dadada/nix-config
dadada/nix-config
1
0
Fork 0
Code Issues 2 Pull requests 5 Projects Releases Packages Wiki Activity Actions 1

chore: reformat

Browse source
This commit is contained in:
Tim Schubert 2025-06-03 20:04:44 +02:00
parent b638c4125b
commit 1402ee13cc
No known key found for this signature in database
57 changed files with 845 additions and 466 deletions
Download patch file Download diff file Expand all files Collapse all files

56
nixos/modules/admin.nix
View file

@ -1,11 +1,16 @@
{ config
, pkgs
, lib
, ...
{
config,
pkgs,
lib,
...
}:
with lib; let
with lib;
let
cfg = config.dadada.admin;
extraGroups = [ "wheel" "libvirtd" ];
extraGroups = [
"wheel"
"libvirtd"
];
shells = {
"bash" = pkgs.bashInteractive;
@ -16,22 +21,32 @@ with lib; let
shellNames = builtins.attrNames shells;
adminOpts =
{ name
, config
, ...
}: {
{
name,
config,
...
}:
{
options = {
keys = mkOption {
type = types.listOf types.str;
default = [ ];
apply = x: assert (builtins.length x > 0 || abort "Please specify at least one key to be able to log in"); x;
apply =
x:
assert (builtins.length x > 0 || abort "Please specify at least one key to be able to log in");
x;
description = ''
The keys that should be able to access the account.
'';
};
shell = mkOption {
type = types.nullOr types.str;
apply = x: assert (builtins.elem x shellNames || abort "Please specify one of ${builtins.toString shellNames}"); x;
apply =
x:
assert (
builtins.elem x shellNames || abort "Please specify one of ${builtins.toString shellNames}"
);
x;
default = "zsh";
defaultText = literalExpression "zsh";
example = literalExpression "bash";
@ -81,15 +96,12 @@ in
security.sudo.wheelNeedsPassword = false;
services.openssh.openFirewall = true;
users.users =
mapAttrs
(user: keys: {
shell = shells."${keys.shell}";
extraGroups = extraGroups;
isNormalUser = true;
openssh.authorizedKeys.keys = keys.keys;
})
cfg.users;
users.users = mapAttrs (user: keys: {
shell = shells."${keys.shell}";
extraGroups = extraGroups;
isNormalUser = true;
openssh.authorizedKeys.keys = keys.keys;
}) cfg.users;
nix.settings.trusted-users = builtins.attrNames cfg.users;
@ -103,7 +115,7 @@ in
services.tor.relay.onionServices = {
"rat" = mkIf cfg.rat.enable {
name = "rat";
map = [{ port = 22; }];
map = [ { port = 22; } ];
};
};
};

12
nixos/modules/backup.nix
View file

@ -1,9 +1,11 @@
{ config
, pkgs
, lib
, ...
{
config,
pkgs,
lib,
...
}:
with lib; let
with lib;
let
backupExcludes = [
"/backup"
"/dev"

27
nixos/modules/borg-server.nix
View file

@ -1,6 +1,11 @@
{ config, lib, ... }:
let
inherit (lib) mkEnableOption mkIf mkOption types;
inherit (lib)
mkEnableOption
mkIf
mkOption
types
;
cfg = config.dadada.borgServer;
in
{
@ -20,31 +25,41 @@ in
services.borgbackup.repos = {
"metis" = {
allowSubRepos = false;
authorizedKeysAppendOnly = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDnc1gCi8lbhlLmPKvaExtCxVaAni8RrOuHUQO6wTbzR root@metis" ];
authorizedKeysAppendOnly = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDnc1gCi8lbhlLmPKvaExtCxVaAni8RrOuHUQO6wTbzR root@metis"
];
path = "${cfg.path}/metis";
quota = "1T";
};
"gorgon" = {
allowSubRepos = false;
authorizedKeysAppendOnly = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP6p9b2D7y2W+9BGee2yk2xsCRewNNaE6oS3CqlW61ti root@gorgon" ];
authorizedKeysAppendOnly = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP6p9b2D7y2W+9BGee2yk2xsCRewNNaE6oS3CqlW61ti root@gorgon"
];
path = "${cfg.path}/gorgon";
quota = "1T";
};
"surgat" = {
allowSubRepos = false;
authorizedKeysAppendOnly = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINGhatanrNG+M6jAkU7Yi44mJmTreJkqyZ6Z+qiEgV7O root@surgat" ];
authorizedKeysAppendOnly = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINGhatanrNG+M6jAkU7Yi44mJmTreJkqyZ6Z+qiEgV7O root@surgat"
];
path = "${cfg.path}/surgat";
quota = "50G";
};
"pruflas" = {
allowSubRepos = false;
authorizedKeysAppendOnly = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBk7f9DSnXCOIUsxFsjCKG23vHShV4TSzzPJunPOwa1I root@pruflas" ];
authorizedKeysAppendOnly = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBk7f9DSnXCOIUsxFsjCKG23vHShV4TSzzPJunPOwa1I root@pruflas"
];
path = "${cfg.path}/pruflas";
quota = "50G";
};
"wohnzimmerpi" = {
allowSubRepos = false;
authorizedKeysAppendOnly = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK6uZ8mPQJWOL984gZKKPyxp7VLcxk42TpTh5iPP6N6k root@wohnzimmerpi" ];
authorizedKeysAppendOnly = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK6uZ8mPQJWOL984gZKKPyxp7VLcxk42TpTh5iPP6N6k root@wohnzimmerpi"
];
path = "${cfg.path}/wohnzimmerpi";
quota = "50G";
};

104
nixos/modules/ddns.nix
View file

@ -1,52 +1,70 @@
{ config
, pkgs
, lib
, ...
{
config,
pkgs,
lib,
...
}:
with lib; let
with lib;
let
cfg = config.dadada.ddns;
ddnsConfig = { domains, credentialsPath, interface }: {
systemd.timers = listToAttrs (forEach domains (domain:
nameValuePair "ddns-${domain}"
{
wantedBy = [ "timers.target" ];
partOf = [ "ddns-${domain}.service" ];
timerConfig.OnCalendar = "hourly";
}));
ddnsConfig =
{
domains,
credentialsPath,
interface,
}:
{
systemd.timers = listToAttrs (
forEach domains (
domain:
nameValuePair "ddns-${domain}" {
wantedBy = [ "timers.target" ];
partOf = [ "ddns-${domain}.service" ];
timerConfig.OnCalendar = "hourly";
}
)
);
systemd.services = listToAttrs (forEach domains (domain:
nameValuePair "ddns-${domain}"
{
serviceConfig = {
Type = "oneshot";
PrivateTmp = true;
PrivateDevices = true;
PrivateUsers = true;
PrivateMounts = true;
PrivateIPC = true;
ProtectHome = true;
ProtectSystem = "strict";
ProtectKernelTunables = true;
BindReadOnlyPaths = [ credentialsPath ];
NoNewPrivileges = true;
CapabilitBoundingSet = [ ];
};
script = ''
function url() {
echo "https://svc.joker.com/nic/update?username=$1&password=$2&hostname=$3"
}
systemd.services = listToAttrs (
forEach domains (
domain:
nameValuePair "ddns-${domain}" {
serviceConfig = {
Type = "oneshot";
PrivateTmp = true;
PrivateDevices = true;
PrivateUsers = true;
PrivateMounts = true;
PrivateIPC = true;
ProtectHome = true;
ProtectSystem = "strict";
ProtectKernelTunables = true;
BindReadOnlyPaths = [ credentialsPath ];
NoNewPrivileges = true;
CapabilitBoundingSet = [ ];
};
script = ''
function url() {
echo "https://svc.joker.com/nic/update?username=$1&password=$2&hostname=$3"
}
IFS=':'
read -r user password < ${credentialsPath}
unset IFS
IFS=':'
read -r user password < ${credentialsPath}
unset IFS
curl_url=$(url "$user" "$password" ${domain})
curl_url=$(url "$user" "$password" ${domain})
${pkgs.curl}/bin/curl --ipv4 "$curl_url" ${if interface == null then "" else "--interface ${interface}"} || true
${pkgs.curl}/bin/curl --ipv6 "$curl_url" ${if interface == null then "" else "--interface ${interface}"}
'';
}));
};
${pkgs.curl}/bin/curl --ipv4 "$curl_url" ${
if interface == null then "" else "--interface ${interface}"
} || true
${pkgs.curl}/bin/curl --ipv6 "$curl_url" ${
if interface == null then "" else "--interface ${interface}"
}
'';
}
)
);
};
in
{
options = {

18
nixos/modules/default.nix
View file

@ -1,8 +1,16 @@
{ lib, ... }:
with lib; let
modules' = dir: filterAttrs (name: type: (name != "default.nix" && name != "profiles" && ((hasSuffix ".nix" name) || (type == "directory"))))
(builtins.readDir dir);
modules = dir: mapAttrs' (name: _: nameValuePair (removeSuffix ".nix" name) (import (dir + "/${name}")))
(modules' dir);
with lib;
let
modules' =
dir:
filterAttrs (
name: type:
(name != "default.nix" && name != "profiles" && ((hasSuffix ".nix" name) || (type == "directory")))
) (builtins.readDir dir);
modules =
dir:
mapAttrs' (name: _: nameValuePair (removeSuffix ".nix" name) (import (dir + "/${name}"))) (
modules' dir
);
in
(modules ./.)

9
nixos/modules/element.nix
View file

@ -1,7 +1,8 @@
{ config
, pkgs
, lib
, ...
{
config,
pkgs,
lib,
...
}:
let
cfg = config.dadada.element;

10
nixos/modules/fileShare.nix
View file

@ -1,8 +1,10 @@
{ config
, lib
, ...
{
config,
lib,
...
}:
with lib; let
with lib;
let
cfg = config.dadada.fileShare;
sharePath = "/mnt/storage/share";
ipv6 = "fd42:dead:beef::/48";

9
nixos/modules/gitea.nix
View file

@ -1,7 +1,8 @@
{ config
, pkgs
, lib
, ...
{
config,
pkgs,
lib,
...
}:
let
cfg = config.dadada.forgejo;

12
nixos/modules/headphones.nix
View file

@ -1,9 +1,11 @@
{ config
, pkgs
, lib
, ...
{
config,
pkgs,
lib,
...
}:
with lib; let
with lib;
let
cfg = config.dadada.headphones;
in
{

10
nixos/modules/homepage.nix
View file

@ -1,11 +1,13 @@
{ config
, lib
, ...
{
config,
lib,
...
}:
let
cfg = config.dadada.homepage;
in
with lib; {
with lib;
{
options.dadada.homepage = {
enable = mkEnableOption "Enable home page";
package = mkOption {

9
nixos/modules/inputs.nix
View file

@ -1,7 +1,8 @@
{ config
, pkgs
, lib
, ...
{
config,
pkgs,
lib,
...
}:
let
cfg = config.dadada.inputs;

6
nixos/modules/profiles/backup.nix
View file

@ -21,6 +21,8 @@ in
sshIdentityFile = config.age.secrets."${config.networking.hostName}-backup-ssh-key".path;
};
age.secrets."${config.networking.hostName}-backup-passphrase".file = "${secretsPath}/${config.networking.hostName}-backup-passphrase.age";
age.secrets."${config.networking.hostName}-backup-ssh-key".file = "${secretsPath}/${config.networking.hostName}-backup-ssh-key.age";
age.secrets."${config.networking.hostName}-backup-passphrase".file =
"${secretsPath}/${config.networking.hostName}-backup-passphrase.age";
age.secrets."${config.networking.hostName}-backup-ssh-key".file =
"${secretsPath}/${config.networking.hostName}-backup-ssh-key.age";
}

15
nixos/modules/profiles/base.nix
View file

@ -1,4 +1,9 @@
{ config, lib, pkgs, ... }:
{
config,
lib,
pkgs,
...
}:
let
mkDefault = lib.mkDefault;
inputs = config.dadada.inputs;
@ -27,7 +32,7 @@ in
nix.package = pkgs.lix;
nix.settings.substituters = [ https://cache.nixos.org/ ];
nix.settings.substituters = [ "https://cache.nixos.org/" ];
nix.settings.trusted-public-keys = [
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
@ -56,7 +61,10 @@ in
services.resolved = {
enable = mkDefault true;
fallbackDns = [ "9.9.9.9#dns.quad9.net" "2620:fe::fe:11#dns11.quad9.net" ];
fallbackDns = [
"9.9.9.9#dns.quad9.net"
"2620:fe::fe:11#dns11.quad9.net"
];
};
programs.zsh.enable = mkDefault true;
@ -64,4 +72,3 @@ in
# Avoid some bots
services.openssh.ports = [ 2222 ];
}

19
nixos/modules/profiles/cloud.nix
View file

@ -21,14 +21,13 @@ in
hostKeys = [
config.age.secrets."${initrdHostKey}".path
];
authorizedKeys = with lib;
concatLists (mapAttrsToList
(name: user:
if elem "wheel" user.extraGroups then
user.openssh.authorizedKeys.keys
else
[ ])
config.users.users);
authorizedKeys =
with lib;
concatLists (
mapAttrsToList (
name: user: if elem "wheel" user.extraGroups then user.openssh.authorizedKeys.keys else [ ]
) config.users.users
);
};
postCommands = ''
echo 'cryptsetup-askpass' >> /root/.profile
@ -36,7 +35,9 @@ in
};
assertions = lib.singleton {
assertion = (config.boot.initrd.network.ssh.hostKeys != [ ]) -> config.boot.loader.supportsInitrdSecrets == true;
assertion =
(config.boot.initrd.network.ssh.hostKeys != [ ])
-> config.boot.loader.supportsInitrdSecrets == true;
message = "Refusing to store private keys in store";
};

13
nixos/modules/profiles/laptop.nix
View file

@ -1,12 +1,14 @@
{ config
, lib
, ...
{
config,
lib,
...
}:
let
inputs = config.dadada.inputs;
secretsPath = config.dadada.secrets.path;
in
with lib; {
with lib;
{
imports = [
./backup.nix
./base.nix
@ -53,5 +55,6 @@ with lib; {
passphrasePath = config.age.secrets."${config.networking.hostName}-backup-passphrase-gs".path;
};
age.secrets."${config.networking.hostName}-backup-passphrase-gs".file = "${secretsPath}/${config.networking.hostName}-backup-passphrase-gs.age";
age.secrets."${config.networking.hostName}-backup-passphrase-gs".file =
"${secretsPath}/${config.networking.hostName}-backup-passphrase-gs.age";
}

16
nixos/modules/profiles/server.nix
View file

@ -1,9 +1,11 @@
{ config
, pkgs
, lib
, ...
{
config,
pkgs,
lib,
...
}:
with lib; {
with lib;
{
imports = [
./backup.nix
./base.nix
@ -16,7 +18,9 @@ with lib; {
documentation.enable = mkDefault false;
documentation.nixos.enable = mkDefault false;
services.btrfs.autoScrub.enable = mkDefault ((filterAttrs (name: fs: fs.fsType == "btrfs") config.fileSystems) != { });
services.btrfs.autoScrub.enable = mkDefault (
(filterAttrs (name: fs: fs.fsType == "btrfs") config.fileSystems) != { }
);
services.journald.extraConfig = ''
SystemKeepFree = 2G

7
nixos/modules/profiles/upgrade-pg-cluster.nix
View file

@ -1,4 +1,9 @@
{ config, pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
{
environment.systemPackages = lib.mkIf config.services.postgresql.enable [
(

12
nixos/modules/share.nix
View file

@ -1,9 +1,11 @@
{ config
, pkgs
, lib
, ...
{
config,
pkgs,
lib,
...
}:
with lib; let
with lib;
let
cfg = config.dadada.share;
in
{

12
nixos/modules/steam.nix
View file

@ -1,9 +1,11 @@
{ config
, pkgs
, lib
, ...
{
config,
pkgs,
lib,
...
}:
with lib; let
with lib;
let
cfg = config.dadada.steam;
in
{

57
nixos/modules/vpnServer.nix
View file

@ -1,28 +1,32 @@
{ config
, pkgs
, lib
, ...
{
config,
pkgs,
lib,
...
}:
with lib; let
with lib;
let
cfg = config.dadada.vpnServer;
wgPeer = { name, ... }: {
options = {
name = mkOption {
internal = true;
default = name;
};
id = mkOption {
description = "VPN client id";
default = 0;
type = types.str;
};
key = mkOption {
description = "VPN client public key";
default = "";
type = types.str;
wgPeer =
{ name, ... }:
{
options = {
name = mkOption {
internal = true;
default = name;
};
id = mkOption {
description = "VPN client id";
default = 0;
type = types.str;
};
key = mkOption {
description = "VPN client public key";
default = "";
type = types.str;
};
};
};
};
in
{
options.dadada.vpnServer = {
@ -41,13 +45,10 @@ in
privateKeyFile = "/var/lib/wireguard/wg0-key";
ips = [ "fd42:9c3b:f96d:0201::0/64" ];
listenPort = 51234;
peers =
map
(peer: {
allowedIPs = [ "fd42:9c3b:f96d:0201::${peer.id}/128" ];
publicKey = peer.key;
})
(attrValues cfg.peers);
peers = map (peer: {
allowedIPs = [ "fd42:9c3b:f96d:0201::${peer.id}/128" ];
publicKey = peer.key;
}) (attrValues cfg.peers);
postSetup = ''
wg set wg0 fwmark 51234
ip -6 route add table 2468 fd42:9c3b:f96d::/48 dev ens3

12
nixos/modules/weechat.nix
View file

@ -1,9 +1,11 @@
{ config
, pkgs
, lib
, ...
{
config,
pkgs,
lib,
...
}:
with lib; let
with lib;
let
cfg = config.dadada.weechat;
in
{

12
nixos/modules/yubikey.nix
View file

@ -1,9 +1,11 @@
{ config
, pkgs
, lib
, ...
{
config,
pkgs,
lib,
...
}:
with lib; let
with lib;
let
yubikey = config.dadada.yubikey;
in
{