WIP: add home-assistant proxy to router

2025-06-22 22:38:28 -07:00
15 changed files with 39 additions and 239 deletions
--- a/flake.lock
+++ b/flake.lock
@@ -1,79 +1,5 @@
 {
  "nodes": {
-    "crane": {
-      "locked": {
-        "lastModified": 1754269165,
-        "narHash": "sha256-0tcS8FHd4QjbCVoxN9jI+PjHgA4vc/IjkUSp+N3zy0U=",
-        "owner": "ipetkov",
-        "repo": "crane",
-        "rev": "444e81206df3f7d92780680e45858e31d2f07a08",
-        "type": "github"
-      },
-      "original": {
-        "owner": "ipetkov",
-        "repo": "crane",
-        "type": "github"
-      }
-    },
-    "flake-compat": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1747046372,
-        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
-        "type": "github"
-      },
-      "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
-    "flake-parts": {
-      "inputs": {
-        "nixpkgs-lib": [
-          "lanzaboote",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1754091436,
-        "narHash": "sha256-XKqDMN1/Qj1DKivQvscI4vmHfDfvYR2pfuFOJiCeewM=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "67df8c627c2c39c41dbec76a1f201929929ab0bd",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "gitignore": {
-      "inputs": {
-        "nixpkgs": [
-          "lanzaboote",
-          "pre-commit-hooks-nix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1709087332,
-        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
-        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
-        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
-        "type": "github"
-      }
-    },
    "home-manager": {
      "inputs": {
        "nixpkgs": [
@@ -81,11 +7,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1765480374,
-        "narHash": "sha256-HlbvQAqLx7WqZFFQZ8nu5UUJAVlXiV/kqKbyueA8srw=",
+        "lastModified": 1750650909,
+        "narHash": "sha256-HRNJuqo15PRKezyBjhNf2Tjj05EcSJ8q6xJyDDbmDXE=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "39cb677ed9e908e90478aa9fe5f3383dfc1a63f3",
+        "rev": "520fc4b50af1b365014c3748c126d3f52edb2f3b",
        "type": "github"
      },
      "original": {
@@ -94,32 +20,6 @@
        "type": "github"
      }
    },
-    "lanzaboote": {
-      "inputs": {
-        "crane": "crane",
-        "flake-compat": "flake-compat",
-        "flake-parts": "flake-parts",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "pre-commit-hooks-nix": "pre-commit-hooks-nix",
-        "rust-overlay": "rust-overlay"
-      },
-      "locked": {
-        "lastModified": 1762205063,
-        "narHash": "sha256-If6vQ+KvtKs3ARBO9G3l+4wFSCYtRBrwX1z+I+B61wQ=",
-        "owner": "nix-community",
-        "repo": "lanzaboote",
-        "rev": "88b8a563ff5704f4e8d8e5118fb911fa2110ca05",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "ref": "v0.4.3",
-        "repo": "lanzaboote",
-        "type": "github"
-      }
-    },
    "nixlib": {
      "locked": {
        "lastModified": 1736643958,
@@ -143,11 +43,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1764234087,
-        "narHash": "sha256-NHF7QWa0ZPT8hsJrvijREW3+nifmF2rTXgS2v0tpcEA=",
+        "lastModified": 1747663185,
+        "narHash": "sha256-Obh50J+O9jhUM/FgXtI3he/QRNiV9+J53+l+RlKSaAk=",
        "owner": "nix-community",
        "repo": "nixos-generators",
-        "rev": "032a1878682fafe829edfcf5fdfad635a2efe748",
+        "rev": "ee07ba0d36c38e9915c55d2ac5a8fb0f05f2afcc",
        "type": "github"
      },
      "original": {
@@ -158,11 +58,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1765186076,
-        "narHash": "sha256-hM20uyap1a0M9d344I692r+ik4gTMyj60cQWO+hAYP8=",
+        "lastModified": 1750506804,
+        "narHash": "sha256-VLFNc4egNjovYVxDGyBYTrvVCgDYgENp5bVi9fPTDYc=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "addf7cf5f383a3101ecfba091b98d0a1263dc9b8",
+        "rev": "4206c4cb56751df534751b058295ea61357bbbaa",
        "type": "github"
      },
      "original": {
@@ -182,11 +82,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1763909441,
-        "narHash": "sha256-56LwV51TX/FhgX+5LCG6akQ5KrOWuKgcJa+eUsRMxsc=",
+        "lastModified": 1748196248,
+        "narHash": "sha256-1iHjsH6/5UOerJEoZKE+Gx1BgAoge/YcnUsOA4wQ/BU=",
        "owner": "nix-community",
        "repo": "plasma-manager",
-        "rev": "b24ed4b272256dfc1cc2291f89a9821d5f9e14b4",
+        "rev": "b7697abe89967839b273a863a3805345ea54ab56",
        "type": "github"
      },
      "original": {
@@ -195,63 +95,15 @@
        "type": "github"
      }
    },
-    "pre-commit-hooks-nix": {
-      "inputs": {
-        "flake-compat": [
-          "lanzaboote",
-          "flake-compat"
-        ],
-        "gitignore": "gitignore",
-        "nixpkgs": [
-          "lanzaboote",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1750779888,
-        "narHash": "sha256-wibppH3g/E2lxU43ZQHC5yA/7kIKLGxVEnsnVK1BtRg=",
-        "owner": "cachix",
-        "repo": "pre-commit-hooks.nix",
-        "rev": "16ec914f6fb6f599ce988427d9d94efddf25fe6d",
-        "type": "github"
-      },
-      "original": {
-        "owner": "cachix",
-        "repo": "pre-commit-hooks.nix",
-        "type": "github"
-      }
-    },
    "root": {
      "inputs": {
        "home-manager": "home-manager",
-        "lanzaboote": "lanzaboote",
        "nixos-generators": "nixos-generators",
        "nixpkgs": "nixpkgs",
        "plasma-manager": "plasma-manager",
        "secrix": "secrix"
      }
    },
-    "rust-overlay": {
-      "inputs": {
-        "nixpkgs": [
-          "lanzaboote",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1761791894,
-        "narHash": "sha256-myRIDh+PxaREz+z9LzbqBJF+SnTFJwkthKDX9zMyddY=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "59c45eb69d9222a4362673141e00ff77842cd219",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    },
    "secrix": {
      "inputs": {
        "nixpkgs": [
@@ -259,11 +111,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1763929380,
-        "narHash": "sha256-Yc7gZME/lcHoJH6bMPCG7CyjKWhOLJPqLI8MXtyKPHo=",
+        "lastModified": 1746643487,
+        "narHash": "sha256-dcB/DArJObCvqE/ZEdQSDW2BZMeDyF83Se5KPfJvz60=",
        "owner": "Platonic-Systems",
        "repo": "secrix",
-        "rev": "c6e3ca7af47c329dcf442a3d017ae171eee5612f",
+        "rev": "4c64203fa5b377953b1fb6d5388187df8b60c6d5",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@@ -22,20 +22,16 @@
      url = "github:Platonic-Systems/secrix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
-    lanzaboote = {
-      url = "github:nix-community/lanzaboote/v0.4.3";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
  };

-  outputs = { self, nixpkgs, home-manager, plasma-manager, nixos-generators, secrix, lanzaboote }:
+  outputs = { self, nixpkgs, home-manager, plasma-manager, nixos-generators, secrix }:
  let
    hmModule = file: {
      imports = [ home-manager.nixosModules.home-manager ];

      home-manager.useGlobalPkgs = true;
      home-manager.useUserPackages = true;
-      home-manager.sharedModules = [ plasma-manager.homeModules.plasma-manager ];
+      home-manager.sharedModules = [ plasma-manager.homeManagerModules.plasma-manager ];

      home-manager.users.cazzzer = import file;
      # Optionally, use home-manager.extraSpecialArgs to pass
@@ -74,7 +70,6 @@
      Yura-TPX13 = nixpkgs.lib.nixosSystem {
        system = "x86_64-linux";
        modules = [
-          lanzaboote.nixosModules.lanzaboote
          ./modules
          ./hosts/common.nix
          ./hosts/common-desktop.nix
--- a/home/modules/git.nix
+++ b/home/modules/git.nix
@@ -7,24 +7,22 @@ in
 {
  programs.git = {
    enable = true;
-    
+
+    userName = name;
+    userEmail = email;
+
    signing = {
      key = signingKey;
      signByDefault = true;
      format = "ssh";
    };

-    settings = {
-      user = {
-        name = name;
-        email = email;
-      };
-      
-      alias = {
-        co = "checkout";
-        s = "switch";
-      };
-      
+    aliases = {
+      co = "checkout";
+      s = "switch";
+    };
+
+    extraConfig = {
      url = {
        "https://gitea.cazzzer.com/" = {
          insteadOf = "caztea:";
--- a/home/modules/plasma.nix
+++ b/home/modules/plasma.nix
@@ -55,8 +55,6 @@
        activities-icons."809dc779-bf5b-49e6-8e3f-cbe283cb05b6" = "keyboard";
        activities-icons."b34a506d-ac4f-4797-8c08-6ef45bc49341" = "preferences-desktop-gaming";
      };
-      baloofilerc.General."exclude folders".persistent = true;
-      systemsettingsrc.systemsettings_sidebar_mode.HighlightNonDefaultSettings=true;
    };
  };

--- a/hosts/Yura-PC/hardware-configuration.nix
+++ b/hosts/Yura-PC/hardware-configuration.nix
@@ -18,11 +18,6 @@
      fsType = "zfs";
    };

-  fileSystems."/nix" =
-    { device = "zroot/data/nix";
-      fsType = "zfs";
-    };
-
  fileSystems."/boot" =
    { device = "/dev/disk/by-uuid/970C-6A15";
      fsType = "vfat";
--- a/hosts/Yura-TPX13/default.nix
+++ b/hosts/Yura-TPX13/default.nix
@@ -11,18 +11,10 @@
    "sysrq_always_enabled=1"
  ];

-  boot.loader.systemd-boot.enable = false;
-  boot.lanzaboote = {
-    enable = true;
-    pkiBundle = "/var/lib/sbctl";
-  };
-
  networking.hostName = "Yura-TPX13"; # Define your hostname.
  networking.hostId = "8425e349"; # Required for ZFS.

  services.fprintd.enable = true;
-  security.pam.services.login.fprintAuth = false;
-

  # Install firefox.
  programs.firefox.enable = true;
--- a/hosts/common-desktop.nix
+++ b/hosts/common-desktop.nix
@@ -7,11 +7,14 @@
    "sysrq_always_enabled=1"
  ];

-  boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_17;
+  boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_14;
  boot.loader = {
    efi.canTouchEfiVariables = true;
    timeout = 3;
-    systemd-boot.enable = lib.mkDefault true;
+    systemd-boot = {
+      enable = true;
+      configurationLimit = 5;
+    };
  };

  # https://nixos.wiki/wiki/Accelerated_Video_Playback
@@ -21,9 +24,6 @@

  # Enable networking
  networking.networkmanager.enable = true;
-  networking.networkmanager.plugins = [
-    pkgs.networkmanager-openvpn
-  ];

  # Enable the X11 windowing system.
  # You can disable this if you're only using the Wayland session.
@@ -58,7 +58,7 @@
  programs.git.enable = true;
  programs.git.lfs.enable = true;
  # https://nixos.wiki/wiki/Git
-  programs.git.package = pkgs.git.override { withLibsecret = true; doInstallCheck = false; };
+  programs.git.package = pkgs.git.override { withLibsecret = true; };
  programs.lazygit.enable = true;
  programs.neovim.enable = true;
  programs.wireshark.enable = true;
@@ -79,7 +79,7 @@
    fantasque-sans-mono
    nerd-fonts.fantasque-sans-mono
    noto-fonts
-    noto-fonts-color-emoji
+    noto-fonts-emoji
    noto-fonts-cjk-sans
    noto-fonts-cjk-serif
    jetbrains-mono
@@ -107,7 +107,6 @@
    jq
    ldns
    mediainfo
-    powertop
    rbw
    restic
    resticprofile
@@ -121,20 +120,14 @@
    bitwarden-desktop
    darkman
    host-spawn # for flatpaks
-    jellyfin-mpv-shim
    kdePackages.filelight
    kdePackages.flatpak-kcm
    kdePackages.kate
    kdePackages.yakuake
-    (mpv.override {
-      scripts = with pkgs.mpvScripts; [
-        mpris
-        videoclip
-      ];
-    })
+    mpv
    nextcloud-client
    lxqt.pavucontrol-qt
-    pinentry-all
+    pinentry
    tela-circle-icon-theme
    virt-viewer
    waypipe
@@ -148,12 +141,7 @@
    android-studio
    rustup
    zed-editor
-    package-version-server # for zed
  ] ++ [
-    # C
-    gcc
-    valgrind
-    
    # Python
    python3
    poetry
@@ -175,11 +163,5 @@
    # Gleam
    gleam
    beamMinimal26Packages.erlang
-    
-    # Racket
-    racket
-    
-    # Ruby
-    ruby
  ];
 }
--- a/modules/opts/kb-input/default.nix
+++ b/modules/opts/kb-input/default.nix
@@ -45,7 +45,7 @@ in {
      enable = true;
      type = "fcitx5";
      fcitx5.waylandFrontend = true;
-      # fcitx5.plasma6Support = true;
+      fcitx5.plasma6Support = true;
      fcitx5.addons = [ pkgs.fcitx5-mozc ];
    };
  };
--- a/modules/router/default.nix
+++ b/modules/router/default.nix
@@ -76,7 +76,6 @@ in
    starship
    tealdeer
    transcrypt
-    wakeonlan
    waypipe
    whois
    wireguard-tools
--- a/modules/router/dns.nix
+++ b/modules/router/dns.nix
@@ -28,8 +28,6 @@ let
    "|woodpecker."
    "||pgrok."
    "|sync."
-    "|minecruft."
-    "|n8n."
  ];
 in
 {
@@ -89,7 +87,6 @@ in

      # Allowed exceptions
      "@@||googleads.g.doubleclick.net"
-      "@@||stats.grafana.org"
    ]
      # Alpina DNS rewrites
      ++ map (host: "${host}${domain}^$dnsrewrite=debbi.${sysdomain}") alpinaDomains;
--- a/modules/router/firewall.nix
+++ b/modules/router/firewall.nix
@@ -56,12 +56,6 @@ in
              udp . 45608 : ${vars.extra.opnsense.addr4} . 45608,
              udp . 35848 : ${vars.extra.opnsense.addr4} . 35848,
              udp . 48425 : ${vars.extra.opnsense.addr4} . 48425,
-              # Amnezia VPN server
-              udp . 37138 : ${vars.extra.amnezia.addr4} . 37138,
-              # Minecruft server
-              tcp . 25565 : ${vars.extra.minecruft.addr4} . 25565,
-              udp . 25565 : ${vars.extra.minecruft.addr4} . 25565,
-              udp . 24454 : ${vars.extra.minecruft.addr4} . 24454,
          }
      }

--- a/modules/router/secrets/cf-api-key.age
+++ b/modules/router/secrets/cf-api-key.age
--- a/modules/router/services.nix
+++ b/modules/router/services.nix
@@ -58,7 +58,7 @@ in
    enable = true;
    package = pkgs.caddy.withPlugins {
      plugins = [ "github.com/caddy-dns/cloudflare@v0.2.1" ];
-      hash = "sha256-Dvifm7rRwFfgXfcYvXcPDNlMaoxKd5h4mHEK6kJ+T4A=";
+      hash = "sha256-2D7dnG50CwtCho+U+iHmSj2w14zllQXPjmTHr6lJZ/A=";
    };
    virtualHosts."*.${domain}".extraConfig = ''
      encode
--- a/modules/router/vars.nix
+++ b/modules/router/vars.nix
@@ -135,7 +135,5 @@ rec {
        }
      ];
    };
-    amnezia.addr4 = "${ifs.lan10.p4}.31";
-    minecruft.addr4 = "${ifs.lan.p4}.11";
  };
 }
--- a/modules/workarounds/flatpak.nix
+++ b/modules/workarounds/flatpak.nix
@@ -28,7 +28,7 @@ in {
          inherit
            (pkgs)
            noto-fonts
-            noto-fonts-color-emoji
+            noto-fonts-emoji
            noto-fonts-cjk-sans
            noto-fonts-cjk-serif
            ;