dadada/nix-config
dadada/nix-config
1
0
Fork 0
Code Issues 2 Pull requests 5 Projects Releases Packages Wiki Activity Actions

updgrade to 23.11

Browse source
This commit is contained in:
Tim Schubert 2023-12-02 15:48:36 +01:00
parent 2c0f9dd7f8
commit eb9cd9d8cf
Signed by: dadada
SSH key fingerprint: SHA256:bFAjFH3hR8zRBaJjzQDjc3o4jqoq5EZ87l+KXEjxIz0
40 changed files with 18 additions and 621 deletions
Download patch file Download diff file Expand all files Collapse all files

2
nixos/modules/admin.nix
View file

@ -96,7 +96,7 @@ in
users.mutableUsers = mkDefault false;
environment.systemPackages = with pkgs; [
vim
helix
tmux
];

1
nixos/modules/default.nix
View file

@ -14,7 +14,6 @@
packages = import ./packages.nix;
secrets = import ./secrets.nix;
share = import ./share.nix;
soft-serve = import ./soft-serve.nix;
steam = import ./steam.nix;
sway = import ./sway.nix;
vpnServer = import ./vpnServer.nix;

2
nixos/modules/profiles/laptop.nix
View file

@ -20,7 +20,7 @@ with lib; {
age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
fonts.fonts = mkDefault (with pkgs; [
fonts.packages = mkDefault (with pkgs; [
source-code-pro
]);

212
nixos/modules/soft-serve.nix
View file

@ -1,212 +0,0 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.soft-serve;
configFile = format.generate "config.yaml" cfg.settings;
exe = getExe cfg.package;
format = pkgs.formats.yaml { };
user = "soft-serve";
in
{
options = {
services.soft-serve = {
enable = mkEnableOption "Enable soft-serve service";
package = mkPackageOption pkgs "soft-serve" { };
stateDir = mkOption {
type = types.path;
default = "/var/lib/soft-serve";
description = lib.mdDoc ''
The absolute path to the data directory.
See <https://github.com/charmbracelet/soft-serve>.
'';
};
user = mkOption {
type = types.str;
default = user;
description = lib.mdDoc "User account under which soft-serve runs.";
};
group = mkOption {
type = types.str;
default = user;
description = lib.mdDoc "Group account under which soft-serve runs.";
};
settings = mkOption {
type = format.type;
default = { };
description = lib.mdDoc ''
The contents of the configuration file.
See <https://github.com/charmbracelet/soft-serve>.
'';
example = literalExpression ''
{
# Soft Serve Server configurations
# The name of the server.
# This is the name that will be displayed in the UI.
name = "Soft Serve";
# Log format to use. Valid values are "json", "logfmt", and "text".
log_format = "text";
# The SSH server configuration.
ssh = {
# The address on which the SSH server will listen.
listen_addr = ":23231";
# The public URL of the SSH server.
# This is the address that will be used to clone repositories.
public_url = "ssh://localhost:23231";
# The path to the SSH server's private key.
key_path = "ssh/soft_serve_host";
# The path to the SSH server's client private key.
# This key will be used to authenticate the server to make git requests to
# ssh remotes.
client_key_path = "ssh/soft_serve_client";
# The maximum number of seconds a connection can take.
# A value of 0 means no timeout.
max_timeout = 0;
# The number of seconds a connection can be idle before it is closed.
idle_timeout = 120;
};
# The Git daemon configuration.
git = {
# The address on which the Git daemon will listen.
listen_addr = ":9418";
# The maximum number of seconds a connection can take.
# A value of 0 means no timeout.
max_timeout = 0;
# The number of seconds a connection can be idle before it is closed.
idle_timeout = 3;
# The maximum number of concurrent connections.
max_connections = 32;
};
# The HTTP server configuration.
http = {
# The address on which the HTTP server will listen.
listen_addr = ":23232";
# The path to the TLS private key.
tls_key_path = "";
# The path to the TLS certificate.
tls_cert_path = "";
# The public URL of the HTTP server.
# This is the address that will be used to clone repositories.
# Make sure to use https:// if you are using TLS.
public_url = "http://localhost:23232";
};
# The stats server configuration.
stats = {
# The address on which the stats server will listen.
listen_addr = ":23233";
};
# Additional admin keys.
initial_admin_keys = [
"ssh-rsa AAAAB3NzaC1yc2..."
];
};
'';
};
};
};
config = let stateDir = cfg.stateDir; in mkIf cfg.enable {
users.users = mkIf (cfg.user == "soft-serve") {
soft-serve = {
description = "soft-serve service";
home = cfg.stateDir;
useDefaultShell = true;
group = cfg.group;
isSystemUser = true;
};
};
users.groups = mkIf (cfg.group == "soft-serve") {
soft-serve = { };
};
systemd.tmpfiles.rules = [
"d '${stateDir}' 0750 ${cfg.user} ${cfg.group} - -"
];
systemd.services.soft-serve = {
description = "Soft Serve git server 🍦";
documentation = [ "https://github.com/charmbracelet/soft-serve" ];
requires = [ "network-online.target" ];
after = [ "network-online.target" ];
wantedBy = [ "multi-user.target" ];
environment = {
SOFT_SERVE_DATA_PATH = stateDir;
};
preStart = ''
# Link the settings file into the data directory.
ln -fs ${configFile} ${stateDir}/config.yaml
'';
serviceConfig = {
Type = "simple";
User = cfg.user;
Group = cfg.group;
Restart = "always";
RestartSec = "1";
ExecStart = "${exe} serve";
WorkingDirectory = stateDir;
RuntimeDirectory = "soft-serve";
RuntimeDirectoryMode = "0750";
ProcSubset = "pid";
ProtectProc = "invisible";
ReadWritePaths = [ stateDir ];
UMask = "0027";
CapabilityBoundingSet = "";
NoNewPrivileges = true;
ProtectSystem = "strict";
ProtectHome = true;
PrivateTmp = true;
PrivateDevices = true;
PrivateUsers = true;
ProtectHostname = true;
ProtectClock = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectKernelLogs = true;
ProtectControlGroups = true;
RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
RestrictNamespaces = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
RemoveIPC = true;
PrivateMounts = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"~@cpu-emulation @debug @keyring @module @mount @obsolete @privileged @raw-io @reboot @setuid @swap"
];
};
};
};
meta.maintainers = [ maintainers.dadada ];
}