fix: cloudflare tunnel on tempest

requires openssh, but removing public key

flake.nix

@@ -110,20 +110,10 @@
 
   };
 
-  outputs = { self, nixpkgs, ... }@inputs:
+  outputs = { nixpkgs, ... }@inputs:
 
     let
 
-      # Common overlays to always use
-      overlays = [
-        inputs.nur.overlay
-        inputs.nix2vim.overlay
-        (import ./overlays/neovim-plugins.nix inputs)
-        (import ./overlays/calibre-web.nix)
-        (import ./overlays/disko.nix inputs)
-        (import ./overlays/tree-sitter.nix inputs)
-      ];
-
       # Global configuration for my systems
       globals = let baseName = "masu.rs";
       in rec {
@@ -135,7 +125,6 @@
         mail.imapHost = "imap.purelymail.com";
         mail.smtpHost = "smtp.purelymail.com";
         dotfilesRepo = "git@github.com:nmasur/dotfiles";
-        nixpkgs.overlays = overlays;
         hostnames = {
           git = "git.${baseName}";
           metrics = "metrics.${baseName}";
@@ -148,6 +137,16 @@
         };
       };
 
+      # Common overlays to always use
+      overlays = [
+        inputs.nur.overlay
+        inputs.nix2vim.overlay
+        (import ./overlays/neovim-plugins.nix inputs)
+        (import ./overlays/calibre-web.nix)
+        (import ./overlays/disko.nix inputs)
+        (import ./overlays/tree-sitter.nix inputs)
+      ];
+
       # System types to support.
       supportedSystems =
         [ "x86_64-linux" "x86_64-darwin" "aarch64-linux" "aarch64-darwin" ];
@@ -157,26 +156,20 @@
 
     in rec {
 
-      nixosModules = {
-        globals = { config }: { config = globals; };
-        common = import ./modules/common;
-        nixos = import ./modules/nixos;
-        darwin = import ./modules/darwin;
-      };
-
       # Contains my full system builds, including home-manager
       # nixos-rebuild switch --flake .#tempest
       nixosConfigurations = {
-        tempest = import ./hosts/tempest { inherit self; };
-        hydra = import ./hosts/hydra { inherit self; };
-        flame = import ./hosts/flame { inherit self; };
-        swan = import ./hosts/swan { inherit self; };
+        tempest = import ./hosts/tempest { inherit inputs globals overlays; };
+        hydra = import ./hosts/hydra { inherit inputs globals overlays; };
+        flame = import ./hosts/flame { inherit inputs globals overlays; };
+        swan = import ./hosts/swan { inherit inputs globals overlays; };
       };
 
       # Contains my full Mac system builds, including home-manager
       # darwin-rebuild switch --flake .#lookingglass
       darwinConfigurations = {
-        lookingglass = import ./hosts/lookingglass { inherit self; };
+        lookingglass =
+          import ./hosts/lookingglass { inherit inputs globals overlays; };
       };
 
       # For quickly applying home-manager settings with:
@@ -192,8 +185,10 @@
       diskoConfigurations = { root = import ./disks/root.nix; };
 
       packages = let
-        aws = system: import ./hosts/aws { inherit self system; };
-        staff = system: import ./hosts/staff { inherit self system; };
+        aws = system:
+          import ./hosts/aws { inherit inputs globals overlays system; };
+        staff = system:
+          import ./hosts/staff { inherit inputs globals overlays system; };
         neovim = system:
           let pkgs = import nixpkgs { inherit system overlays; };
           in import ./modules/common/neovim/package {

hosts/aws/default.nix

@@ -1,14 +1,17 @@
-{ self, system, ... }:
+{ inputs, system, globals, overlays, ... }:
 
-self.inputs.nixos-generators.nixosGenerate {
+inputs.nixos-generators.nixosGenerate {
   inherit system;
   format = "amazon";
   modules = [
-    self.inputs.home-manager.nixosModules.home-manager
-    self.nixosModules.globals
-    self.nixosModules.common
-    self.nixosModules.nixos
+    inputs.home-manager.nixosModules.home-manager
     {
+      nixpkgs.overlays = overlays;
+      user = globals.user;
+      fullName = globals.fullName;
+      dotfilesRepo = globals.dotfilesRepo;
+      gitName = globals.gitName;
+      gitEmail = globals.gitEmail;
       networking.hostName = "sheep";
       gui.enable = false;
       theme.colors = (import ../../colorscheme/gruvbox).dark;
@@ -18,6 +21,9 @@ self.inputs.nixos-generators.nixosGenerate {
       # AWS settings require this
       permitRootLogin = "prohibit-password";
     }
+    ../../modules/common
+    ../../modules/nixos
+    ../../modules/nixos/services/sshd.nix
   ] ++ [
     # Required to fix diskSize errors during build
     ({ ... }: { amazonImage.sizeMB = 16 * 1024; })

hosts/flame/default.nix

@@ -4,23 +4,24 @@
 # How to install:
 # https://blog.korfuri.fr/posts/2022/08/nixos-on-an-oracle-free-tier-ampere-machine/
 
-{ self, ... }:
+{ inputs, globals, overlays, ... }:
 
-self.inputs.nixpkgs.lib.nixosSystem {
+inputs.nixpkgs.lib.nixosSystem {
   system = "aarch64-linux";
   specialArgs = { };
   modules = [
-    self.inputs.home-manager.nixosModules.home-manager
-    self.nixosModules.globals
-    self.nixosModules.common
-    self.nixosModules.nixos
+    globals
+    inputs.home-manager.nixosModules.home-manager
+    ../../modules/common
+    ../../modules/nixos
     {
+      nixpkgs.overlays = overlays;
+
       # Hardware
       server = true;
       networking.hostName = "flame";
 
-      imports =
-        [ (self.inputs.nixpkgs + "/nixos/modules/profiles/qemu-guest.nix") ];
+      imports = [ (inputs.nixpkgs + "/nixos/modules/profiles/qemu-guest.nix") ];
       boot.initrd.availableKernelModules = [ "xhci_pci" "virtio_pci" "usbhid" ];
 
       fileSystems."/" = {
@@ -48,6 +49,7 @@ self.inputs.nixpkgs.lib.nixosSystem {
 
       services.caddy.enable = true;
       services.grafana.enable = true;
+      services.openssh.enable = true;
       services.prometheus.enable = true;
       services.gitea.enable = true;
       services.vaultwarden.enable = true;
@@ -70,6 +72,9 @@ self.inputs.nixpkgs.lib.nixosSystem {
         accessKeyId = "0026b0e73b2e2c80000000005";
       };
 
+      # # Grant access to Jellyfin directories from Nextcloud
+      # users.users.nextcloud.extraGroups = [ "jellyfin" ];
+
       # # Wireguard config for Transmission
       # wireguard.enable = true;
       # networking.wireguard.interfaces.wg0 = {

hosts/hydra/default.nix

@@ -1,20 +1,21 @@
 # The Hydra
 # System configuration for WSL
 
-{ self, ... }:
+{ inputs, globals, overlays, ... }:
 
-self.inputs.nixpkgs.lib.nixosSystem {
+inputs.nixpkgs.lib.nixosSystem {
   system = "x86_64-linux";
   specialArgs = { };
   modules = [
-    self.inputs.wsl.nixosModules.wsl
-    self.inputs.home-manager.nixosModules.home-manager
-    self.nixosModules.globals
-    self.nixosModules.common
-    self.nixosModules.nixos
-    self.nixosModules.wsl
+    ../../modules/common
+    ../../modules/nixos
+    ../../modules/wsl
+    globals
+    inputs.wsl.nixosModules.wsl
+    inputs.home-manager.nixosModules.home-manager
     {
       networking.hostName = "hydra";
+      nixpkgs.overlays = overlays;
       identityFile = "/home/${globals.user}/.ssh/id_ed25519";
       gui.enable = false;
       theme = {

hosts/lookingglass/default.nix

@@ -1,46 +1,46 @@
 # The Looking Glass
 # System configuration for my work Macbook
 
-{ self, ... }:
+{ inputs, globals, overlays, ... }:
 
-self.inputs.darwin.lib.darwinSystem {
+inputs.darwin.lib.darwinSystem {
   system = "x86_64-darwin";
   specialArgs = { };
   modules = [
-    self.inputs.home-manager.darwinModules.home-manager
-    self.nixosModules.common
-    self.nixosModules.darwin
-    ({ config, lib, ... }: {
-      config = rec {
-        user = lib.mkForce "Noah.Masur";
-        gitName = lib.mkForce "Noah-Masur_1701";
-        gitEmail = lib.mkForce "${user}@take2games.com";
-        nixpkgs.overlays = [ self.inputs.firefox-darwin.overlay ];
-        networking.hostName = "lookingglass";
-        identityFile = "/Users/${user}/.ssh/id_ed25519";
-        gui.enable = true;
-        theme = {
-          colors = (import ../../colorscheme/gruvbox-dark).dark;
-          dark = true;
-        };
-        mail.user = globals.user;
-        charm.enable = true;
-        neovim.enable = true;
-        mail.enable = true;
-        mail.aerc.enable = true;
-        mail.himalaya.enable = false;
-        kitty.enable = true;
-        discord.enable = true;
-        firefox.enable = true;
-        dotfiles.enable = true;
-        nixlang.enable = true;
-        terraform.enable = true;
-        python.enable = true;
-        lua.enable = true;
-        kubernetes.enable = true;
-        _1password.enable = true;
-        slack.enable = true;
-      };
+    ../../modules/common
+    ../../modules/darwin
+    (globals // rec {
+      user = "Noah.Masur";
+      gitName = "Noah-Masur_1701";
+      gitEmail = "${user}@take2games.com";
     })
+    inputs.home-manager.darwinModules.home-manager
+    {
+      nixpkgs.overlays = [ inputs.firefox-darwin.overlay ] ++ overlays;
+      networking.hostName = "lookingglass";
+      identityFile = "/Users/Noah.Masur/.ssh/id_ed25519";
+      gui.enable = true;
+      theme = {
+        colors = (import ../../colorscheme/gruvbox-dark).dark;
+        dark = true;
+      };
+      mail.user = globals.user;
+      charm.enable = true;
+      neovim.enable = true;
+      mail.enable = true;
+      mail.aerc.enable = true;
+      mail.himalaya.enable = false;
+      kitty.enable = true;
+      discord.enable = true;
+      firefox.enable = true;
+      dotfiles.enable = true;
+      nixlang.enable = true;
+      terraform.enable = true;
+      python.enable = true;
+      lua.enable = true;
+      kubernetes.enable = true;
+      _1password.enable = true;
+      slack.enable = true;
+    }
   ];
 }

hosts/staff/default.nix

@@ -1,32 +1,31 @@
 # The Staff
 # ISO configuration for my USB drive
 
-{ self, system, ... }:
+{ inputs, system, overlays, ... }:
 
-self.inputs.nixos-generators.nixosGenerate {
+inputs.nixos-generators.nixosGenerate {
   inherit system;
   format = "install-iso";
-  modules = [
-    self.nixosModules.global
-    self.nixosModules.common
-    self.nixosModules.nixos
-    ({ config, pkgs, ... }: {
-      networking.hostName = "staff";
-      users.extraUsers.root.openssh.authorizedKeys.keys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s"
-      ];
-      services.openssh = {
-        enable = true;
-        ports = [ 22 ];
-        allowSFTP = true;
-        settings = {
-          GatewayPorts = "no";
-          X11Forwarding = false;
-          PasswordAuthentication = false;
-          PermitRootLogin = "yes";
-        };
+  modules = [{
+    nixpkgs.overlays = overlays;
+    networking.hostName = "staff";
+    users.extraUsers.root.openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s"
+    ];
+    services.openssh = {
+      enable = true;
+      ports = [ 22 ];
+      allowSFTP = true;
+      settings = {
+        GatewayPorts = "no";
+        X11Forwarding = false;
+        PasswordAuthentication = false;
+        PermitRootLogin = "yes";
       };
-      environment.systemPackages = with pkgs; [
+    };
+    environment.systemPackages =
+      let pkgs = import inputs.nixpkgs { inherit system overlays; };
+      in with pkgs; [
         git
         vim
         wget
@@ -36,10 +35,9 @@ self.inputs.nixos-generators.nixosGenerate {
           colors = (import ../../colorscheme/gruvbox).dark;
         })
       ];
-      nix.extraOptions = ''
-        experimental-features = nix-command flakes
-        warn-dirty = false
-      '';
-    })
-  ];
+    nix.extraOptions = ''
+      experimental-features = nix-command flakes
+      warn-dirty = false
+    '';
+  }];
 }

hosts/swan/default.nix

@@ -1,17 +1,17 @@
 # The Swan
 # System configuration for my home NAS server
 
-{ self, ... }:
+{ inputs, globals, overlays, ... }:
 
-self.inputs.nixpkgs.lib.nixosSystem {
+inputs.nixpkgs.lib.nixosSystem {
   system = "x86_64-linux";
   specialArgs = { };
   modules = [
-    self.inputs.home-manager.nixosModules.home-manager
-    self.inputs.disko.nixosModules.disko
-    self.nixosModules.globals
-    self.nixosModules.common
-    self.nixosModules.nixos
+    globals
+    inputs.home-manager.nixosModules.home-manager
+    inputs.disko.nixosModules.disko
+    ../../modules/common
+    ../../modules/nixos
     {
       # Hardware
       server = true;
@@ -46,6 +46,7 @@ self.inputs.nixpkgs.lib.nixosSystem {
 
       gui.enable = false;
       theme = { colors = (import ../../colorscheme/gruvbox).dark; };
+      nixpkgs.overlays = overlays;
       neovim.enable = true;
       cloudflare.enable = true;
       dotfiles.enable = true;
@@ -55,6 +56,7 @@ self.inputs.nixpkgs.lib.nixosSystem {
       services.jellyfin.enable = true;
       services.nextcloud.enable = true;
       services.calibre-web.enable = true;
+      services.openssh.enable = true;
       services.prometheus.enable = true;
       services.samba.enable = true;
 

hosts/tempest/default.nix

@@ -1,16 +1,18 @@
 # The Tempest
 # System configuration for my desktop
 
-{ self, ... }:
+{ inputs, globals, overlays, ... }:
 
-self.inputs.nixpkgs.lib.nixosSystem {
+inputs.nixpkgs.lib.nixosSystem {
   system = "x86_64-linux";
   modules = [
-    self.inputs.home-manager.nixosModules.home-manager
-    self.nixosModules.globals
-    self.nixosModules.common
-    self.nixosModules.nixos
+    globals
+    inputs.home-manager.nixosModules.home-manager
+    ../../modules/common
+    ../../modules/nixos
     {
+      nixpkgs.overlays = overlays;
+
       # Hardware
       physical = true;
       networking.hostName = "tempest";
@@ -51,7 +53,7 @@ self.inputs.nixpkgs.lib.nixosSystem {
 
       # Must be prepared ahead
       identityFile = "/home/${globals.user}/.ssh/id_ed25519";
-      passwordHash = self.inputs.nixpkgs.lib.fileContents ../../password.sha512;
+      passwordHash = inputs.nixpkgs.lib.fileContents ../../password.sha512;
 
       # Theming
       gui.enable = true;
@@ -59,8 +61,8 @@ self.inputs.nixpkgs.lib.nixosSystem {
         colors = (import ../../colorscheme/gruvbox-dark).dark;
         dark = true;
       };
-      wallpaper = "${self.inputs.wallpapers}/gruvbox/road.jpg";
-      gtk.theme.name = self.inputs.nixpkgs.lib.mkDefault "Adwaita-dark";
+      wallpaper = "${inputs.wallpapers}/gruvbox/road.jpg";
+      gtk.theme.name = inputs.nixpkgs.lib.mkDefault "Adwaita-dark";
 
       # Programs and services
       charm.enable = true;
@@ -90,6 +92,7 @@ self.inputs.nixpkgs.lib.nixosSystem {
         ryujinx.enable = true;
       };
 
+      services.openssh.enable = true; # Required for Cloudflare tunnel
       cloudflareTunnel = {
         enable = true;
         id = "ac133a82-31fb-480c-942a-cdbcd4c58173";

modules/nixos/services/nextcloud.nix

@@ -3,7 +3,7 @@
   config = lib.mkIf config.services.nextcloud.enable {
 
     services.nextcloud = {
-      package = pkgs.nextcloud26; # Required to specify
+      package = pkgs.nextcloud27; # Required to specify
       datadir = "/data/nextcloud";
       https = true;
       hostName = "localhost";

modules/nixos/services/sshd.nix

@@ -13,9 +13,8 @@
     };
   };
 
-  config = lib.mkIf (config.publicKey != null) {
+  config = lib.mkIf config.services.openssh.enable {
     services.openssh = {
-      enable = true;
       ports = [ 22 ];
       allowSFTP = true;
       settings = {
@@ -27,7 +26,7 @@
     };
 
     users.users.${config.user}.openssh.authorizedKeys.keys =
-      [ config.publicKey ];
+      lib.mkIf (config.publicKey != null) [ config.publicKey ];
 
     # Implement a simple fail2ban service for sshd
     services.sshguard.enable = true;