
}; };
fileSystems = {
fileSystems."/" = { "/" = {
device = "zroot/root"; device = "zroot/root";
fsType = "zfs"; fsType = "zfs";
}; };
fileSystems."/nix" = { "/nix" = {
device = "zroot/nix"; device = "zroot/nix";
fsType = "zfs"; fsType = "zfs";
}; };
fileSystems."/var" = { "/var" = {
device = "zroot/var"; device = "zroot/var";
fsType = "zfs"; fsType = "zfs";
}; };
fileSystems."/home" = { "/home" = {
device = "zroot/home"; device = "zroot/home";
fsType = "zfs"; fsType = "zfs";
}; };
};
swapDevices = [ ]; swapDevices = [ ];
@ -65,11 +66,15 @@
# System settings and services. # System settings and services.
mySystem = { mySystem = {
purpose = "Production"; purpose = "Production";
system.motd.networkInterfaces = [ "enp2s0" "wlp3s0" ]; system = {
system.resticBackup.local.enable = false; motd.networkInterfaces = [ "enp2s0" "wlp3s0" ];
system.resticBackup.remote.enable = false; resticBackup = {
system.resticBackup.local.noWarning = true; local.enable = false;
system.resticBackup.remote.noWarning = true; remote.enable = false;
local.noWarning = true;
remote.noWarning = true;
};
};
services = { services = {
podman.enable = true; podman.enable = true;

9
nixos/hosts/varda/default.nix
View file

@ -3,21 +3,22 @@
networking.hostId = "cdab8473"; networking.hostId = "cdab8473";
networking.hostName = "varda"; # Define your hostname. networking.hostName = "varda"; # Define your hostname.
fileSystems = {
fileSystems."/" = { "/" = {
device = "rpool/root"; device = "rpool/root";
fsType = "zfs"; fsType = "zfs";
}; };
fileSystems."/home" = { "/home" = {
device = "rpool/home"; device = "rpool/home";
fsType = "zfs"; fsType = "zfs";
}; };
fileSystems."/boot" = { "/boot" = {
device = "/dev/disk/by-uuid/8091-E7F2"; device = "/dev/disk/by-uuid/8091-E7F2";
fsType = "vfat"; fsType = "vfat";
}; };
};
swapDevices = [ ]; swapDevices = [ ];

10
nixos/modules/nixos/de/gnome.nix
View file

@ -4,12 +4,14 @@ let
cfg = config.mySystem.de.gnome; cfg = config.mySystem.de.gnome;
in in
{ {
options.mySystem.de.gnome.enable = mkEnableOption "GNOME"; options = {
options.mySystem.de.gnome.systrayicons = mkEnableOption "Enable systray icons" // { default = true; }; mySystem.de.gnome = {
options.mySystem.de.gnome.gsconnect = mkEnableOption "Enable gsconnect (KDEConnect for GNOME)" // { default = true; }; systrayicons = mkEnableOption "Enable systray icons" // { default = true; };
gsconnect = mkEnableOption "Enable gsconnect (KDEConnect for GNOME)" // { default = true; };
};
};
config = mkIf cfg.enable { config = mkIf cfg.enable {
# Ref: https://nixos.wiki/wiki/GNOME # Ref: https://nixos.wiki/wiki/GNOME
# GNOME plz # GNOME plz

16
nixos/modules/nixos/default.nix
View file

@ -13,43 +13,45 @@ with lib;
./system ./system
]; ];
options.mySystem.persistentFolder = mkOption { options.mySystem = {
persistentFolder = mkOption {
type = types.str; type = types.str;
description = "persistent folder for nixos mutable files"; description = "persistent folder for nixos mutable files";
default = "/persist"; default = "/persist";
}; };
options.mySystem.nasFolder = mkOption { nasFolder = mkOption {
type = types.str; type = types.str;
description = "folder where nas mounts reside"; description = "folder where nas mounts reside";
default = "/mnt/nas"; default = "/mnt/nas";
}; };
options.mySystem.nasAddress = mkOption { nasAddress = mkOption {
type = types.str; type = types.str;
description = "NAS Address or name for the backup nas"; description = "NAS Address or name for the backup nas";
default = "10.1.1.13"; default = "10.1.1.13";
}; };
options.mySystem.domain = mkOption { domain = mkOption {
type = types.str; type = types.str;
description = "domain for hosted services"; description = "domain for hosted services";
default = ""; default = "";
}; };
options.mySystem.internalDomain = mkOption { internalDomain = mkOption {
type = types.str; type = types.str;
description = "domain for local devices"; description = "domain for local devices";
default = ""; default = "";
}; };
options.mySystem.purpose = mkOption { purpose = mkOption {
type = types.str; type = types.str;
description = "System purpose"; description = "System purpose";
default = "Development"; default = "Development";
}; };
};
options.mySystem.monitoring.prometheus.scrapeConfigs = mkOption { monitoring.prometheus.scrapeConfigs = mkOption {
type = lib.types.listOf lib.types.attrs; type = lib.types.listOf lib.types.attrs;
description = "Prometheus scrape targets"; description = "Prometheus scrape targets";
default = [ ]; default = [ ];

6
nixos/modules/nixos/hardware/nvidia/default.nix
View file

@ -8,9 +8,11 @@ in
config = mkIf cfg.enable { config = mkIf cfg.enable {
environment.sessionVariables.NIXOS_OZONE_WL = "1";
# ref: https://nixos.wiki/wiki/Nvidia # ref: https://nixos.wiki/wiki/Nvidia
# Enable OpenGL # Enable OpenGL
hardware.opengl = { hardware = {
opengl = {
enable = true; enable = true;
driSupport = true; driSupport = true;
driSupport32Bit = true; driSupport32Bit = true;
@ -21,7 +23,6 @@ in
]; ];
# This is for the benefit of VSCODE running natively in wayland # This is for the benefit of VSCODE running natively in wayland
environment.sessionVariables.NIXOS_OZONE_WL = "1";
hardware.nvidia = { hardware.nvidia = {
@ -73,6 +74,7 @@ in
# patches = [ rcu_patch ]; # patches = [ rcu_patch ];
}; };
}; };
};
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
}; };

8
nixos/modules/nixos/services/podman/default.nix
View file

@ -40,11 +40,13 @@ in
networking.firewall.interfaces.podman0.allowedUDPPorts = [ 53 ]; networking.firewall.interfaces.podman0.allowedUDPPorts = [ 53 ];
# extra user for containers # extra user for containers
users.users.kah = { users = {
kah = {
uid = 568; uid = 568;
group = "kah"; group = "kah";
}; };
users.groups.kah = { }; groups.kah = { };
users.users.jahanson.extraGroups = [ "kah" ]; jahanson.extraGroups = [ "kah" ];
};
}; };
} }

21
nixos/modules/nixos/services/radicale/default.nix
View file

@ -52,8 +52,19 @@ in
directories = [ "/var/lib/radicale/" ]; directories = [ "/var/lib/radicale/" ];
}; };
services =
{
## service ## service
services.radicale = { nginx.virtualHosts.${host} = {
useACMEHost = config.networking.domain;
forceSSL = true;
locations."/" = {
proxyPass = "http://127.0.0.1:${builtins.toString port}";
};
};
### Ingress
radicale = {
enable = true; enable = true;
settings = { settings = {
server.hosts = [ "0.0.0.0:${builtins.toString port}" ]; server.hosts = [ "0.0.0.0:${builtins.toString port}" ];
@ -66,14 +77,6 @@ in
storage.filesystem_folder = "/var/lib/radicale/collections"; storage.filesystem_folder = "/var/lib/radicale/collections";
}; };
}; };
### Ingress
services.nginx.virtualHosts.${host} = {
useACMEHost = config.networking.domain;
forceSSL = true;
locations."/" = {
proxyPass = "http://127.0.0.1:${builtins.toString port}";
};
}; };
### firewall config ### firewall config

12
nixos/modules/nixos/system/samba/default.nix
View file

@ -17,9 +17,13 @@ in
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
services.samba.enable = true; services = {
services.samba.extraConfig = cfg.extraConfig; samaba = {
services.samba.shares = cfg.shares; enable = true;
services.samba.openFirewall = true; inherit (cfg) extraConfig;
inherit (cfg) shares;
openFirewall = true;
};
};
}; };
} }

8
nixos/profiles/global/sops.nix
View file

@ -2,13 +2,15 @@
{ {
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
# Secret for machine-specific pushover # Secret for machine-specific pushover
sops.secrets."services/pushover/env" = { sops.secrets = {
"services/pushover/env" = {
sopsFile = ./secrets.sops.yaml; sopsFile = ./secrets.sops.yaml;
}; };
sops.secrets.pushover-user-key = { pushover-user-key = {
sopsFile = ./secrets.sops.yaml; sopsFile = ./secrets.sops.yaml;
}; };
sops.secrets.pushover-api-key = { pushover-api-key = {
sopsFile = ./secrets.sops.yaml; sopsFile = ./secrets.sops.yaml;
}; };
};
} }

14
nixos/profiles/hw-hetzner-cax.nix
View file

@ -1,12 +1,14 @@
{ lib, ... }: { { lib, ... }: {
imports = [ ]; imports = [ ];
boot.loader.systemd-boot.enable = true; boot = {
boot.loader.efi.canTouchEfiVariables = true; loader.systemd-boot.enable = true;
boot.initrd.availableKernelModules = [ "xhci_pci" "virtio_pci" "virtio_scsi" "usbhid" "sr_mod" ]; loader.efi.canTouchEfiVariables = true;
boot.initrd.kernelModules = [ ]; initrd.availableKernelModules = [ "xhci_pci" "virtio_pci" "virtio_scsi" "usbhid" "sr_mod" ];
boot.kernelModules = [ ]; initrd.kernelModules = [ ];
boot.extraModulePackages = [ ]; kernelModules = [ ];
extraModulePackages = [ ];
};
mySystem = { mySystem = {
services.openssh.enable = true; services.openssh.enable = true;

11
nixos/profiles/role-server.nix
View file

@ -6,10 +6,13 @@ with lib;
{ {
config = { config = {
# Enable monitoring for remote scraping # Enable monitoring for remote scraping
mySystem.services.rebootRequiredCheck.enable = true; mySystem = {
mySystem.security.wheelNeedsSudoPassword = false; services.rebootRequiredCheck.enable = true;
mySystem.services.cockpit.enable = true; security.wheelNeedsSudoPassword = false;
mySystem.system.motd.enable = true; services.cockpit.enable = true;
system.motd.enable = true;
};
nix.settings = { nix.settings = {
# TODO factor out into mySystem # TODO factor out into mySystem
# Avoid disk full issues # Avoid disk full issues