Merge pull request 'merge-nixconfigs' (#14) from merge-nixconfigs into main

Reviewed-on: #14

nixos/home/modules/default.nix

@@ -1,8 +1,5 @@
-{ inputs
+{ lib, ... }: {
-, config
+  
-, lib
-, ...
-}: {
   imports = [
     ./shell
     ./programs

nixos/home/modules/shell/fish/default.nix

@@ -23,8 +23,6 @@ in
           ll = "${pkgs.eza}/bin/eza --long --all --group --header";
           tm = "tmux attach -t (basename $PWD) || tmux new -s (basename $PWD)";
           x = "exit";
-          # lazydocker --> lazypodman
-          lazypodman="sudo DOCKER_HOST=unix:///run/podman/podman.sock lazydocker";
         };
 
         shellAbbrs = {

nixos/lib/default.nix

@@ -1,4 +1,4 @@
-{ inputs, lib, ... }:
+{ lib, ... }:
 
 with lib;
 rec {
@@ -12,9 +12,6 @@ rec {
       user = existsOrDefault "user" options "568";
       group = existsOrDefault "group" options "568";
 
-      subdomain = existsOrDefault "subdomainOverride" options options.app;
-      host = existsOrDefault "host" options "${subdomain}.${options.domain}";
-
       enableBackups = (lib.attrsets.hasAttrByPath [ "persistence" "folder" ] options)
         && (lib.attrsets.attrByPath [ "persistence" "enable" ] true options);
       # nix doesnt have an exhausive list of options for oci

nixos/modules/README.md

@@ -1,6 +1,6 @@
 ## Modules
 
-A set of 'custom' modules with the aim to enable easy on/off/settings to build up a system modulary to my 'specs'.
+A set of 'custom' modules with the aim to enable easy on/off/settings to build up a system modularly to my 'specs'.
 
 The main goal is to build up a `mySystem` options key which is easy to read and toggle functionality on and off.
 

nixos/modules/nixos/de/default.nix

@@ -1,6 +1,5 @@
 {
   imports = [
     ./gnome.nix
-
   ];
 }

nixos/modules/nixos/de/gnome.nix

@@ -1,9 +1,4 @@
-{ lib
+{ lib, config, pkgs, ... }:
-, config
-, pkgs
-, ...
-}:
-
 with lib;
 let
   cfg = config.mySystem.de.gnome;
@@ -13,7 +8,6 @@ in
   options.mySystem.de.gnome.systrayicons = mkEnableOption "Enable systray icons" // { default = true; };
   options.mySystem.de.gnome.gsconnect = mkEnableOption "Enable gsconnect (KDEConnect for GNOME)" // { default = true; };
 
-
   config = mkIf cfg.enable {
 
     # Ref: https://nixos.wiki/wiki/GNOME
@@ -38,17 +32,12 @@ in
           # GNOME
           gnome.enable = true;
         };
-
       };
 
       udev.packages = optionals cfg.systrayicons [ pkgs.gnome.gnome-settings-daemon ]; # support appindicator
-
-
     };
 
     # systyray icons
-
-
     # extra pkgs and extensions
     environment = {
       systemPackages = with pkgs; [
@@ -62,9 +51,7 @@ in
         # dont forget to enable them per-user in dconf settings -> "org/gnome/shell"
         gnomeExtensions.vitals
         gnomeExtensions.caffeine
-        gnomeExtensions.spotify-tray
         gnomeExtensions.dash-to-dock
-
       ]
       ++ optionals cfg.systrayicons [ pkgs.gnomeExtensions.appindicator ];
     };
@@ -89,21 +76,9 @@ in
     systemd.services."getty@tty1".enable = false;
     systemd.services."autovt@tty1".enable = false;
 
-    # TODO tidy this
-    # port forward for GNOME when using RDP***REMOVED***
-
-    # for RDP TODO make this a flag if RDP is enabled per host
-    networking.firewall.allowedTCPPorts = [
-      3389
-    ];
-
     # And dconf
     programs.dconf.enable = true;
 
-    # https://github.com/NixOS/nixpkgs/issues/114514
-    # dconf write /org/gnome/mutter/experimental-features "['scale-monitor-framebuffer']" TODO hack for GNOME 45
-
-
     # Exclude default GNOME packages that dont interest me.
     environment.gnome.excludePackages =
       (with pkgs; [

nixos/modules/nixos/programs/shell/fish.nix

@@ -1,9 +1,4 @@
-{ lib
+{ lib, config, ... }:
-, config
-, self
-, pkgs
-, ...
-}:
 with lib;
 let
   cfg = config.mySystem.shell.fish;

nixos/modules/nixos/security/acme/default.nix

@@ -1,17 +1,7 @@
-{ lib
+{ lib, config, ... }:
-, config
-, pkgs
-, ...
-}:
 with lib;
 let
   cfg = config.mySystem.security.acme;
-  app = "acme";
-  appFolder = "/var/lib/${app}";
-  # persistentFolder = "${config.mySystem.persistentFolder}/var/lib/${appFolder}";
-  user = app;
-  group = app;
-
 in
 {
   options.mySystem.security.acme.enable = mkEnableOption "acme";

nixos/modules/nixos/security/default.nix

@@ -1,9 +1,6 @@
-{ lib, config, ... }:
+{ ... }:
-with lib;
 {
   imports = [
     ./acme
   ];
-
-
 }

nixos/modules/nixos/services/cockpit/default.nix

@@ -1,9 +1,4 @@
-{ lib
+{ lib, config, pkgs, ... }:
-, config
-, pkgs
-, ...
-}:
-
 with lib;
 let
   cfg = config.mySystem.services.cockpit;

nixos/modules/nixos/services/default.nix

@@ -3,9 +3,7 @@
     ./cockpit
     ./forgejo
     ./glances
-    ./grafana
     ./monitoring.nix
-    ./nfs
     ./nginx
     ./nix-serve
     ./podman

nixos/modules/nixos/services/forgejo/default.nix

@@ -1,9 +1,7 @@
-{ lib, pkgs, config, ... }:
+{ lib, config, ... }:
 with lib;
 let
   cfg = config.mySystem.services.forgejo;
-  app = "forgejo";
-  port = 443;
   http_port = 3000;
   serviceUser = "forgejo";
   domain = "git.hsn.dev";

nixos/modules/nixos/services/glances/default.nix

@@ -1,8 +1,4 @@
-{ pkgs
+{ pkgs, config, lib, ... }:
-, config
-, lib
-, ...
-}:
 let
   cfg = config.mySystem.services.glances;
   app = "Glances";
@@ -17,16 +13,7 @@ with lib;
           type = lib.types.bool;
           description = "Enable gatus monitoring";
           default = true;
-
         };
-      addToHomepage = mkOption
-        {
-          type = lib.types.bool;
-          description = "Add to homepage";
-          default = true;
-
-        };
-
     };
   config = mkIf cfg.enable {
 
@@ -46,7 +33,6 @@ with lib;
       firewall.allowedTCPPorts = [ 61208 ];
     };
 
-
     environment.etc."glances/glances.conf" = {
       text = ''
         [global]

nixos/modules/nixos/services/grafana/default.nix

@@ -1,108 +0,0 @@
-{ lib
-, config
-, pkgs
-, ...
-}:
-with lib;
-let
-  cfg = config.mySystem.services.grafana;
-  app = "grafana";
-  category = "services";
-  description = "Metric visualisation";
-  user = app; #string
-  group = app; #string
-  port = 2342; #int
-  appFolder = "/var/lib/${app}";
-  # persistentFolder = "${config.mySystem.persistentFolder}/var/lib/${appFolder}";
-  host = "${app}" + (if cfg.dev then "-dev" else "");
-  url = "${host}.${config.networking.domain}";
-in
-{
-  options.mySystem.${category}.${app} =
-    {
-      enable = mkEnableOption "${app}";
-      addToHomepage = mkEnableOption "Add ${app} to homepage" // { default = true; };
-      monitor = mkOption
-        {
-          type = lib.types.bool;
-          description = "Enable gatus monitoring";
-          default = true;
-        };
-      addToDNS = mkOption
-        {
-          type = lib.types.bool;
-          description = "Add to DNS list";
-          default = true;
-        };
-      dev = mkOption
-        {
-          type = lib.types.bool;
-          description = "Development instance";
-          default = false;
-        };
-      backups = mkOption
-        {
-          type = lib.types.bool;
-          description = "Enable local backups";
-          default = true;
-        };
-
-
-    };
-
-  config = mkIf cfg.enable {
-
-    users.users.jahanson.extraGroups = [ group ];
-
-    ## service
-    services.grafana = {
-      inherit port;
-      enable = true;
-      domain = host;
-      addr = "127.0.0.1";
-    };
-
-    ### gatus integration
-    mySystem.services.gatus.monitors = mkIf cfg.monitor [
-      {
-        name = app;
-        group = "${category}";
-        url = "https://${url}";
-        interval = "1m";
-        conditions = [ "[CONNECTED] == true" "[STATUS] == 200" "[RESPONSE_TIME] < 50" ];
-      }
-    ];
-
-    ### Ingress
-    services.nginx.virtualHosts.${url} = {
-      useACMEHost = config.networking.domain;
-      forceSSL = true;
-      locations."^~ /" = {
-        proxyPass = "http://127.0.0.1:${builtins.toString port}";
-      };
-    };
-
-    ### firewall config
-
-    # networking.firewall = mkIf cfg.openFirewall {
-    #   allowedTCPPorts = [ port ];
-    #   allowedUDPPorts = [ port ];
-    # };
-
-    ### backups
-    warnings = [
-      (mkIf (!cfg.backups && config.mySystem.purpose != "Development")
-        "WARNING: Local backups for ${app} are disabled!")
-    ];
-
-    services.restic.backups = config.lib.mySystem.mkRestic
-      {
-        inherit app user;
-        paths = [ appFolder ];
-        inherit appFolder;
-
-      };
-
-
-  };
-}

nixos/modules/nixos/services/monitoring.nix

@@ -1,8 +1,4 @@
-{ lib
+{ lib, config, ... }:
-, config
-, self
-, ...
-}:
 with lib;
 let
   cfg = config.mySystem.services.promMonitoring;
@@ -30,8 +26,6 @@ in
       smartctl = {
         enable = true;
       };
-
-
     };
 
     # ensure ports are open

nixos/modules/nixos/services/nfs/default.nix

@@ -1,48 +0,0 @@
-{ lib
-, config
-, pkgs
-, ...
-}:
-with lib;
-let
-  cfg = config.mySystem.nfs.nas;
-in
-{
-  options.mySystem.nfs.nas = {
-    enable = mkEnableOption "Mount NAS";
-    lazy = mkOption
-      {
-        type = lib.types.bool;
-        description = "Enable lazymount";
-        default = false;
-      };
-  };
-
-  config = mkIf cfg.enable
-    {
-      services.rpcbind.enable = true; # needed for NFS
-      environment.systemPackages = with pkgs; [ nfs-utils ];
-
-      systemd.mounts = lib.mkIf cfg.lazy [{
-        type = "nfs";
-        mountConfig = {
-          Options = "noatime";
-        };
-        what = "${config.mySystem.nasAddress}:/tank";
-        where = "/mnt/nas";
-      }];
-
-      systemd.automounts = lib.mkIf cfg.lazy [{
-        wantedBy = [ "multi-user.target" ];
-        automountConfig = {
-          TimeoutIdleSec = "600";
-        };
-        where = "/mnt/nas";
-      }];
-
-      fileSystems."${config.mySystem.nasFolder}" = lib.mkIf (!cfg.lazy) {
-        device = "${config.mySystem.nasAddress}:/tank";
-        fsType = "nfs";
-      };
-    };
-}

nixos/modules/nixos/services/nginx/default.nix

@@ -1,8 +1,4 @@
-{ lib
+{ lib, config, ... }:
-, config
-, pkgs
-, ...
-}:
 with lib;
 let
   cfg = config.mySystem.services.nginx;

nixos/modules/nixos/services/nix-serve/default.nix

@@ -1,8 +1,4 @@
-{ lib
+{ lib, config, pkgs, ... }:
-, config
-, pkgs
-, ...
-}:
 with lib;
 let
   cfg = config.mySystem.services.nix-serve;
@@ -13,10 +9,8 @@ in
   # enable nix serve binary cache
   # you can test its working with `nix store ping --store http://10.8.20.33:5000`
   config.services.nix-serve = mkIf cfg.enable {
-
     enable = true;
     package = pkgs.nix-serve-ng;
     openFirewall = true;
-
   };
 }

nixos/modules/nixos/services/podman/default.nix

@@ -1,9 +1,4 @@
-{ lib
+{ lib, config, pkgs, ... }:
-, config
-, pkgs
-, ...
-}:
-
 with lib;
 let
   cfg = config.mySystem.services.podman;
@@ -34,8 +29,14 @@ in
 
       environment.systemPackages = with pkgs; [
         podman-tui # status of containers in the terminal
+        lazydocker
       ];
       
+      programs.fish.shellAliases = {
+        # lazydocker --> lazypodman
+        lazypodman="sudo DOCKER_HOST=unix:///run/podman/podman.sock lazydocker";
+      };
+
       networking.firewall.interfaces.podman0.allowedUDPPorts = [ 53 ];
 
       # extra user for containers

nixos/modules/nixos/services/postgresql/default.nix

@@ -1,15 +1,9 @@
-{ lib
+{ lib, config, ... }:
-, config
-, pkgs
-, ...
-}:
 with lib;
 let
   cfg = config.mySystem.${category}.${app};
   app = "postgresql";
   category = "services";
-  description = "Postgres RDMS";
-  appFolder = "/var/lib/${app}";
 in
 {
   options.mySystem.${category}.${app} =
@@ -21,6 +15,13 @@ in
           type = lib.types.bool;
           description = "Enable prometheus scraping";
           default = true;
+          
+        };
+      backupLocation = mkOption
+        {
+          type = lib.types.string;
+          description = "Location for sql backups to be stored.";
+          default = "/persist/backup/postgresql";
         };
       backup = mkOption
         {
@@ -28,7 +29,6 @@ in
           description = "Enable backups";
           default = true;
         };
-
     };
 
   config = mkIf cfg.enable {
@@ -55,7 +55,7 @@ in
     # enable backups
     services.postgresqlBackup = mkIf cfg.backup {
       enable = lib.mkForce true;
-      location = "${config.mySystem.nasFolder}/backup/nixos/postgresql";
+      location = cfg.backupLocation;
     };
 
     ### firewall config

nixos/modules/nixos/services/radicale/default.nix

@@ -1,20 +1,14 @@
-{ lib
+{ lib, config, ... }:
-, config
-, pkgs
-, ...
-}:
 with lib;
 let
   cfg = config.mySystem.${category}.${app};
   app = "radicale";
   category = "services";
-  description = "Contact/Calendar managment";
   user = app; #string
   group = app; #string
   port = 5232; #int
   appFolder = "/var/lib/${app}";
-  host = "${app}" + (if cfg.dev then "-dev" else "");
+  url = "${app}.jahanson.tech";
-  url = "${host}.${config.networking.domain}";
 in
 {
   options.mySystem.${category}.${app} =
@@ -33,26 +27,12 @@ in
           description = "Enable prometheus scraping";
           default = true;
         };
-      addToDNS = mkOption
-        {
-          type = lib.types.bool;
-          description = "Add to DNS list";
-          default = true;
-        };
-      dev = mkOption
-        {
-          type = lib.types.bool;
-          description = "Development instance";
-          default = false;
-        };
       backups = mkOption
         {
           type = lib.types.bool;
           description = "Enable local backups";
           default = true;
         };
-
-
     };
 
   config = mkIf cfg.enable {
@@ -83,8 +63,7 @@ in
           htpasswd_encryption = "plain";
           realm = "Radicale - Password Required";
         };
-        storage.filesystem_folder = "/var/lib/radicale/collections"; # TODO impermance/move?
+        storage.filesystem_folder = "/var/lib/radicale/collections";
-
       };
     };
     
@@ -126,9 +105,6 @@ in
         inherit app user;
         paths = [ appFolder ];
         inherit appFolder;
-
       });
-
-
   };
 }

nixos/modules/nixos/services/reboot-required-check.nix

@@ -1,8 +1,4 @@
-{ lib
+{ lib, config, ... }:
-, config
-, self
-, ...
-}:
 with lib;
 let
   cfg = config.mySystem.services.rebootRequiredCheck;
@@ -11,7 +7,6 @@ in
   options.mySystem.services.rebootRequiredCheck.enable = mkEnableOption "Reboot required check";
 
   config = mkIf cfg.enable {
-
     # Enable timer
     systemd.timers."reboot-required-check" = {
       wantedBy = [ "timers.target" ];
@@ -46,9 +41,5 @@ in
         User = "root";
       };
     };
-
-
   };
-
-
 }

nixos/modules/nixos/services/restic/default.nix

@@ -1,8 +1,4 @@
-{ lib
+{ lib, config, pkgs, ... }:
-, config
-, pkgs
-, ...
-}:
 with lib;
 let
   cfg = config.mySystem.system.resticBackup;
@@ -30,10 +26,9 @@ in
     mountPath = mkOption
       {
         type = types.str;
-        description = "Location for  snapshot mount";
+        description = "Location for snapshot mount";
         default = "/mnt/nightly_backup";
       };
-
   };
   config = {
 

nixos/modules/nixos/system/impermanence.nix

@@ -1,7 +1,4 @@
-{ lib
+{ lib, config, ... }:
-, config
-, ...
-}:
 let
   cfg = config.mySystem.system.impermanence;
 in

nixos/modules/nixos/system/motd/default.nix

@@ -53,22 +53,24 @@ let
         zpool list -Ho name,cap,size | awk '{ printf("%-10s%+3s used out of %+5s\n", $1, $2, $3); }' | sed -e 's/^/  /'
       fi
       printf "\n"
-      printf "$BOLDService status$ENDCOLOR\n"
       
-      while IFS= read -r line; do
+      if [[ -n "$service_status" ]]; then
-        if [[ $line =~ ".scope" ]]; then
+      printf "$BOLDService status$ENDCOLOR\n"
-          continue
+        while IFS= read -r line; do
-        fi
+          if [[ $line =~ ".scope" ]]; then
-        if echo "$line" | grep -q 'failed'; then
+            continue
-          service_name=$(echo $line | awk '{print $2;}' | sed 's/podman-//g')
+          fi
-          printf "$RED• $ENDCOLOR%-50s $RED[failed]$ENDCOLOR\n" "$service_name"
+          if echo "$line" | grep -q 'failed'; then
-        elif echo "$line" | grep -q 'running'; then
+            service_name=$(echo $line | awk '{print $2;}' | sed 's/podman-//g')
-          service_name=$(echo $line | awk '{print $1;}' | sed 's/podman-//g')
+            printf "$RED• $ENDCOLOR%-50s $RED[failed]$ENDCOLOR\n" "$service_name"
-          printf "$GREEN• $ENDCOLOR%-50s $GREEN[active]$ENDCOLOR\n" "$service_name"
+          elif echo "$line" | grep -q 'running'; then
-        else
+            service_name=$(echo $line | awk '{print $1;}' | sed 's/podman-//g')
-          echo "service status unknown"
+            printf "$GREEN• $ENDCOLOR%-50s $GREEN[active]$ENDCOLOR\n" "$service_name"
-        fi
+          else
-      done <<< "$service_status"
+            echo "service status unknown"
+          fi
+        done <<< "$service_status"
+      fi
     '';
   cfg = config.mySystem.system.motd;
 in

nixos/modules/nixos/system/nix.nix

@@ -1,8 +1,4 @@
-{ lib
+{ lib, config, ... }:
-, config
-, self
-, ...
-}:
 with lib;
 let
   cfg = config.mySystem.nix;
@@ -27,7 +23,6 @@ in
         };
     };
   };
-
   config.nix = {
     optimise.automatic = cfg.autoOptimiseStore;
     # automatically garbage collect nix store

nixos/modules/nixos/system/openssh.nix

@@ -1,8 +1,4 @@
-{ lib
+{ lib, config, ... }:
-, config
-, self
-, ...
-}:
 with lib;
 let
   cfg = config.mySystem.services.openssh;
@@ -23,7 +19,6 @@ in
         default = "no";
       };
   };
-
   config = mkIf cfg.enable {
     services.openssh = {
       enable = true;

nixos/modules/nixos/system/pushover/default.nix

@@ -8,7 +8,7 @@ let
   cfg = config.mySystem.system.systemd.pushover-alerts;
 in
 {
-  options.mySystem.system.systemd.pushover-alerts.enable = mkEnableOption "Pushover alers for systemd failures" // { default = true; };
+  options.mySystem.system.systemd.pushover-alerts.enable = mkEnableOption "Pushover alerts for systemd failures" // { default = true; };
   options.systemd.services = mkOption {
     type = with types; attrsOf (
       submodule {

nixos/modules/nixos/system/security.nix

@@ -1,7 +1,4 @@
-{ lib
+{ lib, config, ... }:
-, config
-, ...
-}:
 with lib;
 let
   cfg = config.mySystem.security;

nixos/modules/nixos/system/systempackages.nix

@@ -1,8 +1,4 @@
-{ lib
+{ lib, config, ... }:
-, config
-, self
-, ...
-}:
 with lib;
 let
   cfg = config.mySystem.system;

nixos/modules/nixos/system/time.nix

@@ -1,7 +1,4 @@
-{ lib
+{ lib, config, ... }:
-, config
-, ...
-}:
 let
   cfg = config.mySystem.time;
 in

nixos/modules/nixos/system/zfs.nix

@@ -1,8 +1,4 @@
-{ lib
+{ lib, config, pkgs, ... }:
-, config
-, pkgs
-, ...
-}:
 let
   cfg = config.mySystem.system.zfs;
 in
@@ -40,6 +36,5 @@ with lib;
       ZED_PUSHOVER_TOKEN = "$(${pkgs.busybox}/bin/cat ${config.sops.secrets.pushover-api-key.path})";
       ZED_PUSHOVER_USER = "$(${pkgs.busybox}/bin/cat ${config.sops.secrets.pushover-user-key.path})";
     };
-
   };
 }

nixos/profiles/global.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, imports, modulesPath, ... }:
+{ config, lib, pkgs, modulesPath, ... }:
 
 with lib;
 {

nixos/profiles/global/default.nix

@@ -5,5 +5,4 @@
     ./system.nix
     ./users.nix
   ];
-
 }

nixos/profiles/global/sops.nix

@@ -1,4 +1,4 @@
-{ config, ... }:
+{ ... }:
 {
   sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
   # Secret for machine-specific pushover

nixos/profiles/global/system.nix

@@ -1,5 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ lib, pkgs, ... }:
-with lib;
 {
   system = {
     # Enable printing changes on nix build etc with nvd

nixos/profiles/role-workstation.nix

@@ -1,12 +1,10 @@
-{ config, lib, pkgs, imports, boot, self, inputs, ... }:
+{ config, lib, pkgs, ... }:
 # Role for workstations
 # Covers desktops/laptops, expected to have a GUI and do workloads
 # Will have home-manager installs
 
 with config;
 {
-
-
   mySystem = {
 
     de.gnome.enable = true;
@@ -15,20 +13,20 @@ with config;
     # TODO decide if i drop to bash on pis?
     shell.fish.enable = true;
 
-    nfs.nas = {
+    # TODO make nfs server configurable
-      enable = true;
+    # nfs.nas = {
-      lazy = true;
+    #   enable = true;
-    };
+    #   lazy = true;
+    # };
+
     system.resticBackup.local.enable = false;
     system.resticBackup.remote.enable = false;
 
   };
 
   boot = {
-
     binfmt.emulatedSystems = [ "aarch64-linux" ]; # Enabled for raspi4 compilation
     plymouth.enable = true; # hide console with splash screen
-
   };
 
   nix.settings = {