swarsel/.dotfiles
1
0
Fork 0
mirror of https://github.com/Swarsel/.dotfiles.git synced 2025-12-06 09:07:21 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat: add kanidm module

Browse source
This commit is contained in:
Leon Schwarzäugl 2025-06-09 05:02:01 +02:00
parent 616522bfa6
commit f87164088f
Signed by: swarsel
GPG key ID: 26A54C31F2A4FD84
9 changed files with 854 additions and 130 deletions
Download patch file Download diff file Expand all files Collapse all files

455
index.html
View file

@ -3,7 +3,7 @@
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<!-- 2025-06-09 Mo 03:26 -->
<!-- 2025-06-09 Mo 12:45 -->
<meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
<title>SwarselSystems: NixOS + Emacs Configuration</title>
@ -263,9 +263,9 @@
<li><a href="#h:7056b9a0-f38b-4bca-b2ba-ab34e2d73493">3.1.4.3. Home-manager only (default non-NixOS)</a></li>
<li><a href="#h:e1498bef-ec67-483d-bf02-76264e30be8e">3.1.4.4. ChaosTheatre (Demo Physical/VM)</a>
<ul>
<li><a href="#org7d36836">3.1.4.4.1. Main configuration</a></li>
<li><a href="#org96e39c3">3.1.4.4.2. NixOS dummy options configuration</a></li>
<li><a href="#org9944579">3.1.4.4.3. home-manager dummy options configuration</a></li>
<li><a href="#org9b449ff">3.1.4.4.1. Main configuration</a></li>
<li><a href="#org10cff1b">3.1.4.4.2. NixOS dummy options configuration</a></li>
<li><a href="#org0c539d3">3.1.4.4.3. home-manager dummy options configuration</a></li>
</ul>
</li>
</ul>
@ -305,7 +305,7 @@
<li><a href="#h:36d6c17c-6d91-4297-b76d-9d7feab6c1a0">3.2.1.27. fhs</a></li>
<li><a href="#h:814d5e7f-4b95-412d-b246-33f888514ec6">3.2.1.28. swarsel-displaypower</a></li>
<li><a href="#h:799579f3-ddd3-4f76-928a-a8c665980476">3.2.1.29. swarsel-mgba</a></li>
<li><a href="#org7169988">3.2.1.30. sshrm</a></li>
<li><a href="#orgda3c026">3.2.1.30. sshrm</a></li>
</ul>
</li>
<li><a href="#h:5e3e21e0-57af-4dad-b32f-6400af9b7aab">3.2.2. Overlays (additions, overrides, nixpkgs-stable)</a></li>
@ -313,28 +313,28 @@
<ul>
<li><a href="#h:14e68518-8ec7-48ec-b208-0e3d6d49954d">3.2.3.1. NixOS</a>
<ul>
<li><a href="#orgc40c880">3.2.3.1.1. Personal</a></li>
<li><a href="#org8b621b6">3.2.3.1.2. Chaostheatre</a></li>
<li><a href="#orgc447ea6">3.2.3.1.3. toto</a></li>
<li><a href="#org242a8a7">3.2.3.1.4. Work</a></li>
<li><a href="#org0af8026">3.2.3.1.5. Framework</a></li>
<li><a href="#org60114bf">3.2.3.1.6. AMD CPU</a></li>
<li><a href="#org006abd1">3.2.3.1.7. AMD GPU</a></li>
<li><a href="#org8b4acf6">3.2.3.1.8. Hibernation</a></li>
<li><a href="#orgc6b961c">3.2.3.1.9. BTRFS</a></li>
<li><a href="#orgb72a5aa">3.2.3.1.10. Local Server</a></li>
<li><a href="#org37ce6f2">3.2.3.1.11. OCI Sync Server</a></li>
<li><a href="#org9037d50">3.2.3.1.1. Personal</a></li>
<li><a href="#org4d186bc">3.2.3.1.2. Chaostheatre</a></li>
<li><a href="#orgb6e7397">3.2.3.1.3. toto</a></li>
<li><a href="#orgb297f59">3.2.3.1.4. Work</a></li>
<li><a href="#org2faed76">3.2.3.1.5. Framework</a></li>
<li><a href="#org9900420">3.2.3.1.6. AMD CPU</a></li>
<li><a href="#org895cc35">3.2.3.1.7. AMD GPU</a></li>
<li><a href="#org39be1cf">3.2.3.1.8. Hibernation</a></li>
<li><a href="#org7672d00">3.2.3.1.9. BTRFS</a></li>
<li><a href="#org1bda8d7">3.2.3.1.10. Local Server</a></li>
<li><a href="#org17d23c6">3.2.3.1.11. OCI Sync Server</a></li>
</ul>
</li>
<li><a href="#h:ced5841f-c088-4d88-b3a1-7d62aad8837b">3.2.3.2. home-manager</a>
<ul>
<li><a href="#orgb37c738">3.2.3.2.1. Personal</a></li>
<li><a href="#orgbf3722f">3.2.3.2.2. Chaostheatre</a></li>
<li><a href="#orgd8744f7">3.2.3.2.3. toto</a></li>
<li><a href="#org2e6004c">3.2.3.2.4. Work</a></li>
<li><a href="#orgd69a7ed">3.2.3.2.5. Framework</a></li>
<li><a href="#orged364f5">3.2.3.2.6. Darwin</a></li>
<li><a href="#orge7ba9f2">3.2.3.2.7. Local Server</a></li>
<li><a href="#org47e7345">3.2.3.2.1. Personal</a></li>
<li><a href="#orgcc5e0f5">3.2.3.2.2. Chaostheatre</a></li>
<li><a href="#org3185dd7">3.2.3.2.3. toto</a></li>
<li><a href="#org061d35f">3.2.3.2.4. Work</a></li>
<li><a href="#org367969f">3.2.3.2.5. Framework</a></li>
<li><a href="#org19a7899">3.2.3.2.6. Darwin</a></li>
<li><a href="#org22458da">3.2.3.2.7. Local Server</a></li>
</ul>
</li>
</ul>
@ -379,7 +379,7 @@
<li><a href="#h:f101daa2-604d-4553-99e2-f64b9c207f51">3.3.1.22.3. enable GVfs</a></li>
<li><a href="#h:08d213d5-a9f4-4309-8635-ba557b01dc7d">3.3.1.22.4. interception-tools: Make CAPS work as ESC/CTRL</a></li>
<li><a href="#h:82fbba41-3a46-4db7-aade-49e4c23fc475">3.3.1.22.5. power-profiles-daemon</a></li>
<li><a href="#orgf6a9187">3.3.1.22.6. SwayOSD</a></li>
<li><a href="#org8e440af">3.3.1.22.6. SwayOSD</a></li>
</ul>
</li>
<li><a href="#h:7a89b5e3-b700-4167-8b14-2b8172f33936">3.3.1.23. Hardware compatibility settings (Yubikey, Ledger, Keyboards) - udev rules</a>
@ -425,12 +425,13 @@
<li><a href="#h:5afeb311-ab86-4029-be53-2160f6d836c3">3.3.2.18. transmission</a></li>
<li><a href="#h:ad2787a2-7b1c-4326-aeff-9d8d6c3f591d">3.3.2.19. syncthing</a></li>
<li><a href="#h:b73ac8bf-b721-4563-9eff-973925c99a39">3.3.2.20. restic</a></li>
<li><a href="#h:a31c7192-e11d-4a26-915d-1bbc38e373d3">3.3.2.21. monitoring</a></li>
<li><a href="#h:a31c7192-e11d-4a26-915d-1bbc38e373d3">3.3.2.21. monitoring (Grafana)</a></li>
<li><a href="#h:23452a18-a0a1-4515-8612-ceb19bb5fc22">3.3.2.22. Jenkins</a></li>
<li><a href="#h:4e6824bc-c3db-485d-b543-4072e6283b62">3.3.2.23. Emacs elfeed (RSS Server)</a></li>
<li><a href="#h:9da3df74-6fc5-4ee1-a345-23ab4e8a613d">3.3.2.24. FreshRSS</a></li>
<li><a href="#h:a9965660-4358-4b9a-8c46-d55f28598344">3.3.2.25. forgejo (git server)</a></li>
<li><a href="#h:cb3f6552-7751-4f9a-b4c7-8d8ba5b255c4">3.3.2.26. Anki Sync Server</a></li>
<li><a href="#orgeb2a887">3.3.2.27. kanidm</a></li>
</ul>
</li>
<li><a href="#h:ac0cd8b3-06cf-4dca-ba73-6100c8fedb47">3.3.3. Darwin</a>
@ -445,11 +446,11 @@
<li><a href="#h:34db28fb-62f7-4597-a9ff-0de2991a8415">3.3.4.3. VmWare</a></li>
<li><a href="#h:fa8d9ec4-3e22-458a-9239-859cffe7f55c">3.3.4.4. Auto-login</a></li>
<li><a href="#h:5c41c4ee-22ca-405b-9e4f-cc4051634edd">3.3.4.5. nswitch-rcm</a></li>
<li><a href="#org1c6aa69">3.3.4.6. Framework</a></li>
<li><a href="#orge813212">3.3.4.7. AMD CPU</a></li>
<li><a href="#orga04a3e5">3.3.4.8. AMD GPU</a></li>
<li><a href="#org4db606b">3.3.4.9. Hibernation</a></li>
<li><a href="#orgb652890">3.3.4.10. BTRFS</a></li>
<li><a href="#org2fd6795">3.3.4.6. Framework</a></li>
<li><a href="#org28eaeed">3.3.4.7. AMD CPU</a></li>
<li><a href="#org4c4411c">3.3.4.8. AMD GPU</a></li>
<li><a href="#org8338221">3.3.4.9. Hibernation</a></li>
<li><a href="#org952308a">3.3.4.10. BTRFS</a></li>
<li><a href="#h:bbf2ecb6-c8ff-4462-b5d5-d45b28604ddf">3.3.4.11. work</a></li>
<li><a href="#h:3fc1d301-7bae-4678-9085-d12c23eed8ac">3.3.4.12. Minimal Install</a></li>
</ul>
@ -498,7 +499,7 @@
<li><a href="#h:cb812c8a-247c-4ce5-a00c-59332c2f5fb9">3.4.1.29.1. gnome-keyring</a></li>
<li><a href="#h:be6afd89-9e1e-40b6-8542-5c07a0ab780d">3.4.1.29.2. KDE Connect</a></li>
<li><a href="#h:99d05729-df35-4958-9940-3319d6a41359">3.4.1.29.3. Mako</a></li>
<li><a href="#org490abd7">3.4.1.29.4. SwayOSD</a></li>
<li><a href="#org978f035">3.4.1.29.4. SwayOSD</a></li>
<li><a href="#h:1598c90b-f195-41a0-9132-94612edf3586">3.4.1.29.5. yubikey-touch-detector</a></li>
</ul>
</li>
@ -523,7 +524,7 @@
<ul>
<li><a href="#h:84fd7029-ecb6-4131-9333-289982f24ffa">3.4.4.1. Gaming</a></li>
<li><a href="#h:f0b2ea93-94c8-48d8-8d47-6fe58f58e0e6">3.4.4.2. Work</a></li>
<li><a href="#org8bce8cc">3.4.4.3. Framework</a></li>
<li><a href="#orgeba9bdf">3.4.4.3. Framework</a></li>
</ul>
</li>
</ul>
@ -701,7 +702,7 @@
<ul>
<li><a href="#h:c1e53aed-fb47-4aff-930c-dc52f3c5dcb8">6.1. Server Emacs config</a></li>
<li><a href="#h:fc64f42f-e7cf-4829-89f6-2d0d58e04f51">6.2. tridactylrc</a></li>
<li><a href="#orga21e7e2">6.3. tridactyl theme</a></li>
<li><a href="#org47034b7">6.3. tridactyl theme</a></li>
<li><a href="#h:77b1c523-5074-4610-b320-90af95e6134d">6.4. Waybar style.css</a></li>
<li><a href="#h:788937cf-8816-466b-8e57-1b695cb50f52">6.5. justfile</a></li>
</ul>
@ -710,7 +711,7 @@
</div>
</div>
<p>
<b>This file has 62779 words spanning 16469 lines and was last revised on 2025-06-09 03:26:38 +0200.</b>
<b>This file has 63503 words spanning 16708 lines and was last revised on 2025-06-09 12:45:18 +0200.</b>
</p>
<p>
@ -763,7 +764,7 @@ This section defines my Emacs configuration. For a while, I considered to use ry
</p>
<p>
My emacs is built using the emacs-overlay nix flake, which builds a bleeding edge emacs on wayland (pgtk) with utilities like treesitter support. By executing the below source block, the current build setting can be updated at any time, and you can see my most up-to-date build options (last updated: 2025-06-09 03:26:38 +0200)
My emacs is built using the emacs-overlay nix flake, which builds a bleeding edge emacs on wayland (pgtk) with utilities like treesitter support. By executing the below source block, the current build setting can be updated at any time, and you can see my most up-to-date build options (last updated: 2025-06-09 12:45:18 +0200)
</p></li>
</ul>
@ -2802,8 +2803,8 @@ This is just a demo host. It applies all the configuration found in the common p
I also set the <code>WLR_RENDERER_ALLOW_SOFTWARE=1</code> to allow this configuration to run in a virtualized environment. I also enable <code>qemuGuest</code> for a smoother experience when testing on QEMU.
</p>
</div>
<div id="outline-container-org7d36836" class="outline-6">
<h6 id="org7d36836"><span class="section-number-6">3.1.4.4.1.</span> Main configuration</h6>
<div id="outline-container-org9b449ff" class="outline-6">
<h6 id="org9b449ff"><span class="section-number-6">3.1.4.4.1.</span> Main configuration</h6>
<div class="outline-text-6" id="text-3-1-4-4-1">
<div class="org-src-container">
<pre class="src src-nix">{ self, inputs, config, pkgs, lib, primaryUser, ... }:
@ -2882,8 +2883,8 @@ in
</div>
</div>
</div>
<div id="outline-container-org96e39c3" class="outline-6">
<h6 id="org96e39c3"><span class="section-number-6">3.1.4.4.2.</span> NixOS dummy options configuration</h6>
<div id="outline-container-org10cff1b" class="outline-6">
<h6 id="org10cff1b"><span class="section-number-6">3.1.4.4.2.</span> NixOS dummy options configuration</h6>
<div class="outline-text-6" id="text-3-1-4-4-2">
<div class="org-src-container">
<pre class="src src-nix">_:
@ -2893,8 +2894,8 @@ in
</div>
</div>
</div>
<div id="outline-container-org9944579" class="outline-6">
<h6 id="org9944579"><span class="section-number-6">3.1.4.4.3.</span> home-manager dummy options configuration</h6>
<div id="outline-container-org0c539d3" class="outline-6">
<h6 id="org0c539d3"><span class="section-number-6">3.1.4.4.3.</span> home-manager dummy options configuration</h6>
<div class="outline-text-6" id="text-3-1-4-4-3">
<div class="org-src-container">
<pre class="src src-nix">_:
@ -4671,8 +4672,8 @@ appimageTools.wrapType2 {
</div>
</div>
</div>
<div id="outline-container-org7169988" class="outline-5">
<h5 id="org7169988"><span class="section-number-5">3.2.1.30.</span> sshrm</h5>
<div id="outline-container-orgda3c026" class="outline-5">
<h5 id="orgda3c026"><span class="section-number-5">3.2.1.30.</span> sshrm</h5>
<div class="outline-text-5" id="text-3-2-1-30">
<p>
This programs simply runs ssh-keygen on the last host that I tried to ssh into. I need this frequently when working with cloud-init usually.
@ -4829,8 +4830,8 @@ in
</pre>
</div>
</div>
<div id="outline-container-orgc40c880" class="outline-6">
<h6 id="orgc40c880"><span class="section-number-6">3.2.3.1.1.</span> Personal</h6>
<div id="outline-container-org9037d50" class="outline-6">
<h6 id="org9037d50"><span class="section-number-6">3.2.3.1.1.</span> Personal</h6>
<div class="outline-text-6" id="text-3-2-3-1-1">
<div class="org-src-container">
<pre class="src src-nix">{ lib, config, ... }:
@ -4897,8 +4898,8 @@ in
</div>
</div>
</div>
<div id="outline-container-org8b621b6" class="outline-6">
<h6 id="org8b621b6"><span class="section-number-6">3.2.3.1.2.</span> Chaostheatre</h6>
<div id="outline-container-org4d186bc" class="outline-6">
<h6 id="org4d186bc"><span class="section-number-6">3.2.3.1.2.</span> Chaostheatre</h6>
<div class="outline-text-6" id="text-3-2-3-1-2">
<div class="org-src-container">
<pre class="src src-nix">{ lib, config, ... }:
@ -4962,8 +4963,8 @@ in
</div>
</div>
</div>
<div id="outline-container-orgc447ea6" class="outline-6">
<h6 id="orgc447ea6"><span class="section-number-6">3.2.3.1.3.</span> toto</h6>
<div id="outline-container-orgb6e7397" class="outline-6">
<h6 id="orgb6e7397"><span class="section-number-6">3.2.3.1.3.</span> toto</h6>
<div class="outline-text-6" id="text-3-2-3-1-3">
<div class="org-src-container">
<pre class="src src-nix">{ lib, config, ... }:
@ -4995,8 +4996,8 @@ in
</div>
</div>
</div>
<div id="outline-container-org242a8a7" class="outline-6">
<h6 id="org242a8a7"><span class="section-number-6">3.2.3.1.4.</span> Work</h6>
<div id="outline-container-orgb297f59" class="outline-6">
<h6 id="orgb297f59"><span class="section-number-6">3.2.3.1.4.</span> Work</h6>
<div class="outline-text-6" id="text-3-2-3-1-4">
<div class="org-src-container">
<pre class="src src-nix">{ lib, config, ... }:
@ -5017,8 +5018,8 @@ in
</div>
</div>
</div>
<div id="outline-container-org0af8026" class="outline-6">
<h6 id="org0af8026"><span class="section-number-6">3.2.3.1.5.</span> Framework</h6>
<div id="outline-container-org2faed76" class="outline-6">
<h6 id="org2faed76"><span class="section-number-6">3.2.3.1.5.</span> Framework</h6>
<div class="outline-text-6" id="text-3-2-3-1-5">
<div class="org-src-container">
<pre class="src src-nix">{ lib, config, ... }:
@ -5039,8 +5040,8 @@ in
</div>
</div>
</div>
<div id="outline-container-org60114bf" class="outline-6">
<h6 id="org60114bf"><span class="section-number-6">3.2.3.1.6.</span> AMD CPU</h6>
<div id="outline-container-org9900420" class="outline-6">
<h6 id="org9900420"><span class="section-number-6">3.2.3.1.6.</span> AMD CPU</h6>
<div class="outline-text-6" id="text-3-2-3-1-6">
<div class="org-src-container">
<pre class="src src-nix">{ lib, config, ... }:
@ -5061,8 +5062,8 @@ in
</div>
</div>
</div>
<div id="outline-container-org006abd1" class="outline-6">
<h6 id="org006abd1"><span class="section-number-6">3.2.3.1.7.</span> AMD GPU</h6>
<div id="outline-container-org895cc35" class="outline-6">
<h6 id="org895cc35"><span class="section-number-6">3.2.3.1.7.</span> AMD GPU</h6>
<div class="outline-text-6" id="text-3-2-3-1-7">
<div class="org-src-container">
<pre class="src src-nix">{ lib, config, ... }:
@ -5083,8 +5084,8 @@ in
</div>
</div>
</div>
<div id="outline-container-org8b4acf6" class="outline-6">
<h6 id="org8b4acf6"><span class="section-number-6">3.2.3.1.8.</span> Hibernation</h6>
<div id="outline-container-org39be1cf" class="outline-6">
<h6 id="org39be1cf"><span class="section-number-6">3.2.3.1.8.</span> Hibernation</h6>
<div class="outline-text-6" id="text-3-2-3-1-8">
<div class="org-src-container">
<pre class="src src-nix">{ lib, config, ... }:
@ -5105,8 +5106,8 @@ in
</div>
</div>
</div>
<div id="outline-container-orgc6b961c" class="outline-6">
<h6 id="orgc6b961c"><span class="section-number-6">3.2.3.1.9.</span> BTRFS</h6>
<div id="outline-container-org7672d00" class="outline-6">
<h6 id="org7672d00"><span class="section-number-6">3.2.3.1.9.</span> BTRFS</h6>
<div class="outline-text-6" id="text-3-2-3-1-9">
<div class="org-src-container">
<pre class="src src-nix">{ lib, config, ... }:
@ -5127,8 +5128,8 @@ in
</div>
</div>
</div>
<div id="outline-container-orgb72a5aa" class="outline-6">
<h6 id="orgb72a5aa"><span class="section-number-6">3.2.3.1.10.</span> Local Server</h6>
<div id="outline-container-org1bda8d7" class="outline-6">
<h6 id="org1bda8d7"><span class="section-number-6">3.2.3.1.10.</span> Local Server</h6>
<div class="outline-text-6" id="text-3-2-3-1-10">
<div class="org-src-container">
<pre class="src src-nix">{ lib, config, ... }:
@ -5169,6 +5170,7 @@ in
emacs = lib.mkDefault true;
freshrss = lib.mkDefault true;
jenkins = lib.mkDefault false;
kanidm = lib.mkDefault true;
};
};
};
@ -5180,8 +5182,8 @@ in
</div>
</div>
</div>
<div id="outline-container-org37ce6f2" class="outline-6">
<h6 id="org37ce6f2"><span class="section-number-6">3.2.3.1.11.</span> OCI Sync Server</h6>
<div id="outline-container-org17d23c6" class="outline-6">
<h6 id="org17d23c6"><span class="section-number-6">3.2.3.1.11.</span> OCI Sync Server</h6>
<div class="outline-text-6" id="text-3-2-3-1-11">
<div class="org-src-container">
<pre class="src src-nix">{ lib, config, ... }:
@ -5238,8 +5240,8 @@ in
</pre>
</div>
</div>
<div id="outline-container-orgb37c738" class="outline-6">
<h6 id="orgb37c738"><span class="section-number-6">3.2.3.2.1.</span> Personal</h6>
<div id="outline-container-org47e7345" class="outline-6">
<h6 id="org47e7345"><span class="section-number-6">3.2.3.2.1.</span> Personal</h6>
<div class="outline-text-6" id="text-3-2-3-2-1">
<div class="org-src-container">
<pre class="src src-nix">{ lib, config, ... }:
@ -5296,8 +5298,8 @@ in
</div>
</div>
</div>
<div id="outline-container-orgbf3722f" class="outline-6">
<h6 id="orgbf3722f"><span class="section-number-6">3.2.3.2.2.</span> Chaostheatre</h6>
<div id="outline-container-orgcc5e0f5" class="outline-6">
<h6 id="orgcc5e0f5"><span class="section-number-6">3.2.3.2.2.</span> Chaostheatre</h6>
<div class="outline-text-6" id="text-3-2-3-2-2">
<div class="org-src-container">
<pre class="src src-nix">{ lib, config, ... }:
@ -5349,8 +5351,8 @@ in
</div>
</div>
</div>
<div id="outline-container-orgd8744f7" class="outline-6">
<h6 id="orgd8744f7"><span class="section-number-6">3.2.3.2.3.</span> toto</h6>
<div id="outline-container-org3185dd7" class="outline-6">
<h6 id="org3185dd7"><span class="section-number-6">3.2.3.2.3.</span> toto</h6>
<div class="outline-text-6" id="text-3-2-3-2-3">
<div class="org-src-container">
<pre class="src src-nix">{ lib, config, ... }:
@ -5370,8 +5372,8 @@ in
</div>
</div>
</div>
<div id="outline-container-org2e6004c" class="outline-6">
<h6 id="org2e6004c"><span class="section-number-6">3.2.3.2.4.</span> Work</h6>
<div id="outline-container-org061d35f" class="outline-6">
<h6 id="org061d35f"><span class="section-number-6">3.2.3.2.4.</span> Work</h6>
<div class="outline-text-6" id="text-3-2-3-2-4">
<div class="org-src-container">
<pre class="src src-nix">{ lib, config, ... }:
@ -5391,8 +5393,8 @@ in
</div>
</div>
</div>
<div id="outline-container-orgd69a7ed" class="outline-6">
<h6 id="orgd69a7ed"><span class="section-number-6">3.2.3.2.5.</span> Framework</h6>
<div id="outline-container-org367969f" class="outline-6">
<h6 id="org367969f"><span class="section-number-6">3.2.3.2.5.</span> Framework</h6>
<div class="outline-text-6" id="text-3-2-3-2-5">
<div class="org-src-container">
<pre class="src src-nix">{ lib, config, ... }:
@ -5413,8 +5415,8 @@ in
</div>
</div>
</div>
<div id="outline-container-orged364f5" class="outline-6">
<h6 id="orged364f5"><span class="section-number-6">3.2.3.2.6.</span> Darwin</h6>
<div id="outline-container-org19a7899" class="outline-6">
<h6 id="org19a7899"><span class="section-number-6">3.2.3.2.6.</span> Darwin</h6>
<div class="outline-text-6" id="text-3-2-3-2-6">
<div class="org-src-container">
<pre class="src src-nix">{ lib, config, ... }:
@ -5432,8 +5434,8 @@ in
</div>
</div>
</div>
<div id="outline-container-orge7ba9f2" class="outline-6">
<h6 id="orge7ba9f2"><span class="section-number-6">3.2.3.2.7.</span> Local Server</h6>
<div id="outline-container-org22458da" class="outline-6">
<h6 id="org22458da"><span class="section-number-6">3.2.3.2.7.</span> Local Server</h6>
<div class="outline-text-6" id="text-3-2-3-2-7">
<div class="org-src-container">
<pre class="src src-nix">{ lib, config, ... }:
@ -6966,8 +6968,8 @@ Most of the time I am using <code>power-saver</code>, however, it is good to be
</div>
</div>
</div>
<div id="outline-container-orgf6a9187" class="outline-6">
<h6 id="orgf6a9187"><span class="section-number-6">3.3.1.22.6.</span> SwayOSD</h6>
<div id="outline-container-org8e440af" class="outline-6">
<h6 id="org8e440af"><span class="section-number-6">3.3.1.22.6.</span> SwayOSD</h6>
<div class="outline-text-6" id="text-3-3-1-22-6">
<div class="org-src-container">
<pre class="src src-nix">{ lib, pkgs, config, ... }:
@ -8673,7 +8675,9 @@ in
port = 3001;
openFirewall = true;
mediaLocation = "/Vault/Eternor/Immich";
environment.IMMICH_MACHINE_LEARNING_URL = lib.mkForce "http://localhost:3003";
environment = {
IMMICH_MACHINE_LEARNING_URL = lib.mkForce "http://localhost:3003";
};
};
@ -8715,7 +8719,7 @@ in
<h5 id="h:89638fb5-0593-4420-9567-f85f0223e341"><span class="section-number-5">3.3.2.17.</span> paperless</h5>
<div class="outline-text-5" id="text-h:89638fb5-0593-4420-9567-f85f0223e341">
<div class="org-src-container">
<pre class="src src-nix">{ lib, config, ... }:
<pre class="src src-nix">{ lib, pkgs, config, ... }:
{
options.swarselsystems.modules.server.paperless = lib.mkEnableOption "enable paperless on server";
config = lib.mkIf config.swarselsystems.modules.server.paperless {
@ -8724,8 +8728,14 @@ in
extraGroups = [ "users" ];
};
sops.secrets.paperless_admin = { owner = "paperless"; };
sops.secrets = {
paperless_admin = { owner = "paperless"; };
kanidm-paperless-client = {
owner = "paperless";
group = "paperless";
mode = "440";
};
};
services.paperless = {
enable = true;
@ -8743,9 +8753,35 @@ in
invalidate_digital_signatures = true;
pdfa_image_compression = "lossless";
};
PAPERLESS_APPS = "allauth.socialaccount.providers.openid_connect";
PAPERLESS_SOCIALACCOUNT_PROVIDERS = builtins.toJSON {
openid_connect = {
OAUTH_PKCE_ENABLED = "True";
APPS = [
rec {
provider_id = "kanidm";
name = "Kanidm";
client_id = "paperless";
# secret will be added dynamically
#secret = "";
settings.server_url = "https://sso.swarsel.win/oauth2/openid/${client_id}/.well-known/openid-configuration";
}
];
};
};
};
};
# Add secret to PAPERLESS_SOCIALACCOUNT_PROVIDERS
systemd.services.paperless-web.script = lib.mkBefore ''
oidcSecret=$(&lt; ${config.sops.secrets.kanidm-paperless-client.path})
export PAPERLESS_SOCIALACCOUNT_PROVIDERS=$(
${pkgs.jq}/bin/jq &lt;&lt;&lt; "$PAPERLESS_SOCIALACCOUNT_PROVIDERS" \
--compact-output \
--arg oidcSecret "$oidcSecret" '.openid_connect.APPS.[0].secret = $oidcSecret'
)
'';
services.nginx = {
virtualHosts = {
"scan.swarsel.win" = {
@ -9104,7 +9140,7 @@ in
</div>
</div>
<div id="outline-container-h:a31c7192-e11d-4a26-915d-1bbc38e373d3" class="outline-5">
<h5 id="h:a31c7192-e11d-4a26-915d-1bbc38e373d3"><span class="section-number-5">3.3.2.21.</span> monitoring</h5>
<h5 id="h:a31c7192-e11d-4a26-915d-1bbc38e373d3"><span class="section-number-5">3.3.2.21.</span> monitoring (Grafana)</h5>
<div class="outline-text-5" id="text-h:a31c7192-e11d-4a26-915d-1bbc38e373d3">
<p>
This section exposes several metrics that I use to check the health of my server. I need to expand on the exporters section at some point, but for now I have everything I need.
@ -9112,6 +9148,9 @@ This section exposes several metrics that I use to check the health of my server
<div class="org-src-container">
<pre class="src src-nix">{ self, lib, config, ... }:
let
grafanaDomain = "status.swarsel.win";
in
{
options.swarselsystems.modules.server.monitoring = lib.mkEnableOption "enable monitoring on server";
config = lib.mkIf config.swarselsystems.modules.server.monitoring {
@ -9123,6 +9162,11 @@ This section exposes several metrics that I use to check the health of my server
prometheusadminpass = {
owner = "grafana";
};
kanidm-grafana-client = {
owner = "grafana";
group = "grafana";
mode = "440";
};
};
users = {
@ -9148,7 +9192,7 @@ This section exposes several metrics that I use to check the health of my server
{
name = "prometheus";
type = "prometheus";
url = "https://status.swarsel.win/prometheus";
url = "https://${grafanaDomain}/prometheus";
editable = false;
access = "proxy";
basicAuth = true;
@ -9173,10 +9217,30 @@ This section exposes several metrics that I use to check the health of my server
settings = {
security.admin_password = "$__file{/run/secrets/grafanaadminpass}";
server = {
domain = grafanaDomain;
root_url = "https://${grafanaDomain}";
http_port = 3000;
http_addr = "127.0.0.1";
http_addr = "0.0.0.0";
protocol = "http";
domain = "status.swarsel.win";
};
"auth.generic_oauth" = {
enabled = true;
name = "Kanidm";
icon = "signin";
allow_sign_up = true;
#auto_login = true;
client_id = "grafana";
client_secret = "$__file{${config.sops.secrets.kanidm-grafana-client.path}}";
scopes = "openid email profile";
login_attribute_path = "preferred_username";
auth_url = "https://sso.swarsel.win/ui/oauth2";
token_url = "https://sso.swarsel.win/oauth2/token";
api_url = "https://sso.swarsel.win/oauth2/openid/grafana/userinfo";
use_pkce = true;
use_refresh_token = true;
# Allow mapping oauth2 roles to server admin
allow_assign_grafana_admin = true;
role_attribute_path = "contains(groups[*], 'server_admin') &amp;&amp; 'GrafanaAdmin' || contains(groups[*], 'admin') &amp;&amp; 'Admin' || contains(groups[*], 'editor') &amp;&amp; 'Editor' || 'Viewer'";
};
};
};
@ -9260,6 +9324,7 @@ This section exposes several metrics that I use to check the health of my server
locations = {
"/" = {
proxyPass = "http://localhost:3000";
proxyWebsockets = true;
extraConfig = ''
client_max_body_size 0;
'';
@ -9516,6 +9581,184 @@ It serves both a Greader API at <a href="https://signpost.swarsel.win/api/greade
</div>
</div>
</div>
<div id="outline-container-orgeb2a887" class="outline-5">
<h5 id="orgeb2a887"><span class="section-number-5">3.3.2.27.</span> kanidm</h5>
<div class="outline-text-5" id="text-3-3-2-27">
<div class="org-src-container">
<pre class="src src-nix">{ self, lib, pkgs, config, ... }:
let
certsSopsFile = self + /secrets/certs/secrets.yaml;
kanidmDomain = "sso.swarsel.win";
kanidmPort = 8300;
in
{
options.swarselsystems.modules.server.kanidm = lib.mkEnableOption "enable kanidm on server";
config = lib.mkIf config.swarselsystems.modules.server.kanidm {
users.users.kanidm = {
group = "kanidm";
isSystemUser = true;
};
users.groups.kanidm = { };
sops.secrets = {
"kanidm-self-signed-crt" = { sopsFile = certsSopsFile; owner = "kanidm"; group = "kanidm"; mode = "440"; };
"kanidm-self-signed-key" = { sopsFile = certsSopsFile; owner = "kanidm"; group = "kanidm"; mode = "440"; };
"kanidm-admin-pw" = { owner = "kanidm"; group = "kanidm"; mode = "440"; };
"kanidm-idm-admin-pw" = { owner = "kanidm"; group = "kanidm"; mode = "440"; };
"kanidm-immich" = { owner = "kanidm"; group = "kanidm"; mode = "440"; };
"kanidm-paperless" = { owner = "kanidm"; group = "kanidm"; mode = "440"; };
"kanidm-forgejo" = { owner = "kanidm"; group = "kanidm"; mode = "440"; };
"kanidm-grafana" = { owner = "kanidm"; group = "kanidm"; mode = "440"; };
};
services.kanidm = {
package = pkgs.kanidmWithSecretProvisioning;
enableServer = true;
serverSettings = {
domain = kanidmDomain;
origin = "https://${kanidmDomain}";
tls_chain = config.sops.secrets.kanidm-self-signed-crt.path;
tls_key = config.sops.secrets.kanidm-self-signed-key.path;
bindaddress = "0.0.0.0:${toString kanidmPort}";
trust_x_forward_for = true;
};
enableClient = true;
clientSettings = {
uri = config.services.kanidm.serverSettings.origin;
verify_ca = true;
verify_hostnames = true;
};
provision = {
enable = true;
adminPasswordFile = config.sops.secrets.kanidm-admin-pw.path;
idmAdminPasswordFile = config.sops.secrets.kanidm-idm-admin-pw.path;
groups = {
"immich.access" = { };
"paperless.access" = { };
"forgejo.access" = { };
"forgejo.admins" = { };
"grafana.access" = { };
"grafana.editors" = { };
"grafana.admins" = { };
"grafana.server-admins" = { };
};
persons = {
swarsel = {
present = true;
mailAddresses = [ "leon@swarsel.win" ];
legalName = "Leon Schwarzäugl";
groups = [
"immich.access"
"paperless.access"
"grafana.access"
"forgejo.access"
];
displayName = "Swarsel";
};
};
systems = {
oauth2 = {
immich = {
displayName = "Immich";
originUrl = [
"https://shots.swarsel.win/auth/login"
"https://shots.swarsel.win/user-settings"
"app.immich:///oauth-callback"
"https://shots.swarsel.win/api/oauth/mobile-redirect"
];
originLanding = "https://shots.swarsel.win/";
basicSecretFile = config.sops.secrets.kanidm-immich.path;
preferShortUsername = true;
enableLegacyCrypto = true; # can use RS256 / HS256, not ES256
scopeMaps."immich.access" = [
"openid"
"email"
"profile"
];
};
paperless = {
displayName = "Paperless";
originUrl = "https://scan.swarsel.win/accounts/oidc/kanidm/login/callback/";
originLanding = "https://scan.swarsel.win/";
basicSecretFile = config.sops.secrets.kanidm-paperless.path;
preferShortUsername = true;
scopeMaps."paperless.access" = [
"openid"
"email"
"profile"
];
};
forgejo = {
displayName = "Forgejo";
originUrl = "https://swagit.swarsel.win/user/oauth2/kanidm/callback";
originLanding = "https://swagit.swarsel.win/";
basicSecretFile = config.sops.secrets.kanidm-forgejo.path;
scopeMaps."forgejo.access" = [
"openid"
"email"
"profile"
];
# XXX: PKCE is currently not supported by gitea/forgejo,
# see https://github.com/go-gitea/gitea/issues/21376.
allowInsecureClientDisablePkce = true;
preferShortUsername = true;
claimMaps.groups = {
joinType = "array";
valuesByGroup."forgejo.admins" = [ "admin" ];
};
};
grafana = {
displayName = "Grafana";
originUrl = "https://status.swarsel.win/login/generic_oauth";
originLanding = "https://status.swarsel.win/";
basicSecretFile = config.sops.secrets.kanidm-grafana.path;
preferShortUsername = true;
scopeMaps."grafana.access" = [
"openid"
"email"
"profile"
];
claimMaps.groups = {
joinType = "array";
valuesByGroup = {
"grafana.editors" = [ "editor" ];
"grafana.admins" = [ "admin" ];
"grafana.server-admins" = [ "server_admin" ];
};
};
};
};
};
};
};
systemd.services.kanidm.serviceConfig.RestartSec = "30";
services.nginx = {
virtualHosts = {
"sso.swarsel.win" = {
enableACME = true;
forceSSL = true;
acmeRoot = null;
locations = {
"/" = {
proxyPass = "https://localhost:${toString kanidmPort}";
};
};
extraConfig = ''
proxy_ssl_verify off;
'';
};
};
};
};
}
</pre>
</div>
</div>
</div>
</div>
<div id="outline-container-h:ac0cd8b3-06cf-4dca-ba73-6100c8fedb47" class="outline-4">
<h4 id="h:ac0cd8b3-06cf-4dca-ba73-6100c8fedb47"><span class="section-number-4">3.3.3.</span> Darwin</h4>
@ -9728,8 +9971,8 @@ This smashes Atmosphere 1.3.2 on the switch, which is what I am currenty using.
</div>
</div>
</div>
<div id="outline-container-org1c6aa69" class="outline-5">
<h5 id="org1c6aa69"><span class="section-number-5">3.3.4.6.</span> Framework</h5>
<div id="outline-container-org2fd6795" class="outline-5">
<h5 id="org2fd6795"><span class="section-number-5">3.3.4.6.</span> Framework</h5>
<div class="outline-text-5" id="text-3-3-4-6">
<p>
This holds configuration that is specific to framework laptops.
@ -9767,8 +10010,8 @@ This holds configuration that is specific to framework laptops.
</div>
</div>
</div>
<div id="outline-container-orge813212" class="outline-5">
<h5 id="orge813212"><span class="section-number-5">3.3.4.7.</span> AMD CPU</h5>
<div id="outline-container-org28eaeed" class="outline-5">
<h5 id="org28eaeed"><span class="section-number-5">3.3.4.7.</span> AMD CPU</h5>
<div class="outline-text-5" id="text-3-3-4-7">
<div class="org-src-container">
<pre class="src src-nix">{ lib, config, ... }:
@ -9784,8 +10027,8 @@ This holds configuration that is specific to framework laptops.
</div>
</div>
</div>
<div id="outline-container-orga04a3e5" class="outline-5">
<h5 id="orga04a3e5"><span class="section-number-5">3.3.4.8.</span> AMD GPU</h5>
<div id="outline-container-org4c4411c" class="outline-5">
<h5 id="org4c4411c"><span class="section-number-5">3.3.4.8.</span> AMD GPU</h5>
<div class="outline-text-5" id="text-3-3-4-8">
<div class="org-src-container">
<pre class="src src-nix">{ lib, config, ... }:
@ -9807,8 +10050,8 @@ This holds configuration that is specific to framework laptops.
</div>
</div>
</div>
<div id="outline-container-org4db606b" class="outline-5">
<h5 id="org4db606b"><span class="section-number-5">3.3.4.9.</span> Hibernation</h5>
<div id="outline-container-org8338221" class="outline-5">
<h5 id="org8338221"><span class="section-number-5">3.3.4.9.</span> Hibernation</h5>
<div class="outline-text-5" id="text-3-3-4-9">
<div class="org-src-container">
<pre class="src src-nix">{ lib, config, ... }:
@ -9839,8 +10082,8 @@ This holds configuration that is specific to framework laptops.
</div>
</div>
</div>
<div id="outline-container-orgb652890" class="outline-5">
<h5 id="orgb652890"><span class="section-number-5">3.3.4.10.</span> BTRFS</h5>
<div id="outline-container-org952308a" class="outline-5">
<h5 id="org952308a"><span class="section-number-5">3.3.4.10.</span> BTRFS</h5>
<div class="outline-text-5" id="text-3-3-4-10">
<div class="org-src-container">
<pre class="src src-nix">{ lib, config, ... }:
@ -12788,8 +13031,8 @@ The `extraConfig` section here CANNOT be reindented. This has something to do wi
</div>
</div>
</div>
<div id="outline-container-org490abd7" class="outline-6">
<h6 id="org490abd7"><span class="section-number-6">3.4.1.29.4.</span> SwayOSD</h6>
<div id="outline-container-org978f035" class="outline-6">
<h6 id="org978f035"><span class="section-number-6">3.4.1.29.4.</span> SwayOSD</h6>
<div class="outline-text-6" id="text-3-4-1-29-4">
<div class="org-src-container">
<pre class="src src-nix">{ lib, config, ... }:
@ -14038,8 +14281,8 @@ in
</div>
</div>
</div>
<div id="outline-container-org8bce8cc" class="outline-5">
<h5 id="org8bce8cc"><span class="section-number-5">3.4.4.3.</span> Framework</h5>
<div id="outline-container-orgeba9bdf" class="outline-5">
<h5 id="orgeba9bdf"><span class="section-number-5">3.4.4.3.</span> Framework</h5>
<div class="outline-text-5" id="text-3-4-4-3">
<p>
This holds configuration that is specific to framework laptops.
@ -17879,8 +18122,8 @@ autocmd DocStart vc-impimba-1.m.imp.ac.at/ui/webconsole mode ignore
</div>
</div>
</div>
<div id="outline-container-orga21e7e2" class="outline-3">
<h3 id="orga21e7e2"><span class="section-number-3">6.3.</span> tridactyl theme</h3>
<div id="outline-container-org47034b7" class="outline-3">
<h3 id="org47034b7"><span class="section-number-3">6.3.</span> tridactyl theme</h3>
<div class="outline-text-3" id="text-6-3">
<div class="org-src-container">
<pre class="src src-config">
@ -18377,7 +18620,7 @@ sync USER HOST:
</div>
<div id="postamble" class="status">
<p class="author">Author: Leon Schwarzäugl</p>
<p class="date">Created: 2025-06-09 Mo 03:26</p>
<p class="date">Created: 2025-06-09 Mo 12:45</p>
<p class="validation"><a href="https://validator.w3.org/check?uri=referer">Validate</a></p>
</div>
</body>