cry/flake
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

super massive rewrite

Browse source
This commit is contained in:
Emile Clark-Boman 2026-02-09 01:51:30 +10:00
parent a2192c9341
commit 1de15c45f2
19 changed files with 746 additions and 1000 deletions
Download patch file Download diff file Expand all files Collapse all files

121
hosts/hyrule/default.nix
View file

@ -1,45 +1,10 @@
{
pkgs,
upkgs,
...
}: let
home-manager = builtins.fetchTarball {
url = "https://github.com/nix-community/home-manager/archive/release-25.05.tar.gz";
sha256 = "07pk5m6mxi666dclaxdwf7xrinifv01vvgxn49bjr8rsbh31syaq";
};
in {
{pkgs, ...}: {
imports = [
./hardware-configuration.nix
(import "${home-manager}/nixos")
./services/forgejo.nix
./services/vaultwarden.nix
./services/nginx.nix
# ./mailserver.nix # TEMP: location
# ./minecraft-server.nix # TEMP: location
../modules/bashistrans.nix
./services
];
nix.settings = {
# make wheel group trusted users allows my "ae" user
# to import packages not signed by a trusted key
# (aka super duper easier to remote deploy)
trusted-users = ["root" "@wheel"];
experimental-features = [
"nix-command"
"flakes"
];
};
time.timeZone = "Australia/Brisbane";
i18n.defaultLocale = "en_US.UTF-8";
console = {
font = "Lat2-Terminus16";
keyMap = "us";
};
# super duper minimum grub2 config
boot.loader.grub = {
enable = true;
@ -48,29 +13,10 @@ in {
networking = {
hostName = "hyrule";
networkmanager.enable = true;
# Use CloudFlare's WARP+ 1.1.1.1 DNS service
nameservers = [
"1.1.1.1"
"1.0.0.1"
];
firewall = {
enable = true;
allowedTCPPorts = [
22 # sshd
80 # nginx
# 143 # IMAP4
443 # nginx
# 587 # SMTPS
2222 # forgejo ssh
2035 # debug (for my job)
# 3000 (INTERNAL) forgejo
# 3306 (INTERNAL) forgejo sqlite3 database
5000 # debug (for my job)
# 8222 (INTERNAL) vaultwarden
45000 # minecaft server
];
allowedUDPPorts = [
54231 # Wireguard
@ -102,11 +48,9 @@ in {
};
users = {
defaultUserShell = pkgs.bash;
users = {
# primary user
ae = {
cry = {
isNormalUser = true;
extraGroups = ["wheel"];
shell = pkgs.bash;
@ -115,16 +59,6 @@ in {
];
};
# TODO: reduce security implications of subspace
subspace = {
isNormalUser = true;
shell = pkgs.bash;
home = "/home/subspace";
packages = with pkgs; [
wishlist
];
};
friends = {
isNormalUser = true;
shell = pkgs.fish;
@ -135,54 +69,5 @@ in {
virtualisation.docker.enable = true;
home-manager = {
users = {
ae = import ../../homes/ae;
subspace = import ../../homes/subspace;
};
};
services = {
openssh = {
enable = true;
ports = [22];
settings = {
PasswordAuthentication = false;
PermitRootLogin = "no";
AllowUsers = ["ae" "subspace"]; # DO NOT ALLOW ALL
UseDns = true;
X11Forwarding = false;
};
};
};
security = {
# accept Lets Encrypt's security policy (for nginx)
acme = {
acceptTerms = true;
# TODO: change this to me@imbored.dev
defaults.email = "eclarkboman@gmail.com";
};
sudo = {
enable = true;
wheelNeedsPassword = true;
};
# allow SSH keys for passwordless auth
# TODO: DO NOT USE THIS (create my own alternative to colmena)
pam = {
enableSSHAgentAuth = true;
services.sudo.sshAgentAuth = true; # pam_ssh_agent_auth module
};
};
environment.systemPackages = with pkgs; [
eza
git
vim
helix
tcpdump
];
system.stateVersion = "24.11"; # DO NOT MODIFY
}

7
hosts/hyrule/services/default.nix Normal file
View file

@ -0,0 +1,7 @@
{...}: {
imports = [
./services/forgejo.nix
./services/vaultwarden.nix
./services/nginx.nix
];
}

150
hosts/hyrule/services/forgejo.nix
View file

@ -1,150 +0,0 @@
{...}: {
# more options here: https://mynixos.com/nixpkgs/options/services.forgejo
# TODO: set a favicon https://forgejo.org/docs/next/contributor/customization/#changing-the-logo
# (might need me to override settings in the nixpkg)
# TODO: create a custom theme for forgejo (modify the source files most likely)
services.forgejo = {
enable = true;
# enable support for Git Large File Storage
lfs.enable = true;
database = {
type = "sqlite3"; # postgres
host = "127.0.0.1";
port = "3306"; # 5432 if postgres
};
# settings are written directly to the `app.ini` config file
# refer to: https://forgejo.org/docs/latest/admin/config-cheat-sheet/
settings = {
server = {
# ENABLE_ACME = true;
# ACME_EMAIL = "eclarkboman@gmail.com"; # change this to "me@imbored.dev"
DOMAIN = "dobutterfliescry.net"; # should this be "imbored.dev"?
ROOT_URL = "https://forge.dobutterfliescry.net"; # full public URL of the Forgejo server
# address and port to listen on
HTTP_ADDR = "127.0.0.1";
HTTP_PORT = 3000;
PROTOCOL = "http"; # http internally, reverse proxy uses https externally
START_SSH_SERVER = true;
DISABLE_SSH = false;
SSH_PORT = 2222;
};
DEFAULT = {
APP_NAME = "tearforge";
APP_SLOGIN = "but cozy";
APP_DISPLAY_NAME_FORMAT = "{APP_NAME} ::{APP_SLOGAN}::";
};
repository = {
DEFAULT_PRIVATE = "private"; # last, private, public
# repo/org created on push to non-existent
ENABLE_PUSH_CREATE_USER = true;
ENABLE_PUSH_CREATE_ORG = false;
DEFAULT_PUSH_CREATE_PRIVATE = true;
MAX_CREATION_LIMIT = -1;
};
"repository.upload" = {
# max per-file size in MB
FILE_MAX_SIZE = 50;
# max number of files per upload
MAX_FILES = 5;
};
badges = let
# flat, flat-square, plastic, for-the-badge, social
style = "for-the-badge";
in {
ENABLED = true;
GENERATOR_URL_TEMPLATE = "https://img.shields.io/badge/{{.label}}-{{.text}}-{{.color}}?style=${style}";
};
ui = {
DEFAULT_THEME = "forgejo-dark";
THEMES = "forgejo-auto,forgejo-light,forgejo-dark";
};
"ui.meta" = {
AUTHOR = "Emile Clark-Boman - emileclarkb";
DESCRIPTION = "This is my personal self-hosted git forge, where I keep and maintain personal projects! PS do butterflies cry when they're sad?";
KEYWORDS = "emile,clark,boman,clarkboman,emileclarkb,git,forge,forgejo,self-hosted,dobutterfliescry,butterfly,butterflies";
};
markdown = {
ENABLE_HARD_LINE_BREAK_IN_COMMENTS = true;
ENABLE_MATH = true;
};
admin = {
DEFAULT_EMAIL_NOTIFICATIONS = "enabled";
SEND_NOTIFICATION_EMAIL_ON_NEW_USER = true;
};
security = {
# Controls access to the installation page.
# When set to “true”, the installation page is not accessible.
#INSTALL_LOCK = false;
PASSWORD_HASH_ALGO = "argon2"; # ARGON2 BEST ALGO FR!! (default: argon2$2$65536$8$50)
MIN_PASSWORD_LENGTH = 12;
PASSWORD_COMPLEXITY = "lower,upper,digit,spec";
PASSWORD_CHECK_PWN = true;
};
service = {
DISABLE_REGISTRATION = true; # toggle for new users
#DEFAULT_USER_IS_RESTRICTED = true;
# Forbid login with third-party services (ie github)
ALLOW_ONLY_INTERNAL_REGISTRATION = true;
ENABLE_CAPTCHA = true;
REQUIRE_CAPTCHA_FOR_LOGIN = true;
REQUIRE_EXTERNAL_REGISTRATION_CAPTCHA = true;
LOGIN_REMEMBER_DAYS = 365;
ENABLE_NOTIFY_MAIL = true;
};
"service.explore" = {
REQUIRE_SIGNIN_VIEW = false;
DISABLE_USERS_PAGE = false;
DISABLE_ORGANIZATIONS_PAGE = false;
DISABLE_CODE_PAGE = false;
};
cache = {
ADAPTER = "twoqueue";
HOST = "{\"size\":100, \"recent_ratio\":0.25, \"ghost_ratio\":0.5}";
ITEM_TTL = "16h";
};
# TODO: fill this in once my mail server is configured
# email.incoming = { ... };
# optional
# TODO: fill this in once my mail server is configured
mailer = {
ENABLED = false;
SMTP_ADDR = "mail.dobutterfliescry.net";
FROM = "iforgor@dobutterfliescry.net";
USER = "iforgor@dobutterfliescry.net";
};
log = {
MODE = "file";
LEVEL = "Info"; # "Trace", "Debug", "Info", "Warn", "Error", "Critical"
ENABLE_SSH_LOG = true;
};
cron = {
ENABLED = true;
RUN_AT_START = false;
};
other = {
SHOW_FOOTER_VERSION = true;
SHOW_FOOTER_TEMPLATE_LOAD_TIME = true;
SHOW_FOOTER_POWERED_BY = true;
ENABLE_SITEMAP = true;
ENABLE_FEED = true;
};
};
};
}

38
hosts/hyrule/services/mailserver.nix
View file

@ -1,38 +0,0 @@
{
config,
pkgs,
...
}: {
imports = [
(builtins.fetchTarball {
url = "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/nixos-25.05/nixos-mailserver-nixos-25.05.tar.gz";
sha256 = "0jpp086m839dz6xh6kw5r8iq0cm4nd691zixzy6z11c4z2vf8v85";
})
];
# simple-nixos-mailserver
# DOCS: https://nixos-mailserver.readthedocs.io/en/latest
mailserver = {
enable = true;
# stateVersion = 3;
# Manually open the firewall instead
openFirewall = false;
virusScanning = false; # expensive memory usage
fqdn = "mail.imbored.dev";
domains = ["imbored.dev"];
# NOTE: generate hashes with `mkpasswd -sm bcrypt`
loginAccounts = {
"me@imbored.dev" = {
aliases = ["emile@imbored.dev"];
hashedPasswordFile = let
CWD = builtins.getEnv "PWD";
# XXX: TODO: use a secrets manager!
in "${CWD}/secrets/passwd/me";
};
};
certificateScheme = "acme-nginx";
};
}

65
hosts/hyrule/services/minecraft-server.nix
View file

@ -1,65 +0,0 @@
{
pkgs,
upkgs,
...
}: {
services.minecraft-server = {
enable = true;
package = upkgs.minecraft-server; # use latest version only!
declarative = true;
eula = true;
openFirewall = false; # do this manually instead
whitelist = {
"SECRET1" = "";
"SECRET2" = "";
};
# REF: https://minecraft.wiki/w/Server.properties#Java_Edition
serverProperties = {
server-ip = "195.114.14.69"; # listen on all addresses if unset
server-port = 45000; # connection port
"query.port" = 45000; # share game info/advertising information
user-native-transport = true; # Linux packet RX/TX optimizations
# Users Connections
enforce-secure-profile = true;
online-mode = true; # don't allow unlicensed minecraft accounts to join
prevent-proxy-connections = false;
rate-limit = 0;
# Server Functionality
enable-status = true; # where the server appears as "online"
hide-online-players = false;
log-ips = true;
pause-when-empty-seconds = 60; # pause server when no player online for x seconds
view-distance = 10; # range: 3-32
simulation-distance = 10; # range: 3-32
# Players
motd = "M&M's Cozycraft Realm <3";
max-players = 2;
white-list = true;
idle-player-timeout = 0; # never kick idle players
# Gameplay
gamemode = "survival";
force-gamemode = true;
difficulty = "normal";
hardcore = false;
pvp = true;
allow-cheats = true;
# World
level-name = "M&M's Cozycraft"; # world name
# level-seed = "" # random seed if unset
level-type = "minecraft:normal"; # world generation preset
generate-structures = true;
spawn-monsters = true;
spawn-protection = 0;
};
jvmOpts = "-Xms2046M -Xmx2046M -XX:+UseG1GC -XX:ParallelGCThreads=2 -XX:MinHeapFreeRatio=5 -XX:MaxHeapFreeRatio=10";
};
}

25
hosts/hyrule/services/vaultwarden.nix
View file

@ -1,25 +0,0 @@
{...}: {
services.vaultwarden = {
enable = true;
dbBackend = "sqlite";
# backupDir = "/var/backup/vaultwarden"; # disable with null
# https://mynixos.com/nixpkgs/option/services.vaultwarden.config
config = {
# internal address and port to listen on
ROCKET_ADDRESS = "127.0.0.1";
ROCKET_PORT = 8222;
# hostname to listen for
DOMAIN = "https://vault.imbored.dev";
# signup policy
SIGNUPS_ALLOWED = false;
SIGNUPS_VERIFY = true;
INVITATIONS_ALLOWED = true;
};
# https://mynixos.com/nixpkgs/option/services.vaultwarden.environmentFile
environmentFile = "/var/lib/vaultwarden/vaultwarden.env";
};
}