Merge branch 'main' of git.lillianviolet.dev:Lillian-Violet/NixOS-Config

This commit is contained in:
Lillian Violet 2024-04-05 23:05:47 +02:00
commit a49e8c5332
39 changed files with 2069 additions and 845 deletions

View file

@ -67,5 +67,13 @@
}; };
}; };
}; };
nodev = {
"/home/lillian/Downloads" = {
fsType = "tmpfs";
mountOptions = [
"size=4G"
];
};
};
}; };
} }

View file

@ -67,5 +67,13 @@
}; };
}; };
}; };
nodev = {
"/home/lillian/Downloads" = {
fsType = "tmpfs";
mountOptions = [
"size=4G"
];
};
};
}; };
} }

79
disko/shodan/default.nix Normal file
View file

@ -0,0 +1,79 @@
{
disko.devices = {
disk = {
nvme0n1 = {
type = "disk";
device = "/dev/disk/by-path/pci-0000:01:00.0-nvme-1";
content = {
type = "gpt";
partitions = {
ESP = {
size = "512M";
type = "EF00";
content = {
type = "filesystem";
format = "vfat";
mountpoint = "/boot";
mountOptions = [
"defaults"
];
};
};
luks = {
size = "100%";
content = {
type = "luks";
name = "crypted";
extraOpenArgs = [];
settings = {
# if you want to use the key for interactive login be sure there is no trailing newline
# for example use `echo -n "password" > /tmp/secret.key`
#keyFile = "/tmp/secret.key";
allowDiscards = true;
};
#additionalKeyFiles = ["/tmp/additionalSecret.key"];
content = {
type = "lvm_pv";
vg = "pool";
};
};
};
};
};
};
};
lvm_vg = {
pool = {
type = "lvm_vg";
lvs = {
swap = {
size = "16G";
content = {
type = "swap";
resumeDevice = true; # resume from hiberation from this device
};
};
root = {
size = "100%FREE";
content = {
type = "filesystem";
format = "ext4";
mountpoint = "/";
mountOptions = [
"defaults"
];
};
};
};
};
};
nodev = {
"/home/lillian/Downloads" = {
fsType = "tmpfs";
mountOptions = [
"size=4G"
];
};
};
};
}

View file

@ -52,11 +52,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1710090208, "lastModified": 1712163166,
"narHash": "sha256-1W7yDW+kqCr/9SygZwygBayE8HwLnzJq48fMAOZQLAY=", "narHash": "sha256-Al0RdDZF8DM1uZ5m1tmOxtPNvFrRpoczHWGbJ57KfuI=",
"owner": "girlbossceo", "owner": "girlbossceo",
"repo": "conduwuit", "repo": "conduwuit",
"rev": "e888a0a745ac979abe6a687ff24b8c5e7b7b79ed", "rev": "bd69d9b565fb403fc78fbeb633fb374ec3f4b49c",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -117,11 +117,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1710003968, "lastModified": 1711299236,
"narHash": "sha256-g8+K+mLiNG5uch35Oy9oDQBAmGSkCcqrd0Jjme7xiG0=", "narHash": "sha256-6/JsyozOMKN8LUGqWMopKTSiK8N79T8Q+hcxu2KkTXg=",
"owner": "ipetkov", "owner": "ipetkov",
"repo": "crane", "repo": "crane",
"rev": "10484f86201bb94bd61ecc5335b1496794fedb78", "rev": "880573f80d09e18a11713f402b9e6172a085449f",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -137,11 +137,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1710379155, "lastModified": 1711934712,
"narHash": "sha256-zdHEsOOnfBTO1ymL6gd9etR+iNS6HowbJM4Llqxy+Uc=", "narHash": "sha256-sBDe+QmX/QohlnKeSEzrftcXyZL5FY09OMjZ59Rpyy4=",
"owner": "nix-community", "owner": "nix-community",
"repo": "disko", "repo": "disko",
"rev": "cc69c2340b59e290982ec7e6238471d470c839d0", "rev": "611c9ea53250f7bb22286b3d26872280a0e608f9",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -194,11 +194,11 @@
"rust-analyzer-src": "rust-analyzer-src" "rust-analyzer-src": "rust-analyzer-src"
}, },
"locked": { "locked": {
"lastModified": 1709619709, "lastModified": 1711606966,
"narHash": "sha256-l6EPVJfwfelWST7qWQeP6t/TDK3HHv5uUB1b2vw4mOQ=", "narHash": "sha256-nTaO7ZDL4D02dVC5ktqnXNiNuODBUHyE4qEcFjAUCQY=",
"owner": "nix-community", "owner": "nix-community",
"repo": "fenix", "repo": "fenix",
"rev": "c8943ea9e98d41325ff57d4ec14736d330b321b2", "rev": "aa45c3e901ea42d6633af083c0c555efaf948b17",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -258,11 +258,11 @@
"flake-compat_4": { "flake-compat_4": {
"flake": false, "flake": false,
"locked": { "locked": {
"lastModified": 1668681692, "lastModified": 1696426674,
"narHash": "sha256-Ht91NGdewz8IQLtWZ9LCeNXMSXHUss+9COoqu6JLmXU=", "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
"owner": "edolstra", "owner": "edolstra",
"repo": "flake-compat", "repo": "flake-compat",
"rev": "009399224d5e398d03b22badca40a37ac85412a1", "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -312,11 +312,11 @@
"systems": "systems" "systems": "systems"
}, },
"locked": { "locked": {
"lastModified": 1709126324, "lastModified": 1710146030,
"narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=", "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
"owner": "numtide", "owner": "numtide",
"repo": "flake-utils", "repo": "flake-utils",
"rev": "d465f4819400de7c8d874d50b982301f28a84605", "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -348,11 +348,11 @@
"systems": "systems_3" "systems": "systems_3"
}, },
"locked": { "locked": {
"lastModified": 1709126324, "lastModified": 1710146030,
"narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=", "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
"owner": "numtide", "owner": "numtide",
"repo": "flake-utils", "repo": "flake-utils",
"rev": "d465f4819400de7c8d874d50b982301f28a84605", "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -370,11 +370,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1703887061, "lastModified": 1709087332,
"narHash": "sha256-gGPa9qWNc6eCXT/+Z5/zMkyYOuRZqeFZBDbopNZQkuY=", "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
"owner": "hercules-ci", "owner": "hercules-ci",
"repo": "gitignore.nix", "repo": "gitignore.nix",
"rev": "43e1aa1308018f37118e34d3a9cb4f5e75dc11d5", "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -390,11 +390,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1710401383, "lastModified": 1712093955,
"narHash": "sha256-jskq7uDpKXrRoY4hDpNqykmSSKHUXYlo7ZFc/se7fus=", "narHash": "sha256-94I0sXz6fiVBvUAk2tg6t3UpM5rOImj4JTSTNFbg64s=",
"owner": "nix-community", "owner": "nix-community",
"repo": "home-manager", "repo": "home-manager",
"rev": "1ab3cec3a1bbb065b2d52b913d1431366028d5b5", "rev": "80546b220e95a575c66c213af1b09fe255299438",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -410,11 +410,11 @@
"nixpkgs": "nixpkgs_3" "nixpkgs": "nixpkgs_3"
}, },
"locked": { "locked": {
"lastModified": 1710404304, "lastModified": 1711231487,
"narHash": "sha256-tYsUAsZgt9TT7d+r1KRYHWyBRWedJ39SXNBVSCQVsGQ=", "narHash": "sha256-dRdFjStMA7GeuD/V4vzKblzuHwxMPgzEboRleVdZlUM=",
"owner": "Jovian-Experiments", "owner": "Jovian-Experiments",
"repo": "Jovian-NixOS", "repo": "Jovian-NixOS",
"rev": "ffa51458aec4d53aac85b6dee1ee2ec29f4e953f", "rev": "1171169117f63f1de9ef2ea36efd8dcf377c6d5a",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -434,11 +434,11 @@
"rust-overlay": "rust-overlay" "rust-overlay": "rust-overlay"
}, },
"locked": { "locked": {
"lastModified": 1710171982, "lastModified": 1711442573,
"narHash": "sha256-WFMB+Yohcvego1/vOtaq+MJ8Wvp5meOANfNifg26Ie4=", "narHash": "sha256-/A3YzcY5erYOPojp5Ffwgxv4X5MTnRiWwuaXfgXbK2g=",
"owner": "nix-community", "owner": "nix-community",
"repo": "lanzaboote", "repo": "lanzaboote",
"rev": "19ad7fd5724f30868748b8156ff25be838cd2bc5", "rev": "df7ac26bd24fac8baa94d60a02c3e0f0d4d16368",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -469,11 +469,11 @@
}, },
"nix-filter": { "nix-filter": {
"locked": { "locked": {
"lastModified": 1705332318, "lastModified": 1710156097,
"narHash": "sha256-kcw1yFeJe9N4PjQji9ZeX47jg0p9A0DuU4djKvg1a7I=", "narHash": "sha256-1Wvk8UP7PXdf8bCCaEoMnOT1qe5/Duqgj+rL8sRQsSM=",
"owner": "numtide", "owner": "numtide",
"repo": "nix-filter", "repo": "nix-filter",
"rev": "3449dc925982ad46246cfc36469baf66e1b64f17", "rev": "3342559a24e85fc164b295c3444e8a139924675b",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -506,11 +506,11 @@
}, },
"nixlib": { "nixlib": {
"locked": { "locked": {
"lastModified": 1710031547, "lastModified": 1711846064,
"narHash": "sha256-pkUg3hOKuGWMGF9WEMPPN/G4pqqdbNGJQ54yhyQYDVY=", "narHash": "sha256-cqfX0QJNEnge3a77VnytM0Q6QZZ0DziFXt6tSCV8ZSc=",
"owner": "nix-community", "owner": "nix-community",
"repo": "nixpkgs.lib", "repo": "nixpkgs.lib",
"rev": "630ebdc047ca96d8126e16bb664c7730dc52f6e6", "rev": "90b1a963ff84dc532db92f678296ff2499a60a87",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -527,11 +527,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1710398463, "lastModified": 1711932680,
"narHash": "sha256-fQlYanU84E8uwBpcoTCcLCwU8cqn0eQ7nwTcrWfSngc=", "narHash": "sha256-CEpVtyB7uyRprTuiG+lpWWMvM/C0CbY/dbBuxT5BDwM=",
"owner": "nix-community", "owner": "nix-community",
"repo": "nixos-generators", "repo": "nixos-generators",
"rev": "efd4e38532b5abfaa5c9fc95c5a913157dc20ccb", "rev": "1f4c32ca4295bb7cca1e48a2f39b65490b249b0b",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -542,11 +542,11 @@
}, },
"nixos-hardware": { "nixos-hardware": {
"locked": { "locked": {
"lastModified": 1710123225, "lastModified": 1711352745,
"narHash": "sha256-j3oWlxRZxB7cFsgEntpH3rosjFHRkAo/dhX9H3OfxtY=", "narHash": "sha256-luvqik+i3HTvCbXQZgB6uggvEcxI9uae0nmrgtXJ17U=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixos-hardware", "repo": "nixos-hardware",
"rev": "ad2fd7b978d5e462048729a6c635c45d3d33c9ba", "rev": "9a763a7acc4cfbb8603bb0231fec3eda864f81c0",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -572,36 +572,6 @@
"type": "github" "type": "github"
} }
}, },
"nixpkgs-23_05": {
"locked": {
"lastModified": 1704290814,
"narHash": "sha256-LWvKHp7kGxk/GEtlrGYV68qIvPHkU9iToomNFGagixU=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "70bdadeb94ffc8806c0570eb5c2695ad29f0e421",
"type": "github"
},
"original": {
"id": "nixpkgs",
"ref": "nixos-23.05",
"type": "indirect"
}
},
"nixpkgs-23_11": {
"locked": {
"lastModified": 1706098335,
"narHash": "sha256-r3dWjT8P9/Ah5m5ul4WqIWD8muj5F+/gbCdjiNVBKmU=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "a77ab169a83a4175169d78684ddd2e54486ac651",
"type": "github"
},
"original": {
"id": "nixpkgs",
"ref": "nixos-23.11",
"type": "indirect"
}
},
"nixpkgs-stable": { "nixpkgs-stable": {
"locked": { "locked": {
"lastModified": 1702780907, "lastModified": 1702780907,
@ -620,11 +590,11 @@
}, },
"nixpkgs-stable_2": { "nixpkgs-stable_2": {
"locked": { "locked": {
"lastModified": 1704874635, "lastModified": 1710695816,
"narHash": "sha256-YWuCrtsty5vVZvu+7BchAxmcYzTMfolSPP5io8+WYCg=", "narHash": "sha256-3Eh7fhEID17pv9ZxrPwCLfqXnYP006RKzSs0JptsN84=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "3dc440faeee9e889fe2d1b4d25ad0f430d449356", "rev": "614b4613980a522ba49f0d194531beddbb7220d3",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -636,11 +606,11 @@
}, },
"nixpkgs-stable_3": { "nixpkgs-stable_3": {
"locked": { "locked": {
"lastModified": 1710033658, "lastModified": 1711819797,
"narHash": "sha256-yiZiVKP5Ya813iYLho2+CcFuuHpaqKc/CoxOlANKcqM=", "narHash": "sha256-tNeB6emxj74Y6ctwmsjtMlzUMn458sBmwnD35U5KIM4=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "b17375d3bb7c79ffc52f3538028b2ec06eb79ef8", "rev": "2b4e3ca0091049c6fbb4908c66b05b77eaef9f0c",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -652,11 +622,11 @@
}, },
"nixpkgs-unstable": { "nixpkgs-unstable": {
"locked": { "locked": {
"lastModified": 1710272261, "lastModified": 1712122226,
"narHash": "sha256-g0bDwXFmTE7uGDOs9HcJsfLFhH7fOsASbAuOzDC+fhQ=", "narHash": "sha256-pmgwKs8Thu1WETMqCrWUm0CkN1nmCKX3b51+EXsAZyY=",
"owner": "nixos", "owner": "nixos",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "0ad13a6833440b8e238947e47bea7f11071dc2b2", "rev": "08b9151ed40350725eb40b1fe96b0b86304a654b",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -668,11 +638,11 @@
}, },
"nixpkgs_2": { "nixpkgs_2": {
"locked": { "locked": {
"lastModified": 1710377395, "lastModified": 1712059183,
"narHash": "sha256-KMubsUWtVr7L55pXMBibBDBdmk3xrjbBPduc0E8z28c=", "narHash": "sha256-I/xinxexiKuaIsGBaHstfm8Y51lmKdTAvDwzB2CmACc=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "db001797591bf76f7b8d4c4ed3b49233391e0c97", "rev": "4b455dc2048f73a79eb3713f342369ff58f93e0b",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -700,11 +670,11 @@
}, },
"nixpkgs_4": { "nixpkgs_4": {
"locked": { "locked": {
"lastModified": 1710078301, "lastModified": 1711297276,
"narHash": "sha256-BQ3v+XPPz5dLiw2AqUEga++yfKRhqJANUqzqNL518pk=", "narHash": "sha256-KtHBr73Z729krfueBV6pUsEyq/4vILGP77DPmrKOTrI=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "73d699a6ff1e83df3fd6c1e60931e13667b8ae14", "rev": "3d41d1087707826b3a90685ab69147f8dc8145d5",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -716,11 +686,11 @@
}, },
"nixpkgs_5": { "nixpkgs_5": {
"locked": { "locked": {
"lastModified": 1710272261, "lastModified": 1712122226,
"narHash": "sha256-g0bDwXFmTE7uGDOs9HcJsfLFhH7fOsASbAuOzDC+fhQ=", "narHash": "sha256-pmgwKs8Thu1WETMqCrWUm0CkN1nmCKX3b51+EXsAZyY=",
"owner": "nixos", "owner": "nixos",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "0ad13a6833440b8e238947e47bea7f11071dc2b2", "rev": "08b9151ed40350725eb40b1fe96b0b86304a654b",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -732,11 +702,11 @@
}, },
"nixpkgs_6": { "nixpkgs_6": {
"locked": { "locked": {
"lastModified": 1705856552, "lastModified": 1709703039,
"narHash": "sha256-JXfnuEf5Yd6bhMs/uvM67/joxYKoysyE3M2k6T3eWbg=", "narHash": "sha256-6hqgQ8OK6gsMu1VtcGKBxKQInRLHtzulDo9Z5jxHEFY=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "612f97239e2cc474c13c9dafa0df378058c5ad8d", "rev": "9df3e30ce24fd28c7b3e2de0d986769db5d6225d",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -747,11 +717,11 @@
}, },
"nixpkgs_7": { "nixpkgs_7": {
"locked": { "locked": {
"lastModified": 1709968316, "lastModified": 1711715736,
"narHash": "sha256-4rZEtEDT6jcgRaqxsatBeds7x1PoEiEjb6QNGb4mNrk=", "narHash": "sha256-9slQ609YqT9bT/MNX9+5k5jltL9zgpn36DpFB7TkttM=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "0e7f98a5f30166cbed344569426850b21e4091d4", "rev": "807c549feabce7eddbf259dbdcec9e0600a0660d",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -797,11 +767,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1709982472, "lastModified": 1712081763,
"narHash": "sha256-cMPHIV7yWbve+nwiQDhVt7BBkxrGTLzSTAslv7u6HZo=", "narHash": "sha256-+xImkX19gde0Qac6kbJtJAXKXTOgcUE5z3RsBxVtseo=",
"owner": "pjones", "owner": "pjones",
"repo": "plasma-manager", "repo": "plasma-manager",
"rev": "26acf8f5880ae7d6e5de4ca953c8ad161b7903eb", "rev": "96a90a7f5ce6b29e01d7da83d082e870e4462174",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -828,11 +798,11 @@
"nixpkgs-stable": "nixpkgs-stable_2" "nixpkgs-stable": "nixpkgs-stable_2"
}, },
"locked": { "locked": {
"lastModified": 1708018599, "lastModified": 1710923068,
"narHash": "sha256-M+Ng6+SePmA8g06CmUZWi1AjG2tFBX9WCXElBHEKnyM=", "narHash": "sha256-6hOpUiuxuwpXXc/xfJsBUJeqqgGI+JMJuLo45aG3cKc=",
"owner": "cachix", "owner": "cachix",
"repo": "pre-commit-hooks.nix", "repo": "pre-commit-hooks.nix",
"rev": "5df5a70ad7575f6601d91f0efec95dd9bc619431", "rev": "e611897ddfdde3ed3eaac4758635d7177ff78673",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -864,11 +834,11 @@
"rust-analyzer-src": { "rust-analyzer-src": {
"flake": false, "flake": false,
"locked": { "locked": {
"lastModified": 1709571018, "lastModified": 1711562745,
"narHash": "sha256-ISFrxHxE0J5g7lDAscbK88hwaT5uewvWoma9TlFmRzM=", "narHash": "sha256-s/YOyBM0vumhkqCFi8CnV5imFlC5JJrGia8CmEXyQkM=",
"owner": "rust-lang", "owner": "rust-lang",
"repo": "rust-analyzer", "repo": "rust-analyzer",
"rev": "9f14343f9ee24f53f17492c5f9b653427e2ad15e", "rev": "ad51a17c627b4ca57f83f0dc1f3bb5f3f17e6d0b",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -890,11 +860,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1710036830, "lastModified": 1711246447,
"narHash": "sha256-pnV4gO3N/7/GzyRSKTRlSfS/19KJiPSvYcL4apnSkoQ=", "narHash": "sha256-g9TOluObcOEKewFo2fR4cn51Y/jSKhRRo4QZckHLop0=",
"owner": "oxalica", "owner": "oxalica",
"repo": "rust-overlay", "repo": "rust-overlay",
"rev": "d09dac6a63a2ac4b74ac2ecdc19acd8c46c2da2c", "rev": "dcc802a6ec4e9cc6a1c8c393327f0c42666f22e4",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -908,16 +878,14 @@
"blobs": "blobs", "blobs": "blobs",
"flake-compat": "flake-compat_4", "flake-compat": "flake-compat_4",
"nixpkgs": "nixpkgs_6", "nixpkgs": "nixpkgs_6",
"nixpkgs-23_05": "nixpkgs-23_05",
"nixpkgs-23_11": "nixpkgs-23_11",
"utils": "utils" "utils": "utils"
}, },
"locked": { "locked": {
"lastModified": 1709905972, "lastModified": 1710449465,
"narHash": "sha256-18OF2/ypr0n4Lp6Fk5SLHPu12ok6jM+Hv3sC0PCim0Q=", "narHash": "sha256-2orO8nfplp6uQJBFqKkj1iyNMC6TysmwbWwbb4osTag=",
"owner": "simple-nixos-mailserver", "owner": "simple-nixos-mailserver",
"repo": "nixos-mailserver", "repo": "nixos-mailserver",
"rev": "572c1b4d69deea1093ac231c37927cfa8ccad477", "rev": "79c8cfcd5873a85559da6201b116fb38b490d030",
"type": "gitlab" "type": "gitlab"
}, },
"original": { "original": {
@ -933,11 +901,11 @@
"nixpkgs-stable": "nixpkgs-stable_3" "nixpkgs-stable": "nixpkgs-stable_3"
}, },
"locked": { "locked": {
"lastModified": 1710417151, "lastModified": 1711855048,
"narHash": "sha256-3aDzAo0+jURqop+XL8EwVMmS3zkslGiPT2JXWOe9W+4=", "narHash": "sha256-HxegAPnQJSC4cbEbF4Iq3YTlFHZKLiNTk8147EbLdGg=",
"owner": "Mic92", "owner": "Mic92",
"repo": "sops-nix", "repo": "sops-nix",
"rev": "804157eb75a4312df25a9a144d3807c40ade72b6", "rev": "99b1e37f9fc0960d064a7862eb7adfb92e64fa10",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -991,13 +959,31 @@
"type": "github" "type": "github"
} }
}, },
"utils": { "systems_4": {
"locked": { "locked": {
"lastModified": 1605370193, "lastModified": 1681028828,
"narHash": "sha256-YyMTf3URDL/otKdKgtoMChu4vfVL3vCMkRqpGifhUn0=", "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
},
"utils": {
"inputs": {
"systems": "systems_4"
},
"locked": {
"lastModified": 1709126324,
"narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=",
"owner": "numtide", "owner": "numtide",
"repo": "flake-utils", "repo": "flake-utils",
"rev": "5021eac20303a61fafe17224c087f5519baed54d", "rev": "d465f4819400de7c8d874d50b982301f28a84605",
"type": "github" "type": "github"
}, },
"original": { "original": {

View file

@ -84,6 +84,7 @@
linger, linger,
pihole, pihole,
lanzaboote, lanzaboote,
jovian,
nixos-hardware, nixos-hardware,
conduit, conduit,
... ...
@ -100,7 +101,11 @@
in { in {
# Your custom packages # Your custom packages
# Accessible through 'nix build', 'nix shell', etc # Accessible through 'nix build', 'nix shell', etc
packages = forAllSystems (system: import ./pkgs nixpkgs.legacyPackages.${system}); packages = forAllSystems (system:
import ./pkgs (import nixpkgs {
inherit system;
config.allowUnfree = true;
}));
# Formatter for your nix files, available through 'nix fmt' # Formatter for your nix files, available through 'nix fmt'
# Other options beside 'alejandra' include 'nixpkgs-fmt' # Other options beside 'alejandra' include 'nixpkgs-fmt'
formatter = forAllSystems (system: nixpkgs.legacyPackages.${system}.alejandra); formatter = forAllSystems (system: nixpkgs.legacyPackages.${system}.alejandra);
@ -134,9 +139,7 @@
} }
]; ];
}; };
};
nixosConfigurations = {
GLaDOS = nixpkgs.lib.nixosSystem { GLaDOS = nixpkgs.lib.nixosSystem {
system = "x86_64-linux"; system = "x86_64-linux";
specialArgs = {inherit inputs outputs;}; specialArgs = {inherit inputs outputs;};
@ -152,9 +155,7 @@
} }
]; ];
}; };
};
nixosConfigurations = {
queen = nixpkgs.lib.nixosSystem { queen = nixpkgs.lib.nixosSystem {
system = "x86_64-linux"; system = "x86_64-linux";
specialArgs = {inherit inputs outputs;}; specialArgs = {inherit inputs outputs;};
@ -166,9 +167,7 @@
simple-nixos-mailserver.nixosModule simple-nixos-mailserver.nixosModule
]; ];
}; };
};
nixosConfigurations = {
shodan = nixpkgs.lib.nixosSystem { shodan = nixpkgs.lib.nixosSystem {
system = "x86_64-linux"; system = "x86_64-linux";
specialArgs = {inherit inputs outputs;}; specialArgs = {inherit inputs outputs;};
@ -176,15 +175,31 @@
# > Our main nixos configuration file < # > Our main nixos configuration file <
./nixos/hosts/shodan/configuration.nix ./nixos/hosts/shodan/configuration.nix
sops-nix.nixosModules.sops sops-nix.nixosModules.sops
lanzaboote.nixosModules.lanzaboote
disko.nixosModules.disko
jovian.nixosModules.jovian
home-manager.nixosModules.home-manager
{
home-manager.sharedModules = [inputs.plasma-manager.homeManagerModules.plasma-manager];
}
];
};
ISO = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
specialArgs = {inherit inputs outputs;};
modules = [
"${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares-plasma6.nix"
"${nixpkgs}/nixos/modules/installer/cd-dvd/channel.nix"
./nixos/hosts/iso/configuration.nix
sops-nix.nixosModules.sops
home-manager.nixosModules.home-manager home-manager.nixosModules.home-manager
{ {
home-manager.sharedModules = [inputs.plasma-manager.homeManagerModules.plasma-manager]; home-manager.sharedModules = [inputs.plasma-manager.homeManagerModules.plasma-manager];
} }
]; ];
}; };
};
nixosConfigurations = {
wheatley = nixpkgs.lib.nixosSystem { wheatley = nixpkgs.lib.nixosSystem {
system = "armv7l-linux"; system = "armv7l-linux";
specialArgs = {inherit inputs outputs;}; specialArgs = {inherit inputs outputs;};

View file

@ -56,7 +56,7 @@
kate kate
# Chat applications: # Chat applications:
element-desktop cinny-desktop
signal-desktop signal-desktop
webcord-vencord webcord-vencord
@ -88,7 +88,8 @@
zsh zsh
# Web browsing: # Web browsing:
firefox (firefox.override {nativeMessagingHosts = [pkgs.firefoxpwa];})
firefoxpwa
librewolf librewolf
ungoogled-chromium ungoogled-chromium
]; ];

File diff suppressed because it is too large Load diff

View file

@ -0,0 +1,13 @@
{
inputs,
outputs,
lib,
config,
pkgs,
...
}: {
# You can import other home-manager modules here
imports = [
./lillian.nix
];
}

View file

@ -0,0 +1,29 @@
# This is your home-manager configuration file
# Use this to configure your home environment (it replaces ~/.config/nixpkgs/home.nix)
{
inputs,
outputs,
lib,
config,
pkgs,
...
}: {
# You can import other home-manager modules here
imports = [
# If you want to use modules your own flake exports (from modules/home-manager):
# outputs.homeManagerModules.example
# Or modules exported from other flakes (such as nix-colors):
# inputs.nix-colors.homeManagerModules.default
# You can also split up your configuration and import pieces of it here:
# ./nvim.nix
../../desktop
];
home.packages = with pkgs; [
];
# https://nixos.wiki/wiki/FAQ/When_do_I_update_stateVersion
home.stateVersion = "24.05";
}

View file

@ -78,6 +78,15 @@
ungoogled-chromium ungoogled-chromium
]; ];
# # Automount services for user
# programs.bashmount.enable = true;
# services.udiskie = {
# enable = true;
# automount = true;
# notify = false;
# tray = "never";
# };
# Enable home-manager and git # Enable home-manager and git
programs.home-manager.enable = true; programs.home-manager.enable = true;
programs.git = { programs.git = {

View file

@ -34,7 +34,7 @@
}; };
} }
]; ];
enableAutosuggestions = true; autosuggestion.enable = true;
enableCompletion = true; enableCompletion = true;
historySubstringSearch.enable = true; historySubstringSearch.enable = true;
syntaxHighlighting.enable = true; syntaxHighlighting.enable = true;

View file

@ -34,6 +34,8 @@
# System tools # System tools
aha aha
bcachefs-tools
clinfo
direnv direnv
git-filter-repo git-filter-repo
gnupg gnupg
@ -43,7 +45,10 @@
sbctl sbctl
tpm2-tools tpm2-tools
tpm2-tss tpm2-tss
virtualgl
vulkan-tools
waydroid waydroid
wayland-utils
xwaylandvideobridge xwaylandvideobridge
yubikey-personalization yubikey-personalization
zsh zsh
@ -58,6 +63,9 @@
# kdePackages.krunner-ssh # kdePackages.krunner-ssh
# kdePackages.krunner-symbols # kdePackages.krunner-symbols
kdePackages.packagekit-qt kdePackages.packagekit-qt
kdePackages.plasma-pa
kdePackages.sddm-kcm
kdePackages.dolphin-plugins
libportal-qt5 libportal-qt5
libportal libportal
@ -89,6 +97,7 @@
services.xserver.enable = true; services.xserver.enable = true;
# Enable the KDE Plasma Desktop Environment. # Enable the KDE Plasma Desktop Environment.
services.xserver.displayManager.sddm.wayland.enable = true;
services.xserver.displayManager.sddm.enable = true; services.xserver.displayManager.sddm.enable = true;
services.desktopManager.plasma6.enable = true; services.desktopManager.plasma6.enable = true;
services.xserver.displayManager.defaultSession = "plasma"; services.xserver.displayManager.defaultSession = "plasma";

View file

@ -0,0 +1,150 @@
{
inputs,
outputs,
lib,
config,
pkgs,
nixpkgs-stable,
...
}: {
imports = [
# If you want to use modules your own flake exports (from modules/home-manager):
# outputs.homeManagerModules.example
# outputs.nixosModules.contabo.wan
inputs.home-manager.nixosModules.home-manager
# Or modules exported from other flakes (such as nix-colors):
# inputs.nix-colors.homeManagerModules.defaults
# Import shared settings
../../shared
];
boot.tmp.cleanOnBoot = true;
zramSwap.enable = false;
networking.domain = "";
services.openssh = {
enable = true;
# require public key authentication for better security
settings.PasswordAuthentication = false;
settings.KbdInteractiveAuthentication = false;
};
nixpkgs = {
# You can add overlays here
overlays = [
];
# Configure your nixpkgs instance
config = {
# Disable if you don't want unfree packages
allowUnfree = true;
};
};
#Set up sops config, and configure where the keyfile is, then set the mode for the unencrypted keys
sops.defaultSopsFile = ./secrets/sops.yaml;
services.desktopManager.plasma6.enable = true;
environment.systemPackages = with pkgs; [
# Custom tools
dvd
dvt
servo
restart
install-nix
# System tools
aha
direnv
efitools
git-filter-repo
gnupg
pciutils
sbctl
tpm2-tools
tpm2-tss
waydroid
zsh
# KDE/QT
krunner-translator
kdePackages.discover
kdePackages.kcalc
kdePackages.kdepim-addons
kdePackages.kirigami
kdePackages.kdeconnect-kde
# kdePackages.krunner-ssh
# kdePackages.krunner-symbols
kdePackages.packagekit-qt
kdePackages.plasma-pa
kdePackages.sddm-kcm
kdePackages.dolphin-plugins
libportal-qt5
libportal
];
# Enable networking
networking.networkmanager.enable = true;
# Contabo ipv6 nameservers: "2a02:c207::1:53" "2a02:c207::2:53"
networking.firewall.enable = true;
networking.firewall.allowedTCPPorts = [22];
programs.kdeconnect.enable = true;
# Configure keymap in X11
services.xserver.xkb = {
layout = "us";
variant = "";
options = "terminate:ctrl_alt_bksp,compose:caps_toggle";
};
# Enable bluetooth hardware
hardware.bluetooth.enable = true;
security.tpm2.enable = true;
security.tpm2.pkcs11.enable = true; # expose /run/current-system/sw/lib/libtpm2_pkcs11.so
security.tpm2.tctiEnvironment.enable = true; # TPM2TOOLS_TCTI and TPM2_PKCS11_TCTI env variables
users.users.lillian.extraGroups = ["tss"]; # tss group has access to TPM devices
# Set your time zone.
time.timeZone = "Europe/Amsterdam";
programs.git = {
enable = true;
};
programs.direnv = {
enable = true;
};
# Enable completion of system packages by zsh
environment.pathsToLink = ["/share/zsh"];
# kde power settings do not turn off screen
systemd = {
services.sshd.wantedBy = pkgs.lib.mkForce ["multi-user.target"];
targets = {
sleep.enable = false;
suspend.enable = false;
hibernate.enable = false;
hybrid-sleep.enable = false;
};
};
home-manager = {
extraSpecialArgs = {inherit inputs outputs;};
users = {
# Import your home-manager configuration
lillian = import ../../../home-manager/hosts/iso;
};
};
boot.kernelPackages = lib.mkForce pkgs.linuxPackages_latest;
boot.supportedFilesystems = lib.mkForce ["bcachefs" "btrfs" "cifs" "f2fs" "jfs" "ntfs" "reiserfs" "vfat" "xfs"];
# https://nixos.wiki/wiki/FAQ/When_do_I_update_stateVersion
system.stateVersion = "unstable";
}

View file

@ -0,0 +1,21 @@
lillian-password: ENC[AES256_GCM,data:eQzZwGxK9Lw2gc8HDNw57odxPzTH4sa/2O97h3VAghRwLClmCYKT91kxj2F3kQ4iEctBl0GxdS4WoL3H9eE4/CAPffXdTmkdYg==,iv:2ezB4DNHFv5ceJ2gtATV12Azm3vFFDLX1qSSy+cKuMY=,tag:zxb5agUCDpi92bYV7+DmoA==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age12e00qvf4shtmsfq3ujamyaa72pjvad2qhrxkvpl9hryrjvgxev4sjhmkxz
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArbVd5bkxmV2FSNDVCWXN1
RGxwdVZ5ZEROQTZ1d2ptU1RJc0dTUVlVOTE4CjhjeklubEhwUFgydkFWbDJkcU1U
VnowU29NSG10a3VKbXk3RWNWY0FwZ1EKLS0tIDJYMXhGeXArRnZ1NmQwQ3NqVHdM
dXlaN3dWOUl4Mys2V0x3Z3F6UVU4MVUKEJYpX8XhSNcM+7aUuxnIwrokY0/29Cnh
yz0HAZkaj8FwvnPnafo5jmwVyi6WXECvX5E0NZfjKH4AF5vTu6Wukg==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2024-03-20T18:17:48Z"
mac: ENC[AES256_GCM,data:3UHIoYPHC6n56CHguOVuoFd9VwCjGiD9VCYy2d5W+4XQEZpjnONX8fhwwWRm42COymz89tmqDmpDp88BnSU8uE14IaCIUoxfCaRiZtjAiHjouua2jr50aUV56pwyan8ZiiOjP8oP1VY/tsv1w0jWI9TjSTHvCdNLR8XEcf6bCrk=,iv:/lBJdkQgwZyiztQ9vSoHgY+WxXJKHFI93dxtOSunHNo=,tag:lLwrSdzoN9CzmyIdLOe5ig==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.8.1

View file

@ -100,13 +100,40 @@
networking.nat.internalInterfaces = ["ve-+"]; networking.nat.internalInterfaces = ["ve-+"];
networking.nat.externalInterface = "ens18"; networking.nat.externalInterface = "ens18";
networking.enableIPv6 = lib.mkForce true; networking.enableIPv6 = lib.mkForce true;
networking.nameservers = ["1.1.1.1"]; networking.nameservers = ["79.143.183.251" "79.143.183.252" "2a02:c207::1:53" "2a02:c207::2:53"];
# Contabo ipv6 nameservers: "2a02:c207::1:53" "2a02:c207::2:53" networking.interfaces.ens18.ipv4.addresses = [
{
address = "62.171.160.195";
prefixLength = 32;
}
];
networking.firewall.enable = true; networking.interfaces.ens18.ipv6.addresses = [
{
address = "2a02:c207:2063:2448::1";
prefixLength = 64;
}
];
networking.firewall.allowedTCPPorts = [22 80 443]; # Open ports in the firewall.
networking.firewall = {
enable = true;
allowPing = false;
allowedTCPPorts = [
22 # SSH
5349 # STUN tls
5350 # STUN tls alt
80 # http
443 # https
];
allowedUDPPortRanges = [
{
from = 49152;
to = 49999;
} # TURN relay
];
};
# networking.useNetworkd = true; # networking.useNetworkd = true;

View file

@ -8,6 +8,9 @@ mailpassunhash: ENC[AES256_GCM,data:q/P3nrNLy3hCISDmalw94nzWIFhoCdCTyflj27D2Ltr8
rpcSecret: ENC[AES256_GCM,data:gOuQSY2RI6rnSnG1,iv:xz1ueq4/UOKYBs5r9Tk4jL0+GyX8uo8I8ZymVgIMKLI=,tag:Fr8rWIttLz7X8Pri6FBJBQ==,type:str] rpcSecret: ENC[AES256_GCM,data:gOuQSY2RI6rnSnG1,iv:xz1ueq4/UOKYBs5r9Tk4jL0+GyX8uo8I8ZymVgIMKLI=,tag:Fr8rWIttLz7X8Pri6FBJBQ==,type:str]
wg-private: ENC[AES256_GCM,data:6BEuNqqG//p5UhRmQ4RPEze6jZdvzK4PEXxlbX2ANYIhFpacj0aZnCr9o/A=,iv:tPlwYdV4I5oA8qG+bfVi1Dpbf7xedByantqsmylZXKQ=,tag:k1BqKqlayOWz5QW1XiAjqQ==,type:str] wg-private: ENC[AES256_GCM,data:6BEuNqqG//p5UhRmQ4RPEze6jZdvzK4PEXxlbX2ANYIhFpacj0aZnCr9o/A=,iv:tPlwYdV4I5oA8qG+bfVi1Dpbf7xedByantqsmylZXKQ=,tag:k1BqKqlayOWz5QW1XiAjqQ==,type:str]
lillian-password: ENC[AES256_GCM,data:tc+Romv2fL+tdqLLmbwqaF4IHrNZ0VEpnECmW/66FW7IUpjHMyS7YP+pmmvDCzM9afIXMxyPFHGNRwiCmxqstiiNeSeLdo6rDw==,iv:sGeu9aNTgdpThv+0Z/nZKIrat1xNgM0t/KTGPaFbsdI=,tag:kZBHF4X0KO9znog61NwU+Q==,type:str] lillian-password: ENC[AES256_GCM,data:tc+Romv2fL+tdqLLmbwqaF4IHrNZ0VEpnECmW/66FW7IUpjHMyS7YP+pmmvDCzM9afIXMxyPFHGNRwiCmxqstiiNeSeLdo6rDw==,iv:sGeu9aNTgdpThv+0Z/nZKIrat1xNgM0t/KTGPaFbsdI=,tag:kZBHF4X0KO9znog61NwU+Q==,type:str]
coturn-auth-secret: ENC[AES256_GCM,data:RYxyATuYIcrGd8h8Gc4CP9ZQ80ekuuwHehnOPYisHejmycgT8a2mWpk+5r3HkFmBNcLDeNlfnhIif5oLHGuHyw==,iv:M2GdNDxP4xpP35FJPTgljbcKpOm6DmEEnIYRItAxDVI=,tag:IiiNXeTi6Yja5PrnKRkhdA==,type:str]
grafana-telegraf-key: ENC[AES256_GCM,data:agpUzG1/n2NAKDt45IgelmDf0CUlC82fmD4f7JdcszNuUg7uCNA7XeaJ6PZtHQ==,iv:keo3i+qSbtXkA5fyCr2S5z9nJS9bXUn5WDiPgWocPU8=,tag:p/nDff10PRhi9pOszp1PnA==,type:str]
sync-secrets: ENC[AES256_GCM,data:AwCgqfSXmYVGnCV5PJ5Ql44IiutTS76F1H7Ow7gB4mQQ8PtiAsmArzpAXd7LzsXedm55X04U+GvkcbM9cwPcF+psyb3Zi8EnI/mjnI9MgFyySSEcosJZVAtCpXGIMyYgRXtF5OBh5CzupAG059d1TDAqrSpLXMuSDdypTaOMHxnlq5q1swfpzhhY3PVgUKVFXdjZLX8aF3JTE9ceVxFsB+traLzOQsl+QKty0x0mpuqR97zkMCchX7bTwgUgbl7phzTvmwV8Qw==,iv:gkZs5NB9+CLfz4kfV4ha2llZQPP81uuXRKqUlASgpiA=,tag:DXkiG0ZFHLHlVhwLwtv/XQ==,type:str]
sops: sops:
kms: [] kms: []
gcp_kms: [] gcp_kms: []
@ -23,8 +26,8 @@ sops:
KzNBMCtUaS9sU21Xc1JUd1FSR29tSkEKyqaDM/WUWjK2l+ahE6sIFYsQ6Qtkf7yz KzNBMCtUaS9sU21Xc1JUd1FSR29tSkEKyqaDM/WUWjK2l+ahE6sIFYsQ6Qtkf7yz
NWFTzsDZBmm9kpSIjchf+PuBuoRHeEKbEH8jnMlYB3J8boEnUnXMlw== NWFTzsDZBmm9kpSIjchf+PuBuoRHeEKbEH8jnMlYB3J8boEnUnXMlw==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
lastmodified: "2024-02-22T11:53:17Z" lastmodified: "2024-04-04T16:38:10Z"
mac: ENC[AES256_GCM,data:bOrEW/yQIgJy7Jqfj/95jtXoIeEX2JNTvsnodkrtmtUQoY8Lczb47rTLpS0CM9Gh1Do38dvoNgWY08jXj3PVPO6s7Yy995ZbtgaR8n/G190PZ+p+i7EInv/OAJe/Xw4WcZlLs1XeKPashJmoX7qZi2fVPmu5UpYD1YiCMzZsWkQ=,iv:vjEJCDX8D4relmBJs569d+sklY1bUptWBjJVS7pKB70=,tag:xsQM3cDBkHymS9t9Qyyitg==,type:str] mac: ENC[AES256_GCM,data:KqkNjZe/rMhiWNS3SeYHm+b23u1LD1jq3f0+jB/BVmy6pDQDTNgA/wWHF/HcorU2Z7TOdjofJPuvRuF6C8ec4RCtTxX2ubIYWV4H3BynYxrEuEsIN8EnPJDcFFc92n9PKzoWnHo2NK1a4ZX+DxYVjDDdjhOMWj/kqWRWZRU+qEw=,iv:rarq3mCSfDFzbIdSIe+3mTNTnoZwFZ2uPkYMGt/xqos=,tag:rCD6SUpwOktRo7fM3Irv7g==,type:str]
pgp: [] pgp: []
unencrypted_suffix: _unencrypted unencrypted_suffix: _unencrypted
version: 3.8.1 version: 3.8.1

View file

@ -0,0 +1,28 @@
{
inputs,
outputs,
lib,
config,
pkgs,
...
}: {
services.udev.extraRules = ''
KERNEL=="sd[a-z]|sd[a-z][0-9]", ACTION=="add", RUN+="${pkgs.systemd}/bin/systemctl start --no-block external-drive-mount@%k.service"
KERNEL=="sd[a-z]|sd[a-z][0-9]", ACTION=="remove", RUN+="${pkgs.systemd}/bin/systemctl stop --no-block external-drive-mount@%k.service"
KERNEL=="mmcblk0|mmcblk0p[0-9]", ACTION=="add", RUN+="${pkgs.systemd}/bin/systemctl start --no-block external-drive-mount@%k.service"
KERNEL=="mmcblk0|mmcblk0p[0-9]", ACTION=="remove", RUN+="${pkgs.systemd}/bin/systemctl stop --no-block external-drive-mount@%k.service"
KERNEL=="nvme0n1p9|nvme0n1p1[0-9]", ACTION=="add", RUN+="${pkgs.systemd}/bin/systemctl start --no-block external-drive-mount@%k.service"
KERNEL=="nvme0n1p9|nvme0n1p1[0-9]", ACTION=="remove", RUN+="${pkgs.systemd}/bin/systemctl stop --no-block external-drive-mount@%k.service"
'';
systemd.services."external-drive-mount@" = {
path = with pkgs; [jq coreutils udisks bash util-linux toybox auto-mount steam];
enable = true;
serviceConfig = {
ExecStart = "${pkgs.auto-mount}/bin/auto-mount add %i";
ExecStop = "${pkgs.auto-mount}/bin/auto-mount remove %i";
Type = "oneshot";
RemainAfterExit = true;
};
};
}

View file

@ -21,6 +21,10 @@
# You can also split up your configuration and import pieces of it here: # You can also split up your configuration and import pieces of it here:
# ./nvim.nix # ./nvim.nix
./hardware-configuration.nix ./hardware-configuration.nix
../../../disko/shodan
./auto-mount.nix
]; ];
boot.tmp.cleanOnBoot = true; boot.tmp.cleanOnBoot = true;
@ -44,19 +48,29 @@
sops.defaultSopsFile = ./secrets/sops.yaml; sops.defaultSopsFile = ./secrets/sops.yaml;
environment.systemPackages = with pkgs; [ environment.systemPackages = with pkgs; [
# Custom tools
auto-mount
#System: #System:
alejandra alejandra
btrfs-progs btrfs-progs
efitools
extest
git git
git-filter-repo git-filter-repo
home-manager home-manager
htop htop
jq
noto-fonts noto-fonts
noto-fonts-emoji-blob-bin noto-fonts-emoji-blob-bin
noto-fonts-emoji noto-fonts-emoji
oh-my-zsh oh-my-zsh
rsync rsync
rustdesk rustdesk
sbctl
steam
udisks
util-linux
wget wget
zsh zsh
@ -86,7 +100,7 @@
jovian.steam.autoStart = true; jovian.steam.autoStart = true;
#What desktop to start when switching to desktop session #What desktop to start when switching to desktop session
jovian.steam.desktopSession = "plasma"; jovian.steam.desktopSession = "plasmax11";
jovian.steam.user = "lillian"; jovian.steam.user = "lillian";
@ -103,7 +117,7 @@
jovian.hardware.has.amd.gpu = true; jovian.hardware.has.amd.gpu = true;
programs.steam = { programs.steam = lib.mkForce {
enable = true; enable = true;
remotePlay.openFirewall = true; # Open ports in the firewall for Steam Remote Play remotePlay.openFirewall = true; # Open ports in the firewall for Steam Remote Play
dedicatedServer.openFirewall = true; # Open ports in the firewall for Source Dedicated Server dedicatedServer.openFirewall = true; # Open ports in the firewall for Source Dedicated Server
@ -120,9 +134,11 @@
services.desktopManager.plasma6.enable = true; services.desktopManager.plasma6.enable = true;
programs.kdeconnect.enable = true; programs.kdeconnect.enable = true;
services.xserver.displayManager.defaultSession = "plasmax11";
services.xserver.displayManager.sddm.wayland.enable = lib.mkForce false;
services.xserver.displayManager.sddm.settings = { services.xserver.displayManager.sddm.settings = {
Autologin = { Autologin = {
Session = "plasma.desktop"; Session = "plasmax11.desktop";
User = "lillian"; User = "lillian";
}; };
}; };
@ -144,6 +160,12 @@
networking.firewall.allowedTCPPorts = [22]; networking.firewall.allowedTCPPorts = [22];
# # Enable automounting of removable media
# services.udisks2.enable = true;
# services.devmon.enable = true;
# services.gvfs.enable = true;
# environment.variables.GIO_EXTRA_MODULES = lib.mkForce ["${pkgs.gvfs}/lib/gio/modules"];
# Set your time zone. # Set your time zone.
time.timeZone = "Europe/Amsterdam"; time.timeZone = "Europe/Amsterdam";
@ -175,7 +197,7 @@
enable = true; enable = true;
}; };
users.users.lillian.extraGroups = ["decky"]; users.users.lillian.extraGroups = ["decky" "tss" "input"];
# Enable completion of system packages by zsh # Enable completion of system packages by zsh
environment.pathsToLink = ["/share/zsh"]; environment.pathsToLink = ["/share/zsh"];
@ -190,12 +212,27 @@
networking.hostName = "shodan"; networking.hostName = "shodan";
boot.loader.systemd-boot.enable = true; security.tpm2.enable = true;
security.tpm2.pkcs11.enable = true; # expose /run/current-system/sw/lib/libtpm2_pkcs11.so
security.tpm2.tctiEnvironment.enable = true; # TPM2TOOLS_TCTI and TPM2_PKCS11_TCTI env variables
# tss group has access to TPM devices
# Lanzaboote currently replaces the systemd-boot module.
# This setting is usually set to true in configuration.nix
# generated at installation time. So we force it to false
# for now.
boot.loader.systemd-boot.enable = lib.mkForce false;
boot.initrd.systemd.enable = true;
boot.lanzaboote = {
enable = true;
pkiBundle = "/etc/secureboot";
};
boot.loader.systemd-boot.configurationLimit = 3; boot.loader.systemd-boot.configurationLimit = 3;
boot.loader.timeout = 0; boot.loader.timeout = 0;
boot.loader.efi.canTouchEfiVariables = true; boot.loader.efi.canTouchEfiVariables = true;
boot.consoleLogLevel = 0; boot.consoleLogLevel = 0;
boot.kernelParams = ["quiet" "udev.log_priority=0"]; boot.kernelParams = ["quiet" "udev.log_priority=0" "fbcon=vc:2-6" "console=tty0"];
boot.plymouth.enable = true; boot.plymouth.enable = true;
# https://nixos.wiki/wiki/FAQ/When_do_I_update_stateVersion # https://nixos.wiki/wiki/FAQ/When_do_I_update_stateVersion

View file

@ -17,20 +17,6 @@
boot.kernelModules = ["kvm-amd"]; boot.kernelModules = ["kvm-amd"];
boot.extraModulePackages = []; boot.extraModulePackages = [];
fileSystems."/" = {
device = "/dev/disk/by-uuid/b29d5a9c-a4a6-4321-a767-27ed928cfa94";
fsType = "ext4";
};
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/ABC6-B031";
fsType = "vfat";
};
swapDevices = [
{device = "/dev/disk/by-uuid/c0c87d80-b6be-444a-a76f-b32d35c38994";}
];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's # (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction # still possible to use this option, but it's recommended to use it in conjunction

View file

@ -1,4 +1,3 @@
pass: ENC[AES256_GCM,data:M7V75Q7I,iv:d59fWvFsEOOu8A+BSK0f2ZskX1SXHN1wA3EfGGsHp70=,tag:FLTogvUgI3HdKYWCJc/M1Q==,type:int]
lillian-password: ENC[AES256_GCM,data:uPNBvMyhkiX3eedduFlsFUIcas/VBVSYrsmGTlgGUOzTQST59CYZRoq0ArphIJ3+Usy6KbR5tA5FCp4PoB3qVYBfjlAq6dhZIw==,iv:TiUIo2lvdL6SiDuW4gWn0TeJXkz5MldzqGxuK3MNPnE=,tag:d3p/h+q50JxygDtk2qxIeQ==,type:str] lillian-password: ENC[AES256_GCM,data:uPNBvMyhkiX3eedduFlsFUIcas/VBVSYrsmGTlgGUOzTQST59CYZRoq0ArphIJ3+Usy6KbR5tA5FCp4PoB3qVYBfjlAq6dhZIw==,iv:TiUIo2lvdL6SiDuW4gWn0TeJXkz5MldzqGxuK3MNPnE=,tag:d3p/h+q50JxygDtk2qxIeQ==,type:str]
sops: sops:
kms: [] kms: []
@ -15,8 +14,8 @@ sops:
KzNBMCtUaS9sU21Xc1JUd1FSR29tSkEKyqaDM/WUWjK2l+ahE6sIFYsQ6Qtkf7yz KzNBMCtUaS9sU21Xc1JUd1FSR29tSkEKyqaDM/WUWjK2l+ahE6sIFYsQ6Qtkf7yz
NWFTzsDZBmm9kpSIjchf+PuBuoRHeEKbEH8jnMlYB3J8boEnUnXMlw== NWFTzsDZBmm9kpSIjchf+PuBuoRHeEKbEH8jnMlYB3J8boEnUnXMlw==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
lastmodified: "2024-02-22T12:17:27Z" lastmodified: "2024-03-19T00:42:59Z"
mac: ENC[AES256_GCM,data:JYOxnbBK2Uj/TH9Pc6gFf0xE82lD726Jm2R7fz4WYM3pAeYoeauRVU0YoxKhOHmAjAq9ZyHZVdWg3bSMMEz9ONz/F6LZiI5qegT+SO3uAPaTRwUa639G6RGO5b86LIRPuXBw5sdePeoxDt62rOiT6UhySK5XiEysEv5NyQFijlw=,iv:1pbuTtnRbaNKRn73NLZ+s3ZW2sGAc80tRd2QWTR4688=,tag:YndVhpjQC1aUBhmv7d/4+A==,type:str] mac: ENC[AES256_GCM,data:WuwpvgM5WCmtsb9WH6us1dn0+qQuV/6+ooI8K7Wp+VFlMWLA4g509TgOFHG+cxWJeN2cRtilnHM1INv1U6uadjWis0LrjrqbHaMRJ5aAr3/zKoTXWTG4pRNykoYmCkwHLnx0gJi6hm4PbKOIFVM+6V5m9JCLKRVO6eqyW15SVww=,iv:xVR5ZGs2Ww+J57qreIlHSW8A+ADAOjzM7B+KLRFrRLw=,tag:6KTaeX8+Txz4j1UJUWRj+w==,type:str]
pgp: [] pgp: []
unencrypted_suffix: _unencrypted unencrypted_suffix: _unencrypted
version: 3.8.1 version: 3.8.1

View file

@ -0,0 +1,45 @@
{
config,
pkgs,
inputs,
lib,
...
}: let
port = 2143;
configFile =
pkgs.writeText "config.json"
''
{
"defaultHomeserver": 0,
"homeserverList": [
"matrix.gladtherescake.eu"
],
"allowCustomHomeservers": false
}
'';
in {
virtualisation.oci-containers.containers."cinny" = {
autoStart = true;
ports = ["${toString port}:80"];
volumes = [
"${configFile}:/app/config.json"
];
image = "ajbura/cinny:latest";
};
services.nginx = {
enable = true;
virtualHosts = {
"cinny.gladtherescake.eu" = {
## Force HTTP redirect to HTTPS
forceSSL = true;
## LetsEncrypt
enableACME = true;
locations."/" = {
proxyPass = "http://localhost:${toString port}";
proxyWebsockets = true;
};
};
};
};
}

View file

@ -40,7 +40,10 @@ in {
settings.global = { settings.global = {
inherit server_name; inherit server_name;
database_backend = "sqlite"; database_backend = "rocksdb";
allow_registration = false;
turn_uris = ["turn:turn.gladtherescake.eu.url?transport=udp" "turn:turn.gladtherescake.eu?transport=tcp"];
turn_secret = "cPKWEn4Fo5TAJoE7iX3xeVOaMVE4afeRN1iRGWYfbkWbkaZMxTpnmazHyH6c6yXT";
}; };
}; };

View file

@ -0,0 +1,48 @@
{
config,
pkgs,
...
}: {
sops.secrets."coturn-auth-secret".mode = "0440";
sops.secrets."coturn-auth-secret".owner = config.users.users.turnserver.name;
users.users.nginx.extraGroups = ["turnserver"];
services.coturn = {
enable = true;
use-auth-secret = true;
static-auth-secret = "cPKWEn4Fo5TAJoE7iX3xeVOaMVE4afeRN1iRGWYfbkWbkaZMxTpnmazHyH6c6yXT";
realm = "turn.gladtherescake.eu";
relay-ips = [
"62.171.160.195"
"2a02:c207:2063:2448::1"
];
extraConfig = "
cipher-list=\"HIGH\"
no-loopback-peers
no-multicast-peers
";
secure-stun = true;
cert = "/var/lib/acme/turn.gladtherescake.eu/fullchain.pem";
pkey = "/var/lib/acme/turn.gladtherescake.eu/key.pem";
min-port = 49152;
max-port = 49999;
};
# setup certs
services.nginx = {
enable = true;
virtualHosts = {
"turn.gladtherescake.eu" = {
forceSSL = true;
enableACME = true;
};
};
};
# share certs with coturn and restart on renewal
security.acme.certs = {
"turn.gladtherescake.eu" = {
group = "turnserver";
postRun = "systemctl reload nginx.service; systemctl restart coturn.service";
};
};
}

View file

@ -0,0 +1,15 @@
{
inputs,
outputs,
lib,
config,
pkgs,
...
}: {
imports = [
./grafana
#./loki
./prometheus
./telegraf
];
}

View file

@ -0,0 +1,48 @@
{
config,
pkgs,
...
}: {
# grafana configuration
services.grafana = {
enable = true;
settings.server = {
domain = "grafana.lillianviolet.dev";
http_port = 2342;
http_addr = "127.0.0.1";
};
provision = {
datasources.settings = {
apiVersion = 1;
datasources = [
{
name = "Prometheus";
type = "prometheus";
access = "proxy";
url = "http://localhost:${toString config.services.prometheus.port}";
isDefault = true;
}
# {
# name = "Loki";
# type = "loki";
# access = "proxy";
# url = "http://localhost:${config.services.loki.port}";
# isDefault = true;
# }
];
};
};
};
# nginx reverse proxy
services.nginx.virtualHosts.${config.services.grafana.settings.server.domain} = {
## Force HTTP redirect to HTTPS
forceSSL = true;
## LetsEncrypt
enableACME = true;
locations."/" = {
proxyPass = "http://${toString config.services.grafana.settings.server.http_addr}:${toString config.services.grafana.settings.server.http_port}";
proxyWebsockets = true;
};
};
}

View file

@ -0,0 +1,10 @@
{
config,
pkgs,
...
}: {
services.loki = {
enable = true;
configFile = ./loki.yaml;
};
}

View file

@ -0,0 +1,40 @@
# Enables authentication through the X-Scope-OrgID header, which must be present
# if true. If false, the OrgID will always be set to "fake".
auth_enabled: false
server:
http_listen_address: "0.0.0.0"
http_listen_port: 3100
ingester:
lifecycler:
address: "127.0.0.1"
ring:
kvstore:
store: inmemory
replication_factor: 1
final_sleep: 0s
chunk_idle_period: 5m
chunk_retain_period: 30s
schema_config:
configs:
- from: 2020-05-15
store: boltdb
object_store: filesystem
schema: v11
index:
prefix: index_
period: 168h
storage_config:
boltdb:
directory: /tmp/loki/index
filesystem:
directory: /tmp/loki/chunks
limits_config:
enforce_metric_name: false
reject_old_samples: true
reject_old_samples_max_age: 168h

View file

@ -0,0 +1,38 @@
{
config,
pkgs,
...
}: {
services.prometheus = {
enable = true;
port = 9001;
# Export the current system metrics
exporters = {
node = {
enable = true;
enabledCollectors = ["systemd"];
port = 9002;
};
};
scrapeConfigs = [
# Scrape the current system
{
job_name = "GrafanaService system";
static_configs = [
{
targets = ["127.0.0.1:9002"];
}
];
}
# Scrape the Loki service
# {
# job_name = "Loki service";
# static_configs = [
# {
# targets = ["127.0.0.1:3100"];
# }
# ];
# }
];
};
}

View file

@ -0,0 +1,56 @@
{
inputs,
lib,
config,
pkgs,
user,
...
}: {
sops.secrets."grafana-telegraf-key".mode = "0440";
sops.secrets."grafana-telegraf-key".owner = config.users.users.telegraf.name;
services.telegraf = {
enable = true;
extraConfig = {
agent = {
interval = "10s";
round_interval = true;
metric_batch_size = 1000;
metric_buffer_limit = 10000;
collection_jitter = "0s";
flush_interval = "10s";
flush_jitter = "0s";
precision = "";
debug = false;
quiet = false;
logfile = "";
hostname = "queen";
omit_hostname = false;
};
inputs = {
cpu = {
percpu = true;
totalcpu = true;
collect_cpu_time = false;
report_active = false;
core_tags = false;
};
disk = {
ignore_fs = ["tmpfs" "devtmpfs" "devfs" "overlay" "aufs" "squashfs"];
};
diskio = {};
kernel = {};
mem = {};
system = {};
};
outputs = {
websocket = {
url = "ws://localhost:${toString config.services.prometheus.port}/api/live/push/telegraf";
data_format = "influx";
headers = {
Authorisation = "Bearer glsa_lqpcKV34Pp0d7eIhKN79E2HTwzWWwN4m_fe64e398";
};
};
};
};
};
}

View file

@ -14,5 +14,9 @@
./nextcloud ./nextcloud
./postgres ./postgres
./roundcube ./roundcube
./coturn
./dashboard
./cinny
./firefox-sync
]; ];
} }

View file

@ -0,0 +1,30 @@
{
config,
pkgs,
...
}: let
port = 5126;
in {
sops.secrets."sync-secrets".mode = "0440";
sops.secrets."sync-secrets".owner = config.users.users.firefox-syncserver.name;
users.groups.firefox-syncserver = {};
users.users.firefox-syncserver = {
isSystemUser = true;
group = "firefox-syncserver";
extraGroups = [config.users.groups.keys.name];
};
services.mysql.package = pkgs.mariadb;
services.firefox-syncserver = {
enable = true;
secrets = config.sops.secrets."sync-secrets".path;
singleNode = {
enable = true;
hostname = "sync.gladtherescake.eu";
url = "http://localhost:${toString port}";
enableNginx = true;
enableTLS = true;
};
};
}

View file

@ -26,6 +26,7 @@
# System tools # System tools
age age
alejandra alejandra
e2fsprogs
git git
git-filter-repo git-filter-repo
home-manager home-manager

View file

@ -1,5 +1,14 @@
# This file defines overlays # This file defines overlays
{inputs, ...}: { {inputs, ...}: {
# This one contains whatever you want to overlay
# You can change versions, add patches, set compilation flags, anything really.
# https://nixos.wiki/wiki/Overlays
modifications = final: prev: {
steam = prev.steam.override {
extraProfile = ''export LD_PRELOAD=${inputs.extest}/lib/libextest.so:$LD_PRELOAD'';
};
};
# This one brings our custom packages from the 'pkgs' directory # This one brings our custom packages from the 'pkgs' directory
additions = final: _prev: additions = final: _prev:
import ../pkgs { import ../pkgs {
@ -7,15 +16,6 @@
pkgs = final; pkgs = final;
}; };
# This one contains whatever you want to overlay
# You can change versions, add patches, set compilation flags, anything really.
# https://nixos.wiki/wiki/Overlays
modifications = final: prev: {
# example = prev.example.overrideAttrs (oldAttrs: rec {
# ...
# });
};
# When applied, the stable nixpkgs set (declared in the flake inputs) will # When applied, the stable nixpkgs set (declared in the flake inputs) will
# be accessible through 'pkgs.stable' # be accessible through 'pkgs.stable'
pkg-sets = ( pkg-sets = (

247
pkgs/auto-mount/default.nix Normal file
View file

@ -0,0 +1,247 @@
{
lib,
stdenv,
system,
pkgs,
jq,
coreutils,
udisks,
toybox,
util-linux,
writeShellApplication,
}:
writeShellApplication
{
# Originally from: https://github.com/scawp/Steam-Deck.Mount-External-Drive/
name = "auto-mount";
runtimeInputs = [jq coreutils udisks util-linux toybox pkgs.steam pkgs.extest];
text = ''
set -euo pipefail
# Originally from https://serverfault.com/a/767079
# This script is called from our systemd unit file to mount or unmount
# a USB drive.
usage()
{
echo "Usage: $0 {add|remove} device_name (e.g. sdb1)"
exit 1
}
if [[ $# -ne 2 ]]; then
usage
fi
ACTION=$1
DEVBASE=$2
DEVICE="/dev/''${DEVBASE}"
# Shared between this and the auto-mount script to ensure we're not double-triggering nor automounting while formatting
# or vice-versa.
MOUNT_LOCK="/home/lillian/lock/jupiter-automount-''${DEVBASE//\/_}.lock"
# Obtain lock
exec 9<>"$MOUNT_LOCK"
if ! flock -n 9; then
echo "$MOUNT_LOCK is active: ignoring action $ACTION"
# Do not return a success exit code: it could end up putting the service in 'started' state without doing the mount
# work (further start commands will be ignored after that)
exit 1
fi
# Wait N seconds for steam
wait_steam()
{
local i=0
local wait=$1
echo "Waiting up to $wait seconds for steam to load"
while ! pgrep -x steamwebhelper &>/dev/null && (( i++ < wait )); do
sleep 1
done
}
send_steam_url()
{
local command
command="$1"
local arg
arg="$2"
local encoded
encoded=$(urlencode "$arg")
if pgrep -x "steam" > /dev/null; then
# TODO use -ifrunning and check return value - if there was a steam process and it returns -1, the message wasn't sent
# need to retry until either steam process is gone or -ifrunning returns 0, or timeout i guess
echo "Sent URL to steam: steam://''${command}/''${arg} (steam://''${command}/''${encoded})" >> /home/lillian/steam.txt
systemd-run -M 1000@ --user --collect --wait sh -c "export LD_PRELOAD=${pkgs.extest}/lib/libextest.so:$LD_PRELOAD ${pkgs.steam}/bin/steam steam://''${command}/''${encoded@Q}"
else
echo "Could not send steam URL steam://''${command}/''${arg} (steam://''${command}/''${encoded}) -- steam not running"
fi
}
# From https://gist.github.com/HazCod/da9ec610c3d50ebff7dd5e7cac76de05
urlencode()
{
[ -z "$1" ] || echo -n "$@" | hexdump -v -e '/1 "%02x"' | sed 's/\(..\)/%\1/g'
}
do_mount()
{
declare -i ret
# NOTE: these values are ABI, since they are sent to the Steam client
# shellcheck disable=SC2034
readonly FSCK_ERROR=1
# shellcheck disable=SC2034
readonly MOUNT_ERROR=2
# Get info for this drive: $ID_FS_LABEL, and $ID_FS_TYPE
dev_json=$(lsblk -o PATH,LABEL,FSTYPE --json -- "$DEVICE" | jq '.blockdevices[0]')
ID_FS_LABEL=$(jq -r '.label | select(type == "string")' <<< "$dev_json")
ID_FS_TYPE=$(jq -r '.fstype | select(type == "string")' <<< "$dev_json")
# Global mount options
OPTS="rw,noatime"
# File system type specific mount options
#if [[ ''${ID_FS_TYPE} == "vfat" ]]; then
# OPTS+=",users,gid=100,umask=000,shortname=mixed,utf8=1,flush"
#fi
case "''${ID_FS_TYPE}" in
"ntfs")
echo "FSType is NTFS"
#Extra Opts don't seem necessary anymore? add if required
#OPTS+=""
;;
"exfat")
echo "FSType is exFat"
#OPTS+=",users,gid=100,umask=000,shortname=mixed,utf8=1,flush"
;;
"btrfs")
echo "FSType is btrfs"
;;
"ext4")
echo "FSType is ext4"
#exit 2
;;
*)
echo "Error mounting ''${DEVICE}: unsupported fstype: ''${ID_FS_TYPE} - ''${dev_json}"
rm "''${MOUNT_LOCK}"
exit 2
;;
esac
# Prior to talking to udisks, we need all udev hooks (we were started by one) to finish, so we know it has knowledge
# of the drive. Our own rule starts us as a service with --no-block, so we can wait for rules to settle here
# safely.
#if ! udevadm settle; then
# echo "Failed to wait for \`udevadm settle\`"
# exit 1
#fi
# Ask udisks to auto-mount. This needs a version of udisks that supports the 'as-user' option.
ret=0
reply=$(busctl call --allow-interactive-authorization=false --expect-reply=true --json=short \
org.freedesktop.UDisks2 \
/org/freedesktop/UDisks2/block_devices/"''${DEVBASE}" \
org.freedesktop.UDisks2.Filesystem \
Mount 'a{sv}' 3 \
as-user s lillian \
auth.no_user_interaction b true \
options s "$OPTS") || ret=$?
if (( ret != 0 )); then
# send_steam_url "system/devicemountresult" "''${DEVBASE}/''${MOUNT_ERROR}"
echo "Error mounting ''${DEVICE} (status = $ret)"
exit 1
fi
# Expected reply is of the format
# {"type":"s","data":["/run/media/lillian/home"]}
mount_point=$(jq -r '.data[0] | select(type == "string")' <<< "$reply" || true)
if [[ -z $mount_point ]]; then
echo "Error when mounting ''${DEVICE}: udisks returned success but could not parse reply:"
echo "---"$'\n'"$reply"$'\n'"---"
exit 1
fi
if [[ ''${ID_FS_TYPE} == "exfat" ]]; then
echo "exFat does not support symlinks, do not add library to Steam"
exit 0
fi
# Create a symlink from /run/media to keep compatibility with apps
# that use the older mount point (for SD cards only).
case "''${DEVBASE}" in
mmcblk0p*)
if [[ -z "''${ID_FS_LABEL}" ]]; then
old_mount_point="/run/media/''${DEVBASE}"
else
old_mount_point="/run/media/''${mount_point##*/}"
fi
if [[ ! -d "''${old_mount_point}" ]]; then
rm -f -- "''${old_mount_point}"
ln -s -- "''${mount_point}" "''${old_mount_point}"
fi
;;
esac
echo "**** Mounted ''${DEVICE} at ''${mount_point} ****"
if [ -f "''${mount_point}/libraryfolder.vdf" ]; then
echo " send_steam_url \"addlibraryfolder\" \"''${mount_point}\""
# send_steam_url "addlibraryfolder" "''${mount_point}"
else
#TODO check permissions are 1000 when creating new SteamLibrary
mkdir -p "''${mount_point}/SteamLibrary"
chown lillian:users "''${mount_point}/SteamLibrary"
# send_steam_url "addlibraryfolder" "''${mount_point}/SteamLibrary"
fi
}
do_unmount()
{
local mount_point
mount_point=$(findmnt -fno TARGET "''${DEVICE}" || true)
if [[ -n $mount_point ]]; then
# Remove symlink to the mount point that we're unmounting
find /run/media -maxdepth 1 -xdev -type l -lname "''${mount_point}" -exec rm -- {} \;
else
# If we don't know the mount point then remove all broken symlinks
find /run/media -maxdepth 1 -xdev -xtype l -exec rm -- {} \;
fi
}
do_retrigger()
{
local mount_point
mount_point=$(findmnt -fno TARGET "''${DEVICE}" || true)
[[ -n $mount_point ]] || return 0
# In retrigger mode, we want to wait a bit for steam as the common pattern is starting in parallel with a retrigger
wait_steam 10
# This is a truly gnarly way to ensure steam is ready for commands.
# TODO literally anything else
sleep 6
# send_steam_url "addlibraryfolder" "''${mount_point}"
}
case "''${ACTION}" in
add)
do_mount
;;
remove)
do_unmount
;;
retrigger)
do_retrigger
;;
*)
usage
;;
esac
'';
}

View file

@ -12,4 +12,5 @@ pkgs: {
upgrade = pkgs.callPackage ./upgrade {}; upgrade = pkgs.callPackage ./upgrade {};
restart = pkgs.callPackage ./restart {}; restart = pkgs.callPackage ./restart {};
phanpy = pkgs.callPackage ./phanpy {}; phanpy = pkgs.callPackage ./phanpy {};
auto-mount = pkgs.callPackage ./auto-mount {};
} }

202
pkgs/fcast/default.nix Normal file
View file

@ -0,0 +1,202 @@
{
lib,
buildNpmPackage,
cargo,
copyDesktopItems,
dbus,
electron_28,
fetchFromGitLab,
glib,
gnome,
gtk3,
jq,
libsecret,
makeDesktopItem,
makeWrapper,
moreutils,
napi-rs-cli,
nodejs_18,
patchutils_0_4_2,
pkg-config,
python3,
runCommand,
rustc,
rustPlatform,
}: let
description = "A secure and free password manager for all of your devices";
icon = "bitwarden";
electron = electron_28;
in
buildNpmPackage rec {
pname = "bitwarden-desktop";
version = "2024.3.0";
src = fetchFromGitLab {
owner = "videostreaming";
repo = "fcast";
rev = "b13d0f7e8150c279d377a78f89d338b7fc0f5539";
hash = "sha256-XEZB95GnfSy/wtTWpF8KlUQwyephUZmSLtbOwbcvd7g=";
};
patches = [
./electron-builder-package-lock.patch
];
# The nested package-lock.json from upstream is out-of-date, so copy the
# lock metadata from the root package-lock.json.
postPatch = ''
cat {,apps/desktop/src/}package-lock.json \
| ${lib.getExe jq} -s '
.[1].packages."".dependencies.argon2 = .[0].packages."".dependencies.argon2
| .[0].packages."" = .[1].packages.""
| .[1].packages = .[0].packages
| .[1]
' \
| ${moreutils}/bin/sponge apps/desktop/src/package-lock.json
'';
nodejs = nodejs_18;
makeCacheWritable = true;
npmFlags = ["--legacy-peer-deps"];
npmWorkspace = "apps/desktop";
npmDepsHash = "sha256-EpZXA+GkmHl5eqwIPTGHJZqrpr6k8gXneJG+GXumlkc=";
cargoDeps = rustPlatform.fetchCargoTarball {
name = "${pname}-${version}";
inherit src;
patches =
map
(
patch:
runCommand
(builtins.baseNameOf patch)
{nativeBuildInputs = [patchutils_0_4_2];}
''
< ${patch} filterdiff -p1 --include=${lib.escapeShellArg cargoRoot}'/*' > $out
''
)
patches;
patchFlags = ["-p4"];
sourceRoot = "${src.name}/${cargoRoot}";
hash = "sha256-qAqEFlUzT28fw6kLB8d7U8yXWevAU+q03zjN2xWsGyI=";
};
cargoRoot = "apps/desktop/desktop_native";
env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
nativeBuildInputs = [
cargo
copyDesktopItems
jq
makeWrapper
moreutils
napi-rs-cli
pkg-config
python3
rustc
rustPlatform.cargoCheckHook
rustPlatform.cargoSetupHook
];
buildInputs = [
glib
gtk3
libsecret
];
preBuild = ''
if [[ $(jq --raw-output '.devDependencies.electron' < package.json | grep -E --only-matching '^[0-9]+') != ${lib.escapeShellArg (lib.versions.major electron.version)} ]]; then
echo 'ERROR: electron version mismatch'
exit 1
fi
'';
postBuild = ''
pushd apps/desktop
# desktop_native/index.js loads a file of that name regarldess of the libc being used
mv desktop_native/desktop_native.* desktop_native/desktop_native.linux-x64-musl.node
npm exec electron-builder -- \
--dir \
-c.electronDist=${electron}/libexec/electron \
-c.electronVersion=${electron.version}
popd
'';
doCheck = true;
nativeCheckInputs = [
dbus
(gnome.gnome-keyring.override {useWrappedDaemon = false;})
];
checkFlags = [
"--skip=password::password::tests::test"
];
checkPhase = ''
runHook preCheck
pushd ${cargoRoot}
export HOME=$(mktemp -d)
export -f cargoCheckHook runHook _eval _callImplicitHook
export cargoCheckType=release
dbus-run-session \
--config-file=${dbus}/share/dbus-1/session.conf \
-- bash -e -c cargoCheckHook
popd
runHook postCheck
'';
installPhase = ''
runHook preInstall
mkdir $out
pushd apps/desktop/dist/linux-unpacked
mkdir -p $out/opt/Bitwarden
cp -r locales resources{,.pak} $out/opt/Bitwarden
popd
makeWrapper '${electron}/bin/electron' "$out/bin/bitwarden" \
--add-flags $out/opt/Bitwarden/resources/app.asar \
--add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
--set-default ELECTRON_IS_DEV 0 \
--inherit-argv0
pushd apps/desktop/resources/icons
for icon in *.png; do
dir=$out/share/icons/hicolor/"''${icon%.png}"/apps
mkdir -p "$dir"
cp "$icon" "$dir"/${icon}.png
done
popd
runHook postInstall
'';
desktopItems = [
(makeDesktopItem {
name = "bitwarden";
exec = "bitwarden %U";
inherit icon;
comment = description;
desktopName = "Bitwarden";
categories = ["Utility"];
})
];
meta = {
changelog = "https://github.com/bitwarden/clients/releases/tag/${src.rev}";
inherit description;
homepage = "https://bitwarden.com";
license = lib.licenses.gpl3;
maintainers = with lib.maintainers; [amarshall kiwi];
platforms = ["x86_64-linux"];
mainProgram = "bitwarden";
};
}

View file

@ -1,20 +1,22 @@
{ {
lib, lib,
stdenv, stdenv,
git,
gum,
writeShellApplication, writeShellApplication,
}: }:
writeShellApplication writeShellApplication
{ {
name = "install-nix-no-inhibit"; name = "install-nix-no-inhibit";
runtimeInputs = []; runtimeInputs = [git gum];
text = '' text = ''
# An install script for NixOS installation to /tmp # An install script for NixOS installation to /tmp
set -e set -e
pushd /tmp > /dev/null pushd /tmp > /dev/null
systemd-inhibit --what=idle rm -rf ./install-nix rm -rf ./install-nix
systemd-inhibit --what=idle git clone https://git.lillianviolet.dev/Lillian-Violet/NixOS-Config.git ./install-nix git clone https://git.lillianviolet.dev/Lillian-Violet/NixOS-Config.git ./install-nix
pushd ./install-nix/nixos/hosts > /dev/null pushd ./install-nix/nixos/hosts > /dev/null
echo "Please choose the hostname you are installing to from the following list:" echo "Please choose the hostname you are installing to from the following list:"
i=1 i=1
@ -25,11 +27,21 @@ writeShellApplication
select dir in "''${dirs[@]}"; do echo "you selected ''${dir}"; break; done select dir in "''${dirs[@]}"; do echo "you selected ''${dir}"; break; done
popd > /dev/null popd > /dev/null
pushd ./install-nix > /dev/null pushd ./install-nix > /dev/null
gum confirm --default=false \
"🔥 🔥 🔥 WARNING!!!! This will ERASE ALL DATA on the disk for ''${dir}. Are you sure you want to continue?"
echo "Partitioning Disks"
sudo nix run github:nix-community/disko \
--extra-experimental-features "nix-command flakes" \
--no-write-lock-file \
-- \
--mode zap_create_mount \
"./disko/''${dir}/default.nix"
echo "NixOS Installing..." echo "NixOS Installing..."
systemd-inhibit --what=idle sudo nixos-install --flake .#"''${dir}" sudo nixos-install --flake .#"''${dir}"
popd > /dev/null popd > /dev/null
echo "Cleaning up repository in '/tmp/install-nix'..." echo "Cleaning up repository in '/tmp/install-nix'..."
systemd-inhibit --what=idle rm -rf ./install-nix rm -rf ./install-nix
popd > /dev/null popd > /dev/null
echo "NixOS Install Succeeded!" echo "NixOS Install Succeeded!"
''; '';

View file

@ -18,9 +18,9 @@ writeShellApplication
pushd ./update > /dev/null pushd ./update > /dev/null
echo "Updating flake lock..." echo "Updating flake lock..."
nix flake update nix flake update
git add flake.lock git stage ./flake.lock
sudo nix flake check
git commit -m "update flake lock" git commit -m "update flake lock"
sudo nix flake check
git push git push
popd > /dev/null popd > /dev/null
echo "Cleaning up repository in '/tmp/update'..." echo "Cleaning up repository in '/tmp/update'..."

1
result Symbolic link
View file

@ -0,0 +1 @@
/nix/store/a9kdf62qv1r5s0nb40a1ij9lm2vsh418-nixos-24.05.20240319.b06025f-x86_64-linux.iso