Lillian-Violet/NixOS-Config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge branch 'main' of codeberg.org:Lillian-Violet/NixOS-Config

Browse source
This commit is contained in:
Lillian Violet 2025-08-26 13:51:20 +02:00
commit 26b99fce6f
13 changed files with 200 additions and 106 deletions
Download patch file Download diff file Expand all files Collapse all files

5
nixos/desktop/default.nix
View file

@ -36,7 +36,6 @@
dvt
servo
restart
freetube-0236
# System tools
aha
@ -92,7 +91,7 @@
#rustdesk
])
++ (with pkgs-edge; [
# freetube
freetube
# list of latest packages from nixpkgs master
# Can be used to install latest version of some packages
]);
@ -107,7 +106,7 @@
programs = {
# Allow executing of anything on the system with a , eg: , python executes python from the nix store even if not in $PATH currently
command-not-found.enable = lib.mkForce false;
nix-index.enable = true;
# nix-index.enable = true;
nix-index-database.comma.enable = true;
direnv = {

2
nixos/hosts/EDI/configuration.nix
View file

@ -57,5 +57,5 @@
};
# https://nixos.wiki/wiki/FAQ/When_do_I_update_stateVersion
system.stateVersion = "25.05";
system.stateVersion = "25.11";
}

2
nixos/hosts/GLaDOS/configuration.nix
View file

@ -96,5 +96,5 @@
users.users.lillian.extraGroups = ["gamemode"];
# https://nixos.wiki/wiki/FAQ/When_do_I_update_stateVersion
system.stateVersion = "25.05";
system.stateVersion = "25.11";
}

27
nixos/hosts/queen/configuration.nix
View file

@ -3,6 +3,7 @@
outputs,
lib,
pkgs,
config,
...
}: {
imports = [
@ -90,6 +91,30 @@
enable = false;
};
systemd = {
services."upgrade-nextcloud" = {
path = with pkgs; [nextcloud31];
enable = true;
unitConfig = {
after = "nextcloud-setup.service";
};
serviceConfig = {
Type = "oneshot";
ExecStart = "${config.services.nextcloud.occ}/bin/nextcloud-occ upgrade";
RemainAfterExit = "yes";
};
};
timers."upgrade-nextcloud" = {
wantedBy = ["timers.target"];
partOf = ["upgrade-nextcloud.service"];
timerConfig = {
OnCalendar = "daily";
Unit = "nextcloud-setup.service";
};
};
};
networking = {
domain = "";
@ -192,5 +217,5 @@
};
# https://nixos.wiki/wiki/FAQ/When_do_I_update_stateVersion
system.stateVersion = "25.05";
system.stateVersion = "25.11";
}

2
nixos/hosts/shodan/configuration.nix
View file

@ -275,5 +275,5 @@
};
# https://nixos.wiki/wiki/FAQ/When_do_I_update_stateVersion
system.stateVersion = "25.05";
system.stateVersion = "25.11";
}

52
nixos/hosts/wheatley/configuration.nix
View file

@ -29,7 +29,7 @@
programs = {
# Allow executing of anything on the system with a , eg: , python executes python from the nix store even if not in $PATH currently
command-not-found.enable = lib.mkForce false;
nix-index.enable = true;
# nix-index.enable = true;
nix-index-database.comma.enable = true;
};
services = {
@ -220,6 +220,34 @@
# wg public key for host: A02sO7uLdgflhPIRd0cbJONIaPP4z8HTxDkmX4NegFg=
# TODO: generate this dynamically based on other hosts
mullvad = {
address = ["10.70.93.226/32" "fc00:bbbb:bbbb:bb01::7:5de1/128"];
privateKeyFile = lib.mkForce config.sops.secrets."wg-private-key".path;
dns = ["100.64.0.7"];
extraOptions = {
FwMark = 51820;
};
postUp = ''
${pkgs.iproute2}/bin/ip rule add from 192.168.2.43 table main
${pkgs.iptables}/bin/iptables -t mangle -A PREROUTING -i end0 -j CONNMARK --set-mark 51820
${pkgs.iptables}/bin/iptables -t mangle -A PREROUTING -m connmark --mark 51820 -j MARK --set-mark 51820
'';
preDown = ''
${pkgs.iproute2}/bin/ip rule del from 192.168.2.43 table main
${pkgs.iptables}/bin/iptables -t mangle -D PREROUTING -i end0 -j CONNMARK --set-mark 51820
${pkgs.iptables}/bin/iptables -t mangle -D PREROUTING -m connmark --mark 51820 -j MARK --set-mark 51820
'';
peers = [
{
publicKey = "UrQiI9ISdPPzd4ARw1NHOPKKvKvxUhjwRjaI0JpJFgM=";
allowedIPs = ["0.0.0.0/0" "::0/0"];
endpoint = "193.32.249.66:51820";
}
];
};
wg1 = {
# Determines the IP address and subnet of the server's end of the tunnel interface.
address = ["10.0.0.1/24" "fdc9:281f:04d7:9ee9::1/64"];
@ -229,22 +257,26 @@
# This allows the wireguard server to route your traffic to the internet and hence be like a VPN
postUp = ''
${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.0.0.1/24 -o eth0 -j MASQUERADE
${pkgs.iptables}/bin/ip6tables -A FORWARD -i wg0 -j ACCEPT
${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s fdc9:281f:04d7:9ee9::1/64 -o eth0 -j MASQUERADE
${pkgs.iptables}/bin/iptables -A FORWARD -i wg1 -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s mullvad -o end0 -j MASQUERADE
${pkgs.iptables}/bin/ip6tables -A FORWARD -i wg1 -j ACCEPT
${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s mullvad -o end0 -j MASQUERADE
'';
# Undo the above
preDown = ''
${pkgs.iptables}/bin/iptables -D FORWARD -i wg0 -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.0.0.1/24 -o eth0 -j MASQUERADE
${pkgs.iptables}/bin/ip6tables -D FORWARD -i wg0 -j ACCEPT
${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s fdc9:281f:04d7:9ee9::1/64 -o eth0 -j MASQUERADE
${pkgs.iptables}/bin/iptables -D FORWARD -i wg1 -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s mullvad -o end0 -j MASQUERADE
${pkgs.iptables}/bin/ip6tables -D FORWARD -i wg1 -j ACCEPT
${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s mullvad -o end0 -j MASQUERADE
'';
privateKeyFile = lib.mkForce config.sops.secrets."wg-private-key".path;
extraOptions = {
FwMark = 51820;
};
peers = [
{
#GLaDOS public key
@ -351,6 +383,6 @@
services.cage.enable = true;
nixpkgs.config.kodi.enableAdvancedLauncher = true;
system.stateVersion = "25.05";
system.stateVersion = "25.11";
nixpkgs.hostPlatform = lib.mkForce "aarch64-linux";
}

84
nixos/shared/default.nix
View file

@ -90,13 +90,15 @@
# grub.enable = false;
};
programs.zsh = {
enable = true;
};
programs = {
zsh = {
enable = true;
};
programs.gnupg.agent = {
enable = true;
enableBrowserSocket = true;
gnupg.agent = {
enable = true;
enableBrowserSocket = true;
};
};
stylix = {
@ -173,18 +175,36 @@
# sansSerif = ["Atkinson Hyperlegible"];
# };
};
systemd = {
services."shutdown-zellij-zsh" = {
path = with pkgs; [killall];
enable = true;
unitConfig = {
Before = "shutdown.target";
};
serviceConfig = {
Type = "oneshot";
ExecStart = "${pkgs.killall}/bin/killall -SIGKILL zellij zsh";
RemainAfterExit = "yes";
};
};
systemd.services."shutdown-zellij-zsh" = {
path = with pkgs; [killall];
enable = true;
unitConfig = {
Before = "shutdown.target";
};
serviceConfig = {
Type = "oneshot";
ExecStart = "${pkgs.killall}/bin/killall -SIGKILL zellij zsh";
RemainAfterExit = "yes";
};
services."start-vpn-wg" =
if config.services.vpn-ip.enable
then {
path = with pkgs; [systemd];
enable = true;
unitConfig = {
Wants = "network-online.target";
After = "network-online.target";
};
serviceConfig = {
Type = "oneshot";
ExecStart = "${pkgs.systemd}/bin/systemctl start wg-quick-wg0.service";
RemainAfterExit = "yes";
};
}
else {};
};
networking =
@ -194,7 +214,7 @@
wg-quick.interfaces = {
wg0 = {
autostart = true;
autostart = false;
address = ["10.0.0.${config.services.vpn-ip.ip}/24" "fdc9:281f:04d7:9ee9::${config.services.vpn-ip.ip}/64"];
dns = ["10.0.0.1" "fdc9:281f:04d7:9ee9::1"];
listenPort = 51821;
@ -234,20 +254,22 @@
};
users = {
users.lillian = {
isNormalUser = true;
extraGroups = ["sudo" "networkmanager" "wheel" "vboxsf" "docker"];
shell = pkgs.zsh;
hashedPasswordFile = config.sops.secrets."lillian-password".path;
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILhwA+ZdP2tEBYQNdzLHZzFHxocyeqzhXI6tFpaZA3PZ lillian@EDI"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH30G2PJOnI6jnAtxOQV0SpLFUva0adarLZLvaoZvjGE lillian@GLaDOS"
];
users = {
lillian = {
isNormalUser = true;
extraGroups = ["sudo" "networkmanager" "wheel" "vboxsf" "docker"];
shell = pkgs.zsh;
hashedPasswordFile = config.sops.secrets."lillian-password".path;
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILhwA+ZdP2tEBYQNdzLHZzFHxocyeqzhXI6tFpaZA3PZ lillian@EDI"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH30G2PJOnI6jnAtxOQV0SpLFUva0adarLZLvaoZvjGE lillian@GLaDOS"
];
};
root = {
hashedPassword = "*";
};
};
mutableUsers = false;
users.root = {
hashedPassword = "*";
};
};
}