Bun/nixos-config
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Alright this ain't finished cause of the home stuff but I don't wanna lose what I've done. Impermanence, disko, lots of changes. TODO: add modularity to home.

Browse source
This commit is contained in:
Jimbo 2024-11-02 17:19:40 -04:00
parent 7a3f60038b
commit 15ab10152b
109 changed files with 766 additions and 749 deletions
Download patch file Download diff file Expand all files Collapse all files

5
modules/system/accounts/users/default.nix
View file

@ -1,9 +1,12 @@
{ ... }:
{ home-manager, ... }:
{
imports = [
./jimbo
./liquidsoap
./nextcloud
./nginx
home-manager.nixosModules.home-manager
];
users.mutableUsers = false;
}

16
modules/system/accounts/users/jimbo/default.nix
View file

@ -1,4 +1,4 @@
{ pkgs, config, ... }:
{ pkgs, config, unstable, nur, blender-bin, ... }:
{
users.users = {
jimbo = {
@ -26,7 +26,6 @@
"input"
"disk"
"dialout"
"networkmanager"
"rtkit"
"kvm"
"libvirtd"
@ -39,4 +38,17 @@
shell = pkgs.zsh;
};
};
home-manager = {
useUserPackages = true;
backupFileExtension = "backup";
extraSpecialArgs = {
inherit
unstable
nur
blender-bin
;
};
users.jimbo = import ../../../../home;
};
}

21
modules/system/desktop/sway/default.nix
View file

@ -2,31 +2,14 @@
{
imports = [
./greetd
./portals
];
programs.sway = {
enable = true;
xwayland.enable = true;
extraPackages = with pkgs; [
swaylock
swaybg
];
extraPackages = with pkgs; [ swaylock ];
};
# Allow swaylock to function
security.pam.services.swaylock = {};
xdg.portal = {
wlr = {
enable = true;
settings.screencast = {
max_fps = 60;
chooser_type = "simple";
chooser_cmd = "${pkgs.slurp}/bin/slurp -f %o -or -B 00000066 -b 00000099";
};
};
extraPortals = with pkgs; [
xdg-desktop-portal-gtk
];
};
}

52
modules/system/desktop/sway/greetd/default.nix
View file

@ -1,34 +1,32 @@
{ pkgs, ... }:
{
services = {
# Configure greetd for "auto" login (single user only)
greetd = let
startSway = pkgs.writeScript "startsway" ''
if lspci -k | grep "Kernel driver in use: nvidia" &> /dev/null; then
export LIBVA_DRIVER_NAME=nvidia
export GBM_BACKEND=nvidia-drm
export __GLX_VENDOR_LIBRARY_NAME=nvidia
else
:
fi
# Configure greetd for login directly to Sway
services.greetd = let
startSway = pkgs.writeScript "startsway" ''
if ${pkgs.pciutils}/bin/lspci -k | grep "in use: nvidia" &> /dev/null; then
export LIBVA_DRIVER_NAME=nvidia
export GBM_BACKEND=nvidia-drm
export __GLX_VENDOR_LIBRARY_NAME=nvidia
else
:
fi
export XDG_CURRENT_DESKTOP=sway
export QT_QPA_PLATFORM="wayland;xcb"
export XDG_CURRENT_DESKTOP=sway
export QT_QPA_PLATFORM="wayland;xcb"
sway --unsupported-gpu
'';
in {
enable = true;
restart = true;
settings = {
terminal = {
vt = 2;
switch = true;
};
default_session = {
command = "${startSway}";
user = "jimbo";
};
sway --unsupported-gpu
'';
in {
enable = true;
restart = true;
settings = {
terminal = {
vt = 2;
switch = true;
};
default_session = {
command = "${startSway}";
user = "jimbo";
};
};
};

16
modules/system/desktop/sway/portals/default.nix Normal file
View file

@ -0,0 +1,16 @@
{ pkgs, ... }:
{
xdg.portal = {
wlr = {
enable = true;
settings.screencast = {
max_fps = 60;
chooser_type = "simple";
chooser_cmd = "${pkgs.slurp}/bin/slurp -f %o -or -B 00000066 -b 00000099";
};
};
extraPortals = with pkgs; [
xdg-desktop-portal-gtk
];
};
}

1
modules/system/desktop/wayland/default.nix
View file

@ -3,7 +3,6 @@
programs = {
dconf.enable = true;
light.enable = true;
xwayland.enable = true;
};
services = {

20
modules/system/devices/audio/default.nix Normal file
View file

@ -0,0 +1,20 @@
{ pkgs, ... }:
{
services.pipewire = {
enable = true;
wireplumber = {
enable = true;
configPackages = [
(pkgs.writeTextDir "share/wireplumber/wireplumber.conf.d/11-bluetooth-policy.conf" ''
wireplumber.settings = { bluetooth.autoswitch-to-headset-profile = false }
'')
];
};
alsa = {
enable = true;
support32Bit = true;
};
pulse.enable = true;
#jack.enable = true;
};
}

3
modules/system/devices/default.nix
View file

@ -1,10 +1,11 @@
{ ... }:
{
imports = [
./audio
./bluetooth
./filesystems
./impermanence
./networking
./pipewire
./printing
./udev
./video

8
modules/system/devices/impermanence/default.nix Normal file
View file

@ -0,0 +1,8 @@
{ impermanence, ... }:
{
imports = [
./root
./jimbo
impermanence.nixosModules.impermanence
];
}

37
modules/system/devices/impermanence/jimbo/default.nix Normal file
View file

@ -0,0 +1,37 @@
{ ... }:
{
environment.persistence."/persist" = {
hideMounts = true;
users.jimbo = {
directories = [
"Downloads"
"Documents"
"Games"
"Pictures"
"Videos"
".snapshots"
".mozilla"
".thunderbird"
".config/blender"
".config/vesktop"
".config/sunshine"
".config/heroic"
".config/obs-studio"
".local/share/nvim/undo"
".local/share/fractal"
".local/share/PrismLauncher"
".local/share/Steam"
{ directory = ".ssh"; mode = "0700"; }
{ directory = ".gnupg"; mode = "0700"; }
{ directory = ".local/share/keyrings"; mode = "0700"; }
];
files = [
".zsh_history"
".local/share/clipman.json"
];
};
};
}

24
modules/system/devices/impermanence/root/default.nix Normal file
View file

@ -0,0 +1,24 @@
{ ... }:
{
environment.persistence."/persist" = {
hideMounts = true;
directories = [
"/etc/nixos"
"/etc/secureboot"
"/var/log"
"/var/lib/bluetooth"
"/var/lib/mpd"
"/var/lib/nixos"
"/var/lib/fail2ban"
"/var/lib/systemd/coredump"
];
files = [
"/etc/machine-id"
"/etc/ssh/ssh_host_ed25519_key"
"/etc/ssh/ssh_host_ed25519_key.pub"
"/etc/ssh/ssh_host_rsa_key"
"/etc/ssh/ssh_host_rsa_key.pub"
];
};
}

4
modules/system/devices/networking/default.nix
View file

@ -4,5 +4,9 @@
wireless.enable = false;
dhcpcd.enable = true;
nftables.enable = true;
nameservers = [
"1.1.1.1"
"1.1.1.2"
];
};
}

32
modules/system/devices/networking/wireguard/pc/default.nix
View file

@ -1,22 +1,22 @@
{ config, ... }:
{
networking.firewall = {
allowedUDPPorts = [ 51820 ];
};
networking = {
firewall.allowedUDPPorts = [ 51820 ];
networking.wireguard.interfaces = {
"${config.ips.wgInt}" = {
# Define IP of client in per device config
listenPort = 51820;
privateKey = config.secrets.wgClientPriv;
peers = [
{
publicKey = "qnOT/lXOJMaQgDUdXpyfGZB2IEyUouRje2m/bCe9ux8=";
allowedIPs = [ "${config.ips.wgSpan}.0/24" ];
endpoint = "sv.${config.domains.jim1}:51820";
persistentKeepalive = 25;
}
];
wireguard.interfaces = {
"${config.ips.wgInt}" = {
# Define IP of client in per device config
listenPort = 51820;
privateKey = config.secrets.wgClientPriv;
peers = [
{ # NixOS Server
publicKey = "qnOT/lXOJMaQgDUdXpyfGZB2IEyUouRje2m/bCe9ux8=";
allowedIPs = [ "${config.ips.wgSpan}.0/24" ];
endpoint = "sv.${config.domains.jim1}:51820";
persistentKeepalive = 25;
}
];
};
};
};
}

8
modules/system/devices/networking/wireguard/server/default.nix
View file

@ -6,12 +6,10 @@
externalInterface = "${config.ips.netInt}";
internalInterfaces = [ "${config.ips.wgInt}" ];
};
firewall.allowedUDPPorts = [ 51820 ];
};
networking.wireguard = {
enable = true;
interfaces = {
firewall.allowedUDPPorts = [ 51820 ];
wireguard.interfaces = {
"${config.ips.wgInt}" = {
ips = [ "${config.ips.wgSpan}.1/24" ];
listenPort = 51820;

4
modules/system/devices/networking/wireless/default.nix
View file

@ -5,7 +5,5 @@
enableB43Firmware = true;
};
environment.systemPackages = with pkgs; [
unstable.impala
];
environment.systemPackages = with pkgs; [ unstable.impala ];
}

23
modules/system/devices/pipewire/default.nix
View file

@ -1,23 +0,0 @@
{ pkgs, ... }:
{
services = {
pipewire = {
enable = true;
audio.enable = true;
wireplumber = {
enable = true;
configPackages = [(
pkgs.writeTextDir "share/wireplumber/wireplumber.conf.d/11-bluetooth-policy.conf" ''
wireplumber.settings = { bluetooth.autoswitch-to-headset-profile = false }
''
)];
};
alsa = {
enable = true;
support32Bit = true;
};
pulse.enable = true;
#jack.enable = true;
};
};
}

2
modules/system/devices/printing/default.nix
View file

@ -3,7 +3,7 @@
services = {
printing = {
enable = true;
drivers = with pkgs; [hplip];
drivers = with pkgs; [ hplip ];
webInterface = false;
};
avahi = {

4
modules/system/devices/udev/oculus/default.nix
View file

@ -7,8 +7,6 @@
destination = "/etc/udev/rules.d/10-oculus.rules";
};
in {
packages = [
oculusRules
];
packages = [ oculusRules ];
};
}

4
modules/system/devices/udev/pdp/default.nix
View file

@ -7,8 +7,6 @@
destination = "/etc/udev/rules.d/10-pdp.rules";
};
in {
packages = [
pdpRules
];
packages = [ pdpRules ];
};
}

4
modules/system/services/pc/default.nix
View file

@ -1,11 +1,11 @@
{ ... }:
{
imports = [
./fwupd
./gnome-keyring
./gvfs
./keyd
./mpd
./networkfs
./polkit
./snapper
];
}

8
modules/system/services/pc/fwupd/default.nix
View file

@ -1,8 +0,0 @@
{ pkgs, ... }:
{
services.fwupd.enable = true;
environment.systemPackages = with pkgs; [
fwupd
];
}

0
modules/system/services/pc/networkfs/default.nix → modules/system/services/pc/gvfs/default.nix
View file

1
modules/system/services/pc/keyd/default.nix
View file

@ -8,7 +8,6 @@
main = {
capslock = "overload(control,esc)";
leftcontrol = "overload(ctrlmod,noop)";
esc = "`";
rightcontrol = "esc";
left = "noop";

6
modules/system/services/pc/school/default.nix
View file

@ -1,6 +0,0 @@
{ ... }:
{
imports = [
./globalprotect
];
}

4
modules/system/services/pc/school/globalprotect/default.nix
View file

@ -1,4 +0,0 @@
{ ... }:
{
services.globalprotect.enable = true;
}

13
modules/system/services/pc/snapper/default.nix Normal file
View file

@ -0,0 +1,13 @@
{ ... }:
{
imports = [
./root
./jimbo
];
services.snapper = {
snapshotInterval = "0/6:00:00";
cleanupInterval = "12:00:00";
persistentTimer = true;
};
}

12
modules/system/services/pc/snapper/jimbo/default.nix Normal file
View file

@ -0,0 +1,12 @@
{ ... }:
{
services.snapper.configs.jimbo = {
SUBVOLUME = "/persist/home/jimbo";
TIMELINE_CREATE = true;
TIMELINE_CLEANUP = true;
TIMELINE_LIMIT_DAILY = 1;
TIMELINE_LIMIT_WEEKLY = 1;
TIMELINE_LIMIT_MONTHLY = 0;
TIMELINE_LIMIT_YEARLY = 0;
};
}

12
modules/system/services/pc/snapper/root/default.nix Normal file
View file

@ -0,0 +1,12 @@
{ ... }:
{
services.snapper.configs.root = {
SUBVOLUME = "/persist";
TIMELINE_CREATE = true;
TIMELINE_CLEANUP = true;
TIMELINE_LIMIT_DAILY = 1;
TIMELINE_LIMIT_WEEKLY = 0;
TIMELINE_LIMIT_MONTHLY = 0;
TIMELINE_LIMIT_YEARLY = 0;
};
}

1
modules/system/services/pc/sunshine/default.nix
View file

@ -2,7 +2,6 @@
{
services.sunshine = {
enable = true;
settings.port = 57989;
autoStart = false;
};
}

31
modules/system/services/server/fileserver/local/samba/default.nix
View file

@ -5,24 +5,25 @@
enable = true;
securityType = "user";
openFirewall = true;
extraConfig = ''
workgroup = WORKGROUP
server string = JimSMB
security = user
hosts allow = ${config.ips.localSpan}. 127.0.0.1 localhost
hosts deny = 0.0.0.0/0
guest account = nobody
map to guest = bad user
'';
shares = {
roms = {
comment = "Samba share with my ROMs";
path = "/export/JimboNFS/Downloads/GameFiles/ROMS";
browseable = "yes";
settings = {
global = {
"workgroup" = "WORKGROUP";
"server string" = "JimSMB";
"security" = "user";
"hosts allow" = "${config.ips.localSpan}. 127.0.0.1 localhost";
"hosts deny" = "0.0.0.0/0";
"guest account" = "nobody";
"map to guest" = "bad user";
};
"roms" = {
"path" = "/export/JimboNFS/Downloads/GameFiles/ROMS";
"browseable" = "yes";
"read only" = "no";
"guest ok" = "no";
"guest ok" = "yes";
"create mask" = "0644";
"directory mask" = "0755";
"force user" = "username";
"force group" = "groupname";
};
};
};

14
modules/system/services/server/social/matrix/synapse/coturn/default.nix
View file

@ -12,7 +12,7 @@
min-port = 49000;
max-port = 50000;
use-auth-secret = true;
static-auth-secret = "will be world readable for local users :(";
static-auth-secret = config.secrets.coturnSecret;
realm = "turn.${config.domains.jim1}";
cert = "/var/lib/acme/turn.${config.domains.jim1}.com/fullchain.pem";
pkey = "/var/lib/acme/turn.${config.domains.jim1}.com/key.pem";
@ -24,7 +24,7 @@
"turn:turn.${config.domains.jim1}:3478?transport=udp"
"turn:turn.${config.domains.jim1}:3478?transport=tcp"
];
turn_shared_secret = config.services.coturn.static-auth-secret;
turn_shared_secret = config.secrets.coturnSecret;
turn_user_lifetime = "1h";
};
};
@ -32,10 +32,12 @@
# Open coturn ports
networking.firewall = {
allowedUDPPorts = [
3478 5349
];
allowedUDPPortRanges = [
{ from = 49000; to = 50000; }
3478
5349
];
allowedUDPPortRanges = [{
from = config.services.coturn.min-port;
to = config.services.coturn.max-port;
}];
};
}

18
modules/system/services/server/social/matrix/synapse/default.nix
View file

@ -13,14 +13,16 @@
public_baseurl = "https://matrix.${config.domains.jim1}";
suppress_key_server_warning = true;
listeners = [{
port = 8008;
bind_addresses = [ "::" "0.0.0.0" ];
resources = [ { compress = false; names = [ "client" "federation" ]; } ];
type = "http";
tls = false;
x_forwarded = true;
}];
listeners = [
{
port = 8008;
bind_addresses = [ "::" "0.0.0.0" ];
resources = [ { compress = true; names = [ "client" "federation" ]; } ];
type = "http";
tls = false;
x_forwarded = true;
}
];
email = {
notif_from = "Jimbo's Matrix <noreply@${config.domains.jim1}>";

4
modules/system/services/server/transmission/default.nix
View file

@ -8,8 +8,6 @@
enable = true;
credentialsFile = pkgs.writeText "credentials" config.secrets.transmissionCredFile;
openPeerPorts = true;
settings = {
rpc-authentication-required = true;
};
settings.rpc-authentication-required = true;
};
}