mirror of
https://github.com/nmasur/dotfiles
synced 2025-07-06 17:50:15 +00:00
Compare commits
1 Commits
920ec8b43e
...
darwin-ssl
| Author | SHA1 | Date | |
|---|---|---|---|
| fca998e14c |
3
.gitignore
vendored
3
.gitignore
vendored
@ -4,6 +4,3 @@
|
||||
**/.direnv/**
|
||||
result
|
||||
.luarc.json
|
||||
private/**
|
||||
!private/**.age
|
||||
!private/**.sha512
|
||||
|
||||
23
README.md
23
README.md
@ -1,17 +1,6 @@
|
||||
This repository contains configuration files for my NixOS, macOS, and WSL
|
||||
hosts.
|
||||
|
||||
They are organized and managed by [Nix](https://nixos.org), so some of the
|
||||
configuration may be difficult to translate to a non-Nix system.
|
||||
|
||||
However, some of the configurations are easier to lift directly:
|
||||
|
||||
- [Neovim](https://github.com/nmasur/dotfiles/tree/master/modules/neovim/lua)
|
||||
- [Fish functions](https://github.com/nmasur/dotfiles/tree/master/modules/shell/fish/functions)
|
||||
- [More fish aliases](https://github.com/nmasur/dotfiles/blob/master/modules/shell/fish/default.nix)
|
||||
- [Git aliases](https://github.com/nmasur/dotfiles/blob/master/modules/shell/git.nix)
|
||||
- [Hammerspoon](https://github.com/nmasur/dotfiles/tree/master/modules/darwin/hammerspoon)
|
||||
|
||||
---
|
||||
|
||||
# Installation
|
||||
@ -25,7 +14,7 @@ installer disk:
|
||||
|
||||
```bash
|
||||
lsblk # Choose the disk you want to wipe
|
||||
nix-shell -p nixVersions.stable
|
||||
nix-shell -p nixFlakes
|
||||
nix run github:nmasur/dotfiles#installer -- nvme0n1 desktop
|
||||
```
|
||||
|
||||
@ -35,7 +24,7 @@ If you're already running NixOS, you can switch to this configuration with the
|
||||
following command:
|
||||
|
||||
```bash
|
||||
nix-shell -p nixVersions.stable
|
||||
nix-shell -p nixFlakes
|
||||
sudo nixos-rebuild switch --flake github:nmasur/dotfiles#desktop
|
||||
```
|
||||
|
||||
@ -46,16 +35,10 @@ WSL](https://xeiaso.net/blog/nix-flakes-4-wsl-2022-05-01), you can switch to
|
||||
the WSL configuration:
|
||||
|
||||
```
|
||||
nix-shell -p nixVersions.stable
|
||||
nix-shell -p nixFlakes
|
||||
sudo nixos-rebuild switch --flake github:nmasur/dotfiles#wsl
|
||||
```
|
||||
|
||||
You should also download the
|
||||
[FiraCode](https://github.com/ryanoasis/nerd-fonts/releases/download/v2.2.2/FiraCode.zip)
|
||||
font and install it on Windows. Install [Alacritty](https://alacritty.org/) and
|
||||
move the `windows/alacritty.yml` file to
|
||||
`C:\Users\<user>\AppData\Roaming\alacritty`.
|
||||
|
||||
## macOS
|
||||
|
||||
To get started on a bare macOS installation, first install Nix:
|
||||
|
||||
@ -1,23 +0,0 @@
|
||||
{ pkgs, ... }: rec {
|
||||
|
||||
default = readme;
|
||||
|
||||
# Format and install from nothing
|
||||
installer = import ./installer.nix { inherit pkgs; };
|
||||
|
||||
# Display the readme for this repository
|
||||
readme = import ./readme.nix { inherit pkgs; };
|
||||
|
||||
# Load the SSH key for this machine
|
||||
loadkey = import ./loadkey.nix { inherit pkgs; };
|
||||
|
||||
# Encrypt secret for all machines
|
||||
encrypt-secret = import ./encrypt-secret.nix { inherit pkgs; };
|
||||
|
||||
# Re-encrypt secrets for all machines
|
||||
reencrypt-secrets = import ./reencrypt-secrets.nix { inherit pkgs; };
|
||||
|
||||
# Connect machine metrics to Netdata Cloud
|
||||
netdata = import ./netdata-cloud.nix { inherit pkgs; };
|
||||
|
||||
}
|
||||
@ -1,19 +0,0 @@
|
||||
{ pkgs, ... }: {
|
||||
|
||||
# nix run github:nmasur/dotfiles#encrypt-secret > private/mysecret.age
|
||||
|
||||
type = "app";
|
||||
|
||||
program = builtins.toString (pkgs.writeShellScript "encrypt-secret" ''
|
||||
printf "\nEnter the secret data to encrypt for all hosts...\n\n" 1>&2
|
||||
read -p "Secret: " secret
|
||||
printf "\nEncrypting...\n\n" 1>&2
|
||||
tmpfile=$(mktemp)
|
||||
echo "''${secret}" > ''${tmpfile}
|
||||
${pkgs.age}/bin/age --encrypt --armor --recipients-file ${
|
||||
builtins.toString ../hosts/public-keys
|
||||
} $tmpfile
|
||||
rm $tmpfile
|
||||
'');
|
||||
|
||||
}
|
||||
@ -13,12 +13,10 @@
|
||||
PARTITION_PREFIX=""
|
||||
|
||||
if [ -z "$DISK" ] || [ -z "$FLAKE" ]; then
|
||||
${pkgs.gum}/bin/gum style --width 50 --margin "1 2" --padding "2 4" \
|
||||
--foreground "#fb4934" \
|
||||
"Missing required parameter." \
|
||||
"Usage: installer -- <disk> <host>" \
|
||||
"Example: installer -- nvme0n1 desktop" \
|
||||
"Flake example: nix run github:nmasur/dotfiles#installer -- nvme0n1 desktop"
|
||||
echo "Missing required parameter."
|
||||
echo "Usage: installer -- <disk> <host>"
|
||||
echo "Example: installer -- nvme0n1 desktop"
|
||||
echo "Flake example: nix run github:nmasur/dotfiles#installer -- nvme0n1 desktop"
|
||||
echo "(exiting)"
|
||||
exit 1
|
||||
fi
|
||||
@ -27,14 +25,10 @@
|
||||
PARTITION_PREFIX="p"
|
||||
esac
|
||||
|
||||
${pkgs.gum}/bin/gum confirm \
|
||||
"This will ERASE ALL DATA on the disk /dev/''${DISK}. Are you sure you want to continue?" \
|
||||
--default=false
|
||||
|
||||
${pkgs.parted}/bin/parted /dev/''${DISK} -- mklabel gpt
|
||||
${pkgs.parted}/bin/parted /dev/''${DISK} -- mkpart primary 512MiB 100%
|
||||
${pkgs.parted}/bin/parted /dev/''${DISK} -- mkpart ESP fat32 1MiB 512MiB
|
||||
${pkgs.parted}/bin/parted /dev/''${DISK} -- set 3 esp on
|
||||
parted /dev/''${DISK} -- mklabel gpt
|
||||
parted /dev/''${DISK} -- mkpart primary 512MiB 100%
|
||||
parted /dev/''${DISK} -- mkpart ESP fat32 1MiB 512MiB
|
||||
parted /dev/''${DISK} -- set 3 esp on
|
||||
mkfs.ext4 -L nixos /dev/''${DISK}''${PARTITION_PREFIX}1
|
||||
mkfs.fat -F 32 -n boot /dev/''${DISK}''${PARTITION_PREFIX}2
|
||||
|
||||
@ -42,7 +36,7 @@
|
||||
mkdir --parents /mnt/boot
|
||||
mount /dev/disk/by-label/boot /mnt/boot
|
||||
|
||||
${pkgs.nixos-install-tools}/bin/nixos-install --flake github:nmasur/dotfiles#''${FLAKE}
|
||||
nixos-install --flake github:nmasur/dotfiles#''${FLAKE}
|
||||
'');
|
||||
|
||||
}
|
||||
|
||||
@ -1,12 +0,0 @@
|
||||
{ pkgs, ... }: {
|
||||
|
||||
type = "app";
|
||||
|
||||
program = builtins.toString (pkgs.writeShellScript "loadkey" ''
|
||||
printf "\nEnter the seed phrase for your SSH key...\n"
|
||||
printf "\nThen press ^D when complete.\n\n"
|
||||
${pkgs.melt}/bin/melt restore ~/.ssh/id_ed25519
|
||||
printf "\n\nContinuing activation.\n\n"
|
||||
'');
|
||||
|
||||
}
|
||||
@ -1,19 +0,0 @@
|
||||
{ pkgs, ... }: {
|
||||
|
||||
type = "app";
|
||||
|
||||
program = builtins.toString (pkgs.writeShellScript "netdata-cloud" ''
|
||||
if [ "$EUID" -ne 0 ]; then
|
||||
echo "Please run as root"
|
||||
exit 1
|
||||
fi
|
||||
mkdir --parents --mode 0750 /var/lib/netdata/cloud.d
|
||||
printf "\nEnter the claim token for netdata cloud...\n\n"
|
||||
read -p "Token: " token
|
||||
echo "''${token}" > /var/lib/netdata/cloud.d/token
|
||||
chown -R netdata:netdata /var/lib/netdata
|
||||
${pkgs.netdata}/bin/netdata-claim.sh -id=$(uuidgen)
|
||||
printf "\n\nNow restart netdata service.\n\n"
|
||||
'');
|
||||
|
||||
}
|
||||
@ -1,27 +0,0 @@
|
||||
{ pkgs, ... }: {
|
||||
|
||||
# nix run github:nmasur/dotfiles#reencrypt-secrets ./private
|
||||
|
||||
type = "app";
|
||||
|
||||
program = builtins.toString (pkgs.writeShellScript "reencrypt-secrets" ''
|
||||
if [ $# -eq 0 ]; then
|
||||
echo "Must provide directory to reencrypt."
|
||||
exit 1
|
||||
fi
|
||||
encrypted=$1
|
||||
for encryptedfile in ''${1}/*; do
|
||||
tmpfile=$(mktemp)
|
||||
echo "Decrypting ''${encryptedfile}..."
|
||||
${pkgs.age}/bin/age --decrypt \
|
||||
--identity ~/.ssh/id_ed25519 $encryptedfile > $tmpfile
|
||||
echo "Encrypting ''${encryptedfile}..."
|
||||
${pkgs.age}/bin/age --encrypt --armor --recipients-file ${
|
||||
builtins.toString ../hosts/public-keys
|
||||
} $tmpfile > $encryptedfile
|
||||
rm $tmpfile
|
||||
done
|
||||
echo "Finished."
|
||||
'');
|
||||
|
||||
}
|
||||
67
flake.lock
generated
67
flake.lock
generated
@ -7,11 +7,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1666776005,
|
||||
"narHash": "sha256-HwSMF19PpczfqNHKcFsA6cF4PVbG00uUSdbq6q3jB5o=",
|
||||
"lastModified": 1662478528,
|
||||
"narHash": "sha256-Myjd0HPL5lXri3NXOcJ6gP7IKod2eMweQBKM4uxgEGw=",
|
||||
"owner": "lnl7",
|
||||
"repo": "nix-darwin",
|
||||
"rev": "f6648ca0698d1611d7eadfa72b122252b833f86c",
|
||||
"rev": "3b69bf3cc26ae19de847bfe54d6ab22d7381a90a",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@ -60,11 +60,11 @@
|
||||
"utils": "utils"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1666903647,
|
||||
"narHash": "sha256-sFI1Gh9DTGzHnBINondupUGYbe+T0wZcpcZjkW0qffM=",
|
||||
"lastModified": 1663328500,
|
||||
"narHash": "sha256-7n+J/exp8ky4dmk02y5a9R7CGmJvHpzrHMzfEkMtSWA=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "213a06295dff96668a1d673b9fd1c03ce1de6745",
|
||||
"rev": "5427f3d1f0ea4357cd4af0bffee7248d640c6ffc",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@ -74,49 +74,13 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixlib": {
|
||||
"locked": {
|
||||
"lastModified": 1636849918,
|
||||
"narHash": "sha256-nzUK6dPcTmNVrgTAC1EOybSMsrcx+QrVPyqRdyKLkjA=",
|
||||
"owner": "nix-community",
|
||||
"repo": "nixpkgs.lib",
|
||||
"rev": "28a5b0557f14124608db68d3ee1f77e9329e9dd5",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"repo": "nixpkgs.lib",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixos-generators": {
|
||||
"inputs": {
|
||||
"nixlib": "nixlib",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1666812839,
|
||||
"narHash": "sha256-0nBDgjPU+iDsvz89W+cDEyhnFGSwCJmwDl/gMGqYiU0=",
|
||||
"owner": "nix-community",
|
||||
"repo": "nixos-generators",
|
||||
"rev": "41f3518bc194389df22a3d198215eae75e6b5ab9",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"repo": "nixos-generators",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1666959691,
|
||||
"narHash": "sha256-TRpWA3t8ata79HOGtFd5dDCl1kJQmIE16PDF53/Hcxo=",
|
||||
"lastModified": 1663357389,
|
||||
"narHash": "sha256-oYA2nVRSi6yhCBqS5Vz465Hw+3BQOVFEhfbfy//3vTs=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "448a599c49978c2794401bfc3a2e1fba1a8663be",
|
||||
"rev": "da6a05816e7fa5226c3f61e285ef8d9dfc868f3c",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@ -143,11 +107,11 @@
|
||||
},
|
||||
"nur": {
|
||||
"locked": {
|
||||
"lastModified": 1667025500,
|
||||
"narHash": "sha256-88akaieCIrqta3Uyha7Zv3FJWzKJebb2BrOdZba1zdI=",
|
||||
"lastModified": 1663440270,
|
||||
"narHash": "sha256-RkBoLyxamsBqRn9lB9RbFSDg7KHiGgHBsrpffEVXWCQ=",
|
||||
"owner": "nix-community",
|
||||
"repo": "nur",
|
||||
"rev": "21dd192519af12a01f1348bbfa86cde47f7aa392",
|
||||
"rev": "7511d58da488c67887745f40fd4846aa8c876d25",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@ -160,7 +124,6 @@
|
||||
"inputs": {
|
||||
"darwin": "darwin",
|
||||
"home-manager": "home-manager",
|
||||
"nixos-generators": "nixos-generators",
|
||||
"nixpkgs": "nixpkgs",
|
||||
"nur": "nur",
|
||||
"wallpapers": "wallpapers",
|
||||
@ -205,11 +168,11 @@
|
||||
"nixpkgs": "nixpkgs_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1666720338,
|
||||
"narHash": "sha256-7V91ZtTz7zDXb6hivktQ9RlBglP+WEkYFSciPJHwMJw=",
|
||||
"lastModified": 1661772734,
|
||||
"narHash": "sha256-DkvAaLDg9D6O0i2MzUknaf/U078K4KWAZaJQmNC/tL8=",
|
||||
"owner": "nix-community",
|
||||
"repo": "NixOS-WSL",
|
||||
"rev": "7bfb8f5aa91fee30a189eae32cda8ddc465076df",
|
||||
"rev": "c1b0259313f661cf74051c916cf3bb4f061ce11f",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
||||
50
flake.nix
50
flake.nix
@ -32,15 +32,9 @@
|
||||
flake = false;
|
||||
};
|
||||
|
||||
# Used to generate NixOS images for other platforms
|
||||
nixos-generators = {
|
||||
url = "github:nix-community/nixos-generators";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
outputs = { self, nixpkgs, ... }@inputs:
|
||||
outputs = { self, nixpkgs, darwin, wsl, home-manager, nur, wallpapers }:
|
||||
|
||||
let
|
||||
|
||||
@ -51,7 +45,7 @@
|
||||
gitName = fullName;
|
||||
gitEmail = "7386960+nmasur@users.noreply.github.com";
|
||||
mailServer = "noahmasur.com";
|
||||
dotfilesRepo = "git@github.com:nmasur/dotfiles";
|
||||
dotfilesRepo = "https://github.com/nmasur/dotfiles";
|
||||
};
|
||||
|
||||
# System types to support.
|
||||
@ -61,38 +55,33 @@
|
||||
# Helper function to generate an attrset '{ x86_64-linux = f "x86_64-linux"; ... }'.
|
||||
forAllSystems = nixpkgs.lib.genAttrs supportedSystems;
|
||||
|
||||
in rec {
|
||||
in {
|
||||
|
||||
nixosConfigurations = {
|
||||
desktop = import ./hosts/desktop { inherit inputs globals; };
|
||||
wsl = import ./hosts/wsl { inherit inputs globals; };
|
||||
oracle = import ./hosts/oracle { inherit inputs globals; };
|
||||
desktop = import ./hosts/desktop {
|
||||
inherit nixpkgs home-manager nur globals wallpapers;
|
||||
};
|
||||
wsl = import ./hosts/wsl { inherit nixpkgs wsl home-manager globals; };
|
||||
};
|
||||
|
||||
darwinConfigurations = {
|
||||
macbook = import ./hosts/macbook { inherit inputs globals; };
|
||||
};
|
||||
|
||||
# For quickly applying local settings with:
|
||||
# home-manager switch --flake .#desktop
|
||||
homeConfigurations = {
|
||||
desktop =
|
||||
nixosConfigurations.desktop.config.home-manager.users.${globals.user}.home;
|
||||
macbook =
|
||||
darwinConfigurations.macbook.config.home-manager.users."Noah.Masur".home;
|
||||
};
|
||||
|
||||
# Package servers into images with a generator
|
||||
packages.x86_64-linux = with inputs; {
|
||||
aws = import ./hosts/aws {
|
||||
inherit inputs globals;
|
||||
system = "x86_64-linux";
|
||||
macbook = import ./hosts/macbook {
|
||||
inherit nixpkgs darwin home-manager nur globals;
|
||||
};
|
||||
};
|
||||
|
||||
apps = forAllSystems (system:
|
||||
let pkgs = import nixpkgs { inherit system; };
|
||||
in import ./apps { inherit pkgs; });
|
||||
in rec {
|
||||
default = readme;
|
||||
|
||||
# Format and install from nothing
|
||||
installer = import ./apps/installer.nix { inherit pkgs; };
|
||||
|
||||
# Display the readme for this repository
|
||||
readme = import ./apps/readme.nix { inherit pkgs; };
|
||||
|
||||
});
|
||||
|
||||
devShells = forAllSystems (system:
|
||||
let pkgs = import nixpkgs { inherit system; };
|
||||
@ -112,7 +101,6 @@
|
||||
vault
|
||||
awscli2
|
||||
google-cloud-sdk
|
||||
ansible
|
||||
kubectl
|
||||
kubernetes-helm
|
||||
kustomize
|
||||
|
||||
@ -1,32 +0,0 @@
|
||||
{ inputs, globals, ... }:
|
||||
|
||||
with inputs;
|
||||
|
||||
nixos-generators.nixosGenerate {
|
||||
inherit system;
|
||||
format = "amazon";
|
||||
modules = [
|
||||
home-manager.nixosModules.home-manager
|
||||
{
|
||||
user = globals.user;
|
||||
fullName = globals.fullName;
|
||||
dotfilesRepo = globals.dotfilesRepo;
|
||||
gitName = globals.gitName;
|
||||
gitEmail = globals.gitEmail;
|
||||
networking.hostName = "sheep";
|
||||
gui.enable = false;
|
||||
colorscheme = (import ../modules/colorscheme/gruvbox);
|
||||
passwordHash = null;
|
||||
publicKey =
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s";
|
||||
# AWS settings require this
|
||||
permitRootLogin = "prohibit-password";
|
||||
}
|
||||
../../hosts/common.nix
|
||||
../../modules/nixos
|
||||
../../modules/services/sshd.nix
|
||||
] ++ [
|
||||
# Required to fix diskSize errors during build
|
||||
({ ... }: { amazonImage.sizeMB = 16 * 1024; })
|
||||
];
|
||||
}
|
||||
@ -1,80 +0,0 @@
|
||||
locals {
|
||||
image_file = one(fileset(path.root, "result/nixos-amazon-image-*.vhd"))
|
||||
}
|
||||
|
||||
# Upload to S3
|
||||
resource "aws_s3_object" "image" {
|
||||
bucket = "your_bucket_name"
|
||||
key = basename(local.image_file)
|
||||
source = local.image_file
|
||||
etag = filemd5(local.image_file)
|
||||
}
|
||||
|
||||
# Setup IAM access for the VM Importer
|
||||
data "aws_iam_policy_document" "vmimport_trust_policy" {
|
||||
statement {
|
||||
actions = ["sts:AssumeRole"]
|
||||
principals {
|
||||
type = "Service"
|
||||
identifiers = ["vmie.amazonaws.com"]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
data "aws_iam_policy_document" "vmimport" {
|
||||
statement {
|
||||
actions = [
|
||||
"s3:GetBucketLocation",
|
||||
"s3:GetObject",
|
||||
"s3:ListBucket",
|
||||
]
|
||||
resources = [
|
||||
"arn:aws:s3:::${aws_s3_object.image.bucket}",
|
||||
"arn:aws:s3:::${aws_s3_object.image.bucket}/*",
|
||||
]
|
||||
}
|
||||
statement {
|
||||
actions = [
|
||||
"ec2:ModifySnapshotAttribute",
|
||||
"ec2:CopySnapshot",
|
||||
"ec2:RegisterImage",
|
||||
"ec2:Describe*",
|
||||
]
|
||||
resources = ["*"]
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_iam_role" "vmimport" {
|
||||
name = "vmimport"
|
||||
assume_role_policy = data.aws_iam_policy_document.vmimport_trust_policy.json
|
||||
inline_policy {
|
||||
name = "vmimport"
|
||||
policy = data.aws_iam_policy_document.vmimport.json
|
||||
}
|
||||
}
|
||||
|
||||
# Import to EBS
|
||||
resource "aws_ebs_snapshot_import" "image" {
|
||||
disk_container {
|
||||
format = "VHD"
|
||||
user_bucket {
|
||||
s3_bucket = aws_s3_object.image.bucket
|
||||
s3_key = aws_s3_object.image.key
|
||||
}
|
||||
}
|
||||
|
||||
role_name = aws_iam_role.vmimport.name
|
||||
}
|
||||
|
||||
# Convert to AMI
|
||||
resource "aws_ami" "image" {
|
||||
description = "Created with NixOS."
|
||||
name = replace(basename(local.image_file), "/\\.vhd$/", "")
|
||||
virtualization_type = "hvm"
|
||||
|
||||
ebs_block_device {
|
||||
device_name = "/dev/xvda"
|
||||
snapshot_id = aws_ebs_snapshot_import.image.id
|
||||
volume_size = 8
|
||||
}
|
||||
}
|
||||
@ -1,260 +0,0 @@
|
||||
name: 'Terraform'
|
||||
env:
|
||||
|
||||
|
||||
AWS_ACCOUNT_NUMBER: ''
|
||||
AWS_PLAN_ROLE_NAME: github_actions_plan
|
||||
AWS_APPLY_ROLE_NAME: github_actions_admin
|
||||
|
||||
# Always required. Used for authenticating to AWS, but can also act as your
|
||||
# default region if you don't want to specify in the provider configuration.
|
||||
AWS_REGION: us-east-1
|
||||
|
||||
# You must change these to fit your project.
|
||||
TF_VAR_project: change-me
|
||||
TF_VAR_label: change-me
|
||||
TF_VAR_owner: Your Name Here
|
||||
|
||||
# If storing Terraform in a subdirectory, specify it here.
|
||||
TERRAFORM_DIRECTORY: .
|
||||
|
||||
# Pinned versions of tools to use.
|
||||
# Check for new releases:
|
||||
# - https://github.com/hashicorp/terraform/releases
|
||||
# - https://github.com/fugue/regula/releases
|
||||
# - https://github.com/terraform-linters/tflint/releases
|
||||
TERRAFORM_VERSION: 1.2.6
|
||||
REGULA_VERSION: 2.9.0
|
||||
TFLINT_VERSION: 0.39.1
|
||||
|
||||
# Terraform configuration options
|
||||
TERRAFORM_PARALLELISM: 10
|
||||
|
||||
# These variables are passed to Terraform based on GitHub information.
|
||||
TF_VAR_repo: ${{ github.repository }}
|
||||
|
||||
# This workflow is triggered in the following ways.
|
||||
on:
|
||||
|
||||
# Any push or merge to these branches.
|
||||
push:
|
||||
branches:
|
||||
- dev
|
||||
- prod
|
||||
|
||||
# Any pull request targeting these branches (plan only).
|
||||
pull_request:
|
||||
branches:
|
||||
- dev
|
||||
- prod
|
||||
|
||||
|
||||
# Any manual trigger on these branches.
|
||||
workflow_dispatch:
|
||||
branches:
|
||||
- dev
|
||||
- prod
|
||||
|
||||
# -------------------------------------------------------------------
|
||||
# The rest of this workflow can operate without adjustments. Edit the
|
||||
# below content at your own risk!
|
||||
# -------------------------------------------------------------------
|
||||
|
||||
# Used to connect to AWS IAM
|
||||
permissions:
|
||||
id-token: write
|
||||
contents: read
|
||||
pull-requests: write
|
||||
|
||||
# Only run one workflow at a time for each Terraform state. This prevents
|
||||
# lockfile conflicts, especially during PR vs push.
|
||||
concurrency: terraform-${{ github.base_ref || github.ref }}
|
||||
|
||||
jobs:
|
||||
terraform:
|
||||
|
||||
name: 'Terraform'
|
||||
|
||||
# Change this if you need to run your deployment on-prem.
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
|
||||
# Downloads the current repo code to the runner.
|
||||
- name: Checkout Repo Code
|
||||
uses: actions/checkout@v2
|
||||
|
||||
# Install Nix
|
||||
- name: Install Nix
|
||||
uses: cachix/install-nix-action@v17
|
||||
|
||||
# Build the image
|
||||
- name: Build Image
|
||||
run: nix build .#aws
|
||||
|
||||
# Login to AWS
|
||||
- name: AWS Assume Role
|
||||
uses: aws-actions/configure-aws-credentials@v1.6.1
|
||||
with:
|
||||
role-to-assume: ${{ env.AWS_ROLE_ARN }}
|
||||
aws-region: ${{ env.AWS_REGION }}
|
||||
|
||||
# Exports all GitHub Secrets as environment variables prefixed by
|
||||
# "TF_VAR_", which exposes them to Terraform. The name of each GitHub
|
||||
# Secret must match its Terraform variable name exactly.
|
||||
- name: Export Secrets to Terraform Variables
|
||||
env:
|
||||
ALL_SECRETS: ${{ toJson(secrets) }}
|
||||
run: |
|
||||
echo "$ALL_SECRETS" \
|
||||
| jq "to_entries | .[] | \"TF_VAR_\" + ( .key | ascii_downcase ) + \"=\" + .value" \
|
||||
| tr -d \" >> $GITHUB_ENV
|
||||
|
||||
# Installs the Terraform binary and some other accessory functions.
|
||||
- name: Setup Terraform
|
||||
uses: hashicorp/setup-terraform@v2
|
||||
with:
|
||||
terraform_version: ${{ env.TERRAFORM_VERSION }}
|
||||
|
||||
# Checks whether Terraform is formatted properly. If this fails, you
|
||||
# should install the pre-commit hook.
|
||||
- name: Check Formatting
|
||||
run: |
|
||||
terraform fmt -no-color -check -diff -recursive
|
||||
|
||||
# Downloads a Terraform code lint test.
|
||||
- uses: terraform-linters/setup-tflint@v1
|
||||
name: Setup TFLint
|
||||
with:
|
||||
tflint_version: v${{ env.TFLINT_VERSION }}
|
||||
|
||||
# Sets up linting with this codebase.
|
||||
- name: Init TFLint
|
||||
working-directory: ${{ env.TERRAFORM_DIRECTORY }}
|
||||
run: tflint --init
|
||||
|
||||
# Lints the current code.
|
||||
- name: Run TFLint
|
||||
working-directory: ${{ env.TERRAFORM_DIRECTORY }}
|
||||
run: |
|
||||
tflint -f compact
|
||||
find ./modules/* -type d -maxdepth 0 | xargs -I __ tflint -f compact --disable-rule=terraform_required_providers --disable-rule=terraform_required_version __
|
||||
|
||||
# Connects to remote state backend and download providers.
|
||||
- name: Terraform Init
|
||||
working-directory: ${{ env.TERRAFORM_DIRECTORY }}
|
||||
run: |
|
||||
terraform init \
|
||||
-backend-config="role_arn=${{ env.AWS_STATE_ROLE_ARN }}" \
|
||||
-backend-config="region=us-east-1" \
|
||||
-backend-config="workspace_key_prefix=accounts/${{ env.AWS_ACCOUNT_NUMBER }}/${{ github.repository }}" \
|
||||
-backend-config="key=state.tfstate" \
|
||||
-backend-config="dynamodb_table=global-tf-state-lock"
|
||||
|
||||
# Set the Terraform Workspace to the current branch name.
|
||||
- name: Set Terraform Workspace
|
||||
working-directory: ${{ env.TERRAFORM_DIRECTORY }}
|
||||
shell: bash
|
||||
run: |
|
||||
export WORKSPACE=${{ github.base_ref || github.ref_name }}
|
||||
terraform workspace select ${WORKSPACE} || terraform workspace new $WORKSPACE
|
||||
echo "TF_WORKSPACE=$(echo ${WORKSPACE} | sed 's/\//_/g')" >> $GITHUB_ENV
|
||||
|
||||
# Checks differences between current code and infrastructure state.
|
||||
- name: Terraform Plan
|
||||
id: plan
|
||||
working-directory: ${{ env.TERRAFORM_DIRECTORY }}
|
||||
run: |
|
||||
terraform plan \
|
||||
-input=false \
|
||||
-no-color \
|
||||
-out=tfplan \
|
||||
-parallelism=${TERRAFORM_PARALLELISM} \
|
||||
-var-file=variables-${TF_WORKSPACE}.tfvars
|
||||
|
||||
# Gets the results of the plan for pull requests.
|
||||
- name: Terraform Show Plan
|
||||
id: show
|
||||
working-directory: ${{ env.TERRAFORM_DIRECTORY }}
|
||||
run: terraform show -no-color tfplan
|
||||
|
||||
# Adds the results of the plan to the pull request.
|
||||
- name: Comment Plan
|
||||
uses: actions/github-script@v6
|
||||
if: github.event_name == 'pull_request'
|
||||
env:
|
||||
STDOUT: "```terraform\n${{ steps.show.outputs.stdout }}```"
|
||||
with:
|
||||
github-token: ${{ secrets.GITHUB_TOKEN }}
|
||||
script: |
|
||||
// 1. Retrieve existing bot comments for the PR
|
||||
const { data: comments } = await github.rest.issues.listComments({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
issue_number: context.issue.number,
|
||||
})
|
||||
const botComment = comments.find(comment => {
|
||||
return comment.user.type === 'Bot' && comment.body.includes('Terraform Format and Style')
|
||||
})
|
||||
|
||||
// 2. Prepare format of the comment
|
||||
const output = `#### Terraform Format and Style 🖌\`${{ steps.fmt.outcome }}\`
|
||||
#### Terraform Initialization ⚙️\`${{ steps.init.outcome }}\`
|
||||
#### Terraform Validation 🤖\`${{ steps.validate.outcome }}\`
|
||||
<details><summary>Validation Output</summary>
|
||||
|
||||
\`\`\`\n
|
||||
${{ steps.validate.outputs.stdout }}
|
||||
\`\`\`
|
||||
|
||||
</details>
|
||||
|
||||
#### Terraform Plan 📖\`${{ steps.plan.outcome }}\`
|
||||
|
||||
<details><summary>Show Plan</summary>
|
||||
|
||||
\`\`\`\n
|
||||
${process.env.PLAN}
|
||||
\`\`\`
|
||||
|
||||
</details>
|
||||
|
||||
*Pusher: @${{ github.actor }}, Action: \`${{ github.event_name }}\`, Working Directory: \`${{ env.tf_actions_working_dir }}\`, Workflow: \`${{ github.workflow }}\`*`;
|
||||
|
||||
// 3. If we have a comment, update it, otherwise create a new one
|
||||
if (botComment) {
|
||||
github.rest.issues.updateComment({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
comment_id: botComment.id,
|
||||
body: output
|
||||
})
|
||||
} else {
|
||||
github.rest.issues.createComment({
|
||||
issue_number: context.issue.number,
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
body: output
|
||||
})
|
||||
}
|
||||
|
||||
# Downloads Regula and checks whether the plan meets compliance requirements.
|
||||
- name: Regula Compliance Check
|
||||
shell: bash
|
||||
working-directory: ${{ env.TERRAFORM_DIRECTORY }}
|
||||
run: |
|
||||
REGULA_URL="https://github.com/fugue/regula/releases/download/v${REGULA_VERSION}/regula_${REGULA_VERSION}_Linux_x86_64.tar.gz"
|
||||
curl -sL "$REGULA_URL" -o regula.tar.gz
|
||||
tar xzf regula.tar.gz
|
||||
terraform show -json tfplan | ./regula run
|
||||
|
||||
# Deploys infrastructure or changes to infrastructure.
|
||||
- name: Terraform Apply
|
||||
if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
|
||||
working-directory: ${{ env.TERRAFORM_DIRECTORY }}
|
||||
run: |
|
||||
terraform apply \
|
||||
-auto-approve \
|
||||
-input=false \
|
||||
-parallelism=${TERRAFORM_PARALLELISM} \
|
||||
tfplan
|
||||
@ -3,9 +3,9 @@
|
||||
imports =
|
||||
[ ../modules/shell ../modules/neovim ../modules/repositories/dotfiles.nix ];
|
||||
|
||||
options = rec {
|
||||
user = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
options = with lib; {
|
||||
user = mkOption {
|
||||
type = types.str;
|
||||
description = "Primary user of the system";
|
||||
};
|
||||
fullName = lib.mkOption {
|
||||
@ -21,54 +21,35 @@
|
||||
if pkgs.stdenv.isDarwin then "$HOME/Downloads" else "$HOME/downloads";
|
||||
};
|
||||
};
|
||||
identityFile = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Path to existing private key file.";
|
||||
default = "/etc/ssh/ssh_host_ed25519_key";
|
||||
};
|
||||
gui = {
|
||||
enable = lib.mkEnableOption {
|
||||
description = "Enable graphics.";
|
||||
enable = mkEnableOption {
|
||||
description = "Enable graphics";
|
||||
default = false;
|
||||
};
|
||||
};
|
||||
theme = {
|
||||
colors = lib.mkOption {
|
||||
type = lib.types.attrs;
|
||||
description = "Base16 color scheme.";
|
||||
default = (import ../modules/colorscheme/gruvbox).dark;
|
||||
colorscheme = mkOption {
|
||||
type = types.attrs;
|
||||
description = "Base16 color scheme";
|
||||
};
|
||||
dark = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
description = "Enable dark mode.";
|
||||
default = true;
|
||||
};
|
||||
};
|
||||
|
||||
# colorscheme = lib.mkOption {
|
||||
# type = types.attrs;
|
||||
# description = "Base16 color scheme";
|
||||
# };
|
||||
homePath = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
homePath = mkOption {
|
||||
type = types.path;
|
||||
description = "Path of user's home directory.";
|
||||
default = builtins.toPath (if pkgs.stdenv.isDarwin then
|
||||
"/Users/${config.user}"
|
||||
else
|
||||
"/home/${config.user}");
|
||||
};
|
||||
|
||||
dotfilesPath = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
dotfilesPath = mkOption {
|
||||
type = types.path;
|
||||
description = "Path of dotfiles repository.";
|
||||
default = config.homePath + "/dev/personal/dotfiles";
|
||||
};
|
||||
dotfilesRepo = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
dotfilesRepo = mkOption {
|
||||
type = types.str;
|
||||
description = "Link to dotfiles repository.";
|
||||
};
|
||||
unfreePackages = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
unfreePackages = mkOption {
|
||||
type = types.listOf types.str;
|
||||
description = "List of unfree packages to allow.";
|
||||
default = [ ];
|
||||
};
|
||||
@ -78,10 +59,7 @@
|
||||
in {
|
||||
|
||||
# Enable features in Nix commands
|
||||
nix.extraOptions = ''
|
||||
experimental-features = nix-command flakes
|
||||
warn-dirty = false
|
||||
'';
|
||||
nix.extraOptions = "experimental-features = nix-command flakes";
|
||||
|
||||
# Basic common system packages for all devices
|
||||
environment.systemPackages = with pkgs; [ git vim wget curl ];
|
||||
|
||||
@ -1,6 +1,4 @@
|
||||
{ inputs, globals, ... }:
|
||||
|
||||
with inputs;
|
||||
{ nixpkgs, home-manager, nur, globals, wallpapers, ... }:
|
||||
|
||||
# System configuration for my desktop
|
||||
nixpkgs.lib.nixosSystem {
|
||||
@ -14,15 +12,18 @@ nixpkgs.lib.nixosSystem {
|
||||
nixpkgs.overlays = [ nur.overlay ];
|
||||
# Set registry to flake packages, used for nix X commands
|
||||
nix.registry.nixpkgs.flake = nixpkgs;
|
||||
identityFile = "/home/${globals.user}/.ssh/id_ed25519";
|
||||
gui.enable = true;
|
||||
theme = {
|
||||
colors = (import ../../modules/colorscheme/gruvbox).dark;
|
||||
dark = true;
|
||||
};
|
||||
gaming.steam = true;
|
||||
gaming.leagueoflegends = true;
|
||||
gaming.legendary = true;
|
||||
gui = {
|
||||
enable = true;
|
||||
compositor.enable = true;
|
||||
wallpaper = "${wallpapers}/gruvbox/road.jpg";
|
||||
gtk.theme.name = nixpkgs.lib.mkDefault "Adwaita-dark";
|
||||
passwordHash = nixpkgs.lib.fileContents ../../private/password.sha512;
|
||||
gtk.theme = { name = "Adwaita-dark"; };
|
||||
};
|
||||
colorscheme = (import ../../modules/colorscheme/gruvbox);
|
||||
passwordHash =
|
||||
"$6$PZYiMGmJIIHAepTM$Wx5EqTQ5GApzXx58nvi8azh16pdxrN6Qrv1wunDlzveOgawitWzcIxuj76X9V868fsPi/NOIEO8yVXqwzS9UF.";
|
||||
}
|
||||
|
||||
./hardware-configuration.nix
|
||||
@ -30,19 +31,14 @@ nixpkgs.lib.nixosSystem {
|
||||
../../modules/hardware
|
||||
../../modules/nixos
|
||||
../../modules/graphical
|
||||
../../modules/applications/media.nix
|
||||
../../modules/applications/firefox.nix
|
||||
../../modules/applications/kitty.nix
|
||||
../../modules/applications/1password.nix
|
||||
../../modules/applications/discord.nix
|
||||
../../modules/applications/nautilus.nix
|
||||
../../modules/applications/obsidian.nix
|
||||
../../modules/mail/default.nix
|
||||
../../modules/gaming/steam.nix
|
||||
../../modules/gaming/legendary.nix
|
||||
../../modules/gaming
|
||||
../../modules/applications
|
||||
../../modules/mail/himalaya.nix
|
||||
../../modules/repositories/notes.nix
|
||||
../../modules/services/keybase.nix
|
||||
../../modules/services/gnupg.nix
|
||||
../../modules/services/mullvad.nix
|
||||
../../modules/programming/nix.nix
|
||||
../../modules/programming/haskell.nix
|
||||
];
|
||||
}
|
||||
|
||||
@ -1,6 +1,4 @@
|
||||
{ inputs, globals, ... }:
|
||||
|
||||
with inputs;
|
||||
{ nixpkgs, darwin, home-manager, nur, globals, ... }:
|
||||
|
||||
# System configuration for my work MacBook
|
||||
darwin.lib.darwinSystem {
|
||||
@ -14,21 +12,18 @@ darwin.lib.darwinSystem {
|
||||
})
|
||||
home-manager.darwinModules.home-manager
|
||||
{
|
||||
identityFile = "/home/${globals.user}/.ssh/id_ed25519";
|
||||
gui.enable = true;
|
||||
colorscheme = (import ../../modules/colorscheme/gruvbox);
|
||||
mailUser = globals.user;
|
||||
networking.hostName = "noah-masur-mac";
|
||||
nixpkgs.overlays = [ nur.overlay ];
|
||||
# Set registry to flake packages, used for nix X commands
|
||||
nix.registry.nixpkgs.flake = nixpkgs;
|
||||
}
|
||||
../common.nix
|
||||
../../modules/darwin
|
||||
../../modules/mail
|
||||
../../modules/applications/alacritty.nix
|
||||
../../modules/applications/kitty.nix
|
||||
../../modules/applications/discord.nix
|
||||
../../modules/mail/himalaya.nix
|
||||
../../modules/repositories/notes.nix
|
||||
../../modules/programming/nix.nix
|
||||
../../modules/programming/terraform.nix
|
||||
|
||||
@ -1,90 +0,0 @@
|
||||
{ inputs, globals, ... }:
|
||||
|
||||
with inputs;
|
||||
|
||||
# System configuration for an Oracle free server
|
||||
|
||||
# How to install:
|
||||
# https://blog.korfuri.fr/posts/2022/08/nixos-on-an-oracle-free-tier-ampere-machine/
|
||||
|
||||
nixpkgs.lib.nixosSystem {
|
||||
system = "aarch64-linux";
|
||||
specialArgs = { };
|
||||
modules = [
|
||||
(removeAttrs globals [ "mailServer" ])
|
||||
home-manager.nixosModules.home-manager
|
||||
{
|
||||
gui.enable = false;
|
||||
colorscheme = (import ../../modules/colorscheme/gruvbox);
|
||||
|
||||
# FQDNs for various services
|
||||
networking.hostName = "oracle";
|
||||
bookServer = "books.masu.rs";
|
||||
streamServer = "stream.masu.rs";
|
||||
nextcloudServer = "cloud.masu.rs";
|
||||
transmissionServer = "download.masu.rs";
|
||||
metricsServer = "metrics.masu.rs";
|
||||
vaultwardenServer = "vault.masu.rs";
|
||||
giteaServer = "git.masu.rs";
|
||||
|
||||
# Disable passwords, only use SSH key
|
||||
publicKey =
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s";
|
||||
|
||||
# Nextcloud backup config
|
||||
backupS3 = {
|
||||
endpoint = "s3.us-west-002.backblazeb2.com";
|
||||
bucket = "noahmasur-backup";
|
||||
accessKeyId = "0026b0e73b2e2c80000000005";
|
||||
};
|
||||
|
||||
# Grant access to Jellyfin directories from Nextcloud
|
||||
users.users.nextcloud.extraGroups = [ "jellyfin" ];
|
||||
|
||||
# Wireguard config for Transmission
|
||||
networking.wireguard.interfaces.wg0 = {
|
||||
|
||||
# The local IPs for this machine within the Wireguard network
|
||||
# Any inbound traffic bound for these IPs should be kept on localhost
|
||||
ips = [ "10.66.13.200/32" "fc00:bbbb:bbbb:bb01::3:dc7/128" ];
|
||||
|
||||
peers = [{
|
||||
|
||||
# Identity of Wireguard target peer (VPN)
|
||||
publicKey = "bOOP5lIjqCdDx5t+mP/kEcSbHS4cZqE0rMlBI178lyY=";
|
||||
|
||||
# The public internet address of the target peer
|
||||
endpoint = "86.106.143.132:51820";
|
||||
|
||||
# Which outgoing IP ranges should be sent through Wireguard
|
||||
allowedIPs = [ "0.0.0.0/0" "::0/0" ];
|
||||
|
||||
# Send heartbeat signal within the network
|
||||
persistentKeepalive = 25;
|
||||
|
||||
}];
|
||||
|
||||
};
|
||||
|
||||
# VPN port forwarding
|
||||
services.transmission.settings.peer-port = 57599;
|
||||
|
||||
# Grant access to Transmission directories from Jellyfin
|
||||
users.users.jellyfin.extraGroups = [ "transmission" ];
|
||||
}
|
||||
./hardware-configuration.nix
|
||||
../common.nix
|
||||
../../modules/nixos
|
||||
../../modules/hardware/server.nix
|
||||
../../modules/services/sshd.nix
|
||||
../../modules/services/calibre.nix
|
||||
../../modules/services/jellyfin.nix
|
||||
../../modules/services/nextcloud.nix
|
||||
../../modules/services/cloudflare.nix
|
||||
../../modules/services/transmission.nix
|
||||
../../modules/services/prometheus.nix
|
||||
../../modules/services/vaultwarden.nix
|
||||
../../modules/services/gitea.nix
|
||||
../../modules/gaming/minecraft-server.nix
|
||||
];
|
||||
}
|
||||
@ -1,34 +0,0 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "virtio_pci" "usbhid" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-uuid/e1b6bd50-306d-429a-9f45-78f57bc597c3";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-uuid/D5CA-237A";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.eth0.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
|
||||
}
|
||||
@ -1,4 +0,0 @@
|
||||
# Scan hosts: ssh-keyscan -t ed25519 <hostnames>
|
||||
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s noah
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHVknmPi7sG6ES0G0jcsvebzKGWWaMfJTYgvOue6EULI oracle.masu.rs
|
||||
20
hosts/server/default.nix
Normal file
20
hosts/server/default.nix
Normal file
@ -0,0 +1,20 @@
|
||||
{ nixpkgs, home-manager, globals, ... }:
|
||||
|
||||
# System configuration for a generic server
|
||||
nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
specialArgs = { };
|
||||
modules = [
|
||||
globals
|
||||
home-manager.nixosModules.home-manager
|
||||
{
|
||||
networking.hostName = "sheep";
|
||||
gui.enable = false;
|
||||
colorscheme = (import ../../modules/colorscheme/gruvbox);
|
||||
passwordHash =
|
||||
"$6$PZYiMGmJIIHAepTM$Wx5EqTQ5GApzXx58nvi8azh16pdxrN6Qrv1wunDlzveOgawitWzcIxuj76X9V868fsPi/NOIEO8yVXqwzS9UF.";
|
||||
}
|
||||
../common.nix
|
||||
../../modules/nixos
|
||||
];
|
||||
}
|
||||
@ -1,6 +1,4 @@
|
||||
{ inputs, globals, ... }:
|
||||
|
||||
with inputs;
|
||||
{ nixpkgs, wsl, home-manager, globals, ... }:
|
||||
|
||||
# System configuration for WSL
|
||||
nixpkgs.lib.nixosSystem {
|
||||
@ -14,10 +12,10 @@ nixpkgs.lib.nixosSystem {
|
||||
networking.hostName = "wsl";
|
||||
# Set registry to flake packages, used for nix X commands
|
||||
nix.registry.nixpkgs.flake = nixpkgs;
|
||||
identityFile = "/home/${globals.user}/.ssh/id_ed25519";
|
||||
gui.enable = false;
|
||||
colorscheme = (import ../../modules/colorscheme/gruvbox);
|
||||
passwordHash = nixpkgs.lib.fileContents ../../private/password.sha512;
|
||||
passwordHash =
|
||||
"$6$PZYiMGmJIIHAepTM$Wx5EqTQ5GApzXx58nvi8azh16pdxrN6Qrv1wunDlzveOgawitWzcIxuj76X9V868fsPi/NOIEO8yVXqwzS9UF.";
|
||||
wsl = {
|
||||
enable = true;
|
||||
automountPath = "/mnt";
|
||||
|
||||
@ -23,8 +23,8 @@
|
||||
key_bindings = [
|
||||
# Used for word completion in fish_user_key_bindings
|
||||
{
|
||||
key = "Return";
|
||||
mods = "Shift";
|
||||
key = "L";
|
||||
mods = "Control|Shift";
|
||||
chars = "\\x1F";
|
||||
}
|
||||
# Used for searching nixpkgs in fish_user_key_bindings
|
||||
@ -34,8 +34,8 @@
|
||||
chars = "\\x11F";
|
||||
}
|
||||
{
|
||||
key = "H";
|
||||
mods = "Control|Shift";
|
||||
key = "K";
|
||||
mods = "Control";
|
||||
mode = "~Vi";
|
||||
action = "ToggleViMode";
|
||||
}
|
||||
@ -54,32 +54,32 @@
|
||||
];
|
||||
colors = {
|
||||
primary = {
|
||||
background = config.theme.colors.base00;
|
||||
foreground = config.theme.colors.base05;
|
||||
background = config.colorscheme.base00;
|
||||
foreground = config.colorscheme.base05;
|
||||
};
|
||||
cursor = {
|
||||
text = "#1d2021";
|
||||
cursor = config.theme.colors.base05;
|
||||
cursor = config.colorscheme.base05;
|
||||
};
|
||||
normal = {
|
||||
black = "#1d2021";
|
||||
red = config.theme.colors.base08;
|
||||
green = config.theme.colors.base0B;
|
||||
yellow = config.theme.colors.base0A;
|
||||
blue = config.theme.colors.base0D;
|
||||
magenta = config.theme.colors.base0E;
|
||||
cyan = config.theme.colors.base0C;
|
||||
white = config.theme.colors.base05;
|
||||
red = config.colorscheme.base08;
|
||||
green = config.colorscheme.base0B;
|
||||
yellow = config.colorscheme.base0A;
|
||||
blue = config.colorscheme.base0D;
|
||||
magenta = config.colorscheme.base0E;
|
||||
cyan = config.colorscheme.base0C;
|
||||
white = config.colorscheme.base05;
|
||||
};
|
||||
bright = {
|
||||
black = config.theme.colors.base03;
|
||||
red = config.theme.colors.base09;
|
||||
green = config.theme.colors.base01;
|
||||
yellow = config.theme.colors.base02;
|
||||
blue = config.theme.colors.base04;
|
||||
magenta = config.theme.colors.base06;
|
||||
cyan = config.theme.colors.base0F;
|
||||
white = config.theme.colors.base07;
|
||||
black = config.colorscheme.base03;
|
||||
red = config.colorscheme.base09;
|
||||
green = config.colorscheme.base01;
|
||||
yellow = config.colorscheme.base02;
|
||||
blue = config.colorscheme.base04;
|
||||
magenta = config.colorscheme.base06;
|
||||
cyan = config.colorscheme.base0F;
|
||||
white = config.colorscheme.base07;
|
||||
};
|
||||
};
|
||||
draw_bold_text_with_bright_colors = false;
|
||||
|
||||
@ -6,7 +6,6 @@
|
||||
./calibre.nix
|
||||
./discord.nix
|
||||
./firefox.nix
|
||||
./kitty.nix
|
||||
./media.nix
|
||||
./obsidian.nix
|
||||
./qbittorrent.nix
|
||||
|
||||
@ -33,7 +33,6 @@
|
||||
settings = {
|
||||
"browser.aboutConfig.showWarning" = false;
|
||||
"browser.warnOnQuit" = false;
|
||||
"browser.quitShortcut.disabled" = true;
|
||||
"browser.theme.dark-private-windows" = true;
|
||||
"browser.toolbars.bookmarks.visibility" = "newtab";
|
||||
"browser.startup.page" = 3; # Restore previous session
|
||||
@ -48,65 +47,65 @@
|
||||
};
|
||||
userChrome = ''
|
||||
:root {
|
||||
--focus-outline-color: ${config.theme.colors.base04} !important;
|
||||
--toolbar-color: ${config.theme.colors.base07} !important;
|
||||
--focus-outline-color: ${config.colorscheme.base04} !important;
|
||||
--toolbar-color: ${config.colorscheme.base07} !important;
|
||||
--tab-min-height: 30px !important;
|
||||
}
|
||||
/* Background of tab bar */
|
||||
.toolbar-items {
|
||||
background-color: ${config.theme.colors.base00} !important;
|
||||
background-color: ${config.colorscheme.base00} !important;
|
||||
}
|
||||
/* Tabs themselves */
|
||||
.tabbrowser-tab .tab-stack {
|
||||
border-radius: 5px 5px 0 0;
|
||||
overflow: hidden;
|
||||
background-color: ${config.theme.colors.base00};
|
||||
color: ${config.theme.colors.base06} !important;
|
||||
background-color: ${config.colorscheme.base00};
|
||||
color: ${config.colorscheme.base06} !important;
|
||||
}
|
||||
.tab-content {
|
||||
border-bottom: 2px solid color-mix(in srgb, var(--identity-tab-color) 40%, transparent);
|
||||
border-radius: 5px 5px 0 0;
|
||||
background-color: ${config.theme.colors.base00};
|
||||
color: ${config.theme.colors.base06} !important;
|
||||
background-color: ${config.colorscheme.base00};
|
||||
color: ${config.colorscheme.base06} !important;
|
||||
}
|
||||
.tab-content[selected=true] {
|
||||
border-bottom: 2px solid color-mix(in srgb, var(--identity-tab-color) 25%, transparent);
|
||||
background-color: ${config.theme.colors.base01} !important;
|
||||
color: ${config.theme.colors.base07} !important;
|
||||
background-color: ${config.colorscheme.base01} !important;
|
||||
color: ${config.colorscheme.base07} !important;
|
||||
}
|
||||
/* Below tab bar */
|
||||
#nav-bar {
|
||||
background: ${config.theme.colors.base01} !important;
|
||||
background: ${config.colorscheme.base01} !important;
|
||||
}
|
||||
/* URL bar in nav bar */
|
||||
#urlbar[focused=true] {
|
||||
color: ${config.theme.colors.base07} !important;
|
||||
background: ${config.theme.colors.base02} !important;
|
||||
caret-color: ${config.theme.colors.base05} !important;
|
||||
color: ${config.colorscheme.base07} !important;
|
||||
background: ${config.colorscheme.base02} !important;
|
||||
caret-color: ${config.colorscheme.base05} !important;
|
||||
}
|
||||
#urlbar:not([focused=true]) {
|
||||
color: ${config.theme.colors.base04} !important;
|
||||
background: ${config.theme.colors.base02} !important;
|
||||
color: ${config.colorscheme.base04} !important;
|
||||
background: ${config.colorscheme.base02} !important;
|
||||
}
|
||||
#urlbar ::-moz-selection {
|
||||
color: ${config.theme.colors.base07} !important;
|
||||
background: ${config.theme.colors.base02} !important;
|
||||
color: ${config.colorscheme.base07} !important;
|
||||
background: ${config.colorscheme.base02} !important;
|
||||
}
|
||||
#urlbar-input-container {
|
||||
border: 1px solid ${config.theme.colors.base01} !important;
|
||||
border: 1px solid ${config.colorscheme.base01} !important;
|
||||
}
|
||||
#urlbar-background {
|
||||
background: ${config.theme.colors.base01} !important;
|
||||
background: ${config.colorscheme.base01} !important;
|
||||
}
|
||||
/* Text in URL bar */
|
||||
#urlbar-input, #urlbar-scheme, .searchbar-textbox {
|
||||
color: ${config.theme.colors.base07} !important;
|
||||
color: ${config.colorscheme.base07} !important;
|
||||
}
|
||||
'';
|
||||
userContent = ''
|
||||
@-moz-document url-prefix(about:blank) {
|
||||
* {
|
||||
background-color:${config.theme.colors.base01} !important;
|
||||
background-color:${config.colorscheme.base01} !important;
|
||||
}
|
||||
}
|
||||
'';
|
||||
|
||||
@ -1,76 +0,0 @@
|
||||
{ config, pkgs, lib, ... }: {
|
||||
|
||||
config = lib.mkIf config.gui.enable {
|
||||
home-manager.users.${config.user} = {
|
||||
# xsession.windowManager.i3.config.terminal = "kitty";
|
||||
# programs.rofi.terminal = "${pkgs.kitty}/bin/kitty";
|
||||
programs.kitty = {
|
||||
enable = true;
|
||||
environment = { };
|
||||
extraConfig = "";
|
||||
font.size = 14;
|
||||
keybindings = {
|
||||
"shift+enter" = "send_text all \\x1F";
|
||||
"super+f" = "toggle_fullscreen";
|
||||
};
|
||||
settings = {
|
||||
|
||||
# Colors (adapted from: https://github.com/kdrag0n/base16-kitty/blob/master/templates/default-256.mustache)
|
||||
background = config.theme.colors.base00;
|
||||
foreground = config.theme.colors.base05;
|
||||
selection_background = config.theme.colors.base05;
|
||||
selection_foreground = config.theme.colors.base00;
|
||||
url_color = config.theme.colors.base04;
|
||||
cursor = config.theme.colors.base05;
|
||||
active_border_color = config.theme.colors.base03;
|
||||
inactive_border_color = config.theme.colors.base01;
|
||||
active_tab_background = config.theme.colors.base00;
|
||||
active_tab_foreground = config.theme.colors.base05;
|
||||
inactive_tab_background = config.theme.colors.base01;
|
||||
inactive_tab_foreground = config.theme.colors.base04;
|
||||
tab_bar_background = config.theme.colors.base01;
|
||||
|
||||
# normal
|
||||
color0 = config.theme.colors.base00;
|
||||
color1 = config.theme.colors.base08;
|
||||
color2 = config.theme.colors.base0B;
|
||||
color3 = config.theme.colors.base0A;
|
||||
color4 = config.theme.colors.base0D;
|
||||
color5 = config.theme.colors.base0E;
|
||||
color6 = config.theme.colors.base0C;
|
||||
color7 = config.theme.colors.base05;
|
||||
|
||||
# bright
|
||||
color8 = config.theme.colors.base03;
|
||||
color9 = config.theme.colors.base08;
|
||||
color10 = config.theme.colors.base0B;
|
||||
color11 = config.theme.colors.base0A;
|
||||
color12 = config.theme.colors.base0D;
|
||||
color13 = config.theme.colors.base0E;
|
||||
color14 = config.theme.colors.base0C;
|
||||
color15 = config.theme.colors.base07;
|
||||
|
||||
# extended base16 colors
|
||||
color16 = config.theme.colors.base09;
|
||||
color17 = config.theme.colors.base0F;
|
||||
color18 = config.theme.colors.base01;
|
||||
color19 = config.theme.colors.base02;
|
||||
color20 = config.theme.colors.base04;
|
||||
color21 = config.theme.colors.base06;
|
||||
|
||||
# Scrollback
|
||||
scrolling_lines = 10000;
|
||||
scrollback_pager_history_size = 10; # MB
|
||||
scrollback_pager = ''
|
||||
${pkgs.neovim}/bin/nvim -c 'setlocal nonumber nolist showtabline=0 foldcolumn=0|Man!' -c "autocmd VimEnter * normal G" -'';
|
||||
|
||||
# Window
|
||||
window_padding_width = 6;
|
||||
|
||||
tab_bar_edge = "top";
|
||||
tab_bar_style = "slant";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@ -5,7 +5,6 @@
|
||||
mpv # Video viewer
|
||||
sxiv # Image viewer
|
||||
mupdf # PDF viewer
|
||||
zathura # PDF viewer
|
||||
];
|
||||
};
|
||||
|
||||
|
||||
@ -2,7 +2,6 @@
|
||||
name = "gruvbox"; # Dark, Medium
|
||||
author =
|
||||
"Dawid Kurek (dawikur@gmail.com), morhetz (https://github.com/morhetz/gruvbox)";
|
||||
dark = {
|
||||
base00 = "#282828"; # ----
|
||||
base01 = "#3c3836"; # ---
|
||||
base02 = "#504945"; # --
|
||||
@ -20,24 +19,4 @@
|
||||
base0E = "#d3869b"; # purple
|
||||
base0F = "#d65d0e"; # brown
|
||||
neovimConfig = ./neovim.lua;
|
||||
};
|
||||
light = {
|
||||
base00 = "#fbf1c7"; # ----
|
||||
base01 = "#ebdbb2"; # ---
|
||||
base02 = "#d5c4a1"; # --
|
||||
base03 = "#bdae93"; # -
|
||||
base04 = "#665c54"; # +
|
||||
base05 = "#504945"; # ++
|
||||
base06 = "#3c3836"; # +++
|
||||
base07 = "#282828"; # ++++
|
||||
base08 = "#9d0006"; # red
|
||||
base09 = "#af3a03"; # orange
|
||||
base0A = "#b57614"; # yellow
|
||||
base0B = "#79740e"; # green
|
||||
base0C = "#427b58"; # aqua/cyan
|
||||
base0D = "#076678"; # blue
|
||||
base0E = "#8f3f71"; # purple
|
||||
base0F = "#d65d0e"; # brown
|
||||
neovimConfig = ./neovim-light.lua;
|
||||
};
|
||||
}
|
||||
|
||||
@ -6,7 +6,6 @@ M.packer = function(use)
|
||||
config = function()
|
||||
vim.g.gruvbox_italicize_strings = 0
|
||||
vim.cmd("colorscheme gruvbox8")
|
||||
vim.cmd("set background=dark")
|
||||
end,
|
||||
})
|
||||
end
|
||||
|
||||
@ -5,9 +5,8 @@
|
||||
./fonts.nix
|
||||
./hammerspoon.nix
|
||||
./homebrew.nix
|
||||
./kitty.nix
|
||||
./networking.nix
|
||||
./nixpkgs.nix
|
||||
./ssl.nix
|
||||
./system.nix
|
||||
./tmux.nix
|
||||
./user.nix
|
||||
|
||||
@ -9,11 +9,6 @@
|
||||
font.normal.family = "FiraCode Nerd Font Mono";
|
||||
};
|
||||
|
||||
programs.kitty.font = {
|
||||
package = pkgs.nerdfonts;
|
||||
name = "FiraCode";
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
}
|
||||
|
||||
@ -56,7 +56,7 @@ function obj:init()
|
||||
-- Launcher shortcuts
|
||||
self.launcher:bind("ctrl", "space", function() end)
|
||||
self.launcher:bind("", "return", function()
|
||||
self:switch("kitty.app")
|
||||
self:switch("Alacritty.app")
|
||||
end)
|
||||
self.launcher:bind("", "C", function()
|
||||
self:switch("Calendar.app")
|
||||
|
||||
@ -29,19 +29,17 @@
|
||||
];
|
||||
brews = [
|
||||
"trash" # Delete files and folders to trash instead of rm
|
||||
"openjdk" # Required by Apache Directory Studio
|
||||
];
|
||||
casks = [
|
||||
"firefox" # Firefox packaging on Nix is broken for macOS
|
||||
"1password" # 1Password packaging on Nix is broken for macOS
|
||||
"firefox" # Firefox packaging on Nix is broken for MacOS
|
||||
"1password" # 1Password packaging on Nix is broken for MacOS
|
||||
"scroll-reverser" # Different scroll style for mouse vs. trackpad
|
||||
"meetingbar" # Show meetings in menu bar
|
||||
"gitify" # Git notifications in menu bar
|
||||
"logitech-g-hub" # Mouse and keyboard management
|
||||
"mimestream" # Gmail client
|
||||
"obsidian" # Obsidian packaging on Nix is not available for macOS
|
||||
"obsidian" # Obsidian packaging on Nix is not available for MacOS
|
||||
"steam" # Not packaged for Nix
|
||||
"apache-directory-studio" # Packaging on Nix is not available for macOS
|
||||
];
|
||||
};
|
||||
|
||||
|
||||
@ -1,16 +0,0 @@
|
||||
{ config, pkgs, lib, ... }: {
|
||||
|
||||
# MacOS-specific settings for Kitty
|
||||
home-manager.users.${config.user} = {
|
||||
programs.kitty = {
|
||||
darwinLaunchOptions = [ "--start-as=fullscreen" ];
|
||||
font.size = lib.mkForce 20;
|
||||
settings = {
|
||||
shell = "${pkgs.fish}/bin/fish";
|
||||
macos_traditional_fullscreen = true;
|
||||
macos_quit_when_last_window_closed = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
}
|
||||
@ -1,9 +1,8 @@
|
||||
{ config, ... }: {
|
||||
{ ... }: {
|
||||
|
||||
networking = {
|
||||
computerName = "${config.fullName}'\\''s Mac";
|
||||
# Adjust if necessary
|
||||
# hostName = "";
|
||||
computerName = "MacBook"; # Host name
|
||||
hostName = "MacBook";
|
||||
};
|
||||
|
||||
}
|
||||
|
||||
@ -1,4 +1,4 @@
|
||||
{ config, pkgs, lib, ... }: {
|
||||
{ config, lib, ... }: {
|
||||
|
||||
home-manager.users.${config.user} = {
|
||||
|
||||
@ -18,13 +18,6 @@
|
||||
commandline --function execute
|
||||
'';
|
||||
};
|
||||
rebuild-home = lib.mkForce {
|
||||
body = ''
|
||||
git -C ${config.dotfilesPath} add --intent-to-add --all
|
||||
commandline -r "${pkgs.home-manager}/bin/home-manager switch --flake ${config.dotfilesPath}#${config.networking.hostName}";
|
||||
commandline --function execute
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
11
modules/darwin/ssl.nix
Normal file
11
modules/darwin/ssl.nix
Normal file
@ -0,0 +1,11 @@
|
||||
{ config, pkgs, ... }: {
|
||||
|
||||
# security.pki.certificateFiles = [
|
||||
# "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
|
||||
# (builtins.toString ../work/nixos-org-certs.crt)
|
||||
# ];
|
||||
|
||||
security.pki.certificates =
|
||||
[ (builtins.readFile ../work/nixos-org-certs.crt) ];
|
||||
|
||||
}
|
||||
@ -2,8 +2,6 @@
|
||||
|
||||
services.nix-daemon.enable = true;
|
||||
|
||||
security.pam.enableSudoTouchIdAuth = true;
|
||||
|
||||
system = {
|
||||
|
||||
keyboard = {
|
||||
@ -141,12 +139,12 @@
|
||||
|
||||
echo "Define dock icon function"
|
||||
__dock_item() {
|
||||
printf "%s%s%s%s%s" \
|
||||
"<dict><key>tile-data</key><dict><key>file-data</key><dict>" \
|
||||
"<key>_CFURLString</key><string>" \
|
||||
printf '%s%s%s%s%s' \
|
||||
'<dict><key>tile-data</key><dict><key>file-data</key><dict>' \
|
||||
'<key>_CFURLString</key><string>' \
|
||||
"$1" \
|
||||
"</string><key>_CFURLStringType</key><integer>0</integer>" \
|
||||
"</dict></dict></dict>"
|
||||
'</string><key>_CFURLStringType</key><integer>0</integer>' \
|
||||
'</dict></dict></dict>'
|
||||
}
|
||||
|
||||
echo "Choose and order dock icons"
|
||||
@ -163,6 +161,16 @@
|
||||
"$(__dock_item /Applications/Alacritty.app)" \
|
||||
"$(__dock_item /System/Applications/System\ Preferences.app)"
|
||||
|
||||
echo "Enable sudo Touch ID"
|
||||
echo "# sudo: auth account password session" > /tmp/sudofile
|
||||
echo "auth sufficient pam_smartcard.so" >> /tmp/sudofile
|
||||
echo "auth sufficient pam_tid.so " >> /tmp/sudofile
|
||||
echo "auth required pam_opendirectory.so" >> /tmp/sudofile
|
||||
echo "account required pam_permit.so" >> /tmp/sudofile
|
||||
echo "password required pam_deny.so" >> /tmp/sudofile
|
||||
echo "session required pam_permit.so" >> /tmp/sudofile
|
||||
sudo mv /tmp/sudofile /etc/pam.d/sudo
|
||||
|
||||
echo "Allow apps from anywhere"
|
||||
SPCTL=$(spctl --status)
|
||||
if ! [ "$SPCTL" = "assessments disabled" ]; then
|
||||
|
||||
@ -1,9 +1,8 @@
|
||||
{ config, pkgs, lib, ... }: {
|
||||
|
||||
users.users."${config.user}" = {
|
||||
# macOS user
|
||||
users.users."${config.user}" = { # macOS user
|
||||
home = config.homePath;
|
||||
shell = pkgs.fish; # Default shell
|
||||
shell = pkgs.zsh; # Default shell
|
||||
};
|
||||
|
||||
}
|
||||
|
||||
@ -1,19 +1,4 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
let
|
||||
|
||||
# Quickly package shell scripts with their dependencies
|
||||
# From https://discourse.nixos.org/t/how-to-create-a-script-with-dependencies/7970/6
|
||||
mkScript = { name, file, env ? [ ] }:
|
||||
pkgs.writeScriptBin name ''
|
||||
for i in ${lib.concatStringsSep " " env}; do
|
||||
export PATH="$i/bin:$PATH"
|
||||
done
|
||||
|
||||
exec ${pkgs.bash}/bin/bash ${file} $@
|
||||
'';
|
||||
|
||||
in {
|
||||
{ config, pkgs, lib, ... }: {
|
||||
|
||||
home-manager.users.${config.user} = {
|
||||
|
||||
@ -26,17 +11,12 @@ in {
|
||||
mpd # TUI slideshows
|
||||
awscli2
|
||||
awslogs
|
||||
google-cloud-sdk
|
||||
ansible
|
||||
vault
|
||||
consul
|
||||
kubectl
|
||||
k9s
|
||||
noti # Create notifications programmatically
|
||||
ipcalc # Make IP network calculations
|
||||
(mkScript {
|
||||
name = "ocr";
|
||||
file = ../shell/bash/scripts/ocr.sh;
|
||||
env = [ tesseract ];
|
||||
})
|
||||
ipcalc
|
||||
(pkgs.writeScriptBin "ocr"
|
||||
(builtins.readFile ../shell/bash/scripts/ocr.sh))
|
||||
];
|
||||
|
||||
programs.fish.shellAbbrs = {
|
||||
|
||||
@ -1,5 +1,7 @@
|
||||
{ config, ... }: {
|
||||
|
||||
imports = [ ./leagueoflegends.nix ./lutris.nix ./steam.nix ./legendary.nix ];
|
||||
|
||||
config = {
|
||||
hardware.opengl = {
|
||||
enable = true;
|
||||
|
||||
@ -4,9 +4,10 @@ let home-packages = config.home-manager.users.${config.user}.home.packages;
|
||||
|
||||
in {
|
||||
|
||||
imports = [ ./. ];
|
||||
options.gaming.legendary =
|
||||
lib.mkEnableOption "Legendary - Epic Games Launcher";
|
||||
|
||||
config = {
|
||||
config = lib.mkIf config.gaming.legendary {
|
||||
environment.systemPackages = with pkgs; [
|
||||
legendary-gl
|
||||
rare # GUI for Legendary (not working)
|
||||
|
||||
@ -1,145 +0,0 @@
|
||||
{ pkgs, ... }:
|
||||
|
||||
let
|
||||
|
||||
localPort = 25564;
|
||||
publicPort = 49732;
|
||||
rconPort = 25575;
|
||||
rconPassword = "thiscanbeanything";
|
||||
|
||||
in {
|
||||
|
||||
unfreePackages = [ "minecraft-server" ];
|
||||
|
||||
services.minecraft-server = {
|
||||
enable = true;
|
||||
eula = true;
|
||||
declarative = true;
|
||||
whitelist = { };
|
||||
openFirewall = false;
|
||||
serverProperties = {
|
||||
server-port = localPort;
|
||||
difficulty = "normal";
|
||||
gamemode = "survival";
|
||||
white-list = false;
|
||||
enforce-whitelist = false;
|
||||
level-name = "world";
|
||||
motd = "Welcome!";
|
||||
pvp = true;
|
||||
player-idle-timeout = 30;
|
||||
generate-structures = true;
|
||||
max-players = 20;
|
||||
snooper-enabled = false;
|
||||
spawn-npcs = true;
|
||||
spawn-animals = true;
|
||||
spawn-monsters = true;
|
||||
allow-nether = true;
|
||||
allow-flight = false;
|
||||
enable-rcon = true;
|
||||
"rcon.port" = rconPort;
|
||||
"rcon.password" = rconPassword;
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ publicPort ];
|
||||
|
||||
## Automatically start and stop Minecraft server based on player connections
|
||||
|
||||
# Adapted shamelessly from:
|
||||
# https://dataswamp.org/~solene/2022-08-20-on-demand-minecraft-with-systemd.html
|
||||
|
||||
# Prevent Minecraft from starting by default
|
||||
systemd.services.minecraft-server = { wantedBy = pkgs.lib.mkForce [ ]; };
|
||||
|
||||
# Listen for connections on the public port, to trigger the actual
|
||||
# listen-minecraft service.
|
||||
systemd.sockets.listen-minecraft = {
|
||||
wantedBy = [ "sockets.target" ];
|
||||
requires = [ "network.target" ];
|
||||
listenStreams = [ "${toString publicPort}" ];
|
||||
};
|
||||
|
||||
# Proxy traffic to local port, and trigger hook-minecraft
|
||||
systemd.services.listen-minecraft = {
|
||||
path = [ pkgs.systemd ];
|
||||
requires = [ "hook-minecraft.service" "listen-minecraft.socket" ];
|
||||
after = [ "hook-minecraft.service" "listen-minecraft.socket" ];
|
||||
serviceConfig.ExecStart =
|
||||
"${pkgs.systemd.out}/lib/systemd/systemd-socket-proxyd 127.0.0.1:${
|
||||
toString localPort
|
||||
}";
|
||||
};
|
||||
|
||||
# Start Minecraft if required and wait for it to be available
|
||||
# Then unlock the listen-minecraft.service
|
||||
systemd.services.hook-minecraft = {
|
||||
path = with pkgs; [ systemd libressl busybox ];
|
||||
|
||||
# Start Minecraft and the auto-shutdown timer
|
||||
script = ''
|
||||
systemctl start minecraft-server.service
|
||||
systemctl start stop-minecraft.timer
|
||||
'';
|
||||
|
||||
# Keep checking until the service is available
|
||||
postStart = ''
|
||||
for i in $(seq 60); do
|
||||
if ${pkgs.libressl.nc}/bin/nc -z 127.0.0.1 ${
|
||||
toString localPort
|
||||
} > /dev/null ; then
|
||||
exit 0
|
||||
fi
|
||||
${pkgs.busybox.out}/bin/sleep 1
|
||||
done
|
||||
exit 1
|
||||
'';
|
||||
};
|
||||
|
||||
# Run a player check on a schedule for auto-shutdown
|
||||
systemd.timers.stop-minecraft = {
|
||||
timerConfig = {
|
||||
OnCalendar = "*-*-* *:*:0/20"; # Every 20 seconds
|
||||
Unit = "stop-minecraft.service";
|
||||
};
|
||||
};
|
||||
|
||||
# If no players are connected, then stop services and prepare to resume again
|
||||
systemd.services.stop-minecraft = {
|
||||
serviceConfig.Type = "oneshot";
|
||||
script = ''
|
||||
# Check when service was launched
|
||||
servicestartsec=$(
|
||||
date -d \
|
||||
"$(systemctl show \
|
||||
--property=ActiveEnterTimestamp \
|
||||
minecraft-server.service \
|
||||
| cut -d= -f2)" \
|
||||
+%s)
|
||||
|
||||
# Calculate elapsed time
|
||||
serviceelapsedsec=$(( $(date +%s) - servicestartsec))
|
||||
|
||||
# Ignore if service just started
|
||||
if [ $serviceelapsedsec -lt 180 ]
|
||||
then
|
||||
echo "Server was just started"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
PLAYERS=$(
|
||||
printf "list\n" \
|
||||
| ${pkgs.rcon.out}/bin/rcon -m \
|
||||
-H 127.0.0.1 -p ${builtins.toString rconPort} -P ${rconPassword} \
|
||||
)
|
||||
|
||||
if echo "$PLAYERS" | grep "are 0 of a"
|
||||
then
|
||||
echo "Stopping server"
|
||||
systemctl stop minecraft-server.service
|
||||
systemctl stop hook-minecraft.service
|
||||
systemctl stop stop-minecraft.timer
|
||||
fi
|
||||
'';
|
||||
};
|
||||
|
||||
}
|
||||
@ -1,10 +1,10 @@
|
||||
{ config, pkgs, lib, ... }: {
|
||||
|
||||
imports = [ ./. ];
|
||||
options.gaming.steam = lib.mkEnableOption "Steam";
|
||||
|
||||
config = {
|
||||
config = lib.mkIf config.gaming.steam {
|
||||
hardware.steam-hardware.enable = true;
|
||||
unfreePackages = [ "steam" "steam-original" "steamcmd" "steam-run" ];
|
||||
unfreePackages = [ "steam" "steam-original" "steamcmd" ];
|
||||
environment.systemPackages = with pkgs; [
|
||||
|
||||
steam
|
||||
|
||||
@ -1,30 +1,54 @@
|
||||
{ lib, ... }: {
|
||||
|
||||
imports =
|
||||
[ ./xorg.nix ./fonts.nix ./i3.nix ./polybar.nix ./picom.nix ./rofi.nix ];
|
||||
imports = [
|
||||
./xorg.nix
|
||||
./fonts.nix
|
||||
./i3.nix
|
||||
./polybar.nix
|
||||
./picom.nix
|
||||
# ./dmenu.nix
|
||||
./rofi.nix
|
||||
];
|
||||
|
||||
options = {
|
||||
options = with lib; {
|
||||
|
||||
launcherCommand = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
gui = {
|
||||
compositor.enable = mkEnableOption {
|
||||
description = "Enable transparency, blur, shadows";
|
||||
default = false;
|
||||
};
|
||||
launcherCommand = mkOption {
|
||||
type = types.str;
|
||||
description = "Command to use for launching";
|
||||
};
|
||||
systemdSearch = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
systemdSearch = mkOption {
|
||||
type = types.str;
|
||||
description = "Command to use for interacting with systemd";
|
||||
};
|
||||
altTabCommand = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
altTabCommand = mkOption {
|
||||
type = types.str;
|
||||
description = "Command to use for choosing windows";
|
||||
};
|
||||
toggleBarCommand = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Command to hide and show the status bar.";
|
||||
};
|
||||
wallpaper = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
gtk.theme = {
|
||||
name = mkOption {
|
||||
type = types.str;
|
||||
description = "Theme name for GTK applications";
|
||||
};
|
||||
package = mkOption {
|
||||
type = types.str;
|
||||
description = "Theme package name for GTK applications";
|
||||
default = "gnome-themes-extra";
|
||||
};
|
||||
};
|
||||
wallpaper = mkOption {
|
||||
type = types.path;
|
||||
description = "Wallpaper background image file";
|
||||
};
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
|
||||
@ -21,7 +21,6 @@ in {
|
||||
services.polybar.config."bar/main".font-0 = "Hack Nerd Font:size=10;2";
|
||||
programs.rofi.font = "Hack Nerd Font 14";
|
||||
programs.alacritty.settings.font.normal.family = fontName;
|
||||
programs.kitty.font.name = fontName;
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
@ -5,15 +5,15 @@ let
|
||||
lockCmd =
|
||||
"${pkgs.betterlockscreen}/bin/betterlockscreen --lock --display 1 --blur 0.5 --span";
|
||||
lockUpdate =
|
||||
"${pkgs.betterlockscreen}/bin/betterlockscreen --update ${config.wallpaper} --display 1 --span";
|
||||
"${pkgs.betterlockscreen}/bin/betterlockscreen --update ${config.gui.wallpaper} --display 1 --span";
|
||||
|
||||
in {
|
||||
|
||||
config = {
|
||||
config = lib.mkIf config.services.xserver.enable {
|
||||
|
||||
services.xserver.windowManager = {
|
||||
i3 = {
|
||||
enable = config.services.xserver.enable;
|
||||
enable = true;
|
||||
package = pkgs.i3-gaps;
|
||||
};
|
||||
};
|
||||
@ -25,7 +25,7 @@ in {
|
||||
|
||||
home-manager.users.${config.user} = {
|
||||
xsession.windowManager.i3 = {
|
||||
enable = config.services.xserver.enable;
|
||||
enable = true;
|
||||
package = pkgs.i3-gaps;
|
||||
config = let
|
||||
modifier = "Mod4"; # Super key
|
||||
@ -43,22 +43,22 @@ in {
|
||||
modifier = modifier;
|
||||
assigns = {
|
||||
"${ws1}" = [{ class = "Firefox"; }];
|
||||
"${ws2}" = [{ class = "kitty"; }];
|
||||
"${ws2}" = [{ class = "Alacritty"; }];
|
||||
"${ws3}" = [{ class = "discord"; }];
|
||||
"${ws4}" = [{ class = "Steam"; }];
|
||||
};
|
||||
bars = [{ command = "echo"; }]; # Disable i3bar
|
||||
colors = let
|
||||
background = config.theme.colors.base00;
|
||||
inactiveBackground = config.theme.colors.base01;
|
||||
border = config.theme.colors.base01;
|
||||
inactiveBorder = config.theme.colors.base01;
|
||||
text = config.theme.colors.base07;
|
||||
inactiveText = config.theme.colors.base04;
|
||||
urgentBackground = config.theme.colors.base08;
|
||||
background = config.colorscheme.base00;
|
||||
inactiveBackground = config.colorscheme.base01;
|
||||
border = config.colorscheme.base01;
|
||||
inactiveBorder = config.colorscheme.base01;
|
||||
text = config.colorscheme.base07;
|
||||
inactiveText = config.colorscheme.base04;
|
||||
urgentBackground = config.colorscheme.base08;
|
||||
indicator = "#00000000";
|
||||
in {
|
||||
background = config.theme.colors.base00;
|
||||
background = config.colorscheme.base00;
|
||||
focused = {
|
||||
inherit background indicator text border;
|
||||
childBorder = background;
|
||||
@ -111,12 +111,12 @@ in {
|
||||
|
||||
# Launchers
|
||||
"${modifier}+Return" =
|
||||
"exec --no-startup-id kitty; workspace ${ws2}; layout tabbed";
|
||||
"exec --no-startup-id alacritty; workspace ${ws2}; layout tabbed";
|
||||
"${modifier}+space" =
|
||||
"exec --no-startup-id ${config.launcherCommand}";
|
||||
"exec --no-startup-id ${config.gui.launcherCommand}";
|
||||
"${modifier}+Shift+s" =
|
||||
"exec --no-startup-id ${config.systemdSearch}";
|
||||
"Mod1+Tab" = "exec --no-startup-id ${config.altTabCommand}";
|
||||
"exec --no-startup-id ${config.gui.systemdSearch}";
|
||||
"Mod1+Tab" = "exec --no-startup-id ${config.gui.altTabCommand}";
|
||||
"${modifier}+Shift+c" = "reload";
|
||||
"${modifier}+Shift+r" = "restart";
|
||||
"${modifier}+Shift+q" = ''
|
||||
@ -125,7 +125,7 @@ in {
|
||||
|
||||
# Window options
|
||||
"${modifier}+q" = "kill";
|
||||
"${modifier}+b" = "exec ${config.toggleBarCommand}";
|
||||
"${modifier}+b" = "exec ${config.gui.toggleBarCommand}";
|
||||
"${modifier}+f" = "fullscreen toggle";
|
||||
"${modifier}+h" = "focus left";
|
||||
"${modifier}+j" = "focus down";
|
||||
@ -205,18 +205,12 @@ in {
|
||||
modes = { };
|
||||
startup = [
|
||||
{
|
||||
command = "feh --bg-fill ${config.wallpaper}";
|
||||
command = "feh --bg-fill ${config.gui.wallpaper}";
|
||||
always = true;
|
||||
notification = false;
|
||||
}
|
||||
{
|
||||
command =
|
||||
"i3-msg workspace ${ws2}, move workspace to output right";
|
||||
notification = false;
|
||||
}
|
||||
{
|
||||
command =
|
||||
"i3-msg workspace ${ws1}, move workspace to output left";
|
||||
command = "i3-msg workspace ${ws1}";
|
||||
notification = false;
|
||||
}
|
||||
];
|
||||
@ -244,7 +238,7 @@ in {
|
||||
};
|
||||
|
||||
programs.fish.functions = {
|
||||
update-lock-screen = lib.mkIf config.services.xserver.enable {
|
||||
update-lock-screen = {
|
||||
description = "Update lockscreen with wallpaper";
|
||||
body = lockUpdate;
|
||||
};
|
||||
@ -253,19 +247,17 @@ in {
|
||||
# Update lock screen cache only if cache is empty
|
||||
home.activation.updateLockScreenCache =
|
||||
let cacheDir = "${config.homePath}/.cache/betterlockscreen/current";
|
||||
in lib.mkIf config.services.xserver.enable
|
||||
(config.home-manager.users.${config.user}.lib.dag.entryAfter
|
||||
in config.home-manager.users.${config.user}.lib.dag.entryAfter
|
||||
[ "writeBoundary" ] ''
|
||||
if [ ! -d ${cacheDir} ] || [ -z "$(ls ${cacheDir})" ]; then
|
||||
$DRY_RUN_CMD ${lockUpdate}
|
||||
fi
|
||||
'');
|
||||
'';
|
||||
|
||||
};
|
||||
|
||||
# Ref: https://github.com/betterlockscreen/betterlockscreen/blob/next/system/betterlockscreen%40.service
|
||||
systemd.services.lock = {
|
||||
enable = config.services.xserver.enable;
|
||||
description = "Lock the screen on resume from suspend";
|
||||
before = [ "sleep.target" "suspend.target" ];
|
||||
serviceConfig = {
|
||||
|
||||
@ -1,11 +1,11 @@
|
||||
{ config, lib, ... }: {
|
||||
|
||||
config = lib.mkIf (config.services.xserver.enable) {
|
||||
config =
|
||||
lib.mkIf (config.services.xserver.enable && config.gui.compositor.enable) {
|
||||
home-manager.users.${config.user} = {
|
||||
|
||||
services.picom = {
|
||||
enable = true;
|
||||
backend = "glx";
|
||||
settings = {
|
||||
blur = false;
|
||||
blurExclude = [ ];
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
|
||||
config = lib.mkIf config.services.xserver.enable {
|
||||
|
||||
toggleBarCommand = "polybar-msg cmd toggle";
|
||||
gui.toggleBarCommand = "polybar-msg cmd toggle";
|
||||
|
||||
home-manager.users.${config.user} = {
|
||||
|
||||
@ -23,14 +23,14 @@
|
||||
# offset-y = -5;
|
||||
# offset-y = "5%";
|
||||
# dpi = 96;
|
||||
background = config.theme.colors.base01;
|
||||
foreground = config.theme.colors.base05;
|
||||
background = config.colorscheme.base01;
|
||||
foreground = config.colorscheme.base05;
|
||||
line-size = "3pt";
|
||||
border-top-size = 0;
|
||||
border-right-size = 0;
|
||||
border-left-size = 0;
|
||||
border-bottom-size = "4pt";
|
||||
border-color = config.theme.colors.base00;
|
||||
border-color = config.colorscheme.base00;
|
||||
padding-left = 2;
|
||||
padding-right = 2;
|
||||
module-margin = 1;
|
||||
@ -58,35 +58,35 @@
|
||||
fuzzy-match = true;
|
||||
format = "<label-state> <label-mode>";
|
||||
label-focused = "%name%";
|
||||
label-focused-foreground = config.theme.colors.base01;
|
||||
label-focused-background = config.theme.colors.base05;
|
||||
label-focused-underline = config.theme.colors.base03;
|
||||
label-focused-foreground = config.colorscheme.base01;
|
||||
label-focused-background = config.colorscheme.base05;
|
||||
label-focused-underline = config.colorscheme.base03;
|
||||
label-focused-padding = padding;
|
||||
label-unfocused = "%name%";
|
||||
label-unfocused-padding = padding;
|
||||
label-visible = "%name%";
|
||||
label-visible-underline = config.theme.colors.base01;
|
||||
label-visible-underline = config.colorscheme.base01;
|
||||
label-visible-padding = padding;
|
||||
label-urgent = "%name%";
|
||||
label-urgent-foreground = config.theme.colors.base00;
|
||||
label-urgent-background = config.theme.colors.base08;
|
||||
label-urgent-underline = config.theme.colors.base0F;
|
||||
label-urgent-foreground = config.colorscheme.base00;
|
||||
label-urgent-background = config.colorscheme.base08;
|
||||
label-urgent-underline = config.colorscheme.base0F;
|
||||
label-urgent-padding = padding;
|
||||
};
|
||||
"module/xworkspaces" = {
|
||||
type = "internal/xworkspaces";
|
||||
label-active = "%name%";
|
||||
label-active-background = config.theme.colors.base05;
|
||||
label-active-foreground = config.theme.colors.base01;
|
||||
label-active-underline = config.theme.colors.base03;
|
||||
label-active-background = config.colorscheme.base05;
|
||||
label-active-foreground = config.colorscheme.base01;
|
||||
label-active-underline = config.colorscheme.base03;
|
||||
label-active-padding = 1;
|
||||
label-occupied = "%name%";
|
||||
label-occupied-padding = 1;
|
||||
label-urgent = "%name%";
|
||||
label-urgent-background = config.theme.colors.base08;
|
||||
label-urgent-background = config.colorscheme.base08;
|
||||
label-urgent-padding = 1;
|
||||
label-empty = "%name%";
|
||||
label-empty-foreground = config.theme.colors.base06;
|
||||
label-empty-foreground = config.colorscheme.base06;
|
||||
label-empty-padding = 1;
|
||||
};
|
||||
"module/xwindow" = {
|
||||
@ -108,10 +108,10 @@
|
||||
format-volume = "<ramp-volume> <label-volume>";
|
||||
# format-volume-background = colors.background;
|
||||
# label-volume-background = colors.background;
|
||||
format-volume-foreground = config.theme.colors.base0B;
|
||||
format-volume-foreground = config.colorscheme.base0B;
|
||||
label-volume = "%percentage%%";
|
||||
label-muted = "ﱝ ---";
|
||||
label-muted-foreground = config.theme.colors.base03;
|
||||
label-muted-foreground = config.colorscheme.base03;
|
||||
ramp-volume-0 = "";
|
||||
ramp-volume-1 = "墳";
|
||||
ramp-volume-2 = "";
|
||||
@ -163,7 +163,7 @@
|
||||
date = "%d %b %l:%M %p";
|
||||
date-alt = "%Y-%m-%d %H:%M:%S";
|
||||
label = "%date%";
|
||||
label-foreground = config.theme.colors.base0A;
|
||||
label-foreground = config.colorscheme.base0A;
|
||||
# format-background = colors.background;
|
||||
};
|
||||
"settings" = {
|
||||
|
||||
@ -25,19 +25,19 @@
|
||||
# Inspired by https://github.com/sherubthakur/dotfiles/blob/master/users/modules/desktop-environment/rofi/launcher.rasi
|
||||
|
||||
"*" = {
|
||||
background-color = mkLiteral config.theme.colors.base00;
|
||||
foreground-color = mkLiteral config.theme.colors.base07;
|
||||
text-color = mkLiteral config.theme.colors.base07;
|
||||
border-color = mkLiteral config.theme.colors.base04;
|
||||
background-color = mkLiteral config.colorscheme.base00;
|
||||
foreground-color = mkLiteral config.colorscheme.base07;
|
||||
text-color = mkLiteral config.colorscheme.base07;
|
||||
border-color = mkLiteral config.colorscheme.base04;
|
||||
};
|
||||
|
||||
# Holds the entire window
|
||||
"#window" = {
|
||||
transparency = "real";
|
||||
background-color = mkLiteral config.theme.colors.base00;
|
||||
text-color = mkLiteral config.theme.colors.base07;
|
||||
background-color = mkLiteral config.colorscheme.base00;
|
||||
text-color = mkLiteral config.colorscheme.base07;
|
||||
border = mkLiteral "4px";
|
||||
border-color = mkLiteral config.theme.colors.base04;
|
||||
border-color = mkLiteral config.colorscheme.base04;
|
||||
border-radius = mkLiteral "4px";
|
||||
width = mkLiteral "850px";
|
||||
padding = mkLiteral "15px";
|
||||
@ -45,10 +45,10 @@
|
||||
|
||||
# Wrapper around bar and results
|
||||
"#mainbox" = {
|
||||
background-color = mkLiteral config.theme.colors.base00;
|
||||
background-color = mkLiteral config.colorscheme.base00;
|
||||
border = mkLiteral "0px";
|
||||
border-radius = mkLiteral "0px";
|
||||
border-color = mkLiteral config.theme.colors.base04;
|
||||
border-color = mkLiteral config.colorscheme.base04;
|
||||
children = map mkLiteral [ "inputbar" "listview" ];
|
||||
spacing = mkLiteral "10px";
|
||||
padding = mkLiteral "10px";
|
||||
@ -59,7 +59,7 @@
|
||||
expand = false;
|
||||
str = ":";
|
||||
margin = mkLiteral "0px 0.3em 0em 0em";
|
||||
text-color = mkLiteral config.theme.colors.base07;
|
||||
text-color = mkLiteral config.colorscheme.base07;
|
||||
};
|
||||
|
||||
# Command prompt left of the input
|
||||
@ -67,7 +67,7 @@
|
||||
|
||||
# Actual text box
|
||||
"#entry" = {
|
||||
placeholder-color = mkLiteral config.theme.colors.base03;
|
||||
placeholder-color = mkLiteral config.colorscheme.base03;
|
||||
expand = true;
|
||||
horizontal-align = "0";
|
||||
placeholder = "Launch Program";
|
||||
@ -85,7 +85,7 @@
|
||||
|
||||
# Results
|
||||
"#listview" = {
|
||||
background-color = mkLiteral config.theme.colors.base00;
|
||||
background-color = mkLiteral config.colorscheme.base00;
|
||||
padding = mkLiteral "0px";
|
||||
columns = 1;
|
||||
lines = 12;
|
||||
@ -104,9 +104,9 @@
|
||||
"#element.selected" = {
|
||||
border = mkLiteral "1px";
|
||||
border-radius = mkLiteral "4px";
|
||||
border-color = mkLiteral config.theme.colors.base07;
|
||||
background-color = mkLiteral config.theme.colors.base04;
|
||||
text-color = mkLiteral config.theme.colors.base00;
|
||||
border-color = mkLiteral config.colorscheme.base07;
|
||||
background-color = mkLiteral config.colorscheme.base04;
|
||||
text-color = mkLiteral config.colorscheme.base00;
|
||||
};
|
||||
|
||||
"#element-text" = {
|
||||
@ -116,8 +116,8 @@
|
||||
margin = mkLiteral "0px 2.5px 0px 2.5px";
|
||||
};
|
||||
"#element-text.selected" = {
|
||||
background-color = mkLiteral config.theme.colors.base04;
|
||||
text-color = mkLiteral config.theme.colors.base00;
|
||||
background-color = mkLiteral config.colorscheme.base04;
|
||||
text-color = mkLiteral config.colorscheme.base00;
|
||||
};
|
||||
|
||||
# Not sure how to get icons
|
||||
@ -125,11 +125,11 @@
|
||||
size = mkLiteral "18px";
|
||||
border = mkLiteral "0px";
|
||||
padding = mkLiteral "2px 5px 2px 2px";
|
||||
background-color = mkLiteral config.theme.colors.base00;
|
||||
background-color = mkLiteral config.colorscheme.base00;
|
||||
};
|
||||
"#element-icon.selected" = {
|
||||
background-color = mkLiteral config.theme.colors.base04;
|
||||
text-color = mkLiteral config.theme.colors.base00;
|
||||
background-color = mkLiteral config.colorscheme.base04;
|
||||
text-color = mkLiteral config.colorscheme.base00;
|
||||
};
|
||||
|
||||
};
|
||||
@ -144,9 +144,9 @@
|
||||
|
||||
};
|
||||
|
||||
launcherCommand = "${pkgs.rofi}/bin/rofi -show run -modi run";
|
||||
systemdSearch = "${pkgs.rofi-systemd}/bin/rofi-systemd";
|
||||
altTabCommand = "${pkgs.rofi}/bin/rofi -show window -modi window";
|
||||
gui.launcherCommand = "${pkgs.rofi}/bin/rofi -show run -modi run";
|
||||
gui.systemdSearch = "${pkgs.rofi-systemd}/bin/rofi-systemd";
|
||||
gui.altTabCommand = "${pkgs.rofi}/bin/rofi -show window -modi window";
|
||||
|
||||
};
|
||||
|
||||
|
||||
@ -1,25 +1,15 @@
|
||||
{ config, pkgs, lib, ... }: {
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
options = {
|
||||
gtk.theme = {
|
||||
name = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Theme name for GTK applications";
|
||||
};
|
||||
package = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Theme package name for GTK applications";
|
||||
default = "gnome-themes-extra";
|
||||
};
|
||||
};
|
||||
};
|
||||
let
|
||||
|
||||
config = let
|
||||
gtkTheme = {
|
||||
name = config.gtk.theme.name;
|
||||
package = pkgs."${config.gtk.theme.package}";
|
||||
name = config.gui.gtk.theme.name;
|
||||
package = pkgs.${config.gui.gtk.theme.package};
|
||||
};
|
||||
in lib.mkIf config.gui.enable {
|
||||
|
||||
in {
|
||||
|
||||
config = lib.mkIf config.gui.enable {
|
||||
|
||||
# Enable the X11 windowing system.
|
||||
services.xserver = {
|
||||
@ -32,16 +22,11 @@
|
||||
displayManager = {
|
||||
lightdm = {
|
||||
enable = config.services.xserver.enable;
|
||||
background = config.wallpaper;
|
||||
background = config.gui.wallpaper;
|
||||
|
||||
# Make the login screen dark
|
||||
greeters.gtk.theme = gtkTheme;
|
||||
|
||||
# Show default user
|
||||
extraSeatDefaults = ''
|
||||
greeter-hide-users = false
|
||||
'';
|
||||
|
||||
};
|
||||
};
|
||||
|
||||
@ -56,7 +41,7 @@
|
||||
services.dbus.packages = [ pkgs.dconf ];
|
||||
programs.dconf.enable = true;
|
||||
|
||||
environment.sessionVariables = { GTK_THEME = config.gtk.theme.name; };
|
||||
environment.sessionVariables = { GTK_THEME = config.gui.gtk.theme.name; };
|
||||
|
||||
home-manager.users.${config.user} = {
|
||||
|
||||
@ -65,10 +50,7 @@
|
||||
pbpaste = "xclip -selection clipboard -out";
|
||||
};
|
||||
|
||||
gtk = let
|
||||
gtkExtraConfig = {
|
||||
gtk-application-prefer-dark-theme = config.theme.dark;
|
||||
};
|
||||
gtk = let gtkExtraConfig = { gtk-application-prefer-dark-theme = true; };
|
||||
in {
|
||||
enable = true;
|
||||
theme = gtkTheme;
|
||||
|
||||
@ -33,11 +33,8 @@ in {
|
||||
config = lib.mkIf config.gui.enable {
|
||||
sound.enable = true;
|
||||
|
||||
# Enable PipeWire
|
||||
services.pipewire = {
|
||||
enable = true;
|
||||
pulse.enable = true;
|
||||
};
|
||||
# Enable PulseAudio
|
||||
hardware.pulseaudio.enable = true;
|
||||
|
||||
# These aren't necessary, but helpful for the user
|
||||
environment.systemPackages = with pkgs; [
|
||||
@ -55,8 +52,7 @@ in {
|
||||
# Make sure that Volnoti actually starts (home-manager doesn't start
|
||||
# user daemon's automatically)
|
||||
startup = [{
|
||||
command =
|
||||
"systemctl --user restart volnoti --alpha 0.15 --radius 40 --timeout 0.2";
|
||||
command = "systemctl --user restart volnoti";
|
||||
always = true;
|
||||
notification = false;
|
||||
}];
|
||||
|
||||
@ -10,9 +10,6 @@
|
||||
# Check for other OSes and make them available
|
||||
useOSProber = true;
|
||||
|
||||
# Attempt to display GRUB on widescreen monitor
|
||||
gfxmodeEfi = "1920x1080";
|
||||
|
||||
# Install GRUB onto the boot disk
|
||||
# device = config.fileSystems."/boot".device;
|
||||
|
||||
|
||||
@ -1,7 +0,0 @@
|
||||
{ config, ... }: {
|
||||
|
||||
# Servers need a bootloader or they won't start
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
}
|
||||
@ -1,187 +0,0 @@
|
||||
{ config, pkgs, ... }: {
|
||||
|
||||
config = {
|
||||
|
||||
home-manager.users.${config.user} = {
|
||||
|
||||
home.packages = with pkgs; [
|
||||
w3m # Render HTML
|
||||
dante # Socksify for rendering HTML
|
||||
];
|
||||
|
||||
programs.aerc = {
|
||||
enable = true;
|
||||
extraBinds = {
|
||||
# Binds are of the form <key sequence> = <command to run>
|
||||
# To use '=' in a key sequence, substitute it with "Eq": "<Ctrl+Eq>"
|
||||
# If you wish to bind #, you can wrap the key sequence in quotes: "#" = quit
|
||||
global = {
|
||||
"<C-p>" = ":prev-tab<Enter>";
|
||||
"<C-n>" = ":next-tab <Enter>";
|
||||
"<C-t>" = ":term<Enter>";
|
||||
"?" = ":help keys<Enter>";
|
||||
};
|
||||
|
||||
messages = {
|
||||
q = ":quit<Enter>";
|
||||
|
||||
j = ":next <Enter>";
|
||||
"<Down>" = ":next<Enter>";
|
||||
"<C-d>" = ":next 50%<Enter>";
|
||||
"<C-f>" = ":next 100%<Enter>";
|
||||
"<PgDn>" = ":next 100%<Enter>";
|
||||
|
||||
k = ":prev <Enter>";
|
||||
"<Up>" = ":prev<Enter>";
|
||||
"<C-u>" = ":prev 50%<Enter>";
|
||||
"<C-b>" = ":prev 100%<Enter>";
|
||||
"<PgUp>" = ":prev 100%<Enter>";
|
||||
g = ":select 0 <Enter>";
|
||||
G = ":select -1<Enter>";
|
||||
|
||||
J = ":next-folder <Enter>";
|
||||
K = ":prev-folder<Enter>";
|
||||
H = ":collapse-folder<Enter>";
|
||||
L = ":expand-folder<Enter>";
|
||||
|
||||
v = ":mark -t<Enter>";
|
||||
V = ":mark -v<Enter>";
|
||||
|
||||
T = ":toggle-threads<Enter>";
|
||||
|
||||
"<Enter>" = ":view<Enter>";
|
||||
d = ":prompt 'Really delete this message?' 'delete-message'<Enter>";
|
||||
D = ":move Trash<Enter>";
|
||||
A = ":archive flat<Enter>";
|
||||
|
||||
C = ":compose<Enter>";
|
||||
|
||||
rr = ":reply -a<Enter>";
|
||||
rq = ":reply -aq<Enter>";
|
||||
Rr = ":reply<Enter>";
|
||||
Rq = ":reply -q<Enter>";
|
||||
|
||||
c = ":cf<space>";
|
||||
"$" = ":term<space>";
|
||||
"!" = ":term<space>";
|
||||
"|" = ":pipe<space>";
|
||||
|
||||
"/" = ":search<space>";
|
||||
"\\" = ":filter <space>";
|
||||
n = ":next-result<Enter>";
|
||||
N = ":prev-result<Enter>";
|
||||
"<Esc>" = ":clear<Enter>";
|
||||
};
|
||||
|
||||
"messages:folder=Drafts" = { "<Enter>" = ":recall<Enter>"; };
|
||||
|
||||
view = {
|
||||
"/" = ":toggle-key-passthrough <Enter> /";
|
||||
q = ":close<Enter>";
|
||||
O = ":open<Enter>";
|
||||
S = ":save<space>";
|
||||
"|" = ":pipe<space>";
|
||||
D = ":move Trash<Enter>";
|
||||
A = ":archive flat<Enter>";
|
||||
|
||||
"<C-l>" = ":open-link <space>";
|
||||
|
||||
f = ":forward <Enter>";
|
||||
rr = ":reply -a<Enter>";
|
||||
rq = ":reply -aq<Enter>";
|
||||
Rr = ":reply<Enter>";
|
||||
Rq = ":reply -q<Enter>";
|
||||
|
||||
H = ":toggle-headers<Enter>";
|
||||
"<C-k>" = ":prev-part<Enter>";
|
||||
"<C-j>" = ":next-part<Enter>";
|
||||
J = ":next <Enter>";
|
||||
K = ":prev<Enter>";
|
||||
};
|
||||
|
||||
"view::passthrough" = {
|
||||
"$noinherit" = "true";
|
||||
"$ex" = "<C-x>";
|
||||
"<Esc>" = ":toggle-key-passthrough<Enter>";
|
||||
};
|
||||
|
||||
compose = {
|
||||
# Keybindings used when the embedded terminal is not selected in the compose
|
||||
# view
|
||||
"$noinherit" = "true";
|
||||
"$ex" = "<C-x>";
|
||||
"<C-k>" = ":prev-field<Enter>";
|
||||
"<C-j>" = ":next-field<Enter>";
|
||||
"<A-p>" = ":switch-account -p<Enter>";
|
||||
"<A-n>" = ":switch-account -n<Enter>";
|
||||
"<tab>" = ":next-field<Enter>";
|
||||
"<C-p>" = ":prev-tab<Enter>";
|
||||
"<C-n>" = ":next-tab<Enter>";
|
||||
};
|
||||
|
||||
"compose::editor" = {
|
||||
# Keybindings used when the embedded terminal is selected in the compose view
|
||||
"$noinherit" = "true";
|
||||
"$ex" = "<C-x>";
|
||||
"<C-k>" = ":prev-field<Enter>";
|
||||
"<C-j>" = ":next-field<Enter>";
|
||||
"<C-p>" = ":prev-tab<Enter>";
|
||||
"<C-n>" = ":next-tab<Enter>";
|
||||
};
|
||||
|
||||
"compose::review" = {
|
||||
# Keybindings used when reviewing a message to be sent
|
||||
y = ":send <Enter>";
|
||||
n = ":abort<Enter>";
|
||||
p = ":postpone<Enter>";
|
||||
q = ":choose -o d discard abort -o p postpone postpone<Enter>";
|
||||
e = ":edit<Enter>";
|
||||
a = ":attach<space>";
|
||||
d = ":detach<space>";
|
||||
};
|
||||
|
||||
terminal = {
|
||||
"$noinherit" = "true";
|
||||
"$ex" = "<C-x>";
|
||||
"<C-p>" = ":prev-tab<Enter>";
|
||||
"<C-n>" = ":next-tab<Enter>";
|
||||
};
|
||||
|
||||
};
|
||||
extraConfig = {
|
||||
general.unsafe-accounts-conf = true;
|
||||
viewer = { pager = "${pkgs.less}/bin/less -R"; };
|
||||
filters = {
|
||||
"text/plain" =
|
||||
"${pkgs.gawk}/bin/awk -f ${pkgs.aerc}/share/aerc/filters/colorize";
|
||||
"text/calendar" =
|
||||
"${pkgs.gawk}/bin/awk -f ${pkgs.aerc}/share/aerc/filters/calendar";
|
||||
"text/html" =
|
||||
"${pkgs.aerc}/share/aerc/filters/html"; # Requires w3m, dante
|
||||
# "text/html" =
|
||||
# "${pkgs.aerc}/share/aerc/filters/html | ${pkgs.aerc}/share/aerc/filters/colorize";
|
||||
# "text/*" =
|
||||
# ''${pkgs.bat}/bin/bat -fP --file-name="$AERC_FILENAME "'';
|
||||
"message/delivery-status" =
|
||||
"${pkgs.gawk}/bin/awk -f ${pkgs.aerc}/share/aerc/filters/colorize";
|
||||
"message/rfc822" =
|
||||
"${pkgs.gawk}/bin/awk -f ${pkgs.aerc}/share/aerc/filters/colorize";
|
||||
"application/x-sh" = "${pkgs.bat}/bin/bat -fP -l sh";
|
||||
"application/pdf" = "${pkgs.zathura}/bin/zathura -";
|
||||
};
|
||||
};
|
||||
};
|
||||
accounts.email.accounts.home.aerc = {
|
||||
enable = true;
|
||||
extraAccounts = {
|
||||
check-mail = "5m";
|
||||
check-mail-cmd = "${pkgs.isync}/bin/mbsync -a";
|
||||
};
|
||||
};
|
||||
|
||||
programs.fish.shellAbbrs = { ae = "aerc"; };
|
||||
|
||||
};
|
||||
|
||||
};
|
||||
}
|
||||
@ -1,83 +0,0 @@
|
||||
{ config, pkgs, lib, ... }: {
|
||||
|
||||
imports = [ ./himalaya.nix ./aerc.nix ];
|
||||
|
||||
options = {
|
||||
mailUser = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "User name for the email address.";
|
||||
default = config.user;
|
||||
};
|
||||
mailServer = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Server name for the email address.";
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
|
||||
home-manager.users.${config.user} = {
|
||||
programs.mbsync = { enable = true; };
|
||||
services.mbsync = lib.mkIf pkgs.stdenv.isLinux {
|
||||
enable = true;
|
||||
frequency = "*:0/5";
|
||||
};
|
||||
accounts.email = {
|
||||
maildirBasePath = "${config.homePath}/mail";
|
||||
accounts = {
|
||||
home = let address = "${config.mailUser}@${config.mailServer}";
|
||||
in {
|
||||
userName = address;
|
||||
realName = config.fullName;
|
||||
primary = true;
|
||||
inherit address;
|
||||
aliases = map (mailUser: "${mailUser}@${config.mailServer}") [
|
||||
"me"
|
||||
"hey"
|
||||
"admin"
|
||||
];
|
||||
alot = { };
|
||||
flavor = "plain";
|
||||
folders = { };
|
||||
getmail = { };
|
||||
imap = {
|
||||
host = "imap.purelymail.com";
|
||||
port = 993;
|
||||
tls.enable = true;
|
||||
};
|
||||
imapnotify = {
|
||||
enable = false;
|
||||
boxes = [ ];
|
||||
onNotify = "";
|
||||
onNotifyPost = "";
|
||||
};
|
||||
maildir = { path = "main"; };
|
||||
mbsync = {
|
||||
enable = true;
|
||||
create = "maildir";
|
||||
expunge = "none";
|
||||
remove = "none";
|
||||
patterns = [ "*" ];
|
||||
extraConfig.channel = {
|
||||
CopyArrivalDate = "yes"; # Sync time of original message
|
||||
};
|
||||
};
|
||||
mu.enable = false;
|
||||
notmuch.enable = false;
|
||||
passwordCommand =
|
||||
"${pkgs.age}/bin/age --decrypt --identity ${config.identityFile} ${
|
||||
builtins.toString ../../private/mailpass.age
|
||||
}";
|
||||
smtp = {
|
||||
host = "smtp.purelymail.com";
|
||||
port = 465;
|
||||
tls.enable = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
};
|
||||
}
|
||||
@ -1,19 +1,89 @@
|
||||
{ config, ... }: {
|
||||
{ config, pkgs, lib, ... }: {
|
||||
|
||||
options = {
|
||||
mailUser = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "User name for the email address.";
|
||||
default = config.user;
|
||||
};
|
||||
mailServer = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Server name for the email address.";
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
|
||||
home-manager.users.${config.user} = {
|
||||
|
||||
programs.himalaya = { enable = true; };
|
||||
accounts.email.accounts.home.himalaya = {
|
||||
programs.mbsync = { enable = true; };
|
||||
services.mbsync = lib.mkIf pkgs.stdenv.isLinux {
|
||||
enable = true;
|
||||
frequency = "*:0/5";
|
||||
};
|
||||
|
||||
accounts.email = {
|
||||
maildirBasePath = "${config.homePath}/mail";
|
||||
accounts = {
|
||||
home = let address = "${config.mailUser}@${config.mailServer}";
|
||||
in {
|
||||
userName = address;
|
||||
realName = config.fullName;
|
||||
primary = true;
|
||||
inherit address;
|
||||
aliases = map (mailUser: "${mailUser}@${config.mailServer}") [
|
||||
"me"
|
||||
"hey"
|
||||
"admin"
|
||||
];
|
||||
alot = { };
|
||||
flavor = "plain";
|
||||
folders = { };
|
||||
getmail = { };
|
||||
himalaya = {
|
||||
enable = true;
|
||||
settings = {
|
||||
backend = "imap";
|
||||
sender = "smtp";
|
||||
downloads-dir = config.userDirs.download;
|
||||
smtp-insecure = true;
|
||||
};
|
||||
};
|
||||
imap = {
|
||||
host = "imap.purelymail.com";
|
||||
port = 993;
|
||||
tls.enable = true;
|
||||
};
|
||||
imapnotify = {
|
||||
enable = false;
|
||||
boxes = [ ];
|
||||
onNotify = "";
|
||||
onNotifyPost = "";
|
||||
};
|
||||
maildir = { path = "main"; };
|
||||
mbsync = {
|
||||
enable = true;
|
||||
create = "maildir";
|
||||
expunge = "none";
|
||||
remove = "none";
|
||||
patterns = [ "*" ];
|
||||
extraConfig.channel = {
|
||||
CopyArrivalDate = "yes"; # Sync time of original message
|
||||
};
|
||||
};
|
||||
mu.enable = false;
|
||||
notmuch.enable = false;
|
||||
passwordCommand =
|
||||
"${pkgs.age}/bin/age --decrypt --identity ${config.homePath}/.ssh/id_ed25519 ${
|
||||
builtins.toString ./mailpass.age
|
||||
}";
|
||||
smtp = {
|
||||
host = "smtp.purelymail.com";
|
||||
port = 465;
|
||||
tls.enable = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
programs.fish.shellAbbrs = { hi = "himalaya"; };
|
||||
|
||||
|
||||
5
modules/mail/mailpass.age
Normal file
5
modules/mail/mailpass.age
Normal file
@ -0,0 +1,5 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 MgHaOw 8h/ESNjn0gknNXoHM34UobHzPgmRunoP97H+KHOuGQM
|
||||
qowH+6TlCRECGCscRgKx6kswY+PZezYUD6E+x9e+5pM
|
||||
--- kFj1JzRdh/D13Uq9aNTzMJIFysEE+kzzthjewOIR2+o
|
||||
Ȳ<EFBFBD><EFBFBD>6<EFBFBD><EFBFBD><EFBFBD>}rC<72>z<><7A><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
||||
@ -5,8 +5,6 @@
|
||||
home.packages = with pkgs; [
|
||||
neovim
|
||||
gcc # for tree-sitter
|
||||
tree-sitter # for tree-sitter-gitignore parser
|
||||
nodejs # for tree-sitter-gitignore parser
|
||||
shfmt # used everywhere
|
||||
shellcheck # used everywhere
|
||||
];
|
||||
@ -17,12 +15,7 @@
|
||||
source = ./lua;
|
||||
recursive = true; # Allows adding more files
|
||||
};
|
||||
"nvim/lua/packer/colors.lua".source = config.theme.colors.neovimConfig;
|
||||
"nvim/lua/background.lua".text = ''
|
||||
vim.cmd("set background=${
|
||||
if config.theme.dark == true then "dark" else "light"
|
||||
}")
|
||||
'';
|
||||
"nvim/lua/packer/colors.lua".source = config.colorscheme.neovimConfig;
|
||||
};
|
||||
|
||||
programs.git.extraConfig.core.editor = "nvim";
|
||||
|
||||
@ -1,4 +1,3 @@
|
||||
require("packer_init")
|
||||
require("settings")
|
||||
require("keybinds")
|
||||
require("background")
|
||||
|
||||
@ -14,7 +14,8 @@ M.packer = function(use)
|
||||
return vim.fn.executable(program) == 1
|
||||
end
|
||||
|
||||
local capabilities = require("cmp_nvim_lsp").default_capabilities()
|
||||
local capabilities =
|
||||
require("cmp_nvim_lsp").update_capabilities(vim.lsp.protocol.make_client_capabilities())
|
||||
if on_path("lua-language-server") then
|
||||
require("lspconfig").sumneko_lua.setup({
|
||||
capabilities = capabilities,
|
||||
@ -79,7 +80,6 @@ M.packer = function(use)
|
||||
return vim.fn.executable(program) == 1
|
||||
end
|
||||
|
||||
local augroup = vim.api.nvim_create_augroup("LspFormatting", {})
|
||||
require("null-ls").setup({
|
||||
sources = {
|
||||
require("null-ls").builtins.formatting.stylua.with({
|
||||
@ -133,15 +133,15 @@ M.packer = function(use)
|
||||
-- require("null-ls").builtins.diagnostics.pylint,
|
||||
},
|
||||
-- Format on save
|
||||
on_attach = function(client, bufnr)
|
||||
if client.supports_method("textDocument/formatting") then
|
||||
vim.api.nvim_clear_autocmds({ group = augroup, buffer = bufnr })
|
||||
on_attach = function(client)
|
||||
if client.resolved_capabilities.document_formatting then
|
||||
local id = vim.api.nvim_create_augroup("LspFormatting", {
|
||||
clear = true,
|
||||
})
|
||||
vim.api.nvim_create_autocmd("BufWritePre", {
|
||||
group = augroup,
|
||||
buffer = bufnr,
|
||||
callback = function()
|
||||
vim.lsp.buf.format({ bufnr = bufnr })
|
||||
end,
|
||||
group = id,
|
||||
pattern = "*",
|
||||
callback = vim.lsp.buf.formatting_seq_sync,
|
||||
})
|
||||
end
|
||||
end,
|
||||
|
||||
@ -29,39 +29,7 @@ M.packer = function(use)
|
||||
})
|
||||
|
||||
-- Markdown renderer / wiki notes
|
||||
-- use("vimwiki/vimwiki")
|
||||
use({
|
||||
"jakewvincent/mkdnflow.nvim",
|
||||
config = function()
|
||||
require("mkdnflow").setup({
|
||||
modules = {
|
||||
bib = false,
|
||||
conceal = true,
|
||||
folds = false,
|
||||
},
|
||||
perspective = {
|
||||
priority = "current",
|
||||
fallback = "first",
|
||||
nvim_wd_heel = false, -- Don't change working dir
|
||||
},
|
||||
links = {
|
||||
style = "markdown",
|
||||
conceal = true,
|
||||
},
|
||||
wrap = true,
|
||||
to_do = {
|
||||
symbols = { " ", "-", "x" },
|
||||
},
|
||||
})
|
||||
vim.api.nvim_create_autocmd("FileType", {
|
||||
pattern = "markdown",
|
||||
callback = function()
|
||||
vim.o.autowriteall = true -- Save in new buffer
|
||||
vim.o.wrapmargin = 79 -- Wrap text automatically
|
||||
end,
|
||||
})
|
||||
end,
|
||||
})
|
||||
use("vimwiki/vimwiki")
|
||||
end
|
||||
|
||||
return M
|
||||
|
||||
@ -8,6 +8,49 @@ M.packer = function(use)
|
||||
require("impatient")
|
||||
end,
|
||||
})
|
||||
|
||||
-- Improve speed and filetype detection
|
||||
use({
|
||||
"nathom/filetype.nvim",
|
||||
config = function()
|
||||
-- Filetype for .env files
|
||||
local envfiletype = function()
|
||||
vim.bo.filetype = "text"
|
||||
vim.bo.syntax = "sh"
|
||||
end
|
||||
-- Force filetype patterns that Vim doesn't know about
|
||||
require("filetype").setup({
|
||||
overrides = {
|
||||
extensions = {
|
||||
Brewfile = "brewfile",
|
||||
muttrc = "muttrc",
|
||||
tfvars = "terraform",
|
||||
tf = "terraform",
|
||||
},
|
||||
literal = {
|
||||
Caskfile = "brewfile",
|
||||
[".gitignore"] = "gitignore",
|
||||
config = "config",
|
||||
},
|
||||
complex = {
|
||||
[".*git/config"] = "gitconfig",
|
||||
["tmux.conf%..*link"] = "tmux",
|
||||
["gitconfig%..*link"] = "gitconfig",
|
||||
[".*ignore%..*link"] = "gitignore",
|
||||
[".*%.toml%..*link"] = "toml",
|
||||
},
|
||||
function_extensions = {},
|
||||
function_literal = {
|
||||
[".envrc"] = envfiletype,
|
||||
[".env"] = envfiletype,
|
||||
[".env.dev"] = envfiletype,
|
||||
[".env.prod"] = envfiletype,
|
||||
[".env.example"] = envfiletype,
|
||||
},
|
||||
},
|
||||
})
|
||||
end,
|
||||
})
|
||||
end
|
||||
|
||||
return M
|
||||
|
||||
@ -8,7 +8,7 @@ M.packer = function(use)
|
||||
-- Syntax engine
|
||||
use({
|
||||
"nvim-treesitter/nvim-treesitter",
|
||||
commit = "9ada5f70f98d51e9e3e76018e783b39fd1cd28f7",
|
||||
commit = "989c75046c46d2ed96bb65c5badd6b8f785e7f09",
|
||||
run = ":TSUpdate",
|
||||
config = function()
|
||||
require("nvim-treesitter.configs").setup({
|
||||
|
||||
@ -16,29 +16,7 @@ M.packer = function(use)
|
||||
vim.keymap.set("v", "<Leader>gd", gitsigns.diffthis)
|
||||
vim.keymap.set("n", "<Leader>rgf", gitsigns.reset_buffer)
|
||||
vim.keymap.set("v", "<Leader>hs", gitsigns.stage_hunk)
|
||||
vim.keymap.set("v", "<Leader>hr", gitsigns.reset_hunk)
|
||||
vim.keymap.set("v", "<Leader>hr", gitsigns.reset_hunk)
|
||||
|
||||
-- Navigation
|
||||
vim.keymap.set("n", "]g", function()
|
||||
if vim.wo.diff then
|
||||
return "]g"
|
||||
end
|
||||
vim.schedule(function()
|
||||
gitsigns.next_hunk()
|
||||
end)
|
||||
return "<Ignore>"
|
||||
end, { expr = true })
|
||||
|
||||
vim.keymap.set("n", "[g", function()
|
||||
if vim.wo.diff then
|
||||
return "[g"
|
||||
end
|
||||
vim.schedule(function()
|
||||
gitsigns.prev_hunk()
|
||||
end)
|
||||
return "<Ignore>"
|
||||
end, { expr = true })
|
||||
vim.keymap.set("v", "<Leader>hs", gitsigns.reset_hunk)
|
||||
end,
|
||||
})
|
||||
|
||||
@ -124,6 +102,7 @@ M.packer = function(use)
|
||||
},
|
||||
view = {
|
||||
width = 30,
|
||||
height = 30,
|
||||
hide_root_folder = false,
|
||||
side = "left",
|
||||
mappings = {
|
||||
|
||||
@ -32,6 +32,8 @@ vim.opt.completeopt = {
|
||||
"menuone",
|
||||
"noselect",
|
||||
}
|
||||
-- Required until 0.6.0: do not source the default filetype.vim
|
||||
vim.g.did_load_filetypes = 1
|
||||
|
||||
-- Remember last position when reopening file
|
||||
vim.api.nvim_exec(
|
||||
@ -75,16 +77,40 @@ vim.api.nvim_exec(
|
||||
false
|
||||
)
|
||||
|
||||
vim.api.nvim_create_autocmd("FileType", {
|
||||
pattern = "*.eml",
|
||||
callback = function()
|
||||
vim.o.wrapmargin = 79 -- Wrap text automatically
|
||||
end,
|
||||
})
|
||||
|
||||
-- Netrw
|
||||
vim.g.netrw_liststyle = 3 -- Change style to 'tree' view
|
||||
vim.g.netrw_banner = 0 -- Remove useless banner
|
||||
vim.g.netrw_winsize = 15 -- Explore window takes % of page
|
||||
vim.g.netrw_browse_split = 4 -- Open in previous window
|
||||
vim.g.netrw_altv = 1 -- Always split left
|
||||
|
||||
-- VimWiki
|
||||
vim.g.vimwiki_list = {
|
||||
{
|
||||
["path"] = "$NOTES_PATH",
|
||||
["syntax"] = "markdown",
|
||||
["index"] = "home",
|
||||
["ext"] = ".md",
|
||||
},
|
||||
}
|
||||
vim.g.vimwiki_key_mappings = {
|
||||
["all_maps"] = 1,
|
||||
["mouse"] = 1,
|
||||
}
|
||||
vim.g.vimwiki_auto_chdir = 1 -- Set local dir to Wiki when open
|
||||
vim.g.vimwiki_create_link = 0 -- Don't automatically create new links
|
||||
vim.g.vimwiki_listsyms = " x" -- Set checkbox symbol progression
|
||||
vim.g.vimwiki_table_mappings = 0 -- VimWiki table keybinds interfere with tab completion
|
||||
vim.api.nvim_exec(
|
||||
[[
|
||||
au FileType markdown inoremap ;tt <Esc>:AddTag<CR>
|
||||
|
||||
function! PInsert(item)
|
||||
let @z=a:item
|
||||
norm "zpx
|
||||
endfunction
|
||||
|
||||
command! AddTag call fzf#run({'source': 'rg "#[A-Za-z/]+[ |\$]" -o --no-filename --no-line-number | sort | uniq', 'sink': function('PInsert')})
|
||||
]],
|
||||
false
|
||||
)
|
||||
|
||||
@ -3,9 +3,8 @@
|
||||
options = {
|
||||
|
||||
passwordHash = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
type = lib.types.str;
|
||||
description = "Password created with mkpasswd -m sha-512";
|
||||
# Test it by running: mkpasswd -m sha-512 --salt "PZYiMGmJIIHAepTM"
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
@ -2,13 +2,7 @@
|
||||
|
||||
home-manager.users.${config.user} = {
|
||||
|
||||
home.packages = with pkgs; [
|
||||
kubectl # Basic Kubernetes queries
|
||||
k9s # Terminal Kubernetes UI
|
||||
kubernetes-helm # Helm CLI
|
||||
fluxcd # Bootstrap clusters with Flux
|
||||
kustomize # Kustomize CLI (for Flux)
|
||||
];
|
||||
home.packages = with pkgs; [ kubectl k9s ];
|
||||
|
||||
programs.fish.shellAbbrs = {
|
||||
k = "kubectl";
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
home-manager.users.${config.user} = {
|
||||
|
||||
home.sessionVariables = {
|
||||
NOTES_PATH = "${config.homePath}/dev/personal/notes/content";
|
||||
NOTES_PATH = "${config.homePath}/dev/personal/notes";
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
@ -1,66 +0,0 @@
|
||||
{ config, pkgs, lib, ... }: {
|
||||
|
||||
imports = [ ./secrets.nix ];
|
||||
|
||||
options = {
|
||||
|
||||
backupS3 = {
|
||||
endpoint = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "S3 endpoint for backups";
|
||||
};
|
||||
bucket = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "S3 bucket for backups";
|
||||
};
|
||||
accessKeyId = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "S3 access key ID for backups";
|
||||
};
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
config = {
|
||||
|
||||
users.groups.backup = { };
|
||||
|
||||
secrets.backup = {
|
||||
source = ../../private/backup.age;
|
||||
dest = "${config.secretsDirectory}/backup";
|
||||
group = "backup";
|
||||
permissions = "0440";
|
||||
};
|
||||
|
||||
users.users.litestream.extraGroups = [ "backup" ];
|
||||
|
||||
services.litestream = {
|
||||
enable = true;
|
||||
environmentFile = config.secrets.backup.dest;
|
||||
};
|
||||
|
||||
# Wait for secret to exist
|
||||
systemd.services.litestream = {
|
||||
after = [ "backup-secret.service" ];
|
||||
requires = [ "backup-secret.service" ];
|
||||
environment.AWS_ACCESS_KEY_ID = config.backupS3.accessKeyId;
|
||||
};
|
||||
|
||||
# # Backup library to object storage
|
||||
# services.restic.backups.calibre = {
|
||||
# user = "calibre-web";
|
||||
# repository =
|
||||
# "s3://${config.backupS3.endpoint}/${config.backupS3.bucket}/calibre";
|
||||
# paths = [
|
||||
# "/var/books"
|
||||
# "/var/lib/calibre-web/app.db"
|
||||
# "/var/lib/calibre-web/gdrive.db"
|
||||
# ];
|
||||
# initialize = true;
|
||||
# timerConfig = { OnCalendar = "00:05:00"; };
|
||||
# environmentFile = backupS3File;
|
||||
# };
|
||||
|
||||
};
|
||||
|
||||
}
|
||||
@ -1,35 +0,0 @@
|
||||
{ config, pkgs, lib, ... }: {
|
||||
|
||||
options = {
|
||||
caddyRoutes = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.attrs;
|
||||
description = "Caddy JSON routes for http servers";
|
||||
};
|
||||
caddyBlocks = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.attrs;
|
||||
description = "Caddy JSON error blocks for http servers";
|
||||
default = [ ];
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
|
||||
services.caddy = {
|
||||
enable = true;
|
||||
adapter = "''"; # Required to enable JSON
|
||||
configFile = pkgs.writeText "Caddyfile" (builtins.toJSON {
|
||||
apps.http.servers.main = {
|
||||
listen = [ ":443" ];
|
||||
routes = config.caddyRoutes;
|
||||
errors.routes = config.caddyBlocks;
|
||||
};
|
||||
});
|
||||
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||
networking.firewall.allowedUDPPorts = [ 443 ];
|
||||
|
||||
};
|
||||
|
||||
}
|
||||
@ -1,74 +0,0 @@
|
||||
{ config, pkgs, lib, ... }: {
|
||||
|
||||
imports = [ ./caddy.nix ./backups.nix ];
|
||||
|
||||
options = {
|
||||
bookServer = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Hostname for Calibre library";
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
|
||||
services.calibre-web = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
options = {
|
||||
reverseProxyAuth.enable = false;
|
||||
enableBookConversion = true;
|
||||
enableBookUploading = true;
|
||||
};
|
||||
};
|
||||
|
||||
# Fix: https://github.com/janeczku/calibre-web/issues/2422
|
||||
nixpkgs.overlays = [
|
||||
(final: prev: {
|
||||
calibre-web = prev.calibre-web.overrideAttrs (old: {
|
||||
patches = (old.patches or [ ])
|
||||
++ [ ../../patches/calibre-web-cloudflare.patch ];
|
||||
});
|
||||
})
|
||||
];
|
||||
|
||||
caddyRoutes = [{
|
||||
match = [{ host = [ config.bookServer ]; }];
|
||||
handle = [{
|
||||
handler = "reverse_proxy";
|
||||
upstreams = [{ dial = "localhost:8083"; }];
|
||||
headers.request.add."X-Script-Name" = [ "/calibre-web" ];
|
||||
}];
|
||||
}];
|
||||
|
||||
# Run a backup on a schedule
|
||||
systemd.timers.calibre-backup = {
|
||||
timerConfig = {
|
||||
OnCalendar = "*-*-* 00:00:00"; # Once per day
|
||||
Unit = "calibre-backup.service";
|
||||
};
|
||||
wantedBy = [ "timers.target" ];
|
||||
};
|
||||
|
||||
# Backup Calibre data to object storage
|
||||
systemd.services.calibre-backup =
|
||||
let libraryPath = "/var/lib/calibre-web"; # Default location
|
||||
in {
|
||||
description = "Backup Calibre data";
|
||||
environment.AWS_ACCESS_KEY_ID = config.backupS3.accessKeyId;
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
User = "calibre-web";
|
||||
Group = "backup";
|
||||
EnvironmentFile = config.secrets.backup.dest;
|
||||
};
|
||||
script = ''
|
||||
${pkgs.awscli2}/bin/aws s3 sync \
|
||||
${libraryPath}/ \
|
||||
s3://${config.backupS3.bucket}/calibre/ \
|
||||
--endpoint-url=https://${config.backupS3.endpoint}
|
||||
'';
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
}
|
||||
@ -1,56 +0,0 @@
|
||||
# This module is necessary for hosts that are serving through Cloudflare.
|
||||
|
||||
{ ... }:
|
||||
|
||||
let
|
||||
|
||||
cloudflareIpRanges = [
|
||||
|
||||
# Cloudflare IPv4: https://www.cloudflare.com/ips-v4
|
||||
"173.245.48.0/20"
|
||||
"103.21.244.0/22"
|
||||
"103.22.200.0/22"
|
||||
"103.31.4.0/22"
|
||||
"141.101.64.0/18"
|
||||
"108.162.192.0/18"
|
||||
"190.93.240.0/20"
|
||||
"188.114.96.0/20"
|
||||
"197.234.240.0/22"
|
||||
"198.41.128.0/17"
|
||||
"162.158.0.0/15"
|
||||
"104.16.0.0/13"
|
||||
"104.24.0.0/14"
|
||||
"172.64.0.0/13"
|
||||
"131.0.72.0/22"
|
||||
|
||||
# Cloudflare IPv6: https://www.cloudflare.com/ips-v6
|
||||
"2400:cb00::/32"
|
||||
"2606:4700::/32"
|
||||
"2803:f800::/32"
|
||||
"2405:b500::/32"
|
||||
"2405:8100::/32"
|
||||
"2a06:98c0::/29"
|
||||
"2c0f:f248::/32"
|
||||
|
||||
];
|
||||
|
||||
in {
|
||||
|
||||
imports = [ ./caddy.nix ];
|
||||
|
||||
config = {
|
||||
|
||||
# Forces Caddy to error if coming from a non-Cloudflare IP
|
||||
caddyBlocks = [{
|
||||
match = [{ not = [{ remote_ip.ranges = cloudflareIpRanges; }]; }];
|
||||
handle = [{
|
||||
handler = "static_response";
|
||||
abort = true;
|
||||
}];
|
||||
}];
|
||||
|
||||
# Allows Nextcloud to trust Cloudflare IPs
|
||||
services.nextcloud.config.trustedProxies = cloudflareIpRanges;
|
||||
|
||||
};
|
||||
}
|
||||
@ -1,93 +0,0 @@
|
||||
{ config, lib, ... }:
|
||||
|
||||
let giteaPath = "/var/lib/gitea"; # Default service directory
|
||||
|
||||
in {
|
||||
|
||||
imports = [ ./caddy.nix ./backups.nix ];
|
||||
|
||||
options = {
|
||||
|
||||
giteaServer = lib.mkOption {
|
||||
description = "Hostname for Gitea.";
|
||||
type = lib.types.str;
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
config = {
|
||||
services.gitea = {
|
||||
enable = true;
|
||||
httpPort = 3001;
|
||||
httpAddress = "127.0.0.1";
|
||||
rootUrl = "https://${config.giteaServer}/";
|
||||
database.type = "sqlite3";
|
||||
settings = {
|
||||
repository = {
|
||||
DEFAULT_PUSH_CREATE_PRIVATE = true;
|
||||
DISABLE_HTTP_GIT = false;
|
||||
ACCESS_CONTROL_ALLOW_ORIGIN = config.giteaServer;
|
||||
ENABLE_PUSH_CREATE_USER = true;
|
||||
ENABLE_PUSH_CREATE_ORG = true;
|
||||
DEFAULT_BRANCH = "main";
|
||||
};
|
||||
server = {
|
||||
SSH_PORT = 22;
|
||||
START_SSH_SERVER = false; # Use sshd instead
|
||||
DISABLE_SSH = false;
|
||||
# SSH_LISTEN_HOST = "0.0.0.0";
|
||||
# SSH_LISTEN_PORT = 122;
|
||||
};
|
||||
service.DISABLE_REGISTRATION = true;
|
||||
session.COOKIE_SECURE = true;
|
||||
ui.SHOW_USER_EMAIL = false;
|
||||
};
|
||||
extraConfig = null;
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 122 ];
|
||||
|
||||
caddyRoutes = [{
|
||||
match = [{ host = [ config.giteaServer ]; }];
|
||||
handle = [{
|
||||
handler = "reverse_proxy";
|
||||
upstreams = [{ dial = "localhost:3001"; }];
|
||||
}];
|
||||
}];
|
||||
|
||||
## Backup config
|
||||
|
||||
# Open to groups, allowing for backups
|
||||
systemd.services.gitea.serviceConfig.StateDirectoryMode =
|
||||
lib.mkForce "0770";
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${giteaPath}/data 0775 gitea gitea"
|
||||
"f ${giteaPath}/data/gitea.db 0660 gitea gitea"
|
||||
];
|
||||
|
||||
# Allow litestream and gitea to share a sqlite database
|
||||
users.users.litestream.extraGroups = [ "gitea" ];
|
||||
users.users.gitea.extraGroups = [ "litestream" ];
|
||||
|
||||
# Backup sqlite database with litestream
|
||||
services.litestream = {
|
||||
settings = {
|
||||
dbs = [{
|
||||
path = "${giteaPath}/data/gitea.db";
|
||||
replicas = [{
|
||||
url =
|
||||
"s3://${config.backupS3.bucket}.${config.backupS3.endpoint}/gitea";
|
||||
}];
|
||||
}];
|
||||
};
|
||||
};
|
||||
|
||||
# Don't start litestream unless gitea is up
|
||||
systemd.services.litestream = {
|
||||
after = [ "gitea.service" ];
|
||||
requires = [ "gitea.service" ];
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
}
|
||||
@ -1,75 +0,0 @@
|
||||
{ lib, pkgs, ... }:
|
||||
|
||||
# Currently has some issues that don't make this viable.
|
||||
|
||||
# Taken from:
|
||||
# https://dataswamp.org/~solene/2022-09-29-iblock-implemented-in-nixos.html
|
||||
|
||||
# You will need to flush all rules when removing:
|
||||
# https://serverfault.com/questions/200635/best-way-to-clear-all-iptables-rules
|
||||
|
||||
let
|
||||
|
||||
portsToBlock = [ 25545 25565 25570 ];
|
||||
portsString =
|
||||
builtins.concatStringsSep "," (builtins.map builtins.toString portsToBlock);
|
||||
|
||||
# Block IPs for 20 days
|
||||
expire = 60 * 60 * 24 * 20;
|
||||
|
||||
rules = table: [
|
||||
"INPUT -i eth0 -p tcp -m multiport --dports ${portsString} -m state --state NEW -m recent --set"
|
||||
"INPUT -i eth0 -p tcp -m multiport --dports ${portsString} -m state --state NEW -m recent --update --seconds 10 --hitcount 1 -j SET --add-set ${table} src"
|
||||
"INPUT -i eth0 -p tcp -m set --match-set ${table} src -j nixos-fw-refuse"
|
||||
"INPUT -i eth0 -p udp -m set --match-set ${table} src -j nixos-fw-refuse"
|
||||
];
|
||||
|
||||
create-rules = lib.concatStringsSep "\n"
|
||||
(builtins.map (rule: "iptables -C " + rule + " || iptables -A " + rule)
|
||||
(rules "blocked") ++ builtins.map
|
||||
(rule: "ip6tables -C " + rule + " || ip6tables -A " + rule)
|
||||
(rules "blocked6"));
|
||||
|
||||
delete-rules = lib.concatStringsSep "\n"
|
||||
(builtins.map (rule: "iptables -C " + rule + " && iptables -D " + rule)
|
||||
(rules "blocked") ++ builtins.map
|
||||
(rule: "ip6tables -C " + rule + " && ip6tables -D " + rule)
|
||||
(rules "blocked6"));
|
||||
|
||||
in {
|
||||
|
||||
networking.firewall = {
|
||||
|
||||
extraPackages = [ pkgs.ipset ];
|
||||
# allowedTCPPorts = portsToBlock;
|
||||
|
||||
# Restore ban list when starting up
|
||||
extraCommands = ''
|
||||
if test -f /var/lib/ipset.conf
|
||||
then
|
||||
ipset restore -! < /var/lib/ipset.conf
|
||||
else
|
||||
ipset -exist create blocked hash:ip ${
|
||||
if expire > 0 then "timeout ${toString expire}" else ""
|
||||
}
|
||||
ipset -exist create blocked6 hash:ip family inet6 ${
|
||||
if expire > 0 then "timeout ${toString expire}" else ""
|
||||
}
|
||||
fi
|
||||
${create-rules}
|
||||
'';
|
||||
|
||||
# Save list when shutting down
|
||||
extraStopCommands = ''
|
||||
ipset -exist create blocked hash:ip ${
|
||||
if expire > 0 then "timeout ${toString expire}" else ""
|
||||
}
|
||||
ipset -exist create blocked6 hash:ip family inet6 ${
|
||||
if expire > 0 then "timeout ${toString expire}" else ""
|
||||
}
|
||||
ipset save > /var/lib/ipset.conf
|
||||
${delete-rules}
|
||||
'';
|
||||
};
|
||||
|
||||
}
|
||||
@ -1,30 +0,0 @@
|
||||
{ config, lib, ... }: {
|
||||
|
||||
options = {
|
||||
streamServer = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Hostname for Jellyfin library";
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
|
||||
services.jellyfin.enable = true;
|
||||
|
||||
caddyRoutes = [{
|
||||
match = [{ host = [ config.streamServer ]; }];
|
||||
handle = [{
|
||||
handler = "reverse_proxy";
|
||||
upstreams = [{ dial = "localhost:8096"; }];
|
||||
}];
|
||||
}];
|
||||
|
||||
# Create videos directory, allow anyone in Jellyfin group to manage it
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /var/lib/jellyfin 0775 jellyfin jellyfin"
|
||||
"d /var/lib/jellyfin/library 0775 jellyfin jellyfin"
|
||||
];
|
||||
|
||||
};
|
||||
|
||||
}
|
||||
@ -1,14 +0,0 @@
|
||||
{ config, pkgs, lib, ... }: {
|
||||
|
||||
config = {
|
||||
|
||||
services.netdata = {
|
||||
enable = true;
|
||||
|
||||
# Disable local dashboard (unsecured)
|
||||
config = { web.mode = "none"; };
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
}
|
||||
@ -1,87 +0,0 @@
|
||||
{ config, pkgs, lib, ... }: {
|
||||
|
||||
imports = [ ./caddy.nix ./secrets.nix ./backups.nix ];
|
||||
|
||||
options = {
|
||||
|
||||
nextcloudServer = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Hostname for Nextcloud";
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
config = {
|
||||
|
||||
services.nextcloud = {
|
||||
enable = true;
|
||||
package = pkgs.nextcloud24; # Required to specify
|
||||
https = true;
|
||||
hostName = "localhost";
|
||||
maxUploadSize = "50G";
|
||||
config = {
|
||||
adminpassFile = config.secrets.nextcloud.dest;
|
||||
extraTrustedDomains = [ config.nextcloudServer ];
|
||||
};
|
||||
};
|
||||
|
||||
# Don't let Nginx use main ports (using Caddy instead)
|
||||
services.nginx.virtualHosts."localhost".listen = [{
|
||||
addr = "127.0.0.1";
|
||||
port = 8080;
|
||||
}];
|
||||
|
||||
# Point Caddy to Nginx
|
||||
caddyRoutes = [{
|
||||
match = [{ host = [ config.nextcloudServer ]; }];
|
||||
handle = [{
|
||||
handler = "reverse_proxy";
|
||||
upstreams = [{ dial = "localhost:8080"; }];
|
||||
}];
|
||||
}];
|
||||
|
||||
# Create credentials file for nextcloud
|
||||
secrets.nextcloud = {
|
||||
source = ../../private/nextcloud.age;
|
||||
dest = "${config.secretsDirectory}/nextcloud";
|
||||
owner = "nextcloud";
|
||||
group = "nextcloud";
|
||||
permissions = "0440";
|
||||
};
|
||||
systemd.services.nextcloud-secret = {
|
||||
requiredBy = [ "nextcloud-setup.service" ];
|
||||
before = [ "nextcloud-setup.service" ];
|
||||
};
|
||||
|
||||
## Backup config
|
||||
|
||||
# Open to groups, allowing for backups
|
||||
systemd.services.phpfpm-nextcloud.serviceConfig.StateDirectoryMode =
|
||||
lib.mkForce "0770";
|
||||
|
||||
# Allow litestream and nextcloud to share a sqlite database
|
||||
users.users.litestream.extraGroups = [ "nextcloud" ];
|
||||
users.users.nextcloud.extraGroups = [ "litestream" ];
|
||||
|
||||
# Backup sqlite database with litestream
|
||||
services.litestream = {
|
||||
settings = {
|
||||
dbs = [{
|
||||
path = "${config.services.nextcloud.datadir}/data/nextcloud.db";
|
||||
replicas = [{
|
||||
url =
|
||||
"s3://${config.backupS3.bucket}.${config.backupS3.endpoint}/nextcloud";
|
||||
}];
|
||||
}];
|
||||
};
|
||||
};
|
||||
|
||||
# Don't start litestream unless nextcloud is up
|
||||
systemd.services.litestream = {
|
||||
after = [ "phpfpm-nextcloud.service" ];
|
||||
requires = [ "phpfpm-nextcloud.service" ];
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
}
|
||||
@ -1,30 +0,0 @@
|
||||
{ config, pkgs, lib, ... }: {
|
||||
|
||||
options.metricsServer = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Hostname of the Grafana server.";
|
||||
};
|
||||
|
||||
config = {
|
||||
|
||||
services.grafana.enable = true;
|
||||
services.prometheus = {
|
||||
enable = true;
|
||||
exporters.node.enable = true;
|
||||
scrapeConfigs = [{
|
||||
job_name = "local";
|
||||
static_configs = [{ targets = [ "127.0.0.1:9100" ]; }];
|
||||
}];
|
||||
};
|
||||
|
||||
caddyRoutes = [{
|
||||
match = [{ host = [ config.metricsServer ]; }];
|
||||
handle = [{
|
||||
handler = "reverse_proxy";
|
||||
upstreams = [{ dial = "localhost:3000"; }];
|
||||
}];
|
||||
}];
|
||||
|
||||
};
|
||||
|
||||
}
|
||||
@ -1,91 +0,0 @@
|
||||
# Secrets management method taken from here:
|
||||
# https://xeiaso.net/blog/nixos-encrypted-secrets-2021-01-20
|
||||
|
||||
# In my case, I pre-encrypt my secrets and commit them to git.
|
||||
|
||||
{ config, pkgs, lib, ... }: {
|
||||
|
||||
options = {
|
||||
|
||||
secretsDirectory = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Default path to place secrets.";
|
||||
default = "/var/private";
|
||||
};
|
||||
|
||||
secrets = lib.mkOption {
|
||||
type = lib.types.attrsOf (lib.types.submodule {
|
||||
options = {
|
||||
source = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
description = "Path to encrypted secret.";
|
||||
};
|
||||
dest = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Resulting path for decrypted secret.";
|
||||
};
|
||||
owner = lib.mkOption {
|
||||
default = "root";
|
||||
type = lib.types.str;
|
||||
description = "User to own the secret.";
|
||||
};
|
||||
group = lib.mkOption {
|
||||
default = "root";
|
||||
type = lib.types.str;
|
||||
description = "Group to own the secret.";
|
||||
};
|
||||
permissions = lib.mkOption {
|
||||
default = "0400";
|
||||
type = lib.types.str;
|
||||
description = "Permissions expressed as octal.";
|
||||
};
|
||||
};
|
||||
});
|
||||
description = "Set of secrets to decrypt to disk.";
|
||||
default = { };
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
config = {
|
||||
|
||||
# Create a default directory to place secrets
|
||||
|
||||
systemd.tmpfiles.rules = [ "d ${config.secretsDirectory} 0755 root wheel" ];
|
||||
|
||||
# Declare oneshot service to decrypt secret using SSH host key
|
||||
# - Requires that the secret is already encrypted for the host
|
||||
# - Encrypt secrets: nix run github:nmasur/dotfiles#encrypt-secret
|
||||
|
||||
systemd.services = lib.mapAttrs' (name: attrs: {
|
||||
name = "${name}-secret";
|
||||
value = {
|
||||
|
||||
description = "Decrypt secret for ${name}";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig.Type = "oneshot";
|
||||
script = ''
|
||||
${pkgs.age}/bin/age --decrypt \
|
||||
--identity ${config.identityFile} \
|
||||
--output ${attrs.dest} \
|
||||
${attrs.source}
|
||||
|
||||
chown '${attrs.owner}':'${attrs.group}' '${attrs.dest}'
|
||||
chmod '${attrs.permissions}' '${attrs.dest}'
|
||||
'';
|
||||
|
||||
};
|
||||
}) config.secrets;
|
||||
|
||||
# Example declaration
|
||||
# config.secrets.my-secret = {
|
||||
# source = ../../private/my-secret.age;
|
||||
# dest = "/var/lib/private/my-secret";
|
||||
# owner = "my-app";
|
||||
# group = "my-app";
|
||||
# permissions = "0440";
|
||||
# };
|
||||
|
||||
};
|
||||
|
||||
}
|
||||
@ -1,36 +0,0 @@
|
||||
{ config, pkgs, lib, ... }: {
|
||||
|
||||
options = {
|
||||
publicKey = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Public SSH key authorized for this system.";
|
||||
};
|
||||
permitRootLogin = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Root login settings.";
|
||||
default = "no";
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
ports = [ 22 ];
|
||||
passwordAuthentication = false;
|
||||
gatewayPorts = "no";
|
||||
forwardX11 = false;
|
||||
allowSFTP = true;
|
||||
permitRootLogin = config.permitRootLogin;
|
||||
};
|
||||
|
||||
users.users.${config.user}.openssh.authorizedKeys.keys =
|
||||
[ config.publicKey ];
|
||||
|
||||
# Implement a simple fail2ban service for sshd
|
||||
services.sshguard.enable = true;
|
||||
|
||||
# Add terminfo for SSH from popular terminal emulators
|
||||
environment.enableAllTerminfo = true;
|
||||
};
|
||||
|
||||
}
|
||||
@ -1,79 +0,0 @@
|
||||
{ config, pkgs, lib, ... }: {
|
||||
|
||||
imports = [ ./wireguard.nix ./secrets.nix ];
|
||||
|
||||
options = {
|
||||
transmissionServer = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Hostname for Transmission";
|
||||
};
|
||||
};
|
||||
|
||||
config = let
|
||||
namespace = config.networking.wireguard.interfaces.wg0.interfaceNamespace;
|
||||
vpnIp = lib.strings.removeSuffix "/32"
|
||||
(builtins.head config.networking.wireguard.interfaces.wg0.ips);
|
||||
in {
|
||||
|
||||
# Setup transmission
|
||||
services.transmission = {
|
||||
enable = true;
|
||||
settings = {
|
||||
port-forwarding-enabled = false;
|
||||
rpc-authentication-required = true;
|
||||
rpc-port = 9091;
|
||||
rpc-bind-address = "0.0.0.0";
|
||||
rpc-username = config.user;
|
||||
rpc-host-whitelist = config.transmissionServer;
|
||||
rpc-host-whitelist-enabled = true;
|
||||
rpc-whitelist = "127.0.0.1,${vpnIp}";
|
||||
rpc-whitelist-enabled = true;
|
||||
};
|
||||
credentialsFile = config.secrets.transmission.dest;
|
||||
};
|
||||
|
||||
# Bind transmission to wireguard namespace
|
||||
systemd.services.transmission = {
|
||||
bindsTo = [ "netns@${namespace}.service" ];
|
||||
requires = [ "network-online.target" "transmission-secret.service" ];
|
||||
after = [ "wireguard-wg0.service" "transmission-secret.service" ];
|
||||
unitConfig.JoinsNamespaceOf = "netns@${namespace}.service";
|
||||
serviceConfig.NetworkNamespacePath = "/var/run/netns/${namespace}";
|
||||
};
|
||||
|
||||
# Create reverse proxy for web UI
|
||||
caddyRoutes = [{
|
||||
match = [{ host = [ config.transmissionServer ]; }];
|
||||
handle = [{
|
||||
handler = "reverse_proxy";
|
||||
upstreams = [{ dial = "localhost:9091"; }];
|
||||
}];
|
||||
}];
|
||||
|
||||
# Allow inbound connections to reach namespace
|
||||
systemd.services.transmission-web-netns = {
|
||||
description = "Forward to transmission in wireguard namespace";
|
||||
requires = [ "transmission.service" ];
|
||||
after = [ "transmission.service" ];
|
||||
serviceConfig = {
|
||||
Restart = "on-failure";
|
||||
TimeoutStopSec = 300;
|
||||
};
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
script = ''
|
||||
${pkgs.iproute2}/bin/ip netns exec ${namespace} ${pkgs.iproute2}/bin/ip link set dev lo up
|
||||
${pkgs.socat}/bin/socat tcp-listen:9091,fork,reuseaddr exec:'${pkgs.iproute2}/bin/ip netns exec ${namespace} ${pkgs.socat}/bin/socat STDIO "tcp-connect:${vpnIp}:9091"',nofork
|
||||
'';
|
||||
};
|
||||
|
||||
# Create credentials file for transmission
|
||||
secrets.transmission = {
|
||||
source = ../../private/transmission.json.age;
|
||||
dest = "${config.secretsDirectory}/transmission.json";
|
||||
owner = "transmission";
|
||||
group = "transmission";
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
}
|
||||
@ -1,123 +0,0 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
let vaultwardenPath = "/var/lib/bitwarden_rs"; # Default service directory
|
||||
|
||||
in {
|
||||
|
||||
imports = [ ./caddy.nix ./secrets.nix ./backups.nix ];
|
||||
|
||||
options = {
|
||||
|
||||
vaultwardenServer = lib.mkOption {
|
||||
description = "Hostname for Vaultwarden.";
|
||||
type = lib.types.str;
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
config = {
|
||||
services.vaultwarden = {
|
||||
enable = true;
|
||||
config = {
|
||||
DOMAIN = "https://${config.vaultwardenServer}";
|
||||
SIGNUPS_ALLOWED = false;
|
||||
SIGNUPS_VERIFY = true;
|
||||
INVITATIONS_ALLOWED = true;
|
||||
WEB_VAULT_ENABLED = true;
|
||||
ROCKET_ADDRESS = "127.0.0.1";
|
||||
ROCKET_PORT = 8222;
|
||||
WEBSOCKET_ENABLED = true;
|
||||
WEBSOCKET_ADDRESS = "0.0.0.0";
|
||||
WEBSOCKET_PORT = 3012;
|
||||
LOGIN_RATELIMIT_SECONDS = 60;
|
||||
LOGIN_RATELIMIT_MAX_BURST = 10;
|
||||
ADMIN_RATELIMIT_SECONDS = 300;
|
||||
ADMIN_RATELIMIT_MAX_BURST = 3;
|
||||
};
|
||||
environmentFile = config.secrets.vaultwarden.dest;
|
||||
dbBackend = "sqlite";
|
||||
};
|
||||
|
||||
secrets.vaultwarden = {
|
||||
source = ../../private/vaultwarden.age;
|
||||
dest = "${config.secretsDirectory}/vaultwarden";
|
||||
owner = "vaultwarden";
|
||||
group = "vaultwarden";
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 3012 ];
|
||||
|
||||
caddyRoutes = [{
|
||||
match = [{ host = [ config.vaultwardenServer ]; }];
|
||||
handle = [{
|
||||
handler = "reverse_proxy";
|
||||
upstreams = [{ dial = "localhost:8222"; }];
|
||||
}];
|
||||
}];
|
||||
|
||||
## Backup config
|
||||
|
||||
# Open to groups, allowing for backups
|
||||
systemd.services.vaultwarden.serviceConfig.StateDirectoryMode =
|
||||
lib.mkForce "0770";
|
||||
systemd.tmpfiles.rules = [
|
||||
"f ${vaultwardenPath}/db.sqlite3 0660 vaultwarden vaultwarden"
|
||||
"f ${vaultwardenPath}/db.sqlite3-shm 0660 vaultwarden vaultwarden"
|
||||
"f ${vaultwardenPath}/db.sqlite3-wal 0660 vaultwarden vaultwarden"
|
||||
];
|
||||
|
||||
# Allow litestream and vaultwarden to share a sqlite database
|
||||
users.users.litestream.extraGroups = [ "vaultwarden" ];
|
||||
users.users.vaultwarden.extraGroups = [ "litestream" ];
|
||||
|
||||
# Backup sqlite database with litestream
|
||||
services.litestream = {
|
||||
settings = {
|
||||
dbs = [{
|
||||
path = "${vaultwardenPath}/db.sqlite3";
|
||||
replicas = [{
|
||||
url =
|
||||
"s3://${config.backupS3.bucket}.${config.backupS3.endpoint}/vaultwarden";
|
||||
}];
|
||||
}];
|
||||
};
|
||||
};
|
||||
|
||||
# Don't start litestream unless vaultwarden is up
|
||||
systemd.services.litestream = {
|
||||
after = [ "vaultwarden.service" ];
|
||||
requires = [ "vaultwarden.service" ];
|
||||
};
|
||||
|
||||
# Run a separate file backup on a schedule
|
||||
systemd.timers.vaultwarden-backup = {
|
||||
timerConfig = {
|
||||
OnCalendar = "*-*-* 06:00:00"; # Once per day
|
||||
Unit = "vaultwarden-backup.service";
|
||||
};
|
||||
wantedBy = [ "timers.target" ];
|
||||
};
|
||||
|
||||
# Backup other Vaultwarden data to object storage
|
||||
systemd.services.vaultwarden-backup = {
|
||||
description = "Backup Vaultwarden files";
|
||||
environment.AWS_ACCESS_KEY_ID = config.backupS3.accessKeyId;
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
User = "vaultwarden";
|
||||
Group = "backup";
|
||||
EnvironmentFile = config.secrets.backup.dest;
|
||||
};
|
||||
script = ''
|
||||
${pkgs.awscli2}/bin/aws s3 sync \
|
||||
${vaultwardenPath}/ \
|
||||
s3://${config.backupS3.bucket}/vaultwarden/ \
|
||||
--endpoint-url=https://${config.backupS3.endpoint} \
|
||||
--exclude "*db.sqlite3*" \
|
||||
--exclude ".db.sqlite3*"
|
||||
'';
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
}
|
||||
@ -1,44 +1,18 @@
|
||||
{ config, pkgs, lib, ... }: {
|
||||
|
||||
imports = [ ./secrets.nix ];
|
||||
|
||||
config = {
|
||||
|
||||
{ ... }: {
|
||||
networking.wireguard = {
|
||||
enable = true;
|
||||
interfaces = {
|
||||
wg0 = {
|
||||
|
||||
# Establishes identity of this machine
|
||||
generatePrivateKeyFile = false;
|
||||
privateKeyFile = config.secrets.wireguard.dest;
|
||||
|
||||
# Move to network namespace for isolating programs
|
||||
interfaceNamespace = "wg";
|
||||
|
||||
ips = [ "10.66.127.235/32" "fc00:bbbb:bbbb:bb01::3:7fea/128" ];
|
||||
generatePrivateKeyFile = true;
|
||||
privateKeyFile = "/private/wireguard/wg0";
|
||||
peers = [{
|
||||
publicKey = "cVDIYPzNChIeANp+0jE12kWM5Ga1MbmNErT1Pmaf12A=";
|
||||
allowedIPs = [ "0.0.0.0/0" "::0/0" ];
|
||||
endpoint = "89.46.62.197:51820";
|
||||
persistentKeepalive = 25;
|
||||
}];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Create namespace for Wireguard
|
||||
# This allows us to isolate specific programs to Wireguard
|
||||
systemd.services."netns@" = {
|
||||
description = "%I network namespace";
|
||||
before = [ "network.target" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
ExecStart = "${pkgs.iproute2}/bin/ip netns add %I";
|
||||
ExecStop = "${pkgs.iproute2}/bin/ip netns del %I";
|
||||
};
|
||||
};
|
||||
|
||||
# Create private key file for wireguard
|
||||
secrets.wireguard = {
|
||||
source = ../../private/wireguard.age;
|
||||
dest = "${config.secretsDirectory}/wireguard";
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
}
|
||||
|
||||
5
modules/shell/age.nix
Normal file
5
modules/shell/age.nix
Normal file
@ -0,0 +1,5 @@
|
||||
{ config, pkgs, ... }: {
|
||||
|
||||
home-manager.users.${config.user}.home.packages = with pkgs; [ age ];
|
||||
|
||||
}
|
||||
@ -1,4 +1,5 @@
|
||||
#!/usr/bin/env bash
|
||||
#!/usr/bin/env nix-shell
|
||||
#!nix-shell -i bash -p tesseract
|
||||
|
||||
# Yoinked from https://github.com/JJGO/dotfiles
|
||||
# Adapted from https://github.com/sdushantha/bin
|
||||
@ -8,13 +9,13 @@ TEXT_FILE="/tmp/ocr.txt"
|
||||
IMAGE_FILE="/tmp/ocr.png"
|
||||
|
||||
function notify-send() {
|
||||
/usr/bin/osascript -e "display notification \"$2\" with title \"OCR\""
|
||||
osascript -e "display notification \"$2\" with title \"OCR\""
|
||||
}
|
||||
|
||||
PATH="/usr/local/bin/:$PATH"
|
||||
|
||||
# Take screenshot by selecting the area
|
||||
/usr/sbin/screencapture -i "$IMAGE_FILE"
|
||||
screencapture -i "$IMAGE_FILE"
|
||||
|
||||
# Get the exit code of the previous command.
|
||||
# So in this case, it is the screenshot command. If it did not exit with an
|
||||
@ -43,7 +44,7 @@ fi
|
||||
|
||||
# Copy text to clipboard
|
||||
# xclip -selection clip < "$TEXT_FILE"
|
||||
/usr/bin/pbcopy <"$TEXT_FILE"
|
||||
pbcopy <"$TEXT_FILE"
|
||||
|
||||
# Send a notification with the text that was grabbed using OCR
|
||||
notify-send "ocr" "$(cat $TEXT_FILE)"
|
||||
|
||||
@ -1,13 +0,0 @@
|
||||
{ config, pkgs, ... }: {
|
||||
|
||||
home-manager.users.${config.user} = {
|
||||
|
||||
home.packages = with pkgs; [
|
||||
glow # Markdown previews
|
||||
skate # Key-value store
|
||||
charm # Manage account and filesystem
|
||||
];
|
||||
|
||||
};
|
||||
|
||||
}
|
||||
@ -1,6 +1,6 @@
|
||||
{ ... }: {
|
||||
imports = [
|
||||
./charm.nix
|
||||
./age.nix
|
||||
./direnv.nix
|
||||
./fish
|
||||
./fzf.nix
|
||||
|
||||
@ -7,11 +7,10 @@
|
||||
home-manager.users.${config.user} = {
|
||||
|
||||
# Packages used in abbreviations and aliases
|
||||
home.packages = with pkgs; [ curl exa ];
|
||||
home.packages = with pkgs; [ curl ];
|
||||
|
||||
programs.fish = {
|
||||
enable = true;
|
||||
shellAliases = { ls = "exa"; };
|
||||
functions = {
|
||||
commandline-git-commits = {
|
||||
description = "Insert commit into commandline";
|
||||
@ -42,6 +41,7 @@
|
||||
description = "Tidy up JSON using jq";
|
||||
body = "pbpaste | jq '.' | pbcopy"; # Need to fix for non-macOS
|
||||
};
|
||||
ls = { body = "${pkgs.exa}/bin/exa $argv"; };
|
||||
note = {
|
||||
description = "Edit or create a note";
|
||||
argumentNames = "filename";
|
||||
|
||||
@ -1,18 +1,16 @@
|
||||
{ config, pkgs, lib, ... }: {
|
||||
{ config, pkgs, ... }: {
|
||||
home-manager.users.${config.user} = {
|
||||
|
||||
programs.fish = {
|
||||
shellAbbrs = {
|
||||
n = "nix";
|
||||
ns = "nix-shell -p";
|
||||
nsf = "nix-shell --run fish -p";
|
||||
ns = "nix-shell --run fish -p";
|
||||
nsr = "nix-shell-run";
|
||||
nps = "nix repl '<nixpkgs>'";
|
||||
nixo = "man configuration.nix";
|
||||
nixh = "man home-configuration.nix";
|
||||
nr = "rebuild-nixos";
|
||||
nro = "rebuild-nixos offline";
|
||||
hm = "rebuild-home";
|
||||
};
|
||||
functions = {
|
||||
nix-shell-run = {
|
||||
@ -40,14 +38,7 @@
|
||||
set option "--option substitute false"
|
||||
end
|
||||
git -C ${config.dotfilesPath} add --intent-to-add --all
|
||||
commandline -r "doas nixos-rebuild switch $option --flake ${config.dotfilesPath}#${config.networking.hostName}"
|
||||
commandline --function execute
|
||||
'';
|
||||
};
|
||||
rebuild-home = {
|
||||
body = ''
|
||||
git -C ${config.dotfilesPath} add --intent-to-add --all
|
||||
commandline -r "${pkgs.home-manager}/bin/home-manager switch --flake ${config.dotfilesPath}#${config.networking.hostName}";
|
||||
commandline -r "doas nixos-rebuild switch $option --flake ${config.dotfilesPath}"
|
||||
commandline --function execute
|
||||
'';
|
||||
};
|
||||
|
||||
@ -9,7 +9,6 @@
|
||||
"$git_branch"
|
||||
"$git_commit"
|
||||
"$git_status"
|
||||
"$hostname"
|
||||
"$cmd_duration"
|
||||
"$character"
|
||||
];
|
||||
@ -48,10 +47,6 @@
|
||||
deleted = "✘";
|
||||
style = "red";
|
||||
};
|
||||
hostname = {
|
||||
ssh_only = true;
|
||||
format = "on [$hostname](bold red) ";
|
||||
};
|
||||
nix_shell = {
|
||||
format = "[$symbol $name]($style)";
|
||||
symbol = "❄️";
|
||||
|
||||
@ -31,8 +31,6 @@ in {
|
||||
vimv-rs # Batch rename files
|
||||
dig # DNS lookup
|
||||
lf # File viewer
|
||||
# whois # Lookup IPs
|
||||
age # Encryption
|
||||
];
|
||||
|
||||
programs.zoxide.enable = true; # Shortcut jump command
|
||||
|
||||
20
modules/work/nixos-org-certs.crt
Normal file
20
modules/work/nixos-org-certs.crt
Normal file
@ -0,0 +1,20 @@
|
||||
T2 Palo Alto CA
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDIjCCAgqgAwIBAgIJAOE7K8F61qxbMA0GCSqGSIb3DQEBCwUAMEExCzAJBgNV
|
||||
BAYTAlVTMQswCQYDVQQIEwJOWTELMAkGA1UECxMCSVQxGDAWBgNVBAMTD1QyIFBh
|
||||
bG8gQWx0byBDQTAeFw0xNTA3MTUyMzUzNDJaFw0yNTA3MTIyMzUzNDJaMEExCzAJ
|
||||
BgNVBAYTAlVTMQswCQYDVQQIEwJOWTELMAkGA1UECxMCSVQxGDAWBgNVBAMTD1Qy
|
||||
IFBhbG8gQWx0byBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANBa
|
||||
nVZxAhk+spmp8JBzwtgPS+2oQ/Kpv7BRWn7Rj52oAL++a4DH2zRLb3f4mMyPpgEX
|
||||
nNrvZSkonxJToEMhAed5eIKNOjcwDT8kLatfmE/LHD4xNeK0FN0p0OlTJkwLI5KZ
|
||||
rne/YKqkYscYfjxyugYPb3ukjYfxeGNfeF9HGKTPAcL+fj0/fgkffJJPZ+d9+C2Z
|
||||
YXXI36DoXEjHUPxOz/hKL5ohM4m86OHt6qvZaG/b43raI99ckRFTwmoF+AfdIgVa
|
||||
3cuaxhnGyv+bC41LTxd1Azzys0txfxkFrt14oBUgOmPJelC26KgFoHnG8hSykNaH
|
||||
Uh8S8i8jmXgEdUN+bGkCAwEAAaMdMBswDAYDVR0TBAUwAwEB/zALBgNVHQ8EBAMC
|
||||
AgQwDQYJKoZIhvcNAQELBQADggEBAAqFo1P7Btgt9BZRpwmjA8ghQmQZQ9Fek1m2
|
||||
aOmkPMa6OqWxXDT5VU/b02LfKb+uVLsdBC1cv7ZrRYZc7ATt8d19rohvSn7DL8GR
|
||||
FEjYgj1OFvblbN8zHogDVx4gD57j9imT40vNpBcsEiRlNXDu/ExbhsDiing1tdmq
|
||||
eULdQg13kdJzqVS6xJ10qddqRRUWASkq5qUwvTO2MQkCjPSGjUAHeHa9vCZRiVWQ
|
||||
vWVwZ7CZ6XTzqcpfKdT/xKGHbT6xQxIhLVOvSMIhirh8OyFVzM5m+PHYN4KO6x5j
|
||||
+Je/viLhvfaEVUntOkOcpQVmwOYZezQZqDDRWXo9k0vqGnZ8Gog=
|
||||
-----END CERTIFICATE-----
|
||||
@ -1,25 +0,0 @@
|
||||
diff --git a/cps/__init__.py b/cps/__init__.py
|
||||
index 0b912d23..ad5d1fa9 100644
|
||||
--- a/cps/__init__.py
|
||||
+++ b/cps/__init__.py
|
||||
@@ -83,7 +83,6 @@ app.config.update(
|
||||
lm = MyLoginManager()
|
||||
lm.login_view = 'web.login'
|
||||
lm.anonymous_user = ub.Anonymous
|
||||
-lm.session_protection = 'strong'
|
||||
|
||||
if wtf_present:
|
||||
csrf = CSRFProtect()
|
||||
diff --git a/cps/admin.py b/cps/admin.py
|
||||
index 1004ee78..e295066e 100644
|
||||
--- a/cps/admin.py
|
||||
+++ b/cps/admin.py
|
||||
@@ -98,8 +98,6 @@ def before_request():
|
||||
# make remember me function work
|
||||
if current_user.is_authenticated:
|
||||
confirm_login()
|
||||
- if not ub.check_user_session(current_user.id, flask_session.get('_id')) and 'opds' not in request.path:
|
||||
- logout_user()
|
||||
g.constants = constants
|
||||
g.user = current_user
|
||||
g.allow_registration = config.config_public_reg
|
||||
@ -1,10 +0,0 @@
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyBmVEo2
|
||||
bExsZERhYi9vVXMxVThRK2w3dFR4UlZVcGlsWUFPM3pReTQwaW5ZCjQ5Z3g3amZC
|
||||
bWUwWkdKTStVbFpwMmdwK3pQQU5CeE5tMVNHbXI1UkdCTFUKLT4gc3NoLWVkMjU1
|
||||
MTkgWXlTVU1RIE9sTG1lOHIyVGdLNWtJRTZtdGNWWEFsTTJ5bE1HS1V2MEdKeGNN
|
||||
WFMyV28KVlRHdDg5SGFadVlJempKWkp6eEp6TkhINnl0R0xDL0J0WXByclpFWE5I
|
||||
VQotLS0gVVhaUDZLTy8xS3hKOVliSlpuTEY2Q2xOQUEvblBtUG9Vb0I5ZE1oOUZ1
|
||||
VQr18Jwx6XDa7bwq0QWT6NdIFzqNUHWhDyUvS9twncFsr0yEAUDQd2XLtE+Vc8T9
|
||||
Z7y/C8Ct5+duqd6YaeqROJz5zVj0NnI0lshirBl89PQWF9ihp4V4Hw==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
@ -1,10 +0,0 @@
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyBIRnEy
|
||||
am1HTXptMmpSTjZQa2hQSUxNUU1rdXlod3U3bVZ0VGxQVlE2WldBClg0K3k5MDZH
|
||||
NFlPdHI0VnZSZE9DTTNMeDdldUpFQ3V0V0k0RnRIZHFhdzAKLT4gc3NoLWVkMjU1
|
||||
MTkgWXlTVU1RIFlxZFpqNU5kNVY2VUk0Um0zZ1d1M2FlRkYvV1BoTEFSNjZ2Vk9I
|
||||
QTVHM0UKY2gvVU9wckVUNEFwdUwyVFJZUGwxOFFKYm12cUlFTEVrb3IvcXI3TnND
|
||||
UQotLS0gMHdaajFjV2ozd0g5dWN5YkhiU2NBVWZVSU00aVIzY0VKYjJleVlQTUdX
|
||||
QQo7rH6kOTRFP43U/qiBOCHx+hBGlaODFRS1CgzkuqfMOq8PM28RsIN+l3sbwjxE
|
||||
W8chE/A0EChjIDtfYTMgsN3cYg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
@ -1,10 +0,0 @@
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyBudkxn
|
||||
ZzU1YVViYUZBWVVTYm1SeHpvanQ5M0YwVGo2YldlN2RwY0tscWpBCjd0ZmtLZ2th
|
||||
dEMrQk5QV0EzT0RpVkg5bGo1cHdTNzVYVkZpVzE4aHR0azgKLT4gc3NoLWVkMjU1
|
||||
MTkgWXlTVU1RIFlqaEI2QUNnMjR1T0FENXJIMEJWOUFJUXZ4SlJxbUFnQktWUW9w
|
||||
UFlmUUkKL1RwaWxoNFM4SkpadWtyN3JnWHdjVTYrQmo0dU9JUnp0MjN5enVsUm9o
|
||||
ZwotLS0gWUd2eTR2VGkyeTZ5cHNuanMrSlZKVmc4T1ZORExmUnhDSjN0NEJkNjkz
|
||||
cwriuyYCgvJe7TRi3n/JwxIRKMsoh7+xj4B5Fdxuj3BOtKVi1geSjlDHVklRwu9Y
|
||||
IMCTLqQtj08JnuLfDezRGHAYCM8=
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
@ -1 +0,0 @@
|
||||
$6$PZYiMGmJIIHAepTM$Wx5EqTQ5GApzXx58nvi8azh16pdxrN6Qrv1wunDlzveOgawitWzcIxuj76X9V868fsPi/NOIEO8yVXqwzS9UF.
|
||||
@ -1,10 +0,0 @@
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyBSYUU2
|
||||
OWp1ZDRLVTJrR1k3SVdXZnRPN3RUNDY5RFM2WEZaTzRmdU1zSWdrCjV1VHpNMG81
|
||||
VHA4LzdsN3FpOUNoTGNlWmlHS3E4dTVvWTVoZHJMSlNYTHMKLT4gc3NoLWVkMjU1
|
||||
MTkgWXlTVU1RIDVjM1JmclgxQThKcU1XQWptWmN0MjlKU1NvMEpwMnYyd3Y4czBT
|
||||
RTVkQ0UKc0pOYkRxZldsWnloQnBYMWk1eFU0M3R5SkZVTUYyaldIcENONE1PWVJv
|
||||
NAotLS0gclZDQndaREZpZ2Z0R0d0alBPeW1tZFVOVHhSaHNlQTRXdTRoZmFDUFFK
|
||||
SQqueOUzTFuhSryWW4Do+NAUcq2YdOtN8gmP5Zcp1oMe/9+JIs6Upjsc3eWn+dSA
|
||||
7QwbGlTyd6D0+PLJxHA18Xfgpj5owGeTDtwykFPgdO1BjE8C3KlgzUfN
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
@ -1,11 +0,0 @@
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyBqNm0x
|
||||
YVc0bXp6eldNdkp1QWk2cEI0WFBhVVd3cHhDODNwMS9UUTBPN25JCmxXZnRIcFZr
|
||||
SFJrQnI3R1BTUk1BcVl3RjlUaXMzSXpqaGdTMi9reno1eHcKLT4gc3NoLWVkMjU1
|
||||
MTkgWXlTVU1RIFlKWCtsWGtWdTI4L0ZFTVRHNFN5by9vTE95MXFoMVZGYlYrM1I2
|
||||
alREaE0Kd251SGRDdE96VmZqblhEWXFkZDhvRUZsZ1pnZ3NqdEdJSlBvaXhoOHVB
|
||||
WQotLS0gaGJNRm14SkdXcTFmYlJUell1WUZUeEllT3ZwMkNaejF3eWJ5U1ZSdno1
|
||||
MAqQIT8vvUro+C+avm6lCPfrX9yigKzx/gtKfMB//1Ie7BUo1+o5iYoA+R0luMU8
|
||||
/zVX1yGAzDPqas/HfYclIPg3bdjm2dnpz0ltOrOvjA4x3nEzzrmS96zo3Fy1d8oX
|
||||
oAMw2l/p2QDHI60cyhvC
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user