refactor!: the big nix refactor
All checks were successful
Check Formatting of Files / Check-Formatting (push) Successful in 1m14s
All checks were successful
Check Formatting of Files / Check-Formatting (push) Successful in 1m14s
This commit is contained in:
parent
9d9a0d1a6f
commit
02334f5601
GPG Key ID:
C3FADDE7A8534BEB
26
.editorconfig
Normal file
26
.editorconfig
Normal file
@ -0,0 +1,26 @@
|
||||
root = true
|
||||
|
||||
[*]
|
||||
end_of_line = lf
|
||||
insert_final_newline = false
|
||||
trim_trailing_whitespace = true
|
||||
charset = utf-8
|
||||
max_line_length = 100
|
||||
indent_style = space
|
||||
|
||||
# We don't want to mess with encrypted files if they exist in the repo
|
||||
[*.age]
|
||||
indent_style = unset
|
||||
indent_size = unset
|
||||
tab_width = unset
|
||||
end_of_line = unset
|
||||
charset = unset
|
||||
trim_trailing_whitespace = unset
|
||||
insert_final_newline = unset
|
||||
max_line_length = unset
|
||||
|
||||
[{*.bash,.envrc}]
|
||||
indent_style = tab
|
||||
|
||||
[*.nix]
|
||||
indent_size = 2
|
||||
@ -12,8 +12,4 @@ jobs:
|
||||
|
||||
- name: Check formatting
|
||||
run: |
|
||||
for f in **/flake.nix; do
|
||||
nix flake lock --update-input "$(basename "$(dirname "$f")")" || true
|
||||
done
|
||||
nix flake lock --update-input Fmt
|
||||
nix --experimental-features "flakes nix-command" flake check
|
||||
|
||||
18
.gitmodules
vendored
18
.gitmodules
vendored
@ -1,27 +1,27 @@
|
||||
[submodule "dots/.config/zsh/config/plugins/zsh-syntax-highlighting"]
|
||||
path = dots/.config/zsh/config/plugins/zsh-syntax-highlighting
|
||||
path = users/price/dots/.config/zsh/config/plugins/zsh-syntax-highlighting
|
||||
url = https://github.com/zsh-users/zsh-syntax-highlighting.git
|
||||
[submodule "dots/.config/zsh/config/plugins/zsh-completions"]
|
||||
path = dots/.config/zsh/config/plugins/zsh-completions
|
||||
path = users/price/dots/.config/zsh/config/plugins/zsh-completions
|
||||
url = https://github.com/zsh-users/zsh-completions.git
|
||||
[submodule "dots/.config/zsh/config/plugins/zsh-autosuggestions"]
|
||||
path = dots/.config/zsh/config/plugins/zsh-autosuggestions
|
||||
path = users/price/dots/.config/zsh/config/plugins/zsh-autosuggestions
|
||||
url = https://github.com/zsh-users/zsh-autosuggestions.git
|
||||
[submodule "dots/.config/zsh/config/plugins/fzf-tab"]
|
||||
path = dots/.config/zsh/config/plugins/fzf-tab
|
||||
path = users/price/dots/.config/zsh/config/plugins/fzf-tab
|
||||
url = https://github.com/Aloxaf/fzf-tab.git
|
||||
[submodule "dots/.config/zsh/config/plugins/z.lua"]
|
||||
path = dots/.config/zsh/config/plugins/z.lua
|
||||
path = users/price/dots/.config/zsh/config/plugins/z.lua
|
||||
url = https://github.com/skywind3000/z.lua.git
|
||||
[submodule "dots/.config/zsh/config/plugins/nix-zsh-completions"]
|
||||
path = dots/.config/zsh/config/plugins/nix-zsh-completions
|
||||
path = users/price/dots/.config/zsh/config/plugins/nix-zsh-completions
|
||||
url = https://github.com/spwhitt/nix-zsh-completions
|
||||
[submodule "dots/.config/zsh/config/themes/powerlevel10k"]
|
||||
path = dots/.config/zsh/config/themes/powerlevel10k
|
||||
path = users/price/dots/.config/zsh/config/themes/powerlevel10k
|
||||
url = https://github.com/romkatv/powerlevel10k.git
|
||||
[submodule "dots/.config/zsh/config/plugins/zsh-nix-shell"]
|
||||
path = dots/.config/zsh/config/plugins/zsh-nix-shell
|
||||
path = users/price/dots/.config/zsh/config/plugins/zsh-nix-shell
|
||||
url = https://github.com/chisui/zsh-nix-shell
|
||||
[submodule "dots/.config/zsh/config/plugins/powerlevel10k"]
|
||||
path = dots/.config/zsh/config/plugins/powerlevel10k
|
||||
path = users/price/dots/.config/zsh/config/plugins/powerlevel10k
|
||||
url = https://github.com/romkatv/powerlevel10k.git
|
||||
@ -1,2 +0,0 @@
|
||||
[Qt]
|
||||
style=GTK+
|
||||
@ -1,2 +0,0 @@
|
||||
env = QT_QPA_PLATFORMTHEME,gtk2
|
||||
env = GTK_THEME,Kanagawa-Borderless
|
||||
@ -1,49 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Dependencies:
|
||||
# - wf-recorder: https://github.com/ammen99/wf-recorder
|
||||
# - notification daemon: https://archlinux.org/packages/?name=notification-daemon
|
||||
# - wl-clipboard: https://github.com/bugaevc/wl-clipboard
|
||||
# - gifski: https://github.com/sindresorhus/Gifski
|
||||
#
|
||||
# Some of this is hacky because I can't get wf-recorder to nicely output GIFs by itself :(
|
||||
|
||||
mk-video() {
|
||||
local program_name="Screen Capture"
|
||||
local pid_file="/tmp/mk-gif-pid"
|
||||
local output_type="${1:-mp4}"
|
||||
|
||||
if [[ -f "${pid_file}" ]]; then
|
||||
notify-send "Saving ${program_name}" "This May Take a Minute" -a "${program_name}"
|
||||
if ! kill -SIGINT "$(cat "${pid_file}")" 2>/dev/null; then
|
||||
notify-send "Failed ${program_name}" "Failed to Save Screen Capture" -u "critical" -a "${program_name}"
|
||||
rm -rf "${pid_file}"
|
||||
exit 1
|
||||
fi
|
||||
inotifywait -e delete_self "${pid_file}" &&
|
||||
notify-send "Saved ${program_name}" "Successfully Saved Screen Capture to Clipboard" -a "${program_name}"
|
||||
else
|
||||
local input_tmpfile
|
||||
notify-send "Starting ${program_name}" "Recording ${output_type^^} of Selected Region" -a "${program_name}"
|
||||
(
|
||||
local tmp_dir
|
||||
tmp_dir="$(mktemp -d)"
|
||||
cd "${tmp_dir}"
|
||||
input_tmpfile="${tmp_dir}/$(mktemp wf-recorder.XXXXXXXXXXX).mp4"
|
||||
wf-recorder -g "$(slurp)" -f "${input_tmpfile}" -- &
|
||||
printf "%s" $! >"${pid_file}"
|
||||
wait
|
||||
if [[ "${output_type}" == "gif" ]]; then
|
||||
local gifski_tmpoutput
|
||||
gifski_tmpoutput="${tmp_dir}/$(mktemp gifski.XXXXXXXXXXX).gif"
|
||||
gifski --output "${gifski_tmpoutput}" "${input_tmpfile}"
|
||||
wl-copy --type image/gif <"${gifski_tmpoutput}"
|
||||
else
|
||||
wl-copy --type video/mp4 <"${input_tmpfile}"
|
||||
fi
|
||||
rm -f "${pid_file}"
|
||||
)
|
||||
fi
|
||||
}
|
||||
|
||||
mk-video "${@}"
|
||||
@ -1,9 +0,0 @@
|
||||
vim.opt_local.expandtab = false
|
||||
|
||||
vim.keymap.set("n", "<leader>fr", function()
|
||||
vim.cmd.write()
|
||||
require("toggleterm").exec("bash " .. vim.api.nvim_buf_get_name(0))
|
||||
end, {
|
||||
buffer = true,
|
||||
desc = "Bash: Save and Run Current Buffer",
|
||||
})
|
||||
@ -1,9 +0,0 @@
|
||||
vim.opt_local.expandtab = false
|
||||
|
||||
vim.keymap.set("n", "<leader>fr", function()
|
||||
vim.cmd.write()
|
||||
require("toggleterm").exec("zsh " .. vim.api.nvim_buf_get_name(0))
|
||||
end, {
|
||||
buffer = true,
|
||||
desc = "ZSH: Save and Run Current Buffer",
|
||||
})
|
||||
@ -1,8 +0,0 @@
|
||||
return {
|
||||
{
|
||||
"famiu/bufdelete.nvim",
|
||||
keys = {
|
||||
{ "<A-x>", "<cmd>Bdelete<cr>", desc = "Close Buffer" },
|
||||
},
|
||||
},
|
||||
}
|
||||
@ -1,6 +0,0 @@
|
||||
return {
|
||||
{
|
||||
dir = "~/Git/Neovim/virt-indent.nvim",
|
||||
ft = { "org", "markdown" },
|
||||
},
|
||||
}
|
||||
Binary file not shown.
489
flake.lock
489
flake.lock
@ -1,28 +1,10 @@
|
||||
{
|
||||
"nodes": {
|
||||
"Fmt": {
|
||||
"inputs": {
|
||||
"flake-utils": "flake-utils",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1,
|
||||
"narHash": "sha256-CosKaGnikx3sv4FurslvRT3G0a2VxruhsFNmgZ9duYg=",
|
||||
"path": "pkgs/Fmt",
|
||||
"type": "path"
|
||||
},
|
||||
"original": {
|
||||
"path": "pkgs/Fmt",
|
||||
"type": "path"
|
||||
}
|
||||
},
|
||||
"agenix": {
|
||||
"inputs": {
|
||||
"agenix": "agenix_2",
|
||||
"crane": "crane",
|
||||
"flake-utils": "flake-utils_2",
|
||||
"flake-utils": "flake-utils",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
],
|
||||
@ -50,7 +32,7 @@
|
||||
"agenix",
|
||||
"nixpkgs"
|
||||
],
|
||||
"systems": "systems_2"
|
||||
"systems": "systems"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1707830867,
|
||||
@ -66,33 +48,35 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"bob": {
|
||||
"blog": {
|
||||
"inputs": {
|
||||
"bob": "bob_2",
|
||||
"flake-utils": "flake-utils_3",
|
||||
"flake-utils": "flake-utils_2",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1,
|
||||
"narHash": "sha256-nZhwbnG+F9bPZXXk2+loWmkbpDZT3r6Vum+egDmigxg=",
|
||||
"path": "./pkgs/bob-nvim",
|
||||
"type": "path"
|
||||
"lastModified": 1714589296,
|
||||
"narHash": "sha256-D/+cMCmS9BdMNNtn7E0J1UDl/5Y2+lHIUjAcCczVYek=",
|
||||
"ref": "refs/heads/Development",
|
||||
"rev": "dd4ae987ef50a7ef2450cb951b23763817950209",
|
||||
"revCount": 87,
|
||||
"type": "git",
|
||||
"url": "https://git.orion-technologies.io/blog/blog"
|
||||
},
|
||||
"original": {
|
||||
"path": "./pkgs/bob-nvim",
|
||||
"type": "path"
|
||||
"type": "git",
|
||||
"url": "https://git.orion-technologies.io/blog/blog"
|
||||
}
|
||||
},
|
||||
"bob_2": {
|
||||
"bob": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1706612487,
|
||||
"narHash": "sha256-OTmsb1tnautQTdO/oeqbwd5MmyHbG946/kPCGSluIrM=",
|
||||
"lastModified": 1713374776,
|
||||
"narHash": "sha256-jVRxvhUENyucRHN4TGV9xsWOs7mfPJCV90Lk/hD1xFE=",
|
||||
"owner": "MordechaiHadad",
|
||||
"repo": "bob",
|
||||
"rev": "e521723d2c084f4b610c27d79f870f83e964fe95",
|
||||
"rev": "e65ef1bfbcb846b12cc639a25f193c2ea9c72b12",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@ -145,6 +129,46 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"deploy-rs": {
|
||||
"inputs": {
|
||||
"flake-compat": "flake-compat",
|
||||
"nixpkgs": "nixpkgs",
|
||||
"utils": "utils"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1711973905,
|
||||
"narHash": "sha256-UFKME/N1pbUtn+2Aqnk+agUt8CekbpuqwzljivfIme8=",
|
||||
"owner": "serokell",
|
||||
"repo": "deploy-rs",
|
||||
"rev": "88b3059b020da69cbe16526b8d639bd5e0b51c8b",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "serokell",
|
||||
"repo": "deploy-rs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"disko": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1714612856,
|
||||
"narHash": "sha256-W7+rtMzRmdovzndN2NYUv5xzkbMudtQ3jbyFuGk0O1E=",
|
||||
"owner": "nix-community",
|
||||
"repo": "disko",
|
||||
"rev": "d57058eb09dd5ec00c746df34fe0a603ea744370",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"repo": "disko",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-compat": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
@ -177,6 +201,38 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-compat_3": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1673956053,
|
||||
"narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",
|
||||
"owner": "edolstra",
|
||||
"repo": "flake-compat",
|
||||
"rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "edolstra",
|
||||
"repo": "flake-compat",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-compat_4": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1696426674,
|
||||
"narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
|
||||
"owner": "edolstra",
|
||||
"repo": "flake-compat",
|
||||
"rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "edolstra",
|
||||
"repo": "flake-compat",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-parts": {
|
||||
"inputs": {
|
||||
"nixpkgs-lib": [
|
||||
@ -185,11 +241,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1712014858,
|
||||
"narHash": "sha256-sB4SWl2lX95bExY2gMFG5HIzvva5AVMJd4Igm+GpZNw=",
|
||||
"lastModified": 1714641030,
|
||||
"narHash": "sha256-yzcRNDoyVP7+SCNX0wmuDju1NUCt8Dz9+lyUXEI0dbI=",
|
||||
"owner": "hercules-ci",
|
||||
"repo": "flake-parts",
|
||||
"rev": "9126214d0a59633752a136528f5f3b9aa8565b7d",
|
||||
"rev": "e5d10a24b66c3ea8f150e47dfdb0416ab7c3390e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@ -207,11 +263,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1709336216,
|
||||
"narHash": "sha256-Dt/wOWeW6Sqm11Yh+2+t0dfEWxoMxGBvv3JpIocFl9E=",
|
||||
"lastModified": 1712014858,
|
||||
"narHash": "sha256-sB4SWl2lX95bExY2gMFG5HIzvva5AVMJd4Igm+GpZNw=",
|
||||
"owner": "hercules-ci",
|
||||
"repo": "flake-parts",
|
||||
"rev": "f7b3c975cf067e56e7cda6cb098ebe3fb4d74ca2",
|
||||
"rev": "9126214d0a59633752a136528f5f3b9aa8565b7d",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@ -219,9 +275,48 @@
|
||||
"type": "indirect"
|
||||
}
|
||||
},
|
||||
"flake-parts_3": {
|
||||
"inputs": {
|
||||
"nixpkgs-lib": [
|
||||
"nix",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1712014858,
|
||||
"narHash": "sha256-sB4SWl2lX95bExY2gMFG5HIzvva5AVMJd4Igm+GpZNw=",
|
||||
"owner": "hercules-ci",
|
||||
"repo": "flake-parts",
|
||||
"rev": "9126214d0a59633752a136528f5f3b9aa8565b7d",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "hercules-ci",
|
||||
"repo": "flake-parts",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils": {
|
||||
"inputs": {
|
||||
"systems": "systems"
|
||||
"systems": "systems_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1705309234,
|
||||
"narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils_2": {
|
||||
"inputs": {
|
||||
"systems": "systems_3"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1710146030,
|
||||
@ -237,43 +332,7 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils_2": {
|
||||
"inputs": {
|
||||
"systems": "systems_3"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1705309234,
|
||||
"narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils_3": {
|
||||
"inputs": {
|
||||
"systems": "systems_4"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1705309234,
|
||||
"narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils_4": {
|
||||
"inputs": {
|
||||
"systems": "systems_5"
|
||||
},
|
||||
@ -291,28 +350,10 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils_5": {
|
||||
"flake-utils_4": {
|
||||
"inputs": {
|
||||
"systems": "systems_6"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1705309234,
|
||||
"narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils_6": {
|
||||
"inputs": {
|
||||
"systems": "systems_7"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1710146030,
|
||||
"narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
|
||||
@ -327,7 +368,22 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils_7": {
|
||||
"flake-utils_5": {
|
||||
"locked": {
|
||||
"lastModified": 1667395993,
|
||||
"narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils_6": {
|
||||
"locked": {
|
||||
"lastModified": 1659877975,
|
||||
"narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
|
||||
@ -342,9 +398,9 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils_8": {
|
||||
"flake-utils_7": {
|
||||
"inputs": {
|
||||
"systems": "systems_8"
|
||||
"systems": "systems_7"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1705309234,
|
||||
@ -403,11 +459,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1713722610,
|
||||
"narHash": "sha256-kcZsbH1PQTG+sS22u/igLq2SaBEHJgmU5hoKzrT2ukI=",
|
||||
"lastModified": 1713898448,
|
||||
"narHash": "sha256-6q6ojsp/Z9P2goqnxyfCSzFOD92T3Uobmj8oVAicUOs=",
|
||||
"owner": "hercules-ci",
|
||||
"repo": "hercules-ci-effects",
|
||||
"rev": "4615d28841e93f6f549fde9188caf493b3822668",
|
||||
"rev": "c0302ec12d569532a6b6bd218f698bc402e93adc",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@ -445,11 +501,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1713818326,
|
||||
"narHash": "sha256-aw3xbVPJauLk/bbrlakIYxKpeuMWzA2feGrkIpIuXd8=",
|
||||
"lastModified": 1714679908,
|
||||
"narHash": "sha256-KzcXzDvDJjX34en8f3Zimm396x6idbt+cu4tWDVS2FI=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "67de98ae6eed5ad6f91b1142356d71a87ba97f21",
|
||||
"rev": "9036fe9ef8e15a819fa76f47a8b1f287903fb848",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@ -458,38 +514,34 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"kanagawa-gtk": {
|
||||
"inputs": {
|
||||
"flake-utils": "flake-utils_5",
|
||||
"kanagawa-gtk": "kanagawa-gtk_2",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"impermanence": {
|
||||
"locked": {
|
||||
"lastModified": 1,
|
||||
"narHash": "sha256-ixRgLAGzQ7RcYRcyuOmY0mFgRw5ey+U39ccPg1izDXQ=",
|
||||
"path": "./pkgs/kanagawa-gtk",
|
||||
"type": "path"
|
||||
"lastModified": 1708968331,
|
||||
"narHash": "sha256-VUXLaPusCBvwM3zhGbRIJVeYluh2uWuqtj4WirQ1L9Y=",
|
||||
"owner": "nix-community",
|
||||
"repo": "impermanence",
|
||||
"rev": "a33ef102a02ce77d3e39c25197664b7a636f9c30",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"path": "./pkgs/kanagawa-gtk",
|
||||
"type": "path"
|
||||
"owner": "nix-community",
|
||||
"repo": "impermanence",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"kanagawa-gtk_2": {
|
||||
"libgit2": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1688426096,
|
||||
"narHash": "sha256-BZRmjVas8q6zsYbXFk4bCk5Ec/3liy9PQ8fqFGHAXe0=",
|
||||
"owner": "Fausto-Korpsvart",
|
||||
"repo": "Kanagawa-GKT-Theme",
|
||||
"rev": "35936a1e3bbd329339991b29725fc1f67f192c1e",
|
||||
"lastModified": 1697646580,
|
||||
"narHash": "sha256-oX4Z3S9WtJlwvj0uH9HlYcWv+x1hqp8mhXl7HsLu2f0=",
|
||||
"owner": "libgit2",
|
||||
"repo": "libgit2",
|
||||
"rev": "45fd9ed7ae1a9b74b957ef4f337bc3c8b3df01b5",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "Fausto-Korpsvart",
|
||||
"repo": "Kanagawa-GKT-Theme",
|
||||
"owner": "libgit2",
|
||||
"repo": "libgit2",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
@ -512,7 +564,7 @@
|
||||
},
|
||||
"neovim-flake": {
|
||||
"inputs": {
|
||||
"flake-utils": "flake-utils_6",
|
||||
"flake-utils": "flake-utils_4",
|
||||
"nixpkgs": [
|
||||
"neovim-nightly-overlay",
|
||||
"nixpkgs"
|
||||
@ -520,11 +572,11 @@
|
||||
},
|
||||
"locked": {
|
||||
"dir": "contrib",
|
||||
"lastModified": 1713809929,
|
||||
"narHash": "sha256-0GB//RpezlOsI9+1/oT8PkEIO8I4DGfAfw3KotTSnzQ=",
|
||||
"lastModified": 1714683427,
|
||||
"narHash": "sha256-SMfFU+VsRTZLVIkGpf67oOTZ29gWmFvxF0nGO6CRx/4=",
|
||||
"owner": "neovim",
|
||||
"repo": "neovim",
|
||||
"rev": "39fc340276a4fdbe1f1bb4bfbe7328267ad7f9d6",
|
||||
"rev": "01e4a70d668d54a7cefa3ff53ec97e39df516265",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@ -536,18 +588,18 @@
|
||||
},
|
||||
"neovim-nightly-overlay": {
|
||||
"inputs": {
|
||||
"flake-compat": "flake-compat",
|
||||
"flake-compat": "flake-compat_2",
|
||||
"flake-parts": "flake-parts",
|
||||
"hercules-ci-effects": "hercules-ci-effects",
|
||||
"neovim-flake": "neovim-flake",
|
||||
"nixpkgs": "nixpkgs"
|
||||
"nixpkgs": "nixpkgs_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1713830781,
|
||||
"narHash": "sha256-Xizkp8EgHpLlUZOhN4PpwRlMaL0xcVxdQORS4eGaKmg=",
|
||||
"lastModified": 1714694802,
|
||||
"narHash": "sha256-b0+Zrd2PDgRIEeeXbivzw3kcSaXCZItOvgOgdfRsyOo=",
|
||||
"owner": "nix-community",
|
||||
"repo": "neovim-nightly-overlay",
|
||||
"rev": "7b0a51e51c4c116e540ed01e668d17023900b518",
|
||||
"rev": "9b2c33c7fa0287db93868d955e7b3d0da3837a57",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@ -556,10 +608,33 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nix": {
|
||||
"inputs": {
|
||||
"flake-compat": "flake-compat_3",
|
||||
"flake-parts": "flake-parts_3",
|
||||
"libgit2": "libgit2",
|
||||
"nixpkgs": "nixpkgs_3",
|
||||
"nixpkgs-regression": "nixpkgs-regression",
|
||||
"pre-commit-hooks": "pre-commit-hooks"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1714701944,
|
||||
"narHash": "sha256-trTxWfGElp0rkjquqG5I5RYVoxo8foCflxJFUtHwnOQ=",
|
||||
"owner": "nixos",
|
||||
"repo": "nix",
|
||||
"rev": "00ca2b05b8fbbef09be5d1e4820857605d4c31b6",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nixos",
|
||||
"repo": "nix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixgl": {
|
||||
"inputs": {
|
||||
"flake-utils": "flake-utils_7",
|
||||
"nixpkgs": "nixpkgs_2"
|
||||
"flake-utils": "flake-utils_6",
|
||||
"nixpkgs": "nixpkgs_4"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1713543440,
|
||||
@ -577,11 +652,11 @@
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1713714268,
|
||||
"narHash": "sha256-ZJGnom7YthvNxUZLdUzy5VePTwYgDYcnnPpyHT4n9lY=",
|
||||
"lastModified": 1702272962,
|
||||
"narHash": "sha256-D+zHwkwPc6oYQ4G3A1HuadopqRwUY/JkMwHz1YF7j4Q=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "69ee1d82f1fa4c70a3dc9a64111e7eef3b8e4527",
|
||||
"rev": "e97b3e4186bcadf0ef1b6be22b8558eab1cdeb5d",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@ -591,7 +666,55 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs-regression": {
|
||||
"locked": {
|
||||
"lastModified": 1643052045,
|
||||
"narHash": "sha256-uGJ0VXIhWKGXxkeNnq4TvV3CIOkUJ3PAoLZ3HMzNVMw=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "215d4d0fd80ca5163643b03a33fde804a29cc1e2",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "215d4d0fd80ca5163643b03a33fde804a29cc1e2",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_2": {
|
||||
"locked": {
|
||||
"lastModified": 1714594348,
|
||||
"narHash": "sha256-fL6twwN/npU94mvumU5ho/uhM/fwePCRQ9lwamm2lds=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "1c74cc292b61614e74c1cf0d372f79d57fb4936b",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixpkgs-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_3": {
|
||||
"locked": {
|
||||
"lastModified": 1709083642,
|
||||
"narHash": "sha256-7kkJQd4rZ+vFrzWu8sTRtta5D1kBG0LSRYAfhtmMlSo=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "b550fe4b4776908ac2a861124307045f8e717c8e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "release-23.11",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_4": {
|
||||
"locked": {
|
||||
"lastModified": 1660551188,
|
||||
"narHash": "sha256-a1LARMMYQ8DPx1BgoI/UN4bXe12hhZkCNqdxNi6uS0g=",
|
||||
@ -606,13 +729,13 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_3": {
|
||||
"nixpkgs_5": {
|
||||
"locked": {
|
||||
"lastModified": 1713714899,
|
||||
"narHash": "sha256-+z/XjO3QJs5rLE5UOf015gdVauVRQd2vZtsFkaXBq2Y=",
|
||||
"lastModified": 1714635257,
|
||||
"narHash": "sha256-4cPymbty65RvF1DWQfc+Bc8B233A1BWxJnNULJKQ1EY=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "6143fc5eeb9c4f00163267708e26191d1e918932",
|
||||
"rev": "63c3a29ca82437c87573e4c6919b09a24ea61b0f",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@ -622,17 +745,52 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"pre-commit-hooks": {
|
||||
"inputs": {
|
||||
"flake-compat": [
|
||||
"nix"
|
||||
],
|
||||
"flake-utils": "flake-utils_5",
|
||||
"gitignore": [
|
||||
"nix"
|
||||
],
|
||||
"nixpkgs": [
|
||||
"nix",
|
||||
"nixpkgs"
|
||||
],
|
||||
"nixpkgs-stable": [
|
||||
"nix",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1712897695,
|
||||
"narHash": "sha256-nMirxrGteNAl9sWiOhoN5tIHyjBbVi5e2tgZUgZlK3Y=",
|
||||
"owner": "cachix",
|
||||
"repo": "pre-commit-hooks.nix",
|
||||
"rev": "40e6053ecb65fcbf12863338a6dcefb3f55f1bf8",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "cachix",
|
||||
"repo": "pre-commit-hooks.nix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"Fmt": "Fmt",
|
||||
"agenix": "agenix",
|
||||
"blog": "blog",
|
||||
"bob": "bob",
|
||||
"flake-utils": "flake-utils_4",
|
||||
"deploy-rs": "deploy-rs",
|
||||
"disko": "disko",
|
||||
"flake-utils": "flake-utils_3",
|
||||
"home-manager": "home-manager_2",
|
||||
"kanagawa-gtk": "kanagawa-gtk",
|
||||
"impermanence": "impermanence",
|
||||
"neovim-nightly-overlay": "neovim-nightly-overlay",
|
||||
"nix": "nix",
|
||||
"nixgl": "nixgl",
|
||||
"nixpkgs": "nixpkgs_3",
|
||||
"nixpkgs": "nixpkgs_5",
|
||||
"waybar": "waybar",
|
||||
"wezterm": "wezterm"
|
||||
}
|
||||
@ -792,34 +950,37 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"systems_8": {
|
||||
"utils": {
|
||||
"inputs": {
|
||||
"systems": "systems_4"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1681028828,
|
||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||
"lastModified": 1701680307,
|
||||
"narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"waybar": {
|
||||
"inputs": {
|
||||
"flake-compat": "flake-compat_2",
|
||||
"flake-compat": "flake-compat_4",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1713882185,
|
||||
"narHash": "sha256-fmmYoOnBVJKvnrF3S95pftmBECaufhe40g5Qcdz9A08=",
|
||||
"lastModified": 1714718861,
|
||||
"narHash": "sha256-mCQdrn0Y3oOVZP/CileWAhuBX6aARBNrfxyqJBB4NxA=",
|
||||
"owner": "Alexays",
|
||||
"repo": "Waybar",
|
||||
"rev": "08b0ed1b79462735cc040ba886136494e70867b2",
|
||||
"rev": "231d6972d7a023e9358ab7deda509baac49006cb",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@ -830,7 +991,7 @@
|
||||
},
|
||||
"wezterm": {
|
||||
"inputs": {
|
||||
"flake-utils": "flake-utils_8",
|
||||
"flake-utils": "flake-utils_7",
|
||||
"freetype2": "freetype2",
|
||||
"harfbuzz": "harfbuzz",
|
||||
"libpng": "libpng",
|
||||
@ -842,11 +1003,11 @@
|
||||
},
|
||||
"locked": {
|
||||
"dir": "nix",
|
||||
"lastModified": 1712365750,
|
||||
"narHash": "sha256-yaGmflPbC9V4gsLt2lvL4qaSojF29IpPmVKAxm/nCRg=",
|
||||
"lastModified": 1714411698,
|
||||
"narHash": "sha256-dut0b9FueToW3WGh3mPh+wfV88ZjTx+r8be3w9HZhAU=",
|
||||
"owner": "wez",
|
||||
"repo": "wezterm",
|
||||
"rev": "cce0706b1f2a9e2d1f02c57f2d1cd367c91df1ae",
|
||||
"rev": "0184e88e97b6521df613df4ccdb2e896ce8b0ad0",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
||||
275
flake.nix
275
flake.nix
@ -2,19 +2,13 @@
|
||||
description = "Price Hiller's home manager configuration";
|
||||
|
||||
inputs = {
|
||||
nix.url = "github:nixos/nix";
|
||||
deploy-rs.url = "github:serokell/deploy-rs";
|
||||
nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
|
||||
flake-utils.url = "github:numtide/flake-utils";
|
||||
kanagawa-gtk = {
|
||||
url = "path:./pkgs/kanagawa-gtk";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
bob = {
|
||||
url = "path:./pkgs/bob-nvim";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
Fmt = {
|
||||
url = "path:pkgs/Fmt";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
flake = false;
|
||||
url = "github:MordechaiHadad/bob";
|
||||
};
|
||||
home-manager = {
|
||||
url = "github:nix-community/home-manager";
|
||||
@ -34,96 +28,249 @@
|
||||
url = "github:yaxitech/ragenix";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
impermanence = {
|
||||
url = "github:nix-community/impermanence";
|
||||
};
|
||||
disko = {
|
||||
url = "github:nix-community/disko";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
blog = {
|
||||
url = "git+https://git.orion-technologies.io/blog/blog";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
};
|
||||
|
||||
outputs =
|
||||
inputs@{
|
||||
self,
|
||||
home-manager,
|
||||
nixpkgs,
|
||||
...
|
||||
}:
|
||||
inputs@{ self, nixpkgs, ... }:
|
||||
let
|
||||
system = "x86_64-linux";
|
||||
username = "sam";
|
||||
pkgs = nixpkgs.legacyPackages.${system};
|
||||
in
|
||||
{
|
||||
packages.x86_64-linux.default = home-manager.defaultPackage.x86_64-linux;
|
||||
checks.${system} = {
|
||||
formatting =
|
||||
pkgs.runCommand "check-dot-file-formatting"
|
||||
{
|
||||
buildInputs = with pkgs; [
|
||||
findutils
|
||||
inputs.Fmt.packages.x86_64-linux.default
|
||||
inherit (self) outputs;
|
||||
forAllSystems =
|
||||
function:
|
||||
nixpkgs.lib.genAttrs
|
||||
[
|
||||
"aarch64-linux"
|
||||
"i686-linux"
|
||||
"x86_64-linux"
|
||||
"aarch64-darwin"
|
||||
"x86_64-darwin"
|
||||
]
|
||||
(
|
||||
system:
|
||||
function (
|
||||
import nixpkgs {
|
||||
inherit system;
|
||||
overlays = [
|
||||
inputs.agenix.overlays.default
|
||||
inputs.neovim-nightly-overlay.overlay
|
||||
];
|
||||
}
|
||||
''
|
||||
set -euo pipefail
|
||||
cd ${self}
|
||||
Fmt -- $(find . -type f)
|
||||
printf "TEST COMPLETED!\n" > $out
|
||||
'';
|
||||
};
|
||||
homeConfigurations.${username} = home-manager.lib.homeManagerConfiguration {
|
||||
inherit pkgs;
|
||||
)
|
||||
);
|
||||
mkHomeCfg =
|
||||
user: home-config:
|
||||
let
|
||||
username = "${builtins.head (builtins.match "(.+)(@.+)?" user)}";
|
||||
in
|
||||
inputs.home-manager.lib.homeManagerConfiguration {
|
||||
pkgs = nixpkgs.legacyPackages.x86_64-linux;
|
||||
extraSpecialArgs = {
|
||||
inherit inputs;
|
||||
inherit self;
|
||||
};
|
||||
modules = [
|
||||
({
|
||||
imports = [ inputs.agenix.homeManagerModules.default ];
|
||||
nixpkgs.overlays = [
|
||||
inputs.neovim-nightly-overlay.overlay
|
||||
inputs.bob.overlays.default
|
||||
inputs.Fmt.overlays.default
|
||||
inputs.kanagawa-gtk.overlays.default
|
||||
inputs.nixgl.overlay
|
||||
(final: prev: {
|
||||
waybar = inputs.waybar.packages.${system}.default;
|
||||
lxappearance = prev.lxappearance.overrideAttrs (oldAttrs: {
|
||||
postInstall = ''
|
||||
wrapProgram $out/bin/lxappearance --prefix GDK_BACKEND : x11
|
||||
'';
|
||||
});
|
||||
opensnitch-ui = prev.opensnitch-ui.overrideAttrs (oldAttrs: {
|
||||
propagatedBuildInputs = oldAttrs.propagatedBuildInputs ++ [ prev.python311Packages.qt-material ];
|
||||
});
|
||||
})
|
||||
self.overlays.modifications
|
||||
self.overlays.additions
|
||||
];
|
||||
home = {
|
||||
stateVersion = "24.05";
|
||||
username = "${username}";
|
||||
homeDirectory = "/home/${username}";
|
||||
stateVersion = "24.05";
|
||||
};
|
||||
})
|
||||
./config
|
||||
home-config
|
||||
];
|
||||
};
|
||||
}
|
||||
// inputs.flake-utils.lib.eachDefaultSystem (
|
||||
system:
|
||||
let
|
||||
pkgs = import nixpkgs {
|
||||
inherit system;
|
||||
overlays = [ inputs.agenix.overlays.default ];
|
||||
};
|
||||
in
|
||||
{
|
||||
devShells.default = pkgs.mkShell {
|
||||
formatter = forAllSystems (pkgs: pkgs.nixfmt-rfc-style);
|
||||
packages = forAllSystems (pkgs: import ./pkgs pkgs);
|
||||
homeConfigurations = builtins.mapAttrs (mkHomeCfg) {
|
||||
"price@orion" = ./users/price/home.nix;
|
||||
"sam" = ./users/sam/home.nix;
|
||||
};
|
||||
overlays = import ./overlays { inherit inputs; };
|
||||
devShells = forAllSystems (pkgs: {
|
||||
default = pkgs.mkShell {
|
||||
packages = with pkgs; [
|
||||
age
|
||||
age-plugin-yubikey
|
||||
pkgs.agenix
|
||||
nixos-rebuild
|
||||
nixos-install-tools
|
||||
pkgs.deploy-rs
|
||||
];
|
||||
shellHook = ''
|
||||
export RULES="$PWD/secrets/secrets.nix"
|
||||
'';
|
||||
};
|
||||
});
|
||||
apps = forAllSystems (pkgs: {
|
||||
home-manager-init = {
|
||||
type = "app";
|
||||
program = "${
|
||||
pkgs.writeShellApplication {
|
||||
name = "home-manager-init";
|
||||
runtimeInputs = with pkgs; [
|
||||
git
|
||||
nix
|
||||
];
|
||||
text = ''
|
||||
#!${pkgs.bash}/bin/bash
|
||||
cd "$(git rev-parse --show-toplevel)"
|
||||
nix run --extra-experimental-features 'nix-command flakes' github:nix-community/home-manager -- switch --extra-experimental-features 'nix-command flakes' --flake "git+file://$(pwd)?submodules=1" "$@"
|
||||
'';
|
||||
}
|
||||
}/bin/home-manager-init";
|
||||
};
|
||||
install-host = {
|
||||
type = "app";
|
||||
program = "${
|
||||
pkgs.writeShellApplication {
|
||||
name = "install-host";
|
||||
runtimeInputs = with pkgs; [
|
||||
openssh
|
||||
coreutils-full
|
||||
git
|
||||
agenix
|
||||
nix
|
||||
];
|
||||
text = (
|
||||
''
|
||||
#!${pkgs.bash}/bin/bash
|
||||
# The below `cd` invocation ensures the installer is running from the toplevel of
|
||||
# the flake and thus has correct paths available.
|
||||
cd "$(git rev-parse --show-toplevel)"
|
||||
''
|
||||
+ builtins.readFile ./scripts/install-host.bash
|
||||
);
|
||||
}
|
||||
}/bin/install-host";
|
||||
};
|
||||
});
|
||||
nixosConfigurations =
|
||||
let
|
||||
lib = (import ./lib { lib = nixpkgs.lib; }) // nixpkgs.lib;
|
||||
persist-dir = "/persist";
|
||||
defaults = {
|
||||
config = {
|
||||
nixpkgs.overlays = [ inputs.neovim-nightly-overlay.overlay ];
|
||||
environment.etc.machine-id.source = "${persist-dir}/ephemeral/etc/machine-id";
|
||||
environment.persistence.save = {
|
||||
hideMounts = true;
|
||||
persistentStoragePath = "${persist-dir}/save";
|
||||
};
|
||||
environment.persistence.ephemeral = {
|
||||
persistentStoragePath = "${persist-dir}/ephemeral";
|
||||
hideMounts = true;
|
||||
directories = [
|
||||
"/var/lib"
|
||||
"/etc/nixos"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
orion =
|
||||
let
|
||||
hostname = "orion";
|
||||
in
|
||||
nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
specialArgs = {
|
||||
inherit self;
|
||||
inherit inputs;
|
||||
inherit outputs;
|
||||
inherit hostname;
|
||||
inherit lib;
|
||||
inherit persist-dir;
|
||||
root-disk = "/dev/vda";
|
||||
};
|
||||
modules = [
|
||||
defaults
|
||||
inputs.impermanence.nixosModules.impermanence
|
||||
inputs.agenix.nixosModules.default
|
||||
inputs.disko.nixosModules.disko
|
||||
{
|
||||
config =
|
||||
(import "${self}/secrets" {
|
||||
agenix = false;
|
||||
inherit lib;
|
||||
}).${hostname};
|
||||
}
|
||||
./hosts/${hostname}
|
||||
];
|
||||
};
|
||||
luna =
|
||||
let
|
||||
hostname = "luna";
|
||||
in
|
||||
nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
specialArgs = {
|
||||
inherit self;
|
||||
inherit inputs;
|
||||
inherit hostname;
|
||||
inherit nixpkgs;
|
||||
inherit lib;
|
||||
inherit persist-dir;
|
||||
root-disk = "/dev/nvme0n1";
|
||||
fqdn = "orion-technologies.io";
|
||||
};
|
||||
modules = [
|
||||
defaults
|
||||
inputs.impermanence.nixosModules.impermanence
|
||||
inputs.agenix.nixosModules.default
|
||||
inputs.disko.nixosModules.disko
|
||||
{
|
||||
config =
|
||||
(import "${self}/secrets" {
|
||||
agenix = false;
|
||||
inherit lib;
|
||||
}).${hostname};
|
||||
}
|
||||
./hosts/${hostname}
|
||||
];
|
||||
};
|
||||
};
|
||||
deploy.nodes =
|
||||
let
|
||||
deploy-rs = inputs.deploy-rs;
|
||||
in
|
||||
{
|
||||
orion = {
|
||||
hostname = "orion";
|
||||
fastConnection = true;
|
||||
profiles.system = {
|
||||
sshUser = "price";
|
||||
user = "root";
|
||||
path = deploy-rs.lib.x86_64-linux.activate.nixos outputs.nixosConfigurations.orion;
|
||||
};
|
||||
};
|
||||
luna = {
|
||||
hostname = "luna.hosts.orion-technologies.io";
|
||||
fastConnection = true;
|
||||
profiles.system = {
|
||||
sshUser = "price";
|
||||
user = "root";
|
||||
path = deploy-rs.lib.x86_64-linux.activate.nixos outputs.nixosConfigurations.luna;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
26
hosts/.editorconfig
Normal file
26
hosts/.editorconfig
Normal file
@ -0,0 +1,26 @@
|
||||
root = true
|
||||
|
||||
[*]
|
||||
end_of_line = lf
|
||||
insert_final_newline = false
|
||||
trim_trailing_whitespace = true
|
||||
charset = utf-8
|
||||
max_line_length = 100
|
||||
indent_style = space
|
||||
|
||||
# We don't want to mess with encrypted files if they exist in the repo
|
||||
[*.age]
|
||||
indent_style = unset
|
||||
indent_size = unset
|
||||
tab_width = unset
|
||||
end_of_line = unset
|
||||
charset = unset
|
||||
trim_trailing_whitespace = unset
|
||||
insert_final_newline = unset
|
||||
max_line_length = unset
|
||||
|
||||
[{*.bash,.envrc}]
|
||||
indent_style = tab
|
||||
|
||||
[*.nix]
|
||||
indent_size = 2
|
||||
3
hosts/luna/README.md
Normal file
3
hosts/luna/README.md
Normal file
@ -0,0 +1,3 @@
|
||||
# Luna
|
||||
|
||||
This is my primary server.
|
||||
10
hosts/luna/default.nix
Normal file
10
hosts/luna/default.nix
Normal file
@ -0,0 +1,10 @@
|
||||
{ lib, ... }:
|
||||
{
|
||||
imports = (
|
||||
lib.recurseFilesInDirs [
|
||||
./os
|
||||
./modules
|
||||
] ".nix"
|
||||
);
|
||||
system.stateVersion = "24.05";
|
||||
}
|
||||
8
hosts/luna/modules/default.nix
Normal file
8
hosts/luna/modules/default.nix
Normal file
@ -0,0 +1,8 @@
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
time.timeZone = "America/Chicago";
|
||||
systemd.extraConfig = ''
|
||||
DefaultTimeoutStopSec=10s
|
||||
'';
|
||||
}
|
||||
21
hosts/luna/modules/docker/default.nix
Normal file
21
hosts/luna/modules/docker/default.nix
Normal file
@ -0,0 +1,21 @@
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
environment.systemPackages = with pkgs; [
|
||||
docker
|
||||
docker-compose
|
||||
];
|
||||
|
||||
virtualisation = {
|
||||
oci-containers.backend = "docker";
|
||||
containers.enable = true;
|
||||
docker = {
|
||||
enable = true;
|
||||
rootless = {
|
||||
enable = true;
|
||||
setSocketVariable = true;
|
||||
};
|
||||
autoPrune.enable = true;
|
||||
package = pkgs.docker;
|
||||
};
|
||||
};
|
||||
}
|
||||
156
hosts/luna/modules/monitoring/auditd.nix
Normal file
156
hosts/luna/modules/monitoring/auditd.nix
Normal file
@ -0,0 +1,156 @@
|
||||
{
|
||||
persist-dir,
|
||||
pkgs,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
let
|
||||
laurel-user = "_laurel";
|
||||
in
|
||||
{
|
||||
security = {
|
||||
audit.enable = true;
|
||||
wrappers.laurel = {
|
||||
source = "${pkgs.laurel}/bin/laurel";
|
||||
owner = "root";
|
||||
group = "${laurel-user}";
|
||||
permissions = "u=rwx,g=rx,o=";
|
||||
};
|
||||
auditd.enable = true;
|
||||
};
|
||||
# Ensure the wrapped laurel service is available in time for auditd
|
||||
systemd.services.suid-sgid-wrappers.before = [ "auditd.service" ];
|
||||
users.groups."${laurel-user}" = { };
|
||||
users.users."${laurel-user}" = {
|
||||
isSystemUser = true;
|
||||
createHome = true;
|
||||
group = "${laurel-user}";
|
||||
home = "/var/log/laurel";
|
||||
};
|
||||
environment.etc = {
|
||||
"laurel/config.toml" = {
|
||||
user = "${laurel-user}";
|
||||
text = ''
|
||||
# Write log files relative to this directory
|
||||
directory = "${config.users.users."${laurel-user}".home}"
|
||||
# Drop privileges from root to this user
|
||||
user = "${laurel-user}"
|
||||
# The periodical time window in seconds for status information to be printed to Syslog.
|
||||
# Status report includes the running version, config and parsing stats.
|
||||
# Default is 0 --> no status reports.
|
||||
statusreport-period = 0
|
||||
# By default, audit events are read from stdin ("stdin"). Alternatively, they
|
||||
# can be consumed from an existing UNIX domain socket ("unix:/path/to/socket")
|
||||
input = "stdin"
|
||||
|
||||
# A string that is written to the log on startup and
|
||||
# whenever Laurel writes a status report.
|
||||
# marker = "correct-horse-battery-staple"
|
||||
|
||||
[auditlog]
|
||||
# Base file name for the JSONL-based log file. Set to "-" to log to stdout. In this case
|
||||
# other log file related settings will be ignored.
|
||||
file = "audit.log"
|
||||
# Rotate when log file reaches this size (in bytes)
|
||||
size = 5000000
|
||||
# When rotating, keep this number of generations around
|
||||
generations = 10
|
||||
# Grant read permissions on the log files to these users, using
|
||||
[transform]
|
||||
|
||||
# "array" (the default) causes EXECVE a0, a1, a2 … arguments to be
|
||||
# output as a list of strings, "ARGV". This is the default, it allows
|
||||
# analysts to reliably reproduce what was executed.
|
||||
#
|
||||
# "string" causes arguments to be concatenated into a single string,
|
||||
# separated by space characters, "ARGV_STR". This form allows for
|
||||
# easier grepping, but it is impossible to tell if space characters in
|
||||
# the resulting string are a separator or were part of an individual
|
||||
# argument in the original command line.
|
||||
|
||||
execve-argv = [ "array" ]
|
||||
|
||||
# execve-argv = [ "array", "string" ]
|
||||
|
||||
# Trim excessively long EXECVE.ARGV and EXECVE.ARGV_STR entries.
|
||||
# Excess is cut from the middle of the argument list and a marker
|
||||
# indicating how many arguments / bytes have been cut is inserted.
|
||||
|
||||
# execve-argv-limit-bytes = 10000
|
||||
|
||||
[translate]
|
||||
|
||||
# Perform translations of numeric values that can also be done by
|
||||
# auditd if configured with log_format=ENRICHED.
|
||||
|
||||
# arch, syscall, sockaddr structures
|
||||
universal = false
|
||||
# UID, GID values
|
||||
user-db = false
|
||||
# Drop raw (numeric) syscall, arch, UID, GID values if they are translated
|
||||
drop-raw = false
|
||||
|
||||
[enrich]
|
||||
|
||||
# Add context (event-id, comm, exe, ppid) for *pid entries
|
||||
pid = true
|
||||
|
||||
# List of environment variables to log for every EXECVE event
|
||||
execve-env = [ "LD_PRELOAD", "LD_LIBRARY_PATH" ]
|
||||
|
||||
# Add container context to SYSCALL-based events
|
||||
container = true
|
||||
|
||||
# Add script context to SYSCALL execve events
|
||||
script = true
|
||||
|
||||
# Add groups that the user (uid) is a member of. Default: true
|
||||
user-groups = true
|
||||
|
||||
[label-process]
|
||||
|
||||
[filter]
|
||||
filter-null-keys = false
|
||||
filter-action = "drop"
|
||||
'';
|
||||
};
|
||||
"audit/plugins.d/laurel.conf".text = ''
|
||||
active = yes
|
||||
direction = out
|
||||
type = always
|
||||
path = ${config.security.wrapperDir}/laurel
|
||||
format = string
|
||||
args = --config /etc/laurel/config.toml
|
||||
'';
|
||||
};
|
||||
security.audit.rules = [
|
||||
# Program Executions
|
||||
"-a exit,always -F arch=b64 -S execve -F key=progexec"
|
||||
|
||||
# Home path access/modification
|
||||
"-a always,exit -F arch=b64 -F dir=/home -F perm=war -F key=homeaccess"
|
||||
|
||||
# Kexec usage
|
||||
"-a always,exit -F arch=b64 -S kexec_load -F key=KEXEC"
|
||||
|
||||
# Root directory access/modification
|
||||
"-a always,exit -F arch=b64 -F dir=/root -F key=roothomeaccess -F perm=war"
|
||||
|
||||
# Failed Modifications of critcal paths
|
||||
"-a always,exit -F arch=b64 -S open -F dir=/etc -F success=0 -F key=unauthedfileaccess"
|
||||
"-a always,exit -F arch=b64 -S open -F dir=/bin -F success=0 -F key=unauthedfileaccess"
|
||||
"-a always,exit -F arch=b64 -S open -F dir=/var -F success=0 -F key=unauthedfileaccess"
|
||||
"-a always,exit -F arch=b64 -S open -F dir=/home -F success=0 -F key=unauthedfileaccess"
|
||||
"-a always,exit -F arch=b64 -S open -F dir=/srv -F success=0 -F key=unauthedfileaccess"
|
||||
"-a always,exit -F arch=b64 -S open -F dir=/opt -F success=0 -F key=unauthedfileaccess"
|
||||
"-a always,exit -F arch=b64 -S open -F dir=/boot -F success=0 -F key=unauthedfileaccess"
|
||||
"-a always,exit -F arch=b64 -S open -F dir=/nix -F success=0 -F key=unauthedfileaccess"
|
||||
"-a always,exit -F arch=b64 -S open -F dir=${persist-dir} -F success=0 -F key=unauthedfileaccess"
|
||||
|
||||
# File deletion events by users
|
||||
"-a always,exit -F arch=b64 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=-1 -F key=delete"
|
||||
|
||||
# Root command executions
|
||||
"-a always,exit -F arch=b64 -F euid=0 -F auid>=1000 -F auid!=-1 -S execve -F key=rootcmd"
|
||||
];
|
||||
}
|
||||
31
hosts/luna/modules/monitoring/grafana.nix
Normal file
31
hosts/luna/modules/monitoring/grafana.nix
Normal file
@ -0,0 +1,31 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
fqdn,
|
||||
...
|
||||
}:
|
||||
let
|
||||
grafana_host = "grafana.${fqdn}";
|
||||
in
|
||||
{
|
||||
services = {
|
||||
grafana = {
|
||||
enable = true;
|
||||
settings.server = {
|
||||
domain = "${grafana_host}";
|
||||
http_addr = "127.0.0.1";
|
||||
http_port = 2342;
|
||||
};
|
||||
};
|
||||
|
||||
nginx.virtualHosts."${grafana_host}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://${config.services.grafana.settings.server.http_addr}:${builtins.toString config.services.grafana.settings.server.http_port}";
|
||||
proxyWebsockets = true;
|
||||
recommendedProxySettings = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
97
hosts/luna/modules/monitoring/prometheus.nix
Normal file
97
hosts/luna/modules/monitoring/prometheus.nix
Normal file
@ -0,0 +1,97 @@
|
||||
{
|
||||
config,
|
||||
fqdn,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
prometheus_host = "prometheus.${fqdn}";
|
||||
in
|
||||
{
|
||||
services = {
|
||||
prometheus = {
|
||||
enable = true;
|
||||
port = 9000;
|
||||
scrapeConfigs = [
|
||||
{
|
||||
job_name = "node-exporter";
|
||||
static_configs = [
|
||||
{ targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ]; }
|
||||
];
|
||||
}
|
||||
];
|
||||
exporters = {
|
||||
node = {
|
||||
enable = true;
|
||||
port = 9001;
|
||||
enabledCollectors = [
|
||||
"arp"
|
||||
"bcache"
|
||||
"btrfs"
|
||||
"bonding"
|
||||
"cpu"
|
||||
"cpufreq"
|
||||
"diskstats"
|
||||
"edac"
|
||||
"entropy"
|
||||
"fibrechannel"
|
||||
"filefd"
|
||||
"filesystem"
|
||||
"hwmon"
|
||||
"ipvs"
|
||||
"loadavg"
|
||||
"meminfo"
|
||||
"mdadm"
|
||||
"netclass"
|
||||
"netdev"
|
||||
"netstat"
|
||||
"nfs"
|
||||
"nfsd"
|
||||
"nvme"
|
||||
"os"
|
||||
"powersupplyclass"
|
||||
"pressure"
|
||||
"rapl"
|
||||
"schedstat"
|
||||
"sockstat"
|
||||
"softnet"
|
||||
"stat"
|
||||
"thermal_zone"
|
||||
"time"
|
||||
"udp_queues"
|
||||
"uname"
|
||||
"vmstat"
|
||||
"systemd"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
nginx = {
|
||||
additionalModules = [ pkgs.nginxModules.pam ];
|
||||
virtualHosts."${prometheus_host}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
extraConfig = ''
|
||||
auth_pam "Password Required";
|
||||
auth_pam_service_name "nginx";
|
||||
'';
|
||||
locations."/" = {
|
||||
proxyPass = "http://${config.services.prometheus.listenAddress}:${builtins.toString config.services.prometheus.port}";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
security.pam.services.nginx.setEnvironment = false;
|
||||
systemd.services.nginx.serviceConfig = {
|
||||
SupplementaryGroups = [ "shadow" ];
|
||||
};
|
||||
|
||||
environment.persistence.save.directories = [
|
||||
{
|
||||
directory = "/var/lib/${config.services.prometheus.stateDir}";
|
||||
user = "prometheus";
|
||||
group = "prometheus";
|
||||
}
|
||||
];
|
||||
}
|
||||
105
hosts/luna/modules/networking.nix
Executable file
105
hosts/luna/modules/networking.nix
Executable file
@ -0,0 +1,105 @@
|
||||
{ hostname, ... }:
|
||||
|
||||
let
|
||||
networks_dhcp_use_dns = "no";
|
||||
networks_dhcp = "ipv4";
|
||||
networks_multicast_dns = "no";
|
||||
networks_ipv6_privacy = "yes";
|
||||
networks_ipv6_accept_ra = "yes";
|
||||
networks_network_config = {
|
||||
DHCP = networks_dhcp;
|
||||
MulticastDNS = networks_multicast_dns;
|
||||
IPv6PrivacyExtensions = networks_ipv6_privacy;
|
||||
IPv6AcceptRA = networks_ipv6_accept_ra;
|
||||
};
|
||||
resolved_nameservers = [
|
||||
"1.1.1.1#cloudflare-dns.com"
|
||||
"9.9.9.9#dns.quad9.net"
|
||||
"8.8.8.8#dns.google"
|
||||
"2606:4700:4700::1111#cloudflare-dns.com"
|
||||
"2620:fe::9#dns.quad9.net"
|
||||
"2001:4860:4860::8888#dns.google"
|
||||
];
|
||||
resolved_fallback_nameservers = [
|
||||
"1.1.1.1#one.one.one.one"
|
||||
"1.0.0.1#one.one.one.one"
|
||||
];
|
||||
in
|
||||
{
|
||||
systemd.network = {
|
||||
enable = true;
|
||||
# HACK: Disable wait-online, check in on https://github.com/NixOS/nixpkgs/pull/258680 &
|
||||
# https://github.com/NixOS/nixpkgs/issues/247608
|
||||
wait-online.enable = false;
|
||||
networks = {
|
||||
"10-wlan" = {
|
||||
matchConfig.Name = [ "wl*" ];
|
||||
networkConfig = networks_network_config;
|
||||
dhcpV4Config = {
|
||||
RouteMetric = 600;
|
||||
UseDNS = networks_dhcp_use_dns;
|
||||
};
|
||||
ipv6AcceptRAConfig = {
|
||||
RouteMetric = 600;
|
||||
UseDNS = networks_dhcp_use_dns;
|
||||
};
|
||||
};
|
||||
"10-ethernet" = {
|
||||
matchConfig.Name = [
|
||||
"en*"
|
||||
"eth*"
|
||||
];
|
||||
networkConfig = networks_network_config;
|
||||
dhcpV4Config = {
|
||||
RouteMetric = 100;
|
||||
UseDNS = networks_dhcp_use_dns;
|
||||
};
|
||||
ipv6AcceptRAConfig = {
|
||||
RouteMetric = 100;
|
||||
UseDNS = networks_dhcp_use_dns;
|
||||
};
|
||||
};
|
||||
"10-wwan" = {
|
||||
matchConfig.Name = [ "ww*" ];
|
||||
networkConfig = networks_network_config;
|
||||
dhcpV4Config = {
|
||||
RouteMetric = 700;
|
||||
UseDNS = networks_dhcp_use_dns;
|
||||
};
|
||||
ipv6AcceptRAConfig = {
|
||||
RouteMetric = 700;
|
||||
UseDNS = networks_dhcp_use_dns;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.resolved = {
|
||||
enable = true;
|
||||
dnssec = "allow-downgrade";
|
||||
domains = [ "~." ];
|
||||
fallbackDns = resolved_fallback_nameservers;
|
||||
llmnr = "resolve";
|
||||
extraConfig = ''
|
||||
MulticastDNS=yes
|
||||
DNSOverTLS=yes
|
||||
CacheFromLocalhost=no
|
||||
Cache=yes
|
||||
'';
|
||||
};
|
||||
networking = {
|
||||
useNetworkd = true;
|
||||
enableIPv6 = true;
|
||||
nameservers = resolved_nameservers;
|
||||
nftables.enable = true;
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [
|
||||
80
|
||||
443
|
||||
2200
|
||||
];
|
||||
};
|
||||
hostName = "${hostname}";
|
||||
};
|
||||
}
|
||||
17
hosts/luna/modules/nix.nix
Executable file
17
hosts/luna/modules/nix.nix
Executable file
@ -0,0 +1,17 @@
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
nix = {
|
||||
settings = {
|
||||
experimental-features = [
|
||||
"nix-command"
|
||||
"flakes"
|
||||
];
|
||||
auto-optimise-store = true;
|
||||
trusted-users = [ "@wheel" ];
|
||||
};
|
||||
gc = {
|
||||
automatic = true;
|
||||
dates = "daily";
|
||||
};
|
||||
};
|
||||
}
|
||||
22
hosts/luna/modules/programs.nix
Executable file
22
hosts/luna/modules/programs.nix
Executable file
@ -0,0 +1,22 @@
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
programs = {
|
||||
neovim = {
|
||||
enable = true;
|
||||
defaultEditor = true;
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
vim
|
||||
coreutils-full
|
||||
nano
|
||||
curl
|
||||
wget
|
||||
git
|
||||
jq
|
||||
rsync
|
||||
];
|
||||
}
|
||||
7
hosts/luna/modules/services/fail2ban.nix
Normal file
7
hosts/luna/modules/services/fail2ban.nix
Normal file
@ -0,0 +1,7 @@
|
||||
{ ... }:
|
||||
{
|
||||
services.fail2ban = {
|
||||
enable = true;
|
||||
maxretry = 10;
|
||||
};
|
||||
}
|
||||
149
hosts/luna/modules/services/gitea.nix
Normal file
149
hosts/luna/modules/services/gitea.nix
Normal file
@ -0,0 +1,149 @@
|
||||
{
|
||||
config,
|
||||
fqdn,
|
||||
inputs,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
gitea_host = "git.${fqdn}";
|
||||
# TODO: Move this docker image out to a separate package and NixOS Module
|
||||
# Huge thank you to https://icewind.nl/entry/gitea-actions-nix/ -- wouldn't have figured this out
|
||||
# without that post 🙂
|
||||
base = import (inputs.nix + "/docker.nix") {
|
||||
inherit pkgs;
|
||||
name = "nix-ci-base";
|
||||
maxLayers = 10;
|
||||
extraPkgs = with pkgs; [
|
||||
nodejs_20
|
||||
bash
|
||||
];
|
||||
nixConf = {
|
||||
substituters = [
|
||||
"https://cache.nixos.org/"
|
||||
"https://nix-community.cachix.org"
|
||||
# insert any other binary caches here
|
||||
];
|
||||
trusted-public-keys = [
|
||||
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
|
||||
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
|
||||
# insert the public keys for those binary caches here
|
||||
];
|
||||
# allow using the new flake commands in our workflows
|
||||
experimental-features = [
|
||||
"nix-command"
|
||||
"flakes"
|
||||
];
|
||||
};
|
||||
};
|
||||
runner = pkgs.dockerTools.buildImage {
|
||||
name = "nix-runner";
|
||||
tag = "latest";
|
||||
|
||||
fromImage = base;
|
||||
fromImageName = null;
|
||||
fromImageTag = "latest";
|
||||
|
||||
copyToRoot = pkgs.buildEnv {
|
||||
name = "image-root";
|
||||
paths = [ pkgs.coreutils-full ];
|
||||
pathsToLink = [ "/bin" ]; # add coreutuls (which includes sleep) to /bin
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
virtualisation.oci-containers.containers = {
|
||||
"nix-runner" = {
|
||||
image = "nix-runner:latest";
|
||||
imageFile = runner;
|
||||
autoStart = false;
|
||||
};
|
||||
};
|
||||
|
||||
age.secrets.gitea-db-pass = {
|
||||
owner = config.services.gitea.user;
|
||||
group = config.services.gitea.group;
|
||||
};
|
||||
|
||||
services = {
|
||||
postgresql = {
|
||||
enable = true;
|
||||
ensureDatabases = [ config.services.gitea.user ];
|
||||
ensureUsers = [
|
||||
{
|
||||
name = config.services.gitea.database.user;
|
||||
ensureClauses = {
|
||||
login = true;
|
||||
createdb = true;
|
||||
};
|
||||
ensureDBOwnership = true;
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
gitea = {
|
||||
appName = "Gitea";
|
||||
enable = true;
|
||||
dump.enable = true;
|
||||
database = {
|
||||
type = "postgres";
|
||||
passwordFile = config.age.secrets.gitea-db-pass.path;
|
||||
};
|
||||
settings = {
|
||||
service.DISABLE_REGISTRATION = true;
|
||||
# Extend timeouts to 1 hour
|
||||
"git.timeout" = {
|
||||
DEFAULT = 3600;
|
||||
MIGRATE = 3600;
|
||||
MIRROR = 3600;
|
||||
CLONE = 3600;
|
||||
PULL = 3600;
|
||||
GC = 3600;
|
||||
};
|
||||
markup.ENABLED = true;
|
||||
mirror.DEFAULT_INTERVAL = "1h";
|
||||
server = {
|
||||
DOMAIN = "${gitea_host}";
|
||||
HTTP_ADDR = "127.0.0.1";
|
||||
ROOT_URL = "https://${gitea_host}/";
|
||||
SSH_PORT = 2220;
|
||||
START_SSH_SERVER = true;
|
||||
DISABLE_QUERY_AUTH_TOKEN = true;
|
||||
};
|
||||
session.COOKIE_SECURE = true;
|
||||
"repository.upload".FILE_MAX_SIZE = 1024;
|
||||
};
|
||||
};
|
||||
gitea-actions-runner.instances = {
|
||||
default = {
|
||||
enable = true;
|
||||
url = config.services.gitea.settings.server.ROOT_URL;
|
||||
tokenFile = config.age.secrets.gitea-runner-token.path;
|
||||
name = "Default";
|
||||
settings = {
|
||||
runner.capacity = 8;
|
||||
};
|
||||
labels = [
|
||||
"default:docker://nix-runner:latest"
|
||||
"alpine:docker://alpine:latest"
|
||||
"debian:docker://debian:latest"
|
||||
];
|
||||
};
|
||||
};
|
||||
nginx.virtualHosts."${gitea_host}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/".proxyPass = "http://${config.services.gitea.settings.server.HTTP_ADDR}:${builtins.toString config.services.gitea.settings.server.HTTP_PORT}";
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ config.services.gitea.settings.server.SSH_PORT ];
|
||||
|
||||
environment.persistence.save.directories = [
|
||||
{
|
||||
directory = config.services.gitea.stateDir;
|
||||
user = config.services.gitea.user;
|
||||
group = config.services.gitea.group;
|
||||
}
|
||||
];
|
||||
}
|
||||
8
hosts/luna/modules/services/journald.nix
Normal file
8
hosts/luna/modules/services/journald.nix
Normal file
@ -0,0 +1,8 @@
|
||||
{ ... }:
|
||||
{
|
||||
services.journald = {
|
||||
extraConfig = ''
|
||||
SystemMaxUse=100G
|
||||
'';
|
||||
};
|
||||
}
|
||||
27
hosts/luna/modules/services/nginx.nix
Normal file
27
hosts/luna/modules/services/nginx.nix
Normal file
@ -0,0 +1,27 @@
|
||||
{
|
||||
inputs,
|
||||
pkgs,
|
||||
fqdn,
|
||||
...
|
||||
}:
|
||||
{
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedGzipSettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
};
|
||||
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults.email = "price@orion-technologies.io";
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."blog.${fqdn}" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
root = inputs.blog.packages.${pkgs.system}.default;
|
||||
locations."/".index = "home.html";
|
||||
};
|
||||
}
|
||||
46
hosts/luna/modules/services/openssh.nix
Normal file
46
hosts/luna/modules/services/openssh.nix
Normal file
@ -0,0 +1,46 @@
|
||||
{ config, ... }:
|
||||
{
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
startWhenNeeded = true;
|
||||
# We set the hostkeys manually so they persist through reboots
|
||||
hostKeys = [
|
||||
{
|
||||
path = (
|
||||
config.environment.persistence.ephemeral.persistentStoragePath + "/etc/ssh/ssh_host_ed25519_key"
|
||||
);
|
||||
type = "ed25519";
|
||||
}
|
||||
];
|
||||
sftpFlags = [
|
||||
"-f AUTHPRIV"
|
||||
"-l INFO"
|
||||
];
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
AuthenticationMethods = "publickey";
|
||||
KbdInteractiveAuthentication = false;
|
||||
PermitRootLogin = "no";
|
||||
X11Forwarding = false;
|
||||
AllowAgentForwarding = false;
|
||||
AllowStreamLocalForwarding = false;
|
||||
LogLevel = "VERBOSE";
|
||||
AllowUsers = [ "price" ];
|
||||
};
|
||||
ports = [ 2200 ];
|
||||
banner = ''
|
||||
┌────────────────────────────────────────────────────┐
|
||||
│ Orion Technologies - Security Notice │
|
||||
│ ┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄ │
|
||||
│ UNAUTHORIZED ACCESS TO THIS DEVICE IS PROHIBITED │
|
||||
│ │
|
||||
│ You must have written, explicit, authorized │
|
||||
│ permission to access or configure this device. │
|
||||
│ Unauthorized attempts and actions to access or use │
|
||||
│ this system may result in civil and/or criminal │
|
||||
│ penalties. All activities performed on this device │
|
||||
│ are logged and monitored. │
|
||||
└────────────────────────────────────────────────────┘
|
||||
'';
|
||||
};
|
||||
}
|
||||
46
hosts/luna/modules/services/postgresql.nix
Normal file
46
hosts/luna/modules/services/postgresql.nix
Normal file
@ -0,0 +1,46 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
{
|
||||
services.postgresqlBackup = {
|
||||
location = "/var/backup/postgresql";
|
||||
backupAll = true;
|
||||
};
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
# Explicitly setting the data dir so upgrades (changing version from 15 -> 16) don't end up
|
||||
# getting lost on system reboots
|
||||
dataDir = "/var/lib/postgresql";
|
||||
settings = {
|
||||
log_connections = true;
|
||||
log_disconnections = true;
|
||||
logging_collector = true;
|
||||
log_statement = "all";
|
||||
log_destination = lib.mkForce "syslog,jsonlog";
|
||||
};
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "root";
|
||||
ensureClauses.superuser = true;
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
environment.systemPackages = [ pkgs.pgloader ];
|
||||
|
||||
environment.persistence.save.directories = [
|
||||
{
|
||||
directory = config.services.postgresql.dataDir;
|
||||
user = "postgres";
|
||||
group = "postgres";
|
||||
}
|
||||
{
|
||||
directory = config.services.postgresqlBackup.location;
|
||||
user = "postgres";
|
||||
group = "postgres";
|
||||
}
|
||||
];
|
||||
}
|
||||
17
hosts/luna/modules/system.nix
Normal file
17
hosts/luna/modules/system.nix
Normal file
@ -0,0 +1,17 @@
|
||||
{ self, ... }:
|
||||
|
||||
{
|
||||
system = {
|
||||
autoUpgrade = {
|
||||
enable = true;
|
||||
dates = "05:00";
|
||||
allowReboot = true;
|
||||
flake = self.outPath;
|
||||
flags = [
|
||||
"--update-input"
|
||||
"nixpkgs"
|
||||
"-L"
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
26
hosts/luna/modules/users.nix
Executable file
26
hosts/luna/modules/users.nix
Executable file
@ -0,0 +1,26 @@
|
||||
{ pkgs, config, ... }:
|
||||
{
|
||||
security.sudo.wheelNeedsPassword = false;
|
||||
users.mutableUsers = false;
|
||||
users.users = {
|
||||
root.hashedPasswordFile = config.age.secrets.users-root-pw.path;
|
||||
price = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" ];
|
||||
shell = pkgs.bash;
|
||||
hashedPasswordFile = config.age.secrets.users-price-pw.path;
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOkWsSntg1ufF40cALcIBA7WZhiU/f0cncqq0pcp+DZY openpgp:0x15993C90"
|
||||
];
|
||||
};
|
||||
};
|
||||
environment.persistence.ephemeral.users = {
|
||||
price = {
|
||||
files = [ ".bash_history" ];
|
||||
};
|
||||
root = {
|
||||
home = "/root";
|
||||
files = [ ".bash_history" ];
|
||||
};
|
||||
};
|
||||
}
|
||||
81
hosts/luna/os/boot.nix
Normal file
81
hosts/luna/os/boot.nix
Normal file
@ -0,0 +1,81 @@
|
||||
{ modulesPath, pkgs, ... }:
|
||||
{
|
||||
|
||||
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
|
||||
|
||||
boot = {
|
||||
tmp = {
|
||||
useTmpfs = true;
|
||||
cleanOnBoot = true;
|
||||
};
|
||||
loader = {
|
||||
systemd-boot.enable = true;
|
||||
efi.canTouchEfiVariables = true;
|
||||
};
|
||||
kernelModules = [ "kvm-intel" ];
|
||||
kernelParams = [ "audit=1" ];
|
||||
extraModulePackages = [ ];
|
||||
initrd = {
|
||||
availableKernelModules = [
|
||||
"xhci_pci"
|
||||
"ahci"
|
||||
"nvme"
|
||||
"uas"
|
||||
"sd_mod"
|
||||
];
|
||||
kernelModules = [ ];
|
||||
systemd = {
|
||||
enable = true;
|
||||
initrdBin = [
|
||||
pkgs.libuuid
|
||||
pkgs.gawk
|
||||
];
|
||||
services.rollback = {
|
||||
description = "Rollback btrfs root subvolume";
|
||||
wantedBy = [ "initrd.target" ];
|
||||
before = [ "sysroot.mount" ];
|
||||
after = [ "initrd-root-device.target" ];
|
||||
unitConfig.DefaultDependencies = "no";
|
||||
serviceConfig.Type = "oneshot";
|
||||
script = ''
|
||||
mkdir -p /mnt
|
||||
DISK_LABEL="NixOS-Primary"
|
||||
FOUND_DISK=0
|
||||
ATTEMPTS=50
|
||||
printf "Attempting to find disk with label '%s'\n" "$DISK_LABEL"
|
||||
while ((ATTEMPTS > 0)); do
|
||||
if findfs LABEL="$DISK_LABEL"; then
|
||||
FOUND_DISK=1
|
||||
printf "Found disk!\n"
|
||||
break;
|
||||
fi
|
||||
((ATTEMPTS--))
|
||||
sleep .1
|
||||
printf "Remaining disk discovery attempts: %s\n" "$ATTEMPTS"
|
||||
done
|
||||
if (( FOUND_DISK == 0 )); then
|
||||
printf "Discovery of disk with label '%s' failed! Cannot rollback!\n" "$DISK_LABEL"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
mount -t btrfs -o subvol=/ $(findfs LABEL="$DISK_LABEL") /mnt
|
||||
btrfs subvolume list -to /mnt/root \
|
||||
| awk 'NR>2 { printf $4"\n" }' \
|
||||
| while read subvol; do
|
||||
printf "Removing Subvolume: %s\n" "$subvol";
|
||||
btrfs subvolume delete "/mnt/$subvol"
|
||||
done
|
||||
|
||||
printf "Removing /root subvolume\n"
|
||||
btrfs subvolume delete /mnt/root
|
||||
|
||||
printf "Restoring base /root subvolume\n"
|
||||
btrfs subvolume snapshot /mnt/root-base /mnt/root
|
||||
|
||||
umount /mnt
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
5
hosts/luna/os/default.nix
Normal file
5
hosts/luna/os/default.nix
Normal file
@ -0,0 +1,5 @@
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
zramSwap.enable = true;
|
||||
}
|
||||
117
hosts/luna/os/fs.nix
Normal file
117
hosts/luna/os/fs.nix
Normal file
@ -0,0 +1,117 @@
|
||||
{
|
||||
lib,
|
||||
root-disk,
|
||||
persist-dir,
|
||||
...
|
||||
}:
|
||||
{
|
||||
services = {
|
||||
fstrim.enable = true;
|
||||
btrfs.autoScrub = {
|
||||
enable = true;
|
||||
fileSystems = [
|
||||
"/"
|
||||
"/nix"
|
||||
"/persist"
|
||||
];
|
||||
};
|
||||
snapper = {
|
||||
# NOTE: According to `snapper-config(5)` the default timeline count for all timelines is 10
|
||||
# (see TIMELINE_LIMIT_HOURLY, ...DAILY, etc.)
|
||||
configs.persist = {
|
||||
TIMELINE_CREATE = true;
|
||||
TIMELINE_CLEANUP = true;
|
||||
SUBVOLUME = "${persist-dir}";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
fileSystems."${persist-dir}".neededForBoot = true;
|
||||
|
||||
disko.devices = {
|
||||
disk.${lib.removePrefix "/dev/" root-disk} = {
|
||||
type = "disk";
|
||||
device = "${root-disk}";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
esp =
|
||||
let
|
||||
label = "NixOS-Boot";
|
||||
in
|
||||
{
|
||||
priority = 1;
|
||||
size = "512M";
|
||||
type = "EF00";
|
||||
content = {
|
||||
extraArgs = [
|
||||
"-n ${label}"
|
||||
"-F 32"
|
||||
];
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
mountOptions = [
|
||||
"umask=0077"
|
||||
"defaults"
|
||||
];
|
||||
};
|
||||
};
|
||||
root =
|
||||
let
|
||||
label = "NixOS-Primary";
|
||||
in
|
||||
{
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "btrfs";
|
||||
extraArgs = [
|
||||
"-f"
|
||||
"--label ${label}"
|
||||
];
|
||||
postCreateHook = ''
|
||||
MOUNT="$(mktemp -d)"
|
||||
mount "/dev/disk/by-label/${label}" "$MOUNT" -o subvol=/
|
||||
trap 'umount $MOUNT; rm -rf $MOUNT' EXIT
|
||||
btrfs subvolume snapshot -r "$MOUNT/root" "$MOUNT/root-base"
|
||||
'';
|
||||
subvolumes = {
|
||||
"/root" = {
|
||||
mountpoint = "/";
|
||||
};
|
||||
"/var-log" = {
|
||||
mountpoint = "/var/log";
|
||||
mountOptions = [
|
||||
"compress=zstd"
|
||||
"noatime"
|
||||
];
|
||||
};
|
||||
"/nix" = {
|
||||
mountpoint = "/nix";
|
||||
mountOptions = [
|
||||
"compress=zstd"
|
||||
"noatime"
|
||||
];
|
||||
};
|
||||
"${persist-dir}" = {
|
||||
mountpoint = "${persist-dir}";
|
||||
mountOptions = [
|
||||
"compress=zstd"
|
||||
"noatime"
|
||||
];
|
||||
};
|
||||
"${persist-dir}/.snapshots" = {
|
||||
mountpoint = "${persist-dir}/.snapshots";
|
||||
mountOptions = [
|
||||
"compress=zstd"
|
||||
"noatime"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
6
hosts/luna/os/hardware.nix
Normal file
6
hosts/luna/os/hardware.nix
Normal file
@ -0,0 +1,6 @@
|
||||
{ lib, config, ... }:
|
||||
{
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
services.fstrim.enable = true;
|
||||
}
|
||||
1
hosts/luna/pubkey.nix
Normal file
1
hosts/luna/pubkey.nix
Normal file
@ -0,0 +1 @@
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJZzZ6q/V7f8zbb9Xm0uZPn4zfdXAj3QgwGkGKzEV9Q5 luna"
|
||||
2
hosts/orion/README.md
Normal file
2
hosts/orion/README.md
Normal file
@ -0,0 +1,2 @@
|
||||
# Orion
|
||||
This is my laptop and primary (and only) developer machine.
|
||||
14
hosts/orion/default.nix
Normal file
14
hosts/orion/default.nix
Normal file
@ -0,0 +1,14 @@
|
||||
{ pkgs, lib, ... }:
|
||||
{
|
||||
imports = (
|
||||
lib.recurseFilesInDirs [
|
||||
./os
|
||||
./modules
|
||||
] ".nix"
|
||||
);
|
||||
system.stateVersion = "24.05";
|
||||
environment.systemPackages = with pkgs; [
|
||||
git
|
||||
neovim
|
||||
];
|
||||
}
|
||||
21
hosts/orion/modules/audio.nix
Normal file
21
hosts/orion/modules/audio.nix
Normal file
@ -0,0 +1,21 @@
|
||||
{
|
||||
inputs,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
hardware.pulseaudio.enable = false;
|
||||
security.rtkit.enable = true;
|
||||
services.pipewire = {
|
||||
enable = true;
|
||||
alsa = {
|
||||
enable = true;
|
||||
support32Bit = true;
|
||||
};
|
||||
pulse.enable = true;
|
||||
wireplumber.enable = true;
|
||||
jack.enable = true;
|
||||
};
|
||||
}
|
||||
36
hosts/orion/modules/bluetooth.nix
Normal file
36
hosts/orion/modules/bluetooth.nix
Normal file
@ -0,0 +1,36 @@
|
||||
{
|
||||
inputs,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
hardware.bluetooth.enable = true;
|
||||
services.blueman.enable = true;
|
||||
environment.systemPackages = with pkgs; [ bluez ];
|
||||
|
||||
systemd.user.services.mpris-proxy = {
|
||||
description = "Mpris proxy";
|
||||
after = [
|
||||
"network.target"
|
||||
"sound.target"
|
||||
];
|
||||
wantedBy = [ "default.target" ];
|
||||
serviceConfig.ExecStart = "${pkgs.bluez}/bin/mpris-proxy";
|
||||
};
|
||||
|
||||
security.polkit.extraConfig = ''
|
||||
/* Allow users in wheel group to use blueman feature requiring root without authentication */
|
||||
polkit.addRule(function(action, subject) {
|
||||
if ((action.id == "org.blueman.network.setup" ||
|
||||
action.id == "org.blueman.dhcp.client" ||
|
||||
action.id == "org.blueman.rfkill.setstate" ||
|
||||
action.id == "org.blueman.pppd.pppconnect") &&
|
||||
subject.isInGroup("wheel")) {
|
||||
|
||||
return polkit.Result.YES;
|
||||
}
|
||||
});
|
||||
'';
|
||||
}
|
||||
23
hosts/orion/modules/graphical.nix
Normal file
23
hosts/orion/modules/graphical.nix
Normal file
@ -0,0 +1,23 @@
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
services.displayManager.sddm = {
|
||||
wayland.enable = true;
|
||||
enable = true;
|
||||
};
|
||||
programs.hyprland = {
|
||||
enable = true;
|
||||
xwayland.enable = true;
|
||||
};
|
||||
xdg = {
|
||||
autostart.enable = true;
|
||||
portal = {
|
||||
enable = true;
|
||||
extraPortals = with pkgs; [
|
||||
xdg-desktop-portal
|
||||
xdg-desktop-portal-gtk
|
||||
];
|
||||
};
|
||||
};
|
||||
hardware.opengl.enable = true;
|
||||
services.spice-vdagentd.enable = true;
|
||||
}
|
||||
30
hosts/orion/modules/hardware.nix
Normal file
30
hosts/orion/modules/hardware.nix
Normal file
@ -0,0 +1,30 @@
|
||||
{
|
||||
inputs,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
# NOTE: Disable Nvidia GPU
|
||||
boot.extraModprobeConfig = ''
|
||||
blacklist nouveau
|
||||
options nouveau iwlwifi power_save=1 modeset=0
|
||||
'';
|
||||
services.udev.extraRules = ''
|
||||
# Remove NVIDIA USB xHCI Host Controller devices, if present
|
||||
ACTION=="add", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x0c0330", ATTR{power/control}="auto", ATTR{remove}="1"
|
||||
# Remove NVIDIA USB Type-C UCSI devices, if present
|
||||
ACTION=="add", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x0c8000", ATTR{power/control}="auto", ATTR{remove}="1"
|
||||
# Remove NVIDIA Audio devices, if present
|
||||
ACTION=="add", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x040300", ATTR{power/control}="auto", ATTR{remove}="1"
|
||||
# Remove NVIDIA VGA/3D controller devices
|
||||
ACTION=="add", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x03[0-9]*", ATTR{power/control}="auto", ATTR{remove}="1"
|
||||
'';
|
||||
boot.blacklistedKernelModules = [
|
||||
"nouveau"
|
||||
"nvidia"
|
||||
"nvidia_drm"
|
||||
"nvidia_modeset"
|
||||
];
|
||||
}
|
||||
56
hosts/orion/modules/networking.nix
Normal file
56
hosts/orion/modules/networking.nix
Normal file
@ -0,0 +1,56 @@
|
||||
{ hostname, lib, ... }:
|
||||
|
||||
let
|
||||
default-network-cfg =
|
||||
let
|
||||
use-dhcp-dns = "no";
|
||||
in
|
||||
{
|
||||
networkConfig = {
|
||||
DHCP = "yes";
|
||||
MulticastDNS = "yes";
|
||||
IPv6PrivacyExtensions = "yes";
|
||||
IPv6AcceptRA = "yes";
|
||||
};
|
||||
dhcpV4Config = {
|
||||
RouteMetric = 600;
|
||||
UseDNS = use-dhcp-dns;
|
||||
};
|
||||
ipv6AcceptRAConfig = {
|
||||
RouteMetric = 600;
|
||||
UseDNS = use-dhcp-dns;
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
systemd.network = {
|
||||
enable = true;
|
||||
networks = lib.attrsets.mapAttrs (name: value: value // default-network-cfg) {
|
||||
"10-wlan".matchConfig.Name = [ "wl*" ];
|
||||
"10-ethernet".matchConfig.name = [
|
||||
"en*"
|
||||
"eth*"
|
||||
];
|
||||
"10-wwan".matchConfig.name = [ "ww*" ];
|
||||
};
|
||||
};
|
||||
|
||||
services.resolved = {
|
||||
enable = true;
|
||||
domains = [ "~." ];
|
||||
extraConfig = ''
|
||||
DNS=2a07:e340::2:853#dns.mullvad.net 194.242.2.2#dns.mullvad.net
|
||||
FallbackDNS=1.1.1.1#cloudflare-dns.com 1.0.0.1#cloudflare-dns.com 2606:4700:4700::1111#cloudflare-dns.com 2606:4700:4700::1001#cloudflare-dns.com
|
||||
Cache=yes
|
||||
CacheFromLocalhost=no
|
||||
DNSSEC=allow-downgrade
|
||||
DNSOverTLS=yes
|
||||
MulticastDNS=yes
|
||||
'';
|
||||
};
|
||||
networking = {
|
||||
hostName = hostname;
|
||||
wireless.iwd.enable = true;
|
||||
useNetworkd = true;
|
||||
};
|
||||
}
|
||||
19
hosts/orion/modules/nix.nix
Normal file
19
hosts/orion/modules/nix.nix
Normal file
@ -0,0 +1,19 @@
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
nix = {
|
||||
settings = {
|
||||
experimental-features = [
|
||||
"nix-command"
|
||||
"flakes"
|
||||
];
|
||||
auto-optimise-store = true;
|
||||
trusted-users = [ "@wheel" ];
|
||||
};
|
||||
gc = {
|
||||
automatic = true;
|
||||
dates = "weekly";
|
||||
options = "--delete-older-than 7d";
|
||||
};
|
||||
};
|
||||
}
|
||||
7
hosts/orion/modules/power.nix
Normal file
7
hosts/orion/modules/power.nix
Normal file
@ -0,0 +1,7 @@
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
powerManagement.enable = true;
|
||||
powerManagement.powertop.enable = true;
|
||||
services.thermald.enable = true;
|
||||
}
|
||||
8
hosts/orion/modules/programs.nix
Normal file
8
hosts/orion/modules/programs.nix
Normal file
@ -0,0 +1,8 @@
|
||||
{ ... }:
|
||||
{
|
||||
programs = {
|
||||
dconf.enable = true;
|
||||
zsh.enable = true;
|
||||
nix-ld.enable = true;
|
||||
};
|
||||
}
|
||||
62
hosts/orion/modules/services/openssh.nix
Normal file
62
hosts/orion/modules/services/openssh.nix
Normal file
@ -0,0 +1,62 @@
|
||||
{ config, ... }:
|
||||
{
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
startWhenNeeded = true;
|
||||
# We set the hostkeys manually so they persist through reboots
|
||||
hostKeys = [
|
||||
{
|
||||
path = (
|
||||
config.environment.persistence.ephemeral.persistentStoragePath + "/etc/ssh/ssh_host_ed25519_key"
|
||||
);
|
||||
type = "ed25519";
|
||||
}
|
||||
];
|
||||
sftpFlags = [
|
||||
"-f AUTHPRIV"
|
||||
"-l INFO"
|
||||
];
|
||||
extraConfig = ''
|
||||
AllowUsers price
|
||||
'';
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
PermitRootLogin = "no";
|
||||
GatewayPorts = "yes";
|
||||
LogLevel = "VERBOSE";
|
||||
KexAlgorithms = [
|
||||
"curve25519-sha256"
|
||||
"curve25519-sha256@libssh.org"
|
||||
"diffie-hellman-group-exchange-sha256"
|
||||
];
|
||||
Ciphers = [
|
||||
"chacha20-poly1305@openssh.com"
|
||||
"aes256-gcm@openssh.com"
|
||||
"aes128-gcm@openssh.com"
|
||||
"aes256-ctr"
|
||||
"aes192-ctr"
|
||||
"aes128-ctr"
|
||||
];
|
||||
Macs = [
|
||||
"hmac-sha2-512-etm@openssh.com"
|
||||
"hmac-sha2-256-etm@openssh.com"
|
||||
"umac-128-etm@openssh.com"
|
||||
];
|
||||
};
|
||||
ports = [ 2200 ];
|
||||
banner = ''
|
||||
┌────────────────────────────────────────────────────┐
|
||||
│ Orion Technologies - Security Notice │
|
||||
│ ┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄ │
|
||||
│ UNAUTHORIZED ACCESS TO THIS DEVICE IS PROHIBITED │
|
||||
│ │
|
||||
│ You must have written, explicit, authorized │
|
||||
│ permission to access or configure this device. │
|
||||
│ Unauthorized attempts and actions to access or use │
|
||||
│ this system may result in civil and/or criminal │
|
||||
│ penalties. All activities performed on this device │
|
||||
│ are logged and monitored. │
|
||||
└────────────────────────────────────────────────────┘
|
||||
'';
|
||||
};
|
||||
}
|
||||
33
hosts/orion/modules/users.nix
Normal file
33
hosts/orion/modules/users.nix
Normal file
@ -0,0 +1,33 @@
|
||||
{ pkgs, config, ... }:
|
||||
{
|
||||
security.sudo.wheelNeedsPassword = false;
|
||||
users.groups.price = { };
|
||||
users.users = {
|
||||
root.hashedPasswordFile = config.age.secrets.users-root-pw.path;
|
||||
price = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" ];
|
||||
group = "price";
|
||||
shell = pkgs.zsh;
|
||||
createHome = true;
|
||||
hashedPasswordFile = config.age.secrets.users-price-pw.path;
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOkWsSntg1ufF40cALcIBA7WZhiU/f0cncqq0pcp+DZY openpgp:0x15993C90"
|
||||
];
|
||||
};
|
||||
};
|
||||
environment.persistence.ephemeral.directories = [
|
||||
{
|
||||
directory = "/home/price";
|
||||
user = "price";
|
||||
group = "${config.users.users.price.group}";
|
||||
mode = "${config.users.users.price.homeMode}";
|
||||
}
|
||||
];
|
||||
environment.persistence.ephemeral.users = {
|
||||
root = {
|
||||
home = (config.users.users.root.home);
|
||||
files = [ ".bash_history" ];
|
||||
};
|
||||
};
|
||||
}
|
||||
87
hosts/orion/os/boot.nix
Normal file
87
hosts/orion/os/boot.nix
Normal file
@ -0,0 +1,87 @@
|
||||
{ modulesPath, pkgs, ... }:
|
||||
{
|
||||
|
||||
# imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
|
||||
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
|
||||
|
||||
boot = {
|
||||
loader = {
|
||||
systemd-boot.enable = true;
|
||||
efi.canTouchEfiVariables = true;
|
||||
};
|
||||
kernelModules = [ "kvm-intel" ];
|
||||
kernelParams = [ "audit=1" ];
|
||||
extraModulePackages = [ ];
|
||||
initrd = {
|
||||
# VM modules
|
||||
availableKernelModules = [
|
||||
"ahci"
|
||||
"xhci_pci"
|
||||
"virtio_pci"
|
||||
"sr_mod"
|
||||
"virtio_blk"
|
||||
];
|
||||
# Actual Host modules
|
||||
# availableKernelModules = [
|
||||
# "xhci_pci"
|
||||
# "thunderbolt"
|
||||
# "vmd"
|
||||
# "nvme"
|
||||
# "usbhid"
|
||||
# "rtsx_pci_sdmmc"
|
||||
# ];
|
||||
systemd = {
|
||||
enable = true;
|
||||
initrdBin = [
|
||||
pkgs.libuuid
|
||||
pkgs.gawk
|
||||
];
|
||||
services.rollback = {
|
||||
description = "Rollback btrfs root subvolume";
|
||||
wantedBy = [ "initrd.target" ];
|
||||
before = [ "sysroot.mount" ];
|
||||
after = [ "initrd-root-device.target" ];
|
||||
unitConfig.DefaultDependencies = "no";
|
||||
serviceConfig.Type = "oneshot";
|
||||
script = ''
|
||||
mkdir -p /mnt
|
||||
DISK_LABEL="NixOS-Primary"
|
||||
FOUND_DISK=0
|
||||
ATTEMPTS=50
|
||||
printf "Attempting to find disk with label '%s'\n" "$DISK_LABEL"
|
||||
while ((ATTEMPTS > 0)); do
|
||||
if findfs LABEL="$DISK_LABEL"; then
|
||||
FOUND_DISK=1
|
||||
printf "Found disk!\n"
|
||||
break;
|
||||
fi
|
||||
((ATTEMPTS--))
|
||||
sleep .1
|
||||
printf "Remaining disk discovery attempts: %s\n" "$ATTEMPTS"
|
||||
done
|
||||
if (( FOUND_DISK == 0 )); then
|
||||
printf "Discovery of disk with label '%s' failed! Cannot rollback!\n" "$DISK_LABEL"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
mount -t btrfs -o subvol=/ $(findfs LABEL="$DISK_LABEL") /mnt
|
||||
btrfs subvolume list -to /mnt/root \
|
||||
| awk 'NR>2 { printf $4"\n" }' \
|
||||
| while read subvol; do
|
||||
printf "Removing Subvolume: %s\n" "$subvol";
|
||||
btrfs subvolume delete "/mnt/$subvol"
|
||||
done
|
||||
|
||||
printf "Removing /root subvolume\n"
|
||||
btrfs subvolume delete /mnt/root
|
||||
|
||||
printf "Restoring base /root subvolume\n"
|
||||
btrfs subvolume snapshot /mnt/root-base /mnt/root
|
||||
|
||||
umount /mnt
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
5
hosts/orion/os/default.nix
Normal file
5
hosts/orion/os/default.nix
Normal file
@ -0,0 +1,5 @@
|
||||
{ modulesPath, ... }:
|
||||
|
||||
{
|
||||
zramSwap.enable = true;
|
||||
}
|
||||
112
hosts/orion/os/fs.nix
Normal file
112
hosts/orion/os/fs.nix
Normal file
@ -0,0 +1,112 @@
|
||||
{
|
||||
modulesPath,
|
||||
config,
|
||||
lib,
|
||||
root-disk,
|
||||
persist-dir,
|
||||
...
|
||||
}:
|
||||
{
|
||||
services = {
|
||||
fstrim.enable = true;
|
||||
btrfs.autoScrub = {
|
||||
enable = true;
|
||||
fileSystems = [
|
||||
"/"
|
||||
"/nix"
|
||||
"/persist"
|
||||
];
|
||||
};
|
||||
snapper = {
|
||||
# NOTE: According to `snapper-config(5)` the default timeline count for all timelines is 10
|
||||
# (see TIMELINE_LIMIT_HOURLY, ...DAILY, etc.)
|
||||
configs.persist = {
|
||||
TIMELINE_CREATE = true;
|
||||
TIMELINE_CLEANUP = true;
|
||||
SUBVOLUME = "${persist-dir}";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
fileSystems."${persist-dir}".neededForBoot = true;
|
||||
|
||||
disko.devices = {
|
||||
disk.${lib.removePrefix "/dev/" root-disk} = {
|
||||
type = "disk";
|
||||
device = "${root-disk}";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
esp =
|
||||
let
|
||||
label = "NixOS-Boot";
|
||||
in
|
||||
{
|
||||
priority = 1;
|
||||
size = "512M";
|
||||
type = "EF00";
|
||||
content = {
|
||||
extraArgs = [
|
||||
"-n ${label}"
|
||||
"-F 32"
|
||||
];
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
mountOptions = [
|
||||
"umask=0077"
|
||||
"defaults"
|
||||
];
|
||||
};
|
||||
};
|
||||
root =
|
||||
let
|
||||
label = "NixOS-Primary";
|
||||
in
|
||||
{
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "luks";
|
||||
name = "crypted";
|
||||
settings = {
|
||||
allowDiscards = true;
|
||||
};
|
||||
content = {
|
||||
type = "btrfs";
|
||||
extraArgs = [
|
||||
"-f"
|
||||
"--label ${label}"
|
||||
];
|
||||
postCreateHook = ''
|
||||
MOUNT="$(mktemp -d)"
|
||||
mount "/dev/disk/by-label/${label}" "$MOUNT" -o subvol=/
|
||||
trap 'umount $MOUNT; rm -rf $MOUNT' EXIT
|
||||
btrfs subvolume snapshot -r "$MOUNT/root" "$MOUNT/root-base"
|
||||
'';
|
||||
subvolumes = {
|
||||
"/root" = {
|
||||
mountpoint = "/";
|
||||
};
|
||||
"/nix" = {
|
||||
mountpoint = "/nix";
|
||||
mountOptions = [
|
||||
"compress=zstd"
|
||||
"noatime"
|
||||
];
|
||||
};
|
||||
"/persist" = {
|
||||
mountpoint = "/persist";
|
||||
mountOptions = [
|
||||
"compress=zstd"
|
||||
"noatime"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
6
hosts/orion/os/hardware.nix
Normal file
6
hosts/orion/os/hardware.nix
Normal file
@ -0,0 +1,6 @@
|
||||
{ lib, config, ... }:
|
||||
{
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
services.fstrim.enable = true;
|
||||
}
|
||||
1
hosts/orion/pubkey.nix
Normal file
1
hosts/orion/pubkey.nix
Normal file
@ -0,0 +1 @@
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB/mvAHcaWQv6m+F5o2wYg5DX+cOYCiqha/LustPcStf orion"
|
||||
@ -1,2 +0,0 @@
|
||||
#!/usr/bin/env /bin/bash
|
||||
nix run --extra-experimental-features 'nix-command flakes' . -- switch --extra-experimental-features 'nix-command flakes' --flake "git+file://$(pwd)?submodules=1" "${@}"
|
||||
16
overlays/default.nix
Normal file
16
overlays/default.nix
Normal file
@ -0,0 +1,16 @@
|
||||
{ inputs, ... }:
|
||||
{
|
||||
additions = final: _prev: import ../pkgs { pkgs = final; };
|
||||
|
||||
modifications = final: prev: {
|
||||
waybar = inputs.waybar.packages.${final.system}.default;
|
||||
lxappearance = prev.lxappearance.overrideAttrs (oldAttrs: {
|
||||
postInstall = ''
|
||||
wrapProgram $out/bin/lxappearance --prefix GDK_BACKEND : x11
|
||||
'';
|
||||
});
|
||||
opensnitch-ui = prev.opensnitch-ui.overrideAttrs (oldAttrs: {
|
||||
propagatedBuildInputs = oldAttrs.propagatedBuildInputs ++ [ prev.python311Packages.qt-material ];
|
||||
});
|
||||
};
|
||||
}
|
||||
@ -1,61 +0,0 @@
|
||||
{
|
||||
"nodes": {
|
||||
"flake-utils": {
|
||||
"inputs": {
|
||||
"systems": "systems"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1710146030,
|
||||
"narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1710534455,
|
||||
"narHash": "sha256-huQT4Xs0y4EeFKn2BTBVYgEwJSv8SDlm82uWgMnCMmI=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "9af9c1c87ed3e3ed271934cb896e0cdd33dae212",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nixos",
|
||||
"ref": "nixpkgs-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"flake-utils": "flake-utils",
|
||||
"nixpkgs": "nixpkgs"
|
||||
}
|
||||
},
|
||||
"systems": {
|
||||
"locked": {
|
||||
"lastModified": 1681028828,
|
||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
}
|
||||
},
|
||||
"root": "root",
|
||||
"version": 7
|
||||
}
|
||||
@ -1,42 +0,0 @@
|
||||
{
|
||||
description = "Flake for custom formatting script";
|
||||
|
||||
inputs = {
|
||||
nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
|
||||
flake-utils.url = "github:numtide/flake-utils";
|
||||
};
|
||||
|
||||
outputs =
|
||||
{
|
||||
self,
|
||||
nixpkgs,
|
||||
flake-utils,
|
||||
}:
|
||||
flake-utils.lib.eachDefaultSystem (
|
||||
system:
|
||||
let
|
||||
pkgs = nixpkgs.legacyPackages.${system};
|
||||
in
|
||||
{
|
||||
packages.default = pkgs.writeShellApplication {
|
||||
name = "Fmt";
|
||||
runtimeInputs = with pkgs; [
|
||||
stylua
|
||||
gnugrep
|
||||
nixfmt-rfc-style
|
||||
nodePackages.prettier
|
||||
shfmt
|
||||
];
|
||||
text = (
|
||||
''
|
||||
#!${pkgs.bash}/bin/bash
|
||||
''
|
||||
+ builtins.readFile ./fmt.bash
|
||||
);
|
||||
};
|
||||
}
|
||||
)
|
||||
// {
|
||||
overlays.default = final: prev: { Fmt = self.packages.${final.system}.default; };
|
||||
};
|
||||
}
|
||||
14
pkgs/bob-nvim.nix
Normal file
14
pkgs/bob-nvim.nix
Normal file
@ -0,0 +1,14 @@
|
||||
{ rustPlatform, fetchFromGitHub }:
|
||||
|
||||
rustPlatform.buildRustPackage rec {
|
||||
pname = "bob";
|
||||
version = "2.9.1";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "MordechaiHadad";
|
||||
repo = "bob";
|
||||
rev = "v${version}";
|
||||
hash = "sha256-jVRxvhUENyucRHN4TGV9xsWOs7mfPJCV90Lk/hD1xFE=";
|
||||
};
|
||||
cargoLock.lockFile = "${src}/Cargo.lock";
|
||||
}
|
||||
@ -1,78 +0,0 @@
|
||||
{
|
||||
"nodes": {
|
||||
"bob": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1706612487,
|
||||
"narHash": "sha256-OTmsb1tnautQTdO/oeqbwd5MmyHbG946/kPCGSluIrM=",
|
||||
"owner": "MordechaiHadad",
|
||||
"repo": "bob",
|
||||
"rev": "e521723d2c084f4b610c27d79f870f83e964fe95",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "MordechaiHadad",
|
||||
"repo": "bob",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils": {
|
||||
"inputs": {
|
||||
"systems": "systems"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1705309234,
|
||||
"narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1708151420,
|
||||
"narHash": "sha256-MGT/4aGCWQPQiu6COqJdCj9kSpLPiShgbwpbC38YXC8=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "6e2f00c83911461438301db0dba5281197fe4b3a",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nixos",
|
||||
"ref": "nixpkgs-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"bob": "bob",
|
||||
"flake-utils": "flake-utils",
|
||||
"nixpkgs": "nixpkgs"
|
||||
}
|
||||
},
|
||||
"systems": {
|
||||
"locked": {
|
||||
"lastModified": 1681028828,
|
||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
}
|
||||
},
|
||||
"root": "root",
|
||||
"version": 7
|
||||
}
|
||||
@ -1,58 +0,0 @@
|
||||
{
|
||||
description = "Flake for bob-nvim, a Neovim version manager.";
|
||||
|
||||
inputs = {
|
||||
nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
|
||||
bob = {
|
||||
flake = false;
|
||||
url = "github:MordechaiHadad/bob";
|
||||
};
|
||||
flake-utils.url = "github:numtide/flake-utils";
|
||||
};
|
||||
|
||||
outputs =
|
||||
{
|
||||
self,
|
||||
nixpkgs,
|
||||
flake-utils,
|
||||
bob,
|
||||
}:
|
||||
flake-utils.lib.eachDefaultSystem (
|
||||
system:
|
||||
let
|
||||
pkgs = nixpkgs.legacyPackages.${system};
|
||||
rust-toolchain = pkgs.symlinkJoin {
|
||||
name = "rust-toolchain";
|
||||
paths = with pkgs; [
|
||||
rustc
|
||||
cargo
|
||||
cargo-watch
|
||||
rust-analyzer
|
||||
rustfmt
|
||||
];
|
||||
};
|
||||
in
|
||||
rec {
|
||||
# This builds the blog binary then runs it and collects the output. Once done it throws away the binary and
|
||||
# shoves the newly created static site into the result.
|
||||
packages.default = pkgs.rustPlatform.buildRustPackage {
|
||||
name = "bob-nvim";
|
||||
pname = "bob";
|
||||
src = "${bob}";
|
||||
cargoLock.lockFile = "${bob}/Cargo.lock";
|
||||
};
|
||||
|
||||
# Rust dev environment
|
||||
devShells.default = pkgs.mkShell {
|
||||
shellHook = ''
|
||||
# For rust-analyzer 'hover' tooltips to work.
|
||||
export RUST_SRC_PATH=${pkgs.rustPlatform.rustLibSrc}
|
||||
'';
|
||||
nativeBuildInputs = [ rust-toolchain ];
|
||||
};
|
||||
}
|
||||
)
|
||||
// {
|
||||
overlays.default = final: prev: { bob-nvim = self.packages.${final.system}.default; };
|
||||
};
|
||||
}
|
||||
23
pkgs/default.nix
Normal file
23
pkgs/default.nix
Normal file
@ -0,0 +1,23 @@
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
bob-nvim = pkgs.callPackage ./bob-nvim.nix {
|
||||
rustPlatform = pkgs.rustPlatform;
|
||||
fetchFromGitHub = pkgs.fetchFromGitHub;
|
||||
};
|
||||
Fmt = pkgs.writeShellApplication {
|
||||
name = "Fmt";
|
||||
runtimeInputs = with pkgs; [
|
||||
stylua
|
||||
gnugrep
|
||||
nixfmt-rfc-style
|
||||
nodePackages.prettier
|
||||
shfmt
|
||||
];
|
||||
text = (
|
||||
''
|
||||
#!${pkgs.bash}/bin/bash
|
||||
''
|
||||
+ builtins.readFile ./fmt.bash
|
||||
);
|
||||
};
|
||||
}
|
||||
@ -1,3 +1,4 @@
|
||||
#!/usr/bin/env bash
|
||||
# vim: ft=sh
|
||||
|
||||
set -euo pipefail
|
||||
@ -1,78 +0,0 @@
|
||||
{
|
||||
"nodes": {
|
||||
"flake-utils": {
|
||||
"inputs": {
|
||||
"systems": "systems"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1705309234,
|
||||
"narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"kanagawa-gtk": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1688426096,
|
||||
"narHash": "sha256-BZRmjVas8q6zsYbXFk4bCk5Ec/3liy9PQ8fqFGHAXe0=",
|
||||
"owner": "Fausto-Korpsvart",
|
||||
"repo": "Kanagawa-GKT-Theme",
|
||||
"rev": "35936a1e3bbd329339991b29725fc1f67f192c1e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "Fausto-Korpsvart",
|
||||
"repo": "Kanagawa-GKT-Theme",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1708151420,
|
||||
"narHash": "sha256-MGT/4aGCWQPQiu6COqJdCj9kSpLPiShgbwpbC38YXC8=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "6e2f00c83911461438301db0dba5281197fe4b3a",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nixos",
|
||||
"ref": "nixpkgs-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"flake-utils": "flake-utils",
|
||||
"kanagawa-gtk": "kanagawa-gtk",
|
||||
"nixpkgs": "nixpkgs"
|
||||
}
|
||||
},
|
||||
"systems": {
|
||||
"locked": {
|
||||
"lastModified": 1681028828,
|
||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
}
|
||||
},
|
||||
"root": "root",
|
||||
"version": 7
|
||||
}
|
||||
@ -1,95 +0,0 @@
|
||||
{
|
||||
description = "Flake for the Kanagwa GTK Theme";
|
||||
|
||||
inputs = {
|
||||
nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
|
||||
kanagawa-gtk = {
|
||||
flake = false;
|
||||
url = "github:Fausto-Korpsvart/Kanagawa-GKT-Theme";
|
||||
};
|
||||
flake-utils.url = "github:numtide/flake-utils";
|
||||
};
|
||||
|
||||
outputs =
|
||||
{
|
||||
self,
|
||||
nixpkgs,
|
||||
flake-utils,
|
||||
kanagawa-gtk,
|
||||
}:
|
||||
flake-utils.lib.eachDefaultSystem (
|
||||
system:
|
||||
let
|
||||
pkgs = nixpkgs.legacyPackages.${system};
|
||||
lib = nixpkgs.lib;
|
||||
in
|
||||
rec {
|
||||
# This builds the blog binary then runs it and collects the output. Once done it throws away the binary and
|
||||
# shoves the newly created static site into the result.
|
||||
packages.kanagawa-gtk-theme = pkgs.stdenvNoCC.mkDerivation rec {
|
||||
pname = "kanagawa-gtk-theme";
|
||||
version = "unknown";
|
||||
|
||||
src = "${kanagawa-gtk}";
|
||||
|
||||
propagatedUserEnvPkgs = with pkgs; [ gtk-engine-murrine ];
|
||||
|
||||
nativeBuildInputs = with pkgs; [ gtk3 ];
|
||||
|
||||
installPhase = ''
|
||||
runHook preInstall
|
||||
mkdir -p $out/share/themes
|
||||
cp -a themes/* $out/share/themes
|
||||
runHook postInstall
|
||||
'';
|
||||
meta = with lib; {
|
||||
description = "A GTK theme with the Kanagawa colour palette. Borrowed with ❤️ from https://github.com/NixOS/nixpkgs/pull/277073.";
|
||||
homepage = "https://github.com/Fausto-Korpsvart/Kanagawa-GKT-Theme";
|
||||
license = licenses.gpl3Only;
|
||||
platforms = platforms.all;
|
||||
};
|
||||
};
|
||||
packages.default = packages.kanagawa-gtk-theme;
|
||||
|
||||
packages.kanagwa-icon-theme = pkgs.stdenvNoCC.mkDerivation rec {
|
||||
pname = "kanagawa-icon-theme";
|
||||
version = "unknown";
|
||||
|
||||
src = "${kanagawa-gtk}";
|
||||
|
||||
nativeBuildInputs = with pkgs; [ gtk3 ];
|
||||
|
||||
propagatedBuildInputs = with pkgs; [ hicolor-icon-theme ];
|
||||
|
||||
dontDropIconThemeCache = true;
|
||||
|
||||
installPhase = ''
|
||||
runHook preInstall
|
||||
|
||||
mkdir -p $out/share/icons
|
||||
cp -a icons/* $out/share/icons
|
||||
for theme in $out/share/icons/*; do
|
||||
gtk-update-icon-cache -f $theme
|
||||
done
|
||||
|
||||
runHook postInstall
|
||||
'';
|
||||
|
||||
meta = with lib; {
|
||||
description = "An icon theme for the Kanagawa colour palette. Borrowed with ❤️ from https://github.com/NixOS/nixpkgs/pull/277073.";
|
||||
homepage = "https://github.com/Fausto-Korpsvart/Kanagawa-GKT-Theme";
|
||||
license = licenses.gpl3Only;
|
||||
platforms = platforms.all;
|
||||
};
|
||||
};
|
||||
|
||||
# Rust dev environment
|
||||
}
|
||||
)
|
||||
// {
|
||||
overlays.default = final: prev: {
|
||||
kanagawa-gtk-theme = self.packages.${final.system}.kanagawa-gtk-theme;
|
||||
kanagawa-gtk-icon-theme = self.packages.${final.system}.kanagwa-icon-theme;
|
||||
};
|
||||
};
|
||||
}
|
||||
112
scripts/install-host.bash
Executable file
112
scripts/install-host.bash
Executable file
@ -0,0 +1,112 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -Eeuo pipefail
|
||||
|
||||
BASE_DIR="$PWD"
|
||||
|
||||
gen-system-key() {
|
||||
local system="${1:?"No system provided to generate a key for!"}"
|
||||
local priv_key_path="${2:?"No private key path provided!"}"
|
||||
local key_file="out-key"
|
||||
local priv_key
|
||||
local pub_key
|
||||
|
||||
# Gen Key in a temp directory
|
||||
pushd "$(mktemp -d)" >/dev/null
|
||||
ssh-keygen -t ed25519 -f ./"${key_file}" -N '' -C "${system}" -q
|
||||
priv_key="$(cat "${key_file}")"
|
||||
pub_key="$(cat "${key_file}.pub")"
|
||||
rm -f "${key_file}" "${key_file}.pub" >/dev/null
|
||||
popd >/dev/null
|
||||
|
||||
# Update public key for system and rekey secrets
|
||||
printf "Rekeying for '%s' secrets with new system key!\n" "${system}" 1>&2
|
||||
local host_pubkey_path="${BASE_DIR}/hosts/${system}/pubkey.nix"
|
||||
if [[ -r "${host_pubkey_path}" ]]; then
|
||||
local backup_pub_key_path
|
||||
backup_pub_key_path="${host_pubkey_path}.$(date +'%Y-%d-%m_%H:%M:%S')"
|
||||
printf "Backing up old public key file to '%s'!\n" "${backup_pub_key_path}" 1>&2
|
||||
mv "${host_pubkey_path}" "${backup_pub_key_path}"
|
||||
fi
|
||||
printf '"%s"' "${pub_key}" >"${host_pubkey_path}"
|
||||
git add "${host_pubkey_path}" 1>&2
|
||||
|
||||
pushd secrets >/dev/null
|
||||
agenix -r -i "${priv_key_path}" 1>&2
|
||||
git add . 1>&2
|
||||
popd >/dev/null
|
||||
|
||||
printf "%s" "${priv_key}"
|
||||
}
|
||||
|
||||
main() {
|
||||
local persist_dir="/mnt/persist"
|
||||
local flake_install_path="${persist_dir}/ephemeral/etc/nixos"
|
||||
|
||||
local system="${1:?"Provide system to build!"}"
|
||||
local flake=".#${system}"
|
||||
local conn="${2:?"Provide ssh connection string! (E.g. root@myhost)"}"
|
||||
local priv_key_path="${3:?Provide path to private key}"
|
||||
local ssh_port="${4:-22}"
|
||||
|
||||
if [[ ! -r "${priv_key_path}" ]]; then
|
||||
printf "Unable a private key file at '%s'\n!" "${priv_key_path}" 1>&2
|
||||
exit 1
|
||||
elif [[ ! -r "${BASE_DIR}/hosts/${system}" ]]; then
|
||||
printf "Could not find a system named '%s' in '%s'!\n" "${system}" "${BASE_DIR}/hosts" 1>&2
|
||||
exit 1
|
||||
fi
|
||||
cat <<-__EOS__
|
||||
─────────────────────────────────
|
||||
Installing NixOS on Remote Host
|
||||
=================================
|
||||
Host: "${conn}"
|
||||
Flake: "${flake}"
|
||||
─────────────────────────────────
|
||||
__EOS__
|
||||
printf "Generating system keys\n"
|
||||
local new_sys_key
|
||||
new_sys_key="$(gen-system-key "${system}" "${priv_key_path}")"
|
||||
printf "Finished generating system keys\n"
|
||||
local nixos_anywhere_log
|
||||
nixos_anywhere_log="$(nix run github:nix-community/nixos-anywhere -- --flake "${flake}" "${conn}" --stop-after-disko -p "${ssh_port}" 2>&1 | tee >(cat >&2))"
|
||||
local ssh_login_key="${nixos_anywhere_log##*$'\n'}"
|
||||
ssh_login_key="${ssh_login_key#*\'}"
|
||||
ssh_login_key="${ssh_login_key%\'*}"
|
||||
local ssh_opts="-i ${ssh_login_key} -o GlobalKnownHostsFile=/dev/null -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -p ${ssh_port} -l root"
|
||||
local ssh_cmd="ssh ${conn} ${ssh_opts}"
|
||||
local system_key_dest="${persist_dir}/ephemeral/etc/ssh/ssh_host_ed25519_key"
|
||||
printf "SSH Command: %s\n" "${ssh_cmd}"
|
||||
eval "${ssh_cmd}" <<-__EOS__
|
||||
mkdir -p "${persist_dir}/ephemeral/etc/ssh"
|
||||
mkdir -p "${persist_dir}/save"
|
||||
mkdir -p "${flake_install_path}"
|
||||
printf "Putting new system key into place\n"
|
||||
printf "%s\n" "${new_sys_key}" > "${system_key_dest}"
|
||||
chmod 0600 "${system_key_dest}"
|
||||
printf "Installing rsync for later stage\n"
|
||||
nix-env -f '<nixpkgs>' -iA rsync
|
||||
__EOS__
|
||||
printf "Copying flake to system\n"
|
||||
local rsync_cmd="rsync -r '${BASE_DIR}'/ '${conn}:${flake_install_path}' -e 'ssh ${ssh_opts}' --info=PROGRESS2"
|
||||
printf "Issuing rsync command: '%s\n'" "${rsync_cmd}"
|
||||
eval "${rsync_cmd}"
|
||||
printf "Doing final install\n"
|
||||
eval "${ssh_cmd}" <<-__EOS__
|
||||
set -euo pipefail
|
||||
cd "${flake_install_path}"
|
||||
nix-env -f '<nixpkgs>' -iA git
|
||||
sudo nixos-install --flake "git+file:${flake}" --no-root-password --no-channel-copy && reboot
|
||||
__EOS__
|
||||
|
||||
cat <<-__EOS__
|
||||
──────────────────────────────────────────
|
||||
Finished Installing NixOS on Remote Host
|
||||
==========================================
|
||||
Host: "${conn}"
|
||||
Flake: "${flake}"
|
||||
──────────────────────────────────────────
|
||||
__EOS__
|
||||
}
|
||||
|
||||
main "${@}"
|
||||
@ -1,30 +1,60 @@
|
||||
{
|
||||
agenix ? true,
|
||||
agenix ? false,
|
||||
lib ? import ../lib { },
|
||||
}:
|
||||
let
|
||||
keys = [
|
||||
masterKeys = [
|
||||
"age1yubikey1qfnj0k4mkzrn8ef5llwh2sv6hd7ckr0qml3n9hzdpz9c59ypvryhyst87k0"
|
||||
"age1ur2lr3z6d2eftgxcalc6s5x9840ew9x43upl9k23wg0ugacrn5as4zl6sj"
|
||||
];
|
||||
secrets =
|
||||
hosts = {
|
||||
luna =
|
||||
let
|
||||
dir = "files";
|
||||
secrets = "hosts/luna";
|
||||
in
|
||||
{ };
|
||||
{
|
||||
users-root-pw = "${secrets}/users-root-pw.age";
|
||||
users-price-pw = "${secrets}/users-price-pw.age";
|
||||
gitea-db-pass = "${secrets}/gitea-db-pass.age";
|
||||
gitea-runner-token = "${secrets}/gitea-runner-token.age";
|
||||
};
|
||||
orion =
|
||||
let
|
||||
secrets = "hosts/orion";
|
||||
in
|
||||
{
|
||||
users-root-pw = "${secrets}/users-root-pw.age";
|
||||
users-price-pw = "${secrets}/users-price-pw.age";
|
||||
};
|
||||
};
|
||||
in
|
||||
if agenix then
|
||||
(builtins.listToAttrs (
|
||||
builtins.concatMap (secretName: [
|
||||
builtins.concatMap (
|
||||
host:
|
||||
let
|
||||
hostSecrets = (builtins.getAttr host hosts);
|
||||
in
|
||||
(builtins.map (
|
||||
hostSecretName:
|
||||
let
|
||||
secret = (builtins.getAttr hostSecretName hostSecrets);
|
||||
in
|
||||
{
|
||||
name = builtins.toString secretName;
|
||||
value.publicKeys = keys;
|
||||
name = builtins.toString secret;
|
||||
value = {
|
||||
publicKeys = [ (import ./../hosts/${host}/pubkey.nix) ] ++ masterKeys;
|
||||
};
|
||||
}
|
||||
]) (builtins.attrNames secrets)
|
||||
) (builtins.attrNames hostSecrets))
|
||||
) (builtins.attrNames hosts)
|
||||
))
|
||||
else
|
||||
(builtins.mapAttrs (
|
||||
host: secrets:
|
||||
(lib.recursiveMerge (
|
||||
builtins.map (secretName: { age.secrets.${secretName}.file = ./${secrets.${secretName}}; }) (
|
||||
builtins.attrNames secrets
|
||||
builtins.attrNames hosts.${host}
|
||||
)
|
||||
))
|
||||
) hosts)
|
||||
|
||||
16
secrets/hosts/luna/gitea-db-pass.age
Normal file
16
secrets/hosts/luna/gitea-db-pass.age
Normal file
@ -0,0 +1,16 @@
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFdvUU04QSBNYlI4
|
||||
SUFhY21vTTdES005Z2pRSHVPUlNaNU94bm5LMEcvL1pwbWQvYlRnCit5MEVsRTMz
|
||||
K0RYc20wbGlzaXV4aDZGODRDdWFxNklwM3NjUFdHUU1zWVEKLT4gWDI1NTE5IDVC
|
||||
aUJrWCtpdzZObE5ETlNobFVoNVUrdmo2dDBodVdpdVhLcjVCaXBkbk0KKy9HblBo
|
||||
alh5ak5YNVEwb0ZsQk9kWGRhb1JkRkhjRkhJWUtnOFVEQ0piVQotPiBwaXYtcDI1
|
||||
NiBySnMxSEEgQXVHc3prNk42UmhwMW9PSTBtMk1jR2hVSXpxVkVyWFFQb29YYWZT
|
||||
bUw4czkKOWhTRmFOUTBtVW5qbXB2Tk93QkJ6UnFacExkMkU0NzVONUlzbzRZOGxE
|
||||
TQotPiBibXQtZ3JlYXNlIG0gVzBBZSBJQjsiUnAxfSAvQV84CjR3U2VaT1B1Tkxw
|
||||
dFdSRzlPeURpZXY2QlUyNHJJMjE3Y3F2VUNWcVB4UQotLS0gc1h6WitwUkpsM0dL
|
||||
T3B4Z3FNV09OVUZ1SGZQQUN2OHE3cmZuZEJleitTawov2e+ve9ZQV89nggvRV/yu
|
||||
Kw0pNzog065lk3mVwNONqlfa3gGd1w78J06lndiZ6oF1/0VZHyRwXf+Rs8cMezzb
|
||||
ITXuBHZ6GXZ0Nii/dhK0nN8sfHtCR3zpUcxBn8nkl5tNhW6MzLSK1yfIOQZMHatO
|
||||
GM1f7BKFdLCLb+6VW6tDnqP+8uOFGLNbTcGepxiEAW6wnixnXHjRC+M9otGIUmfe
|
||||
XdlANT4syDJhuqv5k/PmB10hgWBGByBlOtG3TiMmBgyZQbOVLAdZx0pNI7jg
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
14
secrets/hosts/luna/gitea-runner-token.age
Normal file
14
secrets/hosts/luna/gitea-runner-token.age
Normal file
@ -0,0 +1,14 @@
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFdvUU04QSA0bys5
|
||||
cmx2R3Iva1ZxekhtcEtIdUdvRGpoRlN2V0ZWNnR1VmlXelAvZlRvCmUvMnZGNWlO
|
||||
a0t4cnBBTUYxQ0EzVGRCYnh1K0YxV1IrdmU2d2hid29LN0EKLT4gWDI1NTE5IGYy
|
||||
ZG4ranlyRExMeGJTZHFEVFh6N1g1a2ZncUZudzBIVDZ0a3BsMHk0a1kKdFNFa0Fl
|
||||
ZTBJSE81UDJIbHRDeWFHQTRSVnRIczRKdjRxQkF2dGFwNi9EbwotPiBwaXYtcDI1
|
||||
NiBySnMxSEEgQStqWFJHZ0RULzRCWFN6aXF2bHAwODNlV29MTm5kTzlRbG5jdlVW
|
||||
d08vdEUKbUQ4SXdtUGNLU0VtT1hSZXlEUnc0QW81Vm56VXBuYklOTWJBSmR3UDJG
|
||||
OAotPiBNLWdyZWFzZSB9RSolSG9DCkt4Z0VzSk5GK3hHelZZQkx6M2g1NnJWcnVG
|
||||
Z3hyZTJNb0lNK0UvZnY0TWFiCi0tLSBGdVIyZ0MybUtZQTFKcVJoUjR2ZG1HYmRi
|
||||
NnZrdWFsdU1Gb3pLYVovODFFCjNwKkWh0MitzqcFXkocWHeE8tf9ZowVVk9sQ+TJ
|
||||
RrbvTpTKP5KATDmG4+C2cn01WN0JorD9gGZk3ygV9sVm42hucvLa3AUMYelvcZHH
|
||||
fxk=
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
15
secrets/hosts/luna/users-price-pw.age
Normal file
15
secrets/hosts/luna/users-price-pw.age
Normal file
@ -0,0 +1,15 @@
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFdvUU04QSBwTzBk
|
||||
ZWQrYklGYmVSK2diM1d0ZWkwNGZ0a2VTTC84SEFjajlreHRnOWdFCm80ckxBQlIr
|
||||
M1UyNTBoUFBINzdEdzVBandQcEdDY3ZvbVpsejFRSTdyY0kKLT4gWDI1NTE5IGNH
|
||||
RU44b3BpaGUzd2V5RFlOZlIyY0o5Z2NFYnAyWTU0NVg0K3lUYUxrR0UKcEVoMTVu
|
||||
QVk1Z25LZlNqTW1EUTUySXdhdGU2Zm5yckhCa2Y4VkJEcHFCRQotPiBwaXYtcDI1
|
||||
NiBySnMxSEEgQWpnRVdYVTZOOElHYTYxOTJ3YnA5eWc3WHowS05NWUo3K0RUNVN3
|
||||
ZHdTTDEKU21UZE5rK3lqbTZ1TGpFWUc0STZxRExtSDVERC9kYjBnbkFmb0o4RzRY
|
||||
QQotPiBGLWdyZWFzZSA/QSRvM1cgPlolCnhuQy81UnF5azEwUW9aTXhqUG8ydzYr
|
||||
eDlPU293YkVKbkhVYnRMWXZQQ3VncWpYWUVtNlpxNjJCQVNVcgotLS0gbklXWlJK
|
||||
MW9XUnY0MU1WMXhjcStjSUphMGlDTVVUbEJ5dHNCbkRDbjlycwoPTmZO09gCTAlk
|
||||
QqFphkBQsaPus03eGrU7MFIjE8zpjKjkLfSQYilrgS5vv164RpWS/y8dMVqoFTsA
|
||||
HKqHcjUkuDUnSgHTk4ZLtISi4y6zq3iDvVABM8K+zVJr9KvJuwCOzOoAxKfn/dSL
|
||||
lvJ7k8CivrnviKc9FYn/Kf4gCtNLBhsQ0X2DOHfusFNG
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
14
secrets/hosts/luna/users-root-pw.age
Normal file
14
secrets/hosts/luna/users-root-pw.age
Normal file
@ -0,0 +1,14 @@
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFdvUU04QSBRUDUw
|
||||
eWRxZ0xQVWc3UXB1dFFiTWhsM29lSkVSUW5QazNPRXhXeEI0SHc4ClFCREpHYTdz
|
||||
RmRZdklUNnVmNHBNalVUdzkxTTc5L1pXK3QzdlQxZVhvMkEKLT4gWDI1NTE5IFBY
|
||||
Z1FvNDdMOHZvYmJUZmlEbUwwbUFxVEc4c2pUa3F4VlZkQW8yQ3ZveVkKY0h0bThW
|
||||
cEs1ZXFjaGZSbTFQZHVySEJ2b3A4bXRKWkI4b01GZ0g4aHdJcwotPiBwaXYtcDI1
|
||||
NiBySnMxSEEgQXp5dnpxWGp0SzVhVWpSYzZXWVU5NmZkcy9FN0R6ajJiWEdzK21p
|
||||
V3A3WEIKYlBaVkw0WTQvWldrWlFUVkVlQVU2UFNKSW9VWlhTMFNuNnFicTA4L2U5
|
||||
bwotPiAhcS1ncmVhc2UgOypuJlwoc18gWl46ZSx0CnoyQ0x2dnVYcXpzRC9DZzNj
|
||||
QQotLS0gT2RBL3ZlN1RYK3d4ZzUrZHI1TzJubllxbUFPbFUzbkI3ZlFldXFoVHly
|
||||
ZwruN+Wtj/2dKzzE3qmapuWPJXpYw/fCdhoRu+Yv1uoqqwGTBAH7usQnO3DffOHo
|
||||
2alpmoDkqlGjrLuJ+frvyWAh6xyggmN7zsD0cadR1a8BoxrBTktY0OFj/+u6MJDD
|
||||
kpkYDB/umaol7aJM6x6f9x+twgdzVxYlsSgdrA+UR19GrX6BniR/fWC0SXZ0
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
15
secrets/hosts/orion/users-price-pw.age
Normal file
15
secrets/hosts/orion/users-price-pw.age
Normal file
@ -0,0 +1,15 @@
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGxkdEhLZyBIWE1n
|
||||
T0ZJaS8xb3JxUGE5VUdxaU9CT2paV1U5U0tCZWFUV0Z3WkdVbTNzCjZuN0lKeEh3
|
||||
UE5WVjVnSk9JYlJra1NDQU1ocWdnMVFoRmUzc0xkQlZ1R0UKLT4gWDI1NTE5IENt
|
||||
NnpHN29KeklSWGpwaDRWNGg3MDh5SyszRXlUU0pnM1dQRGZBejdNMkUKdXdnSndV
|
||||
VzBJbFQvV1JLVGt4TU0wR1ZuL0twcmFDV0NSL29JRGU5bWhoWQotPiBwaXYtcDI1
|
||||
NiBySnMxSEEgQXc2RWNaOHFXcDJ6UlpyZWk3Y3g2RDJvQkNKQ3FmQyt0dXoyWHZa
|
||||
WTZvSTcKTmpmOEliRkV0NU92K2NTV3dBV0NwTEVTVi9vTTRYVVJVTUxUL0xBWkNB
|
||||
MAotPiAiLGp4LWdyZWFzZSAhKTdzbi9XClY4aTVYUGYyOE9acGJyVGliL2krUEg0
|
||||
OFdUMHUKLS0tIEUwOU1YclcwNnBSUTFaalo4Wm9YaEFaOXZDa29YZjRZdTF2cmRi
|
||||
VVQzZ0UKGip/2vrDDEHl0kh81TMmQXSCYi+gcyPk+CimiUgPuMvUsVWBfhEhVQSm
|
||||
8k5SohQRurOcyTyKt66qO9sNLQf8i4n5uTe7j3mdP9xBMQSmQkFujtIDzO2ZA8kc
|
||||
5J7DYDHyG4LwnC9Epyd8eBmE1Hhpqug+RqMG3C7NApxYJ626gB2t4WyZUEQuIYAT
|
||||
Ew==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
17
secrets/hosts/orion/users-root-pw.age
Normal file
17
secrets/hosts/orion/users-root-pw.age
Normal file
@ -0,0 +1,17 @@
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGxkdEhLZyB5cUQ5
|
||||
MGdqVmpnKzFjak9iVk1BVWN6U0oyT3c5MUJ5cFdabnNEalovMmpvCkFVYVpwbXJi
|
||||
dlhHdUtzZ1Y5U2pqVVlDbGhxcmtoUmN5dGNxNStwMkllTFUKLT4gWDI1NTE5IEty
|
||||
OVVhTE1KRFgzWXl1T3NCR2FBK0w0YTJIcC91TUhJaXgyaTRBQ1hneTgKZWNNdDJp
|
||||
STNEWkJxdUhsSk1SMXFSc0ZyNXJEenJ0b0VqZExsbUs2VUdkbwotPiBwaXYtcDI1
|
||||
NiBySnMxSEEgQW5LZCtmRFEvYUkrZHp0MVJJc0tjbW1GalNYYkttUXVPR0xDTWRn
|
||||
dEtFSkcKaGYyZElrUzNyYWpqYUhTSERiZGVadlp1UU1RSnkrODFJTzFKVFRIeUdI
|
||||
VQotPiAhM1Y+Xy1ncmVhc2UgbGY3UEt+RiAqcDxfYTBdIGJ7CnVyOVRDcytTb0h4
|
||||
d2pDYlpBSEpIZDA2NDdsOExGMGdDeXYzWXJCYUdUaGFBZHNmN1BpdmZJMEVIZWNV
|
||||
c3lkWjQKTDhDSWo0NFVuQzVhZk1EUHhocHdhN1JZTkVpZUdSTUwxUzBjSFIrVnpr
|
||||
SDAwTnpBSHNibUZhajVqVzQKLS0tIDVDY0FnRnJUc3hwbDgyYzJZazRmQ0pyVmV6
|
||||
dU45S2lDdStQc05kUXdoSDQKdNPcHQuexwFFJwGBkand8jVXS/8gbhycSEysX+Sj
|
||||
s5BKORCExjyRkO8AkI//LZ/96ReoIYuHmUaIRIC6qtJCAvK89SsDm8iPbzyTigfL
|
||||
OjHzW3UCX69spnohxKFgfYNmypFSwl/L9fQ9RVVj2HFXRwctMFdfYAke/CVIUzz+
|
||||
EAI9BuTRh+Wy9fwlcQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
@ -101,11 +101,11 @@ bind = SUPER,j,movefocus,d
|
||||
bind = SUPERSHIFT,left,exec,~/.config/hypr/scripts/focus-workspace-mon.bash $(( $(hyprctl monitors -j | jq -c '.[] | select(.focused) | .activeWorkspace.id') - 1 ))
|
||||
bind = SUPERSHIFT,right,exec,~/.config/hypr/scripts/focus-workspace-mon.bash $(( $(hyprctl monitors -j | jq -c '.[] | select(.focused) | .activeWorkspace.id') + 1 ))
|
||||
|
||||
bind = SUPERCTRL,left,exec,~/.config/hypr/scripts/move-workspace-mon.bash $(( $(hyprctl monitors -j | jq -c '.[] | select(.focused) | .activeWorkspace.id') - 1 ))
|
||||
bind = SUPERCTRL,right,exec,~/.config/hypr/scripts/move-workspace-mon.bash $(( $(hyprctl monitors -j | jq -c '.[] | select(.focused) | .activeWorkspace.id') + 1 ))
|
||||
bind = SUPERCTRL,left,exec,~/.config/hypr/scripts/move-workspace-mon.bash $(( $(hyprctl monitors -j | jq -c '.[] | select(.focused) | .activeWorkspace.id') - 1 )) 1
|
||||
bind = SUPERCTRL,right,exec,~/.config/hypr/scripts/move-workspace-mon.bash $(( $(hyprctl monitors -j | jq -c '.[] | select(.focused) | .activeWorkspace.id') + 1 )) 1
|
||||
|
||||
bind = SUPERSHIFTCTRL,left,exec,~/.config/hypr/scripts/move-workspace-mon.bash $(( $(hyprctl monitors -j | jq -c '.[] | select(.focused) | .activeWorkspace.id') - 1 )) 1
|
||||
bind = SUPERSHIFTCTRL,right,exec,~/.config/hypr/scripts/move-workspace-mon.bash $(( $(hyprctl monitors -j | jq -c '.[] | select(.focused) | .activeWorkspace.id') + 1 )) 1
|
||||
bind = SUPERSHIFTCTRL,left,exec,~/.config/hypr/scripts/move-workspace-mon.bash $(( $(hyprctl monitors -j | jq -c '.[] | select(.focused) | .activeWorkspace.id') - 1 ))
|
||||
bind = SUPERSHIFTCTRL,right,exec,~/.config/hypr/scripts/move-workspace-mon.bash $(( $(hyprctl monitors -j | jq -c '.[] | select(.focused) | .activeWorkspace.id') + 1 ))
|
||||
|
||||
bind = SUPER,1,exec,~/.config/hypr/scripts/focus-workspace-mon.bash 1
|
||||
bind = SUPER,2,exec,~/.config/hypr/scripts/focus-workspace-mon.bash 2
|
||||
@ -1,7 +1,6 @@
|
||||
$configDir = ~/.config/hypr/conf
|
||||
|
||||
# --- Core Config ---
|
||||
source = $configDir/core/env.conf
|
||||
source = $configDir/core/general.conf
|
||||
source = $configDir/core/bindings.conf
|
||||
source = $configDir/core/appearance.conf
|
||||
@ -6,7 +6,7 @@ exec = systemd-run --user --unit=slimbookbattery slimbookbattery --minimize || s
|
||||
exec = systemd-run --user --unit=clight-gui clight-gui --tray || systemctl --user restart clight-gui
|
||||
exec = systemd-run --user --unit=events-monitor ~/.config/hypr/scripts/launchers/events-monitor.bash || systemctl --user restart events-monitor
|
||||
exec = systemd-run --user --unit=xwaylandvideobridge xwaylandvideobridge || systemctl --user restart xwaylandvideobridge
|
||||
exec = systemd-run --user --unit=polkit-agent /usr/lib/polkit-kde-authentication-agent-1 || systemctl --user restart polkit-agent
|
||||
exec = systemd-run --user --unit=polkit-agent /usr/lib/polkit-gnome/polkit-gnome-authentication-agent-1 || systemctl --user restart polkit-agent
|
||||
exec-once = systemctl --user import-environment WAYLAND_DISPLAY XDG_CURRENT_DESKTOP PATH
|
||||
exec = sleep 1 && systemctl --user restart compositor.target
|
||||
exec-once = swaylock
|
||||
74
users/price/dots/.config/hypr/scripts/#screen-cap.bash#
Executable file
74
users/price/dots/.config/hypr/scripts/#screen-cap.bash#
Executable file
@ -0,0 +1,74 @@
|
||||
#!/usr/bin/env -S nix shell github:nix-community/nixgl#nixGLIntel nixpkgs#bash nixpkgs#wl-screenrec nixpkgs#gifski nixpkgs#inotify-tools nixpkgs#libnotify nixpkgs#mktemp nixpkgs#slurp nixpkgs#slurp --command bash
|
||||
|
||||
# Dependencies:
|
||||
# - wl-screenrec: https://github.com/russelltg/wl-screenrec
|
||||
# - notification daemon: https://archlinux.org/packages/?name=notification-daemon
|
||||
# - wl-clipboard: https://github.com/bugaevc/wl-clipboard
|
||||
# - gifski: https://github.com/sindresorhus/Gifski
|
||||
#
|
||||
# Gifski is necessary because `wl-screenrec` doesn't support gifs
|
||||
|
||||
# set -euoE pipefail
|
||||
|
||||
mk-screen-cap() {
|
||||
local program_name="Screen Capture"
|
||||
local pid_file="/tmp/mk-gif-pid"
|
||||
local output_type="${1:-webm}"
|
||||
|
||||
if [[ -f "$pid_file" ]]; then
|
||||
printf "Ending screen capture\n"
|
||||
notify-send "Saving ${program_name}" "This May Take a Minute" -a "$program_name"
|
||||
if ! kill -SIGINT "$(cat "$pid_file")"; then
|
||||
notify-send "Failed ${program_name}" "Failed to Save Screen Capture" -u "critical" -a "$program_name"
|
||||
printf "Failed to save screen capture!\n"
|
||||
rm -rf "$pid_file"
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
printf -- "Beginning recording\n"
|
||||
local tmp_file
|
||||
notify-send "Starting ${program_name}" "Recording ${output_type^^} of Selected Region" -a "$program_name"
|
||||
local tmp_diruullllllllllllllllllllllllllllllllllllllllllhhhhhjkklh
|
||||
tmp_dir="$(mktemp -d)"
|
||||
local file_extension="$output_type"
|
||||
if [[ "$output_type" == "gif" ]]; then
|
||||
file_extension="webm"
|
||||
fi
|
||||
local tmp_file
|
||||
tmp_file="$(mktemp --tmpdir="$tmp_dir" recording.XXXXXXXXXXX).${file_extension}"
|
||||
printf "Working temp file: '%s'\n" "$tmp_file"
|
||||
|
||||
local geometry
|
||||
geometry="$(slurp)"
|
||||
nixGLIntel wl-screenrec --filename "$tmp_file" --geometry "$geometry" &
|
||||
local pid="${!}"
|
||||
printf "%s" "$pid" >"$pid_file"
|
||||
printf "Putting pid: '%d' into pid file: '%s'\n" "$pid" "$pid_file"
|
||||
wait -n "$pid"
|
||||
|
||||
if [[ "$output_type" == "gif" ]]; then
|
||||
printf "Converting recording to gif...\n"
|
||||
local gifski_tmpout
|
||||
gifski_tmpout="${tmp_dir}/$(mktemp --"$tmp_dir" gifski.XXXXXXXXXXX).gif"
|
||||
gifski --output "$gifski_tmpout" "$tmp_file"
|
||||
mv "$gifski_tmpout" "$tmp_file"
|
||||
fi
|
||||
|
||||
local save_path
|
||||
save_path="${HOME}/Videos/Screen-Recordings"
|
||||
mkdir -p "$save_path"
|
||||
save_path="${save_path}/$(date --iso-8601="seconds").${output_type}"
|
||||
printf "Recording ended, saving to: '%s'\n" "$save_path"
|
||||
mv "$tmp_file" "$save_path"
|
||||
|
||||
printf "Copying recording to clipboard\n"
|
||||
local mimetype
|
||||
mimetype="$(file -b --mime-type "$save_path")"
|
||||
wl-copy --type="$mimetype" <"$save_path"
|
||||
rm -f "$pid_file"
|
||||
notify-send "Saved ${program_name}" "Successfully Saved Screen Capture to Clipboard" -a "$program_name"
|
||||
printf "Finished Recording, exiting...\n"
|
||||
fi
|
||||
}
|
||||
|
||||
mk-screen-cap "${@}"
|
||||
@ -10,7 +10,7 @@ main() {
|
||||
hyprctl dispatch movetoworkspacesilent "${workspace_id}"
|
||||
hyprctl dispatch movecurrentworkspacetomonitor "${focused_monitor}"
|
||||
|
||||
if (( should_change_focus == 1 )); then
|
||||
if ((should_change_focus == 1)); then
|
||||
hyprctl dispatch workspace "${workspace_id}"
|
||||
fi
|
||||
}
|
||||
74
users/price/dots/.config/hypr/scripts/screen-cap.bash
Executable file
74
users/price/dots/.config/hypr/scripts/screen-cap.bash
Executable file
@ -0,0 +1,74 @@
|
||||
#!/usr/bin/env -S nix shell github:nix-community/nixgl#nixGLIntel nixpkgs#bash nixpkgs#wl-screenrec nixpkgs#gifski nixpkgs#inotify-tools nixpkgs#libnotify nixpkgs#mktemp nixpkgs#slurp nixpkgs#slurp --command bash
|
||||
|
||||
# Dependencies:
|
||||
# - wl-screenrec: https://github.com/russelltg/wl-screenrec
|
||||
# - notification daemon: https://archlinux.org/packages/?name=notification-daemon
|
||||
# - wl-clipboard: https://github.com/bugaevc/wl-clipboard
|
||||
# - gifski: https://github.com/sindresorhus/Gifski
|
||||
#
|
||||
# Gifski is necessary because `wl-screenrec` doesn't support gifs
|
||||
|
||||
# set -euoE pipefail
|
||||
|
||||
mk-screen-cap() {
|
||||
local program_name="Screen Capture"
|
||||
local pid_file="/tmp/mk-gif-pid"
|
||||
local output_type="${1:-webm}"
|
||||
|
||||
if [[ -f "$pid_file" ]]; then
|
||||
printf "Ending screen capture\n"
|
||||
notify-send "Saving ${program_name}" "This May Take a Minute" -a "$program_name"
|
||||
if ! kill -SIGINT "$(cat "$pid_file")"; then
|
||||
notify-send "Failed ${program_name}" "Failed to Save Screen Capture" -u "critical" -a "$program_name"
|
||||
printf "Failed to save screen capture!\n"
|
||||
rm -rf "$pid_file"
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
printf -- "Beginning recording\n"
|
||||
local tmp_file
|
||||
notify-send "Starting ${program_name}" "Recording ${output_type^^} of Selected Region" -a "$program_name"
|
||||
local tmp_dir
|
||||
tmp_dir="$(mktemp -d)"
|
||||
local file_extension="$output_type"
|
||||
if [[ "$output_type" == "gif" ]]; then
|
||||
file_extension="webm"
|
||||
fi
|
||||
local tmp_file
|
||||
tmp_file="$(mktemp --tmpdir="$tmp_dir" recording.XXXXXXXXXXX).${file_extension}"
|
||||
printf "Working temp file: '%s'\n" "$tmp_file"
|
||||
|
||||
local geometry
|
||||
geometry="$(slurp)"
|
||||
nixGLIntel wl-screenrec --filename "$tmp_file" --geometry "$geometry" &
|
||||
local pid="${!}"
|
||||
printf "%s" "$pid" >"$pid_file"
|
||||
printf "Putting pid: '%d' into pid file: '%s'\n" "$pid" "$pid_file"
|
||||
wait -n "$pid"
|
||||
|
||||
if [[ "$output_type" == "gif" ]]; then
|
||||
printf "Converting recording to gif...\n"
|
||||
local gifski_tmpout
|
||||
gifski_tmpout="${tmp_dir}/$(mktemp --"$tmp_dir" gifski.XXXXXXXXXXX).gif"
|
||||
gifski --output "$gifski_tmpout" "$tmp_file"
|
||||
mv "$gifski_tmpout" "$tmp_file"
|
||||
fi
|
||||
|
||||
local save_path
|
||||
save_path="${HOME}/Videos/Screen-Recordings"
|
||||
mkdir -p "$save_path"
|
||||
save_path="${save_path}/$(date --iso-8601="seconds").${output_type}"
|
||||
printf "Recording ended, saving to: '%s'\n" "$save_path"
|
||||
mv "$tmp_file" "$save_path"
|
||||
|
||||
printf "Copying recording to clipboard\n"
|
||||
local mimetype
|
||||
mimetype="$(file -b --mime-type "$save_path")"
|
||||
wl-copy --type="$mimetype" <"$save_path"
|
||||
rm -f "$pid_file"
|
||||
notify-send "Saved ${program_name}" "Successfully Saved Screen Capture to Clipboard" -a "$program_name"
|
||||
printf "Finished Recording, exiting...\n"
|
||||
fi
|
||||
}
|
||||
|
||||
mk-screen-cap "${@}"
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue
Block a user