Compare commits
4
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 CaZzzer
|
17e98fa091
|
||
|
CaZzzer
|
ff7e27cc62
|
||
|
CaZzzer
|
3dea018a21
|
||
|
CaZzzer
|
94a8d00b28
|
Generated
+15
-137
@@ -1,58 +1,5 @@
|
||||
{
|
||||
"nodes": {
|
||||
"crane": {
|
||||
"locked": {
|
||||
"lastModified": 1781825982,
|
||||
"narHash": "sha256-SlXKwIRIhrOSAcTjCB3ftPLzJWZStQIPS7J1FlZPnKk=",
|
||||
"owner": "ipetkov",
|
||||
"repo": "crane",
|
||||
"rev": "469fd08d0bcf6926321fa973c6777fbc87785dd7",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "ipetkov",
|
||||
"repo": "crane",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-compat": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1767039857,
|
||||
"narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
|
||||
"owner": "NixOS",
|
||||
"repo": "flake-compat",
|
||||
"rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"repo": "flake-compat",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"gitignore": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"lanzaboote",
|
||||
"pre-commit",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1709087332,
|
||||
"narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
|
||||
"owner": "hercules-ci",
|
||||
"repo": "gitignore.nix",
|
||||
"rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "hercules-ci",
|
||||
"repo": "gitignore.nix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"home-manager": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
@@ -60,11 +7,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1791642191,
|
||||
"narHash": "sha256-0bK0A59rVUn1SRZzo4cNi4VSqAe7vR1gL2/MZl53Frw=",
|
||||
"lastModified": 1749178927,
|
||||
"narHash": "sha256-bXcEx1aZUNm5hMLVJeuofcOrZyOiapzvQ7K36HYK3YQ=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "c58f54c733a7894d84fa2fdff26cc12088c4b78c",
|
||||
"rev": "91287a0e9d42570754487b7e38c6697e15a9aab2",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -73,30 +20,6 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"lanzaboote": {
|
||||
"inputs": {
|
||||
"crane": "crane",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
],
|
||||
"pre-commit": "pre-commit",
|
||||
"rust-overlay": "rust-overlay"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1782141370,
|
||||
"narHash": "sha256-hqijVSEETttmo8Okql9/LG0Ua34hdciKW1a5zzlj8mU=",
|
||||
"owner": "nix-community",
|
||||
"repo": "lanzaboote",
|
||||
"rev": "7c9a54a7f87b4539ddbd8bda09a8a5f5f9361aa9",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"ref": "v1.1.0",
|
||||
"repo": "lanzaboote",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixlib": {
|
||||
"locked": {
|
||||
"lastModified": 1736643958,
|
||||
@@ -120,11 +43,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1769813415,
|
||||
"narHash": "sha256-nnVmNNKBi1YiBNPhKclNYDORoHkuKipoz7EtVnXO50A=",
|
||||
"lastModified": 1747663185,
|
||||
"narHash": "sha256-Obh50J+O9jhUM/FgXtI3he/QRNiV9+J53+l+RlKSaAk=",
|
||||
"owner": "nix-community",
|
||||
"repo": "nixos-generators",
|
||||
"rev": "8946737ff703382fda7623b9fab071d037e897d5",
|
||||
"rev": "ee07ba0d36c38e9915c55d2ac5a8fb0f05f2afcc",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -135,11 +58,11 @@
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1791594108,
|
||||
"narHash": "sha256-XK4KceonkwD8LuMAt/vNrz982mXJM5jeHAxMwsUXXAQ=",
|
||||
"lastModified": 1748929857,
|
||||
"narHash": "sha256-lcZQ8RhsmhsK8u7LIFsJhsLh/pzR9yZ8yqpTzyGdj+Q=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "6510408d147d8c5e6d76043e899e9251756f6a75",
|
||||
"rev": "c2a03962b8e24e669fb37b7df10e7c79531ff1a4",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -159,11 +82,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1785762349,
|
||||
"narHash": "sha256-jZhZkzAwc7f3exzcTDJWP2WCAchCv0iNC3UF/QsahdQ=",
|
||||
"lastModified": 1748196248,
|
||||
"narHash": "sha256-1iHjsH6/5UOerJEoZKE+Gx1BgAoge/YcnUsOA4wQ/BU=",
|
||||
"owner": "nix-community",
|
||||
"repo": "plasma-manager",
|
||||
"rev": "a19a2a029fa180911bd89c554dca1616e10f4c1d",
|
||||
"rev": "b7697abe89967839b273a863a3805345ea54ab56",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -172,60 +95,15 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"pre-commit": {
|
||||
"inputs": {
|
||||
"flake-compat": "flake-compat",
|
||||
"gitignore": "gitignore",
|
||||
"nixpkgs": [
|
||||
"lanzaboote",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1781733627,
|
||||
"narHash": "sha256-U3yTuGBnmXvXoQI3qkpfEDsn9RovQPAjN7ndRco+3u0=",
|
||||
"owner": "cachix",
|
||||
"repo": "pre-commit-hooks.nix",
|
||||
"rev": "3bbec39bc90eadfa031e6f3b77272f3f60803e39",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "cachix",
|
||||
"repo": "pre-commit-hooks.nix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"home-manager": "home-manager",
|
||||
"lanzaboote": "lanzaboote",
|
||||
"nixos-generators": "nixos-generators",
|
||||
"nixpkgs": "nixpkgs",
|
||||
"plasma-manager": "plasma-manager",
|
||||
"secrix": "secrix"
|
||||
}
|
||||
},
|
||||
"rust-overlay": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"lanzaboote",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1782012058,
|
||||
"narHash": "sha256-9mWUnReOUXfKjZuJAL/bAFH3LUyECTRtXgSNVjRw3UY=",
|
||||
"owner": "oxalica",
|
||||
"repo": "rust-overlay",
|
||||
"rev": "8534567325bd8a8d2928e6afd81e0a87d19efd3c",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "oxalica",
|
||||
"repo": "rust-overlay",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"secrix": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
@@ -233,11 +111,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1787124737,
|
||||
"narHash": "sha256-EnQcFCdcQs1agb8U/h3kn7+A3c3uorANCPP2WakZjAk=",
|
||||
"lastModified": 1746643487,
|
||||
"narHash": "sha256-dcB/DArJObCvqE/ZEdQSDW2BZMeDyF83Se5KPfJvz60=",
|
||||
"owner": "Platonic-Systems",
|
||||
"repo": "secrix",
|
||||
"rev": "9c0a7db4e355c28fe67643656821b06161b4df61",
|
||||
"rev": "4c64203fa5b377953b1fb6d5388187df8b60c6d5",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
||||
@@ -22,20 +22,16 @@
|
||||
url = "github:Platonic-Systems/secrix";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
lanzaboote = {
|
||||
url = "github:nix-community/lanzaboote/v1.1.0";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
};
|
||||
|
||||
outputs = { self, nixpkgs, home-manager, plasma-manager, nixos-generators, secrix, lanzaboote }:
|
||||
outputs = { self, nixpkgs, home-manager, plasma-manager, nixos-generators, secrix }:
|
||||
let
|
||||
hmModule = file: {
|
||||
imports = [ home-manager.nixosModules.home-manager ];
|
||||
|
||||
home-manager.useGlobalPkgs = true;
|
||||
home-manager.useUserPackages = true;
|
||||
home-manager.sharedModules = [ plasma-manager.homeModules.plasma-manager ];
|
||||
home-manager.sharedModules = [ plasma-manager.homeManagerModules.plasma-manager ];
|
||||
|
||||
home-manager.users.cazzzer = import file;
|
||||
# Optionally, use home-manager.extraSpecialArgs to pass
|
||||
@@ -74,7 +70,6 @@
|
||||
Yura-TPX13 = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [
|
||||
lanzaboote.nixosModules.lanzaboote
|
||||
./modules
|
||||
./hosts/common.nix
|
||||
./hosts/common-desktop.nix
|
||||
|
||||
@@ -5,11 +5,11 @@
|
||||
enable = true;
|
||||
shellInit = "set fish_greeting";
|
||||
shellAliases = {
|
||||
# Replace ls with eza
|
||||
ls = "eza -al --color=always --group-directories-first --icons=always"; # preferred listing
|
||||
la = "eza -a --color=always --group-directories-first --icons=always"; # all files and dirs
|
||||
ll = "eza -l --color=always --group-directories-first --icons=always"; # long format
|
||||
lt = "eza -aT --color=always --group-directories-first --icons=always"; # tree listing
|
||||
# Replace ls with exa
|
||||
ls = "exa -al --color=always --group-directories-first --icons"; # preferred listing
|
||||
la = "exa -a --color=always --group-directories-first --icons"; # all files and dirs
|
||||
ll = "exa -l --color=always --group-directories-first --icons"; # long format
|
||||
lt = "exa -aT --color=always --group-directories-first --icons"; # tree listing
|
||||
"l." = "exa -a | rg '^\.'"; # show only dotfiles
|
||||
|
||||
# Replace cat with bat
|
||||
|
||||
+10
-12
@@ -7,24 +7,22 @@ in
|
||||
{
|
||||
programs.git = {
|
||||
enable = true;
|
||||
|
||||
|
||||
userName = name;
|
||||
userEmail = email;
|
||||
|
||||
signing = {
|
||||
key = signingKey;
|
||||
signByDefault = true;
|
||||
format = "ssh";
|
||||
};
|
||||
|
||||
settings = {
|
||||
user = {
|
||||
name = name;
|
||||
email = email;
|
||||
};
|
||||
|
||||
alias = {
|
||||
co = "checkout";
|
||||
s = "switch";
|
||||
};
|
||||
|
||||
aliases = {
|
||||
co = "checkout";
|
||||
s = "switch";
|
||||
};
|
||||
|
||||
extraConfig = {
|
||||
url = {
|
||||
"https://gitea.cazzzer.com/" = {
|
||||
insteadOf = "caztea:";
|
||||
|
||||
@@ -55,8 +55,6 @@
|
||||
activities-icons."809dc779-bf5b-49e6-8e3f-cbe283cb05b6" = "keyboard";
|
||||
activities-icons."b34a506d-ac4f-4797-8c08-6ef45bc49341" = "preferences-desktop-gaming";
|
||||
};
|
||||
baloofilerc.General."exclude folders".persistent = true;
|
||||
systemsettingsrc.systemsettings_sidebar_mode.HighlightNonDefaultSettings=true;
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
@@ -31,10 +31,6 @@
|
||||
intel-media-driver # LIBVA_DRIVER_NAME=iHD
|
||||
];
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
lmstudio
|
||||
];
|
||||
|
||||
networking.hostName = "Yura-PC"; # Define your hostname.
|
||||
networking.hostId = "110a2814"; # Required for ZFS.
|
||||
|
||||
|
||||
@@ -18,11 +18,6 @@
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
fileSystems."/nix" =
|
||||
{ device = "zroot/data/nix";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/970C-6A15";
|
||||
fsType = "vfat";
|
||||
|
||||
@@ -11,18 +11,10 @@
|
||||
"sysrq_always_enabled=1"
|
||||
];
|
||||
|
||||
boot.loader.systemd-boot.enable = false;
|
||||
boot.lanzaboote = {
|
||||
enable = true;
|
||||
pkiBundle = "/var/lib/sbctl";
|
||||
};
|
||||
|
||||
networking.hostName = "Yura-TPX13"; # Define your hostname.
|
||||
networking.hostId = "8425e349"; # Required for ZFS.
|
||||
|
||||
services.fprintd.enable = true;
|
||||
security.pam.services.login.fprintAuth = false;
|
||||
|
||||
|
||||
# Install firefox.
|
||||
programs.firefox.enable = true;
|
||||
|
||||
+19
-67
@@ -7,20 +7,15 @@
|
||||
"sysrq_always_enabled=1"
|
||||
];
|
||||
|
||||
boot.kernelPackages = pkgs.linuxKernel.packages.linux_7_2;
|
||||
boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_14;
|
||||
boot.loader = {
|
||||
efi.canTouchEfiVariables = true;
|
||||
timeout = 3;
|
||||
systemd-boot.enable = lib.mkDefault true;
|
||||
systemd-boot = {
|
||||
enable = true;
|
||||
configurationLimit = 5;
|
||||
};
|
||||
};
|
||||
boot.kernel.sysctl = {
|
||||
# https://wiki.archlinux.org/title/Zram#Optimizing_swap_on_zram
|
||||
"vm.swappiness" = 180;
|
||||
"vm.watermark_boost_factor" = 0;
|
||||
"vm.watermark_scale_factor" = 125;
|
||||
"vm.page-cluster" = 0;
|
||||
};
|
||||
zramSwap.enable = true;
|
||||
|
||||
# https://nixos.wiki/wiki/Accelerated_Video_Playback
|
||||
hardware.graphics.enable = true;
|
||||
@@ -29,16 +24,14 @@
|
||||
|
||||
# Enable networking
|
||||
networking.networkmanager.enable = true;
|
||||
networking.networkmanager.plugins = [
|
||||
pkgs.networkmanager-openvpn
|
||||
];
|
||||
|
||||
# Enable the X11 windowing system.
|
||||
# You can disable this if you're only using the Wayland session.
|
||||
services.xserver.enable = false;
|
||||
|
||||
# Enable the KDE Plasma Desktop Environment.
|
||||
services.displayManager.plasma-login-manager.enable = true;
|
||||
services.displayManager.sddm.enable = true;
|
||||
services.displayManager.sddm.wayland.enable = true;
|
||||
services.desktopManager.plasma6.enable = true;
|
||||
|
||||
# Enable CUPS to print documents.
|
||||
@@ -65,28 +58,28 @@
|
||||
programs.git.enable = true;
|
||||
programs.git.lfs.enable = true;
|
||||
# https://nixos.wiki/wiki/Git
|
||||
programs.git.package = pkgs.git.override { withLibsecret = true; doInstallCheck = false; };
|
||||
programs.git.package = pkgs.git.override { withLibsecret = true; };
|
||||
programs.lazygit.enable = true;
|
||||
programs.neovim.enable = true;
|
||||
programs.wireshark.enable = true;
|
||||
programs.wireshark.package = pkgs.wireshark; # wireshark-cli by default
|
||||
programs.bat.enable = true;
|
||||
programs.htop.enable = true;
|
||||
programs.nix-ld.enable = true;
|
||||
# programs.steam.enable = true;
|
||||
|
||||
# https://nixos.wiki/wiki/Docker
|
||||
virtualisation.docker.enable = true;
|
||||
virtualisation.docker.enableOnBoot = false;
|
||||
virtualisation.docker.package = pkgs.docker_28;
|
||||
|
||||
# https://github.com/flatpak/flatpak/issues/2861
|
||||
xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
|
||||
|
||||
workarounds.flatpak.enable = true;
|
||||
fonts.packages = with pkgs; [
|
||||
fantasque-sans-mono
|
||||
nerd-fonts.fantasque-sans-mono
|
||||
noto-fonts
|
||||
noto-fonts-color-emoji
|
||||
noto-fonts-emoji
|
||||
noto-fonts-cjk-sans
|
||||
noto-fonts-cjk-serif
|
||||
jetbrains-mono
|
||||
@@ -114,13 +107,12 @@
|
||||
jq
|
||||
ldns
|
||||
mediainfo
|
||||
powertop
|
||||
rbw
|
||||
restic
|
||||
resticprofile
|
||||
rclone
|
||||
ripgrep-all
|
||||
rustscan
|
||||
unrar
|
||||
whois
|
||||
wireguard-tools
|
||||
yt-dlp
|
||||
@@ -128,88 +120,48 @@
|
||||
bitwarden-desktop
|
||||
darkman
|
||||
host-spawn # for flatpaks
|
||||
jellyfin-mpv-shim
|
||||
kdePackages.filelight
|
||||
kdePackages.flatpak-kcm
|
||||
kdePackages.kate
|
||||
kdePackages.yakuake
|
||||
(mpv.override {
|
||||
scripts = with pkgs.mpvScripts; [
|
||||
mpris
|
||||
videoclip
|
||||
];
|
||||
})
|
||||
mpv
|
||||
nextcloud-client
|
||||
# lutris
|
||||
lxqt.pavucontrol-qt
|
||||
pinentry-all
|
||||
pinentry
|
||||
tela-circle-icon-theme
|
||||
typst
|
||||
virt-viewer
|
||||
waypipe
|
||||
] ++ [
|
||||
# jetbrains.rust-rover
|
||||
# jetbrains.goland
|
||||
jetbrains.clion
|
||||
# jetbrains.idea
|
||||
jetbrains.pycharm
|
||||
jetbrains.idea-ultimate
|
||||
jetbrains.pycharm-professional
|
||||
jetbrains.webstorm
|
||||
android-studio
|
||||
rustup
|
||||
zed-editor
|
||||
package-version-server # for zed
|
||||
antigravity-cli
|
||||
antigravity-ide-fhs
|
||||
codex
|
||||
# codex-acp
|
||||
# github-copilot-cli
|
||||
# opencode
|
||||
# opencode-desktop
|
||||
] ++ [
|
||||
# C
|
||||
gcc
|
||||
valgrind
|
||||
|
||||
# Python
|
||||
python3
|
||||
poetry
|
||||
|
||||
# Haskell
|
||||
cabal-install
|
||||
haskell-language-server
|
||||
# haskellPackages.hls-cabal-plugin
|
||||
haskellPackages.ghc
|
||||
haskellPackages.stack
|
||||
|
||||
# Node
|
||||
nodejs_24
|
||||
nodejs_22
|
||||
pnpm
|
||||
bun
|
||||
|
||||
# Nix
|
||||
nil
|
||||
nixd
|
||||
nixfmt
|
||||
nixfmt-rfc-style
|
||||
|
||||
# Gleam
|
||||
gleam
|
||||
beamMinimal28Packages.erlang
|
||||
|
||||
# Racket
|
||||
racket
|
||||
|
||||
# Ruby
|
||||
ruby
|
||||
|
||||
# Java
|
||||
zulu
|
||||
|
||||
# spacetimedb
|
||||
] ++ [
|
||||
jujutsu
|
||||
lazyjj
|
||||
jjui
|
||||
# jj-fzf
|
||||
gg-jj
|
||||
beamMinimal26Packages.erlang
|
||||
];
|
||||
}
|
||||
|
||||
@@ -14,12 +14,12 @@
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/0dec41bf-aba0-4b7b-9f61-bbb572e5bd1e";
|
||||
{ device = "/dev/disk/by-uuid/f222513b-ded1-49fa-b591-20ce86a2fe7f";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/9F5E-672F";
|
||||
{ device = "/dev/disk/by-uuid/12CE-A600";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0022" "dmask=0022" ];
|
||||
};
|
||||
|
||||
@@ -70,6 +70,7 @@
|
||||
# https://github.com/flatpak/flatpak/issues/2861
|
||||
xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
|
||||
|
||||
# workarounds.flatpak.enable = true;
|
||||
fonts.packages = with pkgs; [
|
||||
noto-fonts-cjk-sans
|
||||
noto-fonts-cjk-serif
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
{ ... }: {
|
||||
imports = [
|
||||
./opts
|
||||
./workarounds
|
||||
];
|
||||
}
|
||||
|
||||
@@ -45,7 +45,7 @@ in {
|
||||
enable = true;
|
||||
type = "fcitx5";
|
||||
fcitx5.waylandFrontend = true;
|
||||
# fcitx5.plasma6Support = true;
|
||||
fcitx5.plasma6Support = true;
|
||||
fcitx5.addons = [ pkgs.fcitx5-mozc ];
|
||||
};
|
||||
};
|
||||
|
||||
@@ -9,7 +9,6 @@ in
|
||||
./opts.nix
|
||||
./ifconfig.nix
|
||||
./wireguard.nix
|
||||
./tailscale.nix
|
||||
./firewall.nix
|
||||
./dns.nix
|
||||
./kea.nix
|
||||
@@ -28,7 +27,7 @@ in
|
||||
|
||||
boot.loader.timeout = 2;
|
||||
boot.loader.systemd-boot.configurationLimit = 5;
|
||||
boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_18;
|
||||
boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_12;
|
||||
boot.growPartition = true;
|
||||
|
||||
# Enable the X11 windowing system.
|
||||
@@ -77,7 +76,6 @@ in
|
||||
starship
|
||||
tealdeer
|
||||
transcrypt
|
||||
wakeonlan
|
||||
waypipe
|
||||
whois
|
||||
wireguard-tools
|
||||
|
||||
+5
-10
@@ -28,8 +28,6 @@ let
|
||||
"|woodpecker."
|
||||
"||pgrok."
|
||||
"|sync."
|
||||
"|minecruft."
|
||||
"|n8n."
|
||||
];
|
||||
in
|
||||
{
|
||||
@@ -54,17 +52,17 @@ in
|
||||
enable_dnssec = true;
|
||||
bootstrap_dns = [ "1.1.1.1" "9.9.9.9" ];
|
||||
upstream_dns = [
|
||||
# Default upstreams
|
||||
"quic://p0.freedns.controld.com"
|
||||
"tls://one.one.one.one"
|
||||
"tls://dns.quad9.net"
|
||||
|
||||
# Adguard uses upstream and not rewrite rules to resolve cname rewrites,
|
||||
# and obviously my sysdomain entries don't exist in cloudflare.
|
||||
"[/${sysdomain}/][::1]" # Sys domains to self (for cname rewrites)
|
||||
|
||||
"[/${ldomain}/][::1]:1053" # Local domains to Knot (ddns)
|
||||
"[/home/][${ifs.lan.ulaPrefix}::250]" # .home domains to opnsense (temporary)
|
||||
|
||||
# Default upstreams
|
||||
"quic://p0.freedns.controld.com"
|
||||
"tls://one.one.one.one"
|
||||
"tls://dns.quad9.net"
|
||||
];
|
||||
};
|
||||
# https://adguard-dns.io/kb/general/dns-filtering-syntax/
|
||||
@@ -82,14 +80,11 @@ in
|
||||
"|etappi.${sysdomain}^$dnsrewrite=${ifs.lan.p4}.12"
|
||||
"|etappi.${sysdomain}^$dnsrewrite=${ifs.lan.ulaPrefix}::12:1"
|
||||
|
||||
"|hass.${domain}^$dnsrewrite=${ifs.lan.ulaAddr}"
|
||||
|
||||
# Lab DNS rewrites
|
||||
"||lab.${domain}^$dnsrewrite=etappi.${sysdomain}"
|
||||
|
||||
# Allowed exceptions
|
||||
"@@||googleads.g.doubleclick.net"
|
||||
"@@||stats.grafana.org"
|
||||
]
|
||||
# Alpina DNS rewrites
|
||||
++ map (host: "${host}${domain}^$dnsrewrite=debbi.${sysdomain}") alpinaDomains;
|
||||
|
||||
@@ -15,11 +15,6 @@ let
|
||||
${ifs.lan50.name},
|
||||
${ifs.wg0.name},
|
||||
}
|
||||
# Tailscale is its own zone, since tailnet traffic is already filtered by tailscale ACLs
|
||||
# and needs some special handling (exit node NAT with CGNAT/ULA addrs)
|
||||
define ZONE_TAILSCALE_IFS = { ${ifs.ts0.name} }
|
||||
define TAILSCALE_NET4 = ${ifs.ts0.net4}
|
||||
define TAILSCALE_NET6 = ${ifs.ts0.net6}
|
||||
define OPNSENSE_NET6 = ${vars.extra.opnsense.net6}
|
||||
define ZONE_LAN_EXTRA_NET6 = {
|
||||
# TODO: reevaluate this statement
|
||||
@@ -61,13 +56,6 @@ in
|
||||
udp . 45608 : ${vars.extra.opnsense.addr4} . 45608,
|
||||
udp . 35848 : ${vars.extra.opnsense.addr4} . 35848,
|
||||
udp . 48425 : ${vars.extra.opnsense.addr4} . 48425,
|
||||
# Amnezia VPN server
|
||||
udp . 37138 : ${vars.extra.amnezia.addr4} . 37138,
|
||||
tcp . 38247 : ${vars.extra.amnezia.addr4} . 22,
|
||||
# Minecruft server
|
||||
tcp . 25565 : ${vars.extra.minecruft.addr4} . 25565,
|
||||
udp . 25565 : ${vars.extra.minecruft.addr4} . 25565,
|
||||
udp . 24454 : ${vars.extra.minecruft.addr4} . 24454,
|
||||
}
|
||||
}
|
||||
|
||||
@@ -85,8 +73,6 @@ in
|
||||
|
||||
# Masquerade LAN addrs
|
||||
oifname $ZONE_WAN_IFS ip saddr $RFC1918 masquerade
|
||||
# Masquerade tailnet addrs (tailscale exit node)
|
||||
oifname $ZONE_WAN_IFS ip saddr $TAILSCALE_NET4 masquerade
|
||||
}
|
||||
'';
|
||||
};
|
||||
@@ -104,28 +90,12 @@ in
|
||||
'';
|
||||
};
|
||||
|
||||
# IPv6 masquerading for tailnet addrs only (tailscale exit node)
|
||||
# Tailscale only assigns ULAs from $TAILSCALE_NET6, so NAT is unavoidable here
|
||||
networking.nftables.tables.nat6_tailscale = {
|
||||
family = "ip6";
|
||||
content = ''
|
||||
${nftIdentifiers}
|
||||
chain postrouting {
|
||||
type nat hook postrouting priority srcnat; policy accept;
|
||||
oifname $ZONE_WAN_IFS ip6 saddr $TAILSCALE_NET6 masquerade
|
||||
}
|
||||
'';
|
||||
};
|
||||
|
||||
networking.nftables.tables.firewall = {
|
||||
family = "inet";
|
||||
content = ''
|
||||
${nftIdentifiers}
|
||||
define ALLOWED_TCP_PORTS = { ssh }
|
||||
define ALLOWED_UDP_PORTS = {
|
||||
${toString vars.ifs.wg0.listenPort},
|
||||
${toString vars.ifs.ts0.listenPort}, # tailscale direct connections
|
||||
}
|
||||
define ALLOWED_UDP_PORTS = { ${toString vars.ifs.wg0.listenPort} }
|
||||
define ALLOWED_TCP_LAN_PORTS = { ssh, https }
|
||||
define ALLOWED_UDP_LAN_PORTS = { bootps, dhcpv6-server, domain, https }
|
||||
set port_forward_v6 {
|
||||
@@ -184,8 +154,6 @@ in
|
||||
# iifname $ZONE_LAN_IFS accept
|
||||
iifname $ZONE_LAN_IFS jump zone_lan_input
|
||||
ip6 saddr $ZONE_LAN_EXTRA_NET6 jump zone_lan_input
|
||||
# Tailscale zone input rules
|
||||
iifname $ZONE_TAILSCALE_IFS jump zone_tailscale_input
|
||||
|
||||
# log
|
||||
}
|
||||
@@ -201,8 +169,6 @@ in
|
||||
# LAN zone forward rules
|
||||
iifname $ZONE_LAN_IFS jump zone_lan_forward
|
||||
ip6 saddr $ZONE_LAN_EXTRA_NET6 jump zone_lan_forward
|
||||
# Tailscale zone forward rules
|
||||
iifname $ZONE_TAILSCALE_IFS jump zone_tailscale_forward
|
||||
}
|
||||
|
||||
chain zone_wan_input {
|
||||
@@ -242,23 +208,6 @@ in
|
||||
|
||||
# Allow traffic between LANs
|
||||
oifname $ZONE_LAN_IFS accept
|
||||
|
||||
# Allow LAN to reach tailnet (no SNAT, tailnet peers see real LAN addrs)
|
||||
oifname $ZONE_TAILSCALE_IFS accept
|
||||
}
|
||||
|
||||
chain zone_tailscale_input {
|
||||
# Tailnet access is restricted by tailscale ACLs, treat like LAN
|
||||
jump zone_lan_input
|
||||
}
|
||||
|
||||
chain zone_tailscale_forward {
|
||||
# Subnet router: allow tailnet to LANs (advertised routes)
|
||||
oifname $ZONE_LAN_IFS accept
|
||||
|
||||
# Exit node: allow tailnet to WAN (masqueraded in nat4 / nat6_tailscale)
|
||||
oifname $ZONE_WAN_IFS ip saddr $TAILSCALE_NET4 accept
|
||||
oifname $ZONE_WAN_IFS ip6 saddr $TAILSCALE_NET6 accept
|
||||
}
|
||||
|
||||
chain output {
|
||||
|
||||
@@ -52,9 +52,6 @@ in
|
||||
# since my WAN and LAN20 are technically bridged.
|
||||
# https://networkengineering.stackexchange.com/questions/83071/why-linux-answers-arp-requests-for-ips-that-belong-to-different-network-interfac
|
||||
boot.kernel.sysctl."net.ipv4.conf.default.arp_filter" = 1;
|
||||
# Later I discovered that rp_filter might also be good to set
|
||||
# Strict mode (1) drops packets if the src ip isn't a local route on the interface
|
||||
boot.kernel.sysctl."net.ipv4.conf.default.rp_filter" = 1;
|
||||
|
||||
# It is impossible to do multiple prefix requests with networkd,
|
||||
# so I use dhcpcd for this
|
||||
|
||||
Binary file not shown.
@@ -1,5 +0,0 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 D2MY/A txjDSEsRr2CJtC9rDIiY9H8aX0us53vhnqJStt+XvlA
|
||||
vjmrx5ByEhbHE/hBEQq3gRqY8b5/mjHLs+He3D/27LM
|
||||
--- rp66vDf9qnM7f9S5YD/X/99YsufPWmvz+V8z8htB2Ow
|
||||
9‡Ài¨*¡-oš·}Ć(Š5[¬ [ÕyK r)¾-cùäóŽù¼R0?Ë8`Èô×{
|
||||
+14
-25
@@ -29,12 +29,10 @@ in
|
||||
};
|
||||
|
||||
# https://wiki.nixos.org/wiki/Grafana#Declarative_configuration
|
||||
secrix.services.grafana.secrets.security-key.encrypted.file = ./secrets/grafana-secret-key.age;
|
||||
services.grafana = {
|
||||
enable = true;
|
||||
settings = {
|
||||
security.allow_embedding = true;
|
||||
security.secret_key = "$__file{${config.secrix.services.grafana.secrets.security-key.decrypted.path}}";
|
||||
server = {
|
||||
http_port = 3001;
|
||||
domain = "grouter.${domain}";
|
||||
@@ -59,37 +57,28 @@ in
|
||||
services.caddy = {
|
||||
enable = true;
|
||||
package = pkgs.caddy.withPlugins {
|
||||
plugins = [ "github.com/caddy-dns/cloudflare@v0.2.4" ];
|
||||
hash = "sha256-xRJ5evsAJ2akg47j3Bt6YDXJOgX88B/rKNP50KSVyNY=";
|
||||
plugins = [ "github.com/caddy-dns/cloudflare@v0.2.1" ];
|
||||
hash = "sha256-Gsuo+ripJSgKSYOM9/yl6Kt/6BFCA6BuTDvPdteinAI=";
|
||||
};
|
||||
virtualHosts."*.${domain}".extraConfig = ''
|
||||
virtualHosts."grouter.${domain}".extraConfig = ''
|
||||
encode
|
||||
tls {
|
||||
dns cloudflare {env.CF_API_KEY}
|
||||
resolvers 1.1.1.1
|
||||
}
|
||||
|
||||
@grouter host grouter.${domain}
|
||||
handle @grouter {
|
||||
@grafana path /grafana /grafana/*
|
||||
handle @grafana {
|
||||
reverse_proxy localhost:${toString config.services.grafana.settings.server.http_port}
|
||||
}
|
||||
redir /adghome /adghome/
|
||||
handle_path /adghome/* {
|
||||
reverse_proxy localhost:${toString config.services.adguardhome.port}
|
||||
basic_auth {
|
||||
Bob $2a$14$HsWmmzQTN68K3vwiRAfiUuqIjKoXEXaj9TOLUtG2mO1vFpdovmyBy
|
||||
}
|
||||
}
|
||||
handle /* {
|
||||
reverse_proxy localhost:${toString config.services.glance.settings.server.port}
|
||||
@grafana path /grafana /grafana/*
|
||||
handle @grafana {
|
||||
reverse_proxy localhost:${toString config.services.grafana.settings.server.http_port}
|
||||
}
|
||||
redir /adghome /adghome/
|
||||
handle_path /adghome/* {
|
||||
reverse_proxy localhost:${toString config.services.adguardhome.port}
|
||||
basic_auth {
|
||||
Bob $2a$14$HsWmmzQTN68K3vwiRAfiUuqIjKoXEXaj9TOLUtG2mO1vFpdovmyBy
|
||||
}
|
||||
}
|
||||
|
||||
@hass host hass.${domain}
|
||||
handle @hass {
|
||||
reverse_proxy homeassistant.4.lab.l.cazzzer.com:8123
|
||||
handle /* {
|
||||
reverse_proxy localhost:${toString config.services.glance.settings.server.port}
|
||||
}
|
||||
'';
|
||||
};
|
||||
|
||||
@@ -1,44 +0,0 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
let
|
||||
vars = import ./vars.nix config;
|
||||
ifs = vars.ifs;
|
||||
ts0 = ifs.ts0;
|
||||
|
||||
# Subnets advertised to the tailnet (still need to be approved in the admin console)
|
||||
advertisedRoutes = [
|
||||
"${vars.p4}.0.0/16" # all LAN v4 subnets
|
||||
"${vars.ulaPrefix}::/48" # all LAN ULA subnets
|
||||
];
|
||||
in
|
||||
{
|
||||
# One-time setup after deploying: `sudo tailscale up`
|
||||
# (state is persisted in /var/lib/tailscale)
|
||||
services.tailscale = {
|
||||
enable = true;
|
||||
port = ts0.listenPort;
|
||||
interfaceName = ts0.name;
|
||||
# Enables ip forwarding (already enabled globally by networkd anyway).
|
||||
# Not using "both", since that sets rp_filter to loose on all interfaces.
|
||||
useRoutingFeatures = "server";
|
||||
# Firewall is managed manually in firewall.nix (networking.firewall is disabled)
|
||||
openFirewall = false;
|
||||
# Applied with `tailscale set` on every start, so these stay declarative
|
||||
extraSetFlags = [
|
||||
# Don't let tailscale touch nftables/iptables, all rules live in firewall.nix
|
||||
"--netfilter-mode=off"
|
||||
# Don't SNAT tailnet -> LAN traffic, LAN hosts route back via the router anyway
|
||||
# (preserves real source addrs for logging/ACLs on LAN hosts)
|
||||
"--snat-subnet-routes=false"
|
||||
# The router is its own DNS server, don't let tailscale mess with resolv.conf
|
||||
"--accept-dns=false"
|
||||
"--advertise-routes=${lib.strings.concatStringsSep "," advertisedRoutes}"
|
||||
"--advertise-exit-node"
|
||||
];
|
||||
};
|
||||
|
||||
# networkd removes "foreign" ip rules when it (re)starts, which would wipe tailscale's
|
||||
# policy routing rules (table 52). This is extra important since networkd is
|
||||
# restarted every minute (see ifconfig.nix).
|
||||
# The nixpkgs tailscale module already marks tailscale0 as unmanaged in networkd.
|
||||
systemd.network.config.networkConfig.ManageForeignRoutingPolicyRules = false;
|
||||
}
|
||||
@@ -111,14 +111,6 @@ rec {
|
||||
} // {
|
||||
listenPort = 51944;
|
||||
};
|
||||
# Tailscale addresses are assigned by the coordination server,
|
||||
# these are the fixed ranges tailscale allocates node addrs from.
|
||||
ts0 = {
|
||||
name = "tailscale0";
|
||||
listenPort = 41641;
|
||||
net4 = "100.64.0.0/10";
|
||||
net6 = "fd7a:115c:a1e0::/48";
|
||||
};
|
||||
};
|
||||
|
||||
extra = {
|
||||
@@ -143,7 +135,5 @@ rec {
|
||||
}
|
||||
];
|
||||
};
|
||||
amnezia.addr4 = "${ifs.lan10.p4}.31";
|
||||
minecruft.addr4 = "${ifs.lan.p4}.11";
|
||||
};
|
||||
}
|
||||
|
||||
@@ -0,0 +1,5 @@
|
||||
{
|
||||
imports = [
|
||||
./flatpak.nix
|
||||
];
|
||||
}
|
||||
@@ -0,0 +1,44 @@
|
||||
# https://github.com/knightpp/nixos-cfg/blob/main/modules/workarounds/flatpak.nix
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
cfg = config.workarounds.flatpak;
|
||||
in {
|
||||
options = {
|
||||
workarounds.flatpak = {
|
||||
enable = lib.mkEnableOption "flatpak workaround";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
system.fsPackages = [pkgs.bindfs];
|
||||
fileSystems = let
|
||||
mkRoSymBind = path: {
|
||||
device = path;
|
||||
fsType = "fuse.bindfs";
|
||||
options = ["ro" "resolve-symlinks" "x-gvfs-hide"];
|
||||
};
|
||||
aggregated = pkgs.buildEnv {
|
||||
name = "system-fonts-and-icons";
|
||||
paths = builtins.attrValues {
|
||||
inherit (pkgs.kdePackages) breeze;
|
||||
inherit
|
||||
(pkgs)
|
||||
noto-fonts
|
||||
noto-fonts-emoji
|
||||
noto-fonts-cjk-sans
|
||||
noto-fonts-cjk-serif
|
||||
;
|
||||
};
|
||||
pathsToLink = ["/share/fonts" "/share/icons"];
|
||||
};
|
||||
in {
|
||||
# Create an FHS mount to support flatpak host icons/fonts
|
||||
"/usr/share/icons" = mkRoSymBind "${aggregated}/share/icons";
|
||||
"/usr/share/fonts" = mkRoSymBind "${aggregated}/share/fonts";
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -5,7 +5,7 @@
|
||||
isNormalUser = true;
|
||||
description = "Yura";
|
||||
group = "cazzzer";
|
||||
extraGroups = [ "wheel" "dialout" ]
|
||||
extraGroups = [ "wheel" ]
|
||||
++ lib.optionals config.networking.networkmanager.enable [ "networkmanager" ]
|
||||
++ lib.optionals config.virtualisation.docker.enable [ "docker" ]
|
||||
++ lib.optionals config.programs.wireshark.enable [ "wireshark" ]
|
||||
|
||||
Reference in New Issue
Block a user