nixos/home/modules/default.nix

@@ -1,5 +1,8 @@
-{ lib, ... }: {
+{ inputs
-  
+, config
+, lib
+, ...
+}: {
   imports = [
     ./shell
     ./programs

nixos/home/modules/shell/fish/default.nix

@@ -23,6 +23,8 @@ in
           ll = "${pkgs.eza}/bin/eza --long --all --group --header";
           tm = "tmux attach -t (basename $PWD) || tmux new -s (basename $PWD)";
           x = "exit";
+          # lazydocker --> lazypodman
+          lazypodman="sudo DOCKER_HOST=unix:///run/podman/podman.sock lazydocker";
         };
 
         shellAbbrs = {

nixos/lib/default.nix

@@ -1,4 +1,4 @@
-{ lib, ... }:
+{ inputs, lib, ... }:
 
 with lib;
 rec {
@@ -12,6 +12,9 @@ rec {
       user = existsOrDefault "user" options "568";
       group = existsOrDefault "group" options "568";
 
+      subdomain = existsOrDefault "subdomainOverride" options options.app;
+      host = existsOrDefault "host" options "${subdomain}.${options.domain}";
+
       enableBackups = (lib.attrsets.hasAttrByPath [ "persistence" "folder" ] options)
         && (lib.attrsets.attrByPath [ "persistence" "enable" ] true options);
       # nix doesnt have an exhausive list of options for oci

nixos/modules/README.md

@@ -1,6 +1,6 @@
 ## Modules
 
-A set of 'custom' modules with the aim to enable easy on/off/settings to build up a system modularly to my 'specs'.
+A set of 'custom' modules with the aim to enable easy on/off/settings to build up a system modulary to my 'specs'.
 
 The main goal is to build up a `mySystem` options key which is easy to read and toggle functionality on and off.
 

nixos/modules/nixos/de/default.nix

@@ -1,5 +1,6 @@
 {
   imports = [
     ./gnome.nix
+
   ];
 }

nixos/modules/nixos/de/gnome.nix

@@ -1,4 +1,9 @@
-{ lib, config, pkgs, ... }:
+{ lib
+, config
+, pkgs
+, ...
+}:
+
 with lib;
 let
   cfg = config.mySystem.de.gnome;
@@ -8,6 +13,7 @@ in
   options.mySystem.de.gnome.systrayicons = mkEnableOption "Enable systray icons" // { default = true; };
   options.mySystem.de.gnome.gsconnect = mkEnableOption "Enable gsconnect (KDEConnect for GNOME)" // { default = true; };
 
+
   config = mkIf cfg.enable {
 
     # Ref: https://nixos.wiki/wiki/GNOME
@@ -32,12 +38,17 @@ in
           # GNOME
           gnome.enable = true;
         };
+
       };
 
       udev.packages = optionals cfg.systrayicons [ pkgs.gnome.gnome-settings-daemon ]; # support appindicator
+
+
     };
 
     # systyray icons
+
+
     # extra pkgs and extensions
     environment = {
       systemPackages = with pkgs; [
@@ -51,7 +62,9 @@ in
         # dont forget to enable them per-user in dconf settings -> "org/gnome/shell"
         gnomeExtensions.vitals
         gnomeExtensions.caffeine
+        gnomeExtensions.spotify-tray
         gnomeExtensions.dash-to-dock
+
       ]
       ++ optionals cfg.systrayicons [ pkgs.gnomeExtensions.appindicator ];
     };
@@ -76,9 +89,21 @@ in
     systemd.services."getty@tty1".enable = false;
     systemd.services."autovt@tty1".enable = false;
 
+    # TODO tidy this
+    # port forward for GNOME when using RDP***REMOVED***
+
+    # for RDP TODO make this a flag if RDP is enabled per host
+    networking.firewall.allowedTCPPorts = [
+      3389
+    ];
+
     # And dconf
     programs.dconf.enable = true;
 
+    # https://github.com/NixOS/nixpkgs/issues/114514
+    # dconf write /org/gnome/mutter/experimental-features "['scale-monitor-framebuffer']" TODO hack for GNOME 45
+
+
     # Exclude default GNOME packages that dont interest me.
     environment.gnome.excludePackages =
       (with pkgs; [

nixos/modules/nixos/programs/shell/fish.nix

@@ -1,4 +1,9 @@
-{ lib, config, ... }:
+{ lib
+, config
+, self
+, pkgs
+, ...
+}:
 with lib;
 let
   cfg = config.mySystem.shell.fish;

nixos/modules/nixos/security/acme/default.nix

@@ -1,7 +1,17 @@
-{ lib, config, ... }:
+{ lib
+, config
+, pkgs
+, ...
+}:
 with lib;
 let
   cfg = config.mySystem.security.acme;
+  app = "acme";
+  appFolder = "/var/lib/${app}";
+  # persistentFolder = "${config.mySystem.persistentFolder}/var/lib/${appFolder}";
+  user = app;
+  group = app;
+
 in
 {
   options.mySystem.security.acme.enable = mkEnableOption "acme";

nixos/modules/nixos/security/default.nix

@@ -1,6 +1,9 @@
-{ ... }:
+{ lib, config, ... }:
+with lib;
 {
   imports = [
     ./acme
   ];
+
+
 }

nixos/modules/nixos/services/cockpit/default.nix

@@ -1,4 +1,9 @@
-{ lib, config, pkgs, ... }:
+{ lib
+, config
+, pkgs
+, ...
+}:
+
 with lib;
 let
   cfg = config.mySystem.services.cockpit;

nixos/modules/nixos/services/default.nix

@@ -3,7 +3,9 @@
     ./cockpit
     ./forgejo
     ./glances
+    ./grafana
     ./monitoring.nix
+    ./nfs
     ./nginx
     ./nix-serve
     ./podman

nixos/modules/nixos/services/forgejo/default.nix

@@ -1,7 +1,9 @@
-{ lib, config, ... }:
+{ lib, pkgs, config, ... }:
 with lib;
 let
   cfg = config.mySystem.services.forgejo;
+  app = "forgejo";
+  port = 443;
   http_port = 3000;
   serviceUser = "forgejo";
   domain = "git.hsn.dev";

nixos/modules/nixos/services/glances/default.nix

@@ -1,4 +1,8 @@
-{ pkgs, config, lib, ... }:
+{ pkgs
+, config
+, lib
+, ...
+}:
 let
   cfg = config.mySystem.services.glances;
   app = "Glances";
@@ -13,7 +17,16 @@ with lib;
           type = lib.types.bool;
           description = "Enable gatus monitoring";
           default = true;
+
         };
+      addToHomepage = mkOption
+        {
+          type = lib.types.bool;
+          description = "Add to homepage";
+          default = true;
+
+        };
+
     };
   config = mkIf cfg.enable {
 
@@ -33,6 +46,7 @@ with lib;
       firewall.allowedTCPPorts = [ 61208 ];
     };
 
+
     environment.etc."glances/glances.conf" = {
       text = ''
         [global]

nixos/modules/nixos/services/grafana/default.nix

@@ -0,0 +1,108 @@
+{ lib
+, config
+, pkgs
+, ...
+}:
+with lib;
+let
+  cfg = config.mySystem.services.grafana;
+  app = "grafana";
+  category = "services";
+  description = "Metric visualisation";
+  user = app; #string
+  group = app; #string
+  port = 2342; #int
+  appFolder = "/var/lib/${app}";
+  # persistentFolder = "${config.mySystem.persistentFolder}/var/lib/${appFolder}";
+  host = "${app}" + (if cfg.dev then "-dev" else "");
+  url = "${host}.${config.networking.domain}";
+in
+{
+  options.mySystem.${category}.${app} =
+    {
+      enable = mkEnableOption "${app}";
+      addToHomepage = mkEnableOption "Add ${app} to homepage" // { default = true; };
+      monitor = mkOption
+        {
+          type = lib.types.bool;
+          description = "Enable gatus monitoring";
+          default = true;
+        };
+      addToDNS = mkOption
+        {
+          type = lib.types.bool;
+          description = "Add to DNS list";
+          default = true;
+        };
+      dev = mkOption
+        {
+          type = lib.types.bool;
+          description = "Development instance";
+          default = false;
+        };
+      backups = mkOption
+        {
+          type = lib.types.bool;
+          description = "Enable local backups";
+          default = true;
+        };
+
+
+    };
+
+  config = mkIf cfg.enable {
+
+    users.users.jahanson.extraGroups = [ group ];
+
+    ## service
+    services.grafana = {
+      inherit port;
+      enable = true;
+      domain = host;
+      addr = "127.0.0.1";
+    };
+
+    ### gatus integration
+    mySystem.services.gatus.monitors = mkIf cfg.monitor [
+      {
+        name = app;
+        group = "${category}";
+        url = "https://${url}";
+        interval = "1m";
+        conditions = [ "[CONNECTED] == true" "[STATUS] == 200" "[RESPONSE_TIME] < 50" ];
+      }
+    ];
+
+    ### Ingress
+    services.nginx.virtualHosts.${url} = {
+      useACMEHost = config.networking.domain;
+      forceSSL = true;
+      locations."^~ /" = {
+        proxyPass = "http://127.0.0.1:${builtins.toString port}";
+      };
+    };
+
+    ### firewall config
+
+    # networking.firewall = mkIf cfg.openFirewall {
+    #   allowedTCPPorts = [ port ];
+    #   allowedUDPPorts = [ port ];
+    # };
+
+    ### backups
+    warnings = [
+      (mkIf (!cfg.backups && config.mySystem.purpose != "Development")
+        "WARNING: Local backups for ${app} are disabled!")
+    ];
+
+    services.restic.backups = config.lib.mySystem.mkRestic
+      {
+        inherit app user;
+        paths = [ appFolder ];
+        inherit appFolder;
+
+      };
+
+
+  };
+}

nixos/modules/nixos/services/monitoring.nix

@@ -1,4 +1,8 @@
-{ lib, config, ... }:
+{ lib
+, config
+, self
+, ...
+}:
 with lib;
 let
   cfg = config.mySystem.services.promMonitoring;
@@ -26,6 +30,8 @@ in
       smartctl = {
         enable = true;
       };
+
+
     };
 
     # ensure ports are open

nixos/modules/nixos/services/nfs/default.nix

@@ -0,0 +1,48 @@
+{ lib
+, config
+, pkgs
+, ...
+}:
+with lib;
+let
+  cfg = config.mySystem.nfs.nas;
+in
+{
+  options.mySystem.nfs.nas = {
+    enable = mkEnableOption "Mount NAS";
+    lazy = mkOption
+      {
+        type = lib.types.bool;
+        description = "Enable lazymount";
+        default = false;
+      };
+  };
+
+  config = mkIf cfg.enable
+    {
+      services.rpcbind.enable = true; # needed for NFS
+      environment.systemPackages = with pkgs; [ nfs-utils ];
+
+      systemd.mounts = lib.mkIf cfg.lazy [{
+        type = "nfs";
+        mountConfig = {
+          Options = "noatime";
+        };
+        what = "${config.mySystem.nasAddress}:/tank";
+        where = "/mnt/nas";
+      }];
+
+      systemd.automounts = lib.mkIf cfg.lazy [{
+        wantedBy = [ "multi-user.target" ];
+        automountConfig = {
+          TimeoutIdleSec = "600";
+        };
+        where = "/mnt/nas";
+      }];
+
+      fileSystems."${config.mySystem.nasFolder}" = lib.mkIf (!cfg.lazy) {
+        device = "${config.mySystem.nasAddress}:/tank";
+        fsType = "nfs";
+      };
+    };
+}

nixos/modules/nixos/services/nginx/default.nix

@@ -1,4 +1,8 @@
-{ lib, config, ... }:
+{ lib
+, config
+, pkgs
+, ...
+}:
 with lib;
 let
   cfg = config.mySystem.services.nginx;

nixos/modules/nixos/services/nix-serve/default.nix

@@ -1,4 +1,8 @@
-{ lib, config, pkgs, ... }:
+{ lib
+, config
+, pkgs
+, ...
+}:
 with lib;
 let
   cfg = config.mySystem.services.nix-serve;
@@ -9,8 +13,10 @@ in
   # enable nix serve binary cache
   # you can test its working with `nix store ping --store http://10.8.20.33:5000`
   config.services.nix-serve = mkIf cfg.enable {
+
     enable = true;
     package = pkgs.nix-serve-ng;
     openFirewall = true;
+
   };
 }

nixos/modules/nixos/services/podman/default.nix

@@ -1,4 +1,9 @@
-{ lib, config, pkgs, ... }:
+{ lib
+, config
+, pkgs
+, ...
+}:
+
 with lib;
 let
   cfg = config.mySystem.services.podman;
@@ -29,14 +34,8 @@ in
 
       environment.systemPackages = with pkgs; [
         podman-tui # status of containers in the terminal
-        lazydocker
       ];
 
-      programs.fish.shellAliases = {
-        # lazydocker --> lazypodman
-        lazypodman="sudo DOCKER_HOST=unix:///run/podman/podman.sock lazydocker";
-      };
-
       networking.firewall.interfaces.podman0.allowedUDPPorts = [ 53 ];
 
       # extra user for containers

nixos/modules/nixos/services/postgresql/default.nix

@@ -1,9 +1,15 @@
-{ lib, config, ... }:
+{ lib
+, config
+, pkgs
+, ...
+}:
 with lib;
 let
   cfg = config.mySystem.${category}.${app};
   app = "postgresql";
   category = "services";
+  description = "Postgres RDMS";
+  appFolder = "/var/lib/${app}";
 in
 {
   options.mySystem.${category}.${app} =
@@ -15,13 +21,6 @@ in
           type = lib.types.bool;
           description = "Enable prometheus scraping";
           default = true;
-          
-        };
-      backupLocation = mkOption
-        {
-          type = lib.types.string;
-          description = "Location for sql backups to be stored.";
-          default = "/persist/backup/postgresql";
         };
       backup = mkOption
         {
@@ -29,6 +28,7 @@ in
           description = "Enable backups";
           default = true;
         };
+
     };
 
   config = mkIf cfg.enable {
@@ -55,7 +55,7 @@ in
     # enable backups
     services.postgresqlBackup = mkIf cfg.backup {
       enable = lib.mkForce true;
-      location = cfg.backupLocation;
+      location = "${config.mySystem.nasFolder}/backup/nixos/postgresql";
     };
 
     ### firewall config

nixos/modules/nixos/services/radicale/default.nix

@@ -1,14 +1,20 @@
-{ lib, config, ... }:
+{ lib
+, config
+, pkgs
+, ...
+}:
 with lib;
 let
   cfg = config.mySystem.${category}.${app};
   app = "radicale";
   category = "services";
+  description = "Contact/Calendar managment";
   user = app; #string
   group = app; #string
   port = 5232; #int
   appFolder = "/var/lib/${app}";
-  url = "${app}.jahanson.tech";
+  host = "${app}" + (if cfg.dev then "-dev" else "");
+  url = "${host}.${config.networking.domain}";
 in
 {
   options.mySystem.${category}.${app} =
@@ -27,12 +33,26 @@ in
           description = "Enable prometheus scraping";
           default = true;
         };
+      addToDNS = mkOption
+        {
+          type = lib.types.bool;
+          description = "Add to DNS list";
+          default = true;
+        };
+      dev = mkOption
+        {
+          type = lib.types.bool;
+          description = "Development instance";
+          default = false;
+        };
       backups = mkOption
         {
           type = lib.types.bool;
           description = "Enable local backups";
           default = true;
         };
+
+
     };
 
   config = mkIf cfg.enable {
@@ -63,7 +83,8 @@ in
           htpasswd_encryption = "plain";
           realm = "Radicale - Password Required";
         };
-        storage.filesystem_folder = "/var/lib/radicale/collections";
+        storage.filesystem_folder = "/var/lib/radicale/collections"; # TODO impermance/move?
+
       };
     };
     
@@ -105,6 +126,9 @@ in
         inherit app user;
         paths = [ appFolder ];
         inherit appFolder;
+
       });
+
+
   };
 }

nixos/modules/nixos/services/reboot-required-check.nix

@@ -1,4 +1,8 @@
-{ lib, config, ... }:
+{ lib
+, config
+, self
+, ...
+}:
 with lib;
 let
   cfg = config.mySystem.services.rebootRequiredCheck;
@@ -7,6 +11,7 @@ in
   options.mySystem.services.rebootRequiredCheck.enable = mkEnableOption "Reboot required check";
 
   config = mkIf cfg.enable {
+
     # Enable timer
     systemd.timers."reboot-required-check" = {
       wantedBy = [ "timers.target" ];
@@ -41,5 +46,9 @@ in
         User = "root";
       };
     };
+
+
   };
+
+
 }

nixos/modules/nixos/services/restic/default.nix

@@ -1,4 +1,8 @@
-{ lib, config, pkgs, ... }:
+{ lib
+, config
+, pkgs
+, ...
+}:
 with lib;
 let
   cfg = config.mySystem.system.resticBackup;
@@ -29,6 +33,7 @@ in
         description = "Location for  snapshot mount";
         default = "/mnt/nightly_backup";
       };
+
   };
   config = {
 

nixos/modules/nixos/system/impermanence.nix

@@ -1,4 +1,7 @@
-{ lib, config, ... }:
+{ lib
+, config
+, ...
+}:
 let
   cfg = config.mySystem.system.impermanence;
 in

nixos/modules/nixos/system/motd/default.nix

@@ -53,9 +53,8 @@ let
         zpool list -Ho name,cap,size | awk '{ printf("%-10s%+3s used out of %+5s\n", $1, $2, $3); }' | sed -e 's/^/  /'
       fi
       printf "\n"
-      
-      if [[ -n "$service_status" ]]; then
       printf "$BOLDService status$ENDCOLOR\n"
+
       while IFS= read -r line; do
         if [[ $line =~ ".scope" ]]; then
           continue
@@ -70,7 +69,6 @@ let
           echo "service status unknown"
         fi
       done <<< "$service_status"
-      fi
     '';
   cfg = config.mySystem.system.motd;
 in

nixos/modules/nixos/system/nix.nix

@@ -1,4 +1,8 @@
-{ lib, config, ... }:
+{ lib
+, config
+, self
+, ...
+}:
 with lib;
 let
   cfg = config.mySystem.nix;
@@ -23,6 +27,7 @@ in
         };
     };
   };
+
   config.nix = {
     optimise.automatic = cfg.autoOptimiseStore;
     # automatically garbage collect nix store

nixos/modules/nixos/system/openssh.nix

@@ -1,4 +1,8 @@
-{ lib, config, ... }:
+{ lib
+, config
+, self
+, ...
+}:
 with lib;
 let
   cfg = config.mySystem.services.openssh;
@@ -19,6 +23,7 @@ in
         default = "no";
       };
   };
+
   config = mkIf cfg.enable {
     services.openssh = {
       enable = true;

nixos/modules/nixos/system/pushover/default.nix

@@ -8,7 +8,7 @@ let
   cfg = config.mySystem.system.systemd.pushover-alerts;
 in
 {
-  options.mySystem.system.systemd.pushover-alerts.enable = mkEnableOption "Pushover alerts for systemd failures" // { default = true; };
+  options.mySystem.system.systemd.pushover-alerts.enable = mkEnableOption "Pushover alers for systemd failures" // { default = true; };
   options.systemd.services = mkOption {
     type = with types; attrsOf (
       submodule {

nixos/modules/nixos/system/security.nix

@@ -1,4 +1,7 @@
-{ lib, config, ... }:
+{ lib
+, config
+, ...
+}:
 with lib;
 let
   cfg = config.mySystem.security;

nixos/modules/nixos/system/systempackages.nix

@@ -1,4 +1,8 @@
-{ lib, config, ... }:
+{ lib
+, config
+, self
+, ...
+}:
 with lib;
 let
   cfg = config.mySystem.system;

nixos/modules/nixos/system/time.nix

@@ -1,4 +1,7 @@
-{ lib, config, ... }:
+{ lib
+, config
+, ...
+}:
 let
   cfg = config.mySystem.time;
 in

nixos/modules/nixos/system/zfs.nix

@@ -1,4 +1,8 @@
-{ lib, config, pkgs, ... }:
+{ lib
+, config
+, pkgs
+, ...
+}:
 let
   cfg = config.mySystem.system.zfs;
 in
@@ -36,5 +40,6 @@ with lib;
       ZED_PUSHOVER_TOKEN = "$(${pkgs.busybox}/bin/cat ${config.sops.secrets.pushover-api-key.path})";
       ZED_PUSHOVER_USER = "$(${pkgs.busybox}/bin/cat ${config.sops.secrets.pushover-user-key.path})";
     };
+
   };
 }

nixos/profiles/global.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, modulesPath, ... }:
+{ config, lib, pkgs, imports, modulesPath, ... }:
 
 with lib;
 {

nixos/profiles/global/default.nix

@@ -5,4 +5,5 @@
     ./system.nix
     ./users.nix
   ];
+
 }

nixos/profiles/global/sops.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ config, ... }:
 {
   sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
   # Secret for machine-specific pushover

nixos/profiles/global/system.nix

@@ -1,4 +1,5 @@
-{ lib, pkgs, ... }:
+{ config, lib, pkgs, ... }:
+with lib;
 {
   system = {
     # Enable printing changes on nix build etc with nvd

nixos/profiles/role-workstation.nix

@@ -1,10 +1,12 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, imports, boot, self, inputs, ... }:
 # Role for workstations
 # Covers desktops/laptops, expected to have a GUI and do workloads
 # Will have home-manager installs
 
 with config;
 {
+
+
   mySystem = {
 
     de.gnome.enable = true;
@@ -13,20 +15,20 @@ with config;
     # TODO decide if i drop to bash on pis?
     shell.fish.enable = true;
 
-    # TODO make nfs server configurable
+    nfs.nas = {
-    # nfs.nas = {
+      enable = true;
-    #   enable = true;
+      lazy = true;
-    #   lazy = true;
+    };
-    # };
-
     system.resticBackup.local.enable = false;
     system.resticBackup.remote.enable = false;
 
   };
 
   boot = {
+
     binfmt.emulatedSystems = [ "aarch64-linux" ]; # Enabled for raspi4 compilation
     plymouth.enable = true; # hide console with splash screen
+
   };
 
   nix.settings = {