Bun/nixos-config
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Update a lot of options, simplify variables, replace options with tags

Browse source
This commit is contained in:
Bun 2025-06-04 16:12:08 -04:00
parent dbc0ab6dd3
commit 7667ef9a1b
147 changed files with 663 additions and 928 deletions
Download patch file Download diff file Expand all files Collapse all files

11
modules/system/default.nix
View file

@ -1,4 +1,4 @@
{ config, lib, name, ... }:
{ config, name, ... }:
{
imports = [
./devices
@ -7,12 +7,9 @@
./services
./settings
./users
./variables
];
options.system = with lib; {
desktop.enable = mkEnableOption "Desktop apps and services";
server.enable = mkEnableOption "Server apps and services";
};
config.networking.hostName = name;
networking.hostName = name;
deployment.tags = config.system.nixos.tags;
}

4
modules/system/devices/audio/default.nix
View file

@ -1,13 +1,13 @@
{ config, ... }:
{
services.pipewire = {
enable = config.system.desktop.enable;
wireplumber.extraConfig."wireplumber.settings"."bluetooth.autoswitch-to-headset-profile" = false;
enable = builtins.elem "pc" config.system.nixos.tags;
alsa = {
enable = true;
support32Bit = true;
};
pulse.enable = true;
#jack.enable = true;
wireplumber.extraConfig."wireplumber.settings"."bluetooth.autoswitch-to-headset-profile" = false;
};
}

10
modules/system/devices/bluetooth/default.nix
View file

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
{ config, lib, ... }:
{
config = lib.mkIf config.system.desktop.enable {
config = lib.mkIf (builtins.elem "pc" config.system.nixos.tags) {
hardware.bluetooth = {
enable = true;
settings = {
@ -8,9 +8,7 @@
Policy.AutoEnable = "true";
};
};
environment = {
systemPackages = with pkgs; [ bluetui ];
persistence."/persist".directories = [ "/var/lib/bluetooth" ];
};
environment.persistence."/persist".directories = [ "/var/lib/bluetooth" ];
};
}

1
modules/system/devices/boot/default.nix
View file

@ -10,7 +10,6 @@
boot = {
kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;
kernelParams = [ "nouveau.config=NvGspRm=1" ];
blacklistedKernelModules = [ "pcspkr" ];
kernel.sysctl = {
"vm.max_map_count" = 2147483642;

1
modules/system/devices/default.nix
View file

@ -7,6 +7,7 @@
./disks
./networking
./printing
./tlp
./udev
./video
];

11
modules/system/devices/disks/filesystems/default.nix
View file

@ -2,17 +2,20 @@
{
boot = {
supportedFilesystems = {
ntfs = config.system.desktop.enable;
zfs = config.system.server.enable;
ntfs = builtins.elem "pc" config.system.nixos.tags;
zfs = builtins.elem "server" config.system.nixos.tags;
};
swraid = {
enable = config.system.server.enable;
enable = builtins.elem "server" config.system.nixos.tags;
mdadmConf = "MAILADDR contact@nixfox.ca";
};
};
services = lib.mkIf config.environment.persistence."/persist".enable {
btrfs.autoScrub.enable = true;
btrfs.autoScrub = {
enable = true;
interval = "weekly";
};
fstrim.enable = true;
};

1
modules/system/devices/networking/default.nix
View file

@ -1,6 +1,7 @@
{ config, ... }:
{
imports = [
./mounts
./mycelium
./nameservers
./wireless

32
modules/system/devices/networking/mounts/default.nix Normal file
View file

@ -0,0 +1,32 @@
{ config, lib, nodes, ... }:
{
fileSystems = let
netOpts = [
"noauto"
"soft"
"x-systemd.automount"
];
in with nodes; {
"midas" = {
enable = lib.mkDefault false;
device = "[${midas.config.deployment.targetHost}]:/storage";
mountPoint = "/network/Midas";
fsType = "nfs4";
options = netOpts;
};
"kitty" = {
enable = lib.mkDefault false;
device = "[${kitty.config.deployment.targetHost}]:/storage";
mountPoint = "/network/Kitty";
fsType = "nfs4";
options = netOpts;
};
"prophet" = {
enable = lib.mkDefault false;
device = "[${prophet.config.deployment.targetHost}]:/storage";
mountPoint = "/network/Prophet";
fsType = "nfs4";
options = netOpts;
};
};
}

4
modules/system/devices/networking/wireless/default.nix
View file

@ -1,7 +1,7 @@
{ config, ... }:
{ ... }:
{
networking.wireless = {
enable = config.system.desktop.enable;
enable = true;
userControlled.enable = true;
};
}

2
modules/system/devices/printing/default.nix
View file

@ -2,7 +2,7 @@
{
services = {
printing = {
enable = config.system.desktop.enable;
enable = builtins.elem "pc" config.system.nixos.tags;
drivers = with pkgs; [ hplip ];
};
avahi = {

31
modules/system/devices/tlp/default.nix Normal file
View file

@ -0,0 +1,31 @@
{ config, ... }:
{
services.tlp = {
enable = true;
settings = let
leastBat = 80;
maxBat = 85;
in {
# Stop battery charging after threshold
START_CHARGE_THRESH_BAT0 = leastBat;
STOP_CHARGE_THRESH_BAT0 = maxBat;
START_CHARGE_THRESH_BAT1 = leastBat;
STOP_CHARGE_THRESH_BAT1 = maxBat;
# Change CPU energy/performance policy to power
CPU_ENERGY_PERF_POLICY_ON_AC = "performance";
CPU_ENERGY_PERF_POLICY_ON_BAT = "power";
# Enable the platform profile low-power
PLATFORM_PROFILE_ON_AC = "performance";
PLATFORM_PROFILE_ON_BAT = "low-power";
# Disable turbo boost
CPU_BOOST_ON_AC = 1;
CPU_BOOST_ON_BAT = 0;
CPU_HWP_DYN_BOOST_ON_AC = 1;
CPU_HWP_DYN_BOOST_ON_BAT = 0;
};
};
}

5
modules/system/devices/udev/default.nix
View file

@ -1,6 +1,7 @@
{ config, lib, pkgs, ... }:
{ pkgs, ... }:
{
services.udev.packages = with pkgs; lib.mkIf config.system.desktop.enable [
services.udev.packages = with pkgs; [
android-udev-rules
game-devices-udev-rules
];
}

2
modules/system/devices/video/default.nix
View file

@ -3,7 +3,7 @@
imports = [ ./nvidia ];
hardware.graphics = {
enable = config.system.desktop.enable;
enable = builtins.elem "pc" config.system.nixos.tags;
enable32Bit = if config.nixpkgs.hostPlatform.linuxArch == "x86_64" then true else false;
extraPackages = with pkgs; [
vulkan-loader

12
modules/system/devices/video/nvidia/default.nix
View file

@ -1,20 +1,18 @@
{ config, lib, ... }:
{
options.system.nvidia.enable = lib.mkEnableOption "Nvidia graphic drivers";
config = lib.mkIf (lib.elem "nvidia" config.services.xserver.videoDrivers) {
boot.kernelParams = [ "nvidia_drm.fbdev=1" ]; # Framebuffer fixes TTY access
config = lib.mkIf config.system.nvidia.enable {
hardware.nvidia = {
modesetting.enable = true;
nvidiaSettings = false;
open = true;
};
boot.kernelParams = [ "nvidia_drm.fbdev=1" ]; # Framebuffer fixes TTY access
services.xserver.videoDrivers = [ "nvidia" ];
nixpkgs.allowUnfreePackages = [ "nvidia-x11" ];
specialisation.nouveau.configuration.config.system.nvidia.enable = lib.mkForce false;
specialisation.nouveau.configuration.config.services.xserver.videoDrivers = lib.mkForce [ "nouveau" ];
} // {
boot.kernelParams = [ "nouveau.config=NvGspRm=1" ];
};
}

2
modules/system/programs/desktops/default.nix
View file

@ -1,6 +1,6 @@
{ config, lib, ... }:
{
config = lib.mkIf config.system.desktop.enable {
config = lib.mkIf (builtins.elem "pc" config.system.nixos.tags) {
programs.sway.enable = true;
security.pam.services.swaylock = {};
};

2
modules/system/programs/gaming/default.nix
View file

@ -1,7 +1,7 @@
{ config, ... }:
{
programs.gamemode = {
enable = config.system.desktop.enable;
enable = builtins.elem "pc" config.system.nixos.tags;
settings = {
general.renice = 10;
gpu = {

4
modules/system/programs/udevil/default.nix
View file

@ -1,4 +1,4 @@
{ config, ... }:
{ ... }:
{
programs.udevil.enable = config.system.desktop.enable;
programs.udevil.enable = true;
}

BIN
modules/system/secrets/default.nix
View file

Binary file not shown.

1
modules/system/services/general/default.nix
View file

@ -6,7 +6,6 @@
./libvirtd
./snowflake
./ssh
./tlp
./userborn
./vmware
];

2
modules/system/services/general/displaymanager/default.nix
View file

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
{
config = lib.mkIf config.system.desktop.enable {
config = lib.mkIf (builtins.elem "pc" config.system.nixos.tags) {
services.greetd = {
enable = true;
settings.default_session.command = lib.mkDefault (lib.strings.concatStringsSep " " [

12
modules/system/services/general/libvirtd/default.nix
View file

@ -14,13 +14,15 @@
};
};
programs.virt-manager.enable = true;
networking.firewall.trustedInterfaces = [
"virbr0"
"virbr1"
# Isolate devices into more IOMMU groups
boot.kernelParams = [
"pcie_acs_override=downstream,multifunction"
"pci=routeirq"
];
programs.virt-manager.enable = true;
# Allow looking glass to be accessed by users
systemd.tmpfiles.rules = [ "f /dev/shm/looking-glass 0660 - libvirtd -" ];
environment.persistence."/persist".directories = [ "/var/lib/libvirt" ];

4
modules/system/services/general/tlp/default.nix
View file

@ -1,4 +0,0 @@
{ config, ... }:
{
services.tlp.enable = config.system.desktop.enable;
}

2
modules/system/services/server/cfdyndns/default.nix
View file

@ -1,4 +1,4 @@
{ config, lib, pkgs, ... }:
{ config, lib, ... }:
{
config = lib.mkIf config.services.cloudflare-dyndns.enable {
services.cloudflare-dyndns.apiTokenFile = "/var/lib/private/cloudflare-dyndns/key";

1
modules/system/services/server/default.nix
View file

@ -5,7 +5,6 @@
./forgejo
./icecast
./jellyfin
./lemmy
./mailserver
./mastodon
./matrix

12
modules/system/services/server/forgejo/default.nix
View file

@ -8,17 +8,17 @@
lfs.enable = true;
settings = {
server = {
DOMAIN = "git.nixfox.ca";
ROOT_URL = "https://git.nixfox.ca:443";
DOMAIN = "git.${config.vars.mainDomain}";
ROOT_URL = "https://git.${config.vars.mainDomain}:443";
HTTP_PORT = 3110;
SSH_PORT = 2299;
START_SSH_SERVER = true;
};
mailer = {
ENABLED = true;
SMTP_ADDR = "mx.nixfox.ca";
FROM = "NixFox Git <noreply@nixfox.ca>";
USER = "noreply@nixfox.ca";
SMTP_ADDR = "mx.${config.vars.mainDomain}";
FROM = "NixFox Git <noreply@${config.vars.mainDomain}>";
USER = "noreply@${config.vars.mainDomain}";
PASSWD = config.secrets.mailPass.nixfoxNoReply;
PROTOCOL = "smtps";
};
@ -32,7 +32,7 @@
networking.firewall.allowedTCPPorts = [ 2299 ];
services.cloudflare-dyndns.domains = [ "git.nixfox.ca" ];
services.cloudflare-dyndns.domains = [ "git.${config.vars.mainDomain}" ];
environment.persistence."/persist".directories = [ "/var/lib/forgejo" ];
};

2
modules/system/services/server/forgejo/nginx/default.nix
View file

@ -1,6 +1,6 @@
{ config, lib, ... }:
{
services.nginx.virtualHosts."git.nixfox.ca" = lib.mkIf config.services.forgejo.enable {
services.nginx.virtualHosts."git.${config.vars.mainDomain}" = lib.mkIf config.services.forgejo.enable {
enableACME = true;
forceSSL = true;
locations."/" = {

6
modules/system/services/server/icecast/default.nix
View file

@ -7,9 +7,9 @@
services.icecast = {
listen.port = 73;
hostname = "radio.nixfox.ca";
hostname = "radio.${config.vars.mainDomain}";
admin = {
user = config.sysusers.main;
user = "admin";
password = config.secrets.cast.adminPass;
};
extraConf = ''
@ -17,7 +17,7 @@
<source-password>${config.secrets.cast.sourcePass}</source-password>
</authentication>
<location>Canada</location>
<admin>contact@nixfox.ca</admin>
<admin>contact@${config.vars.mainDomain}</admin>
'';
};
}

2
modules/system/services/server/icecast/nginx/default.nix
View file

@ -1,6 +1,6 @@
{ config, lib, ... }:
{
services.nginx.virtualHosts."radio.nixfox.ca" = lib.mkIf config.services.icecast.enable {
services.nginx.virtualHosts."radio.${config.vars.mainDomain}" = lib.mkIf config.services.icecast.enable {
enableACME = true;
forceSSL = true;
locations."/" = {

2
modules/system/services/server/jellyfin/nginx/default.nix
View file

@ -1,6 +1,6 @@
{ config, lib, ... }:
{
services.nginx.virtualHosts."jelly.nixfox.ca" = lib.mkIf config.services.jellyfin.enable {
services.nginx.virtualHosts."jelly.${config.vars.mainDomain}" = lib.mkIf config.services.jellyfin.enable {
enableACME = true;
forceSSL = true;
locations."/" = {

22
modules/system/services/server/lemmy/default.nix
View file

@ -1,22 +0,0 @@
{ config, lib, ... }:
{
imports = [ ./nginx ];
config = lib.mkIf config.services.lemmy.enable {
services.lemmy = lib.mkIf config.services.lemmy.enable {
nginx.enable = true;
database.createLocally = true;
settings = {
hostname = "lemmy.nixfox.ca";
email = {
smtp_server = "mx.nixfox.ca:587";
smtp_login = "noreply@nixfox.ca";
smtp_from_address = "NixFox Lemmy <noreply@nixfox.ca>";
smtp_password = config.secrets.mailPass.nixfoxNoReply;
tls_type = "starttls";
};
};
};
environment.persistence."/persist".directories = [ "/var/lib/postgresql" ];
};
}

7
modules/system/services/server/lemmy/nginx/default.nix
View file

@ -1,7 +0,0 @@
{ config, lib, ... }:
{
services.nginx.virtualHosts."lemmy.nixfox.ca" = lib.mkIf config.services.lemmy.enable {
enableACME = true;
forceSSL = true;
};
}

70
modules/system/services/server/mailserver/default.nix
View file

@ -1,11 +1,75 @@
{ lib, ... }:
{ config, lib, pkgs, mailserver, ... }:
{
imports = [
./go-autoconfig
./radicale
./roundcube
./simplenix
mailserver.nixosModule
];
options.services.mailserver.enable = lib.mkEnableOption "Simple NixOS Mailserver";
config = lib.mkIf config.mailserver.enable {
mailserver = {
fqdn = "mx.${config.vars.mainDomain}";
domains = [
"nixfox.ca"
"bloxelcom.net"
"freecorn1854.win"
"lunamoonlight.xyz"
];
certificateScheme = "acme-nginx";
localDnsResolver = false;
redis.port = 1515;
# Passwords made with 'mkpasswd -sm bcrypt'
loginAccounts = {
"jimbo@nixfox.ca" = {
hashedPassword = config.secrets.mailHash.bun;
aliases = [
"james@nixfox.ca"
"bun@nixfox.ca"
"bun@bloxelcom.net"
"contact@nixfox.ca"
];
};
"luna@lunamoonlight.xyz" = {
hashedPassword = config.secrets.mailHash.luna;
aliases = [
"luna@bloxelcom.net"
"contact@bloxelcom.net"
"ibu@bloxelcom.net"
];
};
"contact@freecorn1854.win" = {
hashedPassword = config.secrets.mailHash.corn;
aliases = [ "freecorn@bloxelcom.net" ];
};
# Noreply emails
"noreply@nixfox.ca" = {
hashedPassword = config.secrets.mailHash.nixfoxNoReply;
sendOnly = true;
};
"noreply@bloxelcom.net" = {
hashedPassword = config.secrets.mailHash.bloxelNoReply;
sendOnly = true;
};
};
};
services = {
redis.servers.rspamd.port = config.mailserver.redis.port;
cloudflare-dyndns.domains = [ config.mailserver.fqdn ];
};
environment.persistence."/persist".directories = [
"/var/vmail"
"/var/lib/dovecot"
"/var/lib/postfix"
"/var/lib/redis-rspamd"
];
};
}

2
modules/system/services/server/mailserver/go-autoconfig/default.nix
View file

@ -2,7 +2,7 @@
{
imports = [ ./nginx ];
services = lib.mkIf config.services.mailserver.enable {
services = lib.mkIf config.mailserver.enable {
go-autoconfig = {
enable = true;
settings = {

2
modules/system/services/server/mailserver/go-autoconfig/nginx/default.nix
View file

@ -1,6 +1,6 @@
{ config, lib, ... }:
{
services.nginx.virtualHosts."autoconfig.nixfox.ca" = lib.mkIf config.services.go-autoconfig.enable {
services.nginx.virtualHosts."autoconfig.${config.vars.mainDomain}" = lib.mkIf config.services.go-autoconfig.enable {
enableACME = true;
forceSSL = true;
locations."/" = {

2
modules/system/services/server/mailserver/radicale/default.nix
View file

@ -2,7 +2,7 @@
{
imports = [ ./nginx ];
config = lib.mkIf config.services.mailserver.enable {
config = lib.mkIf config.mailserver.enable {
services = {
radicale = {
enable = true;

2
modules/system/services/server/mailserver/radicale/nginx/default.nix
View file

@ -1,6 +1,6 @@
{ config, lib, ... }:
{
services.nginx.virtualHosts."cal.nixfox.ca" = lib.mkIf config.services.go-autoconfig.enable {
services.nginx.virtualHosts."cal.${config.vars.mainDomain}" = lib.mkIf config.services.radicale.enable {
enableACME = true;
forceSSL = true;
locations."/" = {

6
modules/system/services/server/mailserver/roundcube/default.nix
View file

@ -1,11 +1,11 @@
{ config, lib, ... }:
{
config = lib.mkIf config.services.mailserver.enable {
config = lib.mkIf config.mailserver.enable {
services.roundcube = {
enable = true;
hostName = "mail.nixfox.ca";
hostName = "mail.${config.vars.mainDomain}";
extraConfig = ''
$config['smtp_server'] = "tls://mx.nixfox.ca";
$config['smtp_server'] = "tls://mx.${config.vars.mainDomain}";
$config['smtp_user'] = "%u";
$config['smtp_pass'] = "%p";
'';

72
modules/system/services/server/mailserver/simplenix/default.nix
View file

@ -1,72 +0,0 @@
{ config, lib, pkgs, mailserver, ... }:
{
imports = [ mailserver.nixosModule ];
config = lib.mkIf config.services.mailserver.enable {
mailserver = {
enable = true;
fqdn = "mx.nixfox.ca";
domains = [
"nixfox.ca"
"bloxelcom.net"
"freecorn1854.win"
"lunamoonlight.xyz"
];
certificateScheme = "acme-nginx";
localDnsResolver = false;
redis.port = 1515;
# Passwords made with 'mkpasswd -sm bcrypt'
loginAccounts = {
"jimbo@nixfox.ca" = {
hashedPassword = config.secrets.mailHash.bun;
aliases = [
"james@nixfox.ca"
"jimbo@bloxelcom.net"
"bun@nixfox.ca"
"bun@bloxelcom.net"
"contact@nixfox.ca"
];
};
"luna@lunamoonlight.xyz" = {
hashedPassword = config.secrets.mailHash.luna;
aliases = [
"luna@bloxelcom.net"
"contact@bloxelcom.net"
"ibu@bloxelcom.net"
];
};
"contact@freecorn1854.win" = {
hashedPassword = config.secrets.mailHash.corn;
aliases = [ "freecorn@bloxelcom.net" ];
};
# Noreply emails
"noreply@nixfox.ca" = {
hashedPassword = config.secrets.mailHash.nixfoxNoReply;
sendOnly = true;
};
"noreply@bloxelcom.net" = {
hashedPassword = config.secrets.mailHash.bloxelNoReply;
sendOnly = true;
};
};
};
services = {
redis.servers.rspamd.port = config.mailserver.redis.port;
cloudflare-dyndns.domains = [ config.mailserver.fqdn ];
};
environment.persistence."/persist".directories = [
"/var/vmail"
"/var/lib/dovecot"
"/var/lib/postfix"
"/var/lib/redis-rspamd"
];
};
}

2
modules/system/services/server/matrix/coturn/default.nix
View file

@ -12,7 +12,7 @@
max-port = 50000;
use-auth-secret = true;
static-auth-secret = config.secrets.coturnSecret;
realm = "turn.nixfox.ca";
realm = "turn.${config.vars.mainDomain}";
cert = "/var/lib/acme/${config.services.coturn.realm}/fullchain.pem";
pkey = "/var/lib/acme/${config.services.coturn.realm}/key.pem";
};

10
modules/system/services/server/matrix/coturn/nginx/default.nix
View file

@ -1,7 +1,7 @@
{ config, lib, ... }:
{
config = lib.mkIf config.services.coturn.enable {
services.nginx.virtualHosts."turn.nixfox.ca" = {
services.nginx.virtualHosts."turn.${config.vars.mainDomain}" = {
enableACME = true;
forceSSL = true;
listen = [{
@ -12,11 +12,9 @@
locations."/".proxyPass = "http://127.0.0.1:1380";
};
security.acme.certs = {
"turn.nixfox.ca" = {
group = "turnserver";
postRun = "systemctl restart coturn.service";
};
security.acme.certs."turn.${config.vars.mainDomain}" = {
group = "turnserver";
postRun = "systemctl restart coturn.service";
};
};
}

10
modules/system/services/server/matrix/element/default.nix
View file

@ -4,14 +4,14 @@
nixpkgs.config.element-web.conf = {
default_server_config."m.homeserver" = {
base_url = "https://matrix.nixfox.ca";
server_name = "matrix.nixfox.ca";
base_url = "https://matrix.${config.vars.mainDomain}";
server_name = "matrix.${config.vars.mainDomain}";
};
branding = {
auth_header_logo_url = "https://www.nixfox.ca/images/copyright/profile.png";
#welcome_background_url = "https://www.nixfox.ca/images/backgrounds/template-background.png";
auth_header_logo_url = "https://www.${config.vars.mainDomain}/images/copyright/profile.png";
#welcome_background_url = "https://www.${config.vars.mainDomain}/images/backgrounds/template-background.png";
};
embedded_pages.home_url = "https://www.nixfox.ca/";
embedded_pages.home_url = "https://www.${config.vars.mainDomain}/";
disable_custom_urls = true;
disable_guests = true;
default_theme = "dark";

2
modules/system/services/server/matrix/element/nginx/default.nix
View file

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
{
services.nginx.virtualHosts."chat.nixfox.ca" = lib.mkIf config.services.matrix-synapse.enable {
services.nginx.virtualHosts."chat.${config.vars.mainDomain}" = lib.mkIf config.services.matrix-synapse.enable {
enableACME = true;
addSSL = true;
root = "${pkgs.element-web}";

10
modules/system/services/server/matrix/synapse/default.nix
View file

@ -5,15 +5,15 @@
config = lib.mkIf config.services.matrix-synapse.enable {
services.matrix-synapse = {
settings = {
server_name = "nixfox.ca";
public_baseurl = "https://matrix.nixfox.ca";
server_name = "${config.vars.mainDomain}";
public_baseurl = "https://matrix.${config.vars.mainDomain}";
suppress_key_server_warning = true;
# Email notifications about account status
email = {
notif_from = "NixFox Matrix <noreply@nixfox.ca>";
smtp_host = "mx.nixfox.ca";
smtp_user = "noreply@nixfox.ca";
notif_from = "NixFox Matrix <noreply@${config.vars.mainDomain}>";
smtp_host = "mx.${config.vars.mainDomain}";
smtp_user = "noreply@${config.vars.mainDomain}";
smtp_pass = config.secrets.mailPass.nixfoxNoReply;
enable_tls = true;
smtp_port = 587;

2
modules/system/services/server/matrix/synapse/nginx/default.nix
View file

@ -1,6 +1,6 @@
{ config, lib, ... }:
{
services.nginx.virtualHosts."matrix.nixfox.ca" = lib.mkIf config.services.matrix-synapse.enable {
services.nginx.virtualHosts."matrix.${config.vars.mainDomain}" = lib.mkIf config.services.matrix-synapse.enable {
enableACME = true;
forceSSL = true;
locations = {

2
modules/system/services/server/minecraft/servers/blockworld/default.nix
View file

@ -14,6 +14,6 @@
symlinks = config.services.minecraft-servers.common.paperSymlinks;
files = config.services.minecraft-servers.common.configFiles;
};
cloudflare-dyndns.domains = lib.mkIf config.services.minecraft-servers.servers.blockworld.enable [ "bloxel.nixfox.ca" ];
cloudflare-dyndns.domains = lib.mkIf config.services.minecraft-servers.servers.blockworld.enable [ "bloxel.${config.vars.mainDomain}" ];
};
}

2
modules/system/services/server/minecraft/servers/cornworld/default.nix
View file

@ -13,6 +13,6 @@
symlinks = config.services.minecraft-servers.common.paperSymlinks;
files = config.services.minecraft-servers.common.configFiles;
};
cloudflare-dyndns.domains = lib.mkIf config.services.minecraft-servers.servers.cornworld.enable [ "corn.nixfox.ca" ];
cloudflare-dyndns.domains = lib.mkIf config.services.minecraft-servers.servers.cornworld.enable [ "corn.${config.vars.mainDomain}" ];
};
}

1
modules/system/services/server/minecraft/servers/default.nix
View file

@ -6,7 +6,6 @@
./dewdemolisher
./johnside
./marsh
./roguecraft
./skyblock
./uberbeta
./velocity

2
modules/system/services/server/minecraft/servers/dewdemolisher/default.nix
View file

@ -13,6 +13,6 @@
symlinks = config.services.minecraft-servers.common.paperSymlinks;
files = config.services.minecraft-servers.common.configFiles;
};
cloudflare-dyndns.domains = lib.mkIf config.services.minecraft-servers.servers.dewdemolisher.enable [ "dew.nixfox.ca" ];
cloudflare-dyndns.domains = lib.mkIf config.services.minecraft-servers.servers.dewdemolisher.enable [ "dew.${config.vars.mainDomain}" ];
};
}

2
modules/system/services/server/minecraft/servers/johnside/default.nix
View file

@ -26,6 +26,6 @@
};
files = config.services.minecraft-servers.common.configFiles;
};
cloudflare-dyndns.domains = lib.mkIf config.services.minecraft-servers.servers.johnside.enable [ "john.nixfox.ca" ];
cloudflare-dyndns.domains = lib.mkIf config.services.minecraft-servers.servers.johnside.enable [ "john.${config.vars.mainDomain}" ];
};
}

2
modules/system/services/server/minecraft/servers/marsh/default.nix
View file

@ -13,6 +13,6 @@
symlinks = config.services.minecraft-servers.common.paperSymlinks;
files = config.services.minecraft-servers.common.configFiles;
};
cloudflare-dyndns.domains = lib.mkIf config.services.minecraft-servers.servers.marsh.enable [ "marsh.nixfox.ca" ];
cloudflare-dyndns.domains = lib.mkIf config.services.minecraft-servers.servers.marsh.enable [ "marsh.${config.vars.mainDomain}" ];
};
}

36
modules/system/services/server/minecraft/servers/roguecraft/default.nix
View file

@ -1,36 +0,0 @@
{ config, lib, pkgs, ... }:
{
services = {
minecraft-servers.servers.roguecraft = {
package = pkgs.paperServers.paper-1_21_1;
jvmOpts = "-Xmx3000M";
serverProperties = config.services.minecraft-servers.common.serverProperties // {
difficulty = 3;
server-port = 30014;
motd = "\\u00A7l\\u00A7bNixFox \\u00A7cRoguecraft \\u00A7bserver.";
require-resource-pack = true;
resource-pack = "https://nixfox.ca/roguecraftresourcepackredir";
resource-pack-sha1 = "b540c0562aba90c3ead2356bb9cb74fcf0db36b3";
};
whitelist = config.services.minecraft-servers.common.whitelist;
symlinks = config.services.minecraft-servers.common.paperSymlinks;
files = config.services.minecraft-servers.common.configFiles // {
"world/datapacks/roguecraft.zip" = builtins.fetchurl {
url = "https://nixfox.ca/roguecraftdatapackredir";
sha256 = "04zrkvzvi1i898al45fh9j3k635sf9qhwca7phbv4ynkfl8bz3q3";
};
};
};
cloudflare-dyndns.domains = lib.mkIf config.services.minecraft-servers.servers.roguecraft.enable [ "rogue.nixfox.ca" ];
nginx.virtualHosts."nixfox.ca".locations = lib.mkIf config.services.minecraft-servers.servers.roguecraft.enable {
"/roguecraftdatapackredir" = {
return = "301 https://cdn.modrinth.com/data/HtKjVijx/versions/Rme4c23R/Roguecraft%201.2.6%20-%20Data%20Pack.zip";
};
"/roguecraftresourcepackredir" = {
return = "301 https://cdn.modrinth.com/data/HtKjVijx/versions/C6bITJnq/Roguecraft%201.2.5.4%20-%20Resource%20Pack.zip";
};
};
};
}

2
modules/system/services/server/minecraft/servers/skyblock/default.nix
View file

@ -13,6 +13,6 @@
symlinks = config.services.minecraft-servers.common.paperSymlinks;
files = config.services.minecraft-servers.common.configFiles;
};
cloudflare-dyndns.domains = lib.mkIf config.services.minecraft-servers.servers.skyblock.enable [ "skyblock.nixfox.ca" ];
cloudflare-dyndns.domains = lib.mkIf config.services.minecraft-servers.servers.skyblock.enable [ "skyblock.${config.vars.mainDomain}" ];
};
}

2
modules/system/services/server/minecraft/servers/uberbeta/default.nix
View file

@ -18,6 +18,6 @@ in {
server-port = 30005;
};
};
cloudflare-dyndns.domains = lib.mkIf config.services.minecraft-servers.servers.uberbeta.enable [ "beta.nixfox.ca" ];
cloudflare-dyndns.domains = lib.mkIf config.services.minecraft-servers.servers.uberbeta.enable [ "beta.${config.vars.mainDomain}" ];
};
}

10
modules/system/services/server/nextcloud/default.nix
View file

@ -8,10 +8,10 @@
config = lib.mkIf config.services.nextcloud.enable {
services.nextcloud = {
package = pkgs.nextcloud31;
hostName = "files.nixfox.ca";
hostName = "files.${config.vars.mainDomain}";
https = true;
config = {
adminuser = config.sysusers.main;
adminuser = "admin";
adminpassFile = "${pkgs.writeText "initial" config.secrets.initialPass}";
dbtype = "sqlite";
};
@ -19,11 +19,11 @@
trusted_proxies = [ "127.0.0.1" ];
trusted_domains = [ config.services.nextcloud.hostName ];
overwriteprotocol = "https";
mail_smtphost = "mx.nixfox.ca";
mail_domain = "nixfox.ca";
mail_smtphost = "mx.${config.vars.mainDomain}";
mail_domain = "${config.vars.mainDomain}";
mail_from_address = "noreply";
mail_smtpauth = "true";
mail_smtpname = "noreply@nixfox.ca";
mail_smtpname = "noreply@${config.vars.mainDomain}";
mail_smtppassword = config.secrets.mailPass.nixfoxNoReply;
mail_smtpmode = "smtp";
mail_smtpport = 587;

2
modules/system/services/server/nextcloud/nginx/default.nix
View file

@ -1,6 +1,6 @@
{ config, lib, ... }:
{
services.nginx.virtualHosts."files.nixfox.ca" = lib.mkIf config.services.nextcloud.enable {
services.nginx.virtualHosts."files.${config.vars.mainDomain}" = lib.mkIf config.services.nextcloud.enable {
enableACME = true;
addSSL = true;
locations."/" = {

2
modules/system/services/server/nginx/acme/default.nix
View file

@ -3,7 +3,7 @@
config = lib.mkIf config.services.nginx.enable {
security.acme = {
acceptTerms = true;
defaults.email = "contact@nixfox.ca";
defaults.email = "contact@${config.vars.mainDomain}";
};
environment.persistence."/persist".directories = [ "/var/lib/acme" ];
};

14
modules/system/services/server/nginx/default.nix
View file

@ -2,23 +2,21 @@
{
imports = [
./acme
./hosts
./rtmp
./user
];
options.services.webserver.enable = lib.mkEnableOption "Nginx webpages";
config = lib.mkIf config.services.nginx.enable {
services.nginx = {
recommendedTlsSettings = true;
recommendedOptimisation = true;
recommendedBrotliSettings = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
};
networking.firewall.allowedTCPPorts = [
80
443
config.services.nginx.defaultHTTPListenPort
config.services.nginx.defaultSSLListenPort
];
environment.persistence."/persist".directories = [ "/var/www" ];
};
}

9
modules/system/services/server/nginx/hosts/default.nix
View file

@ -1,9 +0,0 @@
{ config, lib, ... }:
{
imports = [
./files
./nixfox
];
environment.persistence."/persist".directories = lib.mkIf config.services.webserver.enable [ "/var/www" ];
}

8
modules/system/services/server/nginx/hosts/files/default.nix
View file

@ -1,8 +0,0 @@
{ config, lib, ... }:
{
services.nginx.virtualHosts."jimbosfiles.com" = lib.mkIf config.services.webserver.enable {
enableACME = true;
addSSL = true;
globalRedirect = "www.nixfox.ca";
};
}

29
modules/system/services/server/nginx/hosts/nixfox/default.nix
View file

@ -1,29 +0,0 @@
{ config, lib, ... }:
{
services.nginx.virtualHosts = lib.mkIf config.services.webserver.enable {
"www.nixfox.ca" = {
enableACME = true;
addSSL = true;
default = true;
root = "/var/www/landing-page";
};
"nixfox.ca" = {
enableACME = true;
addSSL = true;
globalRedirect = "www.nixfox.ca";
locations = {
"/.well-known/matrix/client".extraConfig = ''
default_type application/json;
return 200 '{
"m.homeserver": { "base_url": "https://matrix.nixfox.ca" },
"m.identity_server": { "base_url": "https://matrix.org" }
}';
'';
"/.well-known/matrix/server".extraConfig = ''
default_type application/json;
return 200 '{ "m.server": "matrix.nixfox.ca:443" }';
'';
};
};
};
}

34
modules/system/services/server/nginx/rtmp/default.nix
View file

@ -1,34 +0,0 @@
{ config, lib, pkgs, nodes, ... }:
{
config = lib.mkIf config.services.webserver.enable {
services.nginx = {
additionalModules = with pkgs.nginxModules; [ rtmp ];
appendConfig = ''
rtmp {
server {
listen 1935;
chunk_size 4096;
allow publish all;
application stream {
record off;
live on;
allow play all;
hls on;
hls_path /var/www/landing-page/streams/hls/;
hls_fragment_naming system;
hls_fragment 3;
hls_playlist_length 40;
}
}
}
'';
};
networking.firewall.extraInputRules = let
targetHosts = lib.attrValues (lib.mapAttrs (_: node: node.config.deployment.targetHost) nodes);
in ''
ip6 saddr { ${lib.concatStringsSep ", " targetHosts} } tcp dport 1935 accept
ip saddr { ${config.secrets.ips.luna}, ${config.secrets.ips.corn} } tcp dport 1935 accept
'';
systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www/landing-page/streams/hls/" ];
};
}

2
modules/system/services/server/owncast/nginx/default.nix
View file

@ -1,6 +1,6 @@
{ config, lib, ... }:
{
services.nginx.virtualHosts."live.nixfox.ca" = lib.mkIf config.services.owncast.enable {
services.nginx.virtualHosts."live.${config.vars.mainDomain}" = lib.mkIf config.services.owncast.enable {
enableACME = true;
forceSSL = true;
locations."/" = {

1
modules/system/services/server/transmission/default.nix
View file

@ -4,6 +4,7 @@
config = lib.mkIf config.services.transmission.enable {
services.transmission = {
package = pkgs.transmission_4;
credentialsFile = pkgs.writeText "credentials" config.secrets.transmissionCredFile;
openPeerPorts = true;
settings = {

2
modules/system/services/server/transmission/nginx/default.nix
View file

@ -1,6 +1,6 @@
{ config, lib, ... }:
{
services.nginx.virtualHosts."tor.nixfox.ca" = lib.mkIf config.services.transmission.enable {
services.nginx.virtualHosts."tor.${config.vars.mainDomain}" = lib.mkIf config.services.transmission.enable {
enableACME = true;
forceSSL = true;
locations."/" = {

8
modules/system/services/server/vaultwarden/default.nix
View file

@ -4,16 +4,16 @@
config = lib.mkIf config.services.vaultwarden.enable {
services.vaultwarden.config = {
domain = "https://pass.nixfox.ca";
domain = "https://pass.${config.vars.mainDomain}";
signupsAllowed = false;
rocketAddress = "127.0.0.1";
rocketPort = 8222;
# Smtp email
smtpHost = "mx.nixfox.ca";
smtpFrom = "noreply@nixfox.ca";
smtpHost = "mx.${config.vars.mainDomain}";
smtpFrom = "noreply@${config.vars.mainDomain}";
smtpFromName = "Vaultwarden";
smtpUsername = "noreply@nixfox.ca";
smtpUsername = "noreply@${config.vars.mainDomain}";
smtpPassword = config.secrets.mailPass.nixfoxNoReply;
smtpSecurity = "starttls";
smtpPort = 587;

2
modules/system/services/server/vaultwarden/nginx/default.nix
View file

@ -1,6 +1,6 @@
{ config, lib, ... }:
{
services.nginx.virtualHosts."pass.nixfox.ca" = lib.mkIf config.services.vaultwarden.enable {
services.nginx.virtualHosts."pass.${config.vars.mainDomain}" = lib.mkIf config.services.vaultwarden.enable {
enableACME = true;
forceSSL = true;
locations."/" = {

2
modules/system/settings/logind/default.nix
View file

@ -1,7 +1,7 @@
{ config, lib, ... }:
{
services.logind = {
powerKey = lib.mkIf config.system.desktop.enable "suspend";
powerKey = lib.mkIf (builtins.elem "pc" config.system.nixos.tags) "suspend";
powerKeyLongPress = "reboot";
};
}

2
modules/system/settings/security/rtkit/default.nix
View file

@ -1,4 +1,4 @@
{ config, ... }:
{
security.rtkit.enable = config.system.desktop.enable;
security.rtkit.enable = builtins.elem "pc" config.system.nixos.tags;
}

19
modules/system/users/corn/default.nix
View file

@ -1,19 +0,0 @@
{ config, lib, pkgs, ... }:
{
users.users."freecorn" = lib.mkIf config.system.extraUsers.enable {
isNormalUser = true;
createHome = true;
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBCADciME1/rtWOlR2BxaAkRSgIZt61SYOgjTi6hw+yS Chinook"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICtoHVAmq8Ps7EguBsV3VY4snagzkhH6aXqwbKzuGs2H Radiant"
];
extraGroups = [
"audio"
"video"
];
uid = 1001;
shell = pkgs.zsh;
};
environment.persistence."/persist".directories = [ "/home/freecorn" ];
}

10
modules/system/users/default.nix
View file

@ -1,6 +1,8 @@
{ lib, ... }:
{ ... }:
{
imports = [ ./main ];
options.system.extraUsers.enable = lib.mkEnableOption "Enable a shared system";
imports = [
./freecorn
./luna
./main
];
}

19
modules/system/users/freecorn/default.nix Normal file
View file

@ -0,0 +1,19 @@
{ config, lib, pkgs, ... }:
let
user = "freecorn";
in {
config = lib.mkIf (builtins.elem "extra-users" config.system.nixos.tags) {
users.users.${user} = {
isNormalUser = true;
createHome = true;
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBCADciME1/rtWOlR2BxaAkRSgIZt61SYOgjTi6hw+yS Chinook"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICtoHVAmq8Ps7EguBsV3VY4snagzkhH6aXqwbKzuGs2H Radiant"
];
shell = pkgs.zsh;
uid = 1001;
};
environment.persistence."/persist".directories = [ "/home/${user}" ];
};
}

28
modules/system/users/luna/default.nix
View file

@ -1,17 +1,17 @@
{ config, lib, ... }:
{
users.users."luna" = lib.mkIf config.system.extraUsers.enable {
isNormalUser = true;
createHome = true;
openssh.authorizedKeys.keys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDJ3hzXkv5MVuGZy4HqfEZD0Ck7ZKiLeVmUTFzGSwZkumCpwX/zirD/tY4SNutPczhhYNn1jwkwnnyCwgkaQ7QWBs72G0opmjXDcSqxXJskSKYgjnUHoPV8uAcMwp5C5GNlwo3DFKXc1c7Sipy1s6y9ZnoKfVmjsr0AhamnC/bHEWg8vx0zuamCzvQ5vLWfpULRKwj286f0s2xaAvYaAJwGD0QMHC0ylFYZuq7Og4HVdlnUt+40BxCi+GAQqsFd4vM+RFjZKKD7ioP5DcIDfvfvxX4UpdKtCxVjeyyF+UJpFnQKytO9HvH4H+CRSAuJ+Vguiq/F3lGhvF0yIQ9M2MD3+tl3RZAj4D6n2ew30mn+QGh2fZgC7Utuzo02pMVUzkpm+mM4x8VyESpC1AuBdh0TAKBwS3ubMpegiCWCfIbNC0CQ/zgIq/5xwhXL8zhmfQrIiULBCd1xqThye0tt7knoPZlVCzOuVYoqxYnwYYGcXhzlArrmgRquyMYHdpFd+DTzJfcQIGdT4a+s0Mc2jRa0KT3A4ZrjziP0OPMQ+cpTd1tmQdEKXN6YhB87Hp9meCefFdzGvVembose82d3BOl45+rWM2ZcH93fNguWwYX0ez8+GiGW4P+gDQcfWfQCNa1daDjgoBwjmbG5rYoS6tfLxSSvYB1YOOK9U3AlPxEuTw== luna@ThinkPad-T480-Arch"
];
extraGroups = [
"audio"
"video"
];
uid = 1002;
};
let
user = "luna";
in {
config = lib.mkIf (builtins.elem "extra-users" config.system.nixos.tags) {
users.users.${user} = {
isNormalUser = true;
createHome = true;
openssh.authorizedKeys.keys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDJ3hzXkv5MVuGZy4HqfEZD0Ck7ZKiLeVmUTFzGSwZkumCpwX/zirD/tY4SNutPczhhYNn1jwkwnnyCwgkaQ7QWBs72G0opmjXDcSqxXJskSKYgjnUHoPV8uAcMwp5C5GNlwo3DFKXc1c7Sipy1s6y9ZnoKfVmjsr0AhamnC/bHEWg8vx0zuamCzvQ5vLWfpULRKwj286f0s2xaAvYaAJwGD0QMHC0ylFYZuq7Og4HVdlnUt+40BxCi+GAQqsFd4vM+RFjZKKD7ioP5DcIDfvfvxX4UpdKtCxVjeyyF+UJpFnQKytO9HvH4H+CRSAuJ+Vguiq/F3lGhvF0yIQ9M2MD3+tl3RZAj4D6n2ew30mn+QGh2fZgC7Utuzo02pMVUzkpm+mM4x8VyESpC1AuBdh0TAKBwS3ubMpegiCWCfIbNC0CQ/zgIq/5xwhXL8zhmfQrIiULBCd1xqThye0tt7knoPZlVCzOuVYoqxYnwYYGcXhzlArrmgRquyMYHdpFd+DTzJfcQIGdT4a+s0Mc2jRa0KT3A4ZrjziP0OPMQ+cpTd1tmQdEKXN6YhB87Hp9meCefFdzGvVembose82d3BOl45+rWM2ZcH93fNguWwYX0ez8+GiGW4P+gDQcfWfQCNa1daDjgoBwjmbG5rYoS6tfLxSSvYB1YOOK9U3AlPxEuTw== ${user}@ThinkPad-T480-Arch"
];
uid = 1002;
};
environment.persistence."/persist".directories = [ "/home/luna" ];
environment.persistence."/persist".directories = [ "/home/${user}" ];
};
}

94
modules/system/users/main/default.nix
View file

@ -1,56 +1,48 @@
{ config, lib, pkgs, ... }:
{
options.sysusers = lib.mkOption {
type = lib.types.attrs;
users.users."${config.vars.mainUser}" = {
isNormalUser = true;
createHome = true;
linger = true;
hashedPassword = config.secrets.accPass.main;
openssh.authorizedKeys.keyFiles = [
../../../../hosts/tower/id_ed25519.pub
../../../../hosts/detritus/id_ed25519.pub
../../../../hosts/intuos/id_ed25519.pub
../../../../hosts/jupiter/id_ed25519.pub
../../../../hosts/midas/id_ed25519.pub
../../../../hosts/kitty/id_ed25519.pub
../../../../hosts/prophet/id_ed25519.pub
];
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN3B9Uf3h5JiD2HjF/vQ5Zx9pibMgRrlf7ZoBktev9eB Warden"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJahAoF74BY6GCTsFkt1ADKaraFgJJozW1Y1aBTLK0j9 Pixel9"
];
extraGroups = [
"wheel"
"audio"
"input"
"render"
"video"
"dialout"
"disk"
"rtkit"
"kvm"
"libvirtd"
"qemu-libvirtd"
"minecraft"
"nfsShare"
"nginx"
];
shell = pkgs.zsh;
uid = 1000;
};
config = {
sysusers.main = "bun";
users.users."${config.sysusers.main}" = {
isNormalUser = true;
createHome = true;
linger = true;
hashedPassword = config.secrets.accPass.main;
openssh.authorizedKeys.keyFiles = [
../../../../hosts/tower/id_ed25519.pub
../../../../hosts/detritus/id_ed25519.pub
../../../../hosts/intuos/id_ed25519.pub
../../../../hosts/jupiter/id_ed25519.pub
../../../../hosts/midas/id_ed25519.pub
../../../../hosts/kitty/id_ed25519.pub
../../../../hosts/prophet/id_ed25519.pub
];
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN3B9Uf3h5JiD2HjF/vQ5Zx9pibMgRrlf7ZoBktev9eB Warden"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJahAoF74BY6GCTsFkt1ADKaraFgJJozW1Y1aBTLK0j9 Pixel9"
];
extraGroups = [
"wheel"
"audio"
"input"
"render"
"video"
"dialout"
"disk"
"rtkit"
"kvm"
"libvirtd"
"qemu-libvirtd"
"minecraft"
"nfsShare"
"nginx"
];
uid = 1000;
shell = pkgs.zsh;
};
home-manager.users."${config.sysusers.main}" = import ../../../home;
};
home-manager.users."${config.vars.mainUser}" = import ../../../home;
}

11
modules/system/variables/default.nix Normal file
View file

@ -0,0 +1,11 @@
{ lib, ... }:
{
options.vars = lib.mkOption {
type = lib.types.attrs;
};
config.vars = {
mainUser = "bun";
mainDomain = "nixfox.ca";
};
}