harald/nixcfg
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

A new start

Browse source
This commit is contained in:
Harald Hoyer 2024-03-21 15:00:36 +01:00
commit f4e2368893
93 changed files with 7621 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
.gitattributes vendored Normal file
View file

@ -0,0 +1 @@
systems/x86_64-linux/mx/mailserver.nix text filter=rot8000

1
.gitignore vendored Normal file
View file

@ -0,0 +1 @@
/.idea

30
.secrets/hetzner/internetbs.yaml Normal file
View file

@ -0,0 +1,30 @@
internetbs: ENC[AES256_GCM,data:usJ/08NTnlLNcnzVyycFVe7VN2LS7gNkqQRltpTEKBHu8POjaNK2E7t0tuq3a+EcxkhxBsd7O8lw7fjFDh6ZPo7nfUQjvVQzbaI1JjMUOw==,iv:kJFbg9mt3EMSzrUWEzC4xK6ilAiRp+fktYUX+W6uwSM=,tag:tsE6qpyjA5d4egFM2IJzRA==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age1qur4kh3gay9ryk3jh2snvjp6x9eq94zdrmgkrfcv4fzsu7l6lumq4tr3uy
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHT3U4dmhTTmRGRnFxMmhQ
Lzc0RWdQaThYZDhtcHFTSHNPNS9pd2RKS0N3CnVlUmx0V3BCUHhkQ1d0Nlk3NGEw
bHM1YWQySEZVV3VjZUcwcE1TSW9scDgKLS0tIFNYbnJxVzA4d2dsQTRVVXhDdFUv
OS9xVXVUSTFmbStObGdLRUl5RWlGTk0Ki6/1TMHB/BfL53qDYvQwmW6xHes27Ni4
exk+T9OlgKsHQfdRpu3t3TrdnFIJYmAJeuU6NNdlp18juNPp9kbBEg==
-----END AGE ENCRYPTED FILE-----
- recipient: age1dwcz3fmp29ju4svy0t0wz4ylhpwlqa8xpw4l7t4gmgqr0ev37qrsfn840l
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUY2VCS1ZtWjc3VFFLSUhl
R2EzbE5SMWlWOXZhWmVuckFzVGR1aFp2aVQ0CllkemVFaFhwYzgxNFNlL3Z1QWRP
d0Rqb2FtYXI5T2ZzUjJIMXluUWwwdnMKLS0tIEQ4Yk1vRzVpZVF4blFxVkdIRGFl
ZmMxald2NU9HSE1ZOUN5R2twMXdmVGcKAXcUXemrleTxGxkMP+4mWh8uYwN1FTDc
cHbaln4DsDOqHtqqpJheTqN0mMOmkDvTCq2jbiKIkr2sruh49acIoA==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2023-10-24T13:45:16Z"
mac: ENC[AES256_GCM,data:MOEFuQSx+SlXM7ajjQR6twCULem19A/hYKHBQhnLMb2V9o8SuYOvhmn8dz/UE558dnJt6eIB0rRKTItEbxNfyjvr6r2q+GPi7OM85ytLd0UuNPwcKUrqmlx5JPCRWt189U+qetbIDH7PXCawfccbLJmJWHBhFn+ZwqPbLs2wUnI=,iv:YUcEofcFTT8KgVVoQg/+bsCgBTdyGmmYLX7m1cqonhA=,tag:9oKLUS0eebRvC7UwEgkhew==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.7.3

31
.secrets/hetzner/postgres.yaml Normal file
View file

@ -0,0 +1,31 @@
postgres:
gitea_dbpass: ENC[AES256_GCM,data:YdouHox7M6iTygteftGMB1W/hEWUchlZ+35ofgbI0xoYGt7QzVZyPKpO8cvcVNPTgdWk6B1zWlFw6JRhXv+ovg==,iv:0EkZGv8iQkq2fcyViCJy/Rj7n3w1BSuU5NiPw5sJhr0=,tag:z3Ff2dNzJBuBqyGiqoxZcg==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age1qur4kh3gay9ryk3jh2snvjp6x9eq94zdrmgkrfcv4fzsu7l6lumq4tr3uy
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBOUVxRXduVWhjNHdnZCtH
U0VLWE01VkJaWmNDUzE1bmorRDN5RWNwTnhJClRkcDNzb1U2MzZ3TDhXSnI4Z252
a1A0dzQ5eUlScDhhYjl6WEdnYnlxUm8KLS0tIDczaXlvcDVwUzdQY1h6a01QM2p6
T3FBVWJqaHQwVnIrNFVsWVBub2djMG8KsbZb43UkVe1Up0O15UTC/PdsEkwwOnVW
9P4AGO097HfTLkAjKJHx5QYF02dJ+4xb6rgzUYt9Nr8h8+GD0xRAfQ==
-----END AGE ENCRYPTED FILE-----
- recipient: age1dwcz3fmp29ju4svy0t0wz4ylhpwlqa8xpw4l7t4gmgqr0ev37qrsfn840l
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBdlhZbDhqamNGU2QrZDN5
MlY5RFgrV3NJUk1PYWJLSnpCZjhiTUF5b0RrCmRHV0JnYlBmL2p0WE9UTzJUcVhK
dkhiYlJtYWtDN0lseHRCNTUzb252TmsKLS0tIGZKbjA3dkVwcnZNK2djV1BvSkJo
a09FM1ZqSWdsdytjdVFCanVldHVoWUUKyy/LXNd/vZLdgXYXfloFkNviaddvrazw
4Z0bJ/fqGvRPlLkTUzZlhWKVXfZFGgo5nQSEvyphkIb6UCyd9VamnA==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2023-10-24T14:02:40Z"
mac: ENC[AES256_GCM,data:7yikTQ7wsy13Hfwo5VKpUow8KW2/UYfzrWuA6Rp+21FglG3f7s6PLlrpMLooDPiaHxiPfc1fHg3u6UDcotyUljMZMQCCfvmLC1saALB6lFHEj3KoTa/NtgimYB2FeK92RcrU+EymmwZItmI/t1CuH8/qvXydWnO9zMWplMtW89Y=,iv:PEmElInahA5pPQvR9aatpKt+JhsKEtBPCPm926/59Uo=,tag:mflo6uSOh8SDKoC5JLHDIw==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.7.3

31
.secrets/sgx/backup-s3.yaml Normal file
View file

@ -0,0 +1,31 @@
backup-s3: ENC[AES256_GCM,data:gT5yQDC/nW7INa6e+BZOiR+Ky6SvU8hsRMvCoBDw8bOJT4yWlLkeYjoZOUSAdNaWyrNuypy72TUnq4+Udhrqd9YeneR7vj+UOSsNpDdqzVaTb0kTiL0lBT3RvXZ3QYVmSqYFnjrR,iv:VVQkDUuQwxHYFgOWueYIYq9M3WSIEYycdH+j+ibeS8w=,tag:wKe5kz0HxpZOW7GCw9rctg==,type:str]
backup-pw: ENC[AES256_GCM,data:JRgZXuO1eABr4fNmWJO/WgFLirEbGssLy+Lc29FWNFfBomDlr+73AFUcj1Ln8w92msuxubOY81jgEtG15PFX/g==,iv:4i6UyGYMJE4a2L4485ywlhZAE900wjVRia/X92Xr3Yg=,tag:d2oU6tSUwj3cdLJNmDHEEQ==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age149fqcw5jze00vd7jauylrp4j5xyv7amlu57jjfuzghkqtzlnxajs704uz3
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPRjFydkVQTXlCWEJCSjNl
Unk1ejJ3K0M4dFVNeFFHK1c4ZjhwTG93b1cwCnJkN3BQZE1Na3VyZkc5SU1PNVkv
b3hVNzNIRStnemZ2RUlxSDJxRWtGTDAKLS0tIGVmK0d0Y2twMTE0U0hoRmRVR2R0
cjhYNlJZdG1QVzYyRzhoUm1wLzdGY1kK0QNSItqjmwLTxQaMEC1bYrtlpE8EGlHb
hkWADj/Qw8m7Hbi1YCL6YWalHfoHM80VlfGGV6oAH4KH7l2mykqfzQ==
-----END AGE ENCRYPTED FILE-----
- recipient: age1dwcz3fmp29ju4svy0t0wz4ylhpwlqa8xpw4l7t4gmgqr0ev37qrsfn840l
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNcHc0NXY1YVhiREJ6ZFBz
cGVqM2ZvZVBYSnlZZ00vS2ZjeUZHeEVrelJ3CnhQRWhWcFRHeUJrcE9OaU9sQ21n
bDJBdnMrRTRKdEtMcWpDQTdqc0R4dDAKLS0tIGZPeTdGOFBSMjhTOEk5TEVnS2tm
QVZ6UEU3eFBEZ2RBRFdMd0sraVl4Z2cKOxGZrvhamIKuYubd6xvHS5VgFuXw7i+x
JvB7Wuu1+GTKk3VM7n66tjZrcZId4W8N9kYtl7w/mE4l5Wg9zIK6ig==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2023-12-06T12:32:28Z"
mac: ENC[AES256_GCM,data:wkR3Z6WuR2h2MuA9vPwcr1Lw0xJrNRIa5REUYT8j4Fhxd+zLghzemp7CoSBxzYaVeD5xIS4FYYvjAxkAV9FZMMWznjkFI+RkBMvlA6O7cUrUtTwh7YJ4ZTfh0iNcihuBXH9XWA7Ku0C9SwGUjGj+uaKPW4JCaVaNxDg0VzdyFeg=,iv:BdI68VoQlPF+eT7FglGyMgtgUT+3okSp9KIZQsIZSZo=,tag:hzQ9I/WXdtqwYjQyeD9XcA==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.8.1

30
.secrets/sgx/pccs.yaml Normal file
View file

@ -0,0 +1,30 @@
pccs: ENC[AES256_GCM,data:gsew4gI/i9vGt0X9pKeGed1ItbKEwL/OuYi7W4kti421V2Lor5QGXWsfw89408mPBP68d1qI6Q5BIUvCJdw7c3NJRH/W5UMF7c5ZlVtwrPK2q2v98LiwoeZ1KRDVrGSrchqVw00PClWIKkvh69s7iD10G3Wm8Ctr8ownLVaJnPPn2GQBtX1KJFXz8ikqKf5dUw3aQh7RGxkoLjzgrMx+7jW/t3R9MnPB1eMIUrsXrC40WXuxPaFDRdgvkCZG3KY0RGxR9ndvdDixunYheeKCt8norFrE4GG5Zj9/SHL40JVOTp53lu2IqkroxvDCiANCvVmKiwhLBcPwblgJ8gB9/6+ofNZqKunnBsJ6HNQczqHWFG1p7YNXAkCeZF4R6+TGHEfCmtrzoV0sPPv43peQX5Ibp84iHggCHAaDvOMtDz6zdKFmNC08jqPVC393IkP5KeHDK3hyoa8sVm6PhqCDG5QR8NmySGoXDDdOx1aj0b0xUPHviEQbegn6LlwmXA==,iv:7m5Y0h6apbtOHufVnV/uoK3sEzj5mPvk4eHd1/XCpKs=,tag:K4JmlbXlFzQHlJSYoFasww==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age149fqcw5jze00vd7jauylrp4j5xyv7amlu57jjfuzghkqtzlnxajs704uz3
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3VXloZWZoWFpPcm9KMnJp
c00vZDM3d01PWXpnVy9tb3NXZkZ0a0JlaVhVCmx6dXZwaUNWY3FzbTdBMlJNTEVB
MlNHa1Q3VmlrUnhNSlpFYmc4Qm5mNFkKLS0tIHlzY2VMVXBZYW9kaUdRakZUNlk3
SXBoeEZxNktZSDc3aUh2b2g2OXpZQ3cKLNHjYAAHR5LwoSKfaFT8eLJxYNmk/f1S
xNaGpR+sS/6xNSHtkz2w++crcPa/mt9qlQja1kLSGB3PFURSqfUjRQ==
-----END AGE ENCRYPTED FILE-----
- recipient: age1dwcz3fmp29ju4svy0t0wz4ylhpwlqa8xpw4l7t4gmgqr0ev37qrsfn840l
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2anNCTitMRzh0dmt3M1pa
REs5SmhJdExtS2lubXd3ZzY0OGxrTEtnVnlJCmRQNTQ1Rnh6aVpVdTZyYzl4aGJY
OVFiMHNTR090UkRqWDAxS0wwMEhDREkKLS0tIHVDU1A3Y3dKZGh6YlVud3FWNDJj
NW1jNlNVd2cwYXZyY3ZZQTJPM3ZRUlEK8/MXSxDhEo/P2NlZT8IrgwuWRAM/75XA
vrnlknbGJI9bto7O5j77O4OKSuniGat1/ZA5xG/o8YhumSbDtk5ZTA==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2023-12-06T11:31:45Z"
mac: ENC[AES256_GCM,data:5nHxMRjWM8OQ1eyU5KtaC7m74Ss/L4/FF5Bn/zKCfX/x0GS/Q01lwGmHk/4Loyj66pt8wJCtK8mzL67RKPARAiX/9BS9pENYgfRwRk4cEmo/OdjSTOKkr7BO8Q9vAd1beMbDkX1pY/MJpmqvsYdK1yd5yNioAh8IC/PvSh2wu7s=,iv:a7cM8dpm+LMUysaQRT6odCChuLPM1biPHQOFTilH1o8=,tag:f330s/P+rlFVgr0CMc5Jjg==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.8.1

31
.secrets/t15/backup-s3.yaml Normal file
View file

@ -0,0 +1,31 @@
backup-s3: ENC[AES256_GCM,data:VsEBUFu2QekSxaBTik4pfnmDKmW68x/R0H90sRVPLyup3MRs0PBk7Qk0hCJGbxzShjlLYcDQcHe0nHyhqmrbNz9U9/cu7hyOKa9QKZvvBcpGApfd8ngdgNnrNdQs4X8No/l66T3w,iv:ylNxJncjVQ6EamgMYbbsoDOcjSocZDV/C/lZTnoX4x0=,tag:SPMFr9cOKyuDhSZaXoUuTg==,type:str]
backup-pw: ENC[AES256_GCM,data:9hF0rxhktvZ/WSY3/AypZ4FBv0c8Ny2XGKXR647LkAbxWgGsP9iMBMOse/RT/ysgBoOvew2i8/8BPt8xtaMHhw==,iv:H/skkAgZOQCKQZ1a8MnuiFDjsNYlfZafbmYxH38EIv4=,tag:Zs231HOXzxCP2KsLgD7rew==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age1f2yu0cc826ej7hs4g865y29zy9uqfy0yp32f2m80typpk2pxqp7sfcffj4
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBheng3clhCbklBZkM3RTdI
Sm5ld1Y4R3VEdjFLV0hMMVNWVXFKK21vRG5nClptb1ZXckQ1YmJQVSt2VVNFOFVq
RUo0ait0eWl6dXBwd3UzUjNBTWNDZzAKLS0tIGlwSnhpTTFIRUVNVUxnNWxnNTlh
VW5ka2c1dzFBSFFqaHJKWXBUL0RBbTgKwdvyBXOa8B2K1VezacEuO0sYX2ApzGt6
JUHUiIOTEWL703FGnkv+hRAtItePYHXmmotpysc1bA25F8Pl4obrqA==
-----END AGE ENCRYPTED FILE-----
- recipient: age1dwcz3fmp29ju4svy0t0wz4ylhpwlqa8xpw4l7t4gmgqr0ev37qrsfn840l
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5ODhLMzNqVm9DMTJ4Sm1p
bXNZMTZreUNPUVdCelJyWGhlUGVYai9hOFVnCkIzM1Vrcjd4YVJhM1hKQ200b3FT
cDJyK3FqTGNHSEtKc3U4bVltS252WEEKLS0tIHViSXB6a1dHZlQrbjB4N2FEcjhh
YktVSFdCempHOTVvL1kxbG44c1RpejAKSMeyP6ayLajIvDKGcG7s5JwIvVXiKaFU
VDDj3eTOEKNBZYCyOoq4IA82G8AvRWaacefAgqBk5dE25LbD2xYHLg==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2023-12-18T13:32:35Z"
mac: ENC[AES256_GCM,data:c4Jum1uWOOsYORM5c3Woo/rjKII4femGBDfc4YPxl8BSKR9oo6Z9R+88lO5egrxT7CoKdJz+izuPgT2EjU7C4OvQ+7aDwpMV2X/lHgvB54V5Lq6I+lLKL5gXG8lt1Bm2YcDrFIWsa+RfInwO9S8yBjkCVbdTnOZZGwNlAYrI31o=,iv:dGK1WmLKryXpjEHvmFXkXYOESTLOIS6ovaunlreVhmI=,tag:W88dYlb2cJ61m7JWYJQIJA==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.8.1

21
.sops.yaml Normal file
View file

@ -0,0 +1,21 @@
keys:
- &server_hetzner age1qur4kh3gay9ryk3jh2snvjp6x9eq94zdrmgkrfcv4fzsu7l6lumq4tr3uy
- &server_sgx age149fqcw5jze00vd7jauylrp4j5xyv7amlu57jjfuzghkqtzlnxajs704uz3
- &server_t15 age1f2yu0cc826ej7hs4g865y29zy9uqfy0yp32f2m80typpk2pxqp7sfcffj4
- &harald age1dwcz3fmp29ju4svy0t0wz4ylhpwlqa8xpw4l7t4gmgqr0ev37qrsfn840l
creation_rules:
- path_regex: .secrets/hetzner/[^/]+\.(yaml|json|env|ini)$
key_groups:
- age:
- *server_hetzner
- *harald
- path_regex: .secrets/sgx/[^/]+\.(yaml|json|env|ini)$
key_groups:
- age:
- *server_sgx
- *harald
- path_regex: .secrets/t15/[^/]+\.(yaml|json|env|ini)$
key_groups:
- age:
- *server_t15
- *harald

28
README.md Normal file
View file

@ -0,0 +1,28 @@
Install system via nixos-anywhere
```bash
❯ nix run github:numtide/nixos-anywhere -- \
--flake 'git+https://git.hoyer.xyz/harald/nixcfg'.#hostname \
root@hostname --no-reboot --tty -i $HOME/.ssh/id_ed25519
... enter disk password
❯ ssh -t root@hostname systemd-cryptenroll /dev/luksdev --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=1,15
```
nixos-rebuild remote git flake
```bash
❯ sudo nixos-rebuild boot --refresh --flake git+https://git.hoyer.xyz/harald/nixcfg
```
home-manager remote git flake
```bash
❯ nix --refresh run 'git+https://git.hoyer.xyz/harald/nixcfg' -- \
switch -b backup --flake 'git+https://git.hoyer.xyz/harald/nixcfg'
```
`command-not-found` unable to open database
```bash
❯ sudo nix-channel --update
```

2738
flake.lock Normal file
View file

File diff suppressed because it is too large Load diff

88
flake.nix Normal file
View file

@ -0,0 +1,88 @@
{
description = "Harald Hoyer's Nix Configurations";
inputs = {
nixpkgs.url = "github:nixos/nixpkgs/nixos-23.11";
# NixPkgs Unstable (nixos-unstable)
unstable.url = "github:nixos/nixpkgs/nixos-unstable";
lanzaboote = {
url = "github:nix-community/lanzaboote/v0.3.0";
inputs.nixpkgs.follows = "nixpkgs";
};
snowfall-lib = {
url = "github:snowfallorg/lib?rev=5082cdac87c5fd99ef2ee5989d9f73888bc5ed14";
inputs.nixpkgs.follows = "nixpkgs";
};
# macOS Support (master)
darwin.url = "github:lnl7/nix-darwin";
darwin.inputs.nixpkgs.follows = "nixpkgs";
home-manager.url = "github:nix-community/home-manager/release-23.11";
home-manager.inputs.nixpkgs.follows = "nixpkgs";
neovim-flake.url = "github:notashelf/neovim-flake/v0.5";
neovim-flake.inputs.nixpkgs.follows = "nixpkgs";
disko.url = "github:nix-community/disko";
disko.inputs.nixpkgs.follows = "nixpkgs";
sops-nix.url = "github:Mic92/sops-nix";
sops-nix.inputs.nixpkgs.follows = "nixpkgs";
nixsgx-flake = {
url = "github:matter-labs/nixsgx";
# inputs.nixpkgs.follows = "nixpkgs";
};
simple-nixos-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver/nixos-23.11";
simple-nixos-mailserver.inputs.nixpkgs.follows = "nixpkgs";
};
outputs = inputs:
let
lib = inputs.snowfall-lib.mkLib {
inherit inputs;
src = ./.;
snowfall.namespace = "metacfg";
snowfall = {
meta = {
name = "metacfg";
title = "Metacfg";
};
};
};
in
lib.mkFlake {
channels-config = {
allowUnfree = true;
};
homes.modules = with inputs; [
neovim-flake.homeManagerModules.default
];
systems.modules.nixos = with inputs; [
lanzaboote.nixosModules.lanzaboote
home-manager.nixosModules.home-manager
sops-nix.nixosModules.sops
disko.nixosModules.disko
simple-nixos-mailserver.nixosModule
];
overlays = with inputs; [
nixsgx-flake.overlays.default
];
outputs-builder = channels: {
formatter = channels.nixpkgs.nixpkgs-fmt;
defaultApp = lib.flake-utils-plus.mkApp { drv = channels.nixpkgs.home-manager; };
};
};
}

32
homes/x86_64-darwin/harald@mpro/default.nix Normal file
View file

@ -0,0 +1,32 @@
{ lib
, pkgs
, config
, ...
}:
{
home = {
username = "harald";
homeDirectory = "/Users/${config.home.username}";
stateVersion = "23.11"; # Please read the comment before changing.
sessionPath = [ "$HOME/bin" ];
};
metacfg = {
cli-apps = {
bash.enable = true;
fish.enable = true;
neovim.enable = true;
tmux.enable = true;
bat.enable = true;
starship.enable = true;
home-manager.enable = true;
};
tools = {
direnv.enable = true;
alacritty.enable = true;
ssh.enable = true;
git.enable = true;
};
};
}

35
homes/x86_64-linux/harald@mx/default.nix Normal file
View file

@ -0,0 +1,35 @@
{ lib
, pkgs
, config
, ...
}:
{
home.sessionPath = [ "$HOME/bin" ];
programs.bash.profileExtra = ''
${lib.getExe pkgs.rust-motd}
'';
metacfg = {
user = {
enable = true;
name = config.snowfallorg.user.name;
};
cli-apps = {
bash.enable = true;
fish.enable = true;
neovim.enable = true;
bat.enable = true;
starship.enable = true;
home-manager.enable = true;
};
tools = {
git.enable = true;
direnv.enable = true;
};
};
xdg.enable = true;
xdg.mime.enable = true;
}

39
homes/x86_64-linux/harald@sgx-azure/default.nix Normal file
View file

@ -0,0 +1,39 @@
{ lib
, pkgs
, config
, ...
}:
{
home = {
username = "harald";
homeDirectory = "/home/${config.home.username}";
stateVersion = "23.11"; # Please read the comment before changing.
sessionPath = [ "$HOME/bin" ];
};
nix.settings = {
substituters = [ "https://cache.nixos.org" "https://nixsgx.cachix.org" ];
trusted-public-keys = [
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
"nixsgx.cachix.org-1:tGi36DlY2joNsIXOlGnSgWW0+E094V6hW0umQRo/KoE="
];
};
metacfg = {
cli-apps = {
bash.enable = true;
fish.enable = true;
neovim.enable = true;
tmux.enable = true;
bat.enable = true;
starship.enable = true;
home-manager.enable = true;
};
tools = {
git.enable = true;
direnv.enable = true;
ssh.enable = true;
};
};
}

30
homes/x86_64-linux/harald@sgx-nixos/default.nix Normal file
View file

@ -0,0 +1,30 @@
{ lib
, config
, ...
}:
{
home.sessionPath = [ "$HOME/bin" ];
metacfg = {
user = {
enable = true;
name = config.snowfallorg.user.name;
};
cli-apps = {
bash.enable = true;
fish.enable = true;
neovim.enable = true;
bat.enable = true;
starship.enable = true;
home-manager.enable = true;
};
tools = {
git.enable = true;
direnv.enable = true;
};
};
xdg.enable = true;
xdg.mime.enable = true;
}

30
homes/x86_64-linux/harald@sgx/default.nix Normal file
View file

@ -0,0 +1,30 @@
{ lib
, config
, ...
}:
{
home.sessionPath = [ "$HOME/bin" ];
metacfg = {
user = {
enable = true;
name = config.snowfallorg.user.name;
};
cli-apps = {
bash.enable = true;
fish.enable = true;
neovim.enable = true;
bat.enable = true;
starship.enable = true;
home-manager.enable = true;
};
tools = {
git.enable = true;
direnv.enable = true;
};
};
xdg.enable = true;
xdg.mime.enable = true;
}

65
homes/x86_64-linux/harald@t15/default.nix Normal file
View file

@ -0,0 +1,65 @@
{ lib
, config
, ...
}:
{
home.sessionPath = [ "$HOME/bin" ];
metacfg = {
user = {
enable = true;
name = config.snowfallorg.user.name;
};
cli-apps = {
bash.enable = true;
fish.enable = true;
neovim.enable = true;
bat.enable = true;
starship.enable = true;
home-manager.enable = true;
};
tools = {
git.enable = true;
direnv.enable = true;
};
};
fonts.fontconfig.enable = true;
dconf.settings = {
# ...
"org/gnome/shell" = {
disable-user-extensions = false;
# `gnome-extensions list` for a list
enabled-extensions = [
"Vitals@CoreCoding.com"
"appindicatorsupport@rgcjonas.gmail.com"
"dash-to-panel@jderose9.github.com"
"hibernate-status@dromi"
];
favorite-apps = [
"org.gnome.Console.desktop"
"jetbrains-toolbox.desktop"
"org.mozilla.firefox.desktop"
"firefox.desktop"
"thunderbird.desktop"
"org.mozilla.Thunderbird.desktop"
"slack.desktop"
"keybase.desktop"
"spotify.desktop"
"org.gnome.Nautilus.desktop"
"virt-manager.desktop"
];
};
"org/virt-manager/virt-manager/connections" = {
autoconnect = [ "qemu:///system" ];
uris = [ "qemu:///system" ];
};
};
xdg.enable = true;
xdg.mime.enable = true;
}

65
homes/x86_64-linux/harald@x1/default.nix Normal file
View file

@ -0,0 +1,65 @@
{ lib
, config
, ...
}:
{
home.sessionPath = [ "$HOME/bin" ];
metacfg = {
user = {
enable = true;
name = config.snowfallorg.user.name;
};
cli-apps = {
bash.enable = true;
fish.enable = true;
neovim.enable = true;
bat.enable = true;
starship.enable = true;
home-manager.enable = true;
};
tools = {
git.enable = true;
direnv.enable = true;
};
};
fonts.fontconfig.enable = true;
dconf.settings = {
# ...
"org/gnome/shell" = {
disable-user-extensions = false;
# `gnome-extensions list` for a list
enabled-extensions = [
"Vitals@CoreCoding.com"
"appindicatorsupport@rgcjonas.gmail.com"
"dash-to-panel@jderose9.github.com"
"hibernate-status@dromi"
];
favorite-apps = [
"org.gnome.Console.desktop"
"jetbrains-toolbox.desktop"
"org.mozilla.firefox.desktop"
"firefox.desktop"
"thunderbird.desktop"
"org.mozilla.Thunderbird.desktop"
"slack.desktop"
"keybase.desktop"
"spotify.desktop"
"org.gnome.Nautilus.desktop"
"virt-manager.desktop"
];
};
"org/virt-manager/virt-manager/connections" = {
autoconnect = [ "qemu:///system" ];
uris = [ "qemu:///system" ];
};
};
xdg.enable = true;
xdg.mime.enable = true;
}

65
lib/audio/default.nix Normal file
View file

@ -0,0 +1,65 @@
{ lib }:
rec {
## Renames an alsa device from a given `name` using the new `description`.
##
#@ { name: String, description: String } -> { matches: List, apply_properties: Attrs }
mkAlsaRename = { name, description }: {
matches = [
[
[ "device.name" "matches" name ]
]
];
# actions = { "update-props" = { "node.description" = description; }; };
apply_properties = {
"device.description" = description;
};
};
## Create a pipewire audio node.
##
#@ { name: String, factory: String ? "adapter", ... } -> { factory: String, args: Attrs }
mkAudioNode = args@{ name, factory ? "adapter", ... }: {
inherit factory;
args = (builtins.removeAttrs args [ "name" "description" ]) // {
"node.name" = name;
"node.description" = args.description or args."node.description";
"factory.name" = args."factory.name" or "support.null-audio-sink";
};
};
## Create a virtual pipewire audio node.
##
#@ { name: String, ... } -> { factory: "adapter", args: Attrs }
mkVirtualAudioNode = args@{ name, ... }:
mkAudioNode (args // {
name = "virtual-${lib.toLower name}-audio";
description = "${name} (Virtual)";
"media.class" = args.class or args."media.class" or "Audio/Duplex";
"object.linger" = args."object.linger" or true;
"audio.position" = args."audio.position" or [ "FL" "FR" ];
"monitor.channel-volumes" = args."monitor.channel-volumes" or true;
});
## Connect two pipewire audio nodes
##
#@ { name: String?, from: String, to: String, ... } -> { name: "libpipewire-module-loopback", args: Attrs }
mkBridgeAudioModule = args@{ from, to, ... }: {
name = "libpipewire-module-loopback";
args = (builtins.removeAttrs args [ "from" "to" "name" ]) // {
"node.name" =
if args ? name then
"${args.name}-bridge"
else
"${lib.toLower from}-to-${lib.toLower to}-bridge";
"audio.position" = args."audio.position" or [ "FL" "FR" ];
"capture.props" = {
"node.target" = from;
} // (args."capture.props" or { });
"playback.props" = {
"node.target" = to;
"monitor.channel-volumes" = true;
} // (args."playback.props" or { });
};
};
}

20
lib/default.nix Normal file
View file

@ -0,0 +1,20 @@
{ lib, inputs, snowfall-inputs }:
rec {
## Override a package's metadata
##
## ```nix
## let
## new-meta = {
## description = "My new description";
## };
## in
## lib.override-meta new-meta pkgs.hello
## ```
##
#@ Attrs -> Package -> Package
override-meta = meta: package:
package.overrideAttrs (attrs: {
meta = (attrs.meta or { }) // meta;
});
}

51
lib/deploy/default.nix Normal file
View file

@ -0,0 +1,51 @@
{ lib, inputs }:
let
inherit (inputs) deploy-rs;
in
rec {
## Create deployment configuration for use with deploy-rs.
##
## ```nix
## mkDeploy {
## inherit self;
## overrides = {
## my-host.system.sudo = "doas -u";
## };
## }
## ```
##
#@ { self: Flake, overrides: Attrs ? {} } -> Attrs
mkDeploy = { self, overrides ? { } }:
let
hosts = self.nixosConfigurations or { };
names = builtins.attrNames hosts;
nodes = lib.foldl
(result: name:
let
host = hosts.${name};
user = host.config.metacfg.user.name or null;
inherit (host.pkgs) system;
in
result // {
${name} = (overrides.${name} or { }) // {
hostname = overrides.${name}.hostname or "${name}";
profiles = (overrides.${name}.profiles or { }) // {
system = (overrides.${name}.profiles.system or { }) // {
path = deploy-rs.lib.${system}.activate.nixos host;
} // lib.optionalAttrs (user != null) {
user = "root";
sshUser = user;
} // lib.optionalAttrs
(host.config.metacfg.security.doas.enable or false)
{
sudo = "doas -u";
};
};
};
})
{ }
names;
in
{ inherit nodes; };
}

25
lib/file/default.nix Normal file
View file

@ -0,0 +1,25 @@
{ lib, ... }:
rec {
## Append text to the contents of a file
##
## ```nix
## fileWithText ./some.txt "appended text"
## ```
##
#@ Path -> String -> String
fileWithText = file: text: ''
${builtins.readFile file}
${text}'';
## Prepend text to the contents of a file
##
## ```nix
## fileWithText' ./some.txt "prepended text"
## ```
##
#@ Path -> String -> String
fileWithText' = file: text: ''
${text}
${builtins.readFile file}'';
}

62
lib/module/default.nix Normal file
View file

@ -0,0 +1,62 @@
{ lib, ... }:
with lib; rec {
## Create a NixOS module option.
##
## ```nix
## lib.mkOpt nixpkgs.lib.types.str "My default" "Description of my option."
## ```
##
#@ Type -> Any -> String
mkOpt = type: default: description:
mkOption { inherit type default description; };
## Create a NixOS module option without a description.
##
## ```nix
## lib.mkOpt' nixpkgs.lib.types.str "My default"
## ```
##
#@ Type -> Any -> String
mkOpt' = type: default: mkOpt type default null;
## Create a boolean NixOS module option.
##
## ```nix
## lib.mkBoolOpt true "Description of my option."
## ```
##
#@ Type -> Any -> String
mkBoolOpt = mkOpt types.bool;
## Create a boolean NixOS module option without a description.
##
## ```nix
## lib.mkBoolOpt true
## ```
##
#@ Type -> Any -> String
mkBoolOpt' = mkOpt' types.bool;
enabled = {
## Quickly enable an option.
##
## ```nix
## services.nginx = enabled;
## ```
##
#@ true
enable = true;
};
disabled = {
## Quickly disable an option.
##
## ```nix
## services.nginx = enabled;
## ```
##
#@ false
enable = false;
};
}

54
lib/network/default.nix Normal file
View file

@ -0,0 +1,54 @@
{ lib, inputs, snowfall-inputs }:
let
inherit (inputs.nixpkgs.lib) assertMsg last;
in
{
network = {
# Split an address to get its host name or ip and its port.
# Type: String -> Attrs
# Usage: get-address-parts "bismuth:3000"
# result: { host = "bismuth"; port = "3000"; }
get-address-parts = address:
let
address-parts = builtins.split ":" address;
ip = builtins.head address-parts;
host = if ip == "" then "127.0.0.1" else ip;
port = if builtins.length address-parts != 3 then "" else last address-parts;
in
{ inherit host port; };
## Create proxy configuration for NGINX virtual hosts.
##
## ```nix
## services.nginx.virtualHosts."example.com" = lib.network.create-proxy {
## port = 3000;
## host = "0.0.0.0";
## proxy-web-sockets = true;
## extra-config = {
## forceSSL = true;
## };
## }
## ``
##
#@ { port: Int ? null, host: String ? "127.0.0.1", proxy-web-sockets: Bool ? false, extra-config: Attrs ? { } } -> Attrs
create-proxy =
{ port ? null
, host ? "127.0.0.1"
, proxy-web-sockets ? false
, extra-config ? { }
}:
assert assertMsg (port != "" && port != null) "port cannot be empty";
assert assertMsg (host != "") "host cannot be empty";
extra-config // {
locations = (extra-config.locations or { }) // {
"/" = (extra-config.locations."/" or { }) // {
proxyPass =
"http://${host}${if port != null then ":${builtins.toString port}" else ""}";
proxyWebsockets = proxy-web-sockets;
};
};
};
};
}

40
modules/darwin/home/default.nix Normal file
View file

@ -0,0 +1,40 @@
{ options, config, pkgs, lib, inputs, ... }:
with lib;
with lib.metacfg;
let
cfg = config.metacfg.home;
in
{
# imports = with inputs; [
# home-manager.darwinModules.home-manager
# ];
options.metacfg.home = with types; {
file = mkOpt attrs { }
"A set of files to be managed by home-manager's <option>home.file</option>.";
configFile = mkOpt attrs { }
"A set of files to be managed by home-manager's <option>xdg.configFile</option>.";
extraOptions = mkOpt attrs { } "Options to pass directly to home-manager.";
homeConfig = mkOpt attrs { } "Final config for home-manager.";
};
config = {
metacfg.home.extraOptions = {
home.stateVersion = mkDefault "23.11";
home.file = mkAliasDefinitions options.metacfg.home.file;
xdg.enable = true;
xdg.configFile = mkAliasDefinitions options.metacfg.home.configFile;
};
snowfallorg.users.${config.metacfg.user.name}.home.config = mkAliasDefinitions options.metacfg.home.extraOptions;
home-manager = {
useUserPackages = true;
useGlobalPkgs = true;
# users.${config.metacfg.user.name} = args:
# mkAliasDefinitions options.metacfg.home.extraOptions;
};
};
}

74
modules/darwin/nix/default.nix Normal file
View file

@ -0,0 +1,74 @@
{ options
, config
, pkgs
, lib
, ...
}:
with lib;
with lib.metacfg; let
cfg = config.metacfg.nix;
in
{
options.metacfg.nix = with types; {
enable = mkBoolOpt true "Whether or not to manage nix configuration.";
package = mkOpt package pkgs.nixUnstable "Which nix package to use.";
};
config = mkIf cfg.enable {
environment.systemPackages = with pkgs; [
deploy-rs
nixfmt
nix-index
nix-prefetch-git
];
nix =
let
users = [ "root" config.metacfg.user.name ];
in
{
package = cfg.package;
settings = {
experimental-features = "nix-command flakes";
http-connections = 50;
warn-dirty = false;
log-lines = 50;
# Large builds apparently fail due to an issue with darwin:
# https://github.com/NixOS/nix/issues/4119
sandbox = false;
# This appears to break on darwin
# https://github.com/NixOS/nix/issues/7273
auto-optimise-store = false;
allow-import-from-derivation = true;
trusted-users = users;
allowed-users = users;
# NOTE: This configuration is generated by nix-installer so I'm adding it here in
# case it becomes important.
extra-nix-path = "nixpkgs=flake:nixpkgs";
build-users-group = "nixbld";
};
#// (lib.optionalAttrs config.metacfg.tools.direnv.enable {
# keep-outputs = true;
# keep-derivations = true;
#});
gc = {
automatic = true;
interval = { Day = 7; };
options = "--delete-older-than 30d";
user = config.metacfg.user.name;
};
# flake-utils-plus
generateRegistryFromInputs = true;
generateNixPathFromInputs = true;
linkInputs = true;
};
};
}

122
modules/darwin/security/gpg/default.nix Normal file
View file

@ -0,0 +1,122 @@
{ lib, config, pkgs, inputs, ... }:
let
inherit (lib) types mkEnableOption mkIf;
inherit (lib.metacfg) mkOpt;
cfg = config.metacfg.security.gpg;
gpgConf = "${inputs.gpg-base-conf}/gpg.conf";
gpgAgentConf = ''
enable-ssh-support
default-cache-ttl 60
max-cache-ttl 120
'';
in
{
options.metacfg.security.gpg = {
enable = mkEnableOption "GPG";
agentTimeout = mkOpt types.int 5 "The amount of time to wait before continuing with shell init.";
};
config = mkIf cfg.enable {
environment.systemPackages = with pkgs; [
gnupg
];
environment.shellInit = ''
export GPG_TTY="$(tty)"
export SSH_AUTH_SOCK=$(${pkgs.gnupg}/bin/gpgconf --list-dirs agent-ssh-socket)
${pkgs.coreutils}/bin/timeout ${builtins.toString cfg.agentTimeout} ${pkgs.gnupg}/bin/gpgconf --launch gpg-agent
gpg_agent_timeout_status=$?
if [ "$gpg_agent_timeout_status" = 124 ]; then
# Command timed out...
echo "GPG Agent timed out..."
echo 'Run "gpgconf --launch gpg-agent" to try and launch it again.'
fi
'';
programs.gnupg.agent = {
enable = true;
enableSSHSupport = true;
};
metacfg.home.file = {
".gnupg/.keep".text = "";
".gnupg/gpg.conf".text = ''
# https://github.com/drduh/config/blob/master/gpg.conf
# https://www.gnupg.org/documentation/manuals/gnupg/GPG-Configuration-Options.html
# https://www.gnupg.org/documentation/manuals/gnupg/GPG-Esoteric-Options.html
# 'gpg --version' to get capabilities
# Use AES256, 192, or 128 as cipher
personal-cipher-preferences AES256 AES192 AES
# Use SHA512, 384, or 256 as digest
personal-digest-preferences SHA512 SHA384 SHA256
# Use ZLIB, BZIP2, ZIP, or no compression
personal-compress-preferences ZLIB BZIP2 ZIP Uncompressed
# Default preferences for new keys
default-preference-list SHA512 SHA384 SHA256 AES256 AES192 AES ZLIB BZIP2 ZIP Uncompressed
# SHA512 as digest to sign keys
cert-digest-algo SHA512
# SHA512 as digest for symmetric ops
s2k-digest-algo SHA512
# AES256 as cipher for symmetric ops
s2k-cipher-algo AES256
# UTF-8 support for compatibility
charset utf-8
# No comments in messages
no-comments
# No version in output
no-emit-version
# Disable banner
no-greeting
# Long key id format
keyid-format 0xlong
# Display UID validity
list-options show-uid-validity
verify-options show-uid-validity
# Display all keys and their fingerprints
with-fingerprint
# Display key origins and updates
#with-key-origin
# Cross-certify subkeys are present and valid
require-cross-certification
# Disable caching of passphrase for symmetrical ops
no-symkey-cache
# Enable smartcard
use-agent
# Disable recipient key ID in messages (breaks Mailvelope)
throw-keyids
# Default key ID to use (helpful with throw-keyids)
#default-key 0xFF3E7D88647EBCDB
#trusted-key 0xFF3E7D88647EBCDB
# Group recipient keys (preferred ID last)
#group keygroup = 0xFF00000000000001 0xFF00000000000002 0xFF3E7D88647EBCDB
# Keyserver URL
#keyserver hkps://keys.openpgp.org
#keyserver hkps://keys.mailvelope.com
#keyserver hkps://keyserver.ubuntu.com:443
#keyserver hkps://pgpkeys.eu
#keyserver hkps://pgp.circl.lu
#keyserver hkp://zkaan2xfbuxia2wpf7ofnkbz6r5zdbbvxbunvp5g2iebopbfc4iqmbad.onion
# Keyserver proxy
#keyserver-options http-proxy=http://127.0.0.1:8118
#keyserver-options http-proxy=socks5-hostname://127.0.0.1:9050
# Enable key retrieval using WKD and DANE
#auto-key-locate wkd,dane,local
#auto-key-retrieve
# Trust delegation mechanism
#trust-model tofu+pgp
# Show expired subkeys
#list-options show-unusable-subkeys
# Verbose output
#verbose
'';
".gnupg/gpg-agent.conf".text = gpgAgentConf;
};
};
}

17
modules/darwin/services/nix-daemon/default.nix Normal file
View file

@ -0,0 +1,17 @@
{ lib, config, ... }:
let
inherit (lib) types mkIf;
inherit (lib.metacfg) mkOpt enabled;
cfg = config.metacfg.services.nix-daemon;
in
{
options.metacfg.services.nix-daemon = {
enable = mkOpt types.bool true "Whether to enable the Nix daemon.";
};
config = mkIf cfg.enable {
services.nix-daemon = enabled;
};
}

30
modules/darwin/suites/common/default.nix Normal file
View file

@ -0,0 +1,30 @@
{ options, config, lib, pkgs, ... }:
with lib;
with lib.metacfg;
let
cfg = config.metacfg.suites.common;
in
{
options.metacfg.suites.common = with types; {
enable = mkBoolOpt false "Whether or not to enable common configuration.";
};
config = mkIf cfg.enable {
programs.fish = enabled;
metacfg = {
nix = enabled;
system = {
fonts = enabled;
#input = enabled;
interface = enabled;
};
security = {
gpg = enabled;
};
};
};
}

32
modules/darwin/system/fonts/default.nix Normal file
View file

@ -0,0 +1,32 @@
{ options, config, pkgs, lib, ... }:
with lib;
with lib.metacfg;
let cfg = config.metacfg.system.fonts;
in
{
options.metacfg.system.fonts = with types; {
enable = mkBoolOpt false "Whether or not to manage fonts.";
fonts = mkOpt (listOf package) [ ] "Custom font packages to install.";
};
config = mkIf cfg.enable {
environment.variables = {
# Enable icons in tooling since we have nerdfonts.
LOG_ICONS = "true";
};
fonts = {
fontDir = enabled;
fonts = with pkgs;
[
noto-fonts
noto-fonts-cjk-sans
noto-fonts-cjk-serif
noto-fonts-emoji
(nerdfonts.override { fonts = [ "Hack" ]; })
] ++ cfg.fonts;
};
};
}

29
modules/darwin/system/interface/default.nix Normal file
View file

@ -0,0 +1,29 @@
{ options, config, pkgs, lib, ... }:
with lib;
with lib.metacfg;
let cfg = config.metacfg.system.interface;
in
{
options.metacfg.system.interface = with types; {
enable = mkEnableOption "macOS interface";
};
config = mkIf cfg.enable {
system.defaults = {
dock.autohide = true;
finder = {
AppleShowAllExtensions = true;
FXEnableExtensionChangeWarning = false;
};
NSGlobalDomain = {
_HIHideMenuBar = true;
AppleShowScrollBars = "Always";
};
};
metacfg.home.file.".hushlogin".text = "";
};
}

45
modules/darwin/user/default.nix Normal file
View file

@ -0,0 +1,45 @@
{ lib
, config
, pkgs
, ...
}:
let
inherit (lib) types mkIf mkDefault;
inherit (lib.metacfg) mkOpt;
cfg = config.metacfg.user;
is-linux = pkgs.stdenv.isLinux;
is-darwin = pkgs.stdenv.isDarwin;
in
{
options.metacfg.user = {
name = mkOpt types.str "harald" "The user account.";
fullName = mkOpt types.str "Harald Hoyer" "The full name of the user.";
email = mkOpt types.str "harald@hoyer.xyz" "The email of the user.";
uid = mkOpt (types.nullOr types.int) 501 "The uid for the user account.";
};
config = {
users.users.${cfg.name} = {
# NOTE: Setting the uid here is required for another
# module to evaluate successfully since it reads
# `users.users.${metacfg.user.name}.uid`.
uid = mkIf (cfg.uid != null) cfg.uid;
};
snowfallorg.users.${config.metacfg.user.name}.home.config = {
home = {
file = {
".profile".text = ''
# The default file limit is far too low and throws an error when rebuilding the system.
# See the original with: ulimit -Sa
ulimit -n 4096
'';
};
};
};
};
}

28
modules/home/cli-apps/bash/default.nix Normal file
View file

@ -0,0 +1,28 @@
{ lib
, config
, pkgs
, ...
}:
let
inherit (lib) mkEnableOption mkIf;
cfg = config.metacfg.cli-apps.bash;
in
{
options.metacfg.cli-apps.bash = {
enable = mkEnableOption "BASH shell";
};
config = mkIf cfg.enable {
home.packages = with pkgs; [
bashInteractive
];
programs.bash = {
enable = true;
initExtra = ''
function msh() { mosh "$@" -- bash -c 'if type -f tmux; then tmux new-session -A -s 0; else screen -R; fi;' ; };
function tsh() { ssh -t "$@" -- bash -c 'if type -f tmux; then tmux new-session -A -s 0; else screen -R; fi;' ; };
'';
};
};
}

22
modules/home/cli-apps/bat/default.nix Normal file
View file

@ -0,0 +1,22 @@
{ lib
, config
, pkgs
, ...
}:
with lib;
with lib.metacfg; let
cfg = config.metacfg.cli-apps.bat;
in
{
options.metacfg.cli-apps.bat = {
enable = mkEnableOption "bat";
};
config = mkIf cfg.enable {
programs.bat = {
enable = true;
config.theme = "ansi";
extraPackages = with pkgs.bat-extras; [ batdiff batman batgrep batwatch ];
};
};
}

60
modules/home/cli-apps/fish/default.nix Normal file
View file

@ -0,0 +1,60 @@
{ lib
, config
, pkgs
, ...
}:
let
inherit (lib) mkEnableOption mkIf;
cfg = config.metacfg.cli-apps.fish;
in
{
options.metacfg.cli-apps.fish = {
enable = mkEnableOption "FISH shell";
};
config = mkIf cfg.enable {
programs.fish = {
enable = true;
interactiveShellInit = ''
function msh --wraps mosh --description 'mosh with tmux'
if not set -q argv[1]
echo 'Usage: msh [user@]host [command]'
else
${pkgs.mosh}/bin/mosh $argv -- tmux new-session -A -s 0
end
end
function tsh --wraps ssh --description 'ssh with tmux'
if not set -q argv[1]
echo 'Usage: tsh [user@]host [command]'
else
${pkgs.openssh}/bin/ssh -t $argv -- tmux new-session -A -s 0
end
end
'';
plugins = [{
name = "foreign-env";
src = pkgs.fetchFromGitHub {
owner = "oh-my-fish";
repo = "plugin-foreign-env";
rev = "dddd9213272a0ab848d474d0cbde12ad034e65bc";
sha256 = "00xqlyl3lffc5l0viin1nyp819wf81fncqyz87jx8ljjdhilmgbs";
};
}];
# shellInit =
# ''
# # nix
# if test -e /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
# fenv source /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
# end
#
# # home-manager
# if test -e $HOME/.nix-profile/etc/profile.d/hm-session-vars.sh
# fenv source $HOME/.nix-profile/etc/profile.d/hm-session-vars.sh
# end
# '';
};
};
}

31
modules/home/cli-apps/home-manager/default.nix Normal file
View file

@ -0,0 +1,31 @@
{ lib, config, pkgs, ... }:
let
inherit (lib) mkEnableOption mkIf;
inherit (lib.metacfg) enabled;
cfg = config.metacfg.cli-apps.home-manager;
in
{
options.metacfg.cli-apps.home-manager = {
enable = mkEnableOption "home-manager";
};
config = mkIf cfg.enable {
programs.home-manager = enabled;
home.sessionVariables = {
EDITOR = "${pkgs.vim}/bin/vim";
BATDIFF_USE_DELTA = "true";
};
home.shellAliases = {
cat = "${pkgs.bat}/bin/bat --decorations never";
less = ''${pkgs.bat}/bin/bat --decorations never --paging=always --pager "${pkgs.less}/bin/less -RF"'';
man = "${pkgs.bat-extras.batman}/bin/batman";
};
home.packages = with pkgs; [
vim
];
};
}

230
modules/home/cli-apps/neovim/default.nix Normal file
View file

@ -0,0 +1,230 @@
{ lib, config, pkgs, ... }:
let
inherit (lib) mkEnableOption mkIf;
cfg = config.metacfg.cli-apps.neovim;
in
{
options.metacfg.cli-apps.neovim = {
enable = mkEnableOption "Neovim";
};
config = mkIf cfg.enable {
programs.neovim-flake = {
enable = true;
# your settings need to go into the settings attrset
settings = {
vim = {
viAlias = false;
vimAlias = false;
debugMode = {
enable = false;
level = 20;
logFile = "/tmp/nvim.log";
};
};
vim.lsp = {
formatOnSave = true;
lspkind.enable = false;
lightbulb.enable = true;
lspsaga.enable = false;
nvimCodeActionMenu.enable = true;
trouble.enable = true;
lspSignature.enable = true;
lsplines.enable = true;
};
vim.debugger = {
nvim-dap = {
enable = true;
ui.enable = true;
};
};
vim.languages = {
enableLSP = true;
enableFormat = true;
enableTreesitter = true;
enableExtraDiagnostics = true;
nix = {
enable = true;
format.type = "nixpkgs-fmt";
};
html.enable = true;
clang = {
enable = true;
lsp.server = "clangd";
};
sql.enable = false;
rust = {
enable = true;
crates.enable = true;
};
java.enable = true;
ts.enable = true;
svelte.enable = true;
go.enable = true;
zig.enable = true;
python.enable = true;
dart.enable = true;
elixir.enable = false;
};
vim.visuals = {
enable = true;
nvimWebDevicons.enable = true;
scrollBar.enable = true;
smoothScroll.enable = true;
cellularAutomaton.enable = true;
fidget-nvim.enable = true;
indentBlankline = {
enable = true;
fillChar = null;
eolChar = null;
showCurrContext = true;
};
cursorline = {
enable = true;
lineTimeout = 0;
};
};
vim.statusline = {
lualine = {
enable = true;
theme = "catppuccin";
};
};
vim.theme = {
enable = true;
name = "catppuccin";
style = "mocha";
transparent = false;
};
vim.autopairs.enable = true;
vim.autocomplete = {
enable = true;
type = "nvim-cmp";
};
vim.filetree = {
nvimTree = {
enable = true;
};
};
vim.tabline = {
nvimBufferline.enable = true;
};
vim.treesitter.context.enable = true;
vim.binds = {
whichKey.enable = true;
cheatsheet.enable = true;
};
vim.telescope.enable = true;
vim.git = {
enable = true;
gitsigns.enable = true;
gitsigns.codeActions = false; # throws an annoying debug message
};
vim.minimap = {
minimap-vim.enable = false;
codewindow.enable = true; # lighter, faster, and uses lua for configuration
};
vim.dashboard = {
dashboard-nvim.enable = false;
alpha.enable = true;
};
vim.notify = {
nvim-notify.enable = true;
};
vim.projects = {
project-nvim.enable = true;
};
vim.utility = {
ccc.enable = true;
vim-wakatime.enable = false;
icon-picker.enable = true;
surround.enable = true;
diffview-nvim.enable = true;
motion = {
hop.enable = true;
leap.enable = true;
};
};
vim.notes = {
obsidian.enable = false; # FIXME neovim fails to build if obsidian is enabled
orgmode.enable = false;
mind-nvim.enable = true;
todo-comments.enable = true;
};
vim.terminal = {
toggleterm = {
enable = true;
lazygit.enable = true;
};
};
vim.ui = {
borders.enable = true;
noice.enable = true;
colorizer.enable = true;
modes-nvim.enable = false; # the theme looks terrible with catppuccin
illuminate.enable = true;
breadcrumbs = {
enable = true;
navbuddy.enable = true;
};
smartcolumn = {
enable = true;
columnAt.languages = {
# this is a freeform module, it's `buftype = int;` for configuring column position
nix = 110;
ruby = 120;
java = 130;
go = [ 90 130 ];
};
};
};
vim.assistant = {
copilot = {
enable = true;
cmp.enable = true;
};
};
vim.session = {
nvim-session-manager.enable = false;
};
vim.gestures = {
gesture-nvim.enable = false;
};
vim.comments = {
comment-nvim.enable = true;
};
vim.spellChecking.languages = [ "en" "de" ];
};
};
};
}

32
modules/home/cli-apps/starship/default.nix Normal file
View file

@ -0,0 +1,32 @@
{ lib
, config
, pkgs
, ...
}:
let
inherit (lib) mkEnableOption mkIf;
cfg = config.metacfg.cli-apps.starship;
in
{
options.metacfg.cli-apps.starship = {
enable = mkEnableOption "starship";
};
config = mkIf cfg.enable {
home.packages = with pkgs; [
(pkgs.nerdfonts.override { fonts = [ "FiraCode" "DroidSansMono" "JetBrainsMono" ]; })
];
programs.starship = {
enable = true;
settings = {
container.format = "[\\[$name\\]]($style) ";
git_status = {
ahead = "⇡$\{count}";
diverged = "⇕⇡$\{ahead_count}⇣$\{behind_count}";
behind = "⇣$\{count}";
};
};
};
};
}

20
modules/home/cli-apps/tmux/default.nix Normal file
View file

@ -0,0 +1,20 @@
{ lib
, config
, pkgs
, ...
}:
with lib;
with lib.metacfg; let
cfg = config.metacfg.cli-apps.tmux;
in
{
options.metacfg.cli-apps.tmux = {
enable = mkEnableOption "Tmux";
};
config = mkIf cfg.enable {
home.packages = with pkgs; [
tmux
];
};
}

11
modules/home/host/default.nix Normal file
View file

@ -0,0 +1,11 @@
{ lib, config, pkgs, host ? null, format ? "unknown", ... }:
let
inherit (lib) types;
inherit (lib.metacfg) mkOpt;
in
{
options.metacfg.host = {
name = mkOpt (types.nullOr types.str) host "The host name.";
};
}

22
modules/home/tools/alacritty/default.nix Normal file
View file

@ -0,0 +1,22 @@
{ lib
, config
, pkgs
, ...
}:
let
inherit (lib) mkEnableOption mkIf;
cfg = config.metacfg.tools.alacritty;
in
{
options.metacfg.tools.alacritty = {
enable = mkEnableOption "alacritty";
};
config = mkIf cfg.enable {
home.packages = with pkgs; [
alacritty
(pkgs.nerdfonts.override { fonts = [ "FiraCode" "DroidSansMono" "JetBrainsMono" ]; })
];
};
}

18
modules/home/tools/direnv/default.nix Normal file
View file

@ -0,0 +1,18 @@
{ options, config, lib, pkgs, ... }:
with lib;
with lib.metacfg;
let cfg = config.metacfg.tools.direnv;
in
{
options.metacfg.tools.direnv = with types; {
enable = mkBoolOpt false "Whether or not to enable direnv.";
};
config = mkIf cfg.enable {
programs.direnv = {
enable = true;
nix-direnv = enabled;
};
};
}

66
modules/home/tools/git/default.nix Normal file
View file

@ -0,0 +1,66 @@
{ lib, config, pkgs, ... }:
let
inherit (lib) types mkEnableOption mkIf;
inherit (lib.metacfg) mkOpt enabled;
cfg = config.metacfg.tools.git;
user = config.metacfg.user;
in
{
options.metacfg.tools.git = {
enable = mkEnableOption "Git";
userName = mkOpt types.str user.fullName "The name to configure git with.";
userEmail = mkOpt types.str user.email "The email to configure git with.";
signingKey =
mkOpt types.str "7F3D64824AC0B6B8009E50504BC0896FB5693595" "The key ID to sign commits with.";
signByDefault = mkOpt types.bool false "Whether to sign commits by default.";
};
config = mkIf cfg.enable {
home.packages = with pkgs; [
git-delete-merged-branches
delta
];
programs.git = {
enable = true;
inherit (cfg) userName userEmail;
lfs = enabled;
signing = {
key = cfg.signingKey;
inherit (cfg) signByDefault;
};
extraConfig = {
init = { defaultBranch = "main"; };
pull = { rebase = true; };
push = { autoSetupRemote = true; };
core = { whitespace = "trailing-space,space-before-tab"; };
safe = {
directory = "${user.home}/git";
};
"credential \"https://github.com\"" = {
helper = "!gh auth git-credential";
};
alias = {
co = "checkout";
ci = "commit --signoff";
};
pull.ff = "only";
core.pager = "${pkgs.delta}/bin/delta";
delta = {
features = "decorations";
syntax-theme = "DarkNeon";
light = "false";
navigate = "true";
};
interactive.diffFilter = "${pkgs.delta}/bin/delta --color-only";
merge.conflictStyle = "diff3";
diff.colorMoved = "default";
filter.rot8000 = {
clean = "${pkgs.metacfg.rot8000}/bin/rot8000";
smudge = "${pkgs.metacfg.rot8000}/bin/rot8000";
};
};
};
};
}

21
modules/home/tools/jetbrains/default.nix Normal file
View file

@ -0,0 +1,21 @@
{ options, config, lib, pkgs, ... }:
with lib;
with lib.metacfg;
let cfg = config.metacfg.tools.jetbrains;
in
{
options.metacfg.tools.jetbrains = with types; {
enable = mkBoolOpt false "Whether or not to enable jetbrains.";
};
config = mkIf cfg.enable {
home.sessionPath = [
"$HOME/.local/share/JetBrains/Toolbox/scripts"
];
home.packages = with pkgs; [
jetbrains-toolbox
(pkgs.nerdfonts.override { fonts = [ "FiraCode" "DroidSansMono" "JetBrainsMono" ]; })
];
};
}

24
modules/home/tools/ssh/default.nix Normal file
View file

@ -0,0 +1,24 @@
{ lib, config, pkgs, ... }:
let
inherit (lib) types mkEnableOption mkIf;
cfg = config.metacfg.tools.ssh;
in
{
options.metacfg.tools.ssh = {
enable = mkEnableOption "SSH";
};
config = mkIf cfg.enable {
home.packages = with pkgs; [
mosh
];
programs.ssh = {
enable = true;
extraConfig = ''
Host *
HostKeyAlgorithms +ssh-rsa
'';
};
};
}

50
modules/home/user/default.nix Normal file
View file

@ -0,0 +1,50 @@
{ lib, config, pkgs, osConfig ? { }, ... }:
let
inherit (lib) types mkIf mkDefault mkMerge;
inherit (lib.metacfg) mkOpt;
cfg = config.metacfg.user;
is-linux = pkgs.stdenv.isLinux;
is-darwin = pkgs.stdenv.isDarwin;
home-directory =
if cfg.name == null then
null
else if is-darwin then
"/Users/${cfg.name}"
else
"/home/${cfg.name}";
in
{
options.metacfg.user = {
enable = mkOpt types.bool false "Whether to configure the user account.";
name = mkOpt (types.nullOr types.str) config.snowfallorg.user.name "The user account.";
fullName = mkOpt types.str "Harald Hoyer" "The full name of the user.";
email = mkOpt types.str "harald@hoyer.xyz" "The email of the user.";
home = mkOpt (types.nullOr types.str) home-directory "The user's home directory.";
};
config = mkIf cfg.enable (mkMerge [
{
assertions = [
{
assertion = cfg.name != null;
message = "metacfg.user.name must be set";
}
{
assertion = cfg.home != null;
message = "metacfg.user.home must be set";
}
];
home = {
username = mkDefault cfg.name;
homeDirectory = mkDefault cfg.home;
};
}
]);
}

32
modules/nixos/home/default.nix Normal file
View file

@ -0,0 +1,32 @@
{ options, config, pkgs, lib, inputs, ... }:
with lib;
with lib.metacfg;
let cfg = config.metacfg.home;
in
{
options.metacfg.home = with types; {
file = mkOpt attrs { }
(mdDoc "A set of files to be managed by home-manager's `home.file`.");
configFile = mkOpt attrs { }
(mdDoc "A set of files to be managed by home-manager's `xdg.configFile`.");
extraOptions = mkOpt attrs { } "Options to pass directly to home-manager.";
};
config = {
metacfg.home.extraOptions = {
home.stateVersion = config.system.stateVersion;
home.file = mkAliasDefinitions options.metacfg.home.file;
xdg.enable = true;
xdg.configFile = mkAliasDefinitions options.metacfg.home.configFile;
};
home-manager = {
useUserPackages = true;
useGlobalPkgs = true;
users.${config.metacfg.user.name} =
mkAliasDefinitions options.metacfg.home.extraOptions;
};
};
}

135
modules/nixos/nix-ld/default.nix Normal file
View file

@ -0,0 +1,135 @@
{ options, config, lib, pkgs, ... }:
with lib;
with lib.metacfg;
let cfg = config.metacfg.nix-ld;
in
{
options.metacfg.nix-ld = with types; {
enable = mkBoolOpt false "Whether or not to enable nix-ld.";
};
config = mkIf cfg.enable {
programs.nix-ld.enable = true;
# Sets up all the libraries to load
programs.nix-ld.libraries = with pkgs; [
SDL
SDL2
SDL2_image
SDL2_mixer
SDL2_ttf
SDL_image
SDL_mixer
SDL_ttf
alsa-lib
at-spi2-atk
at-spi2-core
atk
bzip2
cairo
cups
curlWithGnuTls
dbus
dbus-glib
desktop-file-utils
e2fsprogs
expat
flac
fontconfig
freeglut
freetype
fribidi
fuse
fuse3
gdk-pixbuf
glew110
glib
gmp
gst_all_1.gst-plugins-base
gst_all_1.gst-plugins-ugly
gst_all_1.gstreamer
gtk2
harfbuzz
icu
keyutils.lib
libGL
libGLU
libappindicator-gtk2
libcaca
libcanberra
libcap
libclang.lib
libdbusmenu
libdrm
libgcrypt
libgpg-error
libidn
libjack2
libjpeg
libmikmod
libogg
libpng12
libpulseaudio
librsvg
libsamplerate
libsecret
libthai
libtheora
libtiff
libudev0-shim
libusb1
libuuid
libvdpau
libvorbis
libvpx
libxcrypt-legacy
libxkbcommon
libxml2
mesa
nspr
nss
openssl
p11-kit
pango
pixman
python3
speex
stdenv.cc.cc
tbb
udev
vulkan-loader
wayland
xorg.libICE
xorg.libSM
xorg.libX11
xorg.libXScrnSaver
xorg.libXcomposite
xorg.libXcursor
xorg.libXdamage
xorg.libXext
xorg.libXfixes
xorg.libXft
xorg.libXi
xorg.libXinerama
xorg.libXmu
xorg.libXrandr
xorg.libXrender
xorg.libXt
xorg.libXtst
xorg.libXxf86vm
xorg.libpciaccess
xorg.libxcb
xorg.xcbutil
xorg.xcbutilimage
xorg.xcbutilkeysyms
xorg.xcbutilrenderutil
xorg.xcbutilwm
xorg.xkeyboardconfig
xz
zlib
];
};
}

94
modules/nixos/nix/default.nix Normal file
View file

@ -0,0 +1,94 @@
{ options, config, pkgs, lib, inputs, ... }:
with lib;
with lib.metacfg;
let
cfg = config.metacfg.nix;
substituters-submodule = types.submodule ({ name, ... }: {
options = with types; {
key = mkOpt (nullOr str) null "The trusted public key for this substituter.";
};
});
in
{
options.metacfg.nix = with types; {
enable = mkBoolOpt false "Whether or not to manage nix configuration.";
package = mkOpt package pkgs.nix "Which nix package to use.";
default-substituter = {
url = mkOpt str "https://cache.nixos.org" "The url for the substituter.";
key = mkOpt str "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" "The trusted public key for the substituter.";
};
extra-substituters = mkOpt (attrsOf substituters-submodule) { } "Extra substituters to configure.";
};
config = mkIf cfg.enable {
assertions = mapAttrsToList
(name: value: {
assertion = value.key != null;
message = "metacfg.nix.extra-substituters.${name}.key must be set";
})
cfg.extra-substituters;
environment.systemPackages = with pkgs; [
metacfg.nixos-revision
(metacfg.nixos-hosts.override {
hosts = inputs.self.nixosConfigurations;
})
deploy-rs
nixfmt
nix-index
nix-prefetch-git
nix-output-monitor
];
nix =
let
users = [ "root" config.metacfg.user.name ] ++
optional config.services.hydra.enable "hydra";
extra-substituters = cfg.extra-substituters // {
"https://nixsgx.cachix.org".key = "nixsgx.cachix.org-1:tGi36DlY2joNsIXOlGnSgWW0+E094V6hW0umQRo/KoE=";
};
in
{
package = cfg.package;
settings = {
experimental-features = "nix-command flakes";
http-connections = 50;
warn-dirty = false;
log-lines = 50;
sandbox = "relaxed";
auto-optimise-store = true;
trusted-users = users;
allowed-users = users;
substituters =
[ cfg.default-substituter.url ]
++
(mapAttrsToList (name: value: name) extra-substituters);
trusted-public-keys =
[ cfg.default-substituter.key ]
++
(mapAttrsToList (name: value: value.key) extra-substituters);
} // (lib.optionalAttrs config.metacfg.tools.direnv.enable {
keep-outputs = true;
keep-derivations = true;
});
gc = {
automatic = true;
dates = "weekly";
options = "--delete-older-than 30d";
};
# flake-utils-plus
generateRegistryFromInputs = true;
generateNixPathFromInputs = true;
linkInputs = true;
};
};
}

159
modules/nixos/services/base/default.nix Normal file
View file

@ -0,0 +1,159 @@
{ options
, config
, lib
, pkgs
, ...
}:
with lib;
with lib.metacfg;
let
cfg = config.metacfg.base;
gitconfig = pkgs.writeText "gitconfig" ''
[filter "rot8000"]
smudge = ${pkgs.metacfg.rot8000}/bin/rot8000
clean = ${pkgs.metacfg.rot8000}/bin/rot8000
'';
in
{
options.metacfg.base = with types; {
enable = mkBoolOpt false "Whether or not to enable the base config.";
};
config = mkIf cfg.enable {
# Configure console keymap
console.keyMap = lib.mkDefault "us";
# Select internationalisation properties.
i18n.defaultLocale = "en_US.UTF-8";
i18n.extraLocaleSettings = {
LC_ADDRESS = "de_DE.UTF-8";
LC_IDENTIFICATION = "de_DE.UTF-8";
LC_MEASUREMENT = "de_DE.UTF-8";
LC_MESSAGES = "en_US.UTF-8";
LC_MONETARY = "de_DE.UTF-8";
LC_NAME = "de_DE.UTF-8";
LC_NUMERIC = "de_DE.UTF-8";
LC_TELEPHONE = "de_DE.UTF-8";
LC_TIME = "de_DE.UTF-8";
};
environment = {
sessionVariables = { PATH = "$HOME/bin:$HOME/.cargo/bin"; };
systemPackages = with pkgs; [
age
bash
cifs-utils
clevis
delta
efibootmgr
git
git-crypt
git-delete-merged-branches
home-manager
htop
mosh
nixpkgs-fmt
openssl
restic
rrsync
sbctl
sops
strace
tmux
tpm2-pkcs11
tpm2-pkcs11.out
tpm2-tools
vim
virt-manager
wget
];
shells = [ pkgs.fish pkgs.bash ];
};
hardware = {
cpu = {
amd.updateMicrocode = lib.mkDefault true;
intel.updateMicrocode = lib.mkDefault true;
};
enableRedistributableFirmware = lib.mkDefault true;
enableAllFirmware = true;
opengl.extraPackages = with pkgs; [ intel-compute-runtime ];
};
programs = {
dconf.enable = true;
bash = {
## shellInit = ''
interactiveShellInit = ''
bind '"\e[A": history-search-backward'
bind '"\e[B": history-search-forward'
'';
};
starship.enable = true;
mosh.enable = true;
vim.defaultEditor = true;
fish.enable = true;
};
# powerManagement.cpuFreqGovernor = "ondemand";
services = {
dbus.implementation = "broker";
dbus.packages = [ pkgs.gcr ];
fwupd.enable = true;
openssh = {
enable = true;
settings.PermitRootLogin = "prohibit-password";
settings.X11Forwarding = true;
};
};
security = {
tpm2.enable = lib.mkDefault true;
tpm2.abrmd.enable = lib.mkDefault true;
sudo = {
enable = true;
wheelNeedsPassword = false;
};
};
time.timeZone = "Europe/Berlin";
users.users.root.openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMNsmP15vH8BVKo7bdvIiiEjiQboPGcRPqJK0+bH4jKD harald@lenovo.fritz.box"
"sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBACLgT81iB1iWWVuXq6PdQ5GAAGhaZhSKnveQCvcNnAOZ5WKH80bZShKHyAYzrzbp8IGwLWJcZQ7TqRK+qZdfagAAAAEc3NoOg== harald@hoyer.xyz"
"sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDsb/Tr69YN5MQLweWPuJaRGm+h2kOyxfD6sqKEDTIwoAAAABHNzaDo= harald@fedora.fritz.box"
];
boot = {
tmp.cleanOnBoot = true;
loader = {
systemd-boot.enable = lib.mkDefault true;
efi.canTouchEfiVariables = true;
timeout = 2;
};
initrd.systemd.enable = true;
kernelPackages = lib.mkOverride 0 pkgs.linuxPackages_latest;
};
system.autoUpgrade = {
flags = [
"--update-input"
"nixpkgs"
"--update-input"
"unstable"
"--no-write-lock-file"
"-L"
];
flake = "git+https://git.hoyer.xyz/harald/nixcfg";
};
systemd.services.nixos-upgrade = {
path = [ pkgs.metacfg.rot8000 ];
environment.GIT_CONFIG_GLOBAL = toString gitconfig;
};
virtualisation.libvirtd.enable = true;
};
}

138
modules/nixos/services/gui/default.nix Normal file
View file

@ -0,0 +1,138 @@
{ options, config, lib, pkgs, ... }:
with lib;
with lib.metacfg;
let cfg = config.metacfg.gui;
in
{
options.metacfg.gui = with types; {
enable = mkBoolOpt false "Whether or not to enable a GUI.";
};
config = mkIf cfg.enable {
services = {
gnome.tracker-miners.enable = lib.mkForce false;
flatpak.enable = true;
pcscd.enable = lib.mkDefault false;
# Enable CUPS to print documents.
printing.enable = true;
pipewire = {
enable = true;
alsa.enable = true;
alsa.support32Bit = true;
pulse.enable = true;
# If you want to use JACK applications, uncomment this
#jack.enable = true;
# use the example session manager (no others are packaged yet so this is enabled by default,
# no need to redefine it in your config for now)
#media-session.enable = true;
};
udev.packages = [
pkgs.libu2f-host
pkgs.yubikey-personalization
];
xserver = {
layout = lib.mkDefault "de+us";
enable = true;
displayManager.gdm.enable = true;
desktopManager.gnome.enable = true;
};
};
#security.pam.p11.control = "sufficient";
#security.pam.p11.control = "required";
#security.pam.p11.enable = true;
# services.fprintd.enable = true;
#security.pam.yubico.enable = true;
#security.pam.yubico.control = "sufficient";
#security.pam.yubico.mode = "challenge-response";
#security.tpm2.pkcs11.enable = true;
# Enable sound with pipewire.
sound.enable = true;
hardware.pulseaudio.enable = false;
security.rtkit.enable = true;
programs.gnupg.agent = {
enable = true;
enableSSHSupport = true;
enableBrowserSocket = true;
};
environment.systemPackages = with pkgs; [
bat
cardpeek
ccache
clang
dive
file
firefox
gh
git
gimp
gnome.gnome-software
gnomeExtensions.appindicator
gnomeExtensions.dash-to-panel
gnomeExtensions.hibernate-status-button
gnomeExtensions.vitals
gnupg
go
jetbrains-toolbox
jq
kbfs
libu2f-host
mosh
mosh
nixpkgs-fmt
opensc
pasystray
#pcsctools
pinentry-gnome
pkg-config
ripgrep
slack
spotify
statix
thunderbird
tmux
vim
wl-clipboard
yubikey-personalization
yubikey-manager-qt
zellij
rustup
];
#----=[ Fonts ]=----#
fonts = {
enableDefaultPackages = false;
packages = with pkgs; [
noto-fonts-emoji
liberation_ttf
freefont_ttf
(nerdfonts.override { fonts = [ "FiraCode" "DroidSansMono" "JetBrainsMono" ]; })
];
fontconfig = {
enable = true;
defaultFonts = {
serif = [ "Liberation" ];
sansSerif = [ "Liberation" ];
monospace = [ "JetBrainsMono" ];
emoji = [ "Noto Color Emoji" ];
};
};
};
# remote desktop
networking.firewall.allowedTCPPorts = [ 3389 ];
};
}

25
modules/nixos/services/podman/default.nix Normal file
View file

@ -0,0 +1,25 @@
{ options, config, lib, pkgs, ... }:
with lib;
with lib.metacfg;
let cfg = config.metacfg.podman;
in
{
options.metacfg.podman = with types; {
enable = mkBoolOpt false "Whether or not to enable podman.";
};
config = mkIf cfg.enable {
virtualisation = {
podman = {
enable = true;
# Create a `docker` alias for podman, to use it as a drop-in replacement
dockerCompat = lib.mkDefault true;
# For Nixos version > 22.11
defaultNetwork.settings = { dns_enabled = true; };
};
};
};
}

21
modules/nixos/services/secureboot/default.nix Normal file
View file

@ -0,0 +1,21 @@
{ options, config, lib, pkgs, ... }:
with lib;
with lib.metacfg;
let cfg = config.metacfg.secureboot;
in
{
options.metacfg.secureboot = with types; {
enable = mkBoolOpt false "Whether or not to enable secureboot.";
};
config = mkIf cfg.enable {
boot = {
lanzaboote = {
enable = true;
pkiBundle = "/etc/secureboot";
};
loader.systemd-boot.enable = lib.mkForce false;
};
};
}

30
modules/nixos/sgx/aesmd_dcap/default.nix Normal file
View file

@ -0,0 +1,30 @@
{ options, config, lib, pkgs, ... }:
with lib;
with lib.metacfg;
let
cfg = config.metacfg.aesmd_dcap;
in
{
options.metacfg.aesmd_dcap = with types; {
enable = mkBoolOpt false "Whether or not to enable aesmd in dcap mode.";
};
config = mkIf cfg.enable {
metacfg = {
nix.extra-substituters = {
"https://nixsgx.cachix.org".key = "nixsgx.cachix.org-1:tGi36DlY2joNsIXOlGnSgWW0+E094V6hW0umQRo/KoE=";
};
};
services.aesmd = {
enable = true;
quoteProviderLibrary = pkgs.nixsgx.sgx-dcap.default_qpl;
};
systemd.services.aesmd = {
environment.LD_LIBRARY_PATH = lib.mkForce (lib.makeLibraryPath [ pkgs.nixsgx.sgx-dcap.default_qpl pkgs.curl.out ]);
serviceConfig.BindReadOnlyPaths = [
"/etc/sgx_default_qcnl.conf"
];
};
};
}

69
modules/nixos/sgx/pccs/default.nix Normal file
View file

@ -0,0 +1,69 @@
{ options, config, lib, pkgs, ... }:
with lib;
with lib.metacfg;
let
cfg = config.metacfg.pccs;
cfg_podman = config.metacfg.podman;
in
{
options.metacfg.pccs = with types; {
enable = mkBoolOpt false "Whether or not to enable a SGX-DCAP.";
secret = mkOption {
type = with types; nullOr path;
default = null;
example = literalExpression "config.sops.secrets.pccs.path";
description = lib.mdDoc "path to the pccs secret file";
};
};
config = mkIf cfg.enable {
assertions = [
{
assertion = cfg.secret != null;
message = "path to the pccs secret file is required when pccs is enabled";
}
{
assertion = cfg_podman.enable;
message = "podman must be enabled when pccs is enabled";
}
];
metacfg = {
nix.extra-substituters = {
"https://nixsgx.cachix.org".key = "nixsgx.cachix.org-1:tGi36DlY2joNsIXOlGnSgWW0+E094V6hW0umQRo/KoE=";
};
};
virtualisation.oci-containers.backend = "podman";
virtualisation.oci-containers.containers = {
# podman run --pull=always --name pccs -it --rm -v /dev/log:/dev/log --secret PCCS_CONFIG,type=mount -p 8081:8081 registry.gitlab.com/haraldh/pccs:pccs_1_19
pccs = {
image = "docker.io/backslashhh/pccs:dcap_1_19";
autoStart = true;
ports = [ "8081:8081" ];
extraOptions = [
"--volume=/dev/log:/dev/log"
"--secret=PCCS_CONFIG,type=mount"
];
};
};
systemd.services.pccs-secret =
{
description = "Inject pccs secret";
wantedBy = [ "multi-user.target" ];
before = [ "podman-pccs.service" ];
serviceConfig = {
EnvironmentFile = cfg.secret;
ExecStart = ''
-${pkgs.podman}/bin/podman secret create --env PCCS_CONFIG PCCS_CONFIG
'';
RemainAfterExit = true;
};
};
};
}

20
modules/nixos/tools/direnv/default.nix Normal file
View file

@ -0,0 +1,20 @@
{ options, config, lib, pkgs, ... }:
with lib;
with lib.metacfg;
let cfg = config.metacfg.tools.direnv;
in
{
options.metacfg.tools.direnv = with types; {
enable = mkBoolOpt false "Whether or not to enable direnv.";
};
config = mkIf cfg.enable {
metacfg.home.extraOptions = {
programs.direnv = {
enable = true;
nix-direnv = enabled;
};
};
};
}

61
modules/nixos/tools/git/default.nix Normal file
View file

@ -0,0 +1,61 @@
{ options, config, pkgs, lib, ... }:
with lib;
with lib.metacfg;
let
cfg = config.metacfg.tools.git;
gpg = config.metacfg.security.gpg;
user = config.metacfg.user;
in
{
options.metacfg.tools.git = with types; {
enable = mkBoolOpt false "Whether or not to install and configure git.";
userName = mkOpt types.str user.fullName "The name to configure git with.";
userEmail = mkOpt types.str user.email "The email to configure git with.";
signingKey =
mkOpt types.str "9762169A1B35EA68" "The key ID to sign commits with.";
};
config = mkIf cfg.enable {
environment.systemPackages = with pkgs; [ git ];
metacfg.home.extraOptions = {
programs.git = {
enable = true;
inherit (cfg) userName userEmail;
lfs = enabled;
signing = {
key = cfg.signingKey;
signByDefault = mkIf gpg.enable true;
};
extraConfig = {
init = { defaultBranch = "main"; };
pull = { rebase = true; };
push = { autoSetupRemote = true; };
core = { whitespace = "trailing-space,space-before-tab"; };
safe = {
directory = "${user.home}/git";
};
"credential \"https://github.com\"" = {
helper = "!gh auth git-credential";
};
alias = {
co = "checkout";
ci = "commit --signoff";
};
pull.ff = "only";
core.pager = "${pkgs.delta}/bin/delta";
delta = {
features = "decorations";
syntax-theme = "DarkNeon";
light = "false";
navigate = "true";
};
interactive.diffFilter = "${pkgs.delta}/bin/delta --color-only";
merge.conflictStyle = "diff3";
diff.colorMoved = "default";
};
};
};
};
}

104
modules/nixos/user/default.nix Normal file
View file

@ -0,0 +1,104 @@
{ options
, config
, pkgs
, lib
, ...
}:
with lib;
with lib.metacfg; let
cfg = config.metacfg.user;
defaultIconFileName = "profile.jpg";
defaultIcon = pkgs.stdenvNoCC.mkDerivation {
name = "default-icon";
src = ./. + "/${defaultIconFileName}";
dontUnpack = true;
installPhase = ''
cp $src $out
'';
passthru = { fileName = defaultIconFileName; };
};
propagatedIcon =
pkgs.runCommandNoCC "propagated-icon"
{ passthru = { fileName = cfg.icon.fileName; }; }
''
local target="$out/share/metacfg-icons/user/${cfg.name}"
mkdir -p "$target"
cp ${cfg.icon} "$target/${cfg.icon.fileName}"
'';
in
{
options.metacfg.user = with types; {
name = mkOpt str "harald" "The name to use for the user account.";
fullName = mkOpt str "Harald Hoyer" "The full name of the user.";
email = mkOpt str "harald@hoyer.xyz" "The email of the user.";
initialPassword =
mkOpt str "password"
"The initial password to use when the user is first created.";
icon =
mkOpt (nullOr package) defaultIcon
"The profile picture to use for the user.";
prompt-init = mkBoolOpt true "Whether or not to show an initial message when opening a new shell.";
extraGroups = mkOpt (listOf str) [ ] "Groups for the user to be assigned.";
sshKeys = mkOpt (listOf str) [
"sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDsb/Tr69YN5MQLweWPuJaRGm+h2kOyxfD6sqKEDTIwoAAAABHNzaDo= harald@fedora.fritz.box"
"sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBACLgT81iB1iWWVuXq6PdQ5GAAGhaZhSKnveQCvcNnAOZ5WKH80bZShKHyAYzrzbp8IGwLWJcZQ7TqRK+qZdfagAAAAEc3NoOg== harald@hoyer.xyz"
"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBAYbUTKpy4QR3s944/hjJ1UK05asFEs/SmWeUbtS0cdA660sT4xHnRfals73FicOoz+uIucJCwn/SCM804j+wtM="
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMNsmP15vH8BVKo7bdvIiiEjiQboPGcRPqJK0+bH4jKD harald@lenovo.fritz.box"
] "ssh keys";
extraOptions =
mkOpt attrs { }
(mdDoc "Extra options passed to `users.users.<name>`.");
};
config = {
environment.systemPackages = with pkgs; [
];
metacfg.home = {
file = {
"Desktop/.keep".text = "";
"Documents/.keep".text = "";
"Downloads/.keep".text = "";
"Music/.keep".text = "";
"Pictures/.keep".text = "";
"Videos/.keep".text = "";
"work/.keep".text = "";
".face".source = cfg.icon;
"Pictures/${
cfg.icon.fileName or (builtins.baseNameOf cfg.icon)
}".source =
cfg.icon;
};
extraOptions.programs.bash.initExtra = ''
[[ $WANT_BASH ]] || ${pkgs.fish}/bin/fish -l
'';
};
users.users.${cfg.name} =
{
isNormalUser = true;
# inherit (cfg) name initialPassword;
openssh.authorizedKeys.keys = cfg.sshKeys;
home = "/home/${cfg.name}";
group = "users";
shell = pkgs.bash;
# Arbitrary user ID to use for the user. Since I only
# have a single user on my machines this won't ever collide.
# However, if you add multiple users you'll need to change this
# so each user has their own unique uid (or leave it out for the
# system to select).
uid = 1000;
extraGroups = [ ] ++ cfg.extraGroups;
}
// cfg.extraOptions;
};
}

BIN
modules/nixos/user/profile.jpg Normal file
View file

Binary file not shown.
Side by side

After

Width:  |  Height:  |  Size: 32 KiB

5
overlays/jetbrains-toolbox/default.nix Normal file
View file

@ -0,0 +1,5 @@
{ channels, ... }:
final: prev:
{
inherit (channels.unstable) jetbrains-toolbox;
}

5
overlays/nixsgx/default.nix Normal file
View file

@ -0,0 +1,5 @@
{ channels, ... }:
final: prev:
{
inherit (channels.nixpkgs.nixsgx) sgx-psw;
}

49
packages/nixos-hosts/default.nix Normal file
View file

@ -0,0 +1,49 @@
{ lib
, writeText
, writeShellApplication
, substituteAll
, gum
, inputs
, hosts ? { }
, ...
}:
let
inherit (lib) mapAttrsToList concatStringsSep;
inherit (lib.metacfg) override-meta;
substitute = args: builtins.readFile (substituteAll args);
formatted-hosts = mapAttrsToList
(name: host: "${name},${host.pkgs.system}")
hosts;
hosts-csv = writeText "hosts.csv" ''
Name,System
${concatStringsSep "\n" formatted-hosts}
'';
nixos-hosts = writeShellApplication {
name = "nixos-hosts";
text = substitute {
src = ./nixos-hosts.sh;
help = ./help;
hosts = if hosts == { } then "" else hosts-csv;
};
checkPhase = "";
runtimeInputs = [
gum
];
};
new-meta = with lib; {
description = "A helper to list all of the NixOS hosts available from your flake.";
license = licenses.asl20;
maintainers = with maintainers; [ jakehamilton ];
};
in
override-meta new-meta nixos-hosts

16
packages/nixos-hosts/help/nixos-hosts.sh Normal file
View file

@ -0,0 +1,16 @@
echo -e "
${text_bold}${text_fg_blue}nixos-hosts${text_reset}
${text_bold}DESCRIPTION${text_reset}
Show NixOS hosts from your flake.
${text_bold}USAGE${text_reset}
${text_dim}\$${text_reset} ${text_bold}nixos-hosts${text_reset} [options]
${text_bold}OPTIONS${text_reset}
--help, -h Show this help message
--debug Show debug messages
"

324
packages/nixos-hosts/nixos-hosts.sh Normal file
View file

@ -0,0 +1,324 @@
#!/usr/bin/env bash
#==============================#
# Global #
#==============================#
DEBUG=${DEBUG:-"false"}
#==============================#
# Injected #
#==============================#
hosts="@hosts@"
help_root="@help@"
#==============================#
# Logging #
#==============================#
text_reset="\e[m"
text_bold="\e[1m"
text_dim="\e[2m"
text_italic="\e[3m"
text_underline="\e[4m"
text_blink="\e[5m"
text_highlight="\e[7m"
text_hidden="\e[8m"
text_strike="\e[9m"
text_fg_red="\e[38;5;1m"
text_fg_green="\e[38;5;2m"
text_fg_yellow="\e[38;5;3m"
text_fg_blue="\e[38;5;4m"
text_fg_magenta="\e[38;5;5m"
text_fg_cyan="\e[38;5;6m"
text_fg_white="\e[38;5;7m"
text_fg_dim="\e[38;5;8m"
text_bg_red="\e[48;5;1m"
text_bg_green="\e[48;5;2m"
text_bg_yellow="\e[48;5;3m"
text_bg_blue="\e[48;5;4m"
text_bg_magenta="\e[48;5;5m"
text_bg_cyan="\e[48;5;6m"
text_bg_white="\e[48;5;7m"
text_bg_dim="\e[48;5;8m"
# Usage: log_info <message>
log_info() {
echo -e "${text_fg_blue}info${text_reset} $1"
}
# Usage: log_todo <message>
log_todo() {
echo -e "${text_bg_magenta}${text_fg_white}todo${text_reset} $1"
}
# Usage: log_debug <message>
log_debug() {
if [[ $DEBUG == true ]]; then
echo -e "${text_fg_dim}debug${text_reset} $1"
fi
}
# Usage: log_warn <message>
log_warn() {
echo -e "${text_fg_yellow}warn${text_reset} $1"
}
# Usage: log_error <message>
log_error() {
echo -e "${text_fg_red}error${text_reset} $1"
}
# Usage: log_fatal <message> [exit-code]
log_fatal() {
echo -e "${text_fg_white}${text_bg_red}fatal${text_reset} $1"
if [ -z ${2:-} ]; then
exit 1
else
exit $2
fi
}
# Usage: clear_previous_line [number]
clear_line() {
echo -e "\e[${1:-"1"}A\e[2K"
}
# Usage:
# rewrite_line <message>
# rewrite_line <number> <message>
rewrite_line() {
if [[ $# == 1 ]]; then
echo -e "\e[1A\e[2K${1}"
else
echo -e "\e[${1}A\e[2K${2}"
fi
}
#==============================#
# Options #
#==============================#
positional_args=()
opt_help=false
opt_pick=false
opt_list=false
# Usage: missing_value <option>
missing_opt_value() {
log_fatal "Option $1 requires a value"
}
# shellcheck disable=SC2154
while [[ $# > 0 ]]; do
case "$1" in
-h|--help)
opt_help=true
shift
;;
-p|--pick)
opt_pick=true
shift
;;
-l|--list)
opt_list=true
shift
;;
--show-trace)
opt_show_trace=true
shift
;;
--debug)
DEBUG=true
shift
;;
--)
shift
break
;;
-*|--*)
echo "Unknown option $1"
exit 1
;;
*)
positional_args+=("$1")
shift
;;
esac
done
passthrough_args=($@)
show_trace=""
#==============================#
# Helpers #
#==============================#
# Usage: split <string> <delimiter>
split() {
IFS=$'\n' read -d "" -ra arr <<< "${1//$2/$'\n'}"
printf '%s\n' "${arr[@]}"
}
# Usage: lstrip <string> <pattern>
lstrip() {
printf '%s\n' "${1##$2}"
}
# Usage: show_help <path>
show_help() {
log_debug "Showing help: ${text_bold}$1${text_reset}"
source "${help_root}/$1.sh"
}
# Usage: require_flake_nix
require_flake_nix() {
if ! [ -f ./flake.nix ]; then
log_fatal "This command requires a flake.nix file, but one was not found in the current directory."
fi
}
# Usage: get_flake_attributes <output> <flake-uri>
get_flake_attributes() {
local outputs=""
# NOTE: Some flakes may not contain the values we're looking for. In
# which case, we swallow errors here to keep the output clean.
set +e
outputs=$(nix eval --impure --raw --expr "\
let
flake = builtins.getFlake \"$2\";
outputs =
if builtins.elem \"$1\" [ \"packages\" \"devShells\" \"apps\" ] then
builtins.attrNames (flake.\"$1\".\${builtins.currentSystem} or {})
else
builtins.attrNames (flake.\"$1\" or {});
names = builtins.map (output: \"$2#\" + output) outputs;
in
builtins.concatStringsSep \" \" names
" 2>/dev/null)
set -e
echo "$outputs"
}
# Usage: replace_each <pattern> <text> <data>
replace_each() {
local results=()
for item in $3; do
if [[ "$item" == $1* ]]; then
results+=("$2$(lstrip $item $1)")
else
results+=("$item")
fi
done
echo "${results[*]}"
}
# Usage: prefix_each <prefix> <data>
prefix_each() {
local results=()
for item in $2; do
results+=("$1 $item")
done
echo "${results[*]}"
}
# Usage: join_by <delimiter> <data> <data> [...<data>]
join_by() {
local d=${1-} f=${2-}
if shift 2; then
printf %s "$f" "${@/#/$d}"
fi
}
# Usage: privileged <command>
privileged() {
cmd="$@"
if command -v sudo >/dev/null; then
log_debug "sudo $cmd"
sudo $cmd
elif command -v doas >/dev/null; then
log_debug "doas $cmd"
doas $cmd
else
log_warn "Could not find ${text_bold}sudo${text_reset} or ${text_bold}doas${text_reset}. Executing without privileges."
log_debug "$cmd"
eval "$cmd"
fi
}
#==============================#
# Commands #
#==============================#
nixos_hosts_all() {
if [[ $opt_help == true ]]; then
show_help nixos-hosts
exit 0
fi
if [[ -z "${hosts}" ]]; then
log_error "To use this program, override it with your nixosConfigurations:"
log_error ""
log_error " nixos-hosts.override {"
log_error " inherit (self) nixosConfigurations;"
log_error " }"
log_error ""
log_fatal "No hosts configured."
fi
if [ "${opt_list}" == "true" ]; then
local csv=$(cat "${hosts}")
local csv_data=$(echo -n "$csv" | tail +2)
while read -r line; do
local name=$(split "${line}" "," | head -n 1)
echo "${name}"
done <<< "${csv_data}"
exit 0
fi
host=$(gum table --selected.foreground="4" --widths=32,20 < "${hosts}")
if [ -z "${host}" ]; then
exit 0
else
local name=$(split "${host}" "," | head -n 1)
echo $name
fi
}
#==============================#
# Execute #
#==============================#
if [ -z "${positional_args:-}" ]; then
if [[ $opt_help == true ]]; then
show_help "nixos-hosts"
exit 0
else
log_debug "Running subcommand: ${text_bold}nixos_hosts_all${text_reset}"
nixos_hosts_all
exit 0
fi
fi
case ${positional_args[0]} in
*)
log_fatal "Unknown subcommand: ${text_bold}${positional_args[0]}${text_reset}"
;;
esac

73
packages/nixos-revision/default.nix Normal file
View file

@ -0,0 +1,73 @@
{ pkgs
, lib
, gitHostCommitUrl ? "https://git.hoyer.xyz/harald/nixcfg/commit"
, ...
}:
let
inherit (lib.metacfg) override-meta;
new-meta = with lib; {
description = "A helper show the current git revision of the system configuration.";
license = licenses.asl20;
maintainers = with maintainers; [ jakehamilton ];
};
package =
pkgs.writeShellScriptBin "nixos-revision" ''
HAS_HELP=false
HAS_OPEN=false
while [[ $# -gt 0 ]]; do
case $1 in
-h|--help)
HAS_HELP=true
shift
;;
-o|--open)
HAS_OPEN=true
shift
;;
*)
shift
;;
esac
done
if [ $HAS_HELP == true ]; then
HELP_MSG="
nixos-revision
USAGE
nixos-revision [options]
OPTIONS
-h, --help Show this help message
-o, --open Open the revision on GitHub
EXAMPLES
$ # Print the current revision
$ nixos-revision
$ # Open the current revision on GitHub
$ nixos-revision --open
"
echo "$HELP_MSG"
exit 0
fi
REVISION=$(nixos-version --json | ${pkgs.jq}/bin/jq -r .configurationRevision)
if [ $HAS_OPEN == true ]; then
GITHUB_URL="${gitHostCommitUrl}/$REVISION"
echo "Opening URL: $GITHUB_URL"
${pkgs.xdg-utils}/bin/xdg-open $GITHUB_URL
else
echo $REVISION
fi
'';
in
override-meta new-meta package

54
packages/rot8000/Cargo.lock generated Normal file
View file

@ -0,0 +1,54 @@
# This file is automatically @generated by Cargo.
# It is not intended for manual editing.
version = 3
[[package]]
name = "aho-corasick"
version = "1.1.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
dependencies = [
"memchr",
]
[[package]]
name = "memchr"
version = "2.7.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "523dc4f511e55ab87b694dc30d0f820d60906ef06413f93d4d7a1385599cc149"
[[package]]
name = "regex"
version = "1.10.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b62dbe01f0b06f9d8dc7d49e05a0785f153b00b2c227856282f671e0318c9b15"
dependencies = [
"aho-corasick",
"memchr",
"regex-automata",
"regex-syntax",
]
[[package]]
name = "regex-automata"
version = "0.4.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "86b83b8b9847f9bf95ef68afb0b8e6cdb80f498442f5179a29fad448fcc1eaea"
dependencies = [
"aho-corasick",
"memchr",
"regex-syntax",
]
[[package]]
name = "regex-syntax"
version = "0.8.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
[[package]]
name = "rot8000"
version = "0.1.0"
dependencies = [
"regex",
]

28
packages/rot8000/default.nix Normal file
View file

@ -0,0 +1,28 @@
{ lib
, stdenv
, rustPlatform
, fetchFromGitHub
, ...
}:
rustPlatform.buildRustPackage rec {
pname = "rot8000";
version = "0.0.1";
src = fetchFromGitHub {
owner = "haraldh";
rev = "3e3c4e4d6ed5b572ca2b09c8dc7f5bc3bd86e554";
repo = "mailsmudge";
sha256 = "sha256-4cG4Mn94lewxj1qstor8R0xLWIBFxf0rOHTMxzgHyFQ=";
};
cargoLock = {
lockFile = ./Cargo.lock;
};
meta = with lib; {
description = "mailsmudge";
homepage = "https://github.com/haraldh/mailsmudge";
license = licenses.unlicense;
maintainers = [ maintainers.tailhook ];
};
}

16
systems/x86_64-darwin/mpro/default.nix Normal file
View file

@ -0,0 +1,16 @@
{ lib, pkgs, ... }:
with lib.metacfg;
{
metacfg = {
suites = {
common = enabled;
};
};
environment.systemPath = [
"/usr/local/Homebrew/bin"
];
system.stateVersion = 4;
}

79
systems/x86_64-linux/mx/acme.nix Normal file
View file

@ -0,0 +1,79 @@
{ pkgs, lib, config, ... }:
{
sops.secrets.internetbs = {
sopsFile = ../../../.secrets/hetzner/internetbs.yaml; # bring your own password file
};
security.acme = {
acceptTerms = true;
defaults = {
email = "harald@hoyer.xyz";
dnsProvider = "internetbs";
credentialsFile = config.sops.secrets.internetbs.path;
};
certs = {
"mx.surfsite.org" = { };
"surfsite.org" = {
extraDomainNames = [
"*.surfsite.org"
];
};
"hoyer.xyz" = {
dnsProvider = "cloudflare";
extraDomainNames = [
"*.hoyer.xyz"
"*.harald.hoyer.xyz"
"*.hartwin.hoyer.xyz"
];
};
"hoyer.world" = {
dnsProvider = "cloudflare";
extraDomainNames = [
"*.hoyer.world"
"*.harald.hoyer.world"
"*.hartwin.hoyer.world"
];
};
"hoyer.social" = {
dnsProvider = "cloudflare";
extraDomainNames = [
"*.hoyer.social"
"*.harald.hoyer.social"
"*.hartwin.hoyer.social"
];
};
"hoyer.photos" = {
dnsProvider = "cloudflare";
extraDomainNames = [
"*.hoyer.photos"
"*.harald.hoyer.photos"
"*.hartwin.hoyer.photos"
];
};
"harald-hoyer.de" = {
extraDomainNames = [
"*.harald-hoyer.de"
];
};
"hartwin-hoyer.de" = {
extraDomainNames = [
"*.hartwin-hoyer.de"
];
};
"varlink.org" = {
extraDomainNames = [
"*.varlink.org"
];
};
};
};
}

18
systems/x86_64-linux/mx/backup.nix Normal file
View file

@ -0,0 +1,18 @@
{ pkgs, lib, ... }:
{
users.users.backup = {
shell = pkgs.bash;
isNormalUser = true;
openssh.authorizedKeys.keys = [
"restrict,command=\"/run/wrappers/bin/rrsync -ro /\" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDQGdtB6BFdXN+cRepkzWhbG5KRIM5nXmHiw1K+CEhGihwWsNVKGgU/q4rePK6PVNflTIoHUfL30jkA7H8VpSzu0XOa97Tqf+sF9VQOFrMjpf2rOWv38nc2GnKpnUu68c17KRZ+i8cnPZH0VUqRzaY/1IPMFH3OYO4qHJAEN5oAsyMFI9pbqFLqRnwNALjxf8fUvR/XB88zt3P34vFFer15FtLr4dlIzoEFGdUSOErmGJGmDzTptMqi/t0kn2AgaBKzMxwGTDUj6adU6KKBERj4ii3ekOrPwcNjsws3Mtlm5p8ycUkwUFoIiXukF6XRzCRSWMbZOgSnu2TfC6jRRrdbMNWn4QGF/jdBvvKcBoD4sChzpG6aF4m+7ue0QuHES7Kd2Rwnq0jbesGuBnRciDN+jssGvxZKX7XEialuXiaTQ4jPUA4zgWq474CR6ksuxpUDlKpH+leWPLtuKlhEZZnJHCMhz8Ewk/ZwiNSbLO97cwJciBM71orGWpFxHciT1QE= root@sgx"
];
};
security.wrappers.rrsync = {
source = "${pkgs.rrsync.out}/bin/rrsync";
owner = "backup";
group = "users";
permissions = "u=rwx,g=,o=";
capabilities = "cap_dac_read_search=+ep";
};
}

71
systems/x86_64-linux/mx/default.nix Normal file
View file

@ -0,0 +1,71 @@
{ pkgs, lib, ... }:
{
imports = [
./hardware-configuration.nix
./rspamd.nix
./goaccess.nix
./nextcloud.nix
./backup.nix
./users.nix
./kicker.nix
./mailserver.nix
./acme.nix
./forgejo.nix
./nginx.nix
./network.nix
];
metacfg = {
base.enable = true;
nix.enable = true;
podman.enable = true;
secureboot.enable = false;
};
security = {
tpm2.enable = lib.mkDefault true;
tpm2.abrmd.enable = lib.mkDefault true;
};
system.autoUpgrade = {
enable = true;
dates = "04:00";
operation = "switch";
allowReboot = true;
flake = lib.mkForce "git+file:///var/lib/gitea/repositories/harald/nixcfg.git#mx";
};
environment.systemPackages = with pkgs; [
age
apacheHttpd # for mkpasswd
efibootmgr
fgallery
git
htop
mdadm
rrsync
tpm2-pkcs11
tpm2-pkcs11.out
tpm2-tools
zola
];
sops.age.sshKeyPaths = [ "/var/lib/secrets/ssh_host_ed25519_key" ];
services.openssh = {
enable = true;
hostKeys = [
{
path = "/var/lib/secrets/ssh_host_ed25519_key";
type = "ed25519";
}
{
path = "/var/lib/secrets/ssh_host_rsa_key";
type = "rsa";
bits = 4096;
}
];
};
system.stateVersion = "23.05";
}

54
systems/x86_64-linux/mx/forgejo.nix Normal file
View file

@ -0,0 +1,54 @@
{ pkgs, lib, config, ... }:
{
sops.secrets."postgres/gitea_dbpass" = {
sopsFile = ../../../.secrets/hetzner/postgres.yaml; # bring your own password file
owner = config.services.forgejo.user;
};
services.forgejo = {
enable = true;
user = "gitea";
group = "gitea";
stateDir = "/var/lib/gitea";
database = {
name = "gitea";
user = "gitea";
type = "postgres";
passwordFile = config.sops.secrets."postgres/gitea_dbpass".path;
};
settings.service.DISABLE_REGISTRATION = true;
settings.server = {
DOMAIN = "git.hoyer.xyz";
ROOT_URL = "https://git.hoyer.xyz/";
HTTP_PORT = 3001;
};
settings.log.LEVEL = "Warn";
};
users.users.gitea = {
home = "/var/lib/gitea";
useDefaultShell = true;
group = "gitea";
isSystemUser = true;
};
users.groups.gitea = { };
services.postgresql = {
package = pkgs.postgresql_14;
ensureDatabases = [
config.services.forgejo.database.name
"nextcloud"
];
ensureUsers = [
{
name = config.services.forgejo.database.user;
ensureDBOwnership = true;
}
{
name = "nextcloud";
ensureDBOwnership = true;
}
];
};
}

26
systems/x86_64-linux/mx/goaccess.nix Normal file
View file

@ -0,0 +1,26 @@
{ pkgs, lib, ... }:
{
systemd.timers."goaccess" = {
wantedBy = [ "timers.target" ];
timerConfig = {
OnCalendar = "*:0/15";
Unit = "goaccess.service";
};
};
systemd.services."goaccess" = {
script = ''
set -eu
${pkgs.gzip}/bin/zcat -f /var/log/nginx/access.log* | ${pkgs.goaccess}/bin/goaccess --log-format=VCOMBINED -o /var/www/hoyer.xyz/html/stats/index.html -
${pkgs.gzip}/bin/zcat -f /var/log/nginx/access.log* | ${pkgs.gnugrep}/bin/egrep '^harald.hoyer.xyz' | ${pkgs.goaccess}/bin/goaccess --log-format=VCOMBINED -o /var/www/hoyer.xyz/html/stats/harald-hoyer.html -
${pkgs.gzip}/bin/zcat -f /var/log/nginx/access.log* | ${pkgs.gnugrep}/bin/egrep '^hartwin.hoyer.xyz' | ${pkgs.goaccess}/bin/goaccess --log-format=VCOMBINED -o /var/www/hoyer.xyz/html/stats/hartwin-hoyer.html -
${pkgs.gzip}/bin/zcat -f /var/log/nginx/access.log* | ${pkgs.gnugrep}/bin/egrep '^git.hoyer.xyz' | ${pkgs.goaccess}/bin/goaccess --log-format=VCOMBINED -o /var/www/hoyer.xyz/html/stats/git-hoyer.html -
${pkgs.gzip}/bin/zcat -f /var/log/nginx/access.log* | ${pkgs.gnugrep}/bin/egrep '^nc.hoyer.xyz' | ${pkgs.goaccess}/bin/goaccess --log-format=VCOMBINED -o /var/www/hoyer.xyz/html/stats/nc-hoyer.html -
${pkgs.gzip}/bin/zcat -f /var/log/nginx/access.log* | ${pkgs.gnugrep}/bin/egrep '^kicker.surfsite.org' | ${pkgs.goaccess}/bin/goaccess --log-format=VCOMBINED -o /var/www/hoyer.xyz/html/stats/kicker.html -
'';
serviceConfig = {
Type = "oneshot";
User = "root";
};
};
}

45
systems/x86_64-linux/mx/hardware-configuration.nix Normal file
View file

@ -0,0 +1,45 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ lib, pkgs, modulesPath, ... }:
{
imports = [
(modulesPath + "/installer/scan/not-detected.nix")
];
boot.kernelPackages = lib.mkForce pkgs.linuxPackages;
boot.initrd.luks.devices.crypted = {
device = "/dev/md/raid1";
preLVM = true;
};
boot.initrd.availableKernelModules = [
"xhci_pci"
"ahci"
"nvme"
"sd_mod"
"tpm"
"tpm_tis"
"trusted"
"tpm_crb"
"tpm_tis_core"
"rng_core"
];
boot.swraid.enable = true;
boot.swraid.mdadmConf = ''
MAILADDR admin@hoyer.xyz
'';
disko.devices = import ./server-raid.nix {
inherit lib;
disks = [ "/dev/sda" "/dev/sdb" ];
};
swapDevices = [{ device = "/swapfile"; }];
}

17
systems/x86_64-linux/mx/kicker.nix Normal file
View file

@ -0,0 +1,17 @@
{ pkgs, lib, ... }:
{
virtualisation.oci-containers.containers = {
kicker = {
image = "quay.io/kicker/kicker:live";
ports = [ "127.0.0.1:8087:80" ];
volumes = [
"/home/hartwin/kicker/.htaccess:/app/public/.htaccess"
"/home/hartwin/kicker/.htpasswd:/app/public/.htpasswd"
"/home/hartwin/kicker/live.db:/app/db/data/current.db"
];
extraOptions = [
"--pull=always"
];
};
};
}

233
systems/x86_64-linux/mx/mailserver.nix Normal file
View file

@ -0,0 +1,233 @@
{ pkgs, lib, config, ... }:
{
# email addresses git smudged
mailserver = {
enable = true;
fqdn = "mx.surfsite.org";
sendingFqdn = "mx.surfsite.org";
domains = [
"harald-hoyer.de"
"hartwin-hoyer.de"
"herward-hoyer.de"
"meike-knutz.de"
"gerlinde-hoyer.de"
"hoyer.xyz"
"nc.hoyer.xyz"
"harald.hoyer.xyz"
"varlink.org"
"surfsite.org"
"myprivacy.tools"
"hoyer.social"
"hoyer.world"
"hoyer.photos"
"harald.hoyer.photos"
"hartwin.hoyer.photos"
"mx.surfsite.org"
];
extraVirtualAliases = {
"znk@ublre.klm" = [
"unenyq@ublre.klm"
"zu@ublre.klm"
];
"sryvk@ublre.klm" = [
"unenyq@ublre.klm"
"zu@ublre.klm"
];
"zhu@ublre.klm" = [
"unenyq@ublre.klm"
"zu@ublre.klm"
];
"xvpxre@fhesfvgr.bet" = [
"unenyq@ublre.klm"
"unegjva@ublre.klm"
];
};
# A list of all login accounts. To create the password hashes, use
# nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt'
loginAccounts = {
"zu@ublre.klm" = {
hashedPasswordFile = "/ubzr/unenyq/frpergf/zu@ublre.klm";
aliases = [
"zrvxr@unenyq-ublre.qr"
"zrvxr@zrvxr-xahgm.qr"
"zrvxr.ublre@zrvxr-xahgm.qr"
"zrvxr@ublre.klm"
];
};
"nyrk@ublre.klm" = {
hashedPasswordFile = "/home/hartwin/secrets/alex-mail";
aliases = [
"nyrk@unegjva-ublre.qr"
"nyrk.ublre@unegjva-ublre.qr"
"nyrk@fhesfvgr.bet"
"nyrk.ublre@fhesfvgr.bet"
"nyrknaqre@ublre.klm"
];
};
"wna@ublre.klm" = {
hashedPasswordFile = "/home/hartwin/secrets/jan-mail";
aliases = [
"wna@unegjva-ublre.qr"
"wna.ublre@unegjva-ublre.qr"
"wna@fhesfvgr.bet"
"wna.ublre@fhesfvgr.bet"
];
};
"unaanu@ublre.klm" = {
hashedPasswordFile = "/home/hartwin/secrets/hannah-mail";
aliases = [
"unaanu@unegjva-ublre.qr"
"unaanu.ublre@unegjva-ublre.qr"
"unaanu@fhesfvgr.bet"
"unaanu.ublre@fhesfvgr.bet"
];
};
"fgrssv@ublre.klm" = {
hashedPasswordFile = "/home/hartwin/secrets/steffi-mail";
aliases = [
"fgrssv@fhesfvgr.bet"
"fgrsnavrublre@fhesfvgr.bet"
"fgrsnavr.ublre@fhesfvgr.bet"
"fgrsnavr.ublre@ublre.klm"
"fgrsnavr@ublre.klm"
];
};
"unegjva@ublre.klm" = {
hashedPasswordFile = "/home/hartwin/secrets/hartwin-mail";
aliases = [
"unegjva.ublre@unegjva-ublre.qr"
"znvy@unegjva-ublre.qr"
"unegjva@unegjva-ublre.qr"
"lbhghor@unegjva-ublre.qr"
"unegjva@ap.ublre.klm"
"unegjva@ublre.cubgbf"
"jroznfgre@unegjva.ublre.cubgbf"
];
};
"uublre@urejneq-ublre.qr" = {
hashedPasswordFile = "/home/hhoyer/secrets/hhoyer-mail";
aliases = [
"urejneq@urejneq-ublre.qr"
"urejneq@if189018.ifreire.qr"
"thn808@urejneq-ublre.qr"
"znvy@urejneq-ublre.qr"
"urejneq.ublre@urejneq-ublre.qr"
"uublre@fhesfvgr.bet"
"uublre@ublre.klm"
"urejneq@ublre.klm"
"urejneq@ap.ublre.klm"
];
};
"unenyq@ublre.klm" = {
hashedPasswordFile = "/ubzr/unenyq/frpergf/unenyq@ublre.klm";
aliases = [
"unenyq@zk.fhesfvgr.bet"
"ebbg@zk.fhesfvgr.bet"
"nohfr@zk.fhesfvgr.bet"
"nohfr@fhesfvgr.bet"
"nohfr@unegjva-ublre.qr"
"nohfr@urejneq-ublre.qr"
"nohfr@zrvxr-xahgm.qr"
"nohfr@treyvaqr-ublre.qr"
"nohfr@ublre.klm"
"nohfr@unenyq.ublre.klm"
"nohfr@ineyvax.bet"
"nohfr@zlcevinpl.gbbyf"
"nohfr@ublre.fbpvny"
"nohfr@ublre.jbeyq"
"nohfr@ublre.cubgbf"
"cbfgznfgre@zk.fhesfvgr.bet"
"cbfgznfgre@fhesfvgr.bet"
"cbfgznfgre@unegjva-ublre.qr"
"cbfgznfgre@urejneq-ublre.qr"
"cbfgznfgre@zrvxr-xahgm.qr"
"cbfgznfgre@treyvaqr-ublre.qr"
"cbfgznfgre@ublre.klm"
"cbfgznfgre@unenyq.ublre.klm"
"cbfgznfgre@ineyvax.bet"
"cbfgznfgre@zlcevinpl.gbbyf"
"cbfgznfgre@ublre.fbpvny"
"cbfgznfgre@ublre.jbeyq"
"cbfgznfgre@ublre.cubgbf"
"jroznfgre@ublre.klm"
"jroznfgre@fhesfvgr.bet"
"jroznfgre@unenyq.ublre.klm"
"jroznfgre@ineyvax.bet"
"jroznfgre@zlcevinpl.gbbyf"
"jroznfgre@ublre.fbpvny"
"jroznfgre@ublre.jbeyq"
"jroznfgre@ublre.cubgbf"
"jroznfgre@unenyq.ublre.cubgbf"
"nqzva@ublre.klm"
"nqzva@unenyq.ublre.klm"
"nqzva@ap.ublre.klm"
"nqzva@zk.fhesfvgr.bet"
"nqzva@ublre.fbpvny"
"nqzva@ublre.jbeyq"
"nqzva@ublre.cubgbf"
"unenyq@fhesfvgr.bet"
"unenyq@ublre.klm"
"unenyq@ap.ublre.klm"
"unenyq@ineyvax.bet"
"unenyq@zlcevinpl.gbbyf"
"unenyq@ublre.jbeyq"
"unenyq@ublre.fbpvny"
"unenyq@ublre.cubgbf"
"@unenyq.ublre.klm"
"@unenyq-ublre.qr"
"cnlcny-unenyq@ublre.klm"
"cubgb-unenyq@ublre.klm"
"so@fhesfvgr.bet"
"servshax@fhesfvgr.bet"
"sop@fhesfvgr.bet"
"zvar@fhesfvgr.bet"
"ovgpbva@fhesfvgr.bet"
"ovgpbva@ublre.klm"
"ebhyrggr@fhesfvgr.bet"
"tvguho@fhesfvgr.bet"
"zhn@fhesfvgr.bet"
"nyvrkcerff@fhesfvgr.bet"
# Max
"znk@ublre.klm"
"znk.ublre@ublre.klm"
"znkvzvyvna@ublre.klm"
"znkvzvyvna.ublre@ublre.klm"
# Felix
"sryvk@ublre.klm"
"sryvk.ublre@ublre.klm"
];
};
};
certificateScheme = "acme";
};
services.roundcube = {
enable = true;
# this is the url of the vhost, not necessarily the same as the fqdn of
# the mailserver
hostName = "webmail.hoyer.xyz";
extraConfig = ''
# starttls needed for authentication, so the fqdn required to match
# the certificate
$config['smtp_server'] = "tls://${config.mailserver.fqdn}";
$config['smtp_user'] = "%u";
$config['smtp_pass'] = "%p";
'';
};
}

45
systems/x86_64-linux/mx/network.nix Normal file
View file

@ -0,0 +1,45 @@
{ pkgs, lib, ... }:
{
services.fail2ban.enable = true;
services.resolved.domains = [
"surfsite.org"
"hoyer.xyz"
];
services.resolved.extraConfig = "ReadEtcHosts=no";
services.nscd.enableNsncd = false;
networking.firewall.allowedTCPPorts = [ 80 443 ];
networking.firewall.allowPing = true;
networking.hostName = "mx"; # Define your hostname.
networking.domain = "surfsite.org";
networking.dhcpcd.enable = false;
networking.firewall.logRefusedConnections = false;
networking.networkmanager.enable = false;
networking.useDHCP = false;
networking.useNetworkd = true;
networking.wireless.enable = false;
networking.defaultGateway.address = "95.216.66.129";
networking.defaultGateway.interface = "enp0s31f6";
#networking.nameservers = [ "1.1.1.1" "8.8.8.8" ];
networking.enableIPv6 = true;
networking.interfaces.enp0s31f6 = {
ipv6 = {
addresses = [{
address = "2a01:4f9:2b:2e3::2"; # Your IPv6 here
prefixLength = 64;
}];
# Default IPv6 route
routes = [{
address = "::";
prefixLength = 0;
via = "fe80::1";
}];
};
ipv4.addresses = [{
address = "95.216.66.178";
prefixLength = 26;
}];
};
}

29
systems/x86_64-linux/mx/nextcloud.nix Normal file
View file

@ -0,0 +1,29 @@
{ pkgs, lib, ... }:
{
systemd.services."nextcloud-setup".requires = [ "postgresql.service" ];
systemd.services."nextcloud-setup".after = [ "postgresql.service" ];
environment.etc."nextcloud-admin-pass".text = "test123";
services.nextcloud = {
enable = true;
package = pkgs.nextcloud28;
hostName = "nc.hoyer.xyz";
https = true;
configureRedis = true;
extraOptions = {
mail_smtpmode = "sendmail";
mail_sendmailmode = "pipe";
};
phpOptions = {
upload_max_filesize = lib.mkForce "1G";
post_max_size = lib.mkForce "1G";
"opcache.interned_strings_buffer" = "16";
};
config.adminpassFile = "/etc/nextcloud-admin-pass";
config.defaultPhoneRegion = "DE";
config.dbtype = "pgsql";
config.dbname = "nextcloud";
config.dbhost = "/run/postgresql";
config.dbuser = "nextcloud";
};
}

166
systems/x86_64-linux/mx/nginx.nix Normal file
View file

@ -0,0 +1,166 @@
{ pkgs, lib, ... }:
{
users.users.nginx.extraGroups = [ "acme" ];
services.nginx = {
enable = true;
appendHttpConfig = ''
log_format vcombined '$host:$server_port '
'$remote_addr - $remote_user [$time_local] '
'"$request" $status $body_bytes_sent '
'"$http_referer" "$http_user_agent"';
access_log /var/log/nginx/access.log vcombined;
'';
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
virtualHosts = {
"00000" = {
useACMEHost = "hoyer.xyz";
serverName = "_";
globalRedirect = "hoyer.xyz";
addSSL = true;
};
"hoyer.photos" = {
enableACME = false;
useACMEHost = "hoyer.photos";
forceSSL = true;
root = "/var/www/hoyer.xyz/html";
};
"hoyer.world" = {
enableACME = false;
useACMEHost = "hoyer.world";
forceSSL = true;
root = "/var/www/hoyer.xyz/html";
};
"hoyer.social" = {
enableACME = false;
useACMEHost = "hoyer.social";
forceSSL = true;
root = "/var/www/hoyer.xyz/html";
};
"hoyer.xyz" = {
# serverName = "hoyer.xyz";
serverAliases = [
"www.hoyer.xyz"
];
useACMEHost = "hoyer.xyz";
enableACME = false;
forceSSL = true;
root = "/var/www/hoyer.xyz/html";
locations."/stats" = {
basicAuthFile = "/var/www/hoyer.xyz/stats.htaccess";
};
};
"surfsite.org" = {
useACMEHost = "surfsite.org";
enableACME = false;
forceSSL = true;
root = "/var/www/surfsite.org";
};
"kicker.surfsite.org" = {
useACMEHost = "surfsite.org";
enableACME = false;
forceSSL = true;
locations."/" = {
proxyPass = "http://localhost:8087/";
};
};
"git.hoyer.xyz" = {
useACMEHost = "hoyer.xyz";
enableACME = false;
forceSSL = true;
locations."/" = {
proxyPass = "http://localhost:3001/";
};
};
"webmail.hoyer.xyz" = {
useACMEHost = "hoyer.xyz";
enableACME = false;
forceSSL = true;
};
"harald.hoyer.photos" = {
enableACME = true;
forceSSL = true;
root = "/var/www/photo.harald-hoyer.de/html";
};
"photo.harald-hoyer.de" = {
useACMEHost = "harald-hoyer.de";
forceSSL = true;
root = "/var/www/photo.harald-hoyer.de/html";
};
"photo-harald.hoyer.xyz" = {
serverAliases = [ "photo.harald.hoyer.xyz" ];
useACMEHost = "hoyer.xyz";
forceSSL = true;
root = "/var/www/photo.harald-hoyer.de/html";
};
"harald-hoyer.de" = {
serverAliases = [
"www.harald-hoyer.de"
];
useACMEHost = "harald-hoyer.de";
globalRedirect = "harald.hoyer.xyz";
forceSSL = true;
};
"harald.hoyer.xyz" = {
serverAliases = [
"www.harald.hoyer.xyz"
];
useACMEHost = "hoyer.xyz";
root = "/var/www/harald.hoyer.xyz/html/";
extraConfig = ''
rewrite ^/feed/rss$ /rss.xml permanent;
rewrite ^/feed/rss/$ /rss.xml permanent;
rewrite ^/feed/$ /rss.xml permanent;
rewrite ^/feed/rss/index.html$ /rss.xml permanent;
rewrite ^/fedora/fedora/RSS2$ /tags/fedora/rss.xml permanent;
rewrite ^/linux/linux/RSS2$ /tags/linux/rss.xml permanent;
rewrite ^/linux/feed$ /tags/linux/rss.xml permanent;
rewrite ^/wp-rss2.php$ /rss.xml permanent;
rewrite ^/aggregator/rss.xml$ /rss.xml permanent;
rewrite ^/personal/blog/aggregator/RSS$ /rss.xml permanent;
rewrite ^/personal/blog/aggregator/RSS2$ /rss.xml permanent;
rewrite ^/aggregator/RSS$ /rss.xml permanent;
rewrite ^/aggregator/RSS2$ /rss.xml permanent;
rewrite ^/wp-commentsrss2.php$ /rss.xml permanent;
'';
forceSSL = true;
};
"hartwin-hoyer.de" = {
serverAliases = [
"www.hartwin-hoyer.de"
];
useACMEHost = "hartwin-hoyer.de";
globalRedirect = "hartwin.hoyer.xyz";
forceSSL = true;
};
"hartwin.hoyer.xyz" = {
serverAliases = [
"testhartwin.hoyer.xyz"
"www.hartwin.hoyer.xyz"
];
useACMEHost = "hoyer.xyz";
root = "/var/www/hartwin.hoyer.xyz/html/";
forceSSL = true;
};
"nc.hoyer.xyz" = {
useACMEHost = "hoyer.xyz";
forceSSL = true;
};
};
};
}

40
systems/x86_64-linux/mx/rspamd.nix Normal file
View file

@ -0,0 +1,40 @@
{ pkgs, lib, ... }:
{
services.rspamd.workers.controller.bindSockets = [{
socket = "/run/rspamd/worker-controller.sock";
mode = "0660";
}];
services.rspamd.locals = {
"maps.d/spf_whitelist.inc.local" = {
text = ''
epicgames.com
dmail.ai
'';
};
"maps.d/spf_dkim_whitelist.inc.local" = {
text = ''
epicgames.com
dmail.ai
'';
};
"maps.d/dmarc_whitelist.inc.local" = {
text = ''
epicgames.com
dmail.ai
'';
};
"greylist-whitelist-domains.inc" = {
text = ''
dmail.ai
epicgames.com
'';
};
};
services.rspamd.extraConfig = ''
actions {
reject = null;
greylist = 4; # Apply greylisting when reaching this score
add_header = 4; # Add header when reaching this score
}
'';
}

77
systems/x86_64-linux/mx/server-raid.nix Normal file
View file

@ -0,0 +1,77 @@
{ disks ? [ "/dev/sda" "/dev/sdb" ], ... }: {
disk = {
one = {
type = "disk";
device = builtins.elemAt disks 0;
content = {
type = "gpt";
partitions = {
boot = {
size = "1M";
type = "EF02";
};
ESP = {
size = "256M";
type = "EF00";
content = {
type = "filesystem";
format = "vfat";
mountpoint = "/boot";
};
};
mdadm = {
size = "100%";
content = {
type = "mdraid";
name = "raid1";
};
};
};
};
};
two = {
type = "disk";
device = builtins.elemAt disks 1;
content = {
type = "gpt";
partitions = {
boot = {
size = "1M";
type = "EF02";
};
ESP = {
size = "256M";
type = "EF00";
};
mdadm = {
size = "100%";
content = {
type = "mdraid";
name = "raid1";
};
};
};
};
};
};
mdadm = {
raid1 = {
type = "mdadm";
level = 1;
content = {
type = "luks";
name = "crypted";
extraOpenArgs = [ "--allow-discards" ];
settings = {
allowDiscards = true;
};
initrdUnlock = false;
content = {
type = "filesystem";
format = "btrfs";
mountpoint = "/";
};
};
};
};
}

23
systems/x86_64-linux/mx/users.nix Normal file
View file

@ -0,0 +1,23 @@
{ pkgs, lib, ... }:
{
# Herward
users.users.hhoyer = {
shell = pkgs.bash;
isNormalUser = true;
description = "hhoyer";
openssh.authorizedKeys.keys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCIlCnBiRkm8i/UQaTDv2UCO+mEzPC5OQ0e+DlzS1GVmJEjH5BqPosEivvDQheQP7WWNZOCWoHqAg8vvH8QpSA6AOqruvsWrbY1TmoMc4TlulgyEK5/z9aw/t3WUkQjj+fYeQbQXSNeT7pplN3hB49MCXAQNJ+LxnnntrZhp7tHRAsJFlGgK6NGFapCizeYt9DOqeh2KGTd+x9TXTa96ccWQTRovE5xWP/8X7LoejCl7sfe2dymeByU465Do+mvDs2DbyKI1XHlLpPZihsyxyU1/K0B9VF92U486vh8Ep3fnTgpu7D9n0KdN0wGMfSmH75rtrYZPiGvu6Qy0YzV6MUN newkex"
];
};
# Hartwin
users.users.hartwin = {
shell = pkgs.bash;
isNormalUser = true;
description = "hartwin";
openssh.authorizedKeys.keys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDjeTezn11UITzlqfOS9U3/sOdEJ4au5MSo/vNUcMHVIfKWLXfOWH6skB2kVrRcSlevNydgWtmQfA/xD7n7Syx4esWLvaUUwRO75QNz8TJq9dgItxi6R+bxWlUqN79aAmNWQH6yftBs+bLDtTg7XABZYe2z53UcfLtG0iQOHG6mftcOL2YKyzdtd/1F7jgMmy2HJ1LzsFNb57hBQvA3cg+hDwXKfptrDh/8Xysm110vMj74T2ANbhmE3wT25PmUMN7B/sx0m7Rm7jg3COyLq6/MZzoFGyl+Kd9vxTPzp76aSq7bI70qGUzcq2aX6UnlkcrrAz2bzZBi5RMOHYO3QPmP hlh@aiur.localdomain"
];
};
}

50
systems/x86_64-linux/sgx-nixos/default.nix Normal file
View file

@ -0,0 +1,50 @@
{ pkgs, lib, config, ... }:
with lib;
with lib.metacfg;
{
imports = [ ./hardware-configuration.nix ];
boot.kernel.sysctl."net.ipv4.conf.all.route_localnet" = 1;
networking.firewall.extraCommands = ''
iptables -t nat -A OUTPUT -o lo -p tcp --dport 8081 -j DNAT --to-destination 192.168.122.1:8081
iptables -t nat -A POSTROUTING -j MASQUERADE
'';
metacfg = {
base.enable = true;
nix-ld.enable = true;
nix.enable = true;
aesmd_dcap.enable = true;
user.extraGroups = [ "docker" "sgx" ];
};
environment.etc."sgx_default_qcnl.conf".text = ''
{
"pccs_url": "https://192.168.122.1:8081/sgx/certification/v4/"
"use_secure_cert": false,
"collateral_service": "https://api.trustedservices.intel.com/sgx/certification/v4/",
"retry_times": 6,
"retry_delay": 10,
"pck_cache_expire_hours": 168,
"verify_collateral_cache_expire_hours": 168,
"local_cache_only": false
}
'';
virtualisation.docker.enable = true;
system.autoUpgrade = {
enable = true;
operation = "switch";
allowReboot = true;
};
security.tpm2.enable = false;
security.tpm2.abrmd.enable = false;
networking.wireless.enable = false; # Enables wireless support via wpa_supplicant.
powerManagement.cpuFreqGovernor = "ondemand";
system.stateVersion = "23.11";
}

39
systems/x86_64-linux/sgx-nixos/hardware-configuration.nix Normal file
View file

@ -0,0 +1,39 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[
(modulesPath + "/profiles/qemu-guest.nix")
];
boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sr_mod" "virtio_blk" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{
device = "/dev/disk/by-uuid/ebb90474-ddcb-484b-9663-d71863827af4";
fsType = "ext4";
};
fileSystems."/boot" =
{
device = "/dev/disk/by-uuid/941C-7B02";
fsType = "vfat";
};
swapDevices = [ ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
}

76
systems/x86_64-linux/sgx/backup.nix Normal file
View file

@ -0,0 +1,76 @@
{ pkgs, lib, config, ... }:
let
backup_new_path = "/mnt/raid/backup/hoyer/new/";
restic_repo = "/mnt/backup/restic-repo";
in
{
services.restic.backups.hoyer_new = {
repository = restic_repo;
passwordFile = config.sops.secrets.backup-pw.path;
timerConfig = {
OnCalendar = "daily";
FixedRandomDelay = true;
RandomizedDelaySec = "4h";
Persistent = true;
};
paths = [ backup_new_path ];
pruneOpts = [
"-g host,paths"
"--keep-daily 7"
"--keep-weekly 4"
"--keep-monthly 3"
"--keep-yearly 1"
];
backupPrepareCommand = ''
HOME=/root ${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh" --exclude-from /root/excludelist --no-specials --no-devices --numeric-ids --delete-after --partial -axz backup@mx.surfsite.org:/{etc,var,home,root} ${backup_new_path}
'';
};
services.restic.backups.self = {
repository = restic_repo;
#repository = "s3:nas2a6e8f.myqnapcloud.com:8081/backup";
passwordFile = config.sops.secrets.backup-pw.path;
timerConfig = {
OnCalendar = "daily";
FixedRandomDelay = true;
RandomizedDelaySec = "4h";
Persistent = true;
};
paths = [
"/etc"
"/var"
"/home"
"/root"
"/persist"
config.services.samba.shares.Qmultimedia.path
];
extraBackupArgs =
let
ignorePatterns = [
"/mnt/raid/backup"
"/mnt/backup"
"/mnt/snap"
"/var/cache"
"/home/*/.local/share/Trash"
"/home/*/.cache"
"/home/*/Downloads"
"/home/*/.npm"
"/home/*/.local/share/containers"
".cache"
".tmp"
".log"
".Trash"
];
ignoreFile = builtins.toFile "ignore"
(lib.foldl (a: b: a + "\n" + b) "" ignorePatterns);
in
[ "--exclude-file=${ignoreFile}" ];
pruneOpts = [
"-g host,paths"
"--keep-daily 7"
"--keep-weekly 4"
"--keep-monthly 3"
"--keep-yearly 1"
];
};
}

55
systems/x86_64-linux/sgx/default.nix Normal file
View file

@ -0,0 +1,55 @@
{ pkgs, lib, config, ... }:
{
imports = [
./hardware-configuration.nix
./fileserver.nix
./backup.nix
./network.nix
];
sops.secrets.pccs.sopsFile = ../../../.secrets/sgx/pccs.yaml;
sops.secrets.backup-pw.sopsFile = ../../../.secrets/sgx/backup-s3.yaml;
metacfg = {
base.enable = true;
gui.enable = false;
nix-ld.enable = true;
nix.enable = true;
aesmd_dcap.enable = true;
pccs.enable = true;
pccs.secret = config.sops.secrets.pccs.path;
podman.enable = true;
secureboot.enable = true;
user.extraGroups = [ "docker" "sgx" ];
};
virtualisation = {
docker.enable = true;
libvirtd.enable = true;
podman.dockerCompat = false;
};
systemd.services.libvirt-guests.after = [ "network-online.target" ];
system.autoUpgrade = {
enable = true;
operation = "switch";
allowReboot = true;
};
services.pcscd.enable = true;
environment.etc."sgx_default_qcnl.conf".text = ''
{
"pccs_url": "https://127.0.0.1:8081/sgx/certification/v4/",
"use_secure_cert": false,
"collateral_service": "https://api.trustedservices.intel.com/sgx/certification/v4/",
"retry_times": 6,
"retry_delay": 10,
"pck_cache_expire_hours": 168,
"verify_collateral_cache_expire_hours": 168,
"local_cache_only": false
}
'';
system.stateVersion = "23.11";
}

75
systems/x86_64-linux/sgx/fileserver.nix Normal file
View file

@ -0,0 +1,75 @@
{ pkgs, lib, config, ... }:
{
services.netatalk = {
enable = true;
settings = {
Homes = {
"basedir regex" = "/home";
path = "Public";
};
time-machine = {
path = "/mnt/backup/tm_share";
"valid users" = "harald";
"time machine" = true;
};
Qmultimedia = {
path = "/mnt/raid/Qmultimedia";
};
};
};
services.avahi = {
enable = true;
nssmdns = true;
publish = {
enable = true;
userServices = true;
};
};
services.samba = {
enable = true;
openFirewall = true;
securityType = "user";
extraConfig = ''
read raw = Yes
write raw = Yes
socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=131072 SO_SNDBUF=131072
min receivefile size = 16384
use sendfile = true
aio read size = 16384
aio write size = 16384
workgroup = WORKGROUP
server string = sgx
netbios name = sgx
security = user
#max protocol = smb2
hosts allow = 192.168.178. 127.0.0.1 localhost 2003::/16 ::1
hosts deny = ALL
guest account = nobody
map to guest = bad user
'';
shares = {
# public = {
# path = "/mnt/Shares/Public";
# browseable = "yes";
# "read only" = "no";
# "guest ok" = "yes";
# "create mask" = "0644";
# "directory mask" = "0755";
# "force user" = "username";
# "force group" = "groupname";
# };
Qmultimedia = {
path = "/mnt/raid/Qmultimedia";
browseable = "yes";
"read only" = "no";
"guest ok" = "no";
"create mask" = "0644";
"directory mask" = "0755";
"force user" = "harald";
"force group" = "users";
};
};
};
}

64
systems/x86_64-linux/sgx/hardware-configuration.nix Normal file
View file

@ -0,0 +1,64 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, modulesPath, ... }:
{
imports =
[
(modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "uas" "sd_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
boot.blacklistedKernelModules = [ "iwlwifi" "snd_hda_intel" "hdaudio" "btintel" "bluetooth" ];
boot.extraModprobeConfig = "options kvm_intel nested=1";
services.btrfs.autoScrub.enable = true;
fileSystems = {
"/" = {
device = "/dev/disk/by-uuid/7aa17b01-785e-41c6-9723-79195af906c6";
fsType = "btrfs";
options = [ "subvol=@" ];
neededForBoot = true;
};
"/boot" = {
device = "/dev/disk/by-uuid/C902-1AF5";
fsType = "vfat";
};
"/mnt/raid" = {
fsType = "btrfs";
device = "/dev/disk/by-uuid/11727be7-bf9b-4888-8b02-d7eb1f898712";
options = [ "defaults" "compress=zstd" "subvol=root" "autodefrag" "noatime" "nofail" "x-systemd.device-timeout=60" ];
};
"/mnt/backup" = {
fsType = "btrfs";
device = "/dev/disk/by-uuid/c29e7eac-26ba-41b1-ac3e-11123476b7c5";
options = [ "defaults" "compress=zstd" "subvol=root" "autodefrag" "noatime" "nofail" "x-systemd.device-timeout=60" ];
};
};
swapDevices =
[{ device = "/dev/disk/by-uuid/72d061d7-ab18-47b9-beb1-1c465dda1be9"; }];
environment.etc."crypttab".text = ''
a16 /dev/disk/by-uuid/6f1c1b24-3c94-44be-8d1b-70db562079c1 /dev/disk/by-id/usb-Ut165_USB2FlashStorage_08050508d213e6-0:0-part1 luks,keyfile-size=256
b16 /dev/disk/by-uuid/9540de6d-c907-43e4-b740-2d75dbf37135 /dev/disk/by-id/usb-Ut165_USB2FlashStorage_08050508d213e6-0:0-part1 luks,keyfile-size=256
a4 /dev/disk/by-uuid/72924bd6-3d58-4437-aafd-ae6d2b995fbf /dev/disk/by-id/usb-Ut165_USB2FlashStorage_08050508d213e6-0:0-part1 luks,keyfile-size=256
b4 /dev/disk/by-uuid/459c8d9a-6e92-4dec-a998-701ab9e76a2e /dev/disk/by-id/usb-Ut165_USB2FlashStorage_08050508d213e6-0:0-part1 luks,keyfile-size=256
c4 /dev/disk/by-uuid/5c61cbf0-dbca-48e0-948e-71bea3806a6c /dev/disk/by-id/usb-Ut165_USB2FlashStorage_08050508d213e6-0:0-part1 luks,keyfile-size=256
'';
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
security.tpm2.enable = false;
security.tpm2.abrmd.enable = false;
powerManagement.cpuFreqGovernor = "ondemand";
}

42
systems/x86_64-linux/sgx/network.nix Normal file
View file

@ -0,0 +1,42 @@
{ pkgs, lib, config, ... }:
{
networking.hostName = "sgx"; # Define your hostname.
networking.useDHCP = false;
#networking.domain = "fritz.box";
networking.wireless.enable = false; # Enables wireless support via wpa_supplicant.
networking.networkmanager.enable = false; # use networkd
networking.dhcpcd.enable = false; # use networkd
# services.nscd.enableNsncd = false;
# systemd-networkd
systemd.network.enable = true;
#systemd.network.wait-online.anyInterface = true;
#systemd.services."systemd-networkd".environment.SYSTEMD_LOG_LEVEL = "debug";
systemd.network.networks."10-br0" = {
matchConfig.Name = "br0";
DHCP = "yes";
linkConfig.RequiredForOnline = "routable";
linkConfig.RequiredFamilyForOnline = "both";
};
systemd.network.netdevs."br0" = {
netdevConfig = {
Name = "br0";
Kind = "bridge";
MACAddress = "00:a1:2f:68:07:ea";
};
};
systemd.network.networks."11-en" = {
linkConfig.RequiredForOnline = "enslaved";
matchConfig.Name = "enp3s0";
networkConfig = {
Bridge = "br0";
};
};
networking.firewall.allowedTCPPorts = [ 548 ];
networking.firewall.allowPing = true;
}

38
systems/x86_64-linux/t15/default.nix Normal file
View file

@ -0,0 +1,38 @@
{ ... }:
{
imports = [ ./hardware-configuration.nix ];
metacfg = {
base.enable = true;
gui.enable = true;
nix-ld.enable = true;
nix.enable = true;
podman.enable = true;
secureboot.enable = true;
};
system.autoUpgrade = {
enable = true;
operation = "boot";
allowReboot = false;
};
system.stateVersion = "23.11";
sops.age.sshKeyPaths = [ "/persist/ssh/ssh_host_ed25519_key" ];
sops.secrets.backup-s3.sopsFile = ../../../.secrets/t15/backup-s3.yaml;
sops.secrets.backup-pw.sopsFile = ../../../.secrets/t15/backup-s3.yaml;
services.openssh.hostKeys = [
{
path = "/persist/ssh/ssh_host_ed25519_key";
type = "ed25519";
}
{
path = "/persist/ssh/ssh_host_rsa_key";
type = "rsa";
bits = 4096;
}
];
}

97
systems/x86_64-linux/t15/hardware-configuration.nix Normal file
View file

@ -0,0 +1,97 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports = [
(modulesPath + "/installer/scan/not-detected.nix")
];
boot.kernelModules = [ "kvm-intel" ];
boot.initrd.availableKernelModules = [
"ahci"
"nvme"
"rng_core"
"sd_mod"
"sdhci_pci"
"thunderbolt"
"tpm"
"tpm_crb"
"tpm_tis"
"tpm_tis_core"
"trusted"
"uas"
"usb_storage"
"usbhid"
"xhci_pci"
"uas"
];
boot.initrd.kernelModules = [ ];
boot.kernelParams = [
"lockdown=confidentiality"
"intel_iommu=on"
"quiet"
"splash"
"video=efifb:nobgrt"
];
boot.extraModulePackages = [ ];
services.btrfs.autoScrub.enable = true;
swapDevices = [{ device = "/swapfile"; }];
boot.initrd.luks.devices.crypted = {
device = "/dev/nvme0n1p2";
preLVM = true;
};
fileSystems = {
"/" =
{
device = "/dev/mapper/crypted";
fsType = "btrfs";
options = [ "subvol=/rootfs" ];
neededForBoot = true;
};
"/nix" = {
device = "/dev/mapper/crypted";
fsType = "btrfs";
options = [ "subvol=/nix" ];
neededForBoot = true;
};
"/home" = {
device = "/dev/mapper/crypted";
fsType = "btrfs";
options = [ "subvol=/home" ];
};
"/persist" = {
device = "/dev/mapper/crypted";
fsType = "btrfs";
options = [ "subvol=/persist" ];
neededForBoot = true;
};
"/boot" =
{
device = "/dev/disk/by-partlabel/disk-one-ESP";
fsType = "vfat";
};
};
console.keyMap = "de-latin1-nodeadkeys";
services.xserver = {
layout = "de";
xkbVariant = "nodeadkeys";
};
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.enp82s0u1u3u4.useDHCP = lib.mkDefault true;
# networking.interfaces.wlp0s20f3.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}

23
systems/x86_64-linux/x1/default.nix Normal file
View file

@ -0,0 +1,23 @@
{ pkgs, lib, ... }:
with lib;
with lib.metacfg;
{
imports = [ ./hardware-configuration.nix ];
metacfg = {
base.enable = true;
gui.enable = true;
nix-ld.enable = true;
nix.enable = true;
podman.enable = true;
secureboot.enable = true;
};
system.autoUpgrade = {
enable = true;
operation = "boot";
allowReboot = false;
};
system.stateVersion = "23.11";
}

54
systems/x86_64-linux/x1/hardware-configuration.nix Normal file
View file

@ -0,0 +1,54 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports = [
(modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "uas" "usbhid" "sd_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.kernelParams = [
"lockdown=confidentiality"
"intel_iommu=on"
"quiet"
"splash"
"video=efifb:nobgrt"
];
boot.extraModulePackages = [ ];
services.btrfs.autoScrub.enable = true;
fileSystems."/" =
{
device = "/dev/disk/by-uuid/1106202c-c3bf-4c15-b7cd-e78749e5c955";
fsType = "btrfs";
options = [ "subvol=@" ];
};
boot.initrd.luks.devices."luks-0e2792db-1b80-49a7-b2eb-54e4b5fc3502".device = "/dev/disk/by-uuid/0e2792db-1b80-49a7-b2eb-54e4b5fc3502";
boot.initrd.luks.devices."luks-280f2e07-e5fc-478e-b7ee-445c99bea415".device = "/dev/disk/by-uuid/280f2e07-e5fc-478e-b7ee-445c99bea415";
fileSystems."/boot" =
{
device = "/dev/disk/by-uuid/13C4-A825";
fsType = "vfat";
};
swapDevices = [{ device = "/dev/mapper/luks-280f2e07-e5fc-478e-b7ee-445c99bea415"; }];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.enp82s0u1u3u4.useDHCP = lib.mkDefault true;
# networking.interfaces.wlp0s20f3.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}