Compare commits
5 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
| 93d221d79b | |||
| 8c2d814a6c | |||
| fc189c0865 | |||
| 8531d066ad | |||
| d6ac70abab |
9
.sops.yaml
Normal file
9
.sops.yaml
Normal file
@ -0,0 +1,9 @@
|
||||
keys:
|
||||
- &admin_age age1xy66lg9eh572ge0y7zzh34f78s8l9hnkxhg3r4gn98ph95mz25tszgerul
|
||||
- &tien_age age12j6x69evhvh6ljngq4lgesnezf7hwafc33z7nj9urnsl5xzlhp5sf6szck
|
||||
creation_rules:
|
||||
- path_regex: tien/secrets.yaml$
|
||||
key_groups:
|
||||
- age:
|
||||
- *admin_age
|
||||
- *tien_age
|
||||
238
configuration.nix
Normal file
238
configuration.nix
Normal file
@ -0,0 +1,238 @@
|
||||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
nixos/desktop/printing
|
||||
];
|
||||
|
||||
# Bootloader.
|
||||
boot.loader.grub.enable = true;
|
||||
boot.loader.grub.device = "/dev/sda";
|
||||
boot.loader.grub.useOSProber = false;
|
||||
|
||||
# Setup keyfile
|
||||
boot.initrd.secrets = {
|
||||
"/crypto_keyfile.bin" = null;
|
||||
};
|
||||
|
||||
# Enable grub cryptodisk
|
||||
boot.loader.grub.enableCryptodisk = true;
|
||||
|
||||
boot.initrd.luks.devices."luks-efc0285c-812e-4946-936b-37e737fb72eb".keyFile = "/crypto_keyfile.bin";
|
||||
|
||||
# allow crosscompiling for raspberrypi
|
||||
boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
|
||||
|
||||
networking.hostName = "lift";
|
||||
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
|
||||
|
||||
networking.networkmanager.enable = true;
|
||||
systemd.network.wait-online.enable = false;
|
||||
boot.initrd.systemd.network.wait-online.enable = false;
|
||||
|
||||
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||
|
||||
# Set your time zone.
|
||||
time.timeZone = "Europe/Berlin";
|
||||
|
||||
# Select internationalisation properties.
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
|
||||
i18n.extraLocaleSettings = {
|
||||
LC_ADDRESS = "de_DE.UTF-8";
|
||||
LC_IDENTIFICATION = "de_DE.UTF-8";
|
||||
LC_MEASUREMENT = "de_DE.UTF-8";
|
||||
LC_MONETARY = "de_DE.UTF-8";
|
||||
LC_NAME = "de_DE.UTF-8";
|
||||
LC_NUMERIC = "de_DE.UTF-8";
|
||||
LC_PAPER = "de_DE.UTF-8";
|
||||
LC_TELEPHONE = "de_DE.UTF-8";
|
||||
LC_TIME = "de_DE.UTF-8";
|
||||
};
|
||||
|
||||
|
||||
# Configure console keymap
|
||||
console.keyMap = "de-latin1-nodeadkeys";
|
||||
|
||||
# Enable scanning
|
||||
hardware.sane.enable = true;
|
||||
hardware.keyboard.zsa.enable = true;
|
||||
hardware.graphics.enable = true;
|
||||
|
||||
# bluetooth
|
||||
hardware.bluetooth.enable = true;
|
||||
|
||||
# hardware.pulseaudio.enable = false;
|
||||
security.rtkit.enable = true;
|
||||
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
users.users.rothe = {
|
||||
isNormalUser = true;
|
||||
description = "rothe";
|
||||
extraGroups = [ "networkmanager" "wheel" "video" "scanner" "lp" "incus-admin" "dialout" ];
|
||||
shell = pkgs.fish;
|
||||
packages = with pkgs; [
|
||||
chromium
|
||||
firefox
|
||||
logseq
|
||||
thunderbird
|
||||
];
|
||||
};
|
||||
|
||||
nixpkgs.config.permittedInsecurePackages = [
|
||||
"electron-27.3.11"
|
||||
];
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
ack
|
||||
avrdude
|
||||
bind
|
||||
calibre
|
||||
cmake
|
||||
cryptsetup
|
||||
curl
|
||||
dracula-theme
|
||||
evince
|
||||
ffmpeg
|
||||
fish
|
||||
foot
|
||||
fzf
|
||||
gammastep
|
||||
gcc
|
||||
gimp
|
||||
git
|
||||
glib
|
||||
eog
|
||||
nautilus
|
||||
simple-scan
|
||||
gnucash
|
||||
gnumake
|
||||
gnupg
|
||||
google-cloud-sdk
|
||||
inkscape
|
||||
ispell
|
||||
keychain
|
||||
libreoffice
|
||||
hugo
|
||||
mosquitto
|
||||
mypy
|
||||
nmap
|
||||
pass-secret-service
|
||||
pavucontrol
|
||||
portfolio
|
||||
prusa-slicer
|
||||
pulseaudio
|
||||
signal-desktop
|
||||
spotify
|
||||
sqlite
|
||||
syncthing
|
||||
tailscale
|
||||
tmux
|
||||
tree
|
||||
unzip
|
||||
vim-full
|
||||
vlc
|
||||
wally-cli
|
||||
wayshot
|
||||
wdisplays
|
||||
wget
|
||||
wl-clipboard
|
||||
xdg-utils
|
||||
yt-dlp
|
||||
];
|
||||
|
||||
xdg.portal = {
|
||||
enable = true;
|
||||
wlr.enable = true;
|
||||
# gtk portal needed to make gtk apps happy
|
||||
extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
|
||||
config.common.default = "*";
|
||||
};
|
||||
|
||||
programs = {
|
||||
fish.enable = true;
|
||||
gnupg.agent = {
|
||||
enable = true;
|
||||
enableSSHSupport = true;
|
||||
};
|
||||
light.enable = true;
|
||||
};
|
||||
# List services that you want to enable:
|
||||
services.resolved = {
|
||||
enable = true;
|
||||
};
|
||||
services.pcscd.enable = true;
|
||||
# xdg-desktop-portal works by exposing a series of D-Bus interfaces
|
||||
# known as portals under a well-known name
|
||||
# (org.freedesktop.portal.Desktop) and object path
|
||||
# (/org/freedesktop/portal/desktop).
|
||||
# The portal interfaces include APIs for file access, opening URIs,
|
||||
# printing and others.
|
||||
services.dbus.enable = true;
|
||||
services.pipewire = {
|
||||
enable = true;
|
||||
alsa.enable = true;
|
||||
pulse.enable = true;
|
||||
};
|
||||
services.passSecretService.enable = true;
|
||||
services.tailscale.enable = true;
|
||||
services.gvfs.enable = true;
|
||||
|
||||
services.greetd = {
|
||||
enable = true;
|
||||
settings = {
|
||||
default_session = {
|
||||
command = "${pkgs.greetd.tuigreet}/bin/tuigreet --time --asterisks --cmd sway";
|
||||
user = "rothe";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
services.blueman.enable = true;
|
||||
services.fwupd.enable = true;
|
||||
services.syncthing = {
|
||||
enable = true;
|
||||
user = "rothe";
|
||||
group = "users";
|
||||
dataDir = "/home/rothe";
|
||||
overrideFolders = false;
|
||||
overrideDevices = false;
|
||||
};
|
||||
|
||||
networking.nftables = {
|
||||
enable = true;
|
||||
};
|
||||
networking.firewall.trustedInterfaces = [ "incusbr0" ];
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "23.05"; # Did you read the comment?
|
||||
|
||||
virtualisation = {
|
||||
incus.enable = false;
|
||||
podman.enable = true;
|
||||
};
|
||||
|
||||
programs.nh = {
|
||||
enable = true;
|
||||
clean.enable = true;
|
||||
clean.extraArgs = "--keep-since 4d --keep 3";
|
||||
flake = "/home/rothe/src/nixos-config";
|
||||
};
|
||||
|
||||
programs.steam = {
|
||||
enable = true;
|
||||
remotePlay.openFirewall = true;
|
||||
dedicatedServer.openFirewall = true;
|
||||
localNetworkGameTransfers.openFirewall = true;
|
||||
};
|
||||
}
|
||||
362
flake.lock
generated
362
flake.lock
generated
@ -1,39 +1,15 @@
|
||||
{
|
||||
"nodes": {
|
||||
"deploy-rs": {
|
||||
"inputs": {
|
||||
"flake-compat": "flake-compat",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
],
|
||||
"utils": "utils"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1727447169,
|
||||
"narHash": "sha256-3KyjMPUKHkiWhwR91J1YchF6zb6gvckCAY1jOE+ne0U=",
|
||||
"owner": "serokell",
|
||||
"repo": "deploy-rs",
|
||||
"rev": "aa07eb05537d4cd025e2310397a6adcedfe72c76",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "serokell",
|
||||
"repo": "deploy-rs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"disko": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
"nixpkgs": "nixpkgs"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1736711425,
|
||||
"narHash": "sha256-8hKhPQuMtXfJi+4lPvw3FBk/zSJVHeb726Zo0uF1PP8=",
|
||||
"lastModified": 1733168902,
|
||||
"narHash": "sha256-8dupm9GfK+BowGdQd7EHK5V61nneLfr9xR6sc5vtDi0=",
|
||||
"owner": "nix-community",
|
||||
"repo": "disko",
|
||||
"rev": "f720e64ec37fa16ebba6354eadf310f81555cc07",
|
||||
"rev": "785c1e02c7e465375df971949b8dcbde9ec362e5",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@ -42,116 +18,6 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-compat": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1696426674,
|
||||
"narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
|
||||
"owner": "edolstra",
|
||||
"repo": "flake-compat",
|
||||
"rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "edolstra",
|
||||
"repo": "flake-compat",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-compat_2": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1696426674,
|
||||
"narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
|
||||
"owner": "edolstra",
|
||||
"repo": "flake-compat",
|
||||
"rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "edolstra",
|
||||
"repo": "flake-compat",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-parts": {
|
||||
"inputs": {
|
||||
"nixpkgs-lib": [
|
||||
"nixvim",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1736143030,
|
||||
"narHash": "sha256-+hu54pAoLDEZT9pjHlqL9DNzWz0NbUn8NEAHP7PQPzU=",
|
||||
"owner": "hercules-ci",
|
||||
"repo": "flake-parts",
|
||||
"rev": "b905f6fc23a9051a6e1b741e1438dbfc0634c6de",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "hercules-ci",
|
||||
"repo": "flake-parts",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils": {
|
||||
"inputs": {
|
||||
"systems": "systems_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1705309234,
|
||||
"narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils_2": {
|
||||
"inputs": {
|
||||
"systems": "systems_3"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1731533236,
|
||||
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"ghostty": {
|
||||
"inputs": {
|
||||
"flake-compat": "flake-compat_2",
|
||||
"nixpkgs-stable": "nixpkgs-stable",
|
||||
"nixpkgs-unstable": "nixpkgs-unstable",
|
||||
"zig": "zig"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1736911212,
|
||||
"narHash": "sha256-OLly4X2kN1tDb2gMYcWeim6uJECPoc52ltJsz1iD5Ug=",
|
||||
"owner": "ghostty-org",
|
||||
"repo": "ghostty",
|
||||
"rev": "ff9414d9ea7b16a375d41cde8f6f193de7e5db72",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "ghostty-org",
|
||||
"repo": "ghostty",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"home-manager": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
@ -159,11 +25,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1736373539,
|
||||
"narHash": "sha256-dinzAqCjenWDxuy+MqUQq0I4zUSfaCvN9rzuCmgMZJY=",
|
||||
"lastModified": 1733050161,
|
||||
"narHash": "sha256-lYnT+EYE47f5yY3KS/Kd4pJ6CO9fhCqumkYYkQ3TK20=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "bd65bc3cde04c16755955630b344bc9e35272c56",
|
||||
"rev": "62d536255879be574ebfe9b87c4ac194febf47c5",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@ -173,229 +39,77 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"ixx": {
|
||||
"inputs": {
|
||||
"flake-utils": [
|
||||
"nixvim",
|
||||
"nuschtosSearch",
|
||||
"flake-utils"
|
||||
],
|
||||
"nixpkgs": [
|
||||
"nixvim",
|
||||
"nuschtosSearch",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1729958008,
|
||||
"narHash": "sha256-EiOq8jF4Z/zQe0QYVc3+qSKxRK//CFHMB84aYrYGwEs=",
|
||||
"owner": "NuschtOS",
|
||||
"repo": "ixx",
|
||||
"rev": "9fd01aad037f345350eab2cd45e1946cc66da4eb",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NuschtOS",
|
||||
"ref": "v0.0.6",
|
||||
"repo": "ixx",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1736867362,
|
||||
"narHash": "sha256-i/UJ5I7HoqmFMwZEH6vAvBxOrjjOJNU739lnZnhUln8=",
|
||||
"lastModified": 1732238832,
|
||||
"narHash": "sha256-sQxuJm8rHY20xq6Ah+GwIUkF95tWjGRd1X8xF+Pkk38=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "9c6b49aeac36e2ed73a8c472f1546f6d9cf1addc",
|
||||
"rev": "8edf06bea5bcbee082df1b7369ff973b91618b8d",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-24.11",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs-stable": {
|
||||
"locked": {
|
||||
"lastModified": 1733423277,
|
||||
"narHash": "sha256-TxabjxEgkNbCGFRHgM/b9yZWlBj60gUOUnRT/wbVQR8=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "e36963a147267afc055f7cf65225958633e536bf",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nixos",
|
||||
"ref": "release-24.11",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs-unstable": {
|
||||
"locked": {
|
||||
"lastModified": 1733229606,
|
||||
"narHash": "sha256-FLYY5M0rpa5C2QAE3CKLYAM6TwbKicdRK6qNrSHlNrE=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "566e53c2ad750c84f6d31f9ccb9d00f823165550",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nixos",
|
||||
"ref": "nixpkgs-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixvim": {
|
||||
"inputs": {
|
||||
"devshell": [],
|
||||
"flake-compat": [],
|
||||
"flake-parts": "flake-parts",
|
||||
"git-hooks": [],
|
||||
"home-manager": [],
|
||||
"nix-darwin": [],
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
],
|
||||
"nuschtosSearch": "nuschtosSearch",
|
||||
"treefmt-nix": []
|
||||
},
|
||||
"nixpkgs_2": {
|
||||
"locked": {
|
||||
"lastModified": 1736598792,
|
||||
"narHash": "sha256-G6/9vT12RAxkNWQPEX9p8tTx/i8jJcmISpbVDGbEPGc=",
|
||||
"owner": "nix-community",
|
||||
"repo": "nixvim",
|
||||
"rev": "2004ff4547f11d25da78f393fe797dde2b831ce7",
|
||||
"lastModified": 1733261153,
|
||||
"narHash": "sha256-eq51hyiaIwtWo19fPEeE0Zr2s83DYMKJoukNLgGGpek=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "b681065d0919f7eb5309a93cea2cfa84dec9aa88",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-24.11",
|
||||
"repo": "nixvim",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nuschtosSearch": {
|
||||
"inputs": {
|
||||
"flake-utils": "flake-utils_2",
|
||||
"ixx": "ixx",
|
||||
"nixpkgs": [
|
||||
"nixvim",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"nixpkgs_3": {
|
||||
"locked": {
|
||||
"lastModified": 1735854821,
|
||||
"narHash": "sha256-Iv59gMDZajNfezTO0Fw6LHE7uKAShxbvMidmZREit7c=",
|
||||
"owner": "NuschtOS",
|
||||
"repo": "search",
|
||||
"rev": "836908e3bddd837ae0f13e215dd48767aee355f0",
|
||||
"lastModified": 1731763621,
|
||||
"narHash": "sha256-ddcX4lQL0X05AYkrkV2LMFgGdRvgap7Ho8kgon3iWZk=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "c69a9bffbecde46b4b939465422ddc59493d3e4d",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NuschtOS",
|
||||
"repo": "search",
|
||||
"owner": "NixOS",
|
||||
"ref": "nixpkgs-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"deploy-rs": "deploy-rs",
|
||||
"disko": "disko",
|
||||
"ghostty": "ghostty",
|
||||
"home-manager": "home-manager",
|
||||
"nixpkgs": "nixpkgs",
|
||||
"nixvim": "nixvim"
|
||||
"nixpkgs": "nixpkgs_2",
|
||||
"sops-nix": "sops-nix"
|
||||
}
|
||||
},
|
||||
"systems": {
|
||||
"locked": {
|
||||
"lastModified": 1681028828,
|
||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"systems_2": {
|
||||
"locked": {
|
||||
"lastModified": 1681028828,
|
||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"systems_3": {
|
||||
"locked": {
|
||||
"lastModified": 1681028828,
|
||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"utils": {
|
||||
"sops-nix": {
|
||||
"inputs": {
|
||||
"systems": "systems"
|
||||
"nixpkgs": "nixpkgs_3"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1701680307,
|
||||
"narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
|
||||
"lastModified": 1732186149,
|
||||
"narHash": "sha256-N9JGWe/T8BC0Tss2Cv30plvZUYoiRmykP7ZdY2on2b0=",
|
||||
"owner": "mic92",
|
||||
"repo": "sops-nix",
|
||||
"rev": "53c853fb1a7e4f25f68805ee25c83d5de18dc699",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"zig": {
|
||||
"inputs": {
|
||||
"flake-compat": [
|
||||
"ghostty"
|
||||
],
|
||||
"flake-utils": "flake-utils",
|
||||
"nixpkgs": [
|
||||
"ghostty",
|
||||
"nixpkgs-stable"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1717848532,
|
||||
"narHash": "sha256-d+xIUvSTreHl8pAmU1fnmkfDTGQYCn2Rb/zOwByxS2M=",
|
||||
"owner": "mitchellh",
|
||||
"repo": "zig-overlay",
|
||||
"rev": "02fc5cc555fc14fda40c42d7c3250efa43812b43",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "mitchellh",
|
||||
"repo": "zig-overlay",
|
||||
"owner": "mic92",
|
||||
"repo": "sops-nix",
|
||||
"type": "github"
|
||||
}
|
||||
}
|
||||
|
||||
75
flake.nix
75
flake.nix
@ -2,29 +2,14 @@
|
||||
description = "NixOS configuration flake";
|
||||
|
||||
inputs = {
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
|
||||
deploy-rs.url = "github:serokell/deploy-rs";
|
||||
deploy-rs.inputs.nixpkgs.follows = "nixpkgs";
|
||||
disko.url = "github:nix-community/disko";
|
||||
disko.inputs.nixpkgs.follows = "nixpkgs";
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
|
||||
home-manager.url = "github:nix-community/home-manager/release-24.11";
|
||||
home-manager.inputs.nixpkgs.follows = "nixpkgs";
|
||||
ghostty.url = "github:ghostty-org/ghostty";
|
||||
nixvim = {
|
||||
url = "github:nix-community/nixvim/nixos-24.11";
|
||||
inputs = {
|
||||
nixpkgs.follows = "nixpkgs";
|
||||
devshell.follows = "";
|
||||
flake-compat.follows = "";
|
||||
git-hooks.follows = "";
|
||||
home-manager.follows = "";
|
||||
nix-darwin.follows = "";
|
||||
treefmt-nix.follows = "";
|
||||
};
|
||||
};
|
||||
sops-nix.url = "github:mic92/sops-nix";
|
||||
};
|
||||
|
||||
outputs = { self, nixpkgs, home-manager, deploy-rs, disko, nixvim, ghostty, ...}:
|
||||
outputs = inputs@{ self, nixpkgs,...}:
|
||||
let
|
||||
system = "x86_64-linux";
|
||||
pkgs = nixpkgs.legacyPackages.${system};
|
||||
@ -33,70 +18,50 @@
|
||||
lift = nixpkgs.lib.nixosSystem {
|
||||
inherit system;
|
||||
modules = [
|
||||
./hosts/lift
|
||||
];
|
||||
};
|
||||
veil = nixpkgs.lib.nixosSystem {
|
||||
inherit system;
|
||||
modules = [
|
||||
./hosts/veil
|
||||
./configuration.nix
|
||||
./sway.nix
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
};
|
||||
tien = nixpkgs.lib.nixosSystem {
|
||||
inherit system;
|
||||
system = "x86_64-linux";
|
||||
specialArgs = { inherit inputs; };
|
||||
modules = [
|
||||
disko.nixosModules.disko
|
||||
./hosts/tien/configuration.nix
|
||||
./hosts/tien/hardware-configuration.nix
|
||||
inputs.disko.nixosModules.disko
|
||||
./vps-configuration.nix
|
||||
./vps-hardware-configuration.nix
|
||||
];
|
||||
};
|
||||
};
|
||||
homeConfigurations = {
|
||||
"rothe@lift" = home-manager.lib.homeManagerConfiguration {
|
||||
"rothe@lift" = inputs.home-manager.lib.homeManagerConfiguration {
|
||||
inherit pkgs;
|
||||
modules = [
|
||||
./home/terminal
|
||||
modules = [
|
||||
./home/rothe.nix
|
||||
./home/wayland
|
||||
nixvim.homeManagerModules.nixvim
|
||||
];
|
||||
extraSpecialArgs = {
|
||||
mail = nixpkgs.lib.strings.concatStrings ["mail" "@" "johannes-rothe.de"];
|
||||
inherit ghostty;
|
||||
};
|
||||
};
|
||||
"rothe@veil" = home-manager.lib.homeManagerConfiguration {
|
||||
"rothe@johannes-powermachine" = inputs.home-manager.lib.homeManagerConfiguration {
|
||||
inherit pkgs;
|
||||
modules = [
|
||||
./home/terminal
|
||||
./home/wayland
|
||||
nixvim.homeManagerModules.nixvim
|
||||
modules = [
|
||||
./home/rothe.nix
|
||||
];
|
||||
extraSpecialArgs = {
|
||||
mail = nixpkgs.lib.strings.concatStrings ["mail" "@" "johannes-rothe.de"];
|
||||
inherit ghostty;
|
||||
};
|
||||
};
|
||||
"rothe@pdemu1cml000301" = home-manager.lib.homeManagerConfiguration {
|
||||
"rothe@pdemu1cml000301" = inputs.home-manager.lib.homeManagerConfiguration {
|
||||
inherit pkgs;
|
||||
modules = [
|
||||
./home/terminal
|
||||
nixvim.homeManagerModules.nixvim
|
||||
modules = [
|
||||
./home/rothe.nix
|
||||
];
|
||||
extraSpecialArgs = {
|
||||
mail = nixpkgs.lib.strings.concatStrings ["rothe" "@" "magazino.eu"];
|
||||
};
|
||||
};
|
||||
};
|
||||
deploy.nodes.tien = let
|
||||
hostname = "tien";
|
||||
in {
|
||||
hostname = hostname;
|
||||
profiles.system = {
|
||||
sshUser = "root";
|
||||
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.${hostname};
|
||||
};
|
||||
};
|
||||
|
||||
checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
|
||||
};
|
||||
}
|
||||
|
||||
26
home/rothe.nix
Normal file
26
home/rothe.nix
Normal file
@ -0,0 +1,26 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
{
|
||||
home.username = "rothe";
|
||||
home.homeDirectory = "/home/rothe";
|
||||
|
||||
imports = [
|
||||
./terminal
|
||||
];
|
||||
|
||||
# Add extra variables like $EDITOR
|
||||
home.sessionVariables = {
|
||||
};
|
||||
|
||||
# This value determines the Home Manager release that your configuration is
|
||||
# compatible with. This helps avoid breakage when a new Home Manager release
|
||||
# introduces backwards incompatible changes.
|
||||
#
|
||||
# You should not change this value, even if you update Home Manager. If you do
|
||||
# want to update the value, then make sure to first check the Home Manager
|
||||
# release notes.
|
||||
home.stateVersion = "23.05"; # Please read the comment before changing.
|
||||
|
||||
# Let Home Manager install and manage itself.
|
||||
programs.home-manager.enable = true;
|
||||
}
|
||||
@ -1,16 +1,7 @@
|
||||
{ config, pkgs, mail, ... }:
|
||||
{ config, pkgs, lib, mail, ... }:
|
||||
|
||||
{
|
||||
imports = [ ./nixvim ];
|
||||
|
||||
config = {
|
||||
home.username = "rothe";
|
||||
home.homeDirectory = "/home/rothe";
|
||||
|
||||
# Add extra variables like $EDITOR
|
||||
home.sessionVariables = {
|
||||
};
|
||||
|
||||
home.packages = with pkgs; [
|
||||
black
|
||||
devenv
|
||||
@ -26,16 +17,12 @@
|
||||
python311
|
||||
python311Packages.flake8
|
||||
python311Packages.ipython
|
||||
ripgrep
|
||||
rusti-cal
|
||||
roboto-mono
|
||||
silver-searcher
|
||||
shellcheck
|
||||
sops
|
||||
(nerdfonts.override { fonts = [
|
||||
"JetBrainsMono"
|
||||
"RobotoMono"
|
||||
]; })
|
||||
(nerdfonts.override { fonts = [ "RobotoMono" ]; })
|
||||
];
|
||||
fonts.fontconfig.enable = true;
|
||||
|
||||
@ -48,13 +35,11 @@
|
||||
fish_add_path ~/go/bin/
|
||||
export DEBFULLNAME="Johannes Rothe"
|
||||
export DEBEMAIL="${mail}"
|
||||
export GIT_EDITOR="nvim"
|
||||
export GIT_AUTHOR_NAME="Johannes Rothe"
|
||||
export GIT_AUTHOR_EMAIL="${mail}"
|
||||
export GIT_COMMITTER_NAME="Johannes Rothe"
|
||||
export GIT_COMMITTER_EMAIL="${mail}"
|
||||
export VAULT_ADDR="https://passwords.magazino.eu:8201"
|
||||
export NIX_PATH=$HOME/.nix-defexpr/channels
|
||||
'';
|
||||
shellAliases = {
|
||||
"..." = "cd ../..";
|
||||
@ -256,21 +241,7 @@
|
||||
programs.direnv = {
|
||||
enable = true;
|
||||
};
|
||||
|
||||
home.file = {
|
||||
"${config.xdg.configHome}/ghostty/config".source = ./ghostty/config;
|
||||
};
|
||||
|
||||
# This value determines the Home Manager release that your configuration is
|
||||
# compatible with. This helps avoid breakage when a new Home Manager release
|
||||
# introduces backwards incompatible changes.
|
||||
#
|
||||
# You should not change this value, even if you update Home Manager. If you do
|
||||
# want to update the value, then make sure to first check the Home Manager
|
||||
# release notes.
|
||||
home.stateVersion = "23.05"; # Please read the comment before changing.
|
||||
|
||||
# Let Home Manager install and manage itself.
|
||||
programs.home-manager.enable = true;
|
||||
};
|
||||
|
||||
}
|
||||
|
||||
|
||||
@ -1,4 +0,0 @@
|
||||
title = " "
|
||||
window-decoration = false
|
||||
theme = "MaterialDarker"
|
||||
confirm-close-surface = false
|
||||
@ -1,131 +0,0 @@
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
imports = [
|
||||
./telescope.nix
|
||||
];
|
||||
programs.nixvim = {
|
||||
colorscheme = "sonokai";
|
||||
enable = true;
|
||||
extraPlugins = [
|
||||
pkgs.vimPlugins.indentLine
|
||||
pkgs.vimPlugins.nvim-lspconfig
|
||||
pkgs.vimPlugins.polyglot
|
||||
pkgs.vimPlugins.sonokai
|
||||
pkgs.vimPlugins.vim-better-whitespace
|
||||
(pkgs.vimUtils.buildVimPlugin {
|
||||
pname = "lualine-so-fancy.nvim";
|
||||
version = "HEAD";
|
||||
src = pkgs.fetchFromGitHub {
|
||||
owner = "meuter";
|
||||
repo = "lualine-so-fancy.nvim";
|
||||
rev = "45197358e5274d301d98638bf079f3437d6eacf8";
|
||||
sha256 = "sha256-j6XI4cw1ouYEvSiKdam8RAqxefDqeLwe37Qir/UO+8g=";
|
||||
};
|
||||
})
|
||||
];
|
||||
globals = {
|
||||
mapleader = ",";
|
||||
sonokai_style = "atlantis";
|
||||
sonokai_disable_italic_comment = 1;
|
||||
};
|
||||
keymaps = [
|
||||
{
|
||||
key = "<leader>rm";
|
||||
action = "<cmd>RenderMarkdown toggle<CR>";
|
||||
}
|
||||
{
|
||||
key = "<leader>g";
|
||||
action = "<cmd>Git<CR>";
|
||||
}
|
||||
{
|
||||
key = "<leader>gp";
|
||||
action = "<cmd>Git push<CR>";
|
||||
}
|
||||
{
|
||||
key = "<leader>gl";
|
||||
action = "<cmd>Git log<CR>";
|
||||
}
|
||||
{
|
||||
key = "<leader>gbl";
|
||||
action = "<cmd>Git blame<CR>";
|
||||
}
|
||||
{
|
||||
key = "<leader>gbr";
|
||||
action = "<cmd>Git branch<CR>";
|
||||
}
|
||||
];
|
||||
opts = {
|
||||
colorcolumn = "88";
|
||||
cursorline = true;
|
||||
number = true;
|
||||
spell = true;
|
||||
termguicolors = true;
|
||||
textwidth = 80;
|
||||
};
|
||||
plugins = {
|
||||
cmp = {
|
||||
enable = true; # Completion
|
||||
autoEnableSources = true;
|
||||
settings.sources = [
|
||||
{ name = "nvim_lsp"; }
|
||||
{ name = "path"; }
|
||||
{ name = "buffer"; }
|
||||
];
|
||||
settings.mapping = {
|
||||
"<C-d>" = "cmp.mapping.scroll_docs(-2)";
|
||||
"<C-f>" = "cmp.mapping.scroll_docs(2)";
|
||||
"<C-Space>" = "cmp.mapping.complete()";
|
||||
"<C-e>" = "cmp.mapping.close()";
|
||||
"<Tab>" = "cmp.mapping(cmp.mapping.select_next_item({behavior = cmp.SelectBehavior.Select}), {'i', 's'})";
|
||||
"<S-Tab>" = "cmp.mapping(cmp.mapping.select_prev_item({behavior = cmp.SelectBehavior.Select}), {'i', 's'})";
|
||||
"<CR>" = "cmp.mapping.confirm({ select = false, behavior = cmp.ConfirmBehavior.Replace })";
|
||||
};
|
||||
};
|
||||
committia.enable = true; # Enhanced git commits
|
||||
fugitive.enable = true;
|
||||
gitsigns.enable = true; # Show git change in first line
|
||||
guess-indent.enable = true; # Guess indent of the file
|
||||
lsp.enable = true;
|
||||
lsp.servers = {
|
||||
bashls.enable = true;
|
||||
dockerls.enable = true;
|
||||
gitlab_ci_ls.enable = true;
|
||||
gitlab_ci_ls.package = pkgs.gitlab-ci-ls;
|
||||
gopls.enable = true;
|
||||
helm_ls.enable = true;
|
||||
jsonls.enable = true;
|
||||
nixd.enable = true;
|
||||
pylsp = {
|
||||
enable = true;
|
||||
settings.plugins = {
|
||||
black.enabled = true;
|
||||
isort.enabled = true;
|
||||
ruff.enabled = true;
|
||||
ruff.formatEnabled = false;
|
||||
};
|
||||
};
|
||||
terraformls = {
|
||||
enable = true;
|
||||
rootDir = "require('lspconfig.util').root_pattern('.git', '.terraform')";
|
||||
};
|
||||
tflint.enable = true;
|
||||
yamlls.enable = true;
|
||||
};
|
||||
lsp-format.enable = true; # Automatically format on save
|
||||
lsp-lines.enable = true; # Display LSP hints in lines
|
||||
lsp-signature.enable = true; # Show function signature when typing
|
||||
lualine.enable = true; # Status line
|
||||
lualine.settings.sections = {
|
||||
lualine_a = [ "fancy_mode" ];
|
||||
lualine_b = [ "fancy_branch" "fancy_diff" ];
|
||||
lualine_c = [ "fancy_cwd" "filename" ];
|
||||
lualine_x = [ "fancy_diagnostics" "fancy_searchcount" ];
|
||||
lualine_y = [ "fancy_filetype" ];
|
||||
lualine_z = [ "fancy_lsp_servers" ];
|
||||
};
|
||||
render-markdown.enable = true;
|
||||
treesitter.enable = true;
|
||||
web-devicons.enable = true;
|
||||
};
|
||||
};
|
||||
}
|
||||
@ -1,29 +0,0 @@
|
||||
{ ... }:
|
||||
{
|
||||
programs.nixvim = {
|
||||
plugins.telescope = {
|
||||
enable = true;
|
||||
extensions = {
|
||||
file-browser.enable = true;
|
||||
frecency.enable = true;
|
||||
fzf-native.enable = true;
|
||||
};
|
||||
keymaps = {
|
||||
# https://github.com/nvim-telescope/telescope.nvim?tab=readme-ov-file#pickers
|
||||
# File pickers
|
||||
"<leader>t" = "file_browser";
|
||||
"<leader>ff" = "find_files";
|
||||
"<leader>fg" = "live_grep";
|
||||
# Vim pickers
|
||||
"<leader>r" = "command_history";
|
||||
"<leader>fo" = "oldfiles";
|
||||
"<leader>fs" = "spell_suggest";
|
||||
# Treesitter pickers
|
||||
"<leader>ft" = "treesitter";
|
||||
# Git pickers
|
||||
"<leader>fgs" = "git_status";
|
||||
# LSP
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@ -1,15 +1,42 @@
|
||||
{ config, pkgs, lib, ghostty, ... }:
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
{
|
||||
home.packages = with pkgs; [
|
||||
brightnessctl
|
||||
flameshot
|
||||
ghostty.packages.x86_64-linux.default
|
||||
pulseaudio
|
||||
swaybg
|
||||
swaylock
|
||||
];
|
||||
|
||||
programs.foot = {
|
||||
enable = true;
|
||||
settings = {
|
||||
main = {
|
||||
font = "Roboto Mono Nerd Font:size=10";
|
||||
dpi-aware = "no";
|
||||
};
|
||||
# nordiq from https://codeberg.org/dnkl/foot/src/branch/master/themes/
|
||||
colors = {
|
||||
background = "2E3440";
|
||||
foreground = "D8DEE9";
|
||||
regular0 = "5b6272";
|
||||
regular1 = "bf616a";
|
||||
regular2 = "a3be8c";
|
||||
regular3 = "ebcb8b";
|
||||
regular4 = "81a1c1";
|
||||
regular5 = "b48ead";
|
||||
regular6 = "88c0d0";
|
||||
regular7 = "e5e9f0";
|
||||
bright0 = "5E5C64";
|
||||
bright1 = "F66151";
|
||||
bright2 = "33DA7A";
|
||||
bright3 = "E9AD0C";
|
||||
bright4 = "2A7BDE";
|
||||
bright5 = "C061CB";
|
||||
bright6 = "33C7DE";
|
||||
bright7 = "FFFFFF";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
programs.rofi = {
|
||||
enable = true;
|
||||
font = "Roboto Mono Nerd Font 10";
|
||||
@ -175,7 +202,6 @@
|
||||
"--release Print" = "exec flameshot gui";
|
||||
"Mod1+l" = "exec swaylock -f -i ${wallpaper} -s fill";
|
||||
"${modifier}+m" = "scratchpad show";
|
||||
"${modifier}+Return" = "exec ghostty";
|
||||
"XF86MonBrightnessDown" = "exec light -U 10";
|
||||
"XF86MonBrightnessUp" = "exec light -A 10";
|
||||
"XF86AudioRaiseVolume" = "exec 'pactl set-sink-volume @DEFAULT_SINK@ +1%'";
|
||||
|
||||
@ -1,66 +0,0 @@
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
# Bootloader.
|
||||
boot.loader.grub.enable = true;
|
||||
boot.loader.grub.device = "/dev/sda";
|
||||
boot.loader.grub.useOSProber = false;
|
||||
|
||||
# Setup keyfile
|
||||
boot.initrd.secrets = {
|
||||
"/crypto_keyfile.bin" = null;
|
||||
};
|
||||
|
||||
# Enable grub cryptodisk
|
||||
boot.loader.grub.enableCryptodisk = true;
|
||||
|
||||
boot.initrd.luks.devices."luks-efc0285c-812e-4946-936b-37e737fb72eb".keyFile = "/crypto_keyfile.bin";
|
||||
|
||||
networking.hostName = "lift";
|
||||
|
||||
networking.networkmanager.enable = true;
|
||||
systemd.network.wait-online.enable = false;
|
||||
boot.initrd.systemd.network.wait-online.enable = false;
|
||||
|
||||
|
||||
# bluetooth
|
||||
hardware.bluetooth.enable = true;
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
avrdude
|
||||
cryptsetup
|
||||
ffmpeg
|
||||
fzf
|
||||
gammastep
|
||||
glib
|
||||
gnupg
|
||||
ispell
|
||||
keychain
|
||||
hugo
|
||||
mosquitto
|
||||
mypy
|
||||
sqlite
|
||||
];
|
||||
|
||||
services.pcscd.enable = true;
|
||||
services.passSecretService.enable = true;
|
||||
|
||||
services.blueman.enable = true;
|
||||
|
||||
networking.nftables = {
|
||||
enable = true;
|
||||
};
|
||||
networking.firewall.trustedInterfaces = [ "incusbr0" ];
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "23.05"; # Did you read the comment?
|
||||
|
||||
virtualisation = {
|
||||
incus.enable = true;
|
||||
podman.enable = true;
|
||||
};
|
||||
}
|
||||
@ -1,12 +0,0 @@
|
||||
{...}:
|
||||
{
|
||||
imports = [
|
||||
./configuration.nix
|
||||
./hardware-configuration.nix
|
||||
../../modules/terminal/base.nix
|
||||
../../modules/terminal/user.nix
|
||||
../../modules/graphical/base.nix
|
||||
../../modules/graphical/printing.nix
|
||||
../../modules/graphical/steam.nix
|
||||
];
|
||||
}
|
||||
@ -1,75 +0,0 @@
|
||||
{ modulesPath, lib, pkgs, ... }:
|
||||
{
|
||||
imports = [
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
(modulesPath + "/profiles/qemu-guest.nix")
|
||||
./disk-config.nix
|
||||
];
|
||||
boot.loader.grub = {
|
||||
# no need to set devices, disko will add all devices that have a EF02 partition to the list already
|
||||
# devices = [ ];
|
||||
efiSupport = true;
|
||||
efiInstallAsRemovable = true;
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
curl
|
||||
];
|
||||
|
||||
networking.hostName = "tien";
|
||||
# do not use DHCP, as dashserv provisions IPs using cloud-init (see service below)
|
||||
networking.useDHCP = pkgs.lib.mkForce false;
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [ 80 443 ];
|
||||
trustedInterfaces = [ "tailscale0" ];
|
||||
};
|
||||
|
||||
services.caddy = {
|
||||
enable = true;
|
||||
email = lib.strings.concatStrings ["mail" "@" "johannes-rothe.de"];
|
||||
virtualHosts = {
|
||||
"johannes-rothe.de".extraConfig = ''
|
||||
reverse_proxy base:11112
|
||||
'';
|
||||
"www.johannes-rothe.de".extraConfig = ''
|
||||
reverse_proxy base:11112
|
||||
'';
|
||||
"cloud.johannes-rothe.de".extraConfig = ''
|
||||
reverse_proxy base:5002
|
||||
'';
|
||||
"feeds.johannes-rothe.de".extraConfig = ''
|
||||
reverse_proxy base:1990
|
||||
'';
|
||||
"git.johannes-rothe.de".extraConfig = ''
|
||||
reverse_proxy base:3001
|
||||
'';
|
||||
"radicale.johannes-rothe.de".extraConfig = ''
|
||||
reverse_proxy base:5232
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
services.cloud-init = {
|
||||
enable = true;
|
||||
network.enable = true;
|
||||
settings = {
|
||||
hostname = "tien";
|
||||
};
|
||||
};
|
||||
|
||||
services.searx = {
|
||||
enable = true;
|
||||
redisCreateLocally = true;
|
||||
settings.server = {
|
||||
bind_address = "0.0.0.0";
|
||||
port = 8888;
|
||||
secret_key = "localonly";
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
services.tailscale.enable = true;
|
||||
|
||||
system.stateVersion = "24.05";
|
||||
}
|
||||
@ -1,19 +0,0 @@
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
networking.hostName = "veil";
|
||||
|
||||
networking.networkmanager.enable = true;
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "24.11"; # Did you read the comment?
|
||||
|
||||
}
|
||||
@ -1,13 +0,0 @@
|
||||
{...}:
|
||||
{
|
||||
imports = [
|
||||
./configuration.nix
|
||||
./hardware-configuration.nix
|
||||
../../modules/terminal/base.nix
|
||||
../../modules/terminal/user.nix
|
||||
../../modules/graphical/amdgpu.nix
|
||||
../../modules/graphical/base.nix
|
||||
../../modules/graphical/printing.nix
|
||||
../../modules/graphical/steam.nix
|
||||
];
|
||||
}
|
||||
@ -1,39 +0,0 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-amd" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/4dda19d7-0520-424e-87e6-771fbfed6ec4";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/AB15-6303";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0077" "dmask=0077" ];
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp7s0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.wlp6s0.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
@ -1,6 +0,0 @@
|
||||
{...}:
|
||||
{
|
||||
boot.initrd.kernelModules = [ "amdgpu" ];
|
||||
# for Southern Islands (SI i.e. GCN 1) cards
|
||||
boot.kernelParams = [ "radeon.si_support=0" "amdgpu.si_support=1" ];
|
||||
}
|
||||
@ -1,91 +0,0 @@
|
||||
{pkgs, ...}:
|
||||
{
|
||||
hardware.sane.enable = true;
|
||||
hardware.graphics.enable = true;
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
calibre
|
||||
chromium
|
||||
dracula-theme
|
||||
eog
|
||||
evince
|
||||
firefox
|
||||
gimp
|
||||
inkscape
|
||||
libreoffice
|
||||
logseq
|
||||
nautilus
|
||||
orca-slicer
|
||||
pavucontrol
|
||||
portfolio
|
||||
pulseaudio
|
||||
signal-desktop
|
||||
simple-scan
|
||||
spotify
|
||||
syncthing
|
||||
thunderbird
|
||||
vlc
|
||||
wayshot
|
||||
wdisplays
|
||||
wl-clipboard
|
||||
xdg-utils
|
||||
yt-dlp
|
||||
];
|
||||
|
||||
# Workaround for logseq
|
||||
nixpkgs.config.permittedInsecurePackages = [
|
||||
"electron-27.3.11"
|
||||
];
|
||||
|
||||
programs = {
|
||||
light.enable = true;
|
||||
sway.enable = true;
|
||||
};
|
||||
|
||||
security.rtkit.enable = true;
|
||||
|
||||
services = {
|
||||
dbus.enable = true;
|
||||
gvfs.enable = true;
|
||||
greetd = {
|
||||
enable = true;
|
||||
settings = {
|
||||
default_session = {
|
||||
command = "${pkgs.greetd.tuigreet}/bin/tuigreet --time --asterisks --cmd sway";
|
||||
user = "rothe";
|
||||
};
|
||||
};
|
||||
};
|
||||
pipewire = {
|
||||
enable = true;
|
||||
alsa.enable = true;
|
||||
pulse.enable = true;
|
||||
};
|
||||
syncthing = {
|
||||
enable = true;
|
||||
user = "rothe";
|
||||
group = "users";
|
||||
dataDir = "/home/rothe";
|
||||
overrideFolders = false;
|
||||
overrideDevices = false;
|
||||
};
|
||||
};
|
||||
|
||||
programs = {
|
||||
# Helper for nixos output
|
||||
nh = {
|
||||
enable = true;
|
||||
clean.enable = true;
|
||||
clean.extraArgs = "--keep-since 4d --keep 3";
|
||||
flake = "/home/rothe/src/nixos-config";
|
||||
};
|
||||
};
|
||||
|
||||
xdg.portal = {
|
||||
enable = true;
|
||||
wlr.enable = true;
|
||||
# gtk portal needed to make gtk apps happy
|
||||
extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
|
||||
config.common.default = "*";
|
||||
};
|
||||
}
|
||||
@ -1,9 +0,0 @@
|
||||
{...}:
|
||||
{
|
||||
programs.steam = {
|
||||
enable = true;
|
||||
remotePlay.openFirewall = true;
|
||||
dedicatedServer.openFirewall = true;
|
||||
localNetworkGameTransfers.openFirewall = true;
|
||||
};
|
||||
}
|
||||
@ -1,54 +0,0 @@
|
||||
{pkgs, ...}:
|
||||
{
|
||||
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||
|
||||
time.timeZone = "Europe/Berlin";
|
||||
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
|
||||
i18n.extraLocaleSettings = {
|
||||
LC_ADDRESS = "de_DE.UTF-8";
|
||||
LC_IDENTIFICATION = "de_DE.UTF-8";
|
||||
LC_MEASUREMENT = "de_DE.UTF-8";
|
||||
LC_MONETARY = "de_DE.UTF-8";
|
||||
LC_NAME = "de_DE.UTF-8";
|
||||
LC_NUMERIC = "de_DE.UTF-8";
|
||||
LC_PAPER = "de_DE.UTF-8";
|
||||
LC_TELEPHONE = "de_DE.UTF-8";
|
||||
LC_TIME = "de_DE.UTF-8";
|
||||
};
|
||||
|
||||
console.keyMap = "de-latin1-nodeadkeys";
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
bind
|
||||
cmake
|
||||
curl
|
||||
gcc
|
||||
git
|
||||
gnumake
|
||||
nmap
|
||||
tmux
|
||||
tree
|
||||
unzip
|
||||
wget
|
||||
];
|
||||
|
||||
hardware.keyboard.zsa.enable = true;
|
||||
|
||||
programs = {
|
||||
fish.enable = true;
|
||||
gnupg.agent = {
|
||||
enable = true;
|
||||
enableSSHSupport = true;
|
||||
};
|
||||
};
|
||||
|
||||
services = {
|
||||
fwupd.enable = true;
|
||||
resolved.enable = true;
|
||||
tailscale.enable = true;
|
||||
tailscale.useRoutingFeatures = "client";
|
||||
};
|
||||
}
|
||||
@ -1,10 +0,0 @@
|
||||
{pkgs, ...}:
|
||||
{
|
||||
|
||||
users.users.rothe = {
|
||||
isNormalUser = true;
|
||||
description = "rothe";
|
||||
extraGroups = [ "networkmanager" "wheel" "video" "scanner" "lp" "incus-admin" "dialout" ];
|
||||
shell = pkgs.fish;
|
||||
};
|
||||
}
|
||||
@ -1,4 +1,4 @@
|
||||
{ pkgs, ... }: {
|
||||
{ inputs, lib, config, pkgs, ... }: {
|
||||
# Enable CUPS to print documents.
|
||||
services.printing.enable = true;
|
||||
|
||||
@ -10,8 +10,7 @@
|
||||
};
|
||||
|
||||
services.printing.drivers = [
|
||||
(pkgs.writeTextDir "share/cups/model/kyocera_fs-1300d.ppd"
|
||||
(builtins.readFile ../../files/kyocera_fs-1300d.ppd))
|
||||
(pkgs.writeTextDir "share/cups/model/kyocera_fs-1300d.ppd" (builtins.readFile ../../../files/kyocera_fs-1300d.ppd))
|
||||
];
|
||||
hardware.printers = {
|
||||
ensurePrinters = [
|
||||
30
nixos/tien/secrets.yaml
Normal file
30
nixos/tien/secrets.yaml
Normal file
@ -0,0 +1,30 @@
|
||||
foo: ENC[AES256_GCM,data:HqMg,iv:LdYZPucCO7rOgOFtuzSwSoOsW/GvPoysLfZa2w+E03E=,tag:DpE52f6iWiQ691bwJNFBZA==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
azure_kv: []
|
||||
hc_vault: []
|
||||
age:
|
||||
- recipient: age1xy66lg9eh572ge0y7zzh34f78s8l9hnkxhg3r4gn98ph95mz25tszgerul
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqdkRUVWpSbjVvRUpiUTNj
|
||||
RDQ5aDNKNGZCd0ZGWkczQWRVUWRraTk3bHlvCjQ2ZGtvM3dJQnl0Wjc2ZmJYNGJV
|
||||
QnhuMG1UVEZDUXdMK2M0L3c5Um4rQ28KLS0tIGtQcGVkQktmUkwwbSsrdC8rVnZE
|
||||
T3VhOFF5NGlER2FCQlUrWFN0RHNSeW8KTFwMDtofyqFrnIFs9qy1gHiw8eVX7pcm
|
||||
2k6yLOeyP2NaksDl74OSrmUECxZKMRPspgn1ZlznibDQKyCVXVVKZg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age12j6x69evhvh6ljngq4lgesnezf7hwafc33z7nj9urnsl5xzlhp5sf6szck
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFOGhZQnBld1lEeGNZVkpi
|
||||
TzFKaFJyVVNqKzNQQkN0M3ZWRUlkY1g3SzE4CmlnVVlMbWRTVHd4KzV3ZHNuR21S
|
||||
bmdJZDJ4YzVDZ3JTcDVucmhpd2xJNFUKLS0tIGRzcUt6cjl3UGpldVBTeG01V1dX
|
||||
eWx2UWdkUXdrSkxPT1NXS2xHengreWsKR31+5SpYGOJyd/SFmzrThBWOVt1GU1hr
|
||||
qTQqyc2/XbMQCc/SrYCa/FhRLboKUFkAO2XbMoH5zEwmkFtuCEoNvg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2024-11-20T21:34:05Z"
|
||||
mac: ENC[AES256_GCM,data:xx007JasOAWh2Os1DKkDQ3QMGmxN3oBpmL/t8/UWleYHVR3CTjYOTiSEguurFFIOqW7sK3ZAxnKbIr3mwDXs2VA1LO6L2UvBA0NaFgP6Qws+YvjF+dzRrxl+fXOMJz5wxOJROYo3VVI4zH7xnI22ENGc7VLDholwbx5EZDbUL7Y=,iv:KZxPU6RbLY2wZIX/hsO8OLweAxGe30LOSHWa9MI1ydA=,tag:oewmLJbInGoX7ZwpljRAkA==,type:str]
|
||||
pgp: []
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.8.1
|
||||
7
sway.nix
Normal file
7
sway.nix
Normal file
@ -0,0 +1,7 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
{
|
||||
programs.sway = {
|
||||
enable = true;
|
||||
};
|
||||
}
|
||||
221
vps-configuration.nix
Normal file
221
vps-configuration.nix
Normal file
@ -0,0 +1,221 @@
|
||||
{ config, inputs, modulesPath, lib, pkgs, ... }:
|
||||
let
|
||||
hostname = "tien";
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
(modulesPath + "/profiles/qemu-guest.nix")
|
||||
./vps-disk-config.nix
|
||||
inputs.sops-nix.nixosModules.sops
|
||||
];
|
||||
boot.loader.grub = {
|
||||
# no need to set devices, disko will add all devices that have a EF02 partition to the list already
|
||||
# devices = [ ];
|
||||
efiSupport = true;
|
||||
efiInstallAsRemovable = true;
|
||||
};
|
||||
|
||||
sops = {
|
||||
defaultSopsFile = ./nixos/tien/secrets.yaml;
|
||||
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
secrets = {
|
||||
foo = {};
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
authelia
|
||||
curl
|
||||
vim
|
||||
];
|
||||
|
||||
networking.hostName = hostname;
|
||||
# do not use DHCP, as dashserv provisions IPs using cloud-init (see service below)
|
||||
networking.useDHCP = pkgs.lib.mkForce false;
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [ 80 443 ];
|
||||
trustedInterfaces = [ "tailscale0" ];
|
||||
};
|
||||
|
||||
services.authelia.instances.main = {
|
||||
enable = true;
|
||||
secrets = {
|
||||
jwtSecretFile = "${pkgs.writeText "jwtSecretFile" "supersecretkeyissupersecret"}";
|
||||
storageEncryptionKeyFile = "${pkgs.writeText "storageEncryptionKeyFile" "supersecretkeyissupersecret"}";
|
||||
sessionSecretFile = "${pkgs.writeText "sessionSecretFile" "supersecretkeyissupersecret"}";
|
||||
};
|
||||
settings = {
|
||||
theme = "auto";
|
||||
default_redirection_url = "https://auth.johannes-rothe.de";
|
||||
|
||||
server = {
|
||||
host = "127.0.0.1";
|
||||
port = 9091;
|
||||
};
|
||||
|
||||
log = {
|
||||
level = "debug";
|
||||
format = "text";
|
||||
};
|
||||
|
||||
authentication_backend = {
|
||||
#file = {
|
||||
# path = "/var/lib/authelia-main/users_database.yml";
|
||||
#};
|
||||
password_reset.disable = false;
|
||||
refresh_interval = "1m";
|
||||
ldap = {
|
||||
implementation = "custom";
|
||||
url = "ldap://localhost:3890";
|
||||
timeout = "5s";
|
||||
start_tls = false;
|
||||
base_dn = "dc=accounts,dc=johannes-rothe,dc=de";
|
||||
additional_users_dn = "ou=people";
|
||||
users_filter = "(&({username_attribute}={input})(objectClass=person))";
|
||||
additional_groups_dn = "ou=groups";
|
||||
groups_filter = "(member={dn})";
|
||||
display_name_attribute = "displayName";
|
||||
username_attribute = "uid";
|
||||
group_name_attribute = "cn";
|
||||
mail_attribute = "mail";
|
||||
# "bind_user" should be the username you created for authentication with the "lldap_strict_readonly" permission. It is not recommended to use an actual admin account here.
|
||||
# If you are configuring Authelia to change user passwords, then the account used here needs the "lldap_password_manager" permission instead.
|
||||
user = "uid=bind_user,ou=people,dc=accounts,dc=johannes-rothe,dc=de";
|
||||
# Password can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html
|
||||
password = "REPLACE_ME";
|
||||
};
|
||||
};
|
||||
|
||||
access_control = {
|
||||
default_policy = "one_factor";
|
||||
rules = [
|
||||
#{
|
||||
# domain = ["auth.example.com"];
|
||||
# policy = "bypass";
|
||||
#}
|
||||
#{
|
||||
# domain = ["*.example.com"];
|
||||
# policy = "one_factor";
|
||||
#}
|
||||
];
|
||||
};
|
||||
|
||||
session = {
|
||||
name = "authelia_session";
|
||||
expiration = "12h";
|
||||
inactivity = "45m";
|
||||
remember_me_duration = "1M";
|
||||
domain = "example.com";
|
||||
redis.host = "/run/redis-authelia-main/redis.sock";
|
||||
};
|
||||
|
||||
regulation = {
|
||||
max_retries = 3;
|
||||
find_time = "5m";
|
||||
ban_time = "15m";
|
||||
};
|
||||
|
||||
storage = {
|
||||
local = {
|
||||
path = "/var/lib/authelia-main/db.sqlite3";
|
||||
};
|
||||
};
|
||||
|
||||
notifier = {
|
||||
disable_startup_check = false;
|
||||
filesystem = {
|
||||
filename = "/var/lib/authelia-main/notification.txt";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.redis.servers.authelia-main = {
|
||||
enable = true;
|
||||
user = "authelia-main";
|
||||
port = 0;
|
||||
unixSocket = "/run/redis-authelia-main/redis.sock";
|
||||
unixSocketPerm = 600;
|
||||
};
|
||||
|
||||
services.headscale = {
|
||||
enable = true;
|
||||
address = "0.0.0.0";
|
||||
port = 8080;
|
||||
settings = {
|
||||
dns_config.base_domain= "johannes-rothe.de";
|
||||
server_url = "https://headscale.johannes-rothe.de";
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
services.caddy = {
|
||||
enable = true;
|
||||
email = lib.strings.concatStrings ["mail" "@" "johannes-rothe.de"];
|
||||
virtualHosts = {
|
||||
"johannes-rothe.de".extraConfig = ''
|
||||
reverse_proxy base:11112
|
||||
'';
|
||||
"www.johannes-rothe.de".extraConfig = ''
|
||||
reverse_proxy base:11112
|
||||
'';
|
||||
#"accounts.johannes-rothe.de".extraConfig = ''
|
||||
# reverse_proxy localhost:9095
|
||||
#'';
|
||||
#"auth.johannes-rothe.de".extraConfig = ''
|
||||
# reverse_proxy localhost:9091
|
||||
#'';
|
||||
"cloud.johannes-rothe.de".extraConfig = ''
|
||||
reverse_proxy base:5002
|
||||
'';
|
||||
"feeds.johannes-rothe.de".extraConfig = ''
|
||||
reverse_proxy base:1990
|
||||
'';
|
||||
"git.johannes-rothe.de".extraConfig = ''
|
||||
reverse_proxy base:3001
|
||||
'';
|
||||
#"headscale.johannes-rothe.de".extraConfig = ''
|
||||
# reverse_proxy localhost:8080
|
||||
#'';
|
||||
"radicale.johannes-rothe.de".extraConfig = ''
|
||||
reverse_proxy base:5232
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
services.cloud-init = {
|
||||
enable = true;
|
||||
network.enable = true;
|
||||
settings = {
|
||||
hostname = hostname;
|
||||
};
|
||||
};
|
||||
|
||||
services.lldap = {
|
||||
enable = true;
|
||||
settings = {
|
||||
http_host = "127.0.0.1";
|
||||
http_port = 9095;
|
||||
http_url = "https://accounts.johannes-rothe.de";
|
||||
ldap_base_dn= "dc=accounts,dc=johannes-rothe,dc=de";
|
||||
};
|
||||
};
|
||||
|
||||
services.searx = {
|
||||
enable = true;
|
||||
redisCreateLocally = true;
|
||||
settings.server = {
|
||||
bind_address = "0.0.0.0";
|
||||
port = 8888;
|
||||
secret_key = "localonly";
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
services.tailscale.enable = true;
|
||||
|
||||
system.stateVersion = "24.05";
|
||||
}
|
||||
Loading…
x
Reference in New Issue
Block a user