desktop: add NetworkManager plugin for OpenVPN

flake.lock

@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749178927,
+        "lastModified": 1752062782,
-        "narHash": "sha256-bXcEx1aZUNm5hMLVJeuofcOrZyOiapzvQ7K36HYK3YQ=",
+        "narHash": "sha256-Dod77HcIByOyfGLEJOgRxg2Fmk2Y5lVgMEcN/xVEt/8=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "91287a0e9d42570754487b7e38c6697e15a9aab2",
+        "rev": "bec8ff39811568eb7c8c8d1e2a1a476326748f51",
         "type": "github"
       },
       "original": {
@@ -43,11 +43,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747663185,
+        "lastModified": 1751903740,
-        "narHash": "sha256-Obh50J+O9jhUM/FgXtI3he/QRNiV9+J53+l+RlKSaAk=",
+        "narHash": "sha256-PeSkNMvkpEvts+9DjFiop1iT2JuBpyknmBUs0Un0a4I=",
         "owner": "nix-community",
         "repo": "nixos-generators",
-        "rev": "ee07ba0d36c38e9915c55d2ac5a8fb0f05f2afcc",
+        "rev": "032decf9db65efed428afd2fa39d80f7089085eb",
         "type": "github"
       },
       "original": {
@@ -58,11 +58,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1748929857,
+        "lastModified": 1751984180,
-        "narHash": "sha256-lcZQ8RhsmhsK8u7LIFsJhsLh/pzR9yZ8yqpTzyGdj+Q=",
+        "narHash": "sha256-LwWRsENAZJKUdD3SpLluwDmdXY9F45ZEgCb0X+xgOL0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c2a03962b8e24e669fb37b7df10e7c79531ff1a4",
+        "rev": "9807714d6944a957c2e036f84b0ff8caf9930bc0",
         "type": "github"
       },
       "original": {

flake.nix

@@ -43,6 +43,7 @@
       modules = [
         secrix.nixosModules.default
         ./modules
+        ./modules/router
         ./hosts/common.nix
         hostFile
         ./users/cazzzer

hosts/Yura-PC/hardware-configuration.nix

@@ -18,6 +18,11 @@
       fsType = "zfs";
     };
 
+  fileSystems."/nix" =
+    { device = "zroot/data/nix";
+      fsType = "zfs";
+    };
+
   fileSystems."/boot" =
     { device = "/dev/disk/by-uuid/970C-6A15";
       fsType = "vfat";

hosts/common-desktop.nix

@@ -7,7 +7,7 @@
     "sysrq_always_enabled=1"
   ];
 
-  boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_14;
+  boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_15;
   boot.loader = {
     efi.canTouchEfiVariables = true;
     timeout = 3;
@@ -24,6 +24,9 @@
 
   # Enable networking
   networking.networkmanager.enable = true;
+  networking.networkmanager.plugins = [
+    pkgs.networkmanager-openvpn
+  ];
 
   # Enable the X11 windowing system.
   # You can disable this if you're only using the Wayland session.
@@ -107,6 +110,7 @@
     jq
     ldns
     mediainfo
+    powertop
     rbw
     restic
     resticprofile

hosts/router-1/default.nix

@@ -1,6 +1,5 @@
 {
   imports = [
-    ../../modules/router
     ../hw-vm.nix
   ];
 

hosts/router-2/default.nix

@@ -1,6 +1,5 @@
 {
   imports = [
-    ../../modules/router
     ../hw-vm.nix
   ];
 

hosts/router/default.nix

@@ -1,6 +1,5 @@
 {
   imports = [
-    ../../modules/router
     ./hardware-configuration.nix
     ./private.nix
   ];

modules/router/default.nix

@@ -76,6 +76,7 @@ in
     starship
     tealdeer
     transcrypt
+    wakeonlan
     waypipe
     whois
     wireguard-tools

modules/router/dns.nix

@@ -80,11 +80,14 @@ in
       "|etappi.${sysdomain}^$dnsrewrite=${ifs.lan.p4}.12"
       "|etappi.${sysdomain}^$dnsrewrite=${ifs.lan.ulaPrefix}::12:1"
 
+      "|hass.${domain}^$dnsrewrite=${ifs.lan.ulaAddr}"
+
       # Lab DNS rewrites
       "||lab.${domain}^$dnsrewrite=etappi.${sysdomain}"
 
       # Allowed exceptions
       "@@||googleads.g.doubleclick.net"
+      "@@||stats.grafana.org"
     ]
       # Alpina DNS rewrites
       ++ map (host: "${host}${domain}^$dnsrewrite=debbi.${sysdomain}") alpinaDomains;

modules/router/services.nix

@@ -58,14 +58,17 @@ in
     enable = true;
     package = pkgs.caddy.withPlugins {
       plugins = [ "github.com/caddy-dns/cloudflare@v0.2.1" ];
-      hash = "sha256-Gsuo+ripJSgKSYOM9/yl6Kt/6BFCA6BuTDvPdteinAI=";
+      hash = "sha256-2D7dnG50CwtCho+U+iHmSj2w14zllQXPjmTHr6lJZ/A=";
     };
-    virtualHosts."grouter.${domain}".extraConfig = ''
+    virtualHosts."*.${domain}".extraConfig = ''
       encode
       tls {
           dns cloudflare {env.CF_API_KEY}
           resolvers 1.1.1.1
       }
+
+      @grouter host grouter.${domain}
+      handle @grouter {
           @grafana path /grafana /grafana/*
           handle @grafana {
               reverse_proxy localhost:${toString config.services.grafana.settings.server.http_port}
@@ -80,6 +83,12 @@ in
           handle /* {
               reverse_proxy localhost:${toString config.services.glance.settings.server.port}
           }
+      }
+
+      @hass host hass.${domain}
+      handle @hass {
+          reverse_proxy homeassistant.4.lab.l.cazzzer.com:8123
+      }
     '';
   };
 }

users/cazzzer/default.nix

@@ -5,7 +5,7 @@
     isNormalUser = true;
     description = "Yura";
     group = "cazzzer";
-    extraGroups = [ "wheel" ]
+    extraGroups = [ "wheel" "dialout" ]
       ++ lib.optionals config.networking.networkmanager.enable [ "networkmanager" ]
       ++ lib.optionals config.virtualisation.docker.enable [ "docker" ]
       ++ lib.optionals config.programs.wireshark.enable [ "wireshark" ]