chore: reformat
This commit is contained in:
parent
b638c4125b
commit
1402ee13cc
57 changed files with 845 additions and 466 deletions
24
checks.nix
24
checks.nix
|
|
@ -1,20 +1,20 @@
|
|||
{ self
|
||||
, flake-utils
|
||||
, nixpkgs
|
||||
, ...
|
||||
{
|
||||
self,
|
||||
flake-utils,
|
||||
nixpkgs,
|
||||
...
|
||||
}:
|
||||
(flake-utils.lib.eachDefaultSystem (system:
|
||||
(flake-utils.lib.eachDefaultSystem (
|
||||
system:
|
||||
let
|
||||
pkgs = nixpkgs.legacyPackages.${system};
|
||||
formatter = self.formatter.${system};
|
||||
in
|
||||
{
|
||||
checks = {
|
||||
format = pkgs.runCommand
|
||||
"check-format"
|
||||
{
|
||||
buildInputs = [ formatter ];
|
||||
}
|
||||
"${formatter}/bin/nixpkgs-fmt --check ${./.} && touch $out";
|
||||
format = pkgs.runCommand "check-format" {
|
||||
buildInputs = [ formatter ];
|
||||
} "${formatter}/bin/nixpkgs-fmt --check ${./.} && touch $out";
|
||||
};
|
||||
})).checks
|
||||
}
|
||||
)).checks
|
||||
|
|
|
|||
|
|
@ -40,5 +40,5 @@
|
|||
};
|
||||
};
|
||||
|
||||
outputs = { ... } @ args: import ./outputs.nix args;
|
||||
outputs = { ... }@args: import ./outputs.nix args;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -33,8 +33,20 @@ with lib.hm.gvariant;
|
|||
current = mkUint32 0;
|
||||
per-window = false;
|
||||
show-all-sources = true;
|
||||
sources = [ (mkTuple [ "xkb" "eu" ]) (mkTuple [ "xkb" "de" ]) ];
|
||||
xkb-options = [ "lv3:ralt_switch" "caps:escape" ];
|
||||
sources = [
|
||||
(mkTuple [
|
||||
"xkb"
|
||||
"eu"
|
||||
])
|
||||
(mkTuple [
|
||||
"xkb"
|
||||
"de"
|
||||
])
|
||||
];
|
||||
xkb-options = [
|
||||
"lv3:ralt_switch"
|
||||
"caps:escape"
|
||||
];
|
||||
};
|
||||
|
||||
"org/gnome/desktop/interface" = {
|
||||
|
|
@ -127,7 +139,10 @@ with lib.hm.gvariant;
|
|||
composer-attribution-language = "de_DE";
|
||||
composer-reply-start-bottom = false;
|
||||
composer-signature-in-new-only = true;
|
||||
composer-spell-languages = [ "de" "en_US" ];
|
||||
composer-spell-languages = [
|
||||
"de"
|
||||
"en_US"
|
||||
];
|
||||
composer-top-signature = false;
|
||||
composer-unicode-smileys = false;
|
||||
composer-visually-wrap-long-lines = true;
|
||||
|
|
|
|||
|
|
@ -1,8 +1,13 @@
|
|||
{ lib, ... }:
|
||||
with lib; let
|
||||
modules' = dir: filterAttrs (name: type: (hasSuffix ".nix" name) || (type == "directory"))
|
||||
(builtins.readDir dir);
|
||||
modules = dir: mapAttrs' (name: _: nameValuePair (removeSuffix ".nix" name) (import (dir + "/${name}")))
|
||||
(modules' dir);
|
||||
with lib;
|
||||
let
|
||||
modules' =
|
||||
dir:
|
||||
filterAttrs (name: type: (hasSuffix ".nix" name) || (type == "directory")) (builtins.readDir dir);
|
||||
modules =
|
||||
dir:
|
||||
mapAttrs' (name: _: nameValuePair (removeSuffix ".nix" name) (import (dir + "/${name}"))) (
|
||||
modules' dir
|
||||
);
|
||||
in
|
||||
(modules ./modules)
|
||||
|
|
|
|||
|
|
@ -1,9 +1,11 @@
|
|||
{ pkgs
|
||||
, lib
|
||||
, config
|
||||
, ...
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
with lib;
|
||||
let
|
||||
cfg = config.dadada.home.alacritty;
|
||||
in
|
||||
{
|
||||
|
|
|
|||
|
|
@ -1,8 +1,10 @@
|
|||
{ config
|
||||
, lib
|
||||
, ...
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
with lib; {
|
||||
with lib;
|
||||
{
|
||||
options.dadada.home.colors = mkOption {
|
||||
type = types.attrs;
|
||||
description = "Color scheme";
|
||||
|
|
|
|||
|
|
@ -1,9 +1,11 @@
|
|||
{ config
|
||||
, pkgs
|
||||
, lib
|
||||
, ...
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
with lib;
|
||||
let
|
||||
cfg = config.dadada.home.direnv;
|
||||
in
|
||||
{
|
||||
|
|
|
|||
|
|
@ -1,9 +1,11 @@
|
|||
{ config
|
||||
, lib
|
||||
, pkgs
|
||||
, ...
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
with lib;
|
||||
let
|
||||
cfg = config.dadada.home.git;
|
||||
allowedSigners = pkgs.writeTextFile {
|
||||
name = "allowed-signers";
|
||||
|
|
|
|||
|
|
@ -1,8 +1,10 @@
|
|||
{ config
|
||||
, lib
|
||||
, ...
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
with lib;
|
||||
let
|
||||
cfg = config.dadada.home.gpg;
|
||||
in
|
||||
{
|
||||
|
|
|
|||
|
|
@ -1,9 +1,11 @@
|
|||
{ config
|
||||
, lib
|
||||
, pkgs
|
||||
, ...
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
with lib;
|
||||
let
|
||||
cfg = config.dadada.home.gtk;
|
||||
in
|
||||
{
|
||||
|
|
|
|||
|
|
@ -1,4 +1,9 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.dadada.home.helix;
|
||||
in
|
||||
|
|
|
|||
|
|
@ -1,8 +1,10 @@
|
|||
{ config
|
||||
, lib
|
||||
, ...
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
with lib;
|
||||
let
|
||||
cfg = config.dadada.home.keyring;
|
||||
in
|
||||
{
|
||||
|
|
|
|||
|
|
@ -1,8 +1,10 @@
|
|||
{ config
|
||||
, lib
|
||||
, ...
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
with lib;
|
||||
let
|
||||
cfg = config.dadada.home.session;
|
||||
in
|
||||
{
|
||||
|
|
|
|||
|
|
@ -1,8 +1,10 @@
|
|||
{ config
|
||||
, lib
|
||||
, ...
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
with lib;
|
||||
let
|
||||
cfg = config.dadada.home.ssh;
|
||||
in
|
||||
{
|
||||
|
|
|
|||
|
|
@ -1,9 +1,11 @@
|
|||
{ config
|
||||
, pkgs
|
||||
, lib
|
||||
, ...
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
with lib;
|
||||
let
|
||||
cfg = config.dadada.home.syncthing;
|
||||
in
|
||||
{
|
||||
|
|
|
|||
|
|
@ -1,8 +1,10 @@
|
|||
{ config
|
||||
, lib
|
||||
, ...
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
with lib;
|
||||
let
|
||||
cfg = config.dadada.home.tmux;
|
||||
in
|
||||
{
|
||||
|
|
|
|||
|
|
@ -1,9 +1,11 @@
|
|||
{ config
|
||||
, pkgs
|
||||
, lib
|
||||
, ...
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
with lib;
|
||||
let
|
||||
apps = {
|
||||
"x-scheme-handler/mailto" = "evolution.desktop";
|
||||
"message/rfc822" = "evolution.desktop";
|
||||
|
|
|
|||
|
|
@ -1,9 +1,11 @@
|
|||
{ config
|
||||
, pkgs
|
||||
, lib
|
||||
, ...
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
with lib;
|
||||
let
|
||||
cfg = config.dadada.home.zsh;
|
||||
in
|
||||
{
|
||||
|
|
@ -45,8 +47,7 @@ in
|
|||
PROMPT="%F{red}%?%f %F{green}%m%f:%F{blue}%~%f"$'\n'"╰─> "
|
||||
RPROMPT='$(git_super_status)'
|
||||
'';
|
||||
profileExtra = ''
|
||||
'';
|
||||
profileExtra = '''';
|
||||
shellAliases = {
|
||||
ga = "git add";
|
||||
gc = "git commit";
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
{ pkgs }: {
|
||||
{ pkgs }:
|
||||
{
|
||||
allowUnfree = true;
|
||||
allowUnfreePredicate = pkg: true;
|
||||
allowBroken = false;
|
||||
|
|
|
|||
|
|
@ -1,5 +1,6 @@
|
|||
{ pkgs }:
|
||||
with pkgs; [
|
||||
with pkgs;
|
||||
[
|
||||
anki
|
||||
aqbanking
|
||||
aria2
|
||||
|
|
@ -105,7 +106,10 @@ with pkgs; [
|
|||
prusa-slicer
|
||||
pv
|
||||
pwgen
|
||||
(python3.withPackages (pkgs: [pkgs.pandas pkgs.requests]))
|
||||
(python3.withPackages (pkgs: [
|
||||
pkgs.pandas
|
||||
pkgs.requests
|
||||
]))
|
||||
ranger
|
||||
reptyr
|
||||
ripgrep
|
||||
|
|
|
|||
|
|
@ -1,5 +1,4 @@
|
|||
{ self, nixpkgs, ... }:
|
||||
(nixpkgs.lib.mapAttrs'
|
||||
(name: config: nixpkgs.lib.nameValuePair name config.config.system.build.toplevel)
|
||||
self.nixosConfigurations
|
||||
)
|
||||
(nixpkgs.lib.mapAttrs' (
|
||||
name: config: nixpkgs.lib.nameValuePair name config.config.system.build.toplevel
|
||||
) self.nixosConfigurations)
|
||||
|
|
|
|||
|
|
@ -1,7 +1,8 @@
|
|||
{ config
|
||||
, modulesPath
|
||||
, pkgs
|
||||
, ...
|
||||
{
|
||||
config,
|
||||
modulesPath,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = [
|
||||
|
|
@ -30,7 +31,10 @@
|
|||
fileSystems."/swap" = {
|
||||
device = "/dev/sda1";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=/root/swap" "noatime" ];
|
||||
options = [
|
||||
"subvol=/root/swap"
|
||||
"noatime"
|
||||
];
|
||||
};
|
||||
|
||||
#swapDevices = [{
|
||||
|
|
@ -49,7 +53,14 @@
|
|||
networking.hostName = "agares";
|
||||
networking.domain = "bs.dadada.li";
|
||||
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "ehci_pci" "usb_storage" "sd_mod" "sdhci_pci" ];
|
||||
boot.initrd.availableKernelModules = [
|
||||
"xhci_pci"
|
||||
"ahci"
|
||||
"ehci_pci"
|
||||
"usb_storage"
|
||||
"sd_mod"
|
||||
"sdhci_pci"
|
||||
];
|
||||
boot.initrd.kernelModules = [ "dm-snapshot" ];
|
||||
|
||||
# Use the GRUB 2 boot loader.
|
||||
|
|
|
|||
|
|
@ -66,7 +66,10 @@
|
|||
];
|
||||
stub-zone =
|
||||
let
|
||||
stubZone = name: addrs: { name = "${name}"; stub-addr = addrs; };
|
||||
stubZone = name: addrs: {
|
||||
name = "${name}";
|
||||
stub-addr = addrs;
|
||||
};
|
||||
in
|
||||
[
|
||||
#(stubZone "li.dadada.bs" ["192.168.128.220" "2a01:4f8:c010:a710::1"])
|
||||
|
|
|
|||
|
|
@ -10,7 +10,10 @@ in
|
|||
enable = true;
|
||||
links = {
|
||||
"10-persistent" = {
|
||||
matchConfig.OriginalName = [ "enp1s0" "enp2s0" ]; # takes search domains from the [Network]
|
||||
matchConfig.OriginalName = [
|
||||
"enp1s0"
|
||||
"enp2s0"
|
||||
]; # takes search domains from the [Network]
|
||||
linkConfig.MACAddressPolicy = "persistent";
|
||||
};
|
||||
};
|
||||
|
|
@ -49,19 +52,21 @@ in
|
|||
PrivateKeyFile = config.age.secrets."wg-privkey-vpn-dadada-li".path;
|
||||
ListenPort = 51234;
|
||||
};
|
||||
wireguardPeers = [{
|
||||
wireguardPeerConfig =
|
||||
let
|
||||
peerAddresses = i: [
|
||||
"${ipv4Prefix}.120.${i}/32"
|
||||
"${ulaPrefix}:120::${i}/128"
|
||||
];
|
||||
in
|
||||
{
|
||||
PublicKey = "0eWP1hzkyoXlrjPSOq+6Y1u8tnFH+SejBJs8f8lf+iU=";
|
||||
AllowedIPs = peerAddresses "3";
|
||||
};
|
||||
}];
|
||||
wireguardPeers = [
|
||||
{
|
||||
wireguardPeerConfig =
|
||||
let
|
||||
peerAddresses = i: [
|
||||
"${ipv4Prefix}.120.${i}/32"
|
||||
"${ulaPrefix}:120::${i}/128"
|
||||
];
|
||||
in
|
||||
{
|
||||
PublicKey = "0eWP1hzkyoXlrjPSOq+6Y1u8tnFH+SejBJs8f8lf+iU=";
|
||||
AllowedIPs = peerAddresses "3";
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
"20-wg0" = {
|
||||
netdevConfig = {
|
||||
|
|
@ -137,7 +142,10 @@ in
|
|||
"10-mgmt" = lib.mkMerge [
|
||||
(subnet "enp1s0" "100")
|
||||
{
|
||||
networkConfig.VLAN = [ "lan.10" "ff.11" ];
|
||||
networkConfig.VLAN = [
|
||||
"lan.10"
|
||||
"ff.11"
|
||||
];
|
||||
dhcpServerStaticLeases = [
|
||||
{
|
||||
# legion
|
||||
|
|
@ -158,13 +166,24 @@ in
|
|||
];
|
||||
"30-wg0" = {
|
||||
matchConfig.Name = "wg0";
|
||||
address = [ "10.3.3.2/32" "fd42:9c3b:f96d:121::2/128" ];
|
||||
address = [
|
||||
"10.3.3.2/32"
|
||||
"fd42:9c3b:f96d:121::2/128"
|
||||
];
|
||||
DHCP = "no";
|
||||
networkConfig.IPv6AcceptRA = false;
|
||||
linkConfig.RequiredForOnline = false;
|
||||
routes = [
|
||||
{ routeConfig = { Destination = "10.3.3.1/24"; }; }
|
||||
{ routeConfig = { Destination = "fd42:9c3b:f96d:121::1/64"; }; }
|
||||
{
|
||||
routeConfig = {
|
||||
Destination = "10.3.3.1/24";
|
||||
};
|
||||
}
|
||||
{
|
||||
routeConfig = {
|
||||
Destination = "fd42:9c3b:f96d:121::1/64";
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
"30-lan" = subnet "lan.10" "101" // {
|
||||
|
|
@ -266,10 +285,14 @@ in
|
|||
linkConfig.RequiredForOnline = false;
|
||||
routes = [
|
||||
{
|
||||
routeConfig = { Destination = "${ipv4Prefix}.120.1/24"; };
|
||||
routeConfig = {
|
||||
Destination = "${ipv4Prefix}.120.1/24";
|
||||
};
|
||||
}
|
||||
{
|
||||
routeConfig = { Destination = "${ulaPrefix}::120:1/64"; };
|
||||
routeConfig = {
|
||||
Destination = "${ulaPrefix}::120:1/64";
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,4 +1,9 @@
|
|||
{ pkgs, lib, config, ... }:
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
let
|
||||
secretsPath = config.dadada.secrets.path;
|
||||
in
|
||||
|
|
|
|||
|
|
@ -1,7 +1,8 @@
|
|||
{ config
|
||||
, pkgs
|
||||
, lib
|
||||
, ...
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
xilinxJtag = pkgs.writeTextFile {
|
||||
|
|
@ -104,13 +105,18 @@ in
|
|||
passwordFile = config.age.secrets.paperless.path;
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = let cfg = config.services.paperless; in [
|
||||
(if cfg.consumptionDirIsPublic then
|
||||
"d '${cfg.consumptionDir}' 777 - - - -"
|
||||
else
|
||||
"d '${cfg.consumptionDir}' 770 ${cfg.user} ${config.users.users.${cfg.user}.group} - -"
|
||||
)
|
||||
];
|
||||
systemd.tmpfiles.rules =
|
||||
let
|
||||
cfg = config.services.paperless;
|
||||
in
|
||||
[
|
||||
(
|
||||
if cfg.consumptionDirIsPublic then
|
||||
"d '${cfg.consumptionDir}' 777 - - - -"
|
||||
else
|
||||
"d '${cfg.consumptionDir}' 770 ${cfg.user} ${config.users.users.${cfg.user}.group} - -"
|
||||
)
|
||||
];
|
||||
|
||||
age.secrets.paperless = {
|
||||
file = "${config.dadada.secrets.path}/paperless.age";
|
||||
|
|
@ -130,12 +136,14 @@ in
|
|||
];
|
||||
};
|
||||
|
||||
hardware.printers.ensurePrinters = [{
|
||||
name = "Brother_HL-L2300D";
|
||||
model = "everywhere";
|
||||
location = "BS";
|
||||
deviceUri = "ipp://192.168.101.29:631/printers/Brother_HL-L2300D";
|
||||
}];
|
||||
hardware.printers.ensurePrinters = [
|
||||
{
|
||||
name = "Brother_HL-L2300D";
|
||||
model = "everywhere";
|
||||
location = "BS";
|
||||
deviceUri = "ipp://192.168.101.29:631/printers/Brother_HL-L2300D";
|
||||
}
|
||||
];
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
android-studio
|
||||
|
|
@ -175,7 +183,7 @@ in
|
|||
saleaeLogic
|
||||
keychron
|
||||
pkgs.libsigrok
|
||||
]; #noMtpUdevRules ];
|
||||
]; # noMtpUdevRules ];
|
||||
|
||||
virtualisation.libvirtd.enable = true;
|
||||
|
||||
|
|
@ -187,7 +195,20 @@ in
|
|||
users.users = {
|
||||
dadada = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" "networkmanager" "libvirtd" "adbusers" "kvm" "video" "scanner" "lp" "docker" "dialout" "wireshark" "paperless" ];
|
||||
extraGroups = [
|
||||
"wheel"
|
||||
"networkmanager"
|
||||
"libvirtd"
|
||||
"adbusers"
|
||||
"kvm"
|
||||
"video"
|
||||
"scanner"
|
||||
"lp"
|
||||
"docker"
|
||||
"dialout"
|
||||
"wireshark"
|
||||
"paperless"
|
||||
];
|
||||
shell = "/run/current-system/sw/bin/zsh";
|
||||
};
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,17 +1,26 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config
|
||||
, lib
|
||||
, pkgs
|
||||
, modulesPath
|
||||
, ...
|
||||
}: {
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = [
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "nvme" "ehci_pci" "xhci_pci" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
|
||||
boot.initrd.availableKernelModules = [
|
||||
"nvme"
|
||||
"ehci_pci"
|
||||
"xhci_pci"
|
||||
"usb_storage"
|
||||
"sd_mod"
|
||||
"rtsx_pci_sdmmc"
|
||||
];
|
||||
boot.initrd.kernelModules = [ "dm-snapshot" ];
|
||||
boot.kernelModules = [ "kvm-amd" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
|
|
|||
|
|
@ -1,11 +1,16 @@
|
|||
{ config
|
||||
, pkgs
|
||||
, lib
|
||||
, ...
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
with lib;
|
||||
let
|
||||
cfg = config.dadada.admin;
|
||||
extraGroups = [ "wheel" "libvirtd" ];
|
||||
extraGroups = [
|
||||
"wheel"
|
||||
"libvirtd"
|
||||
];
|
||||
|
||||
shells = {
|
||||
"bash" = pkgs.bashInteractive;
|
||||
|
|
@ -16,22 +21,32 @@ with lib; let
|
|||
shellNames = builtins.attrNames shells;
|
||||
|
||||
adminOpts =
|
||||
{ name
|
||||
, config
|
||||
, ...
|
||||
}: {
|
||||
{
|
||||
name,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
{
|
||||
options = {
|
||||
keys = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [ ];
|
||||
apply = x: assert (builtins.length x > 0 || abort "Please specify at least one key to be able to log in"); x;
|
||||
apply =
|
||||
x:
|
||||
assert (builtins.length x > 0 || abort "Please specify at least one key to be able to log in");
|
||||
x;
|
||||
description = ''
|
||||
The keys that should be able to access the account.
|
||||
'';
|
||||
};
|
||||
shell = mkOption {
|
||||
type = types.nullOr types.str;
|
||||
apply = x: assert (builtins.elem x shellNames || abort "Please specify one of ${builtins.toString shellNames}"); x;
|
||||
apply =
|
||||
x:
|
||||
assert (
|
||||
builtins.elem x shellNames || abort "Please specify one of ${builtins.toString shellNames}"
|
||||
);
|
||||
x;
|
||||
default = "zsh";
|
||||
defaultText = literalExpression "zsh";
|
||||
example = literalExpression "bash";
|
||||
|
|
@ -81,15 +96,12 @@ in
|
|||
security.sudo.wheelNeedsPassword = false;
|
||||
services.openssh.openFirewall = true;
|
||||
|
||||
users.users =
|
||||
mapAttrs
|
||||
(user: keys: {
|
||||
shell = shells."${keys.shell}";
|
||||
extraGroups = extraGroups;
|
||||
isNormalUser = true;
|
||||
openssh.authorizedKeys.keys = keys.keys;
|
||||
})
|
||||
cfg.users;
|
||||
users.users = mapAttrs (user: keys: {
|
||||
shell = shells."${keys.shell}";
|
||||
extraGroups = extraGroups;
|
||||
isNormalUser = true;
|
||||
openssh.authorizedKeys.keys = keys.keys;
|
||||
}) cfg.users;
|
||||
|
||||
nix.settings.trusted-users = builtins.attrNames cfg.users;
|
||||
|
||||
|
|
@ -103,7 +115,7 @@ in
|
|||
services.tor.relay.onionServices = {
|
||||
"rat" = mkIf cfg.rat.enable {
|
||||
name = "rat";
|
||||
map = [{ port = 22; }];
|
||||
map = [ { port = 22; } ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,9 +1,11 @@
|
|||
{ config
|
||||
, pkgs
|
||||
, lib
|
||||
, ...
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
with lib;
|
||||
let
|
||||
backupExcludes = [
|
||||
"/backup"
|
||||
"/dev"
|
||||
|
|
|
|||
|
|
@ -1,6 +1,11 @@
|
|||
{ config, lib, ... }:
|
||||
let
|
||||
inherit (lib) mkEnableOption mkIf mkOption types;
|
||||
inherit (lib)
|
||||
mkEnableOption
|
||||
mkIf
|
||||
mkOption
|
||||
types
|
||||
;
|
||||
cfg = config.dadada.borgServer;
|
||||
in
|
||||
{
|
||||
|
|
@ -20,31 +25,41 @@ in
|
|||
services.borgbackup.repos = {
|
||||
"metis" = {
|
||||
allowSubRepos = false;
|
||||
authorizedKeysAppendOnly = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDnc1gCi8lbhlLmPKvaExtCxVaAni8RrOuHUQO6wTbzR root@metis" ];
|
||||
authorizedKeysAppendOnly = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDnc1gCi8lbhlLmPKvaExtCxVaAni8RrOuHUQO6wTbzR root@metis"
|
||||
];
|
||||
path = "${cfg.path}/metis";
|
||||
quota = "1T";
|
||||
};
|
||||
"gorgon" = {
|
||||
allowSubRepos = false;
|
||||
authorizedKeysAppendOnly = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP6p9b2D7y2W+9BGee2yk2xsCRewNNaE6oS3CqlW61ti root@gorgon" ];
|
||||
authorizedKeysAppendOnly = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP6p9b2D7y2W+9BGee2yk2xsCRewNNaE6oS3CqlW61ti root@gorgon"
|
||||
];
|
||||
path = "${cfg.path}/gorgon";
|
||||
quota = "1T";
|
||||
};
|
||||
"surgat" = {
|
||||
allowSubRepos = false;
|
||||
authorizedKeysAppendOnly = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINGhatanrNG+M6jAkU7Yi44mJmTreJkqyZ6Z+qiEgV7O root@surgat" ];
|
||||
authorizedKeysAppendOnly = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINGhatanrNG+M6jAkU7Yi44mJmTreJkqyZ6Z+qiEgV7O root@surgat"
|
||||
];
|
||||
path = "${cfg.path}/surgat";
|
||||
quota = "50G";
|
||||
};
|
||||
"pruflas" = {
|
||||
allowSubRepos = false;
|
||||
authorizedKeysAppendOnly = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBk7f9DSnXCOIUsxFsjCKG23vHShV4TSzzPJunPOwa1I root@pruflas" ];
|
||||
authorizedKeysAppendOnly = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBk7f9DSnXCOIUsxFsjCKG23vHShV4TSzzPJunPOwa1I root@pruflas"
|
||||
];
|
||||
path = "${cfg.path}/pruflas";
|
||||
quota = "50G";
|
||||
};
|
||||
"wohnzimmerpi" = {
|
||||
allowSubRepos = false;
|
||||
authorizedKeysAppendOnly = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK6uZ8mPQJWOL984gZKKPyxp7VLcxk42TpTh5iPP6N6k root@wohnzimmerpi" ];
|
||||
authorizedKeysAppendOnly = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK6uZ8mPQJWOL984gZKKPyxp7VLcxk42TpTh5iPP6N6k root@wohnzimmerpi"
|
||||
];
|
||||
path = "${cfg.path}/wohnzimmerpi";
|
||||
quota = "50G";
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,52 +1,70 @@
|
|||
{ config
|
||||
, pkgs
|
||||
, lib
|
||||
, ...
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
with lib;
|
||||
let
|
||||
cfg = config.dadada.ddns;
|
||||
ddnsConfig = { domains, credentialsPath, interface }: {
|
||||
systemd.timers = listToAttrs (forEach domains (domain:
|
||||
nameValuePair "ddns-${domain}"
|
||||
{
|
||||
wantedBy = [ "timers.target" ];
|
||||
partOf = [ "ddns-${domain}.service" ];
|
||||
timerConfig.OnCalendar = "hourly";
|
||||
}));
|
||||
ddnsConfig =
|
||||
{
|
||||
domains,
|
||||
credentialsPath,
|
||||
interface,
|
||||
}:
|
||||
{
|
||||
systemd.timers = listToAttrs (
|
||||
forEach domains (
|
||||
domain:
|
||||
nameValuePair "ddns-${domain}" {
|
||||
wantedBy = [ "timers.target" ];
|
||||
partOf = [ "ddns-${domain}.service" ];
|
||||
timerConfig.OnCalendar = "hourly";
|
||||
}
|
||||
)
|
||||
);
|
||||
|
||||
systemd.services = listToAttrs (forEach domains (domain:
|
||||
nameValuePair "ddns-${domain}"
|
||||
{
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
PrivateTmp = true;
|
||||
PrivateDevices = true;
|
||||
PrivateUsers = true;
|
||||
PrivateMounts = true;
|
||||
PrivateIPC = true;
|
||||
ProtectHome = true;
|
||||
ProtectSystem = "strict";
|
||||
ProtectKernelTunables = true;
|
||||
BindReadOnlyPaths = [ credentialsPath ];
|
||||
NoNewPrivileges = true;
|
||||
CapabilitBoundingSet = [ ];
|
||||
};
|
||||
script = ''
|
||||
function url() {
|
||||
echo "https://svc.joker.com/nic/update?username=$1&password=$2&hostname=$3"
|
||||
}
|
||||
systemd.services = listToAttrs (
|
||||
forEach domains (
|
||||
domain:
|
||||
nameValuePair "ddns-${domain}" {
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
PrivateTmp = true;
|
||||
PrivateDevices = true;
|
||||
PrivateUsers = true;
|
||||
PrivateMounts = true;
|
||||
PrivateIPC = true;
|
||||
ProtectHome = true;
|
||||
ProtectSystem = "strict";
|
||||
ProtectKernelTunables = true;
|
||||
BindReadOnlyPaths = [ credentialsPath ];
|
||||
NoNewPrivileges = true;
|
||||
CapabilitBoundingSet = [ ];
|
||||
};
|
||||
script = ''
|
||||
function url() {
|
||||
echo "https://svc.joker.com/nic/update?username=$1&password=$2&hostname=$3"
|
||||
}
|
||||
|
||||
IFS=':'
|
||||
read -r user password < ${credentialsPath}
|
||||
unset IFS
|
||||
IFS=':'
|
||||
read -r user password < ${credentialsPath}
|
||||
unset IFS
|
||||
|
||||
curl_url=$(url "$user" "$password" ${domain})
|
||||
curl_url=$(url "$user" "$password" ${domain})
|
||||
|
||||
${pkgs.curl}/bin/curl --ipv4 "$curl_url" ${if interface == null then "" else "--interface ${interface}"} || true
|
||||
${pkgs.curl}/bin/curl --ipv6 "$curl_url" ${if interface == null then "" else "--interface ${interface}"}
|
||||
'';
|
||||
}));
|
||||
};
|
||||
${pkgs.curl}/bin/curl --ipv4 "$curl_url" ${
|
||||
if interface == null then "" else "--interface ${interface}"
|
||||
} || true
|
||||
${pkgs.curl}/bin/curl --ipv6 "$curl_url" ${
|
||||
if interface == null then "" else "--interface ${interface}"
|
||||
}
|
||||
'';
|
||||
}
|
||||
)
|
||||
);
|
||||
};
|
||||
in
|
||||
{
|
||||
options = {
|
||||
|
|
|
|||
|
|
@ -1,8 +1,16 @@
|
|||
{ lib, ... }:
|
||||
with lib; let
|
||||
modules' = dir: filterAttrs (name: type: (name != "default.nix" && name != "profiles" && ((hasSuffix ".nix" name) || (type == "directory"))))
|
||||
(builtins.readDir dir);
|
||||
modules = dir: mapAttrs' (name: _: nameValuePair (removeSuffix ".nix" name) (import (dir + "/${name}")))
|
||||
(modules' dir);
|
||||
with lib;
|
||||
let
|
||||
modules' =
|
||||
dir:
|
||||
filterAttrs (
|
||||
name: type:
|
||||
(name != "default.nix" && name != "profiles" && ((hasSuffix ".nix" name) || (type == "directory")))
|
||||
) (builtins.readDir dir);
|
||||
modules =
|
||||
dir:
|
||||
mapAttrs' (name: _: nameValuePair (removeSuffix ".nix" name) (import (dir + "/${name}"))) (
|
||||
modules' dir
|
||||
);
|
||||
in
|
||||
(modules ./.)
|
||||
|
|
|
|||
|
|
@ -1,7 +1,8 @@
|
|||
{ config
|
||||
, pkgs
|
||||
, lib
|
||||
, ...
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.dadada.element;
|
||||
|
|
|
|||
|
|
@ -1,8 +1,10 @@
|
|||
{ config
|
||||
, lib
|
||||
, ...
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
with lib;
|
||||
let
|
||||
cfg = config.dadada.fileShare;
|
||||
sharePath = "/mnt/storage/share";
|
||||
ipv6 = "fd42:dead:beef::/48";
|
||||
|
|
|
|||
|
|
@ -1,7 +1,8 @@
|
|||
{ config
|
||||
, pkgs
|
||||
, lib
|
||||
, ...
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.dadada.forgejo;
|
||||
|
|
|
|||
|
|
@ -1,9 +1,11 @@
|
|||
{ config
|
||||
, pkgs
|
||||
, lib
|
||||
, ...
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
with lib;
|
||||
let
|
||||
cfg = config.dadada.headphones;
|
||||
in
|
||||
{
|
||||
|
|
|
|||
|
|
@ -1,11 +1,13 @@
|
|||
{ config
|
||||
, lib
|
||||
, ...
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.dadada.homepage;
|
||||
in
|
||||
with lib; {
|
||||
with lib;
|
||||
{
|
||||
options.dadada.homepage = {
|
||||
enable = mkEnableOption "Enable home page";
|
||||
package = mkOption {
|
||||
|
|
|
|||
|
|
@ -1,7 +1,8 @@
|
|||
{ config
|
||||
, pkgs
|
||||
, lib
|
||||
, ...
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.dadada.inputs;
|
||||
|
|
|
|||
|
|
@ -21,6 +21,8 @@ in
|
|||
sshIdentityFile = config.age.secrets."${config.networking.hostName}-backup-ssh-key".path;
|
||||
};
|
||||
|
||||
age.secrets."${config.networking.hostName}-backup-passphrase".file = "${secretsPath}/${config.networking.hostName}-backup-passphrase.age";
|
||||
age.secrets."${config.networking.hostName}-backup-ssh-key".file = "${secretsPath}/${config.networking.hostName}-backup-ssh-key.age";
|
||||
age.secrets."${config.networking.hostName}-backup-passphrase".file =
|
||||
"${secretsPath}/${config.networking.hostName}-backup-passphrase.age";
|
||||
age.secrets."${config.networking.hostName}-backup-ssh-key".file =
|
||||
"${secretsPath}/${config.networking.hostName}-backup-ssh-key.age";
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,9 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
mkDefault = lib.mkDefault;
|
||||
inputs = config.dadada.inputs;
|
||||
|
|
@ -27,7 +32,7 @@ in
|
|||
|
||||
nix.package = pkgs.lix;
|
||||
|
||||
nix.settings.substituters = [ https://cache.nixos.org/ ];
|
||||
nix.settings.substituters = [ "https://cache.nixos.org/" ];
|
||||
|
||||
nix.settings.trusted-public-keys = [
|
||||
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
|
||||
|
|
@ -56,7 +61,10 @@ in
|
|||
|
||||
services.resolved = {
|
||||
enable = mkDefault true;
|
||||
fallbackDns = [ "9.9.9.9#dns.quad9.net" "2620:fe::fe:11#dns11.quad9.net" ];
|
||||
fallbackDns = [
|
||||
"9.9.9.9#dns.quad9.net"
|
||||
"2620:fe::fe:11#dns11.quad9.net"
|
||||
];
|
||||
};
|
||||
|
||||
programs.zsh.enable = mkDefault true;
|
||||
|
|
@ -64,4 +72,3 @@ in
|
|||
# Avoid some bots
|
||||
services.openssh.ports = [ 2222 ];
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -21,14 +21,13 @@ in
|
|||
hostKeys = [
|
||||
config.age.secrets."${initrdHostKey}".path
|
||||
];
|
||||
authorizedKeys = with lib;
|
||||
concatLists (mapAttrsToList
|
||||
(name: user:
|
||||
if elem "wheel" user.extraGroups then
|
||||
user.openssh.authorizedKeys.keys
|
||||
else
|
||||
[ ])
|
||||
config.users.users);
|
||||
authorizedKeys =
|
||||
with lib;
|
||||
concatLists (
|
||||
mapAttrsToList (
|
||||
name: user: if elem "wheel" user.extraGroups then user.openssh.authorizedKeys.keys else [ ]
|
||||
) config.users.users
|
||||
);
|
||||
};
|
||||
postCommands = ''
|
||||
echo 'cryptsetup-askpass' >> /root/.profile
|
||||
|
|
@ -36,7 +35,9 @@ in
|
|||
};
|
||||
|
||||
assertions = lib.singleton {
|
||||
assertion = (config.boot.initrd.network.ssh.hostKeys != [ ]) -> config.boot.loader.supportsInitrdSecrets == true;
|
||||
assertion =
|
||||
(config.boot.initrd.network.ssh.hostKeys != [ ])
|
||||
-> config.boot.loader.supportsInitrdSecrets == true;
|
||||
message = "Refusing to store private keys in store";
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -1,12 +1,14 @@
|
|||
{ config
|
||||
, lib
|
||||
, ...
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inputs = config.dadada.inputs;
|
||||
secretsPath = config.dadada.secrets.path;
|
||||
in
|
||||
with lib; {
|
||||
with lib;
|
||||
{
|
||||
imports = [
|
||||
./backup.nix
|
||||
./base.nix
|
||||
|
|
@ -53,5 +55,6 @@ with lib; {
|
|||
passphrasePath = config.age.secrets."${config.networking.hostName}-backup-passphrase-gs".path;
|
||||
};
|
||||
|
||||
age.secrets."${config.networking.hostName}-backup-passphrase-gs".file = "${secretsPath}/${config.networking.hostName}-backup-passphrase-gs.age";
|
||||
age.secrets."${config.networking.hostName}-backup-passphrase-gs".file =
|
||||
"${secretsPath}/${config.networking.hostName}-backup-passphrase-gs.age";
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,9 +1,11 @@
|
|||
{ config
|
||||
, pkgs
|
||||
, lib
|
||||
, ...
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
with lib; {
|
||||
with lib;
|
||||
{
|
||||
imports = [
|
||||
./backup.nix
|
||||
./base.nix
|
||||
|
|
@ -16,7 +18,9 @@ with lib; {
|
|||
documentation.enable = mkDefault false;
|
||||
documentation.nixos.enable = mkDefault false;
|
||||
|
||||
services.btrfs.autoScrub.enable = mkDefault ((filterAttrs (name: fs: fs.fsType == "btrfs") config.fileSystems) != { });
|
||||
services.btrfs.autoScrub.enable = mkDefault (
|
||||
(filterAttrs (name: fs: fs.fsType == "btrfs") config.fileSystems) != { }
|
||||
);
|
||||
|
||||
services.journald.extraConfig = ''
|
||||
SystemKeepFree = 2G
|
||||
|
|
|
|||
|
|
@ -1,4 +1,9 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
{
|
||||
environment.systemPackages = lib.mkIf config.services.postgresql.enable [
|
||||
(
|
||||
|
|
|
|||
|
|
@ -1,9 +1,11 @@
|
|||
{ config
|
||||
, pkgs
|
||||
, lib
|
||||
, ...
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
with lib;
|
||||
let
|
||||
cfg = config.dadada.share;
|
||||
in
|
||||
{
|
||||
|
|
|
|||
|
|
@ -1,9 +1,11 @@
|
|||
{ config
|
||||
, pkgs
|
||||
, lib
|
||||
, ...
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
with lib;
|
||||
let
|
||||
cfg = config.dadada.steam;
|
||||
in
|
||||
{
|
||||
|
|
|
|||
|
|
@ -1,28 +1,32 @@
|
|||
{ config
|
||||
, pkgs
|
||||
, lib
|
||||
, ...
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
with lib;
|
||||
let
|
||||
cfg = config.dadada.vpnServer;
|
||||
wgPeer = { name, ... }: {
|
||||
options = {
|
||||
name = mkOption {
|
||||
internal = true;
|
||||
default = name;
|
||||
};
|
||||
id = mkOption {
|
||||
description = "VPN client id";
|
||||
default = 0;
|
||||
type = types.str;
|
||||
};
|
||||
key = mkOption {
|
||||
description = "VPN client public key";
|
||||
default = "";
|
||||
type = types.str;
|
||||
wgPeer =
|
||||
{ name, ... }:
|
||||
{
|
||||
options = {
|
||||
name = mkOption {
|
||||
internal = true;
|
||||
default = name;
|
||||
};
|
||||
id = mkOption {
|
||||
description = "VPN client id";
|
||||
default = 0;
|
||||
type = types.str;
|
||||
};
|
||||
key = mkOption {
|
||||
description = "VPN client public key";
|
||||
default = "";
|
||||
type = types.str;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
options.dadada.vpnServer = {
|
||||
|
|
@ -41,13 +45,10 @@ in
|
|||
privateKeyFile = "/var/lib/wireguard/wg0-key";
|
||||
ips = [ "fd42:9c3b:f96d:0201::0/64" ];
|
||||
listenPort = 51234;
|
||||
peers =
|
||||
map
|
||||
(peer: {
|
||||
allowedIPs = [ "fd42:9c3b:f96d:0201::${peer.id}/128" ];
|
||||
publicKey = peer.key;
|
||||
})
|
||||
(attrValues cfg.peers);
|
||||
peers = map (peer: {
|
||||
allowedIPs = [ "fd42:9c3b:f96d:0201::${peer.id}/128" ];
|
||||
publicKey = peer.key;
|
||||
}) (attrValues cfg.peers);
|
||||
postSetup = ''
|
||||
wg set wg0 fwmark 51234
|
||||
ip -6 route add table 2468 fd42:9c3b:f96d::/48 dev ens3
|
||||
|
|
|
|||
|
|
@ -1,9 +1,11 @@
|
|||
{ config
|
||||
, pkgs
|
||||
, lib
|
||||
, ...
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
with lib;
|
||||
let
|
||||
cfg = config.dadada.weechat;
|
||||
in
|
||||
{
|
||||
|
|
|
|||
|
|
@ -1,9 +1,11 @@
|
|||
{ config
|
||||
, pkgs
|
||||
, lib
|
||||
, ...
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
with lib;
|
||||
let
|
||||
yubikey = config.dadada.yubikey;
|
||||
in
|
||||
{
|
||||
|
|
|
|||
|
|
@ -1,4 +1,9 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
hostAliases = [
|
||||
"ifrit.dadada.li"
|
||||
|
|
@ -37,7 +42,10 @@ in
|
|||
};
|
||||
};
|
||||
|
||||
services.openssh.ports = [ 22 2222 ];
|
||||
services.openssh.ports = [
|
||||
22
|
||||
2222
|
||||
];
|
||||
|
||||
dadada.backupClient.bs.enable = false;
|
||||
dadada.backupClient.backup1.enable = false;
|
||||
|
|
@ -59,7 +67,9 @@ in
|
|||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
assertions = lib.singleton {
|
||||
assertion = (config.boot.initrd.network.ssh.hostKeys != [ ]) -> config.boot.loader.supportsInitrdSecrets == true;
|
||||
assertion =
|
||||
(config.boot.initrd.network.ssh.hostKeys != [ ])
|
||||
-> config.boot.loader.supportsInitrdSecrets == true;
|
||||
message = "Refusing to store private keys in store";
|
||||
};
|
||||
|
||||
|
|
@ -183,7 +193,12 @@ in
|
|||
{
|
||||
hostName = "localhost";
|
||||
system = "x86_64-linux";
|
||||
supportedFeatures = [ "kvm" "nixos-test" "big-parallel" "benchmark" ];
|
||||
supportedFeatures = [
|
||||
"kvm"
|
||||
"nixos-test"
|
||||
"big-parallel"
|
||||
"benchmark"
|
||||
];
|
||||
maxJobs = 16;
|
||||
}
|
||||
];
|
||||
|
|
@ -277,26 +292,48 @@ in
|
|||
};
|
||||
"30-wg0" = {
|
||||
matchConfig.Name = "wg0";
|
||||
address = [ "10.3.3.3/32" "fd42:9c3b:f96d:121::3/128" ];
|
||||
address = [
|
||||
"10.3.3.3/32"
|
||||
"fd42:9c3b:f96d:121::3/128"
|
||||
];
|
||||
DHCP = "no";
|
||||
networkConfig.IPv6AcceptRA = false;
|
||||
linkConfig.RequiredForOnline = false;
|
||||
routes = [
|
||||
{ routeConfig = { Destination = "10.3.3.1/24"; }; }
|
||||
{ routeConfig = { Destination = "fd42:9c3b:f96d:121::1/64"; }; }
|
||||
{
|
||||
routeConfig = {
|
||||
Destination = "10.3.3.1/24";
|
||||
};
|
||||
}
|
||||
{
|
||||
routeConfig = {
|
||||
Destination = "fd42:9c3b:f96d:121::1/64";
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
"30-uwu" = {
|
||||
matchConfig.Name = "uwu";
|
||||
address = [ "10.11.0.39/24" "fc00:1337:dead:beef::10.11.0.39/128" ];
|
||||
address = [
|
||||
"10.11.0.39/24"
|
||||
"fc00:1337:dead:beef::10.11.0.39/128"
|
||||
];
|
||||
dns = [ "10.11.0.1%uwu#uwu" ];
|
||||
domains = [ "uwu" ];
|
||||
DHCP = "no";
|
||||
networkConfig.IPv6AcceptRA = false;
|
||||
linkConfig.RequiredForOnline = false;
|
||||
routes = [
|
||||
{ routeConfig = { Destination = "10.11.0.0/22"; }; }
|
||||
{ routeConfig = { Destination = "fc00:1337:dead:beef::10.11.0.0/118"; }; }
|
||||
{
|
||||
routeConfig = {
|
||||
Destination = "10.11.0.0/22";
|
||||
};
|
||||
}
|
||||
{
|
||||
routeConfig = {
|
||||
Destination = "fc00:1337:dead:beef::10.11.0.0/118";
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
"20-br0" = {
|
||||
|
|
@ -337,7 +374,10 @@ in
|
|||
{
|
||||
wireguardPeerConfig = {
|
||||
PublicKey = "KzL+PKlv4LktIqqTqC9Esw8dkSZN2qSn/vq76UHbOlY=";
|
||||
AllowedIPs = [ "10.3.3.1/32" "fd42:9c3b:f96d:121::1/128" ];
|
||||
AllowedIPs = [
|
||||
"10.3.3.1/32"
|
||||
"fd42:9c3b:f96d:121::1/128"
|
||||
];
|
||||
PersistentKeepalive = 25;
|
||||
Endpoint = "surgat.dadada.li:51235";
|
||||
};
|
||||
|
|
@ -345,7 +385,10 @@ in
|
|||
{
|
||||
wireguardPeerConfig = {
|
||||
PublicKey = "INfv++4R+Kd2jdh/3CooM70ZeeoN6aeU6mo+T4C8gWU=";
|
||||
AllowedIPs = [ "10.3.3.2/32" "fd42:9c3b:f96d:121::2/128" ];
|
||||
AllowedIPs = [
|
||||
"10.3.3.2/32"
|
||||
"fd42:9c3b:f96d:121::2/128"
|
||||
];
|
||||
Endpoint = "192.168.101.1:51235";
|
||||
};
|
||||
}
|
||||
|
|
@ -359,15 +402,21 @@ in
|
|||
wireguardConfig = {
|
||||
PrivateKeyFile = config.age.secrets.${uwuPrivKey}.path;
|
||||
};
|
||||
wireguardPeers = [{
|
||||
wireguardPeerConfig = {
|
||||
PublicKey = "tuoiOWqgHz/lrgTcLjX+xIhvxh9jDH6gmDw2ZMvX5T8=";
|
||||
AllowedIPs = [ "10.11.0.0/22" "fc00:1337:dead:beef::10.11.0.0/118" "192.168.178.0/23" ];
|
||||
PersistentKeepalive = 25;
|
||||
PresharedKeyFile = config.age.secrets.${uwuPresharedKey}.path;
|
||||
Endpoint = "53c70r.de:51820";
|
||||
};
|
||||
}];
|
||||
wireguardPeers = [
|
||||
{
|
||||
wireguardPeerConfig = {
|
||||
PublicKey = "tuoiOWqgHz/lrgTcLjX+xIhvxh9jDH6gmDw2ZMvX5T8=";
|
||||
AllowedIPs = [
|
||||
"10.11.0.0/22"
|
||||
"fc00:1337:dead:beef::10.11.0.0/118"
|
||||
"192.168.178.0/23"
|
||||
];
|
||||
PersistentKeepalive = 25;
|
||||
PresharedKeyFile = config.age.secrets.${uwuPresharedKey}.path;
|
||||
Endpoint = "53c70r.de:51820";
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,89 +1,115 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, modulesPath, ... }:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
modulesPath,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports =
|
||||
[
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
imports = [
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "igc" "xhci_pci" "thunderbolt" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
|
||||
boot.initrd.availableKernelModules = [
|
||||
"igc"
|
||||
"xhci_pci"
|
||||
"thunderbolt"
|
||||
"ahci"
|
||||
"nvme"
|
||||
"usbhid"
|
||||
"usb_storage"
|
||||
"sd_mod"
|
||||
];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{
|
||||
device = "/dev/disk/by-uuid/7ca5fd2a-2a56-48fe-bd48-1e51b6a66714";
|
||||
fsType = "btrfs";
|
||||
options = [ "compress=zstd" ];
|
||||
};
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-uuid/7ca5fd2a-2a56-48fe-bd48-1e51b6a66714";
|
||||
fsType = "btrfs";
|
||||
options = [ "compress=zstd" ];
|
||||
};
|
||||
|
||||
boot.initrd.luks.devices."luks".device = "/dev/disk/by-uuid/bac4ee0e-e393-414f-ac3e-1ec20739abae";
|
||||
|
||||
fileSystems."/swap" =
|
||||
fileSystems."/swap" = {
|
||||
device = "/dev/disk/by-uuid/7ca5fd2a-2a56-48fe-bd48-1e51b6a66714";
|
||||
fsType = "btrfs";
|
||||
options = [
|
||||
"subvol=swap"
|
||||
"noatime"
|
||||
];
|
||||
};
|
||||
|
||||
fileSystems."/nix" = {
|
||||
device = "/dev/disk/by-uuid/7ca5fd2a-2a56-48fe-bd48-1e51b6a66714";
|
||||
fsType = "btrfs";
|
||||
options = [
|
||||
"subvol=nix"
|
||||
"noatime"
|
||||
"compress=zstd"
|
||||
];
|
||||
};
|
||||
|
||||
fileSystems."/var" = {
|
||||
device = "/dev/disk/by-uuid/7ca5fd2a-2a56-48fe-bd48-1e51b6a66714";
|
||||
fsType = "btrfs";
|
||||
options = [
|
||||
"subvol=var"
|
||||
"compress=zstd"
|
||||
];
|
||||
};
|
||||
|
||||
fileSystems."/home" = {
|
||||
device = "/dev/disk/by-uuid/7ca5fd2a-2a56-48fe-bd48-1e51b6a66714";
|
||||
fsType = "btrfs";
|
||||
options = [
|
||||
"subvol=home"
|
||||
"compress=zstd"
|
||||
];
|
||||
};
|
||||
|
||||
fileSystems."/root" = {
|
||||
device = "/dev/disk/by-uuid/7ca5fd2a-2a56-48fe-bd48-1e51b6a66714";
|
||||
fsType = "btrfs";
|
||||
options = [
|
||||
"subvol=root"
|
||||
"compress=zstd"
|
||||
];
|
||||
};
|
||||
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-uuid/2E20-49CB";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
swapDevices = [
|
||||
{
|
||||
device = "/dev/disk/by-uuid/7ca5fd2a-2a56-48fe-bd48-1e51b6a66714";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=swap" "noatime" ];
|
||||
};
|
||||
device = "/swap/swapfile";
|
||||
size = 32 * 1024; # 32 GByte
|
||||
}
|
||||
];
|
||||
|
||||
fileSystems."/nix" =
|
||||
{
|
||||
device = "/dev/disk/by-uuid/7ca5fd2a-2a56-48fe-bd48-1e51b6a66714";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=nix" "noatime" "compress=zstd" ];
|
||||
};
|
||||
fileSystems."/mnt/storage" = {
|
||||
device = "/dev/disk/by-uuid/ce483e75-5886-4b03-a3f9-675b80560ac9";
|
||||
fsType = "btrfs";
|
||||
options = [
|
||||
"subvol=root"
|
||||
"compress=zstd"
|
||||
];
|
||||
};
|
||||
|
||||
fileSystems."/var" =
|
||||
{
|
||||
device = "/dev/disk/by-uuid/7ca5fd2a-2a56-48fe-bd48-1e51b6a66714";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=var" "compress=zstd" ];
|
||||
};
|
||||
|
||||
fileSystems."/home" =
|
||||
{
|
||||
device = "/dev/disk/by-uuid/7ca5fd2a-2a56-48fe-bd48-1e51b6a66714";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=home" "compress=zstd" ];
|
||||
};
|
||||
|
||||
fileSystems."/root" =
|
||||
{
|
||||
device = "/dev/disk/by-uuid/7ca5fd2a-2a56-48fe-bd48-1e51b6a66714";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=root" "compress=zstd" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{
|
||||
device = "/dev/disk/by-uuid/2E20-49CB";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
swapDevices = [{
|
||||
device = "/swap/swapfile";
|
||||
size = 32 * 1024; # 32 GByte
|
||||
}];
|
||||
|
||||
|
||||
fileSystems."/mnt/storage" =
|
||||
{
|
||||
device = "/dev/disk/by-uuid/ce483e75-5886-4b03-a3f9-675b80560ac9";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=root" "compress=zstd" ];
|
||||
};
|
||||
|
||||
|
||||
fileSystems."/mnt/storage/backups" =
|
||||
{
|
||||
device = "/dev/disk/by-uuid/ce483e75-5886-4b03-a3f9-675b80560ac9";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=backups" "noatime" ];
|
||||
};
|
||||
fileSystems."/mnt/storage/backups" = {
|
||||
device = "/dev/disk/by-uuid/ce483e75-5886-4b03-a3f9-675b80560ac9";
|
||||
fsType = "btrfs";
|
||||
options = [
|
||||
"subvol=backups"
|
||||
"noatime"
|
||||
];
|
||||
};
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
{ config
|
||||
, pkgs
|
||||
, ...
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
hostName = "surgat";
|
||||
|
|
@ -85,14 +86,29 @@ in
|
|||
};
|
||||
"10-ninurta" = {
|
||||
matchConfig.Name = "ninurta";
|
||||
address = [ "10.3.3.1/32" "fd42:9c3b:f96d:121::1/128" ];
|
||||
address = [
|
||||
"10.3.3.1/32"
|
||||
"fd42:9c3b:f96d:121::1/128"
|
||||
];
|
||||
DHCP = "no";
|
||||
networkConfig.IPv6AcceptRA = false;
|
||||
linkConfig.RequiredForOnline = "no";
|
||||
routes = [
|
||||
{ routeConfig = { Destination = "10.3.3.3/24"; }; }
|
||||
{ routeConfig = { Destination = "fd42:9c3b:f96d:121::/64"; }; }
|
||||
{ routeConfig = { Destination = "fd42:9c3b:f96d:101::/64"; }; }
|
||||
{
|
||||
routeConfig = {
|
||||
Destination = "10.3.3.3/24";
|
||||
};
|
||||
}
|
||||
{
|
||||
routeConfig = {
|
||||
Destination = "fd42:9c3b:f96d:121::/64";
|
||||
};
|
||||
}
|
||||
{
|
||||
routeConfig = {
|
||||
Destination = "fd42:9c3b:f96d:101::/64";
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
|
@ -106,12 +122,18 @@ in
|
|||
PrivateKeyFile = "/var/lib/wireguard/hydra";
|
||||
ListenPort = 51235;
|
||||
};
|
||||
wireguardPeers = [{
|
||||
wireguardPeerConfig = {
|
||||
PublicKey = "Kw2HVRb1zeA7NAzBvI3UzmOj45VqM358EBuZWdlAUDE=";
|
||||
AllowedIPs = [ "10.3.3.3/32" "fd42:9c3b:f96d:121::3/128" "fd42:9c3b:f96d:101:4a21:bff:fe3e:9cfe/128" ];
|
||||
};
|
||||
}];
|
||||
wireguardPeers = [
|
||||
{
|
||||
wireguardPeerConfig = {
|
||||
PublicKey = "Kw2HVRb1zeA7NAzBvI3UzmOj45VqM358EBuZWdlAUDE=";
|
||||
AllowedIPs = [
|
||||
"10.3.3.3/32"
|
||||
"fd42:9c3b:f96d:121::3/128"
|
||||
"fd42:9c3b:f96d:101:4a21:bff:fe3e:9cfe/128"
|
||||
];
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
@ -143,7 +165,10 @@ in
|
|||
|
||||
services.resolved = {
|
||||
enable = true;
|
||||
fallbackDns = [ "9.9.9.9" "2620:fe::fe" ];
|
||||
fallbackDns = [
|
||||
"9.9.9.9"
|
||||
"2620:fe::fe"
|
||||
];
|
||||
};
|
||||
|
||||
system.autoUpgrade.allowReboot = false;
|
||||
|
|
|
|||
|
|
@ -1,17 +1,25 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config
|
||||
, lib
|
||||
, pkgs
|
||||
, modulesPath
|
||||
, ...
|
||||
}: {
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = [
|
||||
(modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ata_piix" "virtio_pci" "xhci_pci" "sd_mod" "sr_mod" ];
|
||||
boot.initrd.availableKernelModules = [
|
||||
"ata_piix"
|
||||
"virtio_pci"
|
||||
"xhci_pci"
|
||||
"sd_mod"
|
||||
"sr_mod"
|
||||
];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
|
|
|||
|
|
@ -26,7 +26,7 @@
|
|||
in
|
||||
import ./devshell.nix { inherit pkgs extraModules; };
|
||||
|
||||
formatter = pkgs.nixpkgs-fmt;
|
||||
formatter = pkgs.nixfmt-tree;
|
||||
|
||||
packages = import ./pkgs { inherit pkgs; } // {
|
||||
installer-iso = self.nixosConfigurations.installer.config.system.build.isoImage;
|
||||
|
|
|
|||
|
|
@ -1,2 +1 @@
|
|||
{
|
||||
}
|
||||
{ }
|
||||
|
|
|
|||
|
|
@ -1,2 +1 @@
|
|||
{ pkgs }:
|
||||
{ }
|
||||
{ pkgs }: { }
|
||||
|
|
|
|||
|
|
@ -9,30 +9,82 @@ let
|
|||
surgat = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOOJ9UgAle5sX0pAawfRztckVwaQm2U8o0Bawv7cZfXE root@surgat";
|
||||
};
|
||||
backupSecrets = hostName: {
|
||||
"${hostName}-backup-passphrase.age".publicKeys = [ systems.${hostName} dadada ];
|
||||
"${hostName}-backup-ssh-key.age".publicKeys = [ systems.${hostName} dadada ];
|
||||
"${hostName}-backup-passphrase.age".publicKeys = [
|
||||
systems.${hostName}
|
||||
dadada
|
||||
];
|
||||
"${hostName}-backup-ssh-key.age".publicKeys = [
|
||||
systems.${hostName}
|
||||
dadada
|
||||
];
|
||||
};
|
||||
in
|
||||
{
|
||||
"pruflas-wg0-key.age".publicKeys = [ systems.ninurta dadada ];
|
||||
"pruflas-wg0-preshared-key.age".publicKeys = [ systems.ninurta dadada ];
|
||||
"pruflas-wg-hydra-key.age".publicKeys = [ systems.ninurta dadada ];
|
||||
"hydra-github-authorization.age".publicKeys = [ systems.ninurta dadada ];
|
||||
"miniflux-admin-credentials.age".publicKeys = [ systems.surgat dadada ];
|
||||
"gorgon-backup-passphrase-gs.age".publicKeys = [ systems.gorgon dadada ];
|
||||
"paperless.age".publicKeys = [ systems.gorgon dadada ];
|
||||
"initrd-surgat-ssh_host_ed25519_key.age".publicKeys = [ systems.surgat dadada ];
|
||||
"surgat-ssh_host_ed25519_key.age".publicKeys = [ systems.surgat dadada ];
|
||||
"ninurta-initrd-ssh-key.age".publicKeys = [ systems.ninurta dadada ];
|
||||
"ddns-credentials.age".publicKeys = [ systems.agares systems.ninurta dadada ];
|
||||
"etc-ppp-chap-secrets.age".publicKeys = [ systems.agares dadada ];
|
||||
"etc-ppp-telekom-secret.age".publicKeys = [ systems.agares dadada ];
|
||||
"wg-privkey-vpn-dadada-li.age".publicKeys = [ systems.agares dadada ];
|
||||
"agares-wg0-key.age".publicKeys = [ systems.agares dadada ];
|
||||
} //
|
||||
backupSecrets "ninurta" //
|
||||
backupSecrets "gorgon" //
|
||||
backupSecrets "ifrit" //
|
||||
backupSecrets "pruflas" //
|
||||
backupSecrets "surgat" //
|
||||
backupSecrets "agares"
|
||||
"pruflas-wg0-key.age".publicKeys = [
|
||||
systems.ninurta
|
||||
dadada
|
||||
];
|
||||
"pruflas-wg0-preshared-key.age".publicKeys = [
|
||||
systems.ninurta
|
||||
dadada
|
||||
];
|
||||
"pruflas-wg-hydra-key.age".publicKeys = [
|
||||
systems.ninurta
|
||||
dadada
|
||||
];
|
||||
"hydra-github-authorization.age".publicKeys = [
|
||||
systems.ninurta
|
||||
dadada
|
||||
];
|
||||
"miniflux-admin-credentials.age".publicKeys = [
|
||||
systems.surgat
|
||||
dadada
|
||||
];
|
||||
"gorgon-backup-passphrase-gs.age".publicKeys = [
|
||||
systems.gorgon
|
||||
dadada
|
||||
];
|
||||
"paperless.age".publicKeys = [
|
||||
systems.gorgon
|
||||
dadada
|
||||
];
|
||||
"initrd-surgat-ssh_host_ed25519_key.age".publicKeys = [
|
||||
systems.surgat
|
||||
dadada
|
||||
];
|
||||
"surgat-ssh_host_ed25519_key.age".publicKeys = [
|
||||
systems.surgat
|
||||
dadada
|
||||
];
|
||||
"ninurta-initrd-ssh-key.age".publicKeys = [
|
||||
systems.ninurta
|
||||
dadada
|
||||
];
|
||||
"ddns-credentials.age".publicKeys = [
|
||||
systems.agares
|
||||
systems.ninurta
|
||||
dadada
|
||||
];
|
||||
"etc-ppp-chap-secrets.age".publicKeys = [
|
||||
systems.agares
|
||||
dadada
|
||||
];
|
||||
"etc-ppp-telekom-secret.age".publicKeys = [
|
||||
systems.agares
|
||||
dadada
|
||||
];
|
||||
"wg-privkey-vpn-dadada-li.age".publicKeys = [
|
||||
systems.agares
|
||||
dadada
|
||||
];
|
||||
"agares-wg0-key.age".publicKeys = [
|
||||
systems.agares
|
||||
dadada
|
||||
];
|
||||
}
|
||||
// backupSecrets "ninurta"
|
||||
// backupSecrets "gorgon"
|
||||
// backupSecrets "ifrit"
|
||||
// backupSecrets "pruflas"
|
||||
// backupSecrets "surgat"
|
||||
// backupSecrets "agares"
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue