Compare commits
2 commits
334a41619a
...
ee46717618
Author | SHA1 | Date | |
---|---|---|---|
ee46717618 | |||
4750ca705d |
27 changed files with 284 additions and 205 deletions
|
@ -1,9 +1,10 @@
|
||||||
{config, ...}: {
|
{ config, ... }:
|
||||||
|
{
|
||||||
security.acme = {
|
security.acme = {
|
||||||
acceptTerms = true;
|
acceptTerms = true;
|
||||||
defaults.email = "hey@winston.sh";
|
defaults.email = "hey@winston.sh";
|
||||||
certs."winston.sh" = {
|
certs."winston.sh" = {
|
||||||
extraDomainNames = ["*.winston.sh"];
|
extraDomainNames = [ "*.winston.sh" ];
|
||||||
dnsProvider = "porkbun";
|
dnsProvider = "porkbun";
|
||||||
credentialsFile = config.age.secrets."lego/porkbun-credentials".path;
|
credentialsFile = config.age.secrets."lego/porkbun-credentials".path;
|
||||||
};
|
};
|
||||||
|
|
|
@ -1,4 +1,5 @@
|
||||||
{pkgs, ...}: {
|
{ pkgs, ... }:
|
||||||
|
{
|
||||||
imports = [
|
imports = [
|
||||||
./games
|
./games
|
||||||
./secrets
|
./secrets
|
||||||
|
@ -9,6 +10,6 @@
|
||||||
./users.nix
|
./users.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
environment.systemPackages = with pkgs; [wezterm.terminfo];
|
environment.systemPackages = with pkgs; [ wezterm.terminfo ];
|
||||||
programs.git.enable = true;
|
programs.git.enable = true;
|
||||||
}
|
}
|
||||||
|
|
|
@ -1,5 +1,7 @@
|
||||||
{lib, ...}: {
|
{ lib, ... }:
|
||||||
nixpkgs.config.allowUnfreePredicate = pkg:
|
{
|
||||||
|
nixpkgs.config.allowUnfreePredicate =
|
||||||
|
pkg:
|
||||||
builtins.elem (lib.getName pkg) [
|
builtins.elem (lib.getName pkg) [
|
||||||
"valheim-server"
|
"valheim-server"
|
||||||
"steamworks-sdk-redist"
|
"steamworks-sdk-redist"
|
||||||
|
|
|
@ -8,7 +8,7 @@
|
||||||
};
|
};
|
||||||
openssh = {
|
openssh = {
|
||||||
enable = true;
|
enable = true;
|
||||||
ports = [22];
|
ports = [ 22 ];
|
||||||
settings = {
|
settings = {
|
||||||
KexAlgorithms = [
|
KexAlgorithms = [
|
||||||
"curve25519-sha256"
|
"curve25519-sha256"
|
||||||
|
|
|
@ -1,12 +1,16 @@
|
||||||
{
|
{
|
||||||
nix = {
|
nix = {
|
||||||
gc.automatic = true;
|
gc.automatic = true;
|
||||||
settings =
|
settings = (import ../flake.nix).nixConfig // {
|
||||||
(import ../flake.nix).nixConfig
|
|
||||||
// {
|
|
||||||
auto-optimise-store = true;
|
auto-optimise-store = true;
|
||||||
experimental-features = ["nix-command" "flakes"];
|
experimental-features = [
|
||||||
trusted-users = ["@wheel" "winston"];
|
"nix-command"
|
||||||
|
"flakes"
|
||||||
|
];
|
||||||
|
trusted-users = [
|
||||||
|
"@wheel"
|
||||||
|
"winston"
|
||||||
|
];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
@ -1,7 +1,13 @@
|
||||||
{lib, ...}: {
|
{ lib, ... }:
|
||||||
age.secrets = with builtins;
|
{
|
||||||
listToAttrs (map (k: {
|
age.secrets =
|
||||||
|
with builtins;
|
||||||
|
listToAttrs (
|
||||||
|
map (k: {
|
||||||
name = lib.removeSuffix ".age" k;
|
name = lib.removeSuffix ".age" k;
|
||||||
value = {file = ./. + "/${k}";};
|
value = {
|
||||||
}) (attrNames (import ./secrets.nix)));
|
file = ./. + "/${k}";
|
||||||
|
};
|
||||||
|
}) (attrNames (import ./secrets.nix))
|
||||||
|
);
|
||||||
}
|
}
|
||||||
|
|
|
@ -2,8 +2,12 @@ let
|
||||||
users.winston = "age1yubikey1qfkn095xth4ukxjye98ew4ul6xdkyz7sek0hd67yfjs5z6tv7q9jgnfchls";
|
users.winston = "age1yubikey1qfkn095xth4ukxjye98ew4ul6xdkyz7sek0hd67yfjs5z6tv7q9jgnfchls";
|
||||||
systems.main-node = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFcY5fuyxK8rs3eocLuLnvSPDL6qcvq7oUdYrE+wLj0y";
|
systems.main-node = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFcY5fuyxK8rs3eocLuLnvSPDL6qcvq7oUdYrE+wLj0y";
|
||||||
|
|
||||||
default = [users.winston systems.main-node];
|
default = [
|
||||||
in {
|
users.winston
|
||||||
|
systems.main-node
|
||||||
|
];
|
||||||
|
in
|
||||||
|
{
|
||||||
"containers/faerber.env.age".publicKeys = default;
|
"containers/faerber.env.age".publicKeys = default;
|
||||||
"containers/ghcr-token.age".publicKeys = default;
|
"containers/ghcr-token.age".publicKeys = default;
|
||||||
|
|
||||||
|
|
|
@ -1,4 +1,5 @@
|
||||||
{config, ...}: {
|
{ config, ... }:
|
||||||
|
{
|
||||||
services.atticd = {
|
services.atticd = {
|
||||||
enable = true;
|
enable = true;
|
||||||
credentialsFile = config.age.secrets."services/attic/atticd.env".path;
|
credentialsFile = config.age.secrets."services/attic/atticd.env".path;
|
||||||
|
|
|
@ -1,8 +1,5 @@
|
||||||
|
{ config, pkgs, ... }:
|
||||||
{
|
{
|
||||||
config,
|
|
||||||
pkgs,
|
|
||||||
...
|
|
||||||
}: {
|
|
||||||
services.atuin = {
|
services.atuin = {
|
||||||
enable = true;
|
enable = true;
|
||||||
package = pkgs.unstable.atuin;
|
package = pkgs.unstable.atuin;
|
||||||
|
|
|
@ -1 +1 @@
|
||||||
{}
|
{ }
|
||||||
|
|
|
@ -3,14 +3,17 @@
|
||||||
inputs,
|
inputs,
|
||||||
pkgs,
|
pkgs,
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
modules = ["services/misc/forgejo.nix" "services/continuous-integration/gitea-actions-runner.nix"];
|
let
|
||||||
in {
|
modules = [
|
||||||
|
"services/misc/forgejo.nix"
|
||||||
|
"services/continuous-integration/gitea-actions-runner.nix"
|
||||||
|
];
|
||||||
|
in
|
||||||
|
{
|
||||||
# swap out stable for unstable modules
|
# swap out stable for unstable modules
|
||||||
disabledModules = modules;
|
disabledModules = modules;
|
||||||
imports =
|
imports = builtins.map (v: "${inputs.nixpkgs-unstable}/nixos/modules/${v}") modules;
|
||||||
builtins.map (v: "${inputs.nixpkgs-unstable}/nixos/modules/${v}")
|
|
||||||
modules;
|
|
||||||
|
|
||||||
age.secrets = {
|
age.secrets = {
|
||||||
"services/forgejo/minio-secretkey".owner = config.services.forgejo.user;
|
"services/forgejo/minio-secretkey".owner = config.services.forgejo.user;
|
||||||
|
@ -18,7 +21,7 @@ in {
|
||||||
};
|
};
|
||||||
|
|
||||||
# forgejo ssh
|
# forgejo ssh
|
||||||
networking.firewall.allowedTCPPorts = [22];
|
networking.firewall.allowedTCPPorts = [ 22 ];
|
||||||
|
|
||||||
# indexer
|
# indexer
|
||||||
services.elasticsearch.enable = true;
|
services.elasticsearch.enable = true;
|
||||||
|
@ -44,10 +47,13 @@ in {
|
||||||
settings = {
|
settings = {
|
||||||
DEFAULT.APP_NAME = "winston's forgejo";
|
DEFAULT.APP_NAME = "winston's forgejo";
|
||||||
|
|
||||||
indexer = with config.services.elasticsearch; let
|
indexer =
|
||||||
|
with config.services.elasticsearch;
|
||||||
|
let
|
||||||
indexer = "elasticsearch";
|
indexer = "elasticsearch";
|
||||||
conn = "http://${listenAddress}:${toString port}";
|
conn = "http://${listenAddress}:${toString port}";
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
REPO_INDEXER_ENABLED = true;
|
REPO_INDEXER_ENABLED = true;
|
||||||
REPO_INDEXER_CONN_STR = conn;
|
REPO_INDEXER_CONN_STR = conn;
|
||||||
REPO_INDEXER_TYPE = indexer;
|
REPO_INDEXER_TYPE = indexer;
|
||||||
|
@ -121,7 +127,7 @@ in {
|
||||||
name = "main";
|
name = "main";
|
||||||
url = config.services.forgejo.settings.server.ROOT_URL;
|
url = config.services.forgejo.settings.server.ROOT_URL;
|
||||||
tokenFile = config.age.secrets."services/forgejo/runner-token".path;
|
tokenFile = config.age.secrets."services/forgejo/runner-token".path;
|
||||||
labels = ["ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest"];
|
labels = [ "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest" ];
|
||||||
settings.container = {
|
settings.container = {
|
||||||
network = "host";
|
network = "host";
|
||||||
options = "--add-host=forgejo.winston.sh:host-gateway";
|
options = "--add-host=forgejo.winston.sh:host-gateway";
|
||||||
|
|
|
@ -1,4 +1,5 @@
|
||||||
{config, ...}: {
|
{ config, ... }:
|
||||||
|
{
|
||||||
services.freshrss = rec {
|
services.freshrss = rec {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
||||||
|
|
|
@ -1,10 +1,15 @@
|
||||||
{config, ...}: {
|
{ config, ... }:
|
||||||
|
{
|
||||||
services.geoipupdate = {
|
services.geoipupdate = {
|
||||||
enable = true;
|
enable = true;
|
||||||
settings = {
|
settings = {
|
||||||
AccountID = 1062126;
|
AccountID = 1062126;
|
||||||
LicenseKey = config.age.secrets."services/geoipupdate/license".path;
|
LicenseKey = config.age.secrets."services/geoipupdate/license".path;
|
||||||
EditionIDs = ["GeoLite2-ASN" "GeoLite2-City" "GeoLite2-Country"];
|
EditionIDs = [
|
||||||
|
"GeoLite2-ASN"
|
||||||
|
"GeoLite2-City"
|
||||||
|
"GeoLite2-Country"
|
||||||
|
];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
@ -1,4 +1,5 @@
|
||||||
{config, ...}: {
|
{ config, ... }:
|
||||||
|
{
|
||||||
services.minio = {
|
services.minio = {
|
||||||
enable = true;
|
enable = true;
|
||||||
browser = true;
|
browser = true;
|
||||||
|
|
|
@ -3,7 +3,8 @@
|
||||||
lib,
|
lib,
|
||||||
pkgs,
|
pkgs,
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
|
let
|
||||||
geoipDir = config.services.geoipupdate.settings.DatabaseDirectory;
|
geoipDir = config.services.geoipupdate.settings.DatabaseDirectory;
|
||||||
|
|
||||||
log_params = [
|
log_params = [
|
||||||
|
@ -25,7 +26,8 @@
|
||||||
];
|
];
|
||||||
log_format = lib.concatStringsSep " " (map (p: "${p}=\"\$${p}\"") log_params);
|
log_format = lib.concatStringsSep " " (map (p: "${p}=\"\$${p}\"") log_params);
|
||||||
log_file = "/var/log/nginx/access.log";
|
log_file = "/var/log/nginx/access.log";
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
services.grafana = {
|
services.grafana = {
|
||||||
enable = true;
|
enable = true;
|
||||||
settings = {
|
settings = {
|
||||||
|
@ -50,7 +52,7 @@ in {
|
||||||
};
|
};
|
||||||
|
|
||||||
services.nginx = {
|
services.nginx = {
|
||||||
additionalModules = [pkgs.nginxModules.geoip2];
|
additionalModules = [ pkgs.nginxModules.geoip2 ];
|
||||||
commonHttpConfig =
|
commonHttpConfig =
|
||||||
# nginx
|
# nginx
|
||||||
''
|
''
|
||||||
|
@ -82,10 +84,12 @@ in {
|
||||||
|
|
||||||
globalConfig.scrape_interval = "10s";
|
globalConfig.scrape_interval = "10s";
|
||||||
scrapeConfigs =
|
scrapeConfigs =
|
||||||
(builtins.map (config: {
|
(builtins.map
|
||||||
|
(config: {
|
||||||
inherit (config) job_name;
|
inherit (config) job_name;
|
||||||
static_configs = [{targets = ["localhost:${toString config.port}"];}];
|
static_configs = [ { targets = [ "localhost:${toString config.port}" ]; } ];
|
||||||
}) [
|
})
|
||||||
|
[
|
||||||
{
|
{
|
||||||
job_name = "fail2ban";
|
job_name = "fail2ban";
|
||||||
port = 9191;
|
port = 9191;
|
||||||
|
@ -106,17 +110,20 @@ in {
|
||||||
job_name = "postgres";
|
job_name = "postgres";
|
||||||
port = config.services.prometheus.exporters.postgres.port;
|
port = config.services.prometheus.exporters.postgres.port;
|
||||||
}
|
}
|
||||||
])
|
]
|
||||||
|
)
|
||||||
++ [
|
++ [
|
||||||
{
|
{
|
||||||
job_name = "minio";
|
job_name = "minio";
|
||||||
bearer_token_file = config.age.secrets."services/prometheus/minio-bearer-token".path;
|
bearer_token_file = config.age.secrets."services/prometheus/minio-bearer-token".path;
|
||||||
metrics_path = "/minio/v2/metrics/cluster";
|
metrics_path = "/minio/v2/metrics/cluster";
|
||||||
static_configs = [{targets = [config.services.minio.listenAddress];}];
|
static_configs = [ { targets = [ config.services.minio.listenAddress ]; } ];
|
||||||
}
|
}
|
||||||
{
|
{
|
||||||
job_name = "forgejo";
|
job_name = "forgejo";
|
||||||
static_configs = with config.services.forgejo.settings.server; [{targets = ["${HTTP_ADDR}:${toString HTTP_PORT}"];}];
|
static_configs = with config.services.forgejo.settings.server; [
|
||||||
|
{ targets = [ "${HTTP_ADDR}:${toString HTTP_PORT}" ]; }
|
||||||
|
];
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
|
|
||||||
|
@ -159,14 +166,30 @@ in {
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
|
|
||||||
source.files = [log_file];
|
source.files = [ log_file ];
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
node = {
|
node = {
|
||||||
enable = true;
|
enable = true;
|
||||||
enabledCollectors = ["logind" "processes" "systemd"];
|
enabledCollectors = [
|
||||||
disabledCollectors = ["bonding" "fibrechannel" "infiniband" "ipvs" "mdadm" "nfs" "nfsd" "nvme" "tapestats" "watchdog" "zfs"];
|
"logind"
|
||||||
|
"processes"
|
||||||
|
"systemd"
|
||||||
|
];
|
||||||
|
disabledCollectors = [
|
||||||
|
"bonding"
|
||||||
|
"fibrechannel"
|
||||||
|
"infiniband"
|
||||||
|
"ipvs"
|
||||||
|
"mdadm"
|
||||||
|
"nfs"
|
||||||
|
"nfsd"
|
||||||
|
"nvme"
|
||||||
|
"tapestats"
|
||||||
|
"watchdog"
|
||||||
|
"zfs"
|
||||||
|
];
|
||||||
};
|
};
|
||||||
postgres = {
|
postgres = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
@ -177,11 +200,11 @@ in {
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.services.prometheus-fail2ban-exporter = {
|
systemd.services.prometheus-fail2ban-exporter = {
|
||||||
wantedBy = ["multi-user.target"];
|
wantedBy = [ "multi-user.target" ];
|
||||||
after = ["network.target"];
|
after = [ "network.target" ];
|
||||||
requires = ["network-online.target"];
|
requires = [ "network-online.target" ];
|
||||||
serviceConfig = {
|
serviceConfig = {
|
||||||
ExecStart = [(lib.getExe pkgs.prometheus-fail2ban-exporter)];
|
ExecStart = [ (lib.getExe pkgs.prometheus-fail2ban-exporter) ];
|
||||||
Restart = "on-failure";
|
Restart = "on-failure";
|
||||||
NoNewPrivileges = true;
|
NoNewPrivileges = true;
|
||||||
User = "root";
|
User = "root";
|
||||||
|
|
|
@ -1,8 +1,5 @@
|
||||||
|
{ config, pkgs, ... }:
|
||||||
{
|
{
|
||||||
config,
|
|
||||||
pkgs,
|
|
||||||
...
|
|
||||||
}: {
|
|
||||||
age.secrets = {
|
age.secrets = {
|
||||||
"services/nextcloud/admin-password".owner = "nextcloud";
|
"services/nextcloud/admin-password".owner = "nextcloud";
|
||||||
"services/nextcloud/s3-secret".owner = "nextcloud";
|
"services/nextcloud/s3-secret".owner = "nextcloud";
|
||||||
|
@ -20,8 +17,7 @@
|
||||||
};
|
};
|
||||||
|
|
||||||
extraApps = {
|
extraApps = {
|
||||||
inherit
|
inherit (config.services.nextcloud.package.packages.apps)
|
||||||
(config.services.nextcloud.package.packages.apps)
|
|
||||||
end_to_end_encryption
|
end_to_end_encryption
|
||||||
previewgenerator
|
previewgenerator
|
||||||
twofactor_webauthn
|
twofactor_webauthn
|
||||||
|
|
|
@ -1,13 +1,11 @@
|
||||||
{
|
{ config, pkgs, ... }:
|
||||||
config,
|
let
|
||||||
pkgs,
|
snakeoilCert = pkgs.runCommand "nginx-snakeoil-cert" { buildInputs = [ pkgs.openssl ]; } ''
|
||||||
...
|
|
||||||
}: let
|
|
||||||
snakeoilCert = pkgs.runCommand "nginx-snakeoil-cert" {buildInputs = [pkgs.openssl];} ''
|
|
||||||
mkdir "$out"
|
mkdir "$out"
|
||||||
openssl req -newkey rsa:4096 -x509 -sha256 -days 36500 -subj '/CN=Snakeoil CA' -nodes -out "$out/cert.pem" -keyout "$out/cert.key"
|
openssl req -newkey rsa:4096 -x509 -sha256 -days 36500 -subj '/CN=Snakeoil CA' -nodes -out "$out/cert.pem" -keyout "$out/cert.key"
|
||||||
'';
|
'';
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
services.nginx = {
|
services.nginx = {
|
||||||
enable = true;
|
enable = true;
|
||||||
package = pkgs.nginxMainline;
|
package = pkgs.nginxMainline;
|
||||||
|
@ -44,11 +42,14 @@ in {
|
||||||
|
|
||||||
security.dhparams = {
|
security.dhparams = {
|
||||||
enable = true;
|
enable = true;
|
||||||
params.nginx = {};
|
params.nginx = { };
|
||||||
};
|
};
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [80 443];
|
networking.firewall.allowedTCPPorts = [
|
||||||
|
80
|
||||||
|
443
|
||||||
|
];
|
||||||
|
|
||||||
# allow nginx to access Acme secrets
|
# allow nginx to access Acme secrets
|
||||||
users.users.nginx.extraGroups = ["acme"];
|
users.users.nginx.extraGroups = [ "acme" ];
|
||||||
}
|
}
|
||||||
|
|
|
@ -1,4 +1,5 @@
|
||||||
{pkgs, ...}: {
|
{ pkgs, ... }:
|
||||||
|
{
|
||||||
services.postgresql = {
|
services.postgresql = {
|
||||||
enable = true;
|
enable = true;
|
||||||
package = pkgs.postgresql_14;
|
package = pkgs.postgresql_14;
|
||||||
|
|
|
@ -3,8 +3,9 @@
|
||||||
inputs,
|
inputs,
|
||||||
pkgs,
|
pkgs,
|
||||||
...
|
...
|
||||||
}: {
|
}:
|
||||||
imports = ["${inputs.nixpkgs-unstable}/nixos/modules/services/misc/renovate.nix"];
|
{
|
||||||
|
imports = [ "${inputs.nixpkgs-unstable}/nixos/modules/services/misc/renovate.nix" ];
|
||||||
|
|
||||||
services.renovate = {
|
services.renovate = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
@ -23,7 +24,7 @@
|
||||||
platform = "gitea";
|
platform = "gitea";
|
||||||
gitAuthor = "renovate[bot] <renovate@winston.sh>";
|
gitAuthor = "renovate[bot] <renovate@winston.sh>";
|
||||||
autodiscover = true;
|
autodiscover = true;
|
||||||
autodiscoverTopics = ["managed-by-renovate"];
|
autodiscoverTopics = [ "managed-by-renovate" ];
|
||||||
|
|
||||||
# performance
|
# performance
|
||||||
cachePrivatePackages = true;
|
cachePrivatePackages = true;
|
||||||
|
|
|
@ -1,8 +1,5 @@
|
||||||
|
{ config, pkgs, ... }:
|
||||||
{
|
{
|
||||||
config,
|
|
||||||
pkgs,
|
|
||||||
...
|
|
||||||
}: {
|
|
||||||
services.wakapi = {
|
services.wakapi = {
|
||||||
enable = true;
|
enable = true;
|
||||||
package = pkgs.unstable.wakapi;
|
package = pkgs.unstable.wakapi;
|
||||||
|
@ -30,7 +27,7 @@
|
||||||
# for agenix owner permissions
|
# for agenix owner permissions
|
||||||
age.secrets."services/wakapi/password-salt.env".owner = "wakapi";
|
age.secrets."services/wakapi/password-salt.env".owner = "wakapi";
|
||||||
users = {
|
users = {
|
||||||
groups.wakapi = {};
|
groups.wakapi = { };
|
||||||
users.wakapi = {
|
users.wakapi = {
|
||||||
isSystemUser = true;
|
isSystemUser = true;
|
||||||
group = "wakapi";
|
group = "wakapi";
|
||||||
|
|
|
@ -3,29 +3,35 @@
|
||||||
lib,
|
lib,
|
||||||
pkgs,
|
pkgs,
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
|
let
|
||||||
nu_scripts = "${pkgs.nu_scripts}/share/nu_scripts";
|
nu_scripts = "${pkgs.nu_scripts}/share/nu_scripts";
|
||||||
mkCompletions = completions:
|
mkCompletions =
|
||||||
|
completions:
|
||||||
lib.concatStringsSep "\n" (
|
lib.concatStringsSep "\n" (
|
||||||
builtins.map (
|
builtins.map (
|
||||||
el: "source ${nu_scripts}/custom-completions/${el.name or el}/${el.filename or el}-completions.nu"
|
el: "source ${nu_scripts}/custom-completions/${el.name or el}/${el.filename or el}-completions.nu"
|
||||||
)
|
) completions
|
||||||
completions
|
|
||||||
);
|
);
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
i18n.defaultLocale = "en_US.UTF-8";
|
i18n.defaultLocale = "en_US.UTF-8";
|
||||||
|
|
||||||
users = {
|
users = {
|
||||||
mutableUsers = false;
|
mutableUsers = false;
|
||||||
users.root = {
|
users.root = {
|
||||||
hashedPasswordFile = config.age.secrets."system/password-root".path;
|
hashedPasswordFile = config.age.secrets."system/password-root".path;
|
||||||
openssh.authorizedKeys.keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ/mwLoiuaQ6KH+1IOvYO541gq37S43pYtMetilMG3v5"] ++ config.users.users.winston.openssh.authorizedKeys.keys;
|
openssh.authorizedKeys.keys = [
|
||||||
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICgFwSZPS1B3wndghjmgmamdM5LZ7hqv4fZsbcmYBQWT"
|
||||||
|
] ++ config.users.users.winston.openssh.authorizedKeys.keys;
|
||||||
};
|
};
|
||||||
users.winston = {
|
users.winston = {
|
||||||
extraGroups = ["wheel"];
|
extraGroups = [ "wheel" ];
|
||||||
hashedPasswordFile = config.age.secrets."system/password-winston".path;
|
hashedPasswordFile = config.age.secrets."system/password-winston".path;
|
||||||
isNormalUser = true;
|
isNormalUser = true;
|
||||||
openssh.authorizedKeys.keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILm0O46zW/XfVOSwz0okRWYeOAg+wCVkCtCAoVTpZsOh"];
|
openssh.authorizedKeys.keys = [
|
||||||
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILm0O46zW/XfVOSwz0okRWYeOAg+wCVkCtCAoVTpZsOh"
|
||||||
|
];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
@ -102,7 +108,12 @@ in {
|
||||||
}
|
}
|
||||||
|
|
||||||
source ${nu_scripts}/aliases/git/git-aliases.nu
|
source ${nu_scripts}/aliases/git/git-aliases.nu
|
||||||
${mkCompletions ["git" "man" "rg" "tar"]}
|
${mkCompletions [
|
||||||
|
"git"
|
||||||
|
"man"
|
||||||
|
"rg"
|
||||||
|
"tar"
|
||||||
|
]}
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
starship.enable = true;
|
starship.enable = true;
|
||||||
|
|
40
flake.nix
40
flake.nix
|
@ -1,19 +1,21 @@
|
||||||
{
|
{
|
||||||
outputs = {
|
outputs =
|
||||||
|
{
|
||||||
flake-parts,
|
flake-parts,
|
||||||
nixpkgs,
|
nixpkgs,
|
||||||
nixpkgs-unstable,
|
nixpkgs-unstable,
|
||||||
self,
|
self,
|
||||||
...
|
...
|
||||||
} @ inputs: let
|
}@inputs:
|
||||||
|
let
|
||||||
overlays = [
|
overlays = [
|
||||||
(final: _: {
|
(final: _: {
|
||||||
unstable = nixpkgs-unstable.legacyPackages.${final.system};
|
unstable = nixpkgs-unstable.legacyPackages.${final.system};
|
||||||
prometheus-fail2ban-exporter = final.callPackage ./pkgs/prometheus-fail2ban-exporter {};
|
prometheus-fail2ban-exporter = final.callPackage ./pkgs/prometheus-fail2ban-exporter { };
|
||||||
})
|
})
|
||||||
];
|
];
|
||||||
in
|
in
|
||||||
flake-parts.lib.mkFlake {inherit inputs;} {
|
flake-parts.lib.mkFlake { inherit inputs; } {
|
||||||
flake = {
|
flake = {
|
||||||
nixosConfigurations.main-node = nixpkgs.lib.nixosSystem {
|
nixosConfigurations.main-node = nixpkgs.lib.nixosSystem {
|
||||||
system = "x86_64-linux";
|
system = "x86_64-linux";
|
||||||
|
@ -33,7 +35,9 @@
|
||||||
inputs.satisfactory-server.nixosModules.default
|
inputs.satisfactory-server.nixosModules.default
|
||||||
inputs.valheim-server.nixosModules.default
|
inputs.valheim-server.nixosModules.default
|
||||||
];
|
];
|
||||||
specialArgs = {inherit inputs;};
|
specialArgs = {
|
||||||
|
inherit inputs;
|
||||||
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
checks = builtins.mapAttrs (_: deployLib: deployLib.deployChecks self.deploy) inputs.deploy-rs.lib;
|
checks = builtins.mapAttrs (_: deployLib: deployLib.deployChecks self.deploy) inputs.deploy-rs.lib;
|
||||||
|
@ -47,17 +51,17 @@
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
perSystem = {
|
perSystem =
|
||||||
|
{
|
||||||
config,
|
config,
|
||||||
inputs',
|
inputs',
|
||||||
pkgs,
|
pkgs,
|
||||||
self',
|
self',
|
||||||
system,
|
system,
|
||||||
...
|
...
|
||||||
}: {
|
}:
|
||||||
_module.args.pkgs = import nixpkgs {
|
{
|
||||||
inherit overlays system;
|
_module.args.pkgs = import nixpkgs { inherit overlays system; };
|
||||||
};
|
|
||||||
|
|
||||||
devShells.default = pkgs.mkShell {
|
devShells.default = pkgs.mkShell {
|
||||||
inherit (config.pre-commit.devShell) shellHook;
|
inherit (config.pre-commit.devShell) shellHook;
|
||||||
|
@ -71,24 +75,28 @@
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
formatter = pkgs.alejandra;
|
formatter = pkgs.nixfmt-rfc-style;
|
||||||
|
|
||||||
pre-commit = {
|
pre-commit = {
|
||||||
check.enable = true;
|
check.enable = true;
|
||||||
settings.excludes = ["_sources/"];
|
settings.excludes = [ "_sources/" ];
|
||||||
settings.hooks = {
|
settings.hooks = {
|
||||||
alejandra.enable = true;
|
|
||||||
commitizen.enable = true;
|
commitizen.enable = true;
|
||||||
deadnix.enable = true;
|
|
||||||
editorconfig-checker.enable = true;
|
editorconfig-checker.enable = true;
|
||||||
nil.enable = true;
|
nil.enable = true;
|
||||||
|
nixfmt-rfc-style.enable = true;
|
||||||
shellcheck.enable = true;
|
shellcheck.enable = true;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
imports = [inputs.pre-commit-hooks.flakeModule];
|
imports = [ inputs.pre-commit-hooks.flakeModule ];
|
||||||
systems = ["x86_64-linux" "aarch64-linux" "aarch64-darwin" "x86_64-darwin"];
|
systems = [
|
||||||
|
"x86_64-linux"
|
||||||
|
"aarch64-linux"
|
||||||
|
"aarch64-darwin"
|
||||||
|
"x86_64-darwin"
|
||||||
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
inputs = {
|
inputs = {
|
||||||
|
|
|
@ -1,5 +1,6 @@
|
||||||
{pkgs, ...}: {
|
{ pkgs, ... }:
|
||||||
imports = [./hardware-configuration.nix];
|
{
|
||||||
|
imports = [ ./hardware-configuration.nix ];
|
||||||
|
|
||||||
boot = {
|
boot = {
|
||||||
loader = {
|
loader = {
|
||||||
|
|
|
@ -3,35 +3,41 @@
|
||||||
lib,
|
lib,
|
||||||
modulesPath,
|
modulesPath,
|
||||||
...
|
...
|
||||||
}: {
|
}:
|
||||||
imports = [
|
{
|
||||||
(modulesPath + "/profiles/qemu-guest.nix")
|
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
|
||||||
];
|
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod"];
|
boot.initrd.availableKernelModules = [
|
||||||
boot.initrd.kernelModules = [];
|
"ata_piix"
|
||||||
boot.kernelModules = [];
|
"uhci_hcd"
|
||||||
boot.extraModulePackages = [];
|
"virtio_pci"
|
||||||
|
"virtio_scsi"
|
||||||
|
"sd_mod"
|
||||||
|
"sr_mod"
|
||||||
|
];
|
||||||
|
boot.initrd.kernelModules = [ ];
|
||||||
|
boot.kernelModules = [ ];
|
||||||
|
boot.extraModulePackages = [ ];
|
||||||
|
|
||||||
fileSystems."/" = {
|
fileSystems."/" = {
|
||||||
device = "/dev/disk/by-uuid/8e282da8-0e52-4515-8647-fff793b8ead8";
|
device = "/dev/disk/by-uuid/8e282da8-0e52-4515-8647-fff793b8ead8";
|
||||||
fsType = "btrfs";
|
fsType = "btrfs";
|
||||||
options = ["subvol=root"];
|
options = [ "subvol=root" ];
|
||||||
};
|
};
|
||||||
|
|
||||||
fileSystems."/home" = {
|
fileSystems."/home" = {
|
||||||
device = "/dev/disk/by-uuid/8e282da8-0e52-4515-8647-fff793b8ead8";
|
device = "/dev/disk/by-uuid/8e282da8-0e52-4515-8647-fff793b8ead8";
|
||||||
fsType = "btrfs";
|
fsType = "btrfs";
|
||||||
options = ["subvol=home"];
|
options = [ "subvol=home" ];
|
||||||
};
|
};
|
||||||
|
|
||||||
fileSystems."/nix" = {
|
fileSystems."/nix" = {
|
||||||
device = "/dev/disk/by-uuid/8e282da8-0e52-4515-8647-fff793b8ead8";
|
device = "/dev/disk/by-uuid/8e282da8-0e52-4515-8647-fff793b8ead8";
|
||||||
fsType = "btrfs";
|
fsType = "btrfs";
|
||||||
options = ["subvol=nix"];
|
options = [ "subvol=nix" ];
|
||||||
};
|
};
|
||||||
|
|
||||||
swapDevices = [];
|
swapDevices = [ ];
|
||||||
|
|
||||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||||
|
|
|
@ -1,5 +1 @@
|
||||||
{
|
{ imports = [ ./wakapi.nix ]; }
|
||||||
imports = [
|
|
||||||
./wakapi.nix
|
|
||||||
];
|
|
||||||
}
|
|
||||||
|
|
|
@ -3,9 +3,10 @@
|
||||||
lib,
|
lib,
|
||||||
pkgs,
|
pkgs,
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
|
let
|
||||||
cfg = config.services.wakapi;
|
cfg = config.services.wakapi;
|
||||||
settingsFormat = pkgs.formats.yaml {};
|
settingsFormat = pkgs.formats.yaml { };
|
||||||
inherit (lib) types;
|
inherit (lib) types;
|
||||||
|
|
||||||
settingsFile = settingsFormat.generate "wakapi-settings" cfg.settings;
|
settingsFile = settingsFormat.generate "wakapi-settings" cfg.settings;
|
||||||
|
@ -13,9 +14,9 @@
|
||||||
serviceConfig = {
|
serviceConfig = {
|
||||||
systemd.services.wakapi = {
|
systemd.services.wakapi = {
|
||||||
description = "Wakapi (self-hosted WakaTime-compatible backend)";
|
description = "Wakapi (self-hosted WakaTime-compatible backend)";
|
||||||
wants = ["network-online.target"];
|
wants = [ "network-online.target" ];
|
||||||
after = ["network-online.target"];
|
after = [ "network-online.target" ];
|
||||||
wantedBy = ["multi-user.target"];
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
|
||||||
script = ''
|
script = ''
|
||||||
exec ${pkgs.wakapi}/bin/wakapi -config ${settingsFile}
|
exec ${pkgs.wakapi}/bin/wakapi -config ${settingsFile}
|
||||||
|
@ -36,7 +37,11 @@
|
||||||
ProtectKernelTunables = true;
|
ProtectKernelTunables = true;
|
||||||
ProtectProc = "invisible";
|
ProtectProc = "invisible";
|
||||||
ProtectSystem = "strict";
|
ProtectSystem = "strict";
|
||||||
RestrictAddressFamilies = ["AF_INET" "AF_INET6" "AF_UNIX"];
|
RestrictAddressFamilies = [
|
||||||
|
"AF_INET"
|
||||||
|
"AF_INET6"
|
||||||
|
"AF_UNIX"
|
||||||
|
];
|
||||||
RestrictNamespaces = true;
|
RestrictNamespaces = true;
|
||||||
RestrictRealtime = true;
|
RestrictRealtime = true;
|
||||||
RestrictSUIDSGID = true;
|
RestrictSUIDSGID = true;
|
||||||
|
@ -77,8 +82,8 @@
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.services.wakapi = {
|
systemd.services.wakapi = {
|
||||||
requires = ["postgresql.service"];
|
requires = [ "postgresql.service" ];
|
||||||
after = ["postgresql.service"];
|
after = [ "postgresql.service" ];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
@ -97,10 +102,11 @@
|
||||||
public_url = lib.mkDefault cfg.domain;
|
public_url = lib.mkDefault cfg.domain;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
options.services.wakapi = {
|
options.services.wakapi = {
|
||||||
enable = lib.mkEnableOption "Wakapi";
|
enable = lib.mkEnableOption "Wakapi";
|
||||||
package = lib.mkPackageOption pkgs "wakapi" {};
|
package = lib.mkPackageOption pkgs "wakapi" { };
|
||||||
|
|
||||||
port = lib.mkOption {
|
port = lib.mkOption {
|
||||||
type = types.int;
|
type = types.int;
|
||||||
|
@ -176,7 +182,7 @@ in {
|
||||||
|
|
||||||
settings = lib.mkOption {
|
settings = lib.mkOption {
|
||||||
type = settingsFormat.type;
|
type = settingsFormat.type;
|
||||||
default = {};
|
default = { };
|
||||||
description = lib.mkDoc ''
|
description = lib.mkDoc ''
|
||||||
Settings for Wakapi.
|
Settings for Wakapi.
|
||||||
|
|
||||||
|
@ -185,9 +191,11 @@ in {
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
config = lib.mkIf cfg.enable (lib.mkMerge [
|
config = lib.mkIf cfg.enable (
|
||||||
|
lib.mkMerge [
|
||||||
databaseConfig
|
databaseConfig
|
||||||
nginxConfig
|
nginxConfig
|
||||||
serviceConfig
|
serviceConfig
|
||||||
]);
|
]
|
||||||
|
);
|
||||||
}
|
}
|
||||||
|
|
|
@ -2,10 +2,11 @@
|
||||||
buildGoModule,
|
buildGoModule,
|
||||||
fetchFromGitLab,
|
fetchFromGitLab,
|
||||||
lib,
|
lib,
|
||||||
}: let
|
}:
|
||||||
|
let
|
||||||
version = "0.10.1";
|
version = "0.10.1";
|
||||||
in
|
in
|
||||||
buildGoModule {
|
buildGoModule {
|
||||||
pname = "prometheus-fail2ban-exporter";
|
pname = "prometheus-fail2ban-exporter";
|
||||||
inherit version;
|
inherit version;
|
||||||
|
|
||||||
|
@ -24,4 +25,4 @@ in
|
||||||
homepage = "https://gitlab.com/hectorjsmith/fail2ban-prometheus-exporter";
|
homepage = "https://gitlab.com/hectorjsmith/fail2ban-prometheus-exporter";
|
||||||
license = licenses.mit;
|
license = licenses.mit;
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue