swarsel/.dotfiles
1
0
Fork 0
mirror of https://github.com/Swarsel/.dotfiles.git synced 2026-04-19 15:49:08 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Compare commits

base: swarsel:4172b30fdb9badf66f825108e5dae3e6aba5d6f0
Branches Tags
swarsel:main
swarsel:migrate/den-dev
swarsel:dev
swarsel:topology-oci
swarsel:v1.1.4
swarsel:v1.1.3
swarsel:v1.1.2
swarsel:v1.1.1
swarsel:v1.1.0
swarsel:v1.0.0
swarsel:v0.1.0
swarsel:v1.0.0-1
..
compare: swarsel:37a8e17cc93ac879ce258da9106f7a2f3380101e
Branches Tags
swarsel:migrate/den-dev
swarsel:main
swarsel:dev
swarsel:topology-oci
swarsel:v1.1.4
swarsel:v1.1.3
swarsel:v1.1.2
swarsel:v1.1.1
swarsel:v1.1.0
swarsel:v1.0.0
swarsel:v0.1.0
swarsel:v1.0.0-1

No commits in common. "4172b30fdb9badf66f825108e5dae3e6aba5d6f0" and "37a8e17cc93ac879ce258da9106f7a2f3380101e" have entirely different histories.
4172b30fdb ... 37a8e17cc9

62 changed files with 1307 additions and 2093 deletions
Download patch file Download diff file Expand all files Collapse all files

61
.sops.yaml
View file

@ -21,27 +21,6 @@ keys:
- &toto age16vzhcvz8tyxj8e0f47fy0z4p3dsg0ak4vl52ut3l07a0tz465cxslmhevl - &toto age16vzhcvz8tyxj8e0f47fy0z4p3dsg0ak4vl52ut3l07a0tz465cxslmhevl
- &twothreetunnel age1g7atkxdlt4ymeh7v7aa2yzr2hq2qkvzrc4r49ugttm3n582ymv9qrmpk8d - &twothreetunnel age1g7atkxdlt4ymeh7v7aa2yzr2hq2qkvzrc4r49ugttm3n582ymv9qrmpk8d
- &winters age1s0vssf9fey2l456hucppzx2x58xep279nsdcglvkqm30sr9ht37s8rvpza - &winters age1s0vssf9fey2l456hucppzx2x58xep279nsdcglvkqm30sr9ht37s8rvpza
- &summers-ankisync age1kyue7mfvzuxprjz2g6ulz2mxlr57rgzg6lfpnrqedkelehley5ls3enwsd
- &summers-atuin age1qpgj3ell93rzkpjq0ezs6t669ds3nyxx67pj50smx597pspz6fqs4jc6pt
- &summers-audio age1f63r2klnpfxmntswz5xydpa75ckgjqcs2yzkm0msqwqgz9aqgu0qwzr659
- &summers-firefly age17328xwk0z3znalpmma5rvp0lt5ghn5p8xfvnrtdxwsw80dqysacqj9j37q
- &summers-forgejo age1qdzkn6v3xhrfjwe8jxz3945dhyyhevwal0narjtr8whf9y7nh3wsn524u5
- &summers-freshrss age1etgfym5m8hn3hxs6cgg757zcv5zg5n22wq38fuq59n7qk7nef5uqyg6vvs
- &summers-homebox age17mugmkdw0y768a3huuf37r45eff9apyknxvwk3agg6xzsjmqp96q57tcty
- &summers-immich age16gf76uustmyyksm3t56zcq9g6j8avy0wrngh8laknfq733s5welqedeg4x
- &summers-jellyfin age1fnvlmhzju0yq908xtgags0sy85q3tacl2sc3w3vdd3yfp27xv5aq06v948
- &summers-kanidm age1s5gcxtatd9frwctzwg54fqycsx2sa73ll36k7qrpm9wwyknkldtst90gn4
- &summers-kavita age1d89878cvt7wsa07ydwtexspku5gppwstrpnpph4ufx5pcd4fadyqgf6lvl
- &summers-koillection age1ayupuxlrkepyvjk7xwgrd0pvcj3tfcha688mcuc8ees2hg3g2ersd0q3nc
- &summers-matrix age1cq7wxnugpfvjk6dgqpfmc8vemzhkg75drkgeaqjd9fuylz5qh40slazr4u
- &summers-monitoring age1vn6ya0japzpgc256jg57fldsqe4udmq50sj5hmkywn7rxfnskevsx2q96u
- &summers-nextcloud age1t7zagjfddns4yltupk7nx8xps4gh7mupyz85uuys0wd22cxj5qsq2hw0p7
- &summers-paperless age1rn0pxluh7m8dyeshek06d7scejqlrcewlk8xmyrwt5e5nev2dc2s3s78vq
- &summers-postgresql age12jh5836w3cmazec8ql652p9h3a3xn6quztztzqxg4n0kz7r96dnqqlhxxw
- &summers-radicale age1gxg2peektn8x36kk3nsgmeawl73e54kaadqd649ygwrv43kkvejq2cw64z
- &summers-storage age1kn34ny229gm0rg7wlcvxmcyjtz4gka6f2vd958fde6vmuzrxcvcsufra90
- &summers-transmission age1y69f2elvmq39lc3t3ucq9y7wt675520n7rvug88qg368qsmmk47qvwrtny
creation_rules: creation_rules:
- path_regex: secrets/repo/[^/]+\.(yaml|json|env|ini|enc)$ - path_regex: secrets/repo/[^/]+\.(yaml|json|env|ini|enc)$
key_groups: key_groups:
@ -63,26 +42,6 @@ creation_rules:
- *dgx - *dgx
- *hintbooth-adguardhome - *hintbooth-adguardhome
- *hintbooth-nginx - *hintbooth-nginx
- *summers-ankisync
- *summers-atuin
- *summers-audio
- *summers-firefly
- *summers-forgejo
- *summers-freshrss
- *summers-homebox
- *summers-immich
- *summers-jellyfin
- *summers-kanidm
- *summers-kavita
- *summers-koillection
- *summers-matrix
- *summers-monitoring
- *summers-nextcloud
- *summers-paperless
- *summers-postgresql
- *summers-radicale
- *summers-storage
- *summers-transmission
- path_regex: secrets/work/[^/]+\.(yaml|json|env|ini)$ - path_regex: secrets/work/[^/]+\.(yaml|json|env|ini)$
key_groups: key_groups:
@ -200,7 +159,6 @@ creation_rules:
- *swarsel - *swarsel
age: age:
- *summers - *summers
- *summers-ankisync
- path_regex: hosts/nixos/x86_64-linux/summers/secrets/atuin/[^/]+\.(yaml|json|env|ini|enc)$ - path_regex: hosts/nixos/x86_64-linux/summers/secrets/atuin/[^/]+\.(yaml|json|env|ini|enc)$
key_groups: key_groups:
@ -208,7 +166,6 @@ creation_rules:
- *swarsel - *swarsel
age: age:
- *summers - *summers
- *summers-atuin
- path_regex: hosts/nixos/x86_64-linux/summers/secrets/audio/[^/]+\.(yaml|json|env|ini|enc)$ - path_regex: hosts/nixos/x86_64-linux/summers/secrets/audio/[^/]+\.(yaml|json|env|ini|enc)$
key_groups: key_groups:
@ -216,7 +173,6 @@ creation_rules:
- *swarsel - *swarsel
age: age:
- *summers - *summers
- *summers-audio
- path_regex: hosts/nixos/x86_64-linux/summers/secrets/firefly/[^/]+\.(yaml|json|env|ini|enc)$ - path_regex: hosts/nixos/x86_64-linux/summers/secrets/firefly/[^/]+\.(yaml|json|env|ini|enc)$
key_groups: key_groups:
@ -224,7 +180,6 @@ creation_rules:
- *swarsel - *swarsel
age: age:
- *summers - *summers
- *summers-firefly
- path_regex: hosts/nixos/x86_64-linux/summers/secrets/forgejo/[^/]+\.(yaml|json|env|ini|enc)$ - path_regex: hosts/nixos/x86_64-linux/summers/secrets/forgejo/[^/]+\.(yaml|json|env|ini|enc)$
key_groups: key_groups:
@ -232,7 +187,6 @@ creation_rules:
- *swarsel - *swarsel
age: age:
- *summers - *summers
- *summers-forgejo
- path_regex: hosts/nixos/x86_64-linux/summers/secrets/freshrss/[^/]+\.(yaml|json|env|ini|enc)$ - path_regex: hosts/nixos/x86_64-linux/summers/secrets/freshrss/[^/]+\.(yaml|json|env|ini|enc)$
key_groups: key_groups:
@ -240,7 +194,6 @@ creation_rules:
- *swarsel - *swarsel
age: age:
- *summers - *summers
- *summers-freshrss
- path_regex: hosts/nixos/x86_64-linux/summers/secrets/homebox/[^/]+\.(yaml|json|env|ini|enc)$ - path_regex: hosts/nixos/x86_64-linux/summers/secrets/homebox/[^/]+\.(yaml|json|env|ini|enc)$
key_groups: key_groups:
@ -248,7 +201,6 @@ creation_rules:
- *swarsel - *swarsel
age: age:
- *summers - *summers
- *summers-homebox
- path_regex: hosts/nixos/x86_64-linux/summers/secrets/immich/[^/]+\.(yaml|json|env|ini|enc)$ - path_regex: hosts/nixos/x86_64-linux/summers/secrets/immich/[^/]+\.(yaml|json|env|ini|enc)$
key_groups: key_groups:
@ -256,7 +208,6 @@ creation_rules:
- *swarsel - *swarsel
age: age:
- *summers - *summers
- *summers-immich
- path_regex: hosts/nixos/x86_64-linux/summers/secrets/jellyfin/[^/]+\.(yaml|json|env|ini|enc)$ - path_regex: hosts/nixos/x86_64-linux/summers/secrets/jellyfin/[^/]+\.(yaml|json|env|ini|enc)$
key_groups: key_groups:
@ -264,7 +215,6 @@ creation_rules:
- *swarsel - *swarsel
age: age:
- *summers - *summers
- *summers-jellyfin
- path_regex: hosts/nixos/x86_64-linux/summers/secrets/kanidm/[^/]+\.(yaml|json|env|ini|enc)$ - path_regex: hosts/nixos/x86_64-linux/summers/secrets/kanidm/[^/]+\.(yaml|json|env|ini|enc)$
key_groups: key_groups:
@ -272,7 +222,6 @@ creation_rules:
- *swarsel - *swarsel
age: age:
- *summers - *summers
- *summers-kanidm
- path_regex: hosts/nixos/x86_64-linux/summers/secrets/kavita/[^/]+\.(yaml|json|env|ini|enc)$ - path_regex: hosts/nixos/x86_64-linux/summers/secrets/kavita/[^/]+\.(yaml|json|env|ini|enc)$
key_groups: key_groups:
@ -280,7 +229,6 @@ creation_rules:
- *swarsel - *swarsel
age: age:
- *summers - *summers
- *summers-kavita
- path_regex: hosts/nixos/x86_64-linux/summers/secrets/koillection/[^/]+\.(yaml|json|env|ini|enc)$ - path_regex: hosts/nixos/x86_64-linux/summers/secrets/koillection/[^/]+\.(yaml|json|env|ini|enc)$
key_groups: key_groups:
@ -288,7 +236,6 @@ creation_rules:
- *swarsel - *swarsel
age: age:
- *summers - *summers
- *summers-koillection
- path_regex: hosts/nixos/x86_64-linux/summers/secrets/matrix/[^/]+\.(yaml|json|env|ini|enc)$ - path_regex: hosts/nixos/x86_64-linux/summers/secrets/matrix/[^/]+\.(yaml|json|env|ini|enc)$
key_groups: key_groups:
@ -296,7 +243,6 @@ creation_rules:
- *swarsel - *swarsel
age: age:
- *summers - *summers
- *summers-matrix
- path_regex: hosts/nixos/x86_64-linux/summers/secrets/monitoring/[^/]+\.(yaml|json|env|ini|enc)$ - path_regex: hosts/nixos/x86_64-linux/summers/secrets/monitoring/[^/]+\.(yaml|json|env|ini|enc)$
key_groups: key_groups:
@ -304,7 +250,6 @@ creation_rules:
- *swarsel - *swarsel
age: age:
- *summers - *summers
- *summers-monitoring
- path_regex: hosts/nixos/x86_64-linux/summers/secrets/nextcloud/[^/]+\.(yaml|json|env|ini|enc)$ - path_regex: hosts/nixos/x86_64-linux/summers/secrets/nextcloud/[^/]+\.(yaml|json|env|ini|enc)$
key_groups: key_groups:
@ -312,7 +257,6 @@ creation_rules:
- *swarsel - *swarsel
age: age:
- *summers - *summers
- *summers-nextcloud
- path_regex: hosts/nixos/x86_64-linux/summers/secrets/paperless/[^/]+\.(yaml|json|env|ini|enc)$ - path_regex: hosts/nixos/x86_64-linux/summers/secrets/paperless/[^/]+\.(yaml|json|env|ini|enc)$
key_groups: key_groups:
@ -320,7 +264,6 @@ creation_rules:
- *swarsel - *swarsel
age: age:
- *summers - *summers
- *summers-paperless
- path_regex: hosts/nixos/x86_64-linux/summers/secrets/postgresql/[^/]+\.(yaml|json|env|ini|enc)$ - path_regex: hosts/nixos/x86_64-linux/summers/secrets/postgresql/[^/]+\.(yaml|json|env|ini|enc)$
key_groups: key_groups:
@ -328,7 +271,6 @@ creation_rules:
- *swarsel - *swarsel
age: age:
- *summers - *summers
- *summers-postgresql
- path_regex: hosts/nixos/x86_64-linux/summers/secrets/radicale/[^/]+\.(yaml|json|env|ini|enc)$ - path_regex: hosts/nixos/x86_64-linux/summers/secrets/radicale/[^/]+\.(yaml|json|env|ini|enc)$
key_groups: key_groups:
@ -336,7 +278,6 @@ creation_rules:
- *swarsel - *swarsel
age: age:
- *summers - *summers
- *summers-radicale
- path_regex: hosts/nixos/x86_64-linux/summers/secrets/storage/[^/]+\.(yaml|json|env|ini|enc)$ - path_regex: hosts/nixos/x86_64-linux/summers/secrets/storage/[^/]+\.(yaml|json|env|ini|enc)$
key_groups: key_groups:
@ -344,7 +285,6 @@ creation_rules:
- *swarsel - *swarsel
age: age:
- *summers - *summers
- *summers-storage
- path_regex: hosts/nixos/x86_64-linux/summers/secrets/transmission/[^/]+\.(yaml|json|env|ini|enc)$ - path_regex: hosts/nixos/x86_64-linux/summers/secrets/transmission/[^/]+\.(yaml|json|env|ini|enc)$
key_groups: key_groups:
@ -352,7 +292,6 @@ creation_rules:
- *swarsel - *swarsel
age: age:
- *summers - *summers
- *summers-transmission
- path_regex: hosts/darwin/x86_64-darwin/nbm-imba-166/secrets/[^/]+\.(yaml|json|env|ini|enc)$ - path_regex: hosts/darwin/x86_64-darwin/nbm-imba-166/secrets/[^/]+\.(yaml|json|env|ini|enc)$
key_groups: key_groups:

2699
SwarselSystems.org
View file

File diff suppressed because it is too large Load diff

29
flake.lock generated
View file

@ -1460,11 +1460,11 @@
"pre-commit-hooks": "pre-commit-hooks_2" "pre-commit-hooks": "pre-commit-hooks_2"
}, },
"locked": { "locked": {
"lastModified": 1767971910, "lastModified": 1757854196,
"narHash": "sha256-j8vLAUaH8oAU5TSprSGa81wx+roo89iG98mUAutsjb8=", "narHash": "sha256-RDr3/JTpRyXSR1OOg+wzdOUmDL1Ke05OLV/xctbuQOw=",
"owner": "oddlama", "owner": "oddlama",
"repo": "nixos-extra-modules", "repo": "nixos-extra-modules",
"rev": "672abff4255796950924b284b1a2b3dd37113bd2", "rev": "a584a970a05d0410dcb00e0ade684a0c0ce00c4b",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -1598,22 +1598,6 @@
"type": "github" "type": "github"
} }
}, },
"nixpkgs-bisect": {
"locked": {
"lastModified": 1768161245,
"narHash": "sha256-fSidazKIcZElti/a1SOmIwSXw6hXR2GLO/2XmkXgtX4=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "d2a6c7729bbe95f5770ccd4d15a38e5037984b04",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "master",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs-dev": { "nixpkgs-dev": {
"locked": { "locked": {
"lastModified": 1767131767, "lastModified": 1767131767,
@ -1909,11 +1893,11 @@
}, },
"nixpkgs_14": { "nixpkgs_14": {
"locked": { "locked": {
"lastModified": 1737885589, "lastModified": 1763966396,
"narHash": "sha256-Zf0hSrtzaM1DEz8//+Xs51k/wdSajticVrATqDrfQjg=", "narHash": "sha256-6eeL1YPcY1MV3DDStIDIdy/zZCDKgHdkCmsrLJFiZf0=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "852ff1d9e153d8875a83602e03fdef8a63f0ecf8", "rev": "5ae3b07d8d6527c42f17c876e404993199144b6a",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -2675,7 +2659,6 @@
"nixos-images": "nixos-images", "nixos-images": "nixos-images",
"nixos-nftables-firewall": "nixos-nftables-firewall", "nixos-nftables-firewall": "nixos-nftables-firewall",
"nixpkgs": "nixpkgs_18", "nixpkgs": "nixpkgs_18",
"nixpkgs-bisect": "nixpkgs-bisect",
"nixpkgs-dev": "nixpkgs-dev", "nixpkgs-dev": "nixpkgs-dev",
"nixpkgs-kernel": "nixpkgs-kernel", "nixpkgs-kernel": "nixpkgs-kernel",
"nixpkgs-stable": "nixpkgs-stable_3", "nixpkgs-stable": "nixpkgs-stable_3",

1
flake.nix
View file

@ -27,7 +27,6 @@
smallpkgs.url = "github:nixos/nixpkgs/08fcb0dcb59df0344652b38ea6326a2d8271baff?narHash=sha256-HXIQzULIG/MEUW2Q/Ss47oE3QrjxvpUX7gUl4Xp6lnc%3D&shallow=1"; smallpkgs.url = "github:nixos/nixpkgs/08fcb0dcb59df0344652b38ea6326a2d8271baff?narHash=sha256-HXIQzULIG/MEUW2Q/Ss47oE3QrjxvpUX7gUl4Xp6lnc%3D&shallow=1";
nixpkgs-dev.url = "github:Swarsel/nixpkgs/main"; nixpkgs-dev.url = "github:Swarsel/nixpkgs/main";
nixpkgs-bisect.url = "github:nixos/nixpkgs/master";
nixpkgs-kernel.url = "github:NixOS/nixpkgs/063f43f2dbdef86376cc29ad646c45c46e93234c?narHash=sha256-6m1Y3/4pVw1RWTsrkAK2VMYSzG4MMIj7sqUy7o8th1o%3D"; #specifically pinned for kernel version nixpkgs-kernel.url = "github:NixOS/nixpkgs/063f43f2dbdef86376cc29ad646c45c46e93234c?narHash=sha256-6m1Y3/4pVw1RWTsrkAK2VMYSzG4MMIj7sqUy7o8th1o%3D"; #specifically pinned for kernel version
nixpkgs-stable.url = "github:NixOS/nixpkgs/nixos-25.11"; nixpkgs-stable.url = "github:NixOS/nixpkgs/nixos-25.11";
nixpkgs-stable24_05.url = "github:NixOS/nixpkgs/nixos-24.05"; nixpkgs-stable24_05.url = "github:NixOS/nixpkgs/nixos-24.05";

4
hosts/nixos/x86_64-linux/hintbooth/default.nix
View file

@ -68,8 +68,8 @@
guests = lib.mkIf (!minimal && config.swarselsystems.withMicroVMs) ( guests = lib.mkIf (!minimal && config.swarselsystems.withMicroVMs) (
{ } { }
// confLib.mkMicrovm "adguardhome" { } // confLib.mkMicrovm "adguardhome"
// confLib.mkMicrovm "nginx" { } // confLib.mkMicrovm "nginx"
); );
} }

1
hosts/nixos/x86_64-linux/hintbooth/guests/adguardhome/default.nix
View file

@ -3,7 +3,6 @@
imports = [ imports = [
"${self}/profiles/nixos/microvm" "${self}/profiles/nixos/microvm"
"${self}/modules/nixos" "${self}/modules/nixos"
"${self}/modules/nixos/optional/microvm-guest-shares.nix"
]; ];
swarselsystems = { swarselsystems = {

1
hosts/nixos/x86_64-linux/hintbooth/guests/nginx/default.nix
View file

@ -6,7 +6,6 @@ in
imports = [ imports = [
"${self}/profiles/nixos/microvm" "${self}/profiles/nixos/microvm"
"${self}/modules/nixos" "${self}/modules/nixos"
"${self}/modules/nixos/optional/microvm-guest-shares.nix"
]; ];
swarselsystems = { swarselsystems = {

52
hosts/nixos/x86_64-linux/summers/default.nix
View file

@ -1,4 +1,4 @@
{ self, config, inputs, lib, minimal, confLib, ... }: { self, inputs, lib, minimal, ... }:
{ {
imports = [ imports = [
@ -39,7 +39,7 @@
writeGlobalNetworks = false; writeGlobalNetworks = false;
networkKernelModules = [ "igb" ]; networkKernelModules = [ "igb" ];
rootDisk = "/dev/disk/by-id/ata-TS120GMTS420S_J024880123"; rootDisk = "/dev/disk/by-id/ata-TS120GMTS420S_J024880123";
withMicroVMs = true; withMicroVMs = false;
localVLANs = [ "services" "home" ]; # devices is only provided on interface for bmc localVLANs = [ "services" "home" ]; # devices is only provided on interface for bmc
initrdVLAN = "home"; initrdVLAN = "home";
server = { server = {
@ -83,7 +83,7 @@
acme = false; # cert handled by proxy acme = false; # cert handled by proxy
nfs = true; nfs = true;
# kavita = true; kavita = true;
restic = true; restic = true;
jellyfin = true; jellyfin = true;
navidrome = true; navidrome = true;
@ -109,29 +109,29 @@
opkssh = true; opkssh = true;
}; };
guests = lib.mkIf (!minimal && config.swarselsystems.withMicroVMs) ( # guests = lib.mkIf (!minimal && config.swarselsystems.withMicroVMs) (
{ } # { }
// confLib.mkMicrovm "kavita" { withZfs = true; } # // confLib.mkMicrovm "kavita"
// confLib.mkMicrovm "jellyfin" { withZfs = true; } # // confLib.mkMicrovm "jellyfin"
// confLib.mkMicrovm "audio" { withZfs = true; } # // confLib.mkMicrovm "audio"
// confLib.mkMicrovm "postgresql" { withZfs = true; } # // confLib.mkMicrovm "postgresql"
// confLib.mkMicrovm "matrix" { withZfs = true; } # // confLib.mkMicrovm "matrix"
// confLib.mkMicrovm "nextcloud" { withZfs = true; } # // confLib.mkMicrovm "nextcloud"
// confLib.mkMicrovm "immich" { withZfs = true; } # // confLib.mkMicrovm "immich"
// confLib.mkMicrovm "paperless" { withZfs = true; } # // confLib.mkMicrovm "paperless"
// confLib.mkMicrovm "transmission" { withZfs = true; } # // confLib.mkMicrovm "transmission"
// confLib.mkMicrovm "storage" { withZfs = true; } # // confLib.mkMicrovm "storage"
// confLib.mkMicrovm "monitoring" { withZfs = true; } # // confLib.mkMicrovm "monitoring"
// confLib.mkMicrovm "freshrss" { withZfs = true; } # // confLib.mkMicrovm "freshrss"
// confLib.mkMicrovm "kanidm" { withZfs = true; } # // confLib.mkMicrovm "kanidm"
// confLib.mkMicrovm "firefly" { withZfs = true; } # // confLib.mkMicrovm "firefly"
// confLib.mkMicrovm "koillection" { withZfs = true; } # // confLib.mkMicrovm "koillection"
// confLib.mkMicrovm "radicale" { withZfs = true; } # // confLib.mkMicrovm "radicale"
// confLib.mkMicrovm "atuin" { withZfs = true; } # // confLib.mkMicrovm "atuin"
// confLib.mkMicrovm "forgejo" { withZfs = true; } # // confLib.mkMicrovm "forgejo"
// confLib.mkMicrovm "ankisync" { withZfs = true; } # // confLib.mkMicrovm "ankisync"
// confLib.mkMicrovm "homebox" { withZfs = true; } # // confLib.mkMicrovm "homebox"
); # );
networking.nftables.firewall.zones.untrusted.interfaces = [ "lan" "bmc" ]; networking.nftables.firewall.zones.untrusted.interfaces = [ "lan" "bmc" ];

4
hosts/nixos/x86_64-linux/summers/guests/ankisync/default.nix
View file

@ -27,7 +27,7 @@
} // lib.optionalAttrs (!minimal) { } // lib.optionalAttrs (!minimal) {
microvm = { microvm = {
mem = 1024 * 1; mem = 1024 * 2;
vcpu = 1; vcpu = 1;
}; };
@ -36,7 +36,7 @@
}; };
swarselmodules.server = { swarselmodules.server = {
# ankisync = true; ankisync = true;
}; };
} }

2
hosts/nixos/x86_64-linux/summers/guests/atuin/default.nix
View file

@ -36,7 +36,7 @@
}; };
swarselmodules.server = { swarselmodules.server = {
# atuin = true; atuin = true;
}; };
} }

6
hosts/nixos/x86_64-linux/summers/guests/audio/default.nix
View file

@ -36,9 +36,9 @@
}; };
swarselmodules.server = { swarselmodules.server = {
# navidrome = true; navidrome = true;
# spotifyd = true; spotifyd = true;
# mpd = true; mpd = true;
}; };
} }

5
hosts/nixos/x86_64-linux/summers/guests/firefly/default.nix
View file

@ -36,9 +36,8 @@
}; };
swarselmodules.server = { swarselmodules.server = {
# firefly-iii = true; firefly-iii = true;
# nginx = true; nginx = true;
# acme = true;
}; };
} }

4
hosts/nixos/x86_64-linux/summers/guests/forgejo/default.nix
View file

@ -27,7 +27,7 @@
} // lib.optionalAttrs (!minimal) { } // lib.optionalAttrs (!minimal) {
microvm = { microvm = {
mem = 1024 * 1; mem = 1024 * 2;
vcpu = 1; vcpu = 1;
}; };
@ -36,7 +36,7 @@
}; };
swarselmodules.server = { swarselmodules.server = {
# forgejo = true; forgejo = true;
}; };
} }

5
hosts/nixos/x86_64-linux/summers/guests/freshrss/default.nix
View file

@ -36,9 +36,8 @@
}; };
swarselmodules.server = { swarselmodules.server = {
# freshrss = true; freshrss = true;
# nginx = true; nginx = true;
# acme = true;
}; };
} }

4
hosts/nixos/x86_64-linux/summers/guests/homebox/default.nix
View file

@ -27,7 +27,7 @@
} // lib.optionalAttrs (!minimal) { } // lib.optionalAttrs (!minimal) {
microvm = { microvm = {
mem = 1024 * 1; mem = 1024 * 2;
vcpu = 1; vcpu = 1;
}; };
@ -36,7 +36,7 @@
}; };
swarselmodules.server = { swarselmodules.server = {
# homebox = true; homebox = true;
}; };
} }

2
hosts/nixos/x86_64-linux/summers/guests/immich/default.nix
View file

@ -36,7 +36,7 @@
}; };
swarselmodules.server = { swarselmodules.server = {
# immich = true; immich = true;
}; };
} }

4
hosts/nixos/x86_64-linux/summers/guests/jellyfin/default.nix
View file

@ -27,7 +27,7 @@
} // lib.optionalAttrs (!minimal) { } // lib.optionalAttrs (!minimal) {
microvm = { microvm = {
mem = 1024 * 3; mem = 1024 * 2;
vcpu = 1; vcpu = 1;
}; };
@ -36,7 +36,7 @@
}; };
swarselmodules.server = { swarselmodules.server = {
# jellyfin = true; jellyfin = true;
}; };
} }

2
hosts/nixos/x86_64-linux/summers/guests/kanidm/default.nix
View file

@ -36,7 +36,7 @@
}; };
swarselmodules.server = { swarselmodules.server = {
# kanidm = true; kanidm = true;
}; };
} }

3
hosts/nixos/x86_64-linux/summers/guests/kavita/default.nix
View file

@ -29,7 +29,6 @@
microvm = { microvm = {
mem = 1024 * 1; mem = 1024 * 1;
vcpu = 1; vcpu = 1;
}; };
swarselprofiles = { swarselprofiles = {
@ -37,7 +36,7 @@
}; };
swarselmodules.server = { swarselmodules.server = {
# kavita = true; kavita = true;
}; };
} }

4
hosts/nixos/x86_64-linux/summers/guests/koillection/default.nix
View file

@ -27,7 +27,7 @@
} // lib.optionalAttrs (!minimal) { } // lib.optionalAttrs (!minimal) {
microvm = { microvm = {
mem = 1024 * 1; mem = 1024 * 2;
vcpu = 1; vcpu = 1;
}; };
@ -36,7 +36,7 @@
}; };
swarselmodules.server = { swarselmodules.server = {
# koillection = true; koillection = true;
}; };
} }

2
hosts/nixos/x86_64-linux/summers/guests/matrix/default.nix
View file

@ -36,7 +36,7 @@
}; };
swarselmodules.server = { swarselmodules.server = {
# matrix = true; matrix = true;
}; };
} }

4
hosts/nixos/x86_64-linux/summers/guests/monitoring/default.nix
View file

@ -27,7 +27,7 @@
} // lib.optionalAttrs (!minimal) { } // lib.optionalAttrs (!minimal) {
microvm = { microvm = {
mem = 1024 * 3; mem = 1024 * 2;
vcpu = 2; vcpu = 2;
}; };
@ -36,7 +36,7 @@
}; };
swarselmodules.server = { swarselmodules.server = {
# grafana = true; grafana = true;
}; };
} }

5
hosts/nixos/x86_64-linux/summers/guests/nextcloud/default.nix
View file

@ -36,9 +36,8 @@
}; };
swarselmodules.server = { swarselmodules.server = {
# nextcloud = true; nextcloud = true;
# nginx = true; nginx = true;
# acme = true;
}; };
} }

2
hosts/nixos/x86_64-linux/summers/guests/paperless/default.nix
View file

@ -36,7 +36,7 @@
}; };
swarselmodules.server = { swarselmodules.server = {
# paperless = true; paperless = true;
}; };
} }

4
hosts/nixos/x86_64-linux/summers/guests/postgresql/default.nix
View file

@ -27,7 +27,7 @@
} // lib.optionalAttrs (!minimal) { } // lib.optionalAttrs (!minimal) {
microvm = { microvm = {
mem = 1024 * 1; mem = 1024 * 2;
vcpu = 1; vcpu = 1;
}; };
@ -36,7 +36,7 @@
}; };
swarselmodules.server = { swarselmodules.server = {
# postgresql = true; postgresql = true;
}; };
} }

4
hosts/nixos/x86_64-linux/summers/guests/radicale/default.nix
View file

@ -27,7 +27,7 @@
} // lib.optionalAttrs (!minimal) { } // lib.optionalAttrs (!minimal) {
microvm = { microvm = {
mem = 1024 * 1; mem = 1024 * 2;
vcpu = 1; vcpu = 1;
}; };
@ -36,7 +36,7 @@
}; };
swarselmodules.server = { swarselmodules.server = {
# radicale = true; radicale = true;
}; };
} }

6
hosts/nixos/x86_64-linux/summers/guests/storage/default.nix
View file

@ -27,7 +27,7 @@
} // lib.optionalAttrs (!minimal) { } // lib.optionalAttrs (!minimal) {
microvm = { microvm = {
mem = 1024 * 4; mem = 1024 * 2;
vcpu = 2; vcpu = 2;
}; };
@ -36,8 +36,8 @@
}; };
swarselmodules.server = { swarselmodules.server = {
# nfs = true; nfs = true;
# syncthing = true; syncthing = true;
}; };
} }

4
hosts/nixos/x86_64-linux/summers/guests/transmission/default.nix
View file

@ -27,7 +27,7 @@
} // lib.optionalAttrs (!minimal) { } // lib.optionalAttrs (!minimal) {
microvm = { microvm = {
mem = 1024 * 4; mem = 1024 * 2;
vcpu = 2; vcpu = 2;
}; };
@ -36,7 +36,7 @@
}; };
swarselmodules.server = { swarselmodules.server = {
# transmission = true; transmission = true;
}; };
} }

2
hosts/nixos/x86_64-linux/winters/hardware-configuration.nix
View file

@ -1,4 +1,4 @@
{ lib, config, modulesPath, ... }: { lib, modulesPath, ... }:
{ {
imports = imports =

4
modules/nixos/common/pii.nix
View file

@ -1,5 +1,5 @@
# largely based on https://github.com/oddlama/nix-config/blob/main/modules/secrets.nix # largely based on https://github.com/oddlama/nix-config/blob/main/modules/secrets.nix
{ config, inputs, lib, nodes, globals, ... }: { config, inputs, lib, nodes, ... }:
let let
# If the given expression is a bare set, it will be wrapped in a function, # If the given expression is a bare set, it will be wrapped in a function,
# so that the imported file can always be applied to the inputs, similar to # so that the imported file can always be applied to the inputs, similar to
@ -53,7 +53,7 @@ in
secrets = lib.mkOption { secrets = lib.mkOption {
readOnly = true; readOnly = true;
default = lib.mapAttrs (_: x: importEncrypted x { inherit lib nodes globals inputs; inherit (inputs.topologyPrivate) topologyPrivate; }) config.repo.secretFiles; default = lib.mapAttrs (_: x: importEncrypted x { inherit lib nodes inputs; inherit (inputs.topologyPrivate) topologyPrivate; }) config.repo.secretFiles;
type = lib.types.unspecified; type = lib.types.unspecified;
description = "Exposes the loaded repo secrets. This option is read-only."; description = "Exposes the loaded repo secrets. This option is read-only.";
}; };

2
modules/nixos/common/users.nix
View file

@ -13,8 +13,6 @@
}; };
"${config.swarselsystems.mainUser}" = { "${config.swarselsystems.mainUser}" = {
isNormalUser = true; isNormalUser = true;
uid = 1000;
autoSubUidGidRange = false;
description = "Leon S"; description = "Leon S";
password = lib.mkIf (minimal || config.swarselsystems.isPublic) "setup"; password = lib.mkIf (minimal || config.swarselsystems.isPublic) "setup";
hashedPasswordFile = lib.mkIf (!minimal && !config.swarselsystems.isPublic) config.sops.secrets.main-user-hashed-pw.path; hashedPasswordFile = lib.mkIf (!minimal && !config.swarselsystems.isPublic) config.sops.secrets.main-user-hashed-pw.path;

15
modules/nixos/optional/microvm-guest-shares.nix
View file

@ -1,15 +0,0 @@
{ self, lib, config, inputs, microVMParent, nodes, ... }:
{
config = {
microvm = {
shares = [
{
tag = "persist";
source = "${lib.optionalString nodes.${microVMParent}.config.swarselsystems.isImpermanence "/persist"}/microvms/${config.networking.hostName}";
mountPoint = "/persist";
proto = "virtiofs";
}
];
};
};
}

32
modules/nixos/optional/microvm-guest.nix
View file

@ -1,4 +1,4 @@
{ self, lib, config, inputs, microVMParent, nodes, globals, confLib, ... }: { self, lib, config, inputs, microVMParent, nodes, ... }:
{ {
imports = [ imports = [
inputs.disko.nixosModules.disko inputs.disko.nixosModules.disko
@ -49,16 +49,24 @@
}; };
}; };
# microvm = { microvm = {
# mount the writeable overlay so that we can use nix shells inside the microvm shares = [
# volumes = [ {
# { tag = "persist";
# image = "/tmp/nix-store-overlay-${config.networking.hostName}.img"; source = "${lib.optionalString nodes.${microVMParent}.config.swarselsystems.isImpermanence "/persist"}/microvms/${config.networking.hostName}";
# autoCreate = true; mountPoint = "/persist";
# mountPoint = config.microvm.writableStoreOverlay; proto = "virtiofs";
# size = 1024; }
# } ];
# ]; # mount the writeable overlay so that we can use nix shells inside the microvm
# }; volumes = [
{
image = "/tmp/nix-store-overlay-${config.networking.hostName}.img";
autoCreate = true;
mountPoint = config.microvm.writableStoreOverlay;
size = 1024;
}
];
};
}; };
} }

4
modules/nixos/optional/microvm-host.nix
View file

@ -1,4 +1,4 @@
{ config, lib, confLib, ... }: { config, lib, ... }:
{ {
config = lib.mkIf (config.guests != { }) { config = lib.mkIf (config.guests != { }) {
@ -17,7 +17,5 @@
(builtins.attrNames config.guests) (builtins.attrNames config.guests)
); );
users.persistentIds.microvm = confLib.mkIds 999;
}; };
} }

7
modules/nixos/server/acme.nix
View file

@ -1,4 +1,4 @@
{ self, pkgs, lib, config, globals, confLib, ... }: { self, pkgs, lib, config, globals, ... }:
let let
inherit (config.repo.secrets.common) dnsProvider dnsBase dnsMail; inherit (config.repo.secrets.common) dnsProvider dnsBase dnsMail;
@ -21,10 +21,7 @@ in
''; '';
}; };
users = { users.groups.acme.members = lib.mkIf config.swarselmodules.server.nginx [ "nginx" ];
persistentIds.acme = confLib.mkIds 967;
groups.acme.members = lib.mkIf config.swarselmodules.server.nginx [ "nginx" ];
};
security.acme = { security.acme = {
acceptTerms = true; acceptTerms = true;

6
modules/nixos/server/disk-encrypt.nix
View file

@ -45,9 +45,9 @@ in
}; };
boot = lib.mkIf (!config.swarselsystems.isClient) { boot = lib.mkIf (!config.swarselsystems.isClient) {
# kernelParams = lib.mkIf (!config.swarselsystems.isCloud && ((config.swarselsystems.localVLANs == []) || isRouter)) [ kernelParams = lib.mkIf (!config.swarselsystems.isCloud && ((config.swarselsystems.localVLANs == [ ]) || isRouter)) [
# "ip=${localIp}::${gatewayIp}:${subnetMask}:${config.networking.hostName}::none" "ip=${localIp}::${gatewayIp}:${subnetMask}:${config.networking.hostName}::none"
# ]; ];
initrd = { initrd = {
secrets."/tmp${hostKeyPathBase}" = if minimal then (lib.mkForce generatedHostKey) else (lib.mkForce hostKeyPath); # need to mkForce this or it behaves stateful secrets."/tmp${hostKeyPathBase}" = if minimal then (lib.mkForce generatedHostKey) else (lib.mkForce hostKeyPath); # need to mkForce this or it behaves stateful
availableKernelModules = config.swarselsystems.networkKernelModules; availableKernelModules = config.swarselsystems.networkKernelModules;

3
modules/nixos/server/firefly-iii.nix
View file

@ -13,9 +13,6 @@ in
config = lib.mkIf config.swarselmodules.server.${serviceName} { config = lib.mkIf config.swarselmodules.server.${serviceName} {
users = { users = {
persistentIds = {
firefly-iii = confLib.mkIds 983;
};
groups.${serviceGroup} = { }; groups.${serviceGroup} = { };
users.${serviceUser} = { users.${serviceUser} = {
group = lib.mkForce serviceGroup; group = lib.mkForce serviceGroup;

11
modules/nixos/server/forgejo.nix
View file

@ -12,14 +12,9 @@ in
# networking.firewall.allowedTCPPorts = [ servicePort ]; # networking.firewall.allowedTCPPorts = [ servicePort ];
users = { users.users.${serviceUser} = {
persistentIds = { group = serviceGroup;
forgejo = confLib.mkIds 985; isSystemUser = true;
};
users.${serviceUser} = {
group = serviceGroup;
isSystemUser = true;
};
}; };
users.groups.${serviceGroup} = { }; users.groups.${serviceGroup} = { };

13
modules/nixos/server/freshrss.nix
View file

@ -9,15 +9,10 @@ in
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server"; options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
config = lib.mkIf config.swarselmodules.server.${serviceName} { config = lib.mkIf config.swarselmodules.server.${serviceName} {
users = { users.users.${serviceUser} = {
persistentIds = { extraGroups = [ "users" ];
freshrss = confLib.mkIds 986; group = serviceGroup;
}; isSystemUser = true;
users.${serviceUser} = {
extraGroups = [ "users" ];
group = serviceGroup;
isSystemUser = true;
};
}; };
users.groups.${serviceGroup} = { }; users.groups.${serviceGroup} = { };

19
modules/nixos/server/homebox.nix
View file

@ -13,10 +13,6 @@ in
icon = "${self}/files/topology-images/${serviceName}.png"; icon = "${self}/files/topology-images/${serviceName}.png";
}; };
users.persistentIds = {
homebox = confLib.mkIds 981;
};
globals = { globals = {
networks = { networks = {
${webProxyIf}.hosts = lib.mkIf isProxied { ${webProxyIf}.hosts = lib.mkIf isProxied {
@ -33,25 +29,14 @@ in
}; };
}; };
systemd.services.homebox = {
environment = {
TMPDIR = "/var/lib/homebox/.tmp";
};
serviceConfig = {
# ReadWritePaths = "/var/lib/homebox";
RuntimeDirectory = "homebox";
BindPaths = "/run/homebox:/var/lib/homebox/.tmp";
};
};
services.${serviceName} = { services.${serviceName} = {
enable = true; enable = true;
package = pkgs.bisect.homebox; package = pkgs.dev.homebox;
database.createLocally = true; database.createLocally = true;
settings = { settings = {
HBOX_WEB_PORT = builtins.toString servicePort; HBOX_WEB_PORT = builtins.toString servicePort;
HBOX_OPTIONS_ALLOW_REGISTRATION = "false"; HBOX_OPTIONS_ALLOW_REGISTRATION = "false";
HBOX_STORAGE_CONN_STRING = "file:///var/lib/homebox"; HBOX_STORAGE_CONN_STRING = "file:///Vault/data/homebox";
HBOX_STORAGE_PREFIX_PATH = ".data"; HBOX_STORAGE_PREFIX_PATH = ".data";
}; };
}; };

103
modules/nixos/server/id.nix
View file

@ -1,103 +0,0 @@
{ lib, config, confLib, ... }:
let
inherit (lib)
concatLists
flip
mapAttrsToList
mkDefault
mkIf
mkOption
types
;
cfg = config.users.persistentIds;
in
{
options = {
swarselmodules.server.ids = lib.mkEnableOption "enable persistent ids on server";
users.persistentIds = mkOption {
default = { };
description = ''
Maps a user or group name to its expected uid/gid values. If a user/group is
used on the system without specifying a uid/gid, this module will assign the
corresponding ids defined here, or show an error if the definition is missing.
'';
type = types.attrsOf (
types.submodule {
options = {
uid = mkOption {
type = types.nullOr types.int;
default = null;
description = "The uid to assign if it is missing in `users.users.<name>`.";
};
gid = mkOption {
type = types.nullOr types.int;
default = null;
description = "The gid to assign if it is missing in `users.groups.<name>`.";
};
};
}
);
};
users.users = mkOption {
type = types.attrsOf (
types.submodule (
{ name, ... }:
{
config.uid =
let
persistentUid = cfg.${name}.uid or null;
in
mkIf (persistentUid != null) (mkDefault persistentUid);
}
)
);
};
users.groups = mkOption {
type = types.attrsOf (
types.submodule (
{ name, ... }:
{
config.gid =
let
persistentGid = cfg.${name}.gid or null;
in
mkIf (persistentGid != null) (mkDefault persistentGid);
}
)
);
};
};
config = lib.mkIf config.swarselmodules.server.ids {
assertions =
concatLists
(
flip mapAttrsToList config.users.users (
name: user: [
{
assertion = user.uid != null;
message = "non-persistent uid detected for '${name}', please assign one via `users.persistentIds`";
}
{
assertion = !user.autoSubUidGidRange;
message = "non-persistent subUids/subGids detected for: ${name}";
}
]
)
)
++ flip mapAttrsToList config.users.groups (
name: group: {
assertion = group.gid != null;
message = "non-persistent gid detected for '${name}', please assign one via `users.persistentIds`";
}
);
users.persistentIds = {
systemd-coredump = confLib.mkIds 998;
systemd-oom = confLib.mkIds 997;
polkituser = confLib.mkIds 973;
nscd = confLib.mkIds 972;
};
};
}

10
modules/nixos/server/immich.nix
View file

@ -7,14 +7,8 @@ in
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server"; options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
config = lib.mkIf config.swarselmodules.server.${serviceName} { config = lib.mkIf config.swarselmodules.server.${serviceName} {
users = { users.users.${serviceUser} = {
persistentIds = { extraGroups = [ "video" "render" "users" ];
immich = confLib.mkIds 989;
redis-immich = confLib.mkIds 977;
};
users.${serviceUser} = {
extraGroups = [ "video" "render" "users" ];
};
}; };
topology.self.services.${serviceName}.info = "https://${serviceDomain}"; topology.self.services.${serviceName}.info = "https://${serviceDomain}";

8
modules/nixos/server/jellyfin.nix
View file

@ -7,12 +7,10 @@ in
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server"; options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
config = lib.mkIf config.swarselmodules.server.${serviceName} { config = lib.mkIf config.swarselmodules.server.${serviceName} {
users = { users.users.${serviceUser} = {
persistentIds.jellyfin = confLib.mkIds 994; extraGroups = [ "video" "render" "users" ];
users.${serviceUser} = {
extraGroups = [ "video" "render" "users" ];
};
}; };
# nixpkgs.config.packageOverrides = pkgs: { # nixpkgs.config.packageOverrides = pkgs: {
# intel-vaapi-driver = pkgs.intel-vaapi-driver.override { enableHybridCodec = true; }; # intel-vaapi-driver = pkgs.intel-vaapi-driver.override { enableHybridCodec = true; };
# }; # };

3
modules/nixos/server/kanidm.nix
View file

@ -34,9 +34,6 @@ in
users = { users = {
persistentIds = {
kanidm = confLib.mkIds 984;
};
users.${serviceUser} = { users.${serviceUser} = {
group = serviceGroup; group = serviceGroup;
isSystemUser = true; isSystemUser = true;

9
modules/nixos/server/kavita.nix
View file

@ -12,13 +12,10 @@ in
calibre calibre
]; ];
users = {
persistentIds.kavita = confLib.mkIds 995;
users.${serviceUser} = {
extraGroups = [ "users" ];
};
};
users.users.${serviceUser} = {
extraGroups = [ "users" ];
};
sops.secrets.kavita-token = { inherit sopsFile; owner = serviceUser; }; sops.secrets.kavita-token = { inherit sopsFile; owner = serviceUser; };

2
modules/nixos/server/kea.nix
View file

@ -82,8 +82,6 @@ in
{ directory = serviceDir; mode = "0700"; } { directory = serviceDir; mode = "0700"; }
]; ];
users.persistentIds.kea = confLib.mkIds 968;
topology = { topology = {
extractors.kea.enable = false; extractors.kea.enable = false;
self.services.${serviceName} = { self.services.${serviceName} = {

5
modules/nixos/server/matrix.nix
View file

@ -314,11 +314,6 @@ in
# restart the bridges daily. this is done for the signal bridge mainly which stops carrying # restart the bridges daily. this is done for the signal bridge mainly which stops carrying
# messages out after a while. # messages out after a while.
users.persistentIds = {
mautrix-signal = confLib.mkIds 993;
mautrix-whatsapp = confLib.mkIds 992;
mautrix-telegram = confLib.mkIds 991;
};
nodes = nodes =
let let

5
modules/nixos/server/monitoring.nix
View file

@ -42,11 +42,6 @@ in
}; };
users = { users = {
persistentIds = {
nextcloud-exporter = confLib.mkIds 988;
node-exporter = confLib.mkIds 987;
grafana = confLib.mkIds 974;
};
users = { users = {
nextcloud-exporter = { nextcloud-exporter = {
extraGroups = [ "nextcloud" ]; extraGroups = [ "nextcloud" ];

5
modules/nixos/server/nextcloud.nix
View file

@ -16,11 +16,6 @@ in
kanidm-nextcloud-client = { inherit sopsFile; owner = serviceUser; group = serviceGroup; mode = "0440"; }; kanidm-nextcloud-client = { inherit sopsFile; owner = serviceUser; group = serviceGroup; mode = "0440"; };
}; };
users.persistentIds = {
nextcloud = confLib.mkIds 990;
redis-nextcloud = confLib.mkIds 976;
};
globals.services.${serviceName} = { globals.services.${serviceName} = {
domain = serviceDomain; domain = serviceDomain;
inherit proxyAddress4 proxyAddress6 isHome serviceAddress; inherit proxyAddress4 proxyAddress6 isHome serviceAddress;

7
modules/nixos/server/nfs.nix
View file

@ -1,15 +1,10 @@
{ lib, config, pkgs, globals, confLib, ... }: { lib, config, pkgs, globals, ... }:
let let
nfsUser = globals.user.name; nfsUser = globals.user.name;
in in
{ {
options.swarselmodules.server.nfs = lib.mkEnableOption "enable nfs on server"; options.swarselmodules.server.nfs = lib.mkEnableOption "enable nfs on server";
config = lib.mkIf config.swarselmodules.server.nfs { config = lib.mkIf config.swarselmodules.server.nfs {
users.persistentIds = {
avahi = confLib.mkIds 978;
};
services = { services = {
# add a user with sudo smbpasswd -a <user> # add a user with sudo smbpasswd -a <user>
samba = { samba = {

3
modules/nixos/server/opkssh.nix
View file

@ -11,9 +11,6 @@ in
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server"; options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
config = lib.mkIf config.swarselmodules.server.${serviceName} { config = lib.mkIf config.swarselmodules.server.${serviceName} {
users.persistentIds = {
opksshuser = confLib.mkIds 980;
};
services.${serviceName} = { services.${serviceName} = {
enable = true; enable = true;

9
modules/nixos/server/paperless.nix
View file

@ -12,13 +12,8 @@ in
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server"; options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
config = lib.mkIf config.swarselmodules.server.${serviceName} { config = lib.mkIf config.swarselmodules.server.${serviceName} {
users = { users.users.${serviceUser} = {
persistentIds = { extraGroups = [ "users" ];
redis-paperless = confLib.mkIds 975;
};
users.${serviceUser} = {
extraGroups = [ "users" ];
};
}; };
sops.secrets = { sops.secrets = {

6
modules/nixos/server/pipewire.nix
View file

@ -1,11 +1,9 @@
{ lib, config, confLib, ... }: { lib, config, ... }:
{ {
config = lib.mkIf (config.swarselmodules.server.mpd || config.swarselmodules.server.navidrome) { config = lib.mkIf (config?swarselmodules.server.mpd || config?swarselmodules.server.navidrome) {
security.rtkit.enable = true; # this is required for pipewire real-time access security.rtkit.enable = true; # this is required for pipewire real-time access
users.persistentIds.rtkit = confLib.mkIds 996;
services.pipewire = { services.pipewire = {
enable = true; enable = true;
pulse.enable = true; pulse.enable = true;

6
modules/nixos/server/podman.nix
View file

@ -1,4 +1,4 @@
{ config, lib, confLib, ... }: { config, lib, ... }:
let let
serviceName = "podman"; serviceName = "podman";
in in
@ -6,10 +6,6 @@ in
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server"; options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
config = lib.mkIf config.swarselmodules.server.${serviceName} { config = lib.mkIf config.swarselmodules.server.${serviceName} {
users.persistentIds = {
podman = confLib.mkIds 969;
};
virtualisation = { virtualisation = {
podman.enable = true; podman.enable = true;
oci-containers.backend = "podman"; oci-containers.backend = "podman";

4
modules/nixos/server/radicale.nix
View file

@ -29,10 +29,6 @@ in
}; };
}; };
users.persistentIds = {
radicale = confLib.mkIds 982;
};
topology.self.services.${serviceName}.info = "https://${serviceDomain}"; topology.self.services.${serviceName}.info = "https://${serviceDomain}";
globals = { globals = {

4
modules/nixos/server/restic.nix
View file

@ -11,10 +11,6 @@ in
paths = lib.mkOption { paths = lib.mkOption {
type = lib.types.listOf lib.types.str; type = lib.types.listOf lib.types.str;
}; };
withPostgres = lib.mkOption {
type = lib.types.bool;
default = false;
};
}; };
config = lib.mkIf config.swarselmodules.server.restic { config = lib.mkIf config.swarselmodules.server.restic {

29
modules/nixos/server/ssh.nix
View file

@ -1,4 +1,4 @@
{ self, lib, config, withHomeManager, confLib, ... }: { self, lib, config, withHomeManager, ... }:
{ {
options.swarselmodules.server.ssh = lib.mkEnableOption "enable ssh on server"; options.swarselmodules.server.ssh = lib.mkEnableOption "enable ssh on server";
config = lib.mkIf config.swarselmodules.server.ssh { config = lib.mkIf config.swarselmodules.server.ssh {
@ -21,22 +21,17 @@
} }
]; ];
}; };
users = { users.users = {
persistentIds = { "${config.swarselsystems.mainUser}".openssh.authorizedKeys.keyFiles = lib.mkIf withHomeManager [
sshd = lib.mkIf config.swarselmodules.server.ids (confLib.mkIds 979); (self + /secrets/public/ssh/yubikey.pub)
}; (self + /secrets/public/ssh/magicant.pub)
users = { # (lib.mkIf config.swarselsystems.isBastionTarget (self + /secrets/public/ssh/jump.pub))
"${config.swarselsystems.mainUser}".openssh.authorizedKeys.keyFiles = lib.mkIf withHomeManager [ ];
(self + /secrets/public/ssh/yubikey.pub) root.openssh.authorizedKeys.keyFiles = [
(self + /secrets/public/ssh/magicant.pub) (self + /secrets/public/ssh/yubikey.pub)
# (lib.mkIf config.swarselsystems.isBastionTarget (self + /secrets/public/ssh/jump.pub)) (self + /secrets/public/ssh/magicant.pub)
]; # (lib.mkIf config.swarselsystems.isBastionTarget (self + /secrets/public/ssh/jump.pub))
root.openssh.authorizedKeys.keyFiles = [ ];
(self + /secrets/public/ssh/yubikey.pub)
(self + /secrets/public/ssh/magicant.pub)
# (lib.mkIf config.swarselsystems.isBastionTarget (self + /secrets/public/ssh/jump.pub))
];
};
}; };
security.sudo.extraConfig = '' security.sudo.extraConfig = ''
Defaults env_keep+=SSH_AUTH_SOCK Defaults env_keep+=SSH_AUTH_SOCK

4
modules/nixos/server/transmission.nix
View file

@ -25,10 +25,6 @@ in
# this user/group section is probably unneeded # this user/group section is probably unneeded
users = { users = {
persistentIds = {
prowlarr = confLib.mkIds 971;
readarr = confLib.mkIds 970;
};
groups = { groups = {
dockeruser = { dockeruser = {
gid = 1155; gid = 1155;

128
modules/shared/config-lib.nix
View file

@ -53,104 +53,44 @@ in
homeServiceAddress = lib.optionalString (config.swarselsystems.server.wireguard.interfaces ? wgHome) globals.networks."${config.swarselsystems.server.wireguard.interfaces.wgHome.serverNetConfigPrefix}-wgHome".hosts.${config.node.name}.ipv4; homeServiceAddress = lib.optionalString (config.swarselsystems.server.wireguard.interfaces ? wgHome) globals.networks."${config.swarselsystems.server.wireguard.interfaces.wgHome.serverNetConfigPrefix}-wgHome".hosts.${config.node.name}.ipv4;
}; };
mkIds = id: {
uid = id;
gid = id;
};
mkDeviceMac = id:
let
mod = n: d: n - (n / d) * d;
toHexByte = n:
let
hex = "0123456789abcdef";
hi = n / 16;
lo = mod n 16;
in
builtins.substring hi 1 hex
+ builtins.substring lo 1 hex;
max = 16777215; # 256^3 - 1
b1 = id / (256 * 256);
r1 = mod id (256 * 256);
b2 = r1 / 256;
b3 = mod r1 256;
in
if
(id <= max)
then
(builtins.concatStringsSep ":"
(map toHexByte [ b1 b2 b3 ]))
else
(throw "Device MAC ID too large (max is 16777215)");
mkMicrovm = mkMicrovm =
if config.swarselsystems.withMicroVMs then if config.swarselsystems.withMicroVMs then
(guestName: (guestName: {
{ enableStorage ? false ${guestName} = {
, withZfs ? false backend = "microvm";
, ... autostart = true;
}: modules = [
{ (config.node.configDir + /guests/${guestName}/default.nix)
${guestName} = { {
backend = "microvm"; node.secretsDir = config.node.configDir + /secrets/${guestName};
autostart = true; node.configDir = config.node.configDir + /guests/${guestName};
zfs = lib.mkIf withZfs { networking.nftables.firewall = {
# stateful config that should be backed up zones.untrusted.interfaces = lib.mkIf
"/state" = { (
pool = "Vault"; lib.length config.guests.${guestName}.networking.links == 1
dataset = "guests/${guestName}/state"; )
config.guests.${guestName}.networking.links;
}; };
# data that should be backed up }
"/storage" = lib.mkIf enableStorage { "${self}/modules/nixos/optional/microvm-guest.nix"
pool = "Vault"; "${self}/modules/nixos/optional/systemd-networkd-base.nix"
dataset = "guests/${guestName}/storage"; ];
}; microvm = {
# other stuff that should only reside on disk, not backed up system = config.node.arch;
"/persist" = { baseMac = config.repo.secrets.local.networking.networks.lan.mac;
pool = "Vault"; interfaces.vlan-services = { };
dataset = "guests/${guestName}/persist";
};
};
modules = [
(config.node.configDir + /guests/${guestName}/default.nix)
{
node.secretsDir = config.node.configDir + /secrets/${guestName};
node.configDir = config.node.configDir + /guests/${guestName};
networking.nftables.firewall = {
zones.untrusted.interfaces = lib.mkIf
(
lib.length config.guests.${guestName}.networking.links == 1
)
config.guests.${guestName}.networking.links;
};
}
"${self}/modules/nixos/optional/microvm-guest.nix"
"${self}/modules/nixos/optional/systemd-networkd-base.nix"
];
microvm = {
system = config.node.arch;
baseMac = config.repo.secrets.local.networking.networks.lan.mac;
interfaces.vlan-services = {
mac = lib.mkForce "02:${lib.substring 3 5 config.guests.${guestName}.microvm.baseMac}:${mkDeviceMac globals.networks.home-lan.vlans.services.hosts."${config.node.name}-${guestName}".id}";
};
};
extraSpecialArgs = {
inherit (inputs.self) nodes;
inherit (inputs.self.pkgs.${config.node.arch}) lib;
inherit inputs outputs minimal;
inherit (inputs) self;
withHomeManager = false;
microVMParent = config.node.name;
globals = inputs.self.globals.${config.node.arch};
};
}; };
}) else extraSpecialArgs = {
(_: { inherit (inputs.self) nodes;
_ = { }; inherit (inputs.self.pkgs.${config.node.arch}) lib;
}); inherit inputs outputs minimal;
inherit (inputs) self;
withHomeManager = false;
microVMParent = config.node.name;
globals = inputs.self.globals.${config.node.arch};
};
};
}) else (_: { _ = { }; });
genNginx = genNginx =
{ serviceAddress { serviceAddress

1
profiles/nixos/localserver/default.nix
View file

@ -17,7 +17,6 @@
nftables = lib.mkDefault true; nftables = lib.mkDefault true;
server = { server = {
general = lib.mkDefault true; general = lib.mkDefault true;
ids = lib.mkDefault true;
network = lib.mkDefault true; network = lib.mkDefault true;
diskEncryption = lib.mkDefault true; diskEncryption = lib.mkDefault true;
packages = lib.mkDefault true; packages = lib.mkDefault true;

1
profiles/nixos/microvm/default.nix
View file

@ -18,7 +18,6 @@
nftables = lib.mkDefault true; nftables = lib.mkDefault true;
server = { server = {
general = lib.mkDefault true; general = lib.mkDefault true;
ids = lib.mkDefault true;
packages = lib.mkDefault true; packages = lib.mkDefault true;
ssh = lib.mkDefault true; ssh = lib.mkDefault true;
wireguard = lib.mkDefault true; wireguard = lib.mkDefault true;

6
secrets/repo/pii.nix.enc
View file

File diff suppressed because one or more lines are too long