Lillian-Violet/NixOS-Config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge branch 'main' of codeberg.org:Lillian-Violet/NixOS-Config

Browse source
This commit is contained in:
Lillian Violet 2025-08-26 13:51:20 +02:00
commit 26b99fce6f
13 changed files with 200 additions and 106 deletions
Download patch file Download diff file Expand all files Collapse all files

2
nixos/hosts/EDI/configuration.nix
View file

@ -57,5 +57,5 @@
};
# https://nixos.wiki/wiki/FAQ/When_do_I_update_stateVersion
system.stateVersion = "25.05";
system.stateVersion = "25.11";
}

2
nixos/hosts/GLaDOS/configuration.nix
View file

@ -96,5 +96,5 @@
users.users.lillian.extraGroups = ["gamemode"];
# https://nixos.wiki/wiki/FAQ/When_do_I_update_stateVersion
system.stateVersion = "25.05";
system.stateVersion = "25.11";
}

27
nixos/hosts/queen/configuration.nix
View file

@ -3,6 +3,7 @@
outputs,
lib,
pkgs,
config,
...
}: {
imports = [
@ -90,6 +91,30 @@
enable = false;
};
systemd = {
services."upgrade-nextcloud" = {
path = with pkgs; [nextcloud31];
enable = true;
unitConfig = {
after = "nextcloud-setup.service";
};
serviceConfig = {
Type = "oneshot";
ExecStart = "${config.services.nextcloud.occ}/bin/nextcloud-occ upgrade";
RemainAfterExit = "yes";
};
};
timers."upgrade-nextcloud" = {
wantedBy = ["timers.target"];
partOf = ["upgrade-nextcloud.service"];
timerConfig = {
OnCalendar = "daily";
Unit = "nextcloud-setup.service";
};
};
};
networking = {
domain = "";
@ -192,5 +217,5 @@
};
# https://nixos.wiki/wiki/FAQ/When_do_I_update_stateVersion
system.stateVersion = "25.05";
system.stateVersion = "25.11";
}

2
nixos/hosts/shodan/configuration.nix
View file

@ -275,5 +275,5 @@
};
# https://nixos.wiki/wiki/FAQ/When_do_I_update_stateVersion
system.stateVersion = "25.05";
system.stateVersion = "25.11";
}

52
nixos/hosts/wheatley/configuration.nix
View file

@ -29,7 +29,7 @@
programs = {
# Allow executing of anything on the system with a , eg: , python executes python from the nix store even if not in $PATH currently
command-not-found.enable = lib.mkForce false;
nix-index.enable = true;
# nix-index.enable = true;
nix-index-database.comma.enable = true;
};
services = {
@ -220,6 +220,34 @@
# wg public key for host: A02sO7uLdgflhPIRd0cbJONIaPP4z8HTxDkmX4NegFg=
# TODO: generate this dynamically based on other hosts
mullvad = {
address = ["10.70.93.226/32" "fc00:bbbb:bbbb:bb01::7:5de1/128"];
privateKeyFile = lib.mkForce config.sops.secrets."wg-private-key".path;
dns = ["100.64.0.7"];
extraOptions = {
FwMark = 51820;
};
postUp = ''
${pkgs.iproute2}/bin/ip rule add from 192.168.2.43 table main
${pkgs.iptables}/bin/iptables -t mangle -A PREROUTING -i end0 -j CONNMARK --set-mark 51820
${pkgs.iptables}/bin/iptables -t mangle -A PREROUTING -m connmark --mark 51820 -j MARK --set-mark 51820
'';
preDown = ''
${pkgs.iproute2}/bin/ip rule del from 192.168.2.43 table main
${pkgs.iptables}/bin/iptables -t mangle -D PREROUTING -i end0 -j CONNMARK --set-mark 51820
${pkgs.iptables}/bin/iptables -t mangle -D PREROUTING -m connmark --mark 51820 -j MARK --set-mark 51820
'';
peers = [
{
publicKey = "UrQiI9ISdPPzd4ARw1NHOPKKvKvxUhjwRjaI0JpJFgM=";
allowedIPs = ["0.0.0.0/0" "::0/0"];
endpoint = "193.32.249.66:51820";
}
];
};
wg1 = {
# Determines the IP address and subnet of the server's end of the tunnel interface.
address = ["10.0.0.1/24" "fdc9:281f:04d7:9ee9::1/64"];
@ -229,22 +257,26 @@
# This allows the wireguard server to route your traffic to the internet and hence be like a VPN
postUp = ''
${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.0.0.1/24 -o eth0 -j MASQUERADE
${pkgs.iptables}/bin/ip6tables -A FORWARD -i wg0 -j ACCEPT
${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s fdc9:281f:04d7:9ee9::1/64 -o eth0 -j MASQUERADE
${pkgs.iptables}/bin/iptables -A FORWARD -i wg1 -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s mullvad -o end0 -j MASQUERADE
${pkgs.iptables}/bin/ip6tables -A FORWARD -i wg1 -j ACCEPT
${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s mullvad -o end0 -j MASQUERADE
'';
# Undo the above
preDown = ''
${pkgs.iptables}/bin/iptables -D FORWARD -i wg0 -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.0.0.1/24 -o eth0 -j MASQUERADE
${pkgs.iptables}/bin/ip6tables -D FORWARD -i wg0 -j ACCEPT
${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s fdc9:281f:04d7:9ee9::1/64 -o eth0 -j MASQUERADE
${pkgs.iptables}/bin/iptables -D FORWARD -i wg1 -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s mullvad -o end0 -j MASQUERADE
${pkgs.iptables}/bin/ip6tables -D FORWARD -i wg1 -j ACCEPT
${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s mullvad -o end0 -j MASQUERADE
'';
privateKeyFile = lib.mkForce config.sops.secrets."wg-private-key".path;
extraOptions = {
FwMark = 51820;
};
peers = [
{
#GLaDOS public key
@ -351,6 +383,6 @@
services.cage.enable = true;
nixpkgs.config.kodi.enableAdvancedLauncher = true;
system.stateVersion = "25.05";
system.stateVersion = "25.11";
nixpkgs.hostPlatform = lib.mkForce "aarch64-linux";
}