chore: update flake

2026-04-14 21:29:12 +02:00 · 2026-02-01 22:18:01 +01:00 · 2026-02-01 22:18:01 +01:00 · 52554d4f92
commit 52554d4f92
parent edd2c61b17
28 changed files with 1111 additions and 1025 deletions
--- a/modules/home/common/swayidle.nix
+++ b/modules/home/common/swayidle.nix
@ -22,12 +22,12 @@ in
          # { timeout = 600; command = ''${pkgs.sway}/bin/swaymsg "output * dpms off"; resumeCommand = "${pkgs.sway}/bin/swaymsg output * dpms on'';  }
          { timeout = 600; command = "${suspend}"; }
        ];
-        events = [
+        events = {
          # { event = "before-sleep"; command = "${lib.getExe pkgs.swaylock-effects} -f --screenshots --clock --effect-blur 7x5 --effect-vignette 0.5:0.5 --fade-in 0.2"; }
          # { event = "after-resume"; command = "${swaylock} -f "; }
-          { event = "before-sleep"; command = "${swaylock} -f "; }
-          { event = "lock"; command = "${swaylock} -f "; }
-        ];
+          before-sleep = "${swaylock} -f ";
+          lock = "${swaylock} -f ";
+        };
      };
  };

--- a/modules/home/common/vesktop-tray.nix
+++ b/modules/home/common/vesktop-tray.nix
@ -19,7 +19,7 @@
      };

      Service = {
-        ExecStart = "${pkgs.vesktop}/bin/vesktop --start-minimized --enable-speech-dispatcher --ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime";
+        ExecStart = "${pkgs.vesktop}/bin/vesktop --start-minimized --ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime";
      };
    };
  };
--- a/modules/home/common/zsh.nix
+++ b/modules/home/common/zsh.nix
@ -1,6 +1,6 @@
-{ self, config, pkgs, lib, minimal, globals, confLib, type, ... }:
+{ self, config, pkgs, lib, minimal, globals, confLib, type, arch, ... }:
 let
-  inherit (config.swarselsystems) flakePath isNixos;
+  inherit (config.swarselsystems) flakePath isNixos homeDir;
  crocDomain = globals.services.croc.domain;
 in
 {
@ -20,7 +20,11 @@ in
      // lib.optionalAttrs (!minimal) {
        shellAliases = lib.recursiveUpdate
          {
-            hg = "history | grep";
+            nb = "nix build";
+            nbl = "nix build --builders \"\"";
+            nbo = "nix build --offline --builders \"\"";
+            nd = "nix develop";
+            ns = "nix shell";
            hmswitch = lib.mkIf (!isNixos) "${lib.getExe pkgs.home-manager} --flake ${flakePath}#$(hostname) switch |& nom";
            nswitch = lib.mkIf isNixos "cd ${flakePath}; swarsel-deploy $(hostname) switch; cd -;";
            ntest = lib.mkIf isNixos "cd ${flakePath}; swarsel-deploy $(hostname) test; cd -;";
@ -46,7 +50,8 @@ in
            boot-diff = "nix store diff-closures /run/*-system";
            gen-diff = "nix profile diff-closures --profile /nix/var/nix/profiles/system";
            cc = "wl-copy";
-            build-topology = "nix build --override-input topologyPrivate ${self}/files/topology/private .#topology.x86_64-linux.config.output";
+            build-topology = "nix build --override-input topologyPrivate ${self}/files/topology/private ${flakePath}#topology.${arch}.config.output";
+            build-topology-dev = "nix build --show-trace --override-input nix-topology ${homeDir}/Documents/Private/nix-topology --override-input topologyPrivate ${self}/files/topology/private ${flakePath}#topology.${arch}.config.output";
            build-iso = "nix build --print-out-paths .#live-iso";
            nix-review-local = "nix run nixpkgs#nixpkgs-review -- rev HEAD";
            nix-review-post = "nix run nixpkgs#nixpkgs-review -- pr --post-result --systems linux";
--- a/modules/nixos/client/nautilus.nix
+++ b/modules/nixos/client/nautilus.nix
@ -0,0 +1,10 @@
+{ lib, config, ... }:
+{
+  options.swarselmodules.nautilus = lib.mkEnableOption "nautilus config";
+  config = lib.mkIf config.swarselmodules.nautilus {
+    programs.nautilus-open-any-terminal = {
+      enable = true;
+      terminal = "kitty";
+    };
+  };
+}
--- a/modules/nixos/optional/microvm-guest.nix
+++ b/modules/nixos/optional/microvm-guest.nix
@ -1,4 +1,4 @@
-{ self, lib, config, inputs, microVMParent, nodes, globals, confLib, ... }:
+{ self, config, inputs, ... }:
 {
  imports = [
    inputs.disko.nixosModules.disko
@ -15,6 +15,7 @@
    inputs.stylix.nixosModules.stylix
    inputs.swarsel-nix.nixosModules.default
    inputs.nixos-nftables-firewall.nixosModules.default
+    inputs.pia.nixosModules.default

    (inputs.nixos-extra-modules + "/modules/interface-naming.nix")

--- a/modules/nixos/server/adguardhome.nix
+++ b/modules/nixos/server/adguardhome.nix
@ -70,7 +70,7 @@ in
          homeDomains) ++ [
          {
            domain = "smb.${globals.domains.main}";
-            answer = globals.networks.home-lan.vlans.services.hosts.storage.ipv4;
+            answer = globals.networks.home-lan.vlans.services.hosts.summers-storage.ipv4;
            enabled = true;
          }
        ];
--- a/modules/nixos/server/bastion.nix
+++ b/modules/nixos/server/bastion.nix
@ -1,14 +1,16 @@
-{ self, lib, config, withHomeManager, ... }:
+{ self, lib, config, withHomeManager, confLib, ... }:
 {
  options.swarselmodules.server.bastion = lib.mkEnableOption "enable bastion on server";
  config = lib.mkIf config.swarselmodules.server.bastion ({

    users = {
+      persistentIds.jump = confLib.mkIds 1001;
      groups = {
        jump = { };
      };
      users = {
-        "jump" = {
+        jump = {
+          autoSubUidGidRange = false;
          isNormalUser = true;
          useDefaultShell = true;
          group = lib.mkForce "jump";
--- a/modules/nixos/server/kanidm.nix
+++ b/modules/nixos/server/kanidm.nix
@ -93,58 +93,65 @@ in
      };
    };

-    systemd.services."generateSSLCert-${serviceName}" =
-      let
-        daysValid = 3650;
-        renewBeforeDays = 365;
-      in
-      {
-        before = [ "${serviceName}.service" ];
-        requiredBy = [ "${serviceName}.service" ];
-        after = [ "local-fs.target" ];
-        requires = [ "local-fs.target" ];
+    systemd.services = {
+      "generateSSLCert-${serviceName}" =
+        let
+          daysValid = 3650;
+          renewBeforeDays = 365;
+        in
+        {
+          before = [ "${serviceName}.service" ];
+          requiredBy = [ "${serviceName}.service" ];
+          after = [ "local-fs.target" ];
+          requires = [ "local-fs.target" ];

-        serviceConfig = {
-          Type = "oneshot";
-        };
+          serviceConfig = {
+            Type = "oneshot";
+          };

-        script = ''
-          set -eu
+          script = ''
+            set -eu

-          ${pkgs.coreutils}/bin/install -d -m 0755 ${certsDir}
-          ${if config.swarselsystems.isImpermanence then "${pkgs.coreutils}/bin/install -d -m 0755 /persist${certsDir}" else ""}
-          ${pkgs.coreutils}/bin/install -d -m 0750 ${privateDir}
-          ${if config.swarselsystems.isImpermanence then "${pkgs.coreutils}/bin/install -d -m 0750 /persist${privateDir}" else ""}
+            ${pkgs.coreutils}/bin/install -d -m 0755 ${certsDir}
+            ${if config.swarselsystems.isImpermanence then "${pkgs.coreutils}/bin/install -d -m 0755 /persist${certsDir}" else ""}
+            ${pkgs.coreutils}/bin/install -d -m 0750 ${privateDir}
+            ${if config.swarselsystems.isImpermanence then "${pkgs.coreutils}/bin/install -d -m 0750 /persist${privateDir}" else ""}

-          need_gen=0
-          if [ ! -f "${certPath}" ] || [ ! -f "${keyPath}" ]; then
-            need_gen=1
-          else
-            enddate="$(${pkgs.openssl}/bin/openssl x509 -noout -enddate -in "${certPath}" | cut -d= -f2)"
-            end_epoch="$(${pkgs.coreutils}/bin/date -d "$enddate" +%s)"
-            now_epoch="$(${pkgs.coreutils}/bin/date +%s)"
-            seconds_left=$(( end_epoch - now_epoch ))
-            days_left=$(( seconds_left / 86400 ))
-            if [ "$days_left" -lt ${toString renewBeforeDays} ]; then
+            need_gen=0
+            if [ ! -f "${certPath}" ] || [ ! -f "${keyPath}" ]; then
              need_gen=1
            else
-              echo 'Certificate exists and is still valid'
+              enddate="$(${pkgs.openssl}/bin/openssl x509 -noout -enddate -in "${certPath}" | cut -d= -f2)"
+              end_epoch="$(${pkgs.coreutils}/bin/date -d "$enddate" +%s)"
+              now_epoch="$(${pkgs.coreutils}/bin/date +%s)"
+              seconds_left=$(( end_epoch - now_epoch ))
+              days_left=$(( seconds_left / 86400 ))
+              if [ "$days_left" -lt ${toString renewBeforeDays} ]; then
+                need_gen=1
+              else
+                echo 'Certificate exists and is still valid'
+              fi
            fi
-          fi

-          if [ "$need_gen" -eq 1 ]; then
-            ${pkgs.openssl}/bin/openssl req -x509 -nodes -days ${toString daysValid} -newkey rsa:4096 -sha256 \
-              -keyout "${keyPath}" \
-              -out "${certPath}" \
-              -subj "/CN=${serviceDomain}" \
-              -addext "subjectAltName=DNS:${serviceDomain}"
+            if [ "$need_gen" -eq 1 ]; then
+              ${pkgs.openssl}/bin/openssl req -x509 -nodes -days ${toString daysValid} -newkey rsa:4096 -sha256 \
+                -keyout "${keyPath}" \
+                -out "${certPath}" \
+                -subj "/CN=${serviceDomain}" \
+                -addext "subjectAltName=DNS:${serviceDomain}"

-            chmod 0644 "${certPath}"
-            chmod 0600 "${keyPath}"
-            chown ${serviceUser}:${serviceGroup} "${certPath}" "${keyPath}"
-          fi
-        '';
+              chmod 0644 "${certPath}"
+              chmod 0600 "${keyPath}"
+              chown ${serviceUser}:${serviceGroup} "${certPath}" "${keyPath}"
+            fi
+          '';
+        };
+      kanidm = {
+        environment.KANIDM_TRUST_X_FORWARD_FOR = "true";
+        serviceConfig.RestartSec = "30";
      };
+    };
+


    # system.activationScripts."createPersistentStorageDirs" = lib.mkIf config.swarselsystems.isImpermanence {
@ -208,7 +215,7 @@ in
          # tls_key = config.sops.secrets.kanidm-self-signed-key.path;
          tls_key = keyPathBase;
          bindaddress = "0.0.0.0:${toString servicePort}";
-          trust_x_forward_for = true;
+          # trust_x_forward_for = true;
        };
        enableClient = true;
        clientSettings = {
@ -405,7 +412,6 @@ in
      };
    };

-    systemd.services.${serviceName}.serviceConfig.RestartSec = "30";

    nodes =
      let
--- a/modules/nixos/server/koillection.nix
+++ b/modules/nixos/server/koillection.nix
@ -1,6 +1,6 @@
 { self, lib, config, globals, dns, confLib, ... }:
 let
-  inherit (confLib.gen { name = "koillection"; port = 2282; dir = "/var/lib/koillection"; }) servicePort serviceName serviceUser serviceDir serviceDomain serviceAddress proxyAddress4 proxyAddress6;
+  inherit (confLib.gen { name = "koillection"; port = 2282; dir = "/var/lib/koillection"; }) servicePort serviceName serviceUser serviceDir serviceDomain serviceAddress proxyAddress4 proxyAddress6 topologyContainerName;
  inherit (confLib.static) isHome isProxied webProxy homeWebProxy dnsServer homeProxyIf webProxyIf homeServiceAddress nginxAccessRules;
  serviceDB = "koillection";

@ -24,7 +24,7 @@ in
      koillection-env-file = { inherit sopsFile; };
    };

-    topology.self.services.${serviceName} = {
+    topology.nodes.${topologyContainerName}.services.${serviceName} = {
      name = lib.swarselsystems.toCapitalized serviceName;
      info = "https://${serviceDomain}";
      icon = "${self}/files/topology-images/${serviceName}.png";
--- a/modules/nixos/server/mailserver.nix
+++ b/modules/nixos/server/mailserver.nix
@ -16,6 +16,15 @@ in
  };
  config = lib.mkIf config.swarselmodules.server.${serviceName} {

+    users = {
+      persistentIds = {
+        knot-resolver = confLib.mkIds 963;
+        postfix-tlspol = confLib.mkIds 962;
+        roundcube = confLib.mkIds 961;
+        redis-rspamd = confLib.mkIds 960;
+      };
+    };
+
    globals.services = {
      ${serviceName} = {
        domain = serviceDomain;
@ -65,11 +74,12 @@ in
      domains = [ baseDomain ];
      indexDir = "${serviceDir}/indices";
      openFirewall = true;
-      certificateScheme = "acme";
+      # certificateScheme = "acme";
      dmarcReporting.enable = true;
      enableSubmission = true;
      enableSubmissionSsl = true;
      enableImapSsl = true;
+      x509.useACMEHost = globals.domains.main;

      loginAccounts = {
        "${user1}@${baseDomain}" = {
--- a/modules/nixos/server/matrix.nix
+++ b/modules/nixos/server/matrix.nix
@ -1,4 +1,4 @@
-{ self, lib, config, pkgs, globals, dns, confLib, ... }:
+{ lib, config, pkgs, globals, dns, confLib, ... }:
 let
  inherit (config.swarselsystems) sopsFile;
  inherit (confLib.gen { name = "matrix"; user = "matrix-synapse"; port = 8008; }) servicePort serviceName serviceUser serviceGroup serviceDomain serviceAddress proxyAddress4 proxyAddress6;
@ -63,14 +63,6 @@ in

    # networking.firewall.allowedTCPPorts = [ servicePort federationPort ];

-    topology.self.services = lib.listToAttrs (map
-      (service:
-        lib.nameValuePair "mautrix-${service}" {
-          name = "mautrix-${service}";
-          icon = "${self}/files/topology-images/mautrix.png";
-        })
-      [ "whatsapp" "signal" "telegram" ]);
-
    systemd = {
      timers."restart-bridges" = {
        wantedBy = [ "timers.target" ];
--- a/modules/nixos/server/microbin.nix
+++ b/modules/nixos/server/microbin.nix
@ -12,6 +12,7 @@ in
  config = lib.mkIf config.swarselmodules.server.${serviceName} {

    users = {
+      persistentIds.${serviceName} = confLib.mkIds 964;
      groups.${serviceGroup} = { };

      users.${serviceUser} = {
--- a/modules/nixos/server/mpd.nix
+++ b/modules/nixos/server/mpd.nix
@ -1,4 +1,4 @@
-{ self, lib, config, pkgs, confLib, ... }:
+{ lib, config, pkgs, confLib, ... }:
 let
  inherit (config.swarselsystems) sopsFile;
  inherit (confLib.gen { name = "mpd"; port = 3254; }) servicePort serviceName serviceUser serviceGroup;
@ -30,10 +30,10 @@ in
      mpv
    ];

-    topology.self.services.${serviceName} = {
-      info = "http://localhost:${builtins.toString servicePort}";
-      icon = lib.mkForce "${self}/files/topology-images/mpd.png";
-    };
+    # topology.self.services.${serviceName} = {
+    #   info = "http://localhost:${builtins.toString servicePort}";
+    #   icon = lib.mkForce "${self}/files/topology-images/mpd.png";
+    # };

    environment.persistence."/state" = lib.mkIf config.swarselsystems.isMicroVM {
      directories = [{ directory = "/var/lib/${serviceName}"; user = "mpd"; group = "mpd"; }];
--- a/modules/nixos/server/shlink.nix
+++ b/modules/nixos/server/shlink.nix
@ -1,6 +1,6 @@
 { self, lib, config, dns, globals, confLib, ... }:
 let
-  inherit (confLib.gen { name = "shlink"; port = 8081; dir = "/var/lib/shlink"; }) servicePort serviceName serviceDomain serviceDir serviceAddress proxyAddress4 proxyAddress6;
+  inherit (confLib.gen { name = "shlink"; port = 8081; dir = "/var/lib/shlink"; }) servicePort serviceName serviceDomain serviceDir serviceAddress proxyAddress4 proxyAddress6 topologyContainerName;
  inherit (confLib.static) isHome isProxied webProxy homeWebProxy dnsServer homeProxyIf webProxyIf homeServiceAddress nginxAccessRules;

  containerRev = "sha256:1a697baca56ab8821783e0ce53eb4fb22e51bb66749ec50581adc0cb6d031d7a";
@ -31,6 +31,12 @@ in
      };
    };

+    topology.nodes.${topologyContainerName}.services.${serviceName} = {
+      name = lib.swarselsystems.toCapitalized serviceName;
+      info = "https://${serviceDomain}";
+      icon = "${self}/files/topology-images/${serviceName}.png";
+    };
+
    virtualisation.oci-containers.containers.${serviceName} = {
      image = "shlinkio/shlink@${containerRev}";
      environment = {
@ -77,12 +83,6 @@ in
      { directory = "/var/lib/containers"; }
    ];

-    topology.self.services.${serviceName} = {
-      name = lib.swarselsystems.toCapitalized serviceName;
-      info = "https://${serviceDomain}";
-      icon = "${self}/files/topology-images/${serviceName}.png";
-    };
-
    globals = {
      networks = {
        ${webProxyIf}.hosts = lib.mkIf isProxied {
--- a/modules/nixos/server/slink.nix
+++ b/modules/nixos/server/slink.nix
@ -1,6 +1,6 @@
 { lib, config, dns, globals, confLib, ... }:
 let
-  inherit (confLib.gen { name = "slink"; port = 3000; dir = "/var/lib/slink"; }) servicePort serviceName serviceDomain serviceDir serviceAddress proxyAddress4 proxyAddress6;
+  inherit (confLib.gen { name = "slink"; port = 3000; dir = "/var/lib/slink"; }) servicePort serviceName serviceDomain serviceDir serviceAddress proxyAddress4 proxyAddress6 topologyContainerName;
  inherit (confLib.static) isHome isProxied webProxy homeWebProxy dnsServer homeProxyIf webProxyIf homeServiceAddress nginxAccessRules;

  containerRev = "sha256:98b9442696f0a8cbc92f0447f54fa4bad227af5dcfd6680545fedab2ed28ddd9";
@ -15,6 +15,12 @@ in
      podman = true;
    };

+    topology.nodes.${topologyContainerName}.services.${serviceName} = {
+      name = lib.swarselsystems.toCapitalized serviceName;
+      info = "https://${serviceDomain}";
+      icon = "services.not-available";
+    };
+
    virtualisation.oci-containers.containers.${serviceName} = {
      image = "anirdev/slink@${containerRev}";
      environment = {
@ -54,12 +60,6 @@ in
      { directory = serviceDir; }
    ];

-    topology.self.services.${serviceName} = {
-      name = lib.swarselsystems.toCapitalized serviceName;
-      info = "https://${serviceDomain}";
-      icon = "services.not-available";
-    };
-
    globals = {
      networks = {
        ${webProxyIf}.hosts = lib.mkIf isProxied {
--- a/modules/nixos/server/ssh-builder.nix
+++ b/modules/nixos/server/ssh-builder.nix
@ -1,4 +1,4 @@
-{ self, pkgs, lib, config, ... }:
+{ self, pkgs, lib, config, confLib, ... }:
 let
  ssh-restrict = "restrict,pty,command=\"${wrapper-dispatch-ssh-nix}/bin/wrapper-dispatch-ssh-nix\" ";

@ -20,6 +20,7 @@ in
  options.swarselmodules.server.ssh-builder = lib.mkEnableOption "enable ssh-builder config on server";
  config = lib.mkIf config.swarselmodules.server.ssh-builder {
    users = {
+      persistentIds.builder = confLib.mkIds 965;
      groups.builder = { };
      users.builder = {
        useDefaultShell = true;
--- a/modules/nixos/server/transmission.nix
+++ b/modules/nixos/server/transmission.nix
@ -2,6 +2,7 @@
 let
  inherit (confLib.gen { name = "transmission"; port = 9091; }) serviceName servicePort serviceDomain;
  inherit (confLib.static) isHome homeServiceAddress homeWebProxy nginxAccessRules;
+  inherit (config.swarselsystems) sopsFile;

  lidarrUser = "lidarr";
  lidarrGroup = lidarrUser;
@ -23,6 +24,10 @@ in
  options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} and friends on server";
  config = lib.mkIf config.swarselmodules.server.${serviceName} {

+    sops.secrets = {
+      pia = { inherit sopsFile; };
+    };
+
    # this user/group section is probably unneeded
    users = {
      persistentIds = {
@ -107,6 +112,17 @@ in
    };

    services = {
+      pia = {
+        enable = true;
+        credentials.credentialsFile = config.sops.secrets.pia.path;
+        protocol = "wireguard";
+        autoConnect = {
+          enable = true;
+          region = "sweden";
+        };
+        portForwarding.enable = true;
+        dns.enable = true;
+      };
      radarr = {
        enable = true;
        user = radarrUser;
--- a/modules/shared/config-lib.nix
+++ b/modules/shared/config-lib.nix
@ -33,6 +33,8 @@ in
        serviceDir = dir;
        serviceAddress = address;
        serviceProxy = proxy;
+        serviceNode = config.node.name;
+        topologyContainerName = "${serviceNode}-${config.virtualisation.oci-containers.backend}-${name}";
        proxyAddress4 = globals.hosts.${proxy}.wanAddress4 or null;
        proxyAddress6 = globals.hosts.${proxy}.wanAddress6 or null;
      };