mirror of
https://github.com/Swarsel/.dotfiles.git
synced 2025-12-06 09:07:21 +01:00
chore: code cleanup
This commit is contained in:
Swarsel
parent
bb59145f85
commit
3eecea6503
GPG key ID:
26A54C31F2A4FD84
42 changed files with 4232 additions and 4479 deletions
File diff suppressed because it is too large
Load diff
43
flake.nix
43
flake.nix
|
|
@ -3,88 +3,85 @@
|
|||
|
||||
inputs = {
|
||||
|
||||
nixpkgs.url = github:nixos/nixpkgs/nixos-unstable;
|
||||
nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
|
||||
|
||||
nixpkgs-stable.url = github:NixOS/nixpkgs/nixos-24.05;
|
||||
nixpkgs-stable.url = "github:NixOS/nixpkgs/nixos-24.05";
|
||||
|
||||
# user-level configuration
|
||||
home-manager = {
|
||||
url = github:nix-community/home-manager;
|
||||
url = "github:nix-community/home-manager";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
|
||||
# overlay to access bleeding edge emacs
|
||||
emacs-overlay = {
|
||||
url = github:nix-community/emacs-overlay;
|
||||
url = "github:nix-community/emacs-overlay";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
|
||||
# nix user repository
|
||||
# i use this mainly to not have to build all firefox extensions
|
||||
# myself as well as for the emacs-init package (tbd)
|
||||
nur.url = github:nix-community/NUR;
|
||||
nur.url = "github:nix-community/NUR";
|
||||
|
||||
# provides GL to non-NixOS hosts
|
||||
nixgl.url = github:guibou/nixGL;
|
||||
nixgl.url = "github:guibou/nixGL";
|
||||
|
||||
# manages all theming using Home-Manager
|
||||
stylix.url = github:danth/stylix;
|
||||
stylix.url = "github:danth/stylix";
|
||||
|
||||
# nix secrets management
|
||||
sops-nix.url = github:Mic92/sops-nix;
|
||||
sops-nix.url = "github:Mic92/sops-nix";
|
||||
|
||||
# enable secure boot on NixOS
|
||||
lanzaboote.url = github:nix-community/lanzaboote;
|
||||
lanzaboote.url = "github:nix-community/lanzaboote";
|
||||
|
||||
# nix for android
|
||||
nix-on-droid = {
|
||||
url = github:t184256/nix-on-droid/release-23.05;
|
||||
url = "github:t184256/nix-on-droid/release-23.05";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
|
||||
# generate NixOS images
|
||||
nixos-generators = {
|
||||
url = github:nix-community/nixos-generators;
|
||||
url = "github:nix-community/nixos-generators";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
|
||||
# patches for gaming on nix
|
||||
nix-gaming = {
|
||||
url = github:fufexan/nix-gaming;
|
||||
url = "github:fufexan/nix-gaming";
|
||||
};
|
||||
|
||||
# hardware quirks on nix
|
||||
nixos-hardware = {
|
||||
url = github:NixOS/nixos-hardware/master;
|
||||
url = "github:NixOS/nixos-hardware/master";
|
||||
};
|
||||
|
||||
# dynamic library loading
|
||||
nix-alien = {
|
||||
url = github:thiagokokada/nix-alien;
|
||||
url = "github:thiagokokada/nix-alien";
|
||||
};
|
||||
|
||||
# automatic nintendo switch payload injection
|
||||
nswitch-rcm-nix = {
|
||||
url = github:Swarsel/nswitch-rcm-nix;
|
||||
url = "github:Swarsel/nswitch-rcm-nix";
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
outputs = inputs@{
|
||||
self,
|
||||
|
||||
nixpkgs,
|
||||
nixpkgs-stable,
|
||||
home-manager,
|
||||
nix-on-droid,
|
||||
nixos-generators,
|
||||
emacs-overlay,
|
||||
nur,
|
||||
nixgl,
|
||||
stylix,
|
||||
sops-nix,
|
||||
lanzaboote,
|
||||
nix-gaming,
|
||||
nixos-hardware,
|
||||
nix-alien,
|
||||
nswitch-rcm-nix,
|
||||
|
|
@ -106,16 +103,6 @@
|
|||
config.allowUnfree = true;
|
||||
};
|
||||
|
||||
# for ovm arm hosts
|
||||
armpkgs = import nixpkgs { system = "aarch64-linux";
|
||||
overlays = [ emacs-overlay.overlay
|
||||
nur.overlay
|
||||
nixgl.overlay
|
||||
];
|
||||
config.allowUnfree = true;
|
||||
};
|
||||
|
||||
|
||||
# NixOS modules that can only be used on NixOS systems
|
||||
nixModules = [ stylix.nixosModules.stylix
|
||||
sops-nix.nixosModules.sops
|
||||
|
|
|
|||
1093
index.html
1093
index.html
File diff suppressed because it is too large
Load diff
|
|
@ -1,4 +1,4 @@
|
|||
{ config, pkgs, lib, fetchFromGitHub, ... }:
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
|
||||
|
|
@ -118,7 +118,7 @@
|
|||
};
|
||||
|
||||
keybindings = let
|
||||
modifier = config.wayland.windowManager.sway.config.modifier;
|
||||
inherit (config.wayland.windowManager.sway.config) modifier;
|
||||
in {
|
||||
# TEMPLATE
|
||||
"${modifier}+w" = "exec \"bash ~/.dotfiles/scripts/checkschildi.sh\"";
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ config, lib, pkgs, inputs, ... }:
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
|
||||
|
|
@ -67,7 +67,7 @@
|
|||
};
|
||||
|
||||
monospace = {
|
||||
package = (pkgs.nerdfonts.override { fonts = [ "FiraCode"]; });
|
||||
package = pkgs.nerdfonts.override { fonts = [ "FiraCode"]; };
|
||||
name = "FiraCode Nerd Font Mono";
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -301,15 +301,17 @@
|
|||
|
||||
];
|
||||
|
||||
sops.defaultSopsFile = "${config.home.homeDirectory}/.dotfiles/secrets/general/secrets.yaml";
|
||||
sops.validateSopsFiles = false;
|
||||
|
||||
# since we are using the home-manager implementation, we need to specify the runtime path for each secret
|
||||
sops.secrets.mrswarsel = {path = "/run/user/1000/secrets/mrswarsel";};
|
||||
sops.secrets.nautilus = {path = "/run/user/1000/secrets/nautilus";};
|
||||
sops.secrets.leon = {path = "/run/user/1000/secrets/leon";};
|
||||
sops.secrets.swarselmail = {path = "/run/user/1000/secrets/swarselmail";};
|
||||
sops.secrets.caldav = {path = "${config.home.homeDirectory}/.emacs.d/.caldav";};
|
||||
sops = {
|
||||
defaultSopsFile = "${config.home.homeDirectory}/.dotfiles/secrets/general/secrets.yaml";
|
||||
validateSopsFiles = false;
|
||||
secrets = {
|
||||
mrswarsel = {path = "/run/user/1000/secrets/mrswarsel";};
|
||||
nautilus = {path = "/run/user/1000/secrets/nautilus";};
|
||||
leon = {path = "/run/user/1000/secrets/leon";};
|
||||
swarselmail = {path = "/run/user/1000/secrets/swarselmail";};
|
||||
caldav = {path = "${config.home.homeDirectory}/.emacs.d/.caldav";};
|
||||
};
|
||||
};
|
||||
|
||||
programs.ssh= {
|
||||
enable = true;
|
||||
|
|
@ -518,22 +520,23 @@ home.sessionVariables = {
|
|||
EDITOR = "bash ~/.dotfiles/scripts/editor.sh";
|
||||
};
|
||||
|
||||
# zsh Integration is enabled by default for these
|
||||
programs.bottom.enable = true;
|
||||
programs.imv.enable = true;
|
||||
programs.sioyek.enable = true;
|
||||
programs.bat.enable = true;
|
||||
programs.carapace.enable = true;
|
||||
programs.wlogout.enable = true;
|
||||
programs.swayr.enable = true;
|
||||
programs.yt-dlp.enable = true;
|
||||
programs.mpv.enable = true;
|
||||
programs.jq.enable = true;
|
||||
programs.nix-index.enable = true;
|
||||
programs.ripgrep.enable = true;
|
||||
programs.pandoc.enable = true;
|
||||
programs.fzf.enable = true;
|
||||
programs.zoxide.enable = true;
|
||||
programs = {
|
||||
bottom.enable = true;
|
||||
imv.enable = true;
|
||||
sioyek.enable = true;
|
||||
bat.enable = true;
|
||||
carapace.enable = true;
|
||||
wlogout.enable = true;
|
||||
swayr.enable = true;
|
||||
yt-dlp.enable = true;
|
||||
mpv.enable = true;
|
||||
jq.enable = true;
|
||||
nix-index.enable = true;
|
||||
ripgrep.enable = true;
|
||||
pandoc.enable = true;
|
||||
fzf.enable = true;
|
||||
zoxide.enable = true;
|
||||
};
|
||||
|
||||
programs.password-store = {
|
||||
enable = true;
|
||||
|
|
@ -1154,7 +1157,7 @@ programs.firefox = {
|
|||
};
|
||||
profiles.default = {
|
||||
isDefault = true;
|
||||
userChrome = (builtins.readFile ../../programs/firefox/chrome/userChrome.css);
|
||||
userChrome = builtins.readFile ../../programs/firefox/chrome/userChrome.css;
|
||||
extensions = with pkgs.nur.repos.rycee.firefox-addons; [
|
||||
tridactyl
|
||||
browserpass
|
||||
|
|
@ -1172,42 +1175,10 @@ programs.firefox = {
|
|||
widegithub
|
||||
enhanced-github
|
||||
unpaywall
|
||||
# fastforwardteam
|
||||
don-t-fuck-with-paste
|
||||
plasma-integration
|
||||
|
||||
# (let version = "3.4.5.0";
|
||||
# in buildFirefoxXpiAddon {
|
||||
# pname = "bypass-paywalls-clean";
|
||||
# inherit version;
|
||||
# addonId = "magnolia@12.34";
|
||||
# url =
|
||||
# "https://gitlab.com/magnolia1234/bpc-uploads/-/raw/master/bypass_paywalls_clean-3.4.5.0.xpi";
|
||||
# sha256 = "703d30c15b88291bd0305cc59013693aea5f75a40ea98fb8e252d1c7bfb43514";
|
||||
# meta = with lib; {
|
||||
# homepage =
|
||||
# "https://gitlab.com/magnolia1234/bypass-paywalls-firefox-clean";
|
||||
# description = "Bypass Paywalls of (custom) news sites";
|
||||
# license = licenses.mit;
|
||||
# platforms = platforms.all;
|
||||
# };
|
||||
# })
|
||||
|
||||
(buildFirefoxXpiAddon {
|
||||
pname = ":emoji:";
|
||||
version = "0.1.3";
|
||||
addonId = "gonelf@gmail.com";
|
||||
url = "https://addons.mozilla.org/firefox/downloads/file/3365324/emojidots-0.1.3.xpi";
|
||||
sha256 = "4f7cc25c478fe52eb82f37c9ff4978dcaa3f95020398c5b184e517f6efa2c201";
|
||||
meta = with lib;
|
||||
{
|
||||
description = "emoji autocomplete anywhere on the internet";
|
||||
mozPermissions = [ "https://gist.githubusercontent.com/gonelf/d8ae3ccb7902b501c4a5dd625d4089da/raw/5eeda197ba92f8c8139e846a1225d5640077e06f/emoji_pretty.json" "tabs" "storage"];
|
||||
platforms = platforms.all;
|
||||
};
|
||||
})
|
||||
|
||||
];
|
||||
|
||||
search.engines = {
|
||||
"Nix Packages" = {
|
||||
urls = [{
|
||||
|
|
@ -1317,9 +1288,10 @@ wayland.windowManager.sway = {
|
|||
enable = true;
|
||||
checkConfig = false; # delete this line once SwayFX is fixed upstream
|
||||
package = pkgs.swayfx;
|
||||
# package = pkgs.sway;
|
||||
systemd.enable = true;
|
||||
systemd.xdgAutostart = true;
|
||||
systemd = {
|
||||
enable = true;
|
||||
xdgAutostart = true;
|
||||
};
|
||||
wrapperFeatures.gtk = true;
|
||||
config = rec {
|
||||
modifier = "Mod4";
|
||||
|
|
@ -1327,7 +1299,7 @@ wayland.windowManager.sway = {
|
|||
menu = "fuzzel";
|
||||
bars = [{ command = "waybar";}];
|
||||
keybindings = let
|
||||
modifier = config.wayland.windowManager.sway.config.modifier;
|
||||
inherit (config.wayland.windowManager.sway.config) modifier;
|
||||
in {
|
||||
"${modifier}+q" = "kill";
|
||||
"${modifier}+f" = "exec firefox";
|
||||
|
|
@ -1539,7 +1511,7 @@ wayland.windowManager.sway = {
|
|||
# exec hash dbus-update-activation-environment 2>/dev/null && dbus-update-activation-environment --systemd DISPLAY WAYLAND_DISPLAY SWAYSOCK
|
||||
# ";
|
||||
extraConfig =let
|
||||
modifier = config.wayland.windowManager.sway.config.modifier;
|
||||
inherit (config.wayland.windowManager.sway.config) modifier;
|
||||
swayfxSettings = "
|
||||
blur enable
|
||||
blur_xray disable
|
||||
|
|
@ -1550,7 +1522,6 @@ wayland.windowManager.sway = {
|
|||
titlebar_separator disable
|
||||
default_dim_inactive 0.02
|
||||
";
|
||||
swayfxSettingsOff = "";
|
||||
in "
|
||||
exec_always autotiling
|
||||
set $exit \"exit: [s]leep, [p]oweroff, [r]eboot, [l]ogout\"
|
||||
|
|
|
|||
|
|
@ -1,31 +1,35 @@
|
|||
{ config, lib, pkgs, inputs, ... }:
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
{
|
||||
|
||||
home-manager.useGlobalPkgs = true;
|
||||
home-manager.useUserPackages = true;
|
||||
home-manager = {
|
||||
useGlobalPkgs = true;
|
||||
useUserPackages = true;
|
||||
};
|
||||
|
||||
services.xserver = {
|
||||
xkb.layout = "us";
|
||||
xkb.variant = "altgr-intl";
|
||||
xkb = {
|
||||
layout = "us";
|
||||
variant = "altgr-intl";
|
||||
};
|
||||
};
|
||||
|
||||
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||
|
||||
users.mutableUsers = false;
|
||||
|
||||
# use ozone for wayland - chromium apps
|
||||
environment.sessionVariables.NIXOS_OZONE_WL = "1";
|
||||
|
||||
# wordlist for look
|
||||
environment.wordlist.enable = true;
|
||||
# gstreamer plugins for nautilus (used for file metadata)
|
||||
environment.sessionVariables.GST_PLUGIN_SYSTEM_PATH_1_0 = lib.makeSearchPathOutput "lib" "lib/gstreamer-1.0" (with pkgs.gst_all_1; [
|
||||
environment = {
|
||||
wordlist.enable = true;
|
||||
sessionVariables = {
|
||||
NIXOS_OZONE_WL = "1";
|
||||
GST_PLUGIN_SYSTEM_PATH_1_0 = lib.makeSearchPathOutput "lib" "lib/gstreamer-1.0" (with pkgs.gst_all_1; [
|
||||
gst-plugins-good
|
||||
gst-plugins-bad
|
||||
gst-plugins-ugly
|
||||
gst-libav
|
||||
]);
|
||||
};
|
||||
};
|
||||
# gstreamer plugins for nautilus (used for file metadata)
|
||||
|
||||
time.hardwareClockInLocalTime = true;
|
||||
|
||||
|
|
@ -52,24 +56,28 @@ nix.optimise = {
|
|||
DefaultTimeoutStopSec=15s
|
||||
'';
|
||||
|
||||
hardware.graphics = {
|
||||
hardware = {
|
||||
graphics = {
|
||||
enable = true;
|
||||
enable32Bit = true;
|
||||
};
|
||||
|
||||
hardware.pulseaudio= {
|
||||
pulseaudio= {
|
||||
enable = true;
|
||||
package = pkgs.pulseaudioFull;
|
||||
};
|
||||
|
||||
hardware.enableAllFirmware = true;
|
||||
enableAllFirmware = true;
|
||||
|
||||
hardware.bluetooth.powerOnBoot = true;
|
||||
hardware.bluetooth.settings = {
|
||||
bluetooth = {
|
||||
powerOnBoot = true;
|
||||
settings = {
|
||||
General = {
|
||||
Enable = "Source,Sink,Media,Socket";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
networking.networkmanager = {
|
||||
enable = true;
|
||||
|
|
@ -278,8 +286,9 @@ systemd.services.NetworkManager-ensure-profiles.after = [ "NetworkManager.servic
|
|||
|
||||
time.timeZone = "Europe/Vienna";
|
||||
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
i18n.extraLocaleSettings = {
|
||||
i18n = {
|
||||
defaultLocale = "en_US.UTF-8";
|
||||
extraLocaleSettings = {
|
||||
LC_ADDRESS = "de_AT.UTF-8";
|
||||
LC_IDENTIFICATION = "de_AT.UTF-8";
|
||||
LC_MEASUREMENT = "de_AT.UTF-8";
|
||||
|
|
@ -290,6 +299,7 @@ i18n.extraLocaleSettings = {
|
|||
LC_TELEPHONE = "de_AT.UTF-8";
|
||||
LC_TIME = "de_AT.UTF-8";
|
||||
};
|
||||
};
|
||||
|
||||
sops = {
|
||||
|
||||
|
|
@ -400,17 +410,16 @@ environment.systemPackages = with pkgs; [
|
|||
|
||||
];
|
||||
|
||||
programs.dconf.enable = true;
|
||||
programs.evince.enable = true;
|
||||
programs.kdeconnect.enable = true;
|
||||
programs = {
|
||||
dconf.enable = true;
|
||||
evince.enable = true;
|
||||
kdeconnect.enable = true;
|
||||
};
|
||||
|
||||
|
||||
# zsh section, do not delete ------
|
||||
programs.zsh.enable = true;
|
||||
users.defaultUserShell = pkgs.zsh;
|
||||
environment.shells = with pkgs; [ zsh ];
|
||||
environment.pathsToLink = [ "/share/zsh" ];
|
||||
# ---------------------------------
|
||||
|
||||
services.blueman.enable = true;
|
||||
|
||||
|
|
@ -421,19 +430,21 @@ hardware.sane = {
|
|||
};
|
||||
|
||||
# enable discovery and usage of network devices (esp. printers)
|
||||
services.printing.enable = true;
|
||||
services.printing.drivers = [
|
||||
services.printing = {
|
||||
enable = true;
|
||||
drivers = [
|
||||
pkgs.gutenprint
|
||||
pkgs.gutenprintBin
|
||||
];
|
||||
services.printing.browsedConf = ''
|
||||
browsedConf = ''
|
||||
BrowseDNSSDSubTypes _cups,_print
|
||||
BrowseLocalProtocols all
|
||||
BrowseRemoteProtocols all
|
||||
CreateIPPPrinterQueues All
|
||||
|
||||
BrowseProtocols all
|
||||
'';
|
||||
};
|
||||
|
||||
services.avahi = {
|
||||
enable = true;
|
||||
nssmdns4 = true;
|
||||
|
|
@ -473,10 +484,6 @@ services.pcscd.enable = true;
|
|||
|
||||
hardware.ledger.enable = true;
|
||||
|
||||
# environment.systemPackages = with pkgs; [
|
||||
# --- IN SYSTEM PACKAGES SECTION ---
|
||||
# ];
|
||||
|
||||
services.udev.packages = with pkgs; [
|
||||
yubikey-personalization
|
||||
ledger-udev-rules
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
{ config, lib, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ config, pkgs, lib, fetchFromGitHub, ... }:
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
|
||||
|
|
@ -97,7 +97,7 @@
|
|||
|
||||
|
||||
keybindings = let
|
||||
modifier = config.wayland.windowManager.sway.config.modifier;
|
||||
inherit (config.wayland.windowManager.sway.config) modifier;
|
||||
in {
|
||||
"${modifier}+w" = "exec \"bash ~/.dotfiles/scripts/checkelement.sh\"";
|
||||
"XF86MonBrightnessUp" = "exec brightnessctl set +5%";
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ config, lib, pkgs, inputs, ... }:
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
|
||||
|
|
@ -94,7 +94,7 @@
|
|||
};
|
||||
|
||||
monospace = {
|
||||
package = (pkgs.nerdfonts.override { fonts = [ "FiraCode"]; });
|
||||
package = pkgs.nerdfonts.override { fonts = [ "FiraCode"]; };
|
||||
name = "FiraCode Nerd Font Mono";
|
||||
};
|
||||
|
||||
|
|
@ -143,10 +143,10 @@
|
|||
|
||||
services.nswitch-rcm = {
|
||||
enable = true;
|
||||
package = (pkgs.fetchurl {
|
||||
package = pkgs.fetchurl {
|
||||
url = "https://github.com/Atmosphere-NX/Atmosphere/releases/download/1.3.2/fusee.bin";
|
||||
hash = "sha256-5AXzNsny45SPLIrvWJA9/JlOCal5l6Y++Cm+RtlJppI=";
|
||||
});
|
||||
};
|
||||
};
|
||||
|
||||
users.users.swarsel = {
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
environment.packages = with pkgs; [
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ config, pkgs, modulesPath, unstable, sops, ... }: let
|
||||
{ config, pkgs, sops, ... }: let
|
||||
matrixDomain = "swatrix.swarsel.win";
|
||||
in {
|
||||
|
||||
|
|
@ -23,13 +23,42 @@ in {
|
|||
|
||||
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/sops" ];
|
||||
sops.defaultSopsFile = "/root/.dotfiles/secrets/omatrix/secrets.yaml";
|
||||
sops.validateSopsFiles = false;
|
||||
sops.secrets.dnstokenfull = {owner="acme";};
|
||||
sops.templates."certs.secret".content = ''
|
||||
sops = {
|
||||
age.sshKeyPaths = [ "/etc/ssh/sops" ];
|
||||
defaultSopsFile = "/root/.dotfiles/secrets/omatrix/secrets.yaml";
|
||||
validateSopsFiles = false;
|
||||
secrets = {
|
||||
dnstokenfull = {owner="acme";};
|
||||
matrixsharedsecret = {owner="matrix-synapse";};
|
||||
mautrixtelegram_as = {owner="matrix-synapse";};
|
||||
mautrixtelegram_hs = {owner="matrix-synapse";};
|
||||
mautrixtelegram_api_id = {owner="matrix-synapse";};
|
||||
mautrixtelegram_api_hash = {owner="matrix-synapse";};
|
||||
};
|
||||
templates = {
|
||||
"certs.secret".content = ''
|
||||
CF_DNS_API_TOKEN=${config.sops.placeholder.dnstokenfull}
|
||||
'';
|
||||
"matrix_user_register.sh".content = ''
|
||||
register_new_matrix_user -k ${config.sops.placeholder.matrixsharedsecret} http://localhost:8008
|
||||
'';
|
||||
mautrixtelegram = {
|
||||
owner = "matrix-synapse";
|
||||
content = ''
|
||||
MAUTRIX_TELEGRAM_APPSERVICE_AS_TOKEN=${config.sops.placeholder.mautrixtelegram_as}
|
||||
MAUTRIX_TELEGRAM_APPSERVICE_HS_TOKEN=${config.sops.placeholder.mautrixtelegram_hs}
|
||||
MAUTRIX_TELEGRAM_TELEGRAM_API_ID=${config.sops.placeholder.mautrixtelegram_api_id}
|
||||
MAUTRIX_TELEGRAM_TELEGRAM_API_HASH=${config.sops.placeholder.mautrixtelegram_api_hash}
|
||||
'';
|
||||
};
|
||||
matrixshared = {
|
||||
owner = "matrix-synapse";
|
||||
content = ''
|
||||
registration_shared_secret: ${config.sops.placeholder.matrixsharedsecret}
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
documentation = {
|
||||
enable = false;
|
||||
|
|
@ -69,11 +98,11 @@ in {
|
|||
|
||||
boot.tmp.cleanOnBoot = true;
|
||||
zramSwap.enable = false;
|
||||
networking.hostName = "swatrix";
|
||||
networking.enableIPv6 = false;
|
||||
# networking.domain = "subnet03112148.vcn03112148.oraclevcn.com";
|
||||
networking.domain = "swarsel.win";
|
||||
networking.firewall.extraCommands = ''
|
||||
networking = {
|
||||
hostName = "swatrix";
|
||||
enableIPv6 = false;
|
||||
domain = "swarsel.win";
|
||||
firewall.extraCommands = ''
|
||||
iptables -I INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT
|
||||
iptables -I INPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT
|
||||
iptables -I INPUT -m state --state NEW -p tcp --dport 8008 -j ACCEPT
|
||||
|
|
@ -81,6 +110,7 @@ in {
|
|||
iptables -I INPUT -m state --state NEW -p tcp --dport 29318 -j ACCEPT
|
||||
iptables -I INPUT -m state --state NEW -p tcp --dport 29328 -j ACCEPT
|
||||
'';
|
||||
};
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PermitRootLogin = "yes";
|
||||
|
|
@ -97,33 +127,9 @@ in {
|
|||
|
||||
boot.loader.grub.device = "nodev";
|
||||
|
||||
sops.secrets.matrixsharedsecret = {owner="matrix-synapse";};
|
||||
sops.templates."matrix_user_register.sh".content = ''
|
||||
register_new_matrix_user -k ${config.sops.placeholder.matrixsharedsecret} http://localhost:8008
|
||||
'';
|
||||
sops.templates.matrixshared.owner = "matrix-synapse";
|
||||
sops.templates.matrixshared.content = ''
|
||||
registration_shared_secret: ${config.sops.placeholder.matrixsharedsecret}
|
||||
'';
|
||||
sops.secrets.mautrixtelegram_as = {owner="matrix-synapse";};
|
||||
sops.secrets.mautrixtelegram_hs = {owner="matrix-synapse";};
|
||||
sops.secrets.mautrixtelegram_api_id = {owner="matrix-synapse";};
|
||||
sops.secrets.mautrixtelegram_api_hash = {owner="matrix-synapse";};
|
||||
sops.templates.mautrixtelegram.owner = "matrix-synapse";
|
||||
sops.templates.mautrixtelegram.content = ''
|
||||
MAUTRIX_TELEGRAM_APPSERVICE_AS_TOKEN=${config.sops.placeholder.mautrixtelegram_as}
|
||||
MAUTRIX_TELEGRAM_APPSERVICE_HS_TOKEN=${config.sops.placeholder.mautrixtelegram_hs}
|
||||
MAUTRIX_TELEGRAM_TELEGRAM_API_ID=${config.sops.placeholder.mautrixtelegram_api_id}
|
||||
MAUTRIX_TELEGRAM_TELEGRAM_API_HASH=${config.sops.placeholder.mautrixtelegram_api_hash}
|
||||
'';
|
||||
# sops.secrets.mautrixwhatsapp_shared = {owner="matrix-synapse";};
|
||||
# sops.templates.mautrixwhatsapp.owner = "matrix-synapse";
|
||||
# sops.templates.mautrixwhatsapp.content = ''
|
||||
# MAUTRIX_WHATSAPP_BRIDGE_LOGIN_SHARED_SECRET=${config.sops.placeholder.mautrixwhatsapp_shared}
|
||||
# '';
|
||||
|
||||
services.postgresql.enable = true;
|
||||
services.postgresql.initialScript = pkgs.writeText "synapse-init.sql" ''
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
initialScript = pkgs.writeText "synapse-init.sql" ''
|
||||
CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
|
||||
CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
|
||||
TEMPLATE template0
|
||||
|
|
@ -145,7 +151,7 @@ in {
|
|||
LC_COLLATE = "C"
|
||||
LC_CTYPE = "C";
|
||||
'';
|
||||
|
||||
};
|
||||
services.matrix-synapse = {
|
||||
settings.app_service_config_files = [
|
||||
"/var/lib/matrix-synapse/telegram-registration.yaml"
|
||||
|
|
@ -154,12 +160,11 @@ in {
|
|||
"/var/lib/matrix-synapse/doublepuppet.yaml"
|
||||
];
|
||||
enable = true;
|
||||
settings.server_name = matrixDomain;
|
||||
settings.public_baseurl = "https://${matrixDomain}";
|
||||
extraConfigFiles = [
|
||||
config.sops.templates.matrixshared.path
|
||||
];
|
||||
settings.listeners = [
|
||||
settings = {
|
||||
server_name = matrixDomain;
|
||||
public_baseurl = "https://${matrixDomain}";
|
||||
};
|
||||
listeners = [
|
||||
{ port = 8008;
|
||||
bind_addresses = [ "0.0.0.0" ];
|
||||
type = "http";
|
||||
|
|
@ -173,6 +178,9 @@ in {
|
|||
];
|
||||
}
|
||||
];
|
||||
extraConfigFiles = [
|
||||
config.sops.templates.matrixshared.path
|
||||
];
|
||||
};
|
||||
|
||||
services.mautrix-telegram = {
|
||||
|
|
@ -196,9 +204,6 @@ in {
|
|||
database = "postgresql:///mautrix-telegram?host=/run/postgresql";
|
||||
};
|
||||
bridge = {
|
||||
# login_shared_secret_map = {
|
||||
# matrixDomain = "as_token:doublepuppet";
|
||||
# };
|
||||
relaybot.authless_portals = true;
|
||||
allow_avatar_remove = true;
|
||||
allow_contact_info = true;
|
||||
|
|
@ -211,12 +216,6 @@ in {
|
|||
"*" = "relaybot";
|
||||
"@swarsel:${matrixDomain}" = "admin";
|
||||
};
|
||||
# Animated stickers conversion requires additional packages in the
|
||||
# service's path.
|
||||
# If this isn't a fresh installation, clearing the bridge's uploaded
|
||||
# file cache might be necessary (make a database backup first!):
|
||||
# delete from telegram_file where \
|
||||
# mime_type in ('application/gzip', 'application/octet-stream')
|
||||
animated_sticker = {
|
||||
target = "gif";
|
||||
args = {
|
||||
|
|
@ -236,7 +235,6 @@ in {
|
|||
|
||||
services.mautrix-whatsapp = {
|
||||
enable = true;
|
||||
# environmentFile = config.sops.templates.mautrixwhatsapp.path;
|
||||
settings = {
|
||||
homeserver = {
|
||||
address = "http://localhost:8008";
|
||||
|
|
@ -284,7 +282,6 @@ in {
|
|||
services.mautrix-signal = {
|
||||
enable = true;
|
||||
registerToSynapse = false; # this has the same effect as registering to app_service_config_file above
|
||||
# environmentFile = config.sops.templates.mautrixwhatsapp.path;
|
||||
settings = {
|
||||
homeserver = {
|
||||
address = "http://localhost:8008";
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
{ config, lib, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ config, pkgs, modulesPath, ... }:
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
|
|
@ -18,14 +18,16 @@
|
|||
|
||||
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/sops" ];
|
||||
sops.defaultSopsFile = "/root/.dotfiles/secrets/sync/secrets.yaml";
|
||||
sops.validateSopsFiles = false;
|
||||
sops.secrets.swarsel = { owner = "root";};
|
||||
sops.secrets.dnstokenfull = {owner="acme";};
|
||||
sops.templates."certs.secret".content = ''
|
||||
sops = {
|
||||
age.sshKeyPaths = [ "/etc/ssh/sops" ];
|
||||
defaultSopsFile = "/root/.dotfiles/secrets/sync/secrets.yaml";
|
||||
validateSopsFiles = false;
|
||||
secrets.swarsel = { owner = "root";};
|
||||
secrets.dnstokenfull = {owner="acme";};
|
||||
templates."certs.secret".content = ''
|
||||
CF_DNS_API_TOKEN=${config.sops.placeholder.dnstokenfull}
|
||||
'';
|
||||
};
|
||||
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
|
|
@ -89,10 +91,11 @@
|
|||
|
||||
boot.tmp.cleanOnBoot = true;
|
||||
zramSwap.enable = false;
|
||||
networking.hostName = "sync";
|
||||
networking.enableIPv6 = false;
|
||||
networking.domain = "subnet03112148.vcn03112148.oraclevcn.com";
|
||||
networking.firewall.extraCommands = ''
|
||||
networking = {
|
||||
hostName = "sync";
|
||||
enableIPv6 = false;
|
||||
domain = "subnet03112148.vcn03112148.oraclevcn.com";
|
||||
firewall.extraCommands = ''
|
||||
iptables -I INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT
|
||||
iptables -I INPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT
|
||||
iptables -I INPUT -m state --state NEW -p tcp --dport 27701 -j ACCEPT
|
||||
|
|
@ -102,6 +105,7 @@
|
|||
iptables -I INPUT -m state --state NEW -p udp --dport 22000 -j ACCEPT
|
||||
iptables -I INPUT -m state --state NEW -p udp --dport 21027 -j ACCEPT
|
||||
'';
|
||||
};
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PermitRootLogin = "yes";
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
{ config, lib, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ config, pkgs, modulesPath, unstable, sops, ... }: let
|
||||
{ config, pkgs, unstable, sops, ... }: let
|
||||
matrixDomain = "swatrix.swarsel.win";
|
||||
in {
|
||||
|
||||
|
|
|
|||
|
|
@ -18,12 +18,16 @@
|
|||
|
||||
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||
|
||||
proxmoxLXC.manageNetwork = true; # manage network myself
|
||||
proxmoxLXC.manageHostName = false; # manage hostname myself
|
||||
networking.hostName = "TEMPLATE"; # Define your hostname.
|
||||
networking.useDHCP = true;
|
||||
networking.enableIPv6 = false;
|
||||
networking.firewall.enable = false;
|
||||
proxmoxLXC = {
|
||||
manageNetwork = true; # manage network myself
|
||||
manageHostName = false; # manage hostname myself
|
||||
};
|
||||
networking = {
|
||||
hostName = "TEMPLATE"; # Define your hostname.
|
||||
useDHCP = true;
|
||||
enableIPv6 = false;
|
||||
firewall.enable = false;
|
||||
};
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PermitRootLogin = "yes";
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
{ lib, ... }:
|
||||
|
||||
{
|
||||
imports = [ ];
|
||||
|
|
|
|||
|
|
@ -29,24 +29,22 @@
|
|||
|
||||
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/sops" ];
|
||||
sops.defaultSopsFile = "/.dotfiles/secrets/calibre/secrets.yaml";
|
||||
sops.validateSopsFiles = false;
|
||||
sops.secrets.kavita = { owner = "kavita";};
|
||||
# sops.secrets.smbuser = { };
|
||||
# sops.secrets.smbpassword = { };
|
||||
# sops.secrets.smbdomain = { };
|
||||
# sops.templates."smb.cred".content = ''
|
||||
# user=${config.sops.placeholder.smbuser}
|
||||
# password=${config.sops.placeholder.smbpassword}
|
||||
# domain=${config.sops.placeholder.smbdomain}
|
||||
# '';
|
||||
proxmoxLXC.manageNetwork = true; # manage network myself
|
||||
proxmoxLXC.manageHostName = false; # manage hostname myself
|
||||
networking.hostName = "calibre"; # Define your hostname.
|
||||
networking.useDHCP = true;
|
||||
networking.enableIPv6 = false;
|
||||
networking.firewall.enable = false;
|
||||
sops = {
|
||||
age.sshKeyPaths = [ "/etc/ssh/sops" ];
|
||||
defaultSopsFile = "/.dotfiles/secrets/calibre/secrets.yaml";
|
||||
validateSopsFiles = false;
|
||||
secrets.kavita = { owner = "kavita";};
|
||||
};
|
||||
proxmoxLXC = {
|
||||
manageNetwork = true; # manage network myself
|
||||
manageHostName = false; # manage hostname myself
|
||||
};
|
||||
networking = {
|
||||
hostName = "calibre"; # Define your hostname.
|
||||
useDHCP = true;
|
||||
enableIPv6 = false;
|
||||
firewall.enable = false;
|
||||
};
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PermitRootLogin = "yes";
|
||||
|
|
@ -61,35 +59,6 @@
|
|||
nswitch = "cd /.dotfiles; git pull; nixos-rebuild --flake .#$(hostname) switch; cd -;";
|
||||
};
|
||||
|
||||
|
||||
# services.calibre-server = {
|
||||
# enable = true;
|
||||
# user = "calibre-server";
|
||||
# auth.enable = true;
|
||||
# auth.userDb = "/srv/calibre/users.sqlite";
|
||||
# libraries = [
|
||||
# /media/Books/main
|
||||
# /media/Books/diverse
|
||||
# /media/Books/language
|
||||
# /media/Books/science
|
||||
# /media/Books/sport
|
||||
# /media/Books/novels
|
||||
# ];
|
||||
# };
|
||||
|
||||
# services.calibre-web = {
|
||||
# enable = true;
|
||||
# user = "calibre-web";
|
||||
# group = "calibre-web";
|
||||
# listen.port = 8083;
|
||||
# listen.ip = "0.0.0.0";
|
||||
# options = {
|
||||
# enableBookUploading = true;
|
||||
# enableKepubify = true;
|
||||
# enableBookConversion = true;
|
||||
# };
|
||||
# };
|
||||
|
||||
services.kavita = {
|
||||
enable = true;
|
||||
user = "kavita";
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
{ lib, ... }:
|
||||
|
||||
{
|
||||
imports = [ ];
|
||||
|
|
|
|||
|
|
@ -31,16 +31,16 @@
|
|||
|
||||
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||
|
||||
# sops.age.sshKeyPaths = [ "/etc/ssh/sops" ];
|
||||
# sops.defaultSopsFile = "/.dotfiles/secrets/jellyfin/secrets.yaml";
|
||||
# sops.validateSopsFiles = false;
|
||||
|
||||
proxmoxLXC.manageNetwork = true; # manage network myself
|
||||
proxmoxLXC.manageHostName = false; # manage hostname myself
|
||||
networking.hostName = "jellyfin"; # Define your hostname.
|
||||
networking.useDHCP = true;
|
||||
networking.enableIPv6 = false;
|
||||
networking.firewall.enable = false;
|
||||
proxmoxLXC = {
|
||||
manageNetwork = true; # manage network myself
|
||||
manageHostName = false; # manage hostname myself
|
||||
};
|
||||
networking = {
|
||||
hostName = "jellyfin"; # Define your hostname.
|
||||
useDHCP = true;
|
||||
enableIPv6 = false;
|
||||
firewall.enable = false;
|
||||
};
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PermitRootLogin = "yes";
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
{ lib, ... }:
|
||||
|
||||
{
|
||||
imports = [ ];
|
||||
|
|
|
|||
|
|
@ -1,18 +1,14 @@
|
|||
{ config, pkgs, modulesPath, unstable, sops, ... }: let
|
||||
{ config, pkgs, modulesPath, sops, ... }: let
|
||||
matrixDomain = "matrix2.swarsel.win";
|
||||
in {
|
||||
|
||||
|
||||
services.xserver = {
|
||||
services = {
|
||||
xserver = {
|
||||
layout = "us";
|
||||
xkbVariant = "altgr-intl";
|
||||
};
|
||||
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||
proxmoxLXC.manageNetwork = true; # manage network myself
|
||||
proxmoxLXC.manageHostName = false; # manage hostname myself
|
||||
networking.useDHCP = true;
|
||||
networking.enableIPv6 = false;
|
||||
services.openssh = {
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings.PermitRootLogin = "yes";
|
||||
listenAddresses = [{
|
||||
|
|
@ -20,6 +16,20 @@ in {
|
|||
addr = "0.0.0.0";
|
||||
}];
|
||||
};
|
||||
};
|
||||
|
||||
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||
|
||||
proxmoxLXC = {
|
||||
manageNetwork = true; # manage network myself
|
||||
manageHostName = false; # manage hostname myself
|
||||
};
|
||||
|
||||
networking = {
|
||||
useDHCP = true;
|
||||
enableIPv6 = false;
|
||||
};
|
||||
|
||||
users.users.root.openssh.authorizedKeys.keyFiles = [
|
||||
../../../secrets/keys/authorized_keys
|
||||
];
|
||||
|
|
@ -38,8 +48,10 @@ in {
|
|||
# this module is hence not in the modules list, we add it ourselves
|
||||
];
|
||||
|
||||
networking.hostName = "matrix"; # Define your hostname.
|
||||
networking.firewall.enable = false;
|
||||
networking = {
|
||||
hostName = "matrix"; # Define your hostname.
|
||||
firewall.enable = false;
|
||||
};
|
||||
environment.systemPackages = with pkgs; [
|
||||
git
|
||||
gnupg
|
||||
|
|
@ -49,36 +61,42 @@ in {
|
|||
ffmpeg
|
||||
];
|
||||
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/sops" ];
|
||||
sops.defaultSopsFile = "/.dotfiles/secrets/matrix/secrets.yaml";
|
||||
sops.validateSopsFiles = false;
|
||||
sops.secrets.matrixsharedsecret = {owner="matrix-synapse";};
|
||||
sops.templates."matrix_user_register.sh".content = ''
|
||||
sops = {
|
||||
age.sshKeyPaths = [ "/etc/ssh/sops" ];
|
||||
defaultSopsFile = "/.dotfiles/secrets/matrix/secrets.yaml";
|
||||
validateSopsFiles = false;
|
||||
secrets = {
|
||||
matrixsharedsecret = {owner="matrix-synapse";};
|
||||
mautrixtelegram_as = {owner="matrix-synapse";};
|
||||
mautrixtelegram_hs = {owner="matrix-synapse";};
|
||||
mautrixtelegram_api_id = {owner="matrix-synapse";};
|
||||
mautrixtelegram_api_hash = {owner="matrix-synapse";};
|
||||
};
|
||||
templates = {
|
||||
"matrix_user_register.sh".content = ''
|
||||
register_new_matrix_user -k ${config.sops.placeholder.matrixsharedsecret} http://localhost:8008
|
||||
'';
|
||||
sops.templates.matrixshared.owner = "matrix-synapse";
|
||||
sops.templates.matrixshared.content = ''
|
||||
matrixshared = {
|
||||
owner = "matrix-synapse";
|
||||
content = ''
|
||||
registration_shared_secret: ${config.sops.placeholder.matrixsharedsecret}
|
||||
'';
|
||||
sops.secrets.mautrixtelegram_as = {owner="matrix-synapse";};
|
||||
sops.secrets.mautrixtelegram_hs = {owner="matrix-synapse";};
|
||||
sops.secrets.mautrixtelegram_api_id = {owner="matrix-synapse";};
|
||||
sops.secrets.mautrixtelegram_api_hash = {owner="matrix-synapse";};
|
||||
sops.templates.mautrixtelegram.owner = "matrix-synapse";
|
||||
sops.templates.mautrixtelegram.content = ''
|
||||
};
|
||||
mautrixtelegram = {
|
||||
owner = "matrix-synapse";
|
||||
content = ''
|
||||
MAUTRIX_TELEGRAM_APPSERVICE_AS_TOKEN=${config.sops.placeholder.mautrixtelegram_as}
|
||||
MAUTRIX_TELEGRAM_APPSERVICE_HS_TOKEN=${config.sops.placeholder.mautrixtelegram_hs}
|
||||
MAUTRIX_TELEGRAM_TELEGRAM_API_ID=${config.sops.placeholder.mautrixtelegram_api_id}
|
||||
MAUTRIX_TELEGRAM_TELEGRAM_API_HASH=${config.sops.placeholder.mautrixtelegram_api_hash}
|
||||
'';
|
||||
# sops.secrets.mautrixwhatsapp_shared = {owner="matrix-synapse";};
|
||||
# sops.templates.mautrixwhatsapp.owner = "matrix-synapse";
|
||||
# sops.templates.mautrixwhatsapp.content = ''
|
||||
# MAUTRIX_WHATSAPP_BRIDGE_LOGIN_SHARED_SECRET=${config.sops.placeholder.mautrixwhatsapp_shared}
|
||||
# '';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.postgresql.enable = true;
|
||||
services.postgresql.initialScript = pkgs.writeText "synapse-init.sql" ''
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
initialScript = pkgs.writeText "synapse-init.sql" ''
|
||||
CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
|
||||
CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
|
||||
TEMPLATE template0
|
||||
|
|
@ -100,21 +118,20 @@ in {
|
|||
LC_COLLATE = "C"
|
||||
LC_CTYPE = "C";
|
||||
'';
|
||||
};
|
||||
|
||||
services.matrix-synapse = {
|
||||
settings.app_service_config_files = [
|
||||
enable = true;
|
||||
settings = {
|
||||
app_service_config_files = [
|
||||
"/var/lib/matrix-synapse/telegram-registration.yaml"
|
||||
"/var/lib/matrix-synapse/whatsapp-registration.yaml"
|
||||
"/var/lib/matrix-synapse/signal-registration.yaml"
|
||||
"/var/lib/matrix-synapse/doublepuppet.yaml"
|
||||
];
|
||||
enable = true;
|
||||
settings.server_name = matrixDomain;
|
||||
settings.public_baseurl = "https://${matrixDomain}";
|
||||
extraConfigFiles = [
|
||||
config.sops.templates.matrixshared.path
|
||||
];
|
||||
settings.listeners = [
|
||||
server_name = matrixDomain;
|
||||
public_baseurl = "https://${matrixDomain}";
|
||||
listeners = [
|
||||
{ port = 8008;
|
||||
bind_addresses = [ "0.0.0.0" ];
|
||||
type = "http";
|
||||
|
|
@ -129,6 +146,10 @@ in {
|
|||
}
|
||||
];
|
||||
};
|
||||
extraConfigFiles = [
|
||||
config.sops.templates.matrixshared.path
|
||||
];
|
||||
};
|
||||
|
||||
services.mautrix-telegram = {
|
||||
enable = true;
|
||||
|
|
@ -151,9 +172,6 @@ in {
|
|||
database = "postgresql:///mautrix-telegram?host=/run/postgresql";
|
||||
};
|
||||
bridge = {
|
||||
# login_shared_secret_map = {
|
||||
# matrixDomain = "as_token:doublepuppet";
|
||||
# };
|
||||
relaybot.authless_portals = true;
|
||||
allow_avatar_remove = true;
|
||||
allow_contact_info = true;
|
||||
|
|
@ -166,12 +184,6 @@ in {
|
|||
"*" = "relaybot";
|
||||
"@swarsel:${matrixDomain}" = "admin";
|
||||
};
|
||||
# Animated stickers conversion requires additional packages in the
|
||||
# service's path.
|
||||
# If this isn't a fresh installation, clearing the bridge's uploaded
|
||||
# file cache might be necessary (make a database backup first!):
|
||||
# delete from telegram_file where \
|
||||
# mime_type in ('application/gzip', 'application/octet-stream')
|
||||
animated_sticker = {
|
||||
target = "gif";
|
||||
args = {
|
||||
|
|
@ -191,7 +203,6 @@ in {
|
|||
|
||||
services.mautrix-whatsapp = {
|
||||
enable = true;
|
||||
# environmentFile = config.sops.templates.mautrixwhatsapp.path;
|
||||
settings = {
|
||||
homeserver = {
|
||||
address = "http://localhost:8008";
|
||||
|
|
@ -238,7 +249,6 @@ in {
|
|||
|
||||
services.mautrix-signal = {
|
||||
enable = true;
|
||||
# environmentFile = config.sops.templates.mautrixwhatsapp.path;
|
||||
settings = {
|
||||
homeserver = {
|
||||
address = "http://localhost:8008";
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
{ lib, ... }:
|
||||
|
||||
{
|
||||
imports = [ ];
|
||||
|
|
|
|||
|
|
@ -20,19 +20,25 @@
|
|||
|
||||
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/sops" ];
|
||||
sops.defaultSopsFile = "/.dotfiles/secrets/nginx/secrets.yaml";
|
||||
sops.validateSopsFiles = false;
|
||||
sops.secrets.dnstokenfull = {owner="acme";};
|
||||
sops.templates."certs.secret".content = ''
|
||||
sops = {
|
||||
age.sshKeyPaths = [ "/etc/ssh/sops" ];
|
||||
defaultSopsFile = "/.dotfiles/secrets/nginx/secrets.yaml";
|
||||
validateSopsFiles = false;
|
||||
secrets.dnstokenfull = {owner="acme";};
|
||||
templates."certs.secret".content = ''
|
||||
CF_DNS_API_TOKEN=${config.sops.placeholder.dnstokenfull}
|
||||
'';
|
||||
proxmoxLXC.manageNetwork = true; # manage network myself
|
||||
proxmoxLXC.manageHostName = false; # manage hostname myself
|
||||
networking.hostName = "nginx"; # Define your hostname.
|
||||
networking.useDHCP = true;
|
||||
networking.enableIPv6 = false;
|
||||
networking.firewall.enable = false;
|
||||
};
|
||||
proxmoxLXC = {
|
||||
manageNetwork = true; # manage network myself
|
||||
manageHostName = false; # manage hostname myself
|
||||
};
|
||||
networking = {
|
||||
hostName = "nginx"; # Define your hostname.
|
||||
useDHCP = true;
|
||||
enableIPv6 = false;
|
||||
firewall.enable = false;
|
||||
};
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PermitRootLogin = "yes";
|
||||
|
|
@ -195,8 +201,4 @@
|
|||
};
|
||||
};
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
{ lib, ... }:
|
||||
|
||||
{
|
||||
imports = [ ];
|
||||
|
|
|
|||
|
|
@ -9,16 +9,12 @@
|
|||
|
||||
|
||||
|
||||
services.xserver = {
|
||||
services = {
|
||||
xserver = {
|
||||
layout = "us";
|
||||
xkbVariant = "altgr-intl";
|
||||
};
|
||||
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||
proxmoxLXC.manageNetwork = true; # manage network myself
|
||||
proxmoxLXC.manageHostName = false; # manage hostname myself
|
||||
networking.useDHCP = true;
|
||||
networking.enableIPv6 = false;
|
||||
services.openssh = {
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings.PermitRootLogin = "yes";
|
||||
listenAddresses = [{
|
||||
|
|
@ -26,6 +22,20 @@
|
|||
addr = "0.0.0.0";
|
||||
}];
|
||||
};
|
||||
};
|
||||
|
||||
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||
|
||||
proxmoxLXC = {
|
||||
manageNetwork = true; # manage network myself
|
||||
manageHostName = false; # manage hostname myself
|
||||
};
|
||||
|
||||
networking = {
|
||||
useDHCP = true;
|
||||
enableIPv6 = false;
|
||||
};
|
||||
|
||||
users.users.root.openssh.authorizedKeys.keyFiles = [
|
||||
../../../secrets/keys/authorized_keys
|
||||
];
|
||||
|
|
@ -52,13 +62,17 @@
|
|||
ssh-to-age
|
||||
];
|
||||
|
||||
networking.hostName = "paperless"; # Define your hostname.
|
||||
networking.firewall.enable = false;
|
||||
networking = {
|
||||
hostName = "paperless"; # Define your hostname.
|
||||
firewall.enable = false;
|
||||
};
|
||||
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/sops" ];
|
||||
sops.defaultSopsFile = "/root/.dotfiles/secrets/paperless/secrets.yaml";
|
||||
sops.validateSopsFiles = false;
|
||||
sops.secrets.admin = { owner = "paperless";};
|
||||
sops = {
|
||||
age.sshKeyPaths = [ "/etc/ssh/sops" ];
|
||||
defaultSopsFile = "/root/.dotfiles/secrets/paperless/secrets.yaml";
|
||||
validateSopsFiles = false;
|
||||
secrets.admin = { owner = "paperless";};
|
||||
};
|
||||
|
||||
services.paperless = {
|
||||
enable = true;
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
{ lib, ... }:
|
||||
|
||||
{
|
||||
imports = [ ];
|
||||
|
|
|
|||
|
|
@ -9,16 +9,12 @@
|
|||
|
||||
|
||||
|
||||
services.xserver = {
|
||||
services = {
|
||||
xserver = {
|
||||
layout = "us";
|
||||
xkbVariant = "altgr-intl";
|
||||
};
|
||||
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||
proxmoxLXC.manageNetwork = true; # manage network myself
|
||||
proxmoxLXC.manageHostName = false; # manage hostname myself
|
||||
networking.useDHCP = true;
|
||||
networking.enableIPv6 = false;
|
||||
services.openssh = {
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings.PermitRootLogin = "yes";
|
||||
listenAddresses = [{
|
||||
|
|
@ -26,6 +22,20 @@
|
|||
addr = "0.0.0.0";
|
||||
}];
|
||||
};
|
||||
};
|
||||
|
||||
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||
|
||||
proxmoxLXC = {
|
||||
manageNetwork = true; # manage network myself
|
||||
manageHostName = false; # manage hostname myself
|
||||
};
|
||||
|
||||
networking = {
|
||||
useDHCP = true;
|
||||
enableIPv6 = false;
|
||||
};
|
||||
|
||||
users.users.root.openssh.authorizedKeys.keyFiles = [
|
||||
../../../secrets/keys/authorized_keys
|
||||
];
|
||||
|
|
@ -40,7 +50,9 @@
|
|||
|
||||
proxmoxLXC.privileged = true; # manage hostname myself
|
||||
|
||||
users.groups.lxc_pshares = {
|
||||
users = {
|
||||
groups = {
|
||||
lxc_pshares = {
|
||||
gid = 110000;
|
||||
members = [
|
||||
"navidrome"
|
||||
|
|
@ -49,32 +61,38 @@
|
|||
];
|
||||
};
|
||||
|
||||
users.groups.navidrome = {
|
||||
navidrome = {
|
||||
gid = 61593;
|
||||
};
|
||||
|
||||
users.groups.mpd = {};
|
||||
mpd = {};
|
||||
};
|
||||
|
||||
users.users.navidrome = {
|
||||
users = {
|
||||
navidrome = {
|
||||
isSystemUser = true;
|
||||
uid = 61593;
|
||||
group = "navidrome";
|
||||
extraGroups = [ "audio" "utmp" ];
|
||||
};
|
||||
|
||||
users.users.mpd = {
|
||||
mpd = {
|
||||
isSystemUser = true;
|
||||
group = "mpd";
|
||||
extraGroups = [ "audio" "utmp" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
sound = {
|
||||
enable = true;
|
||||
};
|
||||
|
||||
hardware.enableAllFirmware = true;
|
||||
networking.hostName = "sound"; # Define your hostname.
|
||||
networking.firewall.enable = false;
|
||||
networking = {
|
||||
hostName = "sound"; # Define your hostname.
|
||||
firewall.enable = false;
|
||||
};
|
||||
environment.systemPackages = with pkgs; [
|
||||
git
|
||||
gnupg
|
||||
|
|
@ -84,10 +102,12 @@
|
|||
mpv
|
||||
];
|
||||
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/sops" ];
|
||||
sops.defaultSopsFile = "/.dotfiles/secrets/sound/secrets.yaml";
|
||||
sops.validateSopsFiles = false;
|
||||
sops.secrets.mpdpass = { owner = "mpd";};
|
||||
sops = {
|
||||
age.sshKeyPaths = [ "/etc/ssh/sops" ];
|
||||
defaultSopsFile = "/.dotfiles/secrets/sound/secrets.yaml";
|
||||
validateSopsFiles = false;
|
||||
secrets.mpdpass = { owner = "mpd";};
|
||||
};
|
||||
|
||||
services.navidrome = {
|
||||
enable = true;
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
{ lib, ... }:
|
||||
|
||||
{
|
||||
imports = [ ];
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ config, pkgs, modulesPath, ... }:
|
||||
{ pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
|
||||
|
|
@ -9,16 +9,12 @@
|
|||
|
||||
|
||||
|
||||
services.xserver = {
|
||||
services = {
|
||||
xserver = {
|
||||
layout = "us";
|
||||
xkbVariant = "altgr-intl";
|
||||
};
|
||||
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||
proxmoxLXC.manageNetwork = true; # manage network myself
|
||||
proxmoxLXC.manageHostName = false; # manage hostname myself
|
||||
networking.useDHCP = true;
|
||||
networking.enableIPv6 = false;
|
||||
services.openssh = {
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings.PermitRootLogin = "yes";
|
||||
listenAddresses = [{
|
||||
|
|
@ -26,6 +22,20 @@
|
|||
addr = "0.0.0.0";
|
||||
}];
|
||||
};
|
||||
};
|
||||
|
||||
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||
|
||||
proxmoxLXC = {
|
||||
manageNetwork = true; # manage network myself
|
||||
manageHostName = false; # manage hostname myself
|
||||
};
|
||||
|
||||
networking = {
|
||||
useDHCP = true;
|
||||
enableIPv6 = false;
|
||||
};
|
||||
|
||||
users.users.root.openssh.authorizedKeys.keyFiles = [
|
||||
../../../secrets/keys/authorized_keys
|
||||
];
|
||||
|
|
@ -56,18 +66,16 @@
|
|||
};
|
||||
|
||||
hardware.enableAllFirmware = true;
|
||||
networking.hostName = "spotifyd"; # Define your hostname.
|
||||
networking.firewall.enable = false;
|
||||
networking = {
|
||||
hostName = "spotifyd"; # Define your hostname.
|
||||
firewall.enable = false;
|
||||
};
|
||||
environment.systemPackages = with pkgs; [
|
||||
git
|
||||
gnupg
|
||||
ssh-to-age
|
||||
];
|
||||
|
||||
# sops.age.sshKeyPaths = [ "/etc/ssh/sops" ];
|
||||
# sops.defaultSopsFile = "/.dotfiles/secrets/spotifyd/secrets.yaml";
|
||||
# sops.validateSopsFiles = false;
|
||||
|
||||
services.spotifyd = {
|
||||
enable = true;
|
||||
settings = {
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
{ lib, ... }:
|
||||
|
||||
{
|
||||
imports = [ ];
|
||||
|
|
|
|||
|
|
@ -44,62 +44,48 @@
|
|||
|
||||
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/sops" ];
|
||||
sops.defaultSopsFile = "/.dotfiles/secrets/transmission/secrets.yaml";
|
||||
sops.validateSopsFiles = false;
|
||||
sops = {
|
||||
age.sshKeyPaths = [ "/etc/ssh/sops" ];
|
||||
defaultSopsFile = "/.dotfiles/secrets/transmission/secrets.yaml";
|
||||
validateSopsFiles = false;
|
||||
};
|
||||
|
||||
boot.kernelModules = [ "tun" ];
|
||||
proxmoxLXC.manageNetwork = true; # manage network myself
|
||||
proxmoxLXC.manageHostName = false; # manage hostname myself
|
||||
networking.hostName = "transmission"; # Define your hostname.
|
||||
networking.useDHCP = true;
|
||||
networking.enableIPv6 = false;
|
||||
networking.firewall.enable = false;
|
||||
|
||||
services.radarr = {
|
||||
enable = true;
|
||||
proxmoxLXC = {
|
||||
manageNetwork = true; # manage network myself
|
||||
manageHostName = false; # manage hostname myself
|
||||
};
|
||||
networking = {
|
||||
hostName = "transmission"; # Define your hostname.
|
||||
useDHCP = true;
|
||||
enableIPv6 = false;
|
||||
firewall.enable = false;
|
||||
};
|
||||
|
||||
services.readarr = {
|
||||
services = {
|
||||
radarr = {
|
||||
enable = true;
|
||||
};
|
||||
services.sonarr = {
|
||||
readarr = {
|
||||
enable = true;
|
||||
};
|
||||
services.lidarr = {
|
||||
sonarr = {
|
||||
enable = true;
|
||||
};
|
||||
services.prowlarr = {
|
||||
lidarr = {
|
||||
enable = true;
|
||||
};
|
||||
prowlarr = {
|
||||
enable = true;
|
||||
};
|
||||
};
|
||||
|
||||
# networking.interfaces = {
|
||||
# lo = {
|
||||
# useDHCP = false;
|
||||
# ipv4.addresses = [
|
||||
# { address = "127.0.0.1"; prefixLength = 8; }
|
||||
# ];
|
||||
# };
|
||||
#
|
||||
# eth0 = {
|
||||
# useDHCP = true;
|
||||
# };
|
||||
# };
|
||||
|
||||
# networking.firewall.extraCommands = ''
|
||||
# sudo iptables -A OUTPUT ! -o lo -m owner --uid-owner vpn -j DROP
|
||||
# '';
|
||||
networking.iproute2 = {
|
||||
enable = true;
|
||||
rttablesExtraConfig = ''
|
||||
200 vpn
|
||||
'';
|
||||
};
|
||||
# boot.kernel.sysctl = {
|
||||
# "net.ipv4.conf.all.rp_filter" = 2;
|
||||
# "net.ipv4.conf.default.rp_filter" = 2;
|
||||
# "net.ipv4.conf.eth0.rp_filter" = 2;
|
||||
# };
|
||||
environment.etc = {
|
||||
"openvpn/iptables.sh" =
|
||||
{ source = ../../../scripts/server1/iptables.sh;
|
||||
|
|
@ -141,26 +127,22 @@
|
|||
nswitch = "cd /.dotfiles; git pull; nixos-rebuild --flake .#$(hostname) switch; cd -;";
|
||||
};
|
||||
|
||||
sops.secrets.vpnuser = {};
|
||||
sops.secrets.rpcuser = {owner="vpn";};
|
||||
sops.secrets.vpnpass = {};
|
||||
sops.secrets.rpcpass = {owner="vpn";};
|
||||
sops.secrets.vpnprot = {};
|
||||
sops.secrets.vpnloc = {};
|
||||
# sops.secrets.crlpem = {};
|
||||
# sops.secrets.capem = {};
|
||||
sops.templates."transmission-rpc".owner = "vpn";
|
||||
sops.templates."transmission-rpc".content = builtins.toJSON {
|
||||
sops = {
|
||||
templates = {
|
||||
"transmission-rpc" = {
|
||||
owner = "vpn";
|
||||
content = builtins.toJSON {
|
||||
rpc-username = config.sops.placeholder.rpcuser;
|
||||
rpc-password = config.sops.placeholder.rpcpass;
|
||||
};
|
||||
};
|
||||
|
||||
sops.templates.pia.content = ''
|
||||
pia.content = ''
|
||||
${config.sops.placeholder.vpnuser}
|
||||
${config.sops.placeholder.vpnpass}
|
||||
'';
|
||||
|
||||
sops.templates.vpn.content = ''
|
||||
vpn.content = ''
|
||||
client
|
||||
dev tun
|
||||
proto ${config.sops.placeholder.vpnprot}
|
||||
|
|
@ -188,71 +170,20 @@
|
|||
dhcp-option DNS 8.8.8.8
|
||||
route-noexec
|
||||
'';
|
||||
|
||||
# services.pia.enable = true;
|
||||
# services.pia.authUserPass.username = "na";
|
||||
# services.pia.authUserPass.password = "na";
|
||||
|
||||
|
||||
# systemd.services.openvpn-vpn = {
|
||||
# wantedBy = [ "multi-user.target" ];
|
||||
# after = [ "network.target" ];
|
||||
# description = "OpenVPN connection to pia";
|
||||
# serviceConfig = {
|
||||
# Type = "forking";
|
||||
# RuntimeDirectory="openvpn";
|
||||
# PrivateTmp=true;
|
||||
# KillMode="mixed";
|
||||
# ExecStart = ''@${pkgs.openvpn}/sbin/openvpn openvpn --daemon ovpn-pia --status /run/openvpn/pia.status 10 --cd /etc/openvpn --script-security 2 --config ${config.sops.templates.vpn.path} --writepid /run/openvpn/pia.pid'';
|
||||
# PIDFile=''/run/openvpn/pia.pid'';
|
||||
# ExecReload=''/run/current-system/sw/bin/kill -HUP $MAINPID'';
|
||||
# WorkingDirectory="/etc/openvpn";
|
||||
# Restart="on-failure";
|
||||
# RestartSec=30;
|
||||
# ProtectSystem="yes";
|
||||
# DeviceAllow=["/dev/null rw" "/dev/net/tun rw"];
|
||||
# };
|
||||
# };
|
||||
};
|
||||
secrets = {
|
||||
vpnuser = {};
|
||||
rpcuser = {owner="vpn";};
|
||||
vpnpass = {};
|
||||
rpcpass = {owner="vpn";};
|
||||
vpnprot = {};
|
||||
vpnloc = {};
|
||||
};
|
||||
};
|
||||
services.openvpn.servers = {
|
||||
pia = {
|
||||
autoStart = false;
|
||||
updateResolvConf = true;
|
||||
# up = ''
|
||||
# export INTERFACE="tun0"
|
||||
# export VPNUSER="vpn"
|
||||
# export LOCALIP="192.168.1.191"
|
||||
# export NETIF="eth0"
|
||||
# export VPNIF="tun0"
|
||||
# export GATEWAYIP=$(ifconfig $VPNIF | egrep -o '([0-9]{1,3}\.){3}[0-9]{1,3}' | egrep -v '255|(127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})' | tail -n1)
|
||||
# iptables -F -t nat
|
||||
# iptables -F -t mangle
|
||||
# iptables -F -t filter
|
||||
# iptables -t mangle -A OUTPUT -j CONNMARK --restore-mark
|
||||
# iptables -t mangle -A OUTPUT ! --dest $LOCALIP -m owner --uid-owner $VPNUSER -j MARK --set-mark 0x1
|
||||
# iptables -t mangle -A OUTPUT --dest $LOCALIP -p udp --dport 53 -m owner --uid-owner $VPNUSER -j MARK --set-mark 0x1
|
||||
# iptables -t mangle -A OUTPUT --dest $LOCALIP -p tcp --dport 53 -m owner --uid-owner $VPNUSER -j MARK --set-mark 0x1
|
||||
# iptables -t mangle -A OUTPUT ! --src $LOCALIP -j MARK --set-mark 0x1
|
||||
# iptables -t mangle -A OUTPUT -j CONNMARK --save-mark
|
||||
# iptables -A INPUT -i $INTERFACE -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||
# iptables -A INPUT -i $INTERFACE -j REJECT
|
||||
# iptables -A OUTPUT -o lo -m owner --uid-owner $VPNUSER -j ACCEPT
|
||||
# iptables -A OUTPUT -o $INTERFACE -m owner --uid-owner $VPNUSER -j ACCEPT
|
||||
# iptables -t nat -A POSTROUTING -o $INTERFACE -j MASQUERADE
|
||||
# iptables -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||
# iptables -A OUTPUT ! --src $LOCALIP -o $NETIF -j REJECT
|
||||
# if [[ `ip rule list | grep -c 0x1` == 0 ]]; then
|
||||
# ip rule add from all fwmark 0x1 lookup $VPNUSER
|
||||
# fi
|
||||
# ip route replace default via $GATEWAYIP table $VPNUSER
|
||||
# ip route append default via 127.0.0.1 dev lo table $VPNUSER
|
||||
# ip route flush cache
|
||||
# '';
|
||||
# down = "bash /etc/openvpn/update-resolv-conf";
|
||||
# these are outsourced to a local file, I am not sure if it can be done with sops-nix
|
||||
# authUserPass = {
|
||||
# username = "TODO:secrets";
|
||||
# password = "TODO:secrets";
|
||||
# };
|
||||
config = "config ${config.sops.templates.vpn.path}";
|
||||
};
|
||||
};
|
||||
|
|
@ -335,24 +266,5 @@
|
|||
};
|
||||
};
|
||||
|
||||
# services.nginx = {
|
||||
# enable = true;
|
||||
# virtualHosts = {
|
||||
|
||||
# "192.168.1.192" = {
|
||||
# locations = {
|
||||
# "/transmission" = {
|
||||
# proxyPass = "http://127.0.0.1:9091";
|
||||
# extraConfig = ''
|
||||
# proxy_set_header Host $host;
|
||||
# proxy_set_header X-Real-IP $remote_addr;
|
||||
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
# '';
|
||||
# };
|
||||
# };
|
||||
# };
|
||||
# };
|
||||
# };
|
||||
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
{ config, lib, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ config, pkgs, lib, fetchFromGitHub, ... }:
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
|
||||
|
|
@ -76,7 +76,7 @@
|
|||
};
|
||||
|
||||
keybindings = let
|
||||
modifier = config.wayland.windowManager.sway.config.modifier;
|
||||
inherit (config.wayland.windowManager.sway.config) modifier;
|
||||
in {
|
||||
"${modifier}+F2" = "exec brightnessctl set +5%";
|
||||
"${modifier}+F1"= "exec brightnessctl set 5%-";
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ config, lib, pkgs, inputs, ... }:
|
||||
{ lib, pkgs, ... }:
|
||||
|
||||
{
|
||||
|
||||
|
|
@ -71,7 +71,7 @@
|
|||
};
|
||||
|
||||
monospace = {
|
||||
package = (pkgs.nerdfonts.override { fonts = [ "FiraCode"]; });
|
||||
package = pkgs.nerdfonts.override { fonts = [ "FiraCode"]; };
|
||||
name = "FiraCode Nerd Font Mono";
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ config, pkgs, lib, fetchFromGitHub, ... }:
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
|
||||
|
|
@ -97,11 +97,11 @@
|
|||
];
|
||||
|
||||
|
||||
keybindings = let
|
||||
modifier = config.wayland.windowManager.sway.config.modifier;
|
||||
in {
|
||||
# keybindings = let
|
||||
# inherit (config.wayland.windowManager.sway.config) modifier;
|
||||
# in {
|
||||
|
||||
};
|
||||
# };
|
||||
|
||||
startup = [
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ config, lib, pkgs, inputs, ... }:
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
|
||||
|
|
@ -88,7 +88,7 @@
|
|||
};
|
||||
|
||||
monospace = {
|
||||
package = (pkgs.nerdfonts.override { fonts = [ "FiraCode"]; });
|
||||
package = pkgs.nerdfonts.override { fonts = [ "FiraCode"]; };
|
||||
name = "FiraCode Nerd Font Mono";
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -8,7 +8,6 @@
|
|||
outputs = {nixpkgs, ...}: let
|
||||
system = "x86_64-linux";
|
||||
pkgs = import nixpkgs { system = "x86_64-linux"; config.allowUnfree = true; };
|
||||
llvm = pkgs.llvmPackages_latest;
|
||||
in {
|
||||
devShells.${system}.default = pkgs.mkShell {
|
||||
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@
|
|||
rust-overlay.url = "github:oxalica/rust-overlay";
|
||||
};
|
||||
|
||||
outputs = {self, nixpkgs, rust-overlay, ...}: let
|
||||
outputs = { nixpkgs, rust-overlay, ...}: let
|
||||
system = "x86_64-linux";
|
||||
pkgs = import nixpkgs {
|
||||
inherit system;
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue