Merge remote-tracking branch 'forge/main'
This commit is contained in:
commit
89ff7a1bcb
14 changed files with 529 additions and 487 deletions
27
deploy
27
deploy
|
|
@ -9,6 +9,7 @@ Options:
|
|||
-f, --fresh Remove old content in the nixstore (good for debugging)
|
||||
-b, --bootloader Reinstall the bootloader
|
||||
-r, --remote Locally build and remotely deploy Colmena hive
|
||||
--show-trace Show nix stack trace on error
|
||||
-h, --help Show this message (^_^)"
|
||||
|
||||
# delete all cached entries
|
||||
|
|
@ -19,7 +20,8 @@ collect_garbage () {
|
|||
|
||||
rebuild_flake () {
|
||||
# make sure all changes are visible to nixos
|
||||
git add . --verbose
|
||||
# (--intent-to-add tracks files but DOES NOT stage them)
|
||||
git add . --intent-to-add --verbose
|
||||
local FLAGS=
|
||||
if [ "$1" = "reinstall-bootloader" ]; then
|
||||
FLAGS="--install-bootloader"
|
||||
|
|
@ -30,7 +32,7 @@ rebuild_flake () {
|
|||
# LOG="$(mktemp /tmp/rebuild-XXXXXXXX)"
|
||||
LOG="./rebuild.log"
|
||||
echo "[*] Logging to $LOG"
|
||||
sudo nixos-rebuild switch --flake . $FLAGS 2>&1 | tee "$LOG"
|
||||
sudo nixos-rebuild switch --flake . $FLAGS $EXTRA_FLAGS 2>&1 | tee "$LOG"
|
||||
#nixos-rebuild build --flake .# --cores 8 -j 1
|
||||
}
|
||||
|
||||
|
|
@ -41,19 +43,22 @@ deploy_hive () {
|
|||
|
||||
git add . --verbose
|
||||
# Deploy to all Colmena hives
|
||||
colmena build --experimental-flake-eval
|
||||
colmena apply --experimental-flake-eval
|
||||
colmena build --experimental-flake-eval $EXTRA_FLAGS
|
||||
colmena apply --experimental-flake-eval $EXTRA_FLAGS
|
||||
# colmena apply --on hyrule --experimental-flake-eval
|
||||
}
|
||||
|
||||
# check which flags were given
|
||||
flag_fresh=false
|
||||
flag_bootloader=false
|
||||
flag_remote=false
|
||||
flag_trace=false
|
||||
for flag in "$@"; do
|
||||
case "$flag" in
|
||||
-r|--remote)
|
||||
deploy_hive
|
||||
exit 0 ;;
|
||||
flag_remote=true ;;
|
||||
--show-trace)
|
||||
flag_trace=true ;;
|
||||
-f|--fresh)
|
||||
flag_fresh=true ;;
|
||||
-b|--bootloader)
|
||||
|
|
@ -67,6 +72,16 @@ for flag in "$@"; do
|
|||
esac
|
||||
done
|
||||
|
||||
EXTRA_FLAGS=""
|
||||
if [ "$flag_trace" = true ]; then
|
||||
EXTRA_FLAGS="$EXTRA_FLAGS --show-trace"
|
||||
fi
|
||||
|
||||
if [ "$flag_remote" = true ]; then
|
||||
deploy_hive
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# delete cached items in nixstore
|
||||
if [ "$flag_fresh" = true ]; then
|
||||
collect_garbage
|
||||
|
|
|
|||
124
flake.lock
generated
124
flake.lock
generated
|
|
@ -5,8 +5,12 @@
|
|||
"flake-compat": "flake-compat",
|
||||
"flake-utils": "flake-utils",
|
||||
"nix-github-actions": "nix-github-actions",
|
||||
"nixpkgs": "nixpkgs",
|
||||
"stable": "stable"
|
||||
"nixpkgs": [
|
||||
"nixpkgs-unstable"
|
||||
],
|
||||
"stable": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1734374287,
|
||||
|
|
@ -23,6 +27,32 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"dobutterfliescry-net": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
],
|
||||
"nixpkgs-unstable": [
|
||||
"nixpkgs-unstable"
|
||||
],
|
||||
"systems": [
|
||||
"systems"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1770316708,
|
||||
"narHash": "sha256-i9oEi2PUIZfp+73ZvQE/Ze0aCEV3y3+vvaJ/ZmAe3bw=",
|
||||
"ref": "refs/heads/main",
|
||||
"rev": "955746af205e2a94a8e0798a911941da9c5af779",
|
||||
"revCount": 117,
|
||||
"type": "git",
|
||||
"url": "https://forge.dobutterfliescry.net/cry/site"
|
||||
},
|
||||
"original": {
|
||||
"type": "git",
|
||||
"url": "https://forge.dobutterfliescry.net/cry/site"
|
||||
}
|
||||
},
|
||||
"flake-compat": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
|
|
@ -40,23 +70,25 @@
|
|||
}
|
||||
},
|
||||
"flake-utils": {
|
||||
"inputs": {
|
||||
"systems": "systems"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1659877975,
|
||||
"narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
|
||||
"lastModified": 1731533236,
|
||||
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
|
||||
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
"id": "flake-utils",
|
||||
"type": "indirect"
|
||||
}
|
||||
},
|
||||
"grub2-themes": {
|
||||
"inputs": {
|
||||
"nixpkgs": "nixpkgs_2"
|
||||
"nixpkgs": "nixpkgs"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1757136219,
|
||||
|
|
@ -111,27 +143,27 @@
|
|||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1734119587,
|
||||
"narHash": "sha256-AKU6qqskl0yf2+JdRdD0cfxX4b9x3KKV5RqA6wijmPM=",
|
||||
"lastModified": 1770536720,
|
||||
"narHash": "sha256-pbmbaQUuoG+v37b91lqcNcz05YUvVif7iWjIx9lF8R4=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "3566ab7246670a43abd2ffa913cc62dad9cdf7d5",
|
||||
"rev": "3c64ab24b22579c833895b6030c9563837e41a70",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-unstable",
|
||||
"ref": "master",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs-unstable": {
|
||||
"locked": {
|
||||
"lastModified": 1761114652,
|
||||
"narHash": "sha256-f/QCJM/YhrV/lavyCVz8iU3rlZun6d+dAiC3H+CDle4=",
|
||||
"lastModified": 1770197578,
|
||||
"narHash": "sha256-AYqlWrX09+HvGs8zM6ebZ1pwUqjkfpnv8mewYwAo+iM=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "01f116e4df6a15f4ccdffb1bcd41096869fb385c",
|
||||
"rev": "00c21e4c93d963c50d4c0c89bfa84ed6e0694df2",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -143,27 +175,11 @@
|
|||
},
|
||||
"nixpkgs_2": {
|
||||
"locked": {
|
||||
"lastModified": 1761269590,
|
||||
"narHash": "sha256-yTr+PCi4wGbOEidrm8XyXBobLxLMqIBsbUyhwsN6wrc=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "d792a6e0cd4ba35c90ea787b717d72410f56dc40",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "master",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_3": {
|
||||
"locked": {
|
||||
"lastModified": 1761016216,
|
||||
"narHash": "sha256-G/iC4t/9j/52i/nm+0/4ybBmAF4hzR8CNHC75qEhjHo=",
|
||||
"lastModified": 1767313136,
|
||||
"narHash": "sha256-16KkgfdYqjaeRGBaYsNrhPRRENs0qzkQVUooNHtoy2w=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "481cf557888e05d3128a76f14c76397b7d7cc869",
|
||||
"rev": "ac62194c3917d5f474c1a844b6fd6da2db95077d",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -176,25 +192,41 @@
|
|||
"root": {
|
||||
"inputs": {
|
||||
"colmena": "colmena",
|
||||
"dobutterfliescry-net": "dobutterfliescry-net",
|
||||
"grub2-themes": "grub2-themes",
|
||||
"nix-flatpak": "nix-flatpak",
|
||||
"nixpkgs": "nixpkgs_3",
|
||||
"nixpkgs-unstable": "nixpkgs-unstable"
|
||||
"nixpkgs": "nixpkgs_2",
|
||||
"nixpkgs-unstable": "nixpkgs-unstable",
|
||||
"systems": "systems_2"
|
||||
}
|
||||
},
|
||||
"stable": {
|
||||
"systems": {
|
||||
"locked": {
|
||||
"lastModified": 1730883749,
|
||||
"narHash": "sha256-mwrFF0vElHJP8X3pFCByJR365Q2463ATp2qGIrDUdlE=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "dba414932936fde69f0606b4f1d87c5bc0003ede",
|
||||
"lastModified": 1681028828,
|
||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-24.05",
|
||||
"repo": "nixpkgs",
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"systems_2": {
|
||||
"locked": {
|
||||
"lastModified": 1681028828,
|
||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
}
|
||||
|
|
|
|||
33
flake.nix
33
flake.nix
|
|
@ -2,14 +2,32 @@
|
|||
description = "Emile's Nix Dotfiles";
|
||||
|
||||
inputs = {
|
||||
systems.url = "github:nix-systems/default";
|
||||
|
||||
nixpkgs.url = "github:nixos/nixpkgs/nixos-25.05";
|
||||
nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
|
||||
|
||||
colmena.url = "github:zhaofengli/colmena/?rev=47b6414d800c8471e98ca072bc0835345741a56a";
|
||||
colmena = {
|
||||
url = "github:zhaofengli/colmena/?rev=47b6414d800c8471e98ca072bc0835345741a56a";
|
||||
inputs = {
|
||||
nixpkgs.follows = "nixpkgs-unstable";
|
||||
stable.follows = "nixpkgs";
|
||||
flake-utils.inputs.systems.follows = "systems";
|
||||
};
|
||||
};
|
||||
|
||||
nix-flatpak.url = "github:gmodena/nix-flatpak/?ref=v0.7.0";
|
||||
|
||||
grub2-themes.url = "github:vinceliuice/grub2-themes";
|
||||
|
||||
dobutterfliescry-net = {
|
||||
url = "git+https://forge.dobutterfliescry.net/cry/site";
|
||||
inputs = {
|
||||
nixpkgs.follows = "nixpkgs";
|
||||
nixpkgs-unstable.follows = "nixpkgs-unstable";
|
||||
systems.follows = "systems";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
outputs = {
|
||||
|
|
@ -32,12 +50,15 @@
|
|||
pkgs-unstable = import nixpkgs-unstable {
|
||||
inherit system;
|
||||
config = {
|
||||
allowUnfree = true; # TODO: bandaid solution... (for minecraft-server)
|
||||
# allowUnfree = true; # TODO: bandaid solution... (for minecraft-server)
|
||||
allowUnfree = false;
|
||||
};
|
||||
};
|
||||
# TODO: come back to this its really cool
|
||||
# this is just something I'm experimenting with
|
||||
# PROJECT_ROOT = builtins.toString ./.;
|
||||
# ROOT = ./.;
|
||||
|
||||
specialArgs = {inherit inputs pkgs-unstable;};
|
||||
in {
|
||||
devShells."x86_64-linux".default = pkgs.mkShell {
|
||||
shell = "${pkgs.bash}/bin/bash";
|
||||
|
|
@ -52,7 +73,7 @@
|
|||
# i be on my puter fr
|
||||
myputer = nixpkgs.lib.nixosSystem {
|
||||
# nix passes these to every single module
|
||||
specialArgs = {inherit inputs pkgs-unstable;};
|
||||
inherit specialArgs;
|
||||
|
||||
modules = [
|
||||
./hosts/myputer
|
||||
|
|
@ -62,7 +83,7 @@
|
|||
|
||||
# my laptop 0w0
|
||||
lolcathost = nixpkgs.lib.nixosSystem {
|
||||
specialArgs = {inherit inputs pkgs-unstable;};
|
||||
inherit specialArgs;
|
||||
|
||||
modules = [
|
||||
./hosts/lolcathost
|
||||
|
|
@ -75,7 +96,7 @@
|
|||
colmenaHive = colmena.lib.makeHive {
|
||||
meta = {
|
||||
nixpkgs = pkgs;
|
||||
specialArgs = {inherit pkgs-unstable;};
|
||||
inherit specialArgs;
|
||||
|
||||
# set nixpkgs per server
|
||||
nodeNixpkgs = {
|
||||
|
|
|
|||
|
|
@ -130,6 +130,12 @@
|
|||
TERM = "linux";
|
||||
};
|
||||
};
|
||||
clocktown = {
|
||||
hostname = "clocktown.dobutterfliescry.net";
|
||||
user = "root";
|
||||
port = 22;
|
||||
identityFile = "~/.ssh/id_clocktown";
|
||||
};
|
||||
subspace = {
|
||||
hostname = "imbored.dev";
|
||||
user = "subspace";
|
||||
|
|
|
|||
|
|
@ -1,5 +1,64 @@
|
|||
{pkgs, ...}: {
|
||||
# read https://docs.helix-editor.com/editor.html
|
||||
{
|
||||
pkgs,
|
||||
pkgs-unstable,
|
||||
...
|
||||
}: let
|
||||
lsps = {
|
||||
bash-language-server = {
|
||||
pkg = pkgs.bash-language-server;
|
||||
cmd = "bash-language-server";
|
||||
};
|
||||
|
||||
clangd = {
|
||||
pkg = pkgs.clang-tools;
|
||||
cmd = "clangd";
|
||||
};
|
||||
|
||||
glsl_analyzer = {
|
||||
pkg = pkgs.glsl_analyzer;
|
||||
cmd = "glsl_analyzer";
|
||||
};
|
||||
|
||||
haskell-language-server = {
|
||||
pkg = pkgs.haskell-language-server;
|
||||
cmd = "haskell-language-server-wrapper";
|
||||
};
|
||||
|
||||
# TODO: once upgraded past Nix-24.07 this line won't be necessary (I think)
|
||||
# helix will support nixd by default
|
||||
# SOURCE: https://github.com/nix-community/nixd/blob/main/nixd/docs/editor-setup.md#Helix
|
||||
nixd = {
|
||||
pkg = pkgs.nixd;
|
||||
cmd = "nixd";
|
||||
};
|
||||
|
||||
OmniSharp = {
|
||||
pkg = pkgs.omnisharp-roslyn;
|
||||
cmd = "OmniSharp";
|
||||
};
|
||||
|
||||
rust-analyzer = {
|
||||
pkg = pkgs.rust-analyzer;
|
||||
cmd = "rust-analyzer";
|
||||
};
|
||||
|
||||
ty = {
|
||||
pkg = pkgs-unstable.ty;
|
||||
cmd = "ty";
|
||||
};
|
||||
|
||||
typescript-language-server = {
|
||||
pkg = pkgs.typescript-language-server;
|
||||
cmd = "typescript-language-server";
|
||||
};
|
||||
};
|
||||
in {
|
||||
home.packages =
|
||||
lsps
|
||||
|> builtins.attrValues
|
||||
|> map (lsp: lsp.pkg);
|
||||
|
||||
# REF: https://docs.helix-editor.com/editor.html
|
||||
programs.helix = {
|
||||
enable = true;
|
||||
settings = {
|
||||
|
|
@ -128,11 +187,12 @@
|
|||
};
|
||||
auto-format = false; # my python is beautiful ^_^
|
||||
rulers = [80];
|
||||
language-servers = ["ty"];
|
||||
}
|
||||
{
|
||||
name = "c";
|
||||
file-types = ["c" "h"]; # use .hpp for C++
|
||||
auto-format = false;
|
||||
auto-format = true;
|
||||
formatter.command = "${pkgs.clang-tools}/bin/clang-format";
|
||||
language-servers = ["clangd"];
|
||||
}
|
||||
|
|
@ -152,49 +212,54 @@
|
|||
formatter.command = "${pkgs.rustfmt}/bin/rustfmt";
|
||||
language-servers = ["rust-analyzer"];
|
||||
}
|
||||
# {
|
||||
# name = "c-sharp";
|
||||
# source = "source.cs";
|
||||
# file-types = ["cs"];
|
||||
# indent = {
|
||||
# tab-width = 4;
|
||||
# unit = " ";
|
||||
# };
|
||||
# block-comment-tokens = {
|
||||
# start = "/*";
|
||||
# end = "*/";
|
||||
# };
|
||||
# # auto-format = false;
|
||||
# # formatter.command = "${pkgs.omnisharp-roslyn}/bin/OmniSharp";
|
||||
# # language-servers = ["OmniSharp"];
|
||||
# }
|
||||
{
|
||||
name = "c-sharp";
|
||||
file-types = ["cs"];
|
||||
indent = {
|
||||
tab-width = 4;
|
||||
unit = " ";
|
||||
};
|
||||
block-comment-tokens = {
|
||||
start = "/*";
|
||||
end = "*/";
|
||||
};
|
||||
# auto-format = true;
|
||||
# formatter.command = "${pkgs.omnisharp-roslyn}/bin/OmniSharp";
|
||||
# language-servers = ["OmniSharp"];
|
||||
}
|
||||
{
|
||||
name = "javascript";
|
||||
file-types = ["js"];
|
||||
indent = {
|
||||
tab-width = 2;
|
||||
unit = " ";
|
||||
};
|
||||
block-comment-tokens = {
|
||||
start = "/*";
|
||||
end = "*/";
|
||||
};
|
||||
auto-format = true;
|
||||
language-servers = ["typescript-language-server"];
|
||||
}
|
||||
{
|
||||
name = "glsl";
|
||||
file-types = ["glsl"];
|
||||
indent = {
|
||||
tab-width = 2;
|
||||
unit = " ";
|
||||
};
|
||||
block-comment-tokens = {
|
||||
start = "/*";
|
||||
end = "*/";
|
||||
};
|
||||
auto-format = false;
|
||||
language-servers = ["glsl_analyzer"];
|
||||
}
|
||||
];
|
||||
|
||||
language-server = {
|
||||
# use nixd as default nix lsp (I haven't tried nil yet)
|
||||
# NOTE: nixd will be supported by default after nix 24.07
|
||||
# SOURCE: https://github.com/nix-community/nixd/blob/main/nixd/docs/editor-setup.md#Helix
|
||||
nixd = {
|
||||
command = "${pkgs.nixd}/bin/nixd";
|
||||
};
|
||||
# clangd for C
|
||||
clangd = {
|
||||
command = "${pkgs.clang-tools}/bin/clangd";
|
||||
};
|
||||
|
||||
haskell-language-server = {
|
||||
command = "${pkgs.haskell-language-server}/bin/haskell-language-server-wrapper";
|
||||
};
|
||||
|
||||
rust-analyzer = {
|
||||
command = "${pkgs.rust-analyzer}/bin/rust-analyzer";
|
||||
};
|
||||
|
||||
# C# language services
|
||||
OmniSharp = {
|
||||
command = "${pkgs.omnisharp-roslyn}/bin/OmniSharp";
|
||||
};
|
||||
};
|
||||
language-server =
|
||||
lsps
|
||||
|> builtins.mapAttrs (_: lsp: {command = "${lsp.pkg}/bin/${lsp.cmd}";});
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,8 +1,6 @@
|
|||
{
|
||||
pkgs,
|
||||
pkgs-unstable,
|
||||
inputs,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
home-manager = builtins.fetchTarball {
|
||||
|
|
@ -14,12 +12,13 @@ in {
|
|||
./hardware-configuration.nix
|
||||
(import "${home-manager}/nixos")
|
||||
|
||||
./services/forgejo.nix
|
||||
./services/vaultwarden.nix
|
||||
./services/nginx.nix
|
||||
# ./mailserver.nix # TEMP: location
|
||||
# ./minecraft-server.nix # TEMP: location
|
||||
|
||||
#../modules/server/nginx.nix
|
||||
#../modules/server/ssh.nix
|
||||
#../modules/server/fail2ban.nix
|
||||
../modules/bashistrans.nix
|
||||
];
|
||||
|
||||
nix.settings = {
|
||||
|
|
@ -33,15 +32,6 @@ in {
|
|||
];
|
||||
};
|
||||
|
||||
# nixpkgs.config.allowUnfreePredicate = let
|
||||
# whitelist = map lib.getName [
|
||||
# "minecraft-server"
|
||||
# pkgs.minecraft-server
|
||||
# pkgs-unstable.minecraft-server
|
||||
# ];
|
||||
# in
|
||||
# pkg: builtins.elem (lib.getName pkg) whitelist;
|
||||
|
||||
time.timeZone = "Australia/Brisbane";
|
||||
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
|
|
@ -92,30 +82,6 @@ in {
|
|||
];
|
||||
};
|
||||
|
||||
# wireguard.interfaces = {
|
||||
# wg0 = {
|
||||
# ips = ["10.10.10.4/24"]; # my IP and the subnet (keyword: "AND")
|
||||
# listenPort = 54231;
|
||||
#
|
||||
# privateKeyFile = "/root/wg_agrivpn_hyrule";
|
||||
#
|
||||
# peers = [
|
||||
# {
|
||||
# # peer's public key
|
||||
# publicKey = "iZ4aqYjbT8O8tfUHEuV+yWLtdoQbdBb6Nt0M4usMSiY=";
|
||||
#
|
||||
# # choose which traffic to forward
|
||||
# allowedIPs = ["10.0.51.0/24" "10.10.10.0/24"];
|
||||
#
|
||||
# # TODO: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
|
||||
# endpoint = "150.242.34.33:54231";
|
||||
#
|
||||
# # send keepalives every 25 seconds. Important to keep NAT tables alive.
|
||||
# persistentKeepalive = 25;
|
||||
# }
|
||||
# ];
|
||||
# };
|
||||
# };
|
||||
wg-quick.interfaces = {
|
||||
wg0 = {
|
||||
address = [
|
||||
|
|
@ -150,7 +116,7 @@ in {
|
|||
extraGroups = ["wheel"];
|
||||
shell = pkgs.bash;
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCsUZY45rgezi+8iROdcR5vPeacJ2fbMjlDijfUrH9hRX2FzCsg/4e3aFKhi2seZMmyTfbstxmDrrH8paUS5TibFgLFBGNngaF3CTjg85i5pm25Hr4IVo31oziBnTWaG6j3buYKtz5e1qSPzXywinJR+5+FCUJU7Fxa+EWTZcOX4wYgArSj4q73rZmvk5N0X44Mudt4nvpD2chvxygsdTzD6ph92qCuaJ/AbfmOoC7b/xvOaOVydUfgDLpHi9VZbd3akvvKxRfW6ZklldgXEzPXKMuastN0mwcBxvIb5G1Vkj8jtSVtKPc5psZ9/NWA5l38xH4qZ6z7eib6thtEMdtcKmTZEEWDADjqTea5Gj61c1n18cr6f3Tff+0bn/cxsl4Y0esi+aDeuCXYiIYNmeKBx0ttDNIxpk4J5Fdh6Xs+AZif5lnJErtu8TPy2aC0bc9wehTjMyvilTHfyerOD1ZJXhN2XwRVDGN7t7leAJZISJlPjqTDcw3Vfvzte/5JqS+FR+hbpG4uz2ix8kUa20u5YF2oSdGl8+zsdozVsdQm10Iv9WSXBV7t4m+oyodgtfzydBpmXq7aBXudCiEKw+7TC7F+1a4YFrVrCNXKFgKUpd1MiVLl7DIbzm5U9MD2BB3Fy7BPCzr3tW6/ExOhhpBWY+HnzVGQfkNr7dRcqfipKw== ae@imbored.dev"
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCsUZY45rgezi+8iROdcR5vPeacJ2fbMjlDijfUrH9hRX2FzCsg/4e3aFKhi2seZMmyTfbstxmDrrH8paUS5TibFgLFBGNngaF3CTjg85i5pm25Hr4IVo31oziBnTWaG6j3buYKtz5e1qSPzXywinJR+5+FCUJU7Fxa+EWTZcOX4wYgArSj4q73rZmvk5N0X44Mudt4nvpD2chvxygsdTzD6ph92qCuaJ/AbfmOoC7b/xvOaOVydUfgDLpHi9VZbd3akvvKxRfW6ZklldgXEzPXKMuastN0mwcBxvIb5G1Vkj8jtSVtKPc5psZ9/NWA5l38xH4qZ6z7eib6thtEMdtcKmTZEEWDADjqTea5Gj61c1n18cr6f3Tff+0bn/cxsl4Y0esi+aDeuCXYiIYNmeKBx0ttDNIxpk4J5Fdh6Xs+AZif5lnJErtu8TPy2aC0bc9wehTjMyvilTHfyerOD1ZJXhN2XwRVDGN7t7leAJZISJlPjqTDcw3Vfvzte/5JqS+FR+hbpG4uz2ix8kUa20u5YF2oSdGl8+zsdozVsdQm10Iv9WSXBV7t4m+oyodgtfzydBpmXq7aBXudCiEKw+7TC7F+1a4YFrVrCNXKFgKUpd1MiVLl7DIbzm5U9MD2BB3Fy7BPCzr3tW6/ExOhhpBWY+HnzVGQfkNr7dRcqfipKw== ae@dobutterfliescry.net"
|
||||
];
|
||||
};
|
||||
|
||||
|
|
@ -182,70 +148,6 @@ in {
|
|||
};
|
||||
|
||||
services = {
|
||||
# simple nginx instance to host static construction page
|
||||
# TODO: I want sshd and forgejo's ssh server to both be bound to port 22
|
||||
# So change sshd to listen on a different address/port (ie 2222 or 127.0.0.3:22, etc)
|
||||
# and change forgejo to use 127.0.0.2:22 (use port 22, ONLY change loopback address)
|
||||
nginx = {
|
||||
enable = true;
|
||||
# in wake of CVE-2022-3602/CVE-2022-3786
|
||||
package = pkgs.nginxStable.override {openssl = pkgs.libressl;};
|
||||
|
||||
recommendedGzipSettings = true;
|
||||
recommendedZstdSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
|
||||
# streamConfig = ''
|
||||
# server {
|
||||
# listen 127.0.0.1:53 udp reuseport;
|
||||
# proxy_timeout 20s;
|
||||
# proxy_pass 192.168.0.1:53535;
|
||||
# }
|
||||
# '';
|
||||
|
||||
virtualHosts = let
|
||||
localhost = "http://127.0.0.1";
|
||||
std = {
|
||||
# TODO: should I run over QUIC+HTTP3? (experimental)
|
||||
# quic = true;
|
||||
# http3 = true;
|
||||
enableACME = true;
|
||||
# kTLS = true; # offload TLS to the linux kernel
|
||||
};
|
||||
in {
|
||||
"imbored.dev" =
|
||||
{
|
||||
default = true;
|
||||
addSSL = true; # not strictly enforced <3
|
||||
root = "/var/www/imbored";
|
||||
# extraConfig = ''
|
||||
# error_page 404 /custom_404.html;
|
||||
# '';
|
||||
}
|
||||
// std;
|
||||
# Route "vault" subdomain to vaultwarden
|
||||
"vault.imbored.dev" =
|
||||
{
|
||||
forceSSL = true;
|
||||
locations."/".proxyPass = "${localhost}:8222";
|
||||
}
|
||||
// std;
|
||||
# Route "forge" subdomain to forgejo
|
||||
# TODO: use `forgejo.settings.server.ENABLE_ACME` instead?
|
||||
"forge.imbored.dev" =
|
||||
{
|
||||
forceSSL = true;
|
||||
extraConfig = ''
|
||||
client_max_body_size 512M;
|
||||
'';
|
||||
locations."/".proxyPass = "${localhost}:3000";
|
||||
}
|
||||
// std;
|
||||
};
|
||||
};
|
||||
|
||||
openssh = {
|
||||
enable = true;
|
||||
ports = [22];
|
||||
|
|
@ -257,235 +159,8 @@ in {
|
|||
X11Forwarding = false;
|
||||
};
|
||||
};
|
||||
|
||||
vaultwarden = {
|
||||
enable = true;
|
||||
dbBackend = "sqlite";
|
||||
|
||||
# backupDir = "/var/backup/vaultwarden"; # disable with null
|
||||
|
||||
# https://mynixos.com/nixpkgs/option/services.vaultwarden.config
|
||||
config = {
|
||||
# internal address and port to listen on
|
||||
ROCKET_ADDRESS = "127.0.0.1";
|
||||
ROCKET_PORT = 8222;
|
||||
|
||||
# hostname to listen for
|
||||
DOMAIN = "https://vault.imbored.dev";
|
||||
|
||||
# signup policy
|
||||
SIGNUPS_ALLOWED = false;
|
||||
SIGNUPS_VERIFY = true;
|
||||
INVITATIONS_ALLOWED = true;
|
||||
};
|
||||
# https://mynixos.com/nixpkgs/option/services.vaultwarden.environmentFile
|
||||
environmentFile = "/var/lib/vaultwarden/vaultwarden.env";
|
||||
};
|
||||
|
||||
# stalwart-mail = let
|
||||
# domain = "imbored.dev";
|
||||
# in {
|
||||
# enable = false; # true;
|
||||
# # openFirewall = true; # im doing this manually rn
|
||||
# settings = {
|
||||
# certificate."${domain}" = {
|
||||
# cert = "file://${certs.${domain}.cert}";
|
||||
# private-key = "file://${certs.${domain}.key}";
|
||||
# };
|
||||
# server = {
|
||||
# hostname = domain;
|
||||
# tls = {
|
||||
# certificate = "${domain}";
|
||||
# enable = true;
|
||||
# implicit = false;
|
||||
# };
|
||||
# listener = {
|
||||
# "smtp-submission" = {
|
||||
# bind = ["127.0.0.1:587"];
|
||||
# protocol = "smtp";
|
||||
# };
|
||||
# "imap" = {
|
||||
# bind = ["127.0.0.1:143"];
|
||||
# protocol = "imap";
|
||||
# };
|
||||
# };
|
||||
# };
|
||||
# session = {
|
||||
# rcpt.directory = "in-memory";
|
||||
# auth = {
|
||||
# mechanisms = ["PLAIN"];
|
||||
# directory = "in-memory";
|
||||
# };
|
||||
# };
|
||||
# jmap.directory = "in-memory";
|
||||
# queue.outbound.next-hop = ["local"];
|
||||
# directory."in-memory" = {
|
||||
# type = "memory";
|
||||
# users = [
|
||||
# {
|
||||
# name = "me";
|
||||
# secret = "foobar";
|
||||
# email = ["me@${domain}"];
|
||||
# }
|
||||
# {
|
||||
# name = "Emile";
|
||||
# secret = "foobar";
|
||||
# email = ["emile@${domain}"];
|
||||
# }
|
||||
# ];
|
||||
# };
|
||||
# };
|
||||
# };
|
||||
|
||||
# more options here: https://mynixos.com/nixpkgs/options/services.forgejo
|
||||
# TODO: set a favicon https://forgejo.org/docs/next/contributor/customization/#changing-the-logo
|
||||
# (might need me to override settings in the nixpkg)
|
||||
# TODO: create a custom theme for forgejo (modify the source files most likely)
|
||||
forgejo = {
|
||||
enable = true;
|
||||
# enable support for Git Large File Storage
|
||||
lfs.enable = true;
|
||||
database = {
|
||||
type = "sqlite3"; # postgres
|
||||
host = "127.0.0.1";
|
||||
port = "3306"; # 5432 if postgres
|
||||
};
|
||||
# settings are written directly to the `app.ini` config file
|
||||
# refer to: https://forgejo.org/docs/latest/admin/config-cheat-sheet/
|
||||
settings = {
|
||||
server = {
|
||||
# ENABLE_ACME = true;
|
||||
# ACME_EMAIL = "eclarkboman@gmail.com"; # change this to "me@imbored.dev"
|
||||
DOMAIN = "forge.imbored.dev"; # should this be "imbored.dev"?
|
||||
ROOT_URL = "https://forge.imbored.dev"; # full public URL of the Forgejo server
|
||||
# address and port to listen on
|
||||
HTTP_ADDR = "127.0.0.1";
|
||||
HTTP_PORT = 3000;
|
||||
PROTOCOL = "http"; # http internally, reverse proxy uses https externally
|
||||
|
||||
START_SSH_SERVER = true;
|
||||
DISABLE_SSH = false;
|
||||
SSH_PORT = 2222;
|
||||
};
|
||||
|
||||
DEFAULT = {
|
||||
APP_NAME = "tearforge";
|
||||
APP_SLOGIN = "but cozy";
|
||||
APP_DISPLAY_NAME_FORMAT = "{APP_NAME} ::{APP_SLOGAN}::";
|
||||
};
|
||||
|
||||
repository = {
|
||||
DEFAULT_PRIVATE = "private"; # last, private, public
|
||||
# repo/org created on push to non-existent
|
||||
ENABLE_PUSH_CREATE_USER = true;
|
||||
ENABLE_PUSH_CREATE_ORG = false;
|
||||
DEFAULT_PUSH_CREATE_PRIVATE = true;
|
||||
MAX_CREATION_LIMIT = -1;
|
||||
};
|
||||
|
||||
"repository.upload" = {
|
||||
# max per-file size in MB
|
||||
FILE_MAX_SIZE = 50;
|
||||
# max number of files per upload
|
||||
MAX_FILES = 5;
|
||||
};
|
||||
|
||||
badges = let
|
||||
# flat, flat-square, plastic, for-the-badge, social
|
||||
style = "for-the-badge";
|
||||
in {
|
||||
ENABLED = true;
|
||||
GENERATOR_URL_TEMPLATE = "https://img.shields.io/badge/{{.label}}-{{.text}}-{{.color}}?style=${style}";
|
||||
};
|
||||
|
||||
ui = {
|
||||
DEFAULT_THEME = "forgejo-dark";
|
||||
THEMES = "forgejo-auto,forgejo-light,forgejo-dark";
|
||||
};
|
||||
"ui.meta" = {
|
||||
AUTHOR = "Emile Clark-Boman - emileclarkb";
|
||||
DESCRIPTION = "This is my personal self-hosted git forge, where I keep and maintain personal projects! PS do butterflies cry when they're sad?";
|
||||
KEYWORDS = "emile,clark,boman,clarkboman,emileclarkb,git,forge,forgejo,self-hosted,dobutterfliescry,butterfly,butterflies";
|
||||
};
|
||||
|
||||
markdown = {
|
||||
ENABLE_HARD_LINE_BREAK_IN_COMMENTS = true;
|
||||
ENABLE_MATH = true;
|
||||
};
|
||||
|
||||
admin = {
|
||||
DEFAULT_EMAIL_NOTIFICATIONS = "enabled";
|
||||
SEND_NOTIFICATION_EMAIL_ON_NEW_USER = true;
|
||||
};
|
||||
|
||||
security = {
|
||||
# Controls access to the installation page.
|
||||
# When set to “true”, the installation page is not accessible.
|
||||
#INSTALL_LOCK = false;
|
||||
|
||||
PASSWORD_HASH_ALGO = "argon2"; # ARGON2 BEST ALGO FR!! (default: argon2$2$65536$8$50)
|
||||
MIN_PASSWORD_LENGTH = 12;
|
||||
PASSWORD_COMPLEXITY = "lower,upper,digit,spec";
|
||||
PASSWORD_CHECK_PWN = true;
|
||||
};
|
||||
|
||||
service = {
|
||||
DISABLE_REGISTRATION = true; # toggle for new users
|
||||
#DEFAULT_USER_IS_RESTRICTED = true;
|
||||
# Forbid login with third-party services (ie github)
|
||||
ALLOW_ONLY_INTERNAL_REGISTRATION = true;
|
||||
ENABLE_CAPTCHA = true;
|
||||
REQUIRE_CAPTCHA_FOR_LOGIN = true;
|
||||
REQUIRE_EXTERNAL_REGISTRATION_CAPTCHA = true;
|
||||
LOGIN_REMEMBER_DAYS = 365;
|
||||
ENABLE_NOTIFY_MAIL = true;
|
||||
};
|
||||
"service.explore" = {
|
||||
REQUIRE_SIGNIN_VIEW = false;
|
||||
DISABLE_USERS_PAGE = false;
|
||||
DISABLE_ORGANIZATIONS_PAGE = false;
|
||||
DISABLE_CODE_PAGE = false;
|
||||
};
|
||||
|
||||
cache = {
|
||||
ADAPTER = "twoqueue";
|
||||
HOST = "{\"size\":100, \"recent_ratio\":0.25, \"ghost_ratio\":0.5}";
|
||||
ITEM_TTL = "16h";
|
||||
};
|
||||
|
||||
# TODO: fill this in once my mail server is configured
|
||||
# email.incoming = { ... };
|
||||
|
||||
# optional
|
||||
# TODO: fill this in once my mail server is configured
|
||||
mailer = {
|
||||
ENABLED = false;
|
||||
SMTP_ADDR = "mail.imbored.dev";
|
||||
FROM = "noreply@imbored.dev";
|
||||
USER = "noreply@imbored.dev";
|
||||
};
|
||||
|
||||
log = {
|
||||
MODE = "file";
|
||||
LEVEL = "Info"; # "Trace", "Debug", "Info", "Warn", "Error", "Critical"
|
||||
ENABLE_SSH_LOG = true;
|
||||
};
|
||||
|
||||
cron = {
|
||||
ENABLED = true;
|
||||
RUN_AT_START = false;
|
||||
};
|
||||
|
||||
other = {
|
||||
SHOW_FOOTER_VERSION = true;
|
||||
SHOW_FOOTER_TEMPLATE_LOAD_TIME = true;
|
||||
SHOW_FOOTER_POWERED_BY = true;
|
||||
ENABLE_SITEMAP = true;
|
||||
ENABLE_FEED = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
security = {
|
||||
# accept Lets Encrypt's security policy (for nginx)
|
||||
acme = {
|
||||
|
|
@ -514,21 +189,5 @@ in {
|
|||
tcpdump
|
||||
];
|
||||
|
||||
programs = {
|
||||
fish.enable = true;
|
||||
|
||||
bash = {
|
||||
completion.enable = true;
|
||||
|
||||
interactiveShellInit = ''
|
||||
if [[ $(${pkgs.procps}/bin/ps --no-header --pid=$PPID --format=comm) != "fish" && -z ''${BASH_EXECUTION_STRING} ]]
|
||||
then
|
||||
shopt -q login_shell && LOGIN_OPTION='--login' || LOGIN_OPTION=""
|
||||
exec ${pkgs.fish}/bin/fish $LOGIN_OPTION
|
||||
fi
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
system.stateVersion = "24.11"; # DO NOT MODIFY
|
||||
}
|
||||
|
|
|
|||
150
hosts/hyrule/services/forgejo.nix
Normal file
150
hosts/hyrule/services/forgejo.nix
Normal file
|
|
@ -0,0 +1,150 @@
|
|||
{...}: {
|
||||
# more options here: https://mynixos.com/nixpkgs/options/services.forgejo
|
||||
# TODO: set a favicon https://forgejo.org/docs/next/contributor/customization/#changing-the-logo
|
||||
# (might need me to override settings in the nixpkg)
|
||||
# TODO: create a custom theme for forgejo (modify the source files most likely)
|
||||
services.forgejo = {
|
||||
enable = true;
|
||||
# enable support for Git Large File Storage
|
||||
lfs.enable = true;
|
||||
database = {
|
||||
type = "sqlite3"; # postgres
|
||||
host = "127.0.0.1";
|
||||
port = "3306"; # 5432 if postgres
|
||||
};
|
||||
# settings are written directly to the `app.ini` config file
|
||||
# refer to: https://forgejo.org/docs/latest/admin/config-cheat-sheet/
|
||||
settings = {
|
||||
server = {
|
||||
# ENABLE_ACME = true;
|
||||
# ACME_EMAIL = "eclarkboman@gmail.com"; # change this to "me@imbored.dev"
|
||||
DOMAIN = "forge.imbored.dev"; # should this be "imbored.dev"?
|
||||
ROOT_URL = "https://forge.imbored.dev"; # full public URL of the Forgejo server
|
||||
# address and port to listen on
|
||||
HTTP_ADDR = "127.0.0.1";
|
||||
HTTP_PORT = 3000;
|
||||
PROTOCOL = "http"; # http internally, reverse proxy uses https externally
|
||||
|
||||
START_SSH_SERVER = true;
|
||||
DISABLE_SSH = false;
|
||||
SSH_PORT = 2222;
|
||||
};
|
||||
|
||||
DEFAULT = {
|
||||
APP_NAME = "tearforge";
|
||||
APP_SLOGIN = "but cozy";
|
||||
APP_DISPLAY_NAME_FORMAT = "{APP_NAME} ::{APP_SLOGAN}::";
|
||||
};
|
||||
|
||||
repository = {
|
||||
DEFAULT_PRIVATE = "private"; # last, private, public
|
||||
# repo/org created on push to non-existent
|
||||
ENABLE_PUSH_CREATE_USER = true;
|
||||
ENABLE_PUSH_CREATE_ORG = false;
|
||||
DEFAULT_PUSH_CREATE_PRIVATE = true;
|
||||
MAX_CREATION_LIMIT = -1;
|
||||
};
|
||||
|
||||
"repository.upload" = {
|
||||
# max per-file size in MB
|
||||
FILE_MAX_SIZE = 50;
|
||||
# max number of files per upload
|
||||
MAX_FILES = 5;
|
||||
};
|
||||
|
||||
badges = let
|
||||
# flat, flat-square, plastic, for-the-badge, social
|
||||
style = "for-the-badge";
|
||||
in {
|
||||
ENABLED = true;
|
||||
GENERATOR_URL_TEMPLATE = "https://img.shields.io/badge/{{.label}}-{{.text}}-{{.color}}?style=${style}";
|
||||
};
|
||||
|
||||
ui = {
|
||||
DEFAULT_THEME = "forgejo-dark";
|
||||
THEMES = "forgejo-auto,forgejo-light,forgejo-dark";
|
||||
};
|
||||
"ui.meta" = {
|
||||
AUTHOR = "Emile Clark-Boman - emileclarkb";
|
||||
DESCRIPTION = "This is my personal self-hosted git forge, where I keep and maintain personal projects! PS do butterflies cry when they're sad?";
|
||||
KEYWORDS = "emile,clark,boman,clarkboman,emileclarkb,git,forge,forgejo,self-hosted,dobutterfliescry,butterfly,butterflies";
|
||||
};
|
||||
|
||||
markdown = {
|
||||
ENABLE_HARD_LINE_BREAK_IN_COMMENTS = true;
|
||||
ENABLE_MATH = true;
|
||||
};
|
||||
|
||||
admin = {
|
||||
DEFAULT_EMAIL_NOTIFICATIONS = "enabled";
|
||||
SEND_NOTIFICATION_EMAIL_ON_NEW_USER = true;
|
||||
};
|
||||
|
||||
security = {
|
||||
# Controls access to the installation page.
|
||||
# When set to “true”, the installation page is not accessible.
|
||||
#INSTALL_LOCK = false;
|
||||
|
||||
PASSWORD_HASH_ALGO = "argon2"; # ARGON2 BEST ALGO FR!! (default: argon2$2$65536$8$50)
|
||||
MIN_PASSWORD_LENGTH = 12;
|
||||
PASSWORD_COMPLEXITY = "lower,upper,digit,spec";
|
||||
PASSWORD_CHECK_PWN = true;
|
||||
};
|
||||
|
||||
service = {
|
||||
DISABLE_REGISTRATION = true; # toggle for new users
|
||||
#DEFAULT_USER_IS_RESTRICTED = true;
|
||||
# Forbid login with third-party services (ie github)
|
||||
ALLOW_ONLY_INTERNAL_REGISTRATION = true;
|
||||
ENABLE_CAPTCHA = true;
|
||||
REQUIRE_CAPTCHA_FOR_LOGIN = true;
|
||||
REQUIRE_EXTERNAL_REGISTRATION_CAPTCHA = true;
|
||||
LOGIN_REMEMBER_DAYS = 365;
|
||||
ENABLE_NOTIFY_MAIL = true;
|
||||
};
|
||||
"service.explore" = {
|
||||
REQUIRE_SIGNIN_VIEW = false;
|
||||
DISABLE_USERS_PAGE = false;
|
||||
DISABLE_ORGANIZATIONS_PAGE = false;
|
||||
DISABLE_CODE_PAGE = false;
|
||||
};
|
||||
|
||||
cache = {
|
||||
ADAPTER = "twoqueue";
|
||||
HOST = "{\"size\":100, \"recent_ratio\":0.25, \"ghost_ratio\":0.5}";
|
||||
ITEM_TTL = "16h";
|
||||
};
|
||||
|
||||
# TODO: fill this in once my mail server is configured
|
||||
# email.incoming = { ... };
|
||||
|
||||
# optional
|
||||
# TODO: fill this in once my mail server is configured
|
||||
mailer = {
|
||||
ENABLED = false;
|
||||
SMTP_ADDR = "mail.dobutterfliescry.net";
|
||||
FROM = "iforgor@dobutterfliescry.net";
|
||||
USER = "iforgor@dobutterfliescry.net";
|
||||
};
|
||||
|
||||
log = {
|
||||
MODE = "file";
|
||||
LEVEL = "Info"; # "Trace", "Debug", "Info", "Warn", "Error", "Critical"
|
||||
ENABLE_SSH_LOG = true;
|
||||
};
|
||||
|
||||
cron = {
|
||||
ENABLED = true;
|
||||
RUN_AT_START = false;
|
||||
};
|
||||
|
||||
other = {
|
||||
SHOW_FOOTER_VERSION = true;
|
||||
SHOW_FOOTER_TEMPLATE_LOAD_TIME = true;
|
||||
SHOW_FOOTER_POWERED_BY = true;
|
||||
ENABLE_SITEMAP = true;
|
||||
ENABLE_FEED = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -28,6 +28,7 @@
|
|||
aliases = ["emile@imbored.dev"];
|
||||
hashedPasswordFile = let
|
||||
CWD = builtins.getEnv "PWD";
|
||||
# XXX: TODO: use a secrets manager!
|
||||
in "${CWD}/secrets/passwd/me";
|
||||
};
|
||||
};
|
||||
82
hosts/hyrule/services/nginx.nix
Normal file
82
hosts/hyrule/services/nginx.nix
Normal file
|
|
@ -0,0 +1,82 @@
|
|||
{
|
||||
inputs,
|
||||
pkgs,
|
||||
...
|
||||
}: {
|
||||
nixpkgs.overlays = [
|
||||
(self: super: {
|
||||
# in wake of CVE-2022-3602/CVE-2022-3786
|
||||
nginxStable = super.nginxStable.override {openssl = pkgs.libressl;};
|
||||
})
|
||||
inputs.dobutterfliescry-net.overlays.default
|
||||
];
|
||||
|
||||
# simple nginx instance to host static construction page
|
||||
# TODO: I want sshd and forgejo's ssh server to both be bound to port 22
|
||||
# So change sshd to listen on a different address/port (ie 2222 or 127.0.0.3:22, etc)
|
||||
# and change forgejo to use 127.0.0.2:22 (use port 22, ONLY change loopback address)
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
# XXX: TODO: this should auto use the nginxStable overlay no?
|
||||
# in wake of CVE-2022-3602/CVE-2022-3786
|
||||
# package = pkgs.nginxStable.override {openssl = pkgs.libressl;};
|
||||
|
||||
recommendedGzipSettings = true;
|
||||
recommendedZstdSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
|
||||
# streamConfig = ''
|
||||
# server {
|
||||
# listen 127.0.0.1:53 udp reuseport;
|
||||
# proxy_timeout 20s;
|
||||
# proxy_pass 192.168.0.1:53535;
|
||||
# }
|
||||
# '';
|
||||
|
||||
virtualHosts = let
|
||||
localhost = "http://127.0.0.1";
|
||||
std = {
|
||||
# TODO: should I run over QUIC+HTTP3? (experimental)
|
||||
# quic = true;
|
||||
# http3 = true;
|
||||
enableACME = true;
|
||||
# kTLS = true; # offload TLS to the linux kernel
|
||||
};
|
||||
|
||||
vault =
|
||||
{
|
||||
forceSSL = true;
|
||||
locations."/".proxyPass = "${localhost}:8222";
|
||||
}
|
||||
// std;
|
||||
forge =
|
||||
{
|
||||
forceSSL = true;
|
||||
extraConfig = ''
|
||||
client_max_body_size 512M;
|
||||
'';
|
||||
locations."/".proxyPass = "${localhost}:3000";
|
||||
}
|
||||
// std;
|
||||
in {
|
||||
"dobutterfliescry.net" =
|
||||
{
|
||||
default = true;
|
||||
addSSL = true; # not strictly enforced <3
|
||||
# root = "/var/www/cry";
|
||||
root = "${pkgs.dobutterfliescry-net}/www";
|
||||
# extraConfig = ''
|
||||
# error_page 404 /custom_404.html;
|
||||
# '';
|
||||
}
|
||||
// std;
|
||||
# Route "vault" subdomain to vaultwarden
|
||||
"vault.imbored.dev" = vault;
|
||||
# Route "forge" subdomain to forgejo
|
||||
# TODO: use `forgejo.settings.server.ENABLE_ACME` instead?
|
||||
"forge.dobutterfliescry.net" = forge;
|
||||
};
|
||||
};
|
||||
}
|
||||
25
hosts/hyrule/services/vaultwarden.nix
Normal file
25
hosts/hyrule/services/vaultwarden.nix
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
{...}: {
|
||||
services.vaultwarden = {
|
||||
enable = true;
|
||||
dbBackend = "sqlite";
|
||||
|
||||
# backupDir = "/var/backup/vaultwarden"; # disable with null
|
||||
|
||||
# https://mynixos.com/nixpkgs/option/services.vaultwarden.config
|
||||
config = {
|
||||
# internal address and port to listen on
|
||||
ROCKET_ADDRESS = "127.0.0.1";
|
||||
ROCKET_PORT = 8222;
|
||||
|
||||
# hostname to listen for
|
||||
DOMAIN = "https://vault.imbored.dev";
|
||||
|
||||
# signup policy
|
||||
SIGNUPS_ALLOWED = false;
|
||||
SIGNUPS_VERIFY = true;
|
||||
INVITATIONS_ALLOWED = true;
|
||||
};
|
||||
# https://mynixos.com/nixpkgs/option/services.vaultwarden.environmentFile
|
||||
environmentFile = "/var/lib/vaultwarden/vaultwarden.env";
|
||||
};
|
||||
}
|
||||
|
|
@ -263,8 +263,10 @@ in {
|
|||
wl-clipboard # clipboard for wayland
|
||||
hyprpicker # color picker
|
||||
hyprshot # screenshot utility
|
||||
wl-screenrec # screen recording utility
|
||||
qbittorrent # torrenting
|
||||
signal-desktop
|
||||
video-trimmer
|
||||
|
||||
(callPackage ../sddm-theme-corners.nix {}).sddm-theme-corners
|
||||
# dependencies for my sddm theme:
|
||||
|
|
@ -280,8 +282,6 @@ in {
|
|||
|
||||
# Systems Emulation
|
||||
qemu # Fellice Bellard's Quick Emulator
|
||||
# GNU Utils
|
||||
gnumake
|
||||
# Binaries
|
||||
binutils
|
||||
strace
|
||||
|
|
@ -296,13 +296,14 @@ in {
|
|||
# C Family
|
||||
gcc
|
||||
clang
|
||||
|
||||
clang-tools
|
||||
gnumake
|
||||
cmake
|
||||
|
||||
# Rust
|
||||
cargo
|
||||
rustc
|
||||
rustfmt
|
||||
rust-analyzer
|
||||
# Go
|
||||
go
|
||||
# Nim
|
||||
|
|
@ -311,16 +312,12 @@ in {
|
|||
# Haskell
|
||||
ghc
|
||||
ghcid
|
||||
haskell-language-server
|
||||
ormolu
|
||||
|
||||
# Nix
|
||||
# TODO: once upgraded past Nix-24.07 this line won't be necessary (I think)
|
||||
# helix will support nixd by default
|
||||
# SOURCE: https://github.com/nix-community/nixd/blob/main/nixd/docs/editor-setup.md#Helix
|
||||
nixd # lsp for nix
|
||||
nix-prefetch-git
|
||||
nix-index
|
||||
nix-unit
|
||||
deploy-rs
|
||||
|
||||
# Python
|
||||
|
|
|
|||
|
|
@ -2,22 +2,26 @@
|
|||
# I want to use fish as my login shell but it always goes terrible
|
||||
# cause it isn't POSIX compliant, so instead Bash is my login and
|
||||
# will just exec fish (^-^)
|
||||
programs.bash = {
|
||||
blesh.enable = false; # ble.sh replacement for GNU readline
|
||||
completion.enable = true;
|
||||
programs = {
|
||||
fish.enable = true;
|
||||
|
||||
interactiveShellInit = ''
|
||||
# help bash transition into a beautiful fish!
|
||||
if [[ -z $CRY_BASH_IS_TRANS ]]
|
||||
then
|
||||
if [[ $(${pkgs.procps}/bin/ps --no-header --pid=$PPID --format=comm) != "fish" && -z ''${BASH_EXECUTION_STRING} ]]
|
||||
bash = {
|
||||
blesh.enable = false; # ble.sh replacement for GNU readline
|
||||
completion.enable = true;
|
||||
|
||||
interactiveShellInit = ''
|
||||
# help bash transition into a beautiful fish!
|
||||
if [[ -z $CRY_BASH_IS_TRANS ]]
|
||||
then
|
||||
shopt -q login_shell && LOGIN_OPTION='--login' || LOGIN_OPTION=""
|
||||
exec ${pkgs.fish}/bin/fish $LOGIN_OPTION
|
||||
if [[ $(${pkgs.procps}/bin/ps --no-header --pid=$PPID --format=comm) != "fish" && -z ''${BASH_EXECUTION_STRING} ]]
|
||||
then
|
||||
shopt -q login_shell && LOGIN_OPTION='--login' || LOGIN_OPTION=""
|
||||
exec ${pkgs.fish}/bin/fish $LOGIN_OPTION
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
# bash is trans now! (no more transitioning required)
|
||||
export CRY_BASH_IS_TRANS=true
|
||||
'';
|
||||
# bash is trans now! (no more transitioning required)
|
||||
export CRY_BASH_IS_TRANS=true
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -311,19 +311,9 @@ in {
|
|||
# Haskell
|
||||
ghc
|
||||
ghcid
|
||||
haskell-language-server
|
||||
ormolu
|
||||
|
||||
# Java
|
||||
# jdk17
|
||||
# (jre8.overrideAttrs
|
||||
# (oldAttrs: {
|
||||
# enableJavaFX = true;
|
||||
# }))
|
||||
# (jdk8.overrideAttrs
|
||||
# (oldAttrs: {
|
||||
# enableJavaFX = true;
|
||||
# }))
|
||||
visualvm
|
||||
|
||||
# Python
|
||||
|
|
@ -362,11 +352,6 @@ in {
|
|||
|
||||
tesseract # for my work with Agribit
|
||||
|
||||
# TODO: once upgraded past Nix-24.07 this line won't be necessary (I think)
|
||||
# helix will support nixd by default
|
||||
# SOURCE: https://github.com/nix-community/nixd/blob/main/nixd/docs/editor-setup.md#Helix
|
||||
# nixd # lsp for nix # DEBUG
|
||||
|
||||
# Pretty necessary
|
||||
git
|
||||
git-filter-repo
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue