mirror of
https://github.com/Swarsel/.dotfiles.git
synced 2025-12-06 09:07:21 +01:00
refactor: finish initial move to modules-only [WIP]
This commit is contained in:
Leon Schwarzäugl
parent
e7e59715d8
commit
27679d38fd
GPG key ID:
26A54C31F2A4FD84
34 changed files with 1934 additions and 1617 deletions
|
|
@ -1,10 +1,13 @@
|
|||
{ config, ... }:
|
||||
{ lib, config, ... }:
|
||||
let
|
||||
inherit (config.swarselsystems) mainUser;
|
||||
in
|
||||
{
|
||||
services = {
|
||||
getty.autologinUser = mainUser;
|
||||
greetd.settings.initial_session.user = mainUser;
|
||||
options.swarselsystems.modules.optional.autologin = lib.mkEnableOption "optional autologin settings";
|
||||
config = lib.mkIf config.swarselsystems.modules.optional.autologin {
|
||||
services = {
|
||||
getty.autologinUser = mainUser;
|
||||
greetd.settings.initial_session.user = mainUser;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,36 +1,39 @@
|
|||
{ pkgs, lib, ... }:
|
||||
{ pkgs, lib, config, ... }:
|
||||
{
|
||||
specialisation = {
|
||||
gaming.configuration = {
|
||||
networking = {
|
||||
firewall.enable = lib.mkForce false;
|
||||
firewall = {
|
||||
allowedUDPPorts = [ 4380 27036 14242 34197 ]; # 34197: factorio; 4380 27036 14242: barotrauma;
|
||||
allowedTCPPorts = [ ]; # 34197: factorio; 4380 27036 14242: barotrauma; 51820: wireguard
|
||||
allowedTCPPortRanges = [
|
||||
{ from = 27015; to = 27030; } # barotrauma
|
||||
{ from = 27036; to = 27037; } # barotrauma
|
||||
];
|
||||
allowedUDPPortRanges = [
|
||||
{ from = 27000; to = 27031; } # barotrauma
|
||||
{ from = 58962; to = 58964; } # barotrauma
|
||||
options.swarselsystems.modules.optional.gaming = lib.mkEnableOption "optional gaming settings";
|
||||
config = lib.mkIf config.swarselsystems.modules.optional.gaming {
|
||||
specialisation = {
|
||||
gaming.configuration = {
|
||||
networking = {
|
||||
firewall.enable = lib.mkForce false;
|
||||
firewall = {
|
||||
allowedUDPPorts = [ 4380 27036 14242 34197 ]; # 34197: factorio; 4380 27036 14242: barotrauma;
|
||||
allowedTCPPorts = [ ]; # 34197: factorio; 4380 27036 14242: barotrauma; 51820: wireguard
|
||||
allowedTCPPortRanges = [
|
||||
{ from = 27015; to = 27030; } # barotrauma
|
||||
{ from = 27036; to = 27037; } # barotrauma
|
||||
];
|
||||
allowedUDPPortRanges = [
|
||||
{ from = 27000; to = 27031; } # barotrauma
|
||||
{ from = 58962; to = 58964; } # barotrauma
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
programs.steam = {
|
||||
enable = true;
|
||||
package = pkgs.steam;
|
||||
extraCompatPackages = [
|
||||
pkgs.proton-ge-bin
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
programs.steam = {
|
||||
enable = true;
|
||||
package = pkgs.steam;
|
||||
extraCompatPackages = [
|
||||
pkgs.proton-ge-bin
|
||||
hardware.xone.enable = true;
|
||||
|
||||
environment.systemPackages = [
|
||||
pkgs.linuxKernel.packages.linux_6_12.xone
|
||||
];
|
||||
};
|
||||
|
||||
hardware.xone.enable = true;
|
||||
|
||||
environment.systemPackages = [
|
||||
pkgs.linuxKernel.packages.linux_6_12.xone
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -1,10 +1,13 @@
|
|||
{ pkgs, ... }:
|
||||
{ lib, config, pkgs, ... }:
|
||||
{
|
||||
services.nswitch-rcm = {
|
||||
enable = true;
|
||||
package = pkgs.fetchurl {
|
||||
url = "https://github.com/Atmosphere-NX/Atmosphere/releases/download/1.3.2/fusee.bin";
|
||||
hash = "sha256-5AXzNsny45SPLIrvWJA9/JlOCal5l6Y++Cm+RtlJppI=";
|
||||
options.swarselsystems.modules.optional.nswitch-rcm = lib.mkEnableOption "optional nswitch-rcm settings";
|
||||
config = lib.mkIf config.swarselsystems.modules.optional.nswitch-rcm {
|
||||
services.nswitch-rcm = {
|
||||
enable = true;
|
||||
package = pkgs.fetchurl {
|
||||
url = "https://github.com/Atmosphere-NX/Atmosphere/releases/download/1.3.2/fusee.bin";
|
||||
hash = "sha256-5AXzNsny45SPLIrvWJA9/JlOCal5l6Y++Cm+RtlJppI=";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,20 +1,22 @@
|
|||
{ lib, pkgs, ... }:
|
||||
{ lib, config, pkgs, ... }:
|
||||
{
|
||||
|
||||
specialisation = {
|
||||
VBox.configuration = {
|
||||
virtualisation.virtualbox = {
|
||||
host = {
|
||||
enable = true;
|
||||
enableExtensionPack = true;
|
||||
};
|
||||
# leaving this here for future notice. setting guest.enable = true will make 'restarting sysinit-reactivation.target' take till timeout on nixos-rebuild switch
|
||||
guest = {
|
||||
enable = false;
|
||||
options.swarselsystems.modules.optional.virtualbox = lib.mkEnableOption "optional VBox settings";
|
||||
config = lib.mkIf config.swarselsystems.modules.optional.virtualbox {
|
||||
specialisation = {
|
||||
VBox.configuration = {
|
||||
virtualisation.virtualbox = {
|
||||
host = {
|
||||
enable = true;
|
||||
enableExtensionPack = true;
|
||||
};
|
||||
# leaving this here for future notice. setting guest.enable = true will make 'restarting sysinit-reactivation.target' take till timeout on nixos-rebuild switch
|
||||
guest = {
|
||||
enable = false;
|
||||
};
|
||||
};
|
||||
# run an older kernel to provide compatibility with windows vm
|
||||
boot.kernelPackages = lib.mkForce pkgs.linuxPackages;
|
||||
};
|
||||
# run an older kernel to provide compatibility with windows vm
|
||||
boot.kernelPackages = lib.mkForce pkgs.linuxPackages;
|
||||
};
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,9 @@
|
|||
_:
|
||||
{ lib, config, ... }:
|
||||
{
|
||||
|
||||
virtualisation.vmware.host.enable = true;
|
||||
virtualisation.vmware.guest.enable = true;
|
||||
options.swarselsystems.modules.optional.vmware = lib.mkEnableOption "optional vmware settings";
|
||||
config = lib.mkIf config.swarselsystems.modules.optional.vmware {
|
||||
virtualisation.vmware.host.enable = true;
|
||||
virtualisation.vmware.guest.enable = true;
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -24,167 +24,170 @@ let
|
|||
};
|
||||
in
|
||||
{
|
||||
sops =
|
||||
let
|
||||
secretNames = [
|
||||
"vcuser"
|
||||
"vcpw"
|
||||
"govcuser"
|
||||
"govcpw"
|
||||
"govcurl"
|
||||
"govcdc"
|
||||
"govcds"
|
||||
"govchost"
|
||||
"govcnetwork"
|
||||
"govcpool"
|
||||
];
|
||||
in
|
||||
{
|
||||
secrets = builtins.listToAttrs (
|
||||
map
|
||||
(name: {
|
||||
inherit name;
|
||||
value = { inherit owner sopsFile; };
|
||||
})
|
||||
secretNames
|
||||
);
|
||||
};
|
||||
options.swarselsystems.modules.optional.work = lib.mkEnableOption "optional work settings";
|
||||
config = lib.mkIf config.swarselsystems.modules.optional.work {
|
||||
sops =
|
||||
let
|
||||
secretNames = [
|
||||
"vcuser"
|
||||
"vcpw"
|
||||
"govcuser"
|
||||
"govcpw"
|
||||
"govcurl"
|
||||
"govcdc"
|
||||
"govcds"
|
||||
"govchost"
|
||||
"govcnetwork"
|
||||
"govcpool"
|
||||
];
|
||||
in
|
||||
{
|
||||
secrets = builtins.listToAttrs (
|
||||
map
|
||||
(name: {
|
||||
inherit name;
|
||||
value = { inherit owner sopsFile; };
|
||||
})
|
||||
secretNames
|
||||
);
|
||||
};
|
||||
|
||||
boot.initrd = {
|
||||
systemd.enable = lib.mkForce true; # make sure we are using initrd systemd even when not using Impermanence
|
||||
luks = {
|
||||
# disable "support" since we use systemd-cryptenroll
|
||||
# make sure yubikeys are enrolled using
|
||||
# sudo systemd-cryptenroll --fido2-device=auto --fido2-with-user-verification=no --fido2-with-user-presence=true --fido2-with-client-pin=no /dev/nvme0n1p2
|
||||
yubikeySupport = false;
|
||||
fido2Support = false;
|
||||
};
|
||||
};
|
||||
|
||||
programs = {
|
||||
zsh.shellInit = ''
|
||||
export VSPHERE_USER="$(cat ${config.sops.secrets.vcuser.path})"
|
||||
export VSPHERE_PW="$(cat ${config.sops.secrets.vcpw.path})"
|
||||
export GOVC_USERNAME="$(cat ${config.sops.secrets.govcuser.path})"
|
||||
export GOVC_PASSWORD="$(cat ${config.sops.secrets.govcpw.path})"
|
||||
export GOVC_URL="$(cat ${config.sops.secrets.govcurl.path})"
|
||||
export GOVC_DATACENTER="$(cat ${config.sops.secrets.govcdc.path})"
|
||||
export GOVC_DATASTORE="$(cat ${config.sops.secrets.govcds.path})"
|
||||
export GOVC_HOST="$(cat ${config.sops.secrets.govchost.path})"
|
||||
export GOVC_RESOURCE_POOL="$(cat ${config.sops.secrets.govcpool.path})"
|
||||
export GOVC_NETWORK="$(cat ${config.sops.secrets.govcnetwork.path})"
|
||||
'';
|
||||
|
||||
browserpass.enable = true;
|
||||
_1password.enable = true;
|
||||
_1password-gui = {
|
||||
enable = true;
|
||||
polkitPolicyOwners = [ "${mainUser}" ];
|
||||
};
|
||||
};
|
||||
|
||||
networking = {
|
||||
firewall.trustedInterfaces = [ "virbr0" ];
|
||||
search = [
|
||||
"vbc.ac.at"
|
||||
"clip.vbc.ac.at"
|
||||
"imp.univie.ac.at"
|
||||
];
|
||||
};
|
||||
|
||||
virtualisation = {
|
||||
docker.enable = lib.mkIf (!config.virtualisation.podman.dockerCompat) true;
|
||||
spiceUSBRedirection.enable = true;
|
||||
libvirtd = {
|
||||
enable = true;
|
||||
qemu = {
|
||||
package = pkgs.qemu_kvm;
|
||||
runAsRoot = true;
|
||||
swtpm.enable = true;
|
||||
vhostUserPackages = with pkgs; [ virtiofsd ];
|
||||
ovmf = {
|
||||
enable = true;
|
||||
packages = [
|
||||
(pkgs.OVMFFull.override {
|
||||
secureBoot = true;
|
||||
tpmSupport = true;
|
||||
}).fd
|
||||
];
|
||||
};
|
||||
boot.initrd = {
|
||||
systemd.enable = lib.mkForce true; # make sure we are using initrd systemd even when not using Impermanence
|
||||
luks = {
|
||||
# disable "support" since we use systemd-cryptenroll
|
||||
# make sure yubikeys are enrolled using
|
||||
# sudo systemd-cryptenroll --fido2-device=auto --fido2-with-user-verification=no --fido2-with-user-presence=true --fido2-with-client-pin=no /dev/nvme0n1p2
|
||||
yubikeySupport = false;
|
||||
fido2Support = false;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
# (python39.withPackages (ps: with ps; [
|
||||
# cryptography
|
||||
# ]))
|
||||
# docker
|
||||
python39
|
||||
qemu
|
||||
packer
|
||||
gnumake
|
||||
libisoburn
|
||||
govc
|
||||
terraform
|
||||
graphviz
|
||||
programs = {
|
||||
zsh.shellInit = ''
|
||||
export VSPHERE_USER="$(cat ${config.sops.secrets.vcuser.path})"
|
||||
export VSPHERE_PW="$(cat ${config.sops.secrets.vcpw.path})"
|
||||
export GOVC_USERNAME="$(cat ${config.sops.secrets.govcuser.path})"
|
||||
export GOVC_PASSWORD="$(cat ${config.sops.secrets.govcpw.path})"
|
||||
export GOVC_URL="$(cat ${config.sops.secrets.govcurl.path})"
|
||||
export GOVC_DATACENTER="$(cat ${config.sops.secrets.govcdc.path})"
|
||||
export GOVC_DATASTORE="$(cat ${config.sops.secrets.govcds.path})"
|
||||
export GOVC_HOST="$(cat ${config.sops.secrets.govchost.path})"
|
||||
export GOVC_RESOURCE_POOL="$(cat ${config.sops.secrets.govcpool.path})"
|
||||
export GOVC_NETWORK="$(cat ${config.sops.secrets.govcnetwork.path})"
|
||||
'';
|
||||
|
||||
# vm
|
||||
virt-manager
|
||||
virt-viewer
|
||||
virtiofsd
|
||||
spice
|
||||
spice-gtk
|
||||
spice-protocol
|
||||
win-virtio
|
||||
win-spice
|
||||
];
|
||||
|
||||
|
||||
services = {
|
||||
spice-vdagentd.enable = true;
|
||||
openssh = {
|
||||
enable = true;
|
||||
extraConfig = ''
|
||||
'';
|
||||
browserpass.enable = true;
|
||||
_1password.enable = true;
|
||||
_1password-gui = {
|
||||
enable = true;
|
||||
polkitPolicyOwners = [ "${mainUser}" ];
|
||||
};
|
||||
};
|
||||
|
||||
syncthing = {
|
||||
settings = {
|
||||
"winters" = {
|
||||
id = "O7RWDMD-AEAHPP7-7TAVLKZ-BSWNBTU-2VA44MS-EYGUNBB-SLHKB3C-ZSLMOAA";
|
||||
};
|
||||
folders = {
|
||||
"Documents" = {
|
||||
path = "${homeDir}/Documents";
|
||||
devices = [ "magicant" "winters" ];
|
||||
id = "hgr3d-pfu3w";
|
||||
networking = {
|
||||
firewall.trustedInterfaces = [ "virbr0" ];
|
||||
search = [
|
||||
"vbc.ac.at"
|
||||
"clip.vbc.ac.at"
|
||||
"imp.univie.ac.at"
|
||||
];
|
||||
};
|
||||
|
||||
virtualisation = {
|
||||
docker.enable = lib.mkIf (!config.virtualisation.podman.dockerCompat) true;
|
||||
spiceUSBRedirection.enable = true;
|
||||
libvirtd = {
|
||||
enable = true;
|
||||
qemu = {
|
||||
package = pkgs.qemu_kvm;
|
||||
runAsRoot = true;
|
||||
swtpm.enable = true;
|
||||
vhostUserPackages = with pkgs; [ virtiofsd ];
|
||||
ovmf = {
|
||||
enable = true;
|
||||
packages = [
|
||||
(pkgs.OVMFFull.override {
|
||||
secureBoot = true;
|
||||
tpmSupport = true;
|
||||
}).fd
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
udev.extraRules = ''
|
||||
# share screen when dongle detected
|
||||
SUBSYSTEM=="usb", ACTION=="add", ATTRS{idVendor}=="343c", ATTRS{idProduct}=="0000", TAG+="systemd", ENV{SYSTEMD_WANTS}="swarsel-screenshare.service"
|
||||
environment.systemPackages = with pkgs; [
|
||||
# (python39.withPackages (ps: with ps; [
|
||||
# cryptography
|
||||
# ]))
|
||||
# docker
|
||||
python39
|
||||
qemu
|
||||
packer
|
||||
gnumake
|
||||
libisoburn
|
||||
govc
|
||||
terraform
|
||||
graphviz
|
||||
|
||||
# lock screen when yubikey removed
|
||||
ACTION=="remove", ENV{PRODUCT}=="3/1050/407/110", RUN+="${pkgs.systemd}/bin/systemctl suspend"
|
||||
'';
|
||||
# vm
|
||||
virt-manager
|
||||
virt-viewer
|
||||
virtiofsd
|
||||
spice
|
||||
spice-gtk
|
||||
spice-protocol
|
||||
win-virtio
|
||||
win-spice
|
||||
];
|
||||
|
||||
};
|
||||
|
||||
systemd.services = lib.mkMerge [
|
||||
(swarselService "swarsel-screenshare" "Start screensharing after HDMI dongle is detected" "${pkgs.screenshare}/bin/screenshare -h")
|
||||
];
|
||||
services = {
|
||||
spice-vdagentd.enable = true;
|
||||
openssh = {
|
||||
enable = true;
|
||||
extraConfig = ''
|
||||
'';
|
||||
};
|
||||
|
||||
# cgroups v1 is required for centos7 dockers
|
||||
specialisation = {
|
||||
cgroup_v1.configuration = {
|
||||
boot.kernelParams = [
|
||||
"SYSTEMD_CGROUP_ENABLE_LEGACY_FORCE=1"
|
||||
"systemd.unified_cgroup_hierarchy=0"
|
||||
];
|
||||
syncthing = {
|
||||
settings = {
|
||||
"winters" = {
|
||||
id = "O7RWDMD-AEAHPP7-7TAVLKZ-BSWNBTU-2VA44MS-EYGUNBB-SLHKB3C-ZSLMOAA";
|
||||
};
|
||||
folders = {
|
||||
"Documents" = {
|
||||
path = "${homeDir}/Documents";
|
||||
devices = [ "magicant" "winters" ];
|
||||
id = "hgr3d-pfu3w";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
udev.extraRules = ''
|
||||
# share screen when dongle detected
|
||||
SUBSYSTEM=="usb", ACTION=="add", ATTRS{idVendor}=="343c", ATTRS{idProduct}=="0000", TAG+="systemd", ENV{SYSTEMD_WANTS}="swarsel-screenshare.service"
|
||||
|
||||
# lock screen when yubikey removed
|
||||
ACTION=="remove", ENV{PRODUCT}=="3/1050/407/110", RUN+="${pkgs.systemd}/bin/systemctl suspend"
|
||||
'';
|
||||
|
||||
};
|
||||
|
||||
systemd.services = lib.mkMerge [
|
||||
(swarselService "swarsel-screenshare" "Start screensharing after HDMI dongle is detected" "${pkgs.screenshare}/bin/screenshare -h")
|
||||
];
|
||||
|
||||
# cgroups v1 is required for centos7 dockers
|
||||
specialisation = {
|
||||
cgroup_v1.configuration = {
|
||||
boot.kernelParams = [
|
||||
"SYSTEMD_CGROUP_ENABLE_LEGACY_FORCE=1"
|
||||
"systemd.unified_cgroup_hierarchy=0"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -1,49 +1,52 @@
|
|||
{ pkgs, ... }:
|
||||
{ lib, config, pkgs, ... }:
|
||||
{
|
||||
services = {
|
||||
# add a user with sudo smbpasswd -a <user>
|
||||
samba = {
|
||||
package = pkgs.samba4Full;
|
||||
# extraConfig = ''
|
||||
# workgroup = WORKGROUP
|
||||
# server role = standalone server
|
||||
# dns proxy = no
|
||||
options.swarselsystems.server.nfs = lib.mkEnableOption "enable nfs on server";
|
||||
config = lib.mkIf config.swarselsystems.server.nfs {
|
||||
services = {
|
||||
# add a user with sudo smbpasswd -a <user>
|
||||
samba = {
|
||||
package = pkgs.samba4Full;
|
||||
# extraConfig = ''
|
||||
# workgroup = WORKGROUP
|
||||
# server role = standalone server
|
||||
# dns proxy = no
|
||||
|
||||
# pam password change = yes
|
||||
# map to guest = bad user
|
||||
# create mask = 0664
|
||||
# force create mode = 0664
|
||||
# directory mask = 0775
|
||||
# force directory mode = 0775
|
||||
# follow symlinks = yes
|
||||
# '';
|
||||
# pam password change = yes
|
||||
# map to guest = bad user
|
||||
# create mask = 0664
|
||||
# force create mode = 0664
|
||||
# directory mask = 0775
|
||||
# force directory mode = 0775
|
||||
# follow symlinks = yes
|
||||
# '';
|
||||
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
settings.Eternor = {
|
||||
browseable = "yes";
|
||||
"read only" = "no";
|
||||
"guest ok" = "no";
|
||||
path = "/Vault/Eternor";
|
||||
writable = "true";
|
||||
comment = "Eternor";
|
||||
"valid users" = "Swarsel";
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
settings.Eternor = {
|
||||
browseable = "yes";
|
||||
"read only" = "no";
|
||||
"guest ok" = "no";
|
||||
path = "/Vault/Eternor";
|
||||
writable = "true";
|
||||
comment = "Eternor";
|
||||
"valid users" = "Swarsel";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
avahi = {
|
||||
publish.enable = true;
|
||||
publish.userServices = true; # Needed to allow samba to automatically register mDNS records without the need for an `extraServiceFile`
|
||||
nssmdns4 = true;
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
};
|
||||
avahi = {
|
||||
publish.enable = true;
|
||||
publish.userServices = true; # Needed to allow samba to automatically register mDNS records without the need for an `extraServiceFile`
|
||||
nssmdns4 = true;
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
};
|
||||
|
||||
# This enables autodiscovery on windows since SMB1 (and thus netbios) support was discontinued
|
||||
samba-wsdd = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
# This enables autodiscovery on windows since SMB1 (and thus netbios) support was discontinued
|
||||
samba-wsdd = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,37 +1,39 @@
|
|||
{ pkgs, config, ... }:
|
||||
{ pkgs, lib, config, ... }:
|
||||
{
|
||||
environment.systemPackages = with pkgs; [
|
||||
lego
|
||||
];
|
||||
options.swarselsystems.server.nginx = lib.mkEnableOption "enable nginx on server";
|
||||
config = lib.mkIf config.swarselsystems.server.nginx {
|
||||
environment.systemPackages = with pkgs; [
|
||||
lego
|
||||
];
|
||||
|
||||
# users.users.acme = {};
|
||||
# users.users.acme = {};
|
||||
|
||||
sops = {
|
||||
# secrets.dnstokenfull = { owner = "acme"; };
|
||||
secrets.dnstokenfull = { };
|
||||
templates."certs.secret".content = ''
|
||||
CF_DNS_API_TOKEN=${config.sops.placeholder.dnstokenfull}
|
||||
'';
|
||||
};
|
||||
sops = {
|
||||
# secrets.dnstokenfull = { owner = "acme"; };
|
||||
secrets.dnstokenfull = { };
|
||||
templates."certs.secret".content = ''
|
||||
CF_DNS_API_TOKEN=${config.sops.placeholder.dnstokenfull}
|
||||
'';
|
||||
};
|
||||
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
preliminarySelfsigned = false;
|
||||
defaults = {
|
||||
email = "mrswarsel@gmail.com";
|
||||
dnsProvider = "cloudflare";
|
||||
environmentFile = "${config.sops.templates."certs.secret".path}";
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
preliminarySelfsigned = false;
|
||||
defaults = {
|
||||
email = "mrswarsel@gmail.com";
|
||||
dnsProvider = "cloudflare";
|
||||
environmentFile = "${config.sops.templates."certs.secret".path}";
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
statusPage = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedGzipSettings = true;
|
||||
# virtualHosts are defined in the respective sections
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
statusPage = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedGzipSettings = true;
|
||||
# virtualHosts are defined in the respective sections
|
||||
};
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,11 +1,14 @@
|
|||
{ pkgs, ... }:
|
||||
{ lib, config, pkgs, ... }:
|
||||
{
|
||||
environment.systemPackages = with pkgs; [
|
||||
gnupg
|
||||
nix-index
|
||||
ssh-to-age
|
||||
git
|
||||
emacs
|
||||
vim
|
||||
];
|
||||
options.swarselsystems.server.packages = lib.mkEnableOption "enable packages on server";
|
||||
config = lib.mkIf config.swarselsystems.server.packages {
|
||||
environment.systemPackages = with pkgs; [
|
||||
gnupg
|
||||
nix-index
|
||||
ssh-to-age
|
||||
git
|
||||
emacs
|
||||
vim
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -4,12 +4,13 @@ let
|
|||
in
|
||||
{
|
||||
options.swarselsystems = {
|
||||
server.general = lib.mkEnableOption "general setting on server";
|
||||
shellAliases = lib.mkOption {
|
||||
type = lib.types.attrsOf lib.types.str;
|
||||
default = { };
|
||||
};
|
||||
};
|
||||
config = {
|
||||
config = lib.mkIf config.swarselsystems.server.general {
|
||||
environment.shellAliases = lib.recursiveUpdate
|
||||
{
|
||||
npswitch = "cd ${flakePath}; git pull; sudo nixos-rebuild --flake .#$(hostname) switch; cd -;";
|
||||
|
|
|
|||
|
|
@ -1,9 +1,11 @@
|
|||
{ config, lib, ... }:
|
||||
{
|
||||
sops = {
|
||||
age.sshKeyPaths = lib.mkDefault [ "/etc/ssh/sops" ];
|
||||
defaultSopsFile = lib.mkDefault "${config.swarselsystems.flakePath}/secrets/winters/secrets.yaml";
|
||||
validateSopsFiles = false;
|
||||
options.swarselsystems.server.sops = lib.mkEnableOption "enable sops on server";
|
||||
config = lib.mkIf config.swarselsystems.server.sops {
|
||||
sops = {
|
||||
age.sshKeyPaths = lib.mkDefault [ "/etc/ssh/sops" ];
|
||||
defaultSopsFile = lib.mkDefault "${config.swarselsystems.flakePath}/secrets/winters/secrets.yaml";
|
||||
validateSopsFiles = false;
|
||||
};
|
||||
};
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,18 +1,20 @@
|
|||
{ self, config, ... }:
|
||||
{ self, lib, config, ... }:
|
||||
{
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
options.swarselsystems.server.ssh = lib.mkEnableOption "enable ssh on server";
|
||||
config = lib.mkIf config.swarselsystems.server.ssh {
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
};
|
||||
users.users."${config.swarselsystems.mainUser}".openssh.authorizedKeys.keyFiles = [
|
||||
(self + /secrets/keys/ssh/yubikey.pub)
|
||||
(self + /secrets/keys/ssh/magicant.pub)
|
||||
];
|
||||
users.users.root.openssh.authorizedKeys.keyFiles = [
|
||||
(self + /secrets/keys/ssh/yubikey.pub)
|
||||
(self + /secrets/keys/ssh/magicant.pub)
|
||||
];
|
||||
security.sudo.extraConfig = ''
|
||||
Defaults env_keep+=SSH_AUTH_SOCK
|
||||
'';
|
||||
};
|
||||
users.users."${config.swarselsystems.mainUser}".openssh.authorizedKeys.keyFiles = [
|
||||
(self + /secrets/keys/ssh/yubikey.pub)
|
||||
(self + /secrets/keys/ssh/magicant.pub)
|
||||
];
|
||||
users.users.root.openssh.authorizedKeys.keyFiles = [
|
||||
(self + /secrets/keys/ssh/yubikey.pub)
|
||||
(self + /secrets/keys/ssh/magicant.pub)
|
||||
];
|
||||
security.sudo.extraConfig = ''
|
||||
Defaults env_keep+=SSH_AUTH_SOCK
|
||||
'';
|
||||
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue