statix
This commit is contained in:
parent
b6132b689e
commit
fb545ba987
SSH key fingerprint:
SHA256:vy6dKBECV522aPAwklFM3ReKAVB086rT3oWwiuiFG7o
16 changed files with 314 additions and 264 deletions
|
|
@ -18,45 +18,46 @@ in
|
|||
|
||||
config = lib.mkMerge [
|
||||
(lib.mkIf cfg.enable {
|
||||
programs.gh.enable = true;
|
||||
programs.gpg.enable = true;
|
||||
programs = {
|
||||
gh.enable = true;
|
||||
gpg.enable = true;
|
||||
git = {
|
||||
enable = true;
|
||||
|
||||
programs.git = {
|
||||
enable = true;
|
||||
userName = cfg.username;
|
||||
userEmail = cfg.email;
|
||||
|
||||
userName = cfg.username;
|
||||
userEmail = cfg.email;
|
||||
|
||||
extraConfig = {
|
||||
core.autocrlf = "input";
|
||||
init.defaultBranch = "main";
|
||||
pull.rebase = true;
|
||||
rebase.autoStash = true;
|
||||
# public key for signing commits
|
||||
user.signingKey = cfg.signingKey;
|
||||
# ssh instead of gpg
|
||||
gpg.format = "ssh";
|
||||
# 1password signing gui git signing
|
||||
gpg.ssh.program = "${pkgs._1password-gui}/bin/op-ssh-sign";
|
||||
# Auto sign commits without -S
|
||||
commit.gpgsign = true;
|
||||
extraConfig = {
|
||||
core.autocrlf = "input";
|
||||
init.defaultBranch = "main";
|
||||
pull.rebase = true;
|
||||
rebase.autoStash = true;
|
||||
# public key for signing commits
|
||||
user.signingKey = cfg.signingKey;
|
||||
# ssh instead of gpg
|
||||
gpg.format = "ssh";
|
||||
# 1password signing gui git signing
|
||||
gpg.ssh.program = "${pkgs._1password-gui}/bin/op-ssh-sign";
|
||||
# Auto sign commits without -S
|
||||
commit.gpgsign = true;
|
||||
};
|
||||
aliases = {
|
||||
co = "checkout";
|
||||
};
|
||||
ignores = [
|
||||
# Mac OS X hidden files
|
||||
".DS_Store"
|
||||
# Windows files
|
||||
"Thumbs.db"
|
||||
# asdf
|
||||
".tool-versions"
|
||||
# Sops
|
||||
".decrypted~*"
|
||||
"*.decrypted.*"
|
||||
# Python virtualenvs
|
||||
".venv"
|
||||
];
|
||||
};
|
||||
aliases = {
|
||||
co = "checkout";
|
||||
};
|
||||
ignores = [
|
||||
# Mac OS X hidden files
|
||||
".DS_Store"
|
||||
# Windows files
|
||||
"Thumbs.db"
|
||||
# asdf
|
||||
".tool-versions"
|
||||
# Sops
|
||||
".decrypted~*"
|
||||
"*.decrypted.*"
|
||||
# Python virtualenvs
|
||||
".venv"
|
||||
];
|
||||
};
|
||||
|
||||
home.packages = [
|
||||
|
|
|
|||
|
|
@ -12,21 +12,26 @@
|
|||
extraModulePackages = [ ];
|
||||
};
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "rpool/root";
|
||||
fsType = "zfs";
|
||||
};
|
||||
fileSystems = {
|
||||
"/" =
|
||||
{
|
||||
device = "rpool/root";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
fileSystems."/home" =
|
||||
{ device = "rpool/home";
|
||||
fsType = "zfs";
|
||||
};
|
||||
"/home" =
|
||||
{
|
||||
device = "rpool/home";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/F1B9-CA7C";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0077" "dmask=0077" ];
|
||||
};
|
||||
"/boot" =
|
||||
{
|
||||
device = "/dev/disk/by-uuid/F1B9-CA7C";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0077" "dmask=0077" ];
|
||||
};
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
|
|
|
|||
|
|
@ -79,13 +79,17 @@ in
|
|||
# NFS
|
||||
nfs.enable = true;
|
||||
# Samba
|
||||
samba.enable = true;
|
||||
samba.shares = import ./config/samba-shares.nix { };
|
||||
samba.extraConfig = import ./config/samba-config.nix { };
|
||||
resticBackup.local.enable = false;
|
||||
resticBackup.remote.enable = false;
|
||||
resticBackup.local.noWarning = true;
|
||||
resticBackup.remote.noWarning = true;
|
||||
samba = {
|
||||
enable = true;
|
||||
shares = import ./config/samba-shares.nix { };
|
||||
extraConfig = import ./config/samba-config.nix { };
|
||||
};
|
||||
resticBackup = {
|
||||
local.enable = false;
|
||||
remote.enable = false;
|
||||
local.noWarning = true;
|
||||
remote.noWarning = true;
|
||||
};
|
||||
# Borg
|
||||
borgbackup = {
|
||||
enable = true;
|
||||
|
|
|
|||
|
|
@ -5,7 +5,8 @@
|
|||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
[
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
networking.hostId = "2132e3bf";
|
||||
|
|
@ -17,24 +18,31 @@
|
|||
extraModulePackages = [ ];
|
||||
};
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "zroot/root";
|
||||
fsType = "zfs";
|
||||
};
|
||||
fileSystems =
|
||||
{
|
||||
"/" =
|
||||
{
|
||||
device = "zroot/root";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
fileSystems."/nix" =
|
||||
{ device = "zroot/nix";
|
||||
fsType = "zfs";
|
||||
};
|
||||
"/nix" =
|
||||
{
|
||||
device = "zroot/nix";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
fileSystems."/var" =
|
||||
{ device = "zroot/var";
|
||||
fsType = "zfs";
|
||||
};
|
||||
"/var" =
|
||||
{
|
||||
device = "zroot/var";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
fileSystems."/home" =
|
||||
{ device = "zroot/home";
|
||||
fsType = "zfs";
|
||||
"/home" =
|
||||
{
|
||||
device = "zroot/home";
|
||||
fsType = "zfs";
|
||||
};
|
||||
};
|
||||
|
||||
# fileSystems."/boot" =
|
||||
|
|
|
|||
|
|
@ -18,24 +18,26 @@
|
|||
extraModulePackages = [ ];
|
||||
};
|
||||
|
||||
fileSystems."/" = {
|
||||
device = "zroot/root";
|
||||
fsType = "zfs";
|
||||
};
|
||||
fileSystems = {
|
||||
"/" = {
|
||||
device = "zroot/root";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
fileSystems."/nix" = {
|
||||
device = "zroot/nix";
|
||||
fsType = "zfs";
|
||||
};
|
||||
"/nix" = {
|
||||
device = "zroot/nix";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
fileSystems."/var" = {
|
||||
device = "zroot/var";
|
||||
fsType = "zfs";
|
||||
};
|
||||
"/var" = {
|
||||
device = "zroot/var";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
fileSystems."/home" = {
|
||||
device = "zroot/home";
|
||||
fsType = "zfs";
|
||||
"/home" = {
|
||||
device = "zroot/home";
|
||||
fsType = "zfs";
|
||||
};
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
|
@ -45,10 +47,12 @@
|
|||
# System settings and services.
|
||||
mySystem = {
|
||||
purpose = "Development";
|
||||
system.motd.networkInterfaces = [ "wlp1s0" ];
|
||||
system = {
|
||||
motd.networkInterfaces = [ "wlp1s0" ];
|
||||
fingerprint-reader-on-laptop-lid.enable = true;
|
||||
borg.pika-backup.enable = true;
|
||||
};
|
||||
security._1password.enable = true;
|
||||
system.fingerprint-reader-on-laptop-lid.enable = true;
|
||||
framework_wifi_swap.enable = true;
|
||||
system.borg.pika-backup.enable = true;
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -17,25 +17,26 @@
|
|||
kernelModules = [ "kvm-intel" ];
|
||||
extraModulePackages = [ ];
|
||||
};
|
||||
fileSystems = {
|
||||
"/" = {
|
||||
device = "zroot/root";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
fileSystems."/" = {
|
||||
device = "zroot/root";
|
||||
fsType = "zfs";
|
||||
};
|
||||
"/nix" = {
|
||||
device = "zroot/nix";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
fileSystems."/nix" = {
|
||||
device = "zroot/nix";
|
||||
fsType = "zfs";
|
||||
};
|
||||
"/var" = {
|
||||
device = "zroot/var";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
fileSystems."/var" = {
|
||||
device = "zroot/var";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
fileSystems."/home" = {
|
||||
device = "zroot/home";
|
||||
fsType = "zfs";
|
||||
"/home" = {
|
||||
device = "zroot/home";
|
||||
fsType = "zfs";
|
||||
};
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
|
@ -65,11 +66,15 @@
|
|||
# System settings and services.
|
||||
mySystem = {
|
||||
purpose = "Production";
|
||||
system.motd.networkInterfaces = [ "enp2s0" "wlp3s0" ];
|
||||
system.resticBackup.local.enable = false;
|
||||
system.resticBackup.remote.enable = false;
|
||||
system.resticBackup.local.noWarning = true;
|
||||
system.resticBackup.remote.noWarning = true;
|
||||
system = {
|
||||
motd.networkInterfaces = [ "enp2s0" "wlp3s0" ];
|
||||
resticBackup = {
|
||||
local.enable = false;
|
||||
remote.enable = false;
|
||||
local.noWarning = true;
|
||||
remote.noWarning = true;
|
||||
};
|
||||
};
|
||||
|
||||
services = {
|
||||
podman.enable = true;
|
||||
|
|
|
|||
|
|
@ -3,20 +3,21 @@
|
|||
|
||||
networking.hostId = "cdab8473";
|
||||
networking.hostName = "varda"; # Define your hostname.
|
||||
fileSystems = {
|
||||
"/" = {
|
||||
device = "rpool/root";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
fileSystems."/" = {
|
||||
device = "rpool/root";
|
||||
fsType = "zfs";
|
||||
};
|
||||
"/home" = {
|
||||
device = "rpool/home";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
fileSystems."/home" = {
|
||||
device = "rpool/home";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-uuid/8091-E7F2";
|
||||
fsType = "vfat";
|
||||
"/boot" = {
|
||||
device = "/dev/disk/by-uuid/8091-E7F2";
|
||||
fsType = "vfat";
|
||||
};
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
|
|
|||
|
|
@ -4,12 +4,14 @@ let
|
|||
cfg = config.mySystem.de.gnome;
|
||||
in
|
||||
{
|
||||
options.mySystem.de.gnome.enable = mkEnableOption "GNOME";
|
||||
options.mySystem.de.gnome.systrayicons = mkEnableOption "Enable systray icons" // { default = true; };
|
||||
options.mySystem.de.gnome.gsconnect = mkEnableOption "Enable gsconnect (KDEConnect for GNOME)" // { default = true; };
|
||||
options = {
|
||||
mySystem.de.gnome = {
|
||||
systrayicons = mkEnableOption "Enable systray icons" // { default = true; };
|
||||
gsconnect = mkEnableOption "Enable gsconnect (KDEConnect for GNOME)" // { default = true; };
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
|
||||
# Ref: https://nixos.wiki/wiki/GNOME
|
||||
|
||||
# GNOME plz
|
||||
|
|
|
|||
|
|
@ -13,43 +13,45 @@ with lib;
|
|||
./system
|
||||
];
|
||||
|
||||
options.mySystem.persistentFolder = mkOption {
|
||||
type = types.str;
|
||||
description = "persistent folder for nixos mutable files";
|
||||
default = "/persist";
|
||||
options.mySystem = {
|
||||
persistentFolder = mkOption {
|
||||
type = types.str;
|
||||
description = "persistent folder for nixos mutable files";
|
||||
default = "/persist";
|
||||
};
|
||||
|
||||
nasFolder = mkOption {
|
||||
type = types.str;
|
||||
description = "folder where nas mounts reside";
|
||||
default = "/mnt/nas";
|
||||
};
|
||||
|
||||
nasAddress = mkOption {
|
||||
type = types.str;
|
||||
description = "NAS Address or name for the backup nas";
|
||||
default = "10.1.1.13";
|
||||
};
|
||||
|
||||
domain = mkOption {
|
||||
type = types.str;
|
||||
description = "domain for hosted services";
|
||||
default = "";
|
||||
};
|
||||
|
||||
internalDomain = mkOption {
|
||||
type = types.str;
|
||||
description = "domain for local devices";
|
||||
default = "";
|
||||
};
|
||||
|
||||
purpose = mkOption {
|
||||
type = types.str;
|
||||
description = "System purpose";
|
||||
default = "Development";
|
||||
};
|
||||
};
|
||||
|
||||
options.mySystem.nasFolder = mkOption {
|
||||
type = types.str;
|
||||
description = "folder where nas mounts reside";
|
||||
default = "/mnt/nas";
|
||||
};
|
||||
|
||||
options.mySystem.nasAddress = mkOption {
|
||||
type = types.str;
|
||||
description = "NAS Address or name for the backup nas";
|
||||
default = "10.1.1.13";
|
||||
};
|
||||
|
||||
options.mySystem.domain = mkOption {
|
||||
type = types.str;
|
||||
description = "domain for hosted services";
|
||||
default = "";
|
||||
};
|
||||
|
||||
options.mySystem.internalDomain = mkOption {
|
||||
type = types.str;
|
||||
description = "domain for local devices";
|
||||
default = "";
|
||||
};
|
||||
|
||||
options.mySystem.purpose = mkOption {
|
||||
type = types.str;
|
||||
description = "System purpose";
|
||||
default = "Development";
|
||||
};
|
||||
|
||||
options.mySystem.monitoring.prometheus.scrapeConfigs = mkOption {
|
||||
monitoring.prometheus.scrapeConfigs = mkOption {
|
||||
type = lib.types.listOf lib.types.attrs;
|
||||
description = "Prometheus scrape targets";
|
||||
default = [ ];
|
||||
|
|
|
|||
|
|
@ -8,70 +8,72 @@ in
|
|||
|
||||
config = mkIf cfg.enable {
|
||||
|
||||
environment.sessionVariables.NIXOS_OZONE_WL = "1";
|
||||
# ref: https://nixos.wiki/wiki/Nvidia
|
||||
# Enable OpenGL
|
||||
hardware.opengl = {
|
||||
enable = true;
|
||||
driSupport = true;
|
||||
driSupport32Bit = true;
|
||||
};
|
||||
hardware = {
|
||||
opengl = {
|
||||
enable = true;
|
||||
driSupport = true;
|
||||
driSupport32Bit = true;
|
||||
};
|
||||
|
||||
hardware.opengl.extraPackages = with pkgs; [
|
||||
vaapiVdpau
|
||||
];
|
||||
hardware.opengl.extraPackages = with pkgs; [
|
||||
vaapiVdpau
|
||||
];
|
||||
|
||||
# This is for the benefit of VSCODE running natively in wayland
|
||||
environment.sessionVariables.NIXOS_OZONE_WL = "1";
|
||||
# This is for the benefit of VSCODE running natively in wayland
|
||||
|
||||
hardware.nvidia = {
|
||||
hardware.nvidia = {
|
||||
|
||||
# Modesetting is required.
|
||||
modesetting.enable = true;
|
||||
# Modesetting is required.
|
||||
modesetting.enable = true;
|
||||
|
||||
# Nvidia power management. Experimental, and can cause sleep/suspend to fail.
|
||||
# Enable this if you have graphical corruption issues or application crashes after waking
|
||||
# up from sleep. This fixes it by saving the entire VRAM memory to /tmp/ instead
|
||||
# of just the bare essentials.
|
||||
powerManagement.enable = false;
|
||||
# Nvidia power management. Experimental, and can cause sleep/suspend to fail.
|
||||
# Enable this if you have graphical corruption issues or application crashes after waking
|
||||
# up from sleep. This fixes it by saving the entire VRAM memory to /tmp/ instead
|
||||
# of just the bare essentials.
|
||||
powerManagement.enable = false;
|
||||
|
||||
# Fine-grained power management. Turns off GPU when not in use.
|
||||
# Experimental and only works on modern Nvidia GPUs (Turing or newer).
|
||||
powerManagement.finegrained = false;
|
||||
# Fine-grained power management. Turns off GPU when not in use.
|
||||
# Experimental and only works on modern Nvidia GPUs (Turing or newer).
|
||||
powerManagement.finegrained = false;
|
||||
|
||||
# Use the NVidia open source kernel module (not to be confused with the
|
||||
# independent third-party "nouveau" open source driver).
|
||||
# Support is limited to the Turing and later architectures. Full list of
|
||||
# supported GPUs is at:
|
||||
# https://github.com/NVIDIA/open-gpu-kernel-modules#compatible-gpus
|
||||
# Only available from driver 515.43.04+
|
||||
# Currently alpha-quality/buggy, so false is currently the recommended setting.
|
||||
open = false;
|
||||
# Use the NVidia open source kernel module (not to be confused with the
|
||||
# independent third-party "nouveau" open source driver).
|
||||
# Support is limited to the Turing and later architectures. Full list of
|
||||
# supported GPUs is at:
|
||||
# https://github.com/NVIDIA/open-gpu-kernel-modules#compatible-gpus
|
||||
# Only available from driver 515.43.04+
|
||||
# Currently alpha-quality/buggy, so false is currently the recommended setting.
|
||||
open = false;
|
||||
|
||||
# Enable the Nvidia settings menu,
|
||||
# accessible via `nvidia-settings`.
|
||||
nvidiaSettings = true;
|
||||
# Enable the Nvidia settings menu,
|
||||
# accessible via `nvidia-settings`.
|
||||
nvidiaSettings = true;
|
||||
|
||||
# Optionally, you may need to select the appropriate driver version for your specific GPU.
|
||||
# package = config.boot.kernelPackages.nvidiaPackages.stable;
|
||||
# Optionally, you may need to select the appropriate driver version for your specific GPU.
|
||||
# package = config.boot.kernelPackages.nvidiaPackages.stable;
|
||||
|
||||
# manual build nvidia driver, works around some wezterm issues
|
||||
# https://github.com/wez/wezterm/issues/2011
|
||||
package =
|
||||
# let
|
||||
# rcu_patch = pkgs.fetchpatch {
|
||||
# url = "https://github.com/gentoo/gentoo/raw/c64caf53/x11-drivers/nvidia-drivers/files/nvidia-drivers-470.223.02-gpl-pfn_valid.patch";
|
||||
# hash = "sha256-eZiQQp2S/asE7MfGvfe6dA/kdCvek9SYa/FFGp24dVg=";
|
||||
# };
|
||||
# in
|
||||
config.boot.kernelPackages.nvidiaPackages.mkDriver {
|
||||
version = "555.58";
|
||||
sha256_64bit = "sha256-bXvcXkg2kQZuCNKRZM5QoTaTjF4l2TtrsKUvyicj5ew=";
|
||||
sha256_aarch64 = "sha256-7XswQwW1iFP4ji5mbRQ6PVEhD4SGWpjUJe1o8zoXYRE=";
|
||||
openSha256 = "sha256-hEAmFISMuXm8tbsrB+WiUcEFuSGRNZ37aKWvf0WJ2/c=";
|
||||
settingsSha256 = "sha256-vWnrXlBCb3K5uVkDFmJDVq51wrCoqgPF03lSjZOuU8M=";
|
||||
persistencedSha256 = "sha256-lyYxDuGDTMdGxX3CaiWUh1IQuQlkI2hPEs5LI20vEVw=";
|
||||
# patches = [ rcu_patch ];
|
||||
};
|
||||
# manual build nvidia driver, works around some wezterm issues
|
||||
# https://github.com/wez/wezterm/issues/2011
|
||||
package =
|
||||
# let
|
||||
# rcu_patch = pkgs.fetchpatch {
|
||||
# url = "https://github.com/gentoo/gentoo/raw/c64caf53/x11-drivers/nvidia-drivers/files/nvidia-drivers-470.223.02-gpl-pfn_valid.patch";
|
||||
# hash = "sha256-eZiQQp2S/asE7MfGvfe6dA/kdCvek9SYa/FFGp24dVg=";
|
||||
# };
|
||||
# in
|
||||
config.boot.kernelPackages.nvidiaPackages.mkDriver {
|
||||
version = "555.58";
|
||||
sha256_64bit = "sha256-bXvcXkg2kQZuCNKRZM5QoTaTjF4l2TtrsKUvyicj5ew=";
|
||||
sha256_aarch64 = "sha256-7XswQwW1iFP4ji5mbRQ6PVEhD4SGWpjUJe1o8zoXYRE=";
|
||||
openSha256 = "sha256-hEAmFISMuXm8tbsrB+WiUcEFuSGRNZ37aKWvf0WJ2/c=";
|
||||
settingsSha256 = "sha256-vWnrXlBCb3K5uVkDFmJDVq51wrCoqgPF03lSjZOuU8M=";
|
||||
persistencedSha256 = "sha256-lyYxDuGDTMdGxX3CaiWUh1IQuQlkI2hPEs5LI20vEVw=";
|
||||
# patches = [ rcu_patch ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
|
|
|
|||
|
|
@ -34,17 +34,19 @@ in
|
|||
|
||||
programs.fish.shellAliases = {
|
||||
# lazydocker --> lazypodman
|
||||
lazypodman="sudo DOCKER_HOST=unix:///run/podman/podman.sock lazydocker";
|
||||
lazypodman = "sudo DOCKER_HOST=unix:///run/podman/podman.sock lazydocker";
|
||||
};
|
||||
|
||||
networking.firewall.interfaces.podman0.allowedUDPPorts = [ 53 ];
|
||||
|
||||
# extra user for containers
|
||||
users.users.kah = {
|
||||
uid = 568;
|
||||
group = "kah";
|
||||
users = {
|
||||
kah = {
|
||||
uid = 568;
|
||||
group = "kah";
|
||||
};
|
||||
groups.kah = { };
|
||||
jahanson.extraGroups = [ "kah" ];
|
||||
};
|
||||
users.groups.kah = { };
|
||||
users.users.jahanson.extraGroups = [ "kah" ];
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -52,29 +52,32 @@ in
|
|||
directories = [ "/var/lib/radicale/" ];
|
||||
};
|
||||
|
||||
## service
|
||||
services.radicale = {
|
||||
enable = true;
|
||||
settings = {
|
||||
server.hosts = [ "0.0.0.0:${builtins.toString port}" ];
|
||||
auth = {
|
||||
type = "htpasswd";
|
||||
htpasswd_filename = config.sops.secrets."${category}/${app}/htpasswd".path;
|
||||
htpasswd_encryption = "plain";
|
||||
realm = "Radicale - Password Required";
|
||||
};
|
||||
storage.filesystem_folder = "/var/lib/radicale/collections";
|
||||
};
|
||||
};
|
||||
|
||||
### Ingress
|
||||
services.nginx.virtualHosts.${host} = {
|
||||
useACMEHost = config.networking.domain;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://127.0.0.1:${builtins.toString port}";
|
||||
services =
|
||||
{
|
||||
## service
|
||||
nginx.virtualHosts.${host} = {
|
||||
useACMEHost = config.networking.domain;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://127.0.0.1:${builtins.toString port}";
|
||||
};
|
||||
};
|
||||
### Ingress
|
||||
radicale = {
|
||||
enable = true;
|
||||
settings = {
|
||||
server.hosts = [ "0.0.0.0:${builtins.toString port}" ];
|
||||
auth = {
|
||||
type = "htpasswd";
|
||||
htpasswd_filename = config.sops.secrets."${category}/${app}/htpasswd".path;
|
||||
htpasswd_encryption = "plain";
|
||||
realm = "Radicale - Password Required";
|
||||
};
|
||||
storage.filesystem_folder = "/var/lib/radicale/collections";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
### firewall config
|
||||
|
||||
|
|
|
|||
|
|
@ -17,9 +17,13 @@ in
|
|||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.samba.enable = true;
|
||||
services.samba.extraConfig = cfg.extraConfig;
|
||||
services.samba.shares = cfg.shares;
|
||||
services.samba.openFirewall = true;
|
||||
services = {
|
||||
samaba = {
|
||||
enable = true;
|
||||
inherit (cfg) extraConfig;
|
||||
inherit (cfg) shares;
|
||||
openFirewall = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,13 +2,15 @@
|
|||
{
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
# Secret for machine-specific pushover
|
||||
sops.secrets."services/pushover/env" = {
|
||||
sopsFile = ./secrets.sops.yaml;
|
||||
};
|
||||
sops.secrets.pushover-user-key = {
|
||||
sopsFile = ./secrets.sops.yaml;
|
||||
};
|
||||
sops.secrets.pushover-api-key = {
|
||||
sopsFile = ./secrets.sops.yaml;
|
||||
sops.secrets = {
|
||||
"services/pushover/env" = {
|
||||
sopsFile = ./secrets.sops.yaml;
|
||||
};
|
||||
pushover-user-key = {
|
||||
sopsFile = ./secrets.sops.yaml;
|
||||
};
|
||||
pushover-api-key = {
|
||||
sopsFile = ./secrets.sops.yaml;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,12 +1,14 @@
|
|||
{ lib, ... }: {
|
||||
imports = [ ];
|
||||
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "virtio_pci" "virtio_scsi" "usbhid" "sr_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
boot = {
|
||||
loader.systemd-boot.enable = true;
|
||||
loader.efi.canTouchEfiVariables = true;
|
||||
initrd.availableKernelModules = [ "xhci_pci" "virtio_pci" "virtio_scsi" "usbhid" "sr_mod" ];
|
||||
initrd.kernelModules = [ ];
|
||||
kernelModules = [ ];
|
||||
extraModulePackages = [ ];
|
||||
};
|
||||
|
||||
mySystem = {
|
||||
services.openssh.enable = true;
|
||||
|
|
|
|||
|
|
@ -6,10 +6,13 @@ with lib;
|
|||
{
|
||||
config = {
|
||||
# Enable monitoring for remote scraping
|
||||
mySystem.services.rebootRequiredCheck.enable = true;
|
||||
mySystem.security.wheelNeedsSudoPassword = false;
|
||||
mySystem.services.cockpit.enable = true;
|
||||
mySystem.system.motd.enable = true;
|
||||
mySystem = {
|
||||
services.rebootRequiredCheck.enable = true;
|
||||
security.wheelNeedsSudoPassword = false;
|
||||
services.cockpit.enable = true;
|
||||
system.motd.enable = true;
|
||||
};
|
||||
|
||||
nix.settings = {
|
||||
# TODO factor out into mySystem
|
||||
# Avoid disk full issues
|
||||
|
|
|
|||
Loading…
Reference in a new issue