Merge branch 'myputer'
This commit is contained in:
commit
6f3c509510
228 changed files with 1864 additions and 24570 deletions
486
hosts/hyrule/default.nix
Executable file
486
hosts/hyrule/default.nix
Executable file
|
|
@ -0,0 +1,486 @@
|
|||
{
|
||||
pkgs,
|
||||
inputs,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
home-manager = builtins.fetchTarball {
|
||||
url = "https://github.com/nix-community/home-manager/archive/release-24.11.tar.gz";
|
||||
sha256 = "0c07xj74vsj37d3a8f98i9rhhhr99ckwlp45n40f0qkmigm3pk8s";
|
||||
};
|
||||
in {
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
(import "${home-manager}/nixos")
|
||||
#../../flakes/wishlist/wishlist.nix
|
||||
#../modules/server/nginx.nix
|
||||
#../modules/server/ssh.nix
|
||||
#../modules/server/fail2ban.nix
|
||||
];
|
||||
|
||||
# override wishlist with the new cool one!
|
||||
#pkgs.config.packageOverrides = {
|
||||
# wishlist = inputs.wishlist.packages.x86_64-linux.wishlist;
|
||||
#};
|
||||
|
||||
nix.settings = {
|
||||
# make wheel group trusted users allows my "ae" user
|
||||
# to import packages not signed by a trusted key
|
||||
# (aka super duper easier to remote deploy)
|
||||
trusted-users = ["root" "@wheel"];
|
||||
experimental-features = [
|
||||
"nix-command"
|
||||
"flakes"
|
||||
];
|
||||
};
|
||||
|
||||
time.timeZone = "Australia/Brisbane";
|
||||
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
console = {
|
||||
font = "Lat2-Terminus16";
|
||||
keyMap = "us";
|
||||
};
|
||||
|
||||
# colmena deployment configuration
|
||||
deployment = {
|
||||
targetHost = "imbored.dev";
|
||||
targetUser = "ae";
|
||||
targetPort = 22;
|
||||
# the following line is unnecessary if using an ssh agent
|
||||
#sshOptions = ["-i /home/me/.ssh/id_hyrule"];
|
||||
#keys = {
|
||||
# "imbored.dev" = {
|
||||
# # text, keyCommand, or keyFile must be set
|
||||
# # text = "";
|
||||
# #keyCommand = [ "" ];
|
||||
# keyFile = "/home/me/.ssh/id_hyrule";
|
||||
# };
|
||||
#};
|
||||
buildOnTarget = false; # build locally then deploy
|
||||
};
|
||||
|
||||
# super duper minimum grub2 config
|
||||
boot.loader.grub = {
|
||||
enable = true;
|
||||
device = "/dev/vda";
|
||||
};
|
||||
|
||||
networking = {
|
||||
hostName = "hyrule";
|
||||
networkmanager.enable = true;
|
||||
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [
|
||||
22 # sshd
|
||||
80 # nginx
|
||||
# 143 # IMAP4
|
||||
443 # nginx
|
||||
# 587 # SMTPS
|
||||
2222 # forgejo ssh
|
||||
2035 # debug (for my job)
|
||||
# 3000 (INTERNAL) forgejo
|
||||
# 3306 (INTERNAL) forgejo sqlite3 database
|
||||
5000 # debug (for my job)
|
||||
# 8222 (INTERNAL) vaultwarden
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
# grant passwordless sudo to wheel group
|
||||
security.sudo.wheelNeedsPassword = false;
|
||||
|
||||
users = {
|
||||
defaultUserShell = pkgs.bash;
|
||||
|
||||
users = {
|
||||
# primary user
|
||||
ae = {
|
||||
isNormalUser = true;
|
||||
extraGroups = ["wheel" "networkmanager" "docker"];
|
||||
shell = pkgs.bash;
|
||||
home = "/home/ae"; # TEMP: remove and replace with home-manager
|
||||
packages = with pkgs; [
|
||||
];
|
||||
};
|
||||
|
||||
subspace = let
|
||||
# override
|
||||
wishlistBash =
|
||||
pkgs.bash.override {
|
||||
};
|
||||
in {
|
||||
isNormalUser = true;
|
||||
shell = pkgs.bash;
|
||||
home = "/home/subspace";
|
||||
packages = with pkgs; [
|
||||
wishlist
|
||||
];
|
||||
};
|
||||
|
||||
# user for friends to ssh into
|
||||
friends = {
|
||||
isNormalUser = true;
|
||||
shell = pkgs.bash;
|
||||
home = "/home/friends"; # TEMP: remove and replace with home-manager
|
||||
packages = with pkgs; [
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
virtualisation.docker.enable = true;
|
||||
|
||||
home-manager = {
|
||||
users = {
|
||||
ae = import ../../homes/ae;
|
||||
subspace = import ../../homes/subspace;
|
||||
};
|
||||
sharedModules = [];
|
||||
};
|
||||
|
||||
services = {
|
||||
# simple nginx instance to host static construction page
|
||||
# TODO: I want sshd and forgejo's ssh server to both be bound to port 22
|
||||
# So change sshd to listen on a different address/port (ie 2222 or 127.0.0.3:22, etc)
|
||||
# and change forgejo to use 127.0.0.2:22 (use port 22, ONLY change loopback address)
|
||||
nginx = {
|
||||
enable = true;
|
||||
|
||||
# in wake of CVE-2022-3602/CVE-2022-3786
|
||||
package = pkgs.nginxStable.override {openssl = pkgs.libressl;};
|
||||
|
||||
#virtualHosts."imbored.dev".locations."/" = {
|
||||
virtualHosts = {
|
||||
"imbored.dev" = {
|
||||
# "http:imbored.dev" = {
|
||||
default = true;
|
||||
# serverName = "imbored.dev";
|
||||
# listenAddresses = ["imbored.dev"];
|
||||
enableACME = true;
|
||||
addSSL = true; # forceSSL = true;
|
||||
root = "/var/www/imbored";
|
||||
#index = "index.html";
|
||||
#root = pkgs.writeTextDir "index.html" ''
|
||||
# <html>
|
||||
# <body>
|
||||
# Give me your mittens!
|
||||
# </body>
|
||||
# </html>
|
||||
#'';
|
||||
};
|
||||
# "ssh:imbored.dev" = {
|
||||
# serverName = "imbored.dev";
|
||||
# listen = [{
|
||||
# addr = "imbored.dev";
|
||||
# port= 22;
|
||||
# }];
|
||||
# locations."/".proxyPass = "ssh://127.0.0.1:2222";
|
||||
# };
|
||||
# Route "vault" subdomain to vaultwarden
|
||||
"vault.imbored.dev" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/".proxyPass = "http://127.0.0.1:8222";
|
||||
};
|
||||
# Route "forge" subdomain to forgejo
|
||||
"forge.imbored.dev" = {
|
||||
# "https:forge.imbored.dev" = {
|
||||
#serverName = "forge.imbored.dev";
|
||||
#listenAddresses = ["forge.imbored.dev"]; # NOTE: I think this is wrong
|
||||
enableACME = true; # TODO: maybe use `forgejo.settings.server.ENABLE_ACME` instead?
|
||||
forceSSL = true;
|
||||
extraConfig = ''
|
||||
client_max_body_size 512M;
|
||||
'';
|
||||
locations."/".proxyPass = "http://127.0.0.1:3000";
|
||||
};
|
||||
# NOTE: would it work if I used "ssh://forge.imbored.dev" and "https://forge.imbored.dev" instead?
|
||||
# "ssh:forge.imbored.dev" = {
|
||||
# serverName = "forge.imbored.dev";
|
||||
# listen = [{
|
||||
# addr = "forge.imbored.dev";
|
||||
# port = 22;
|
||||
# }];
|
||||
# locations."/".proxyPass = "ssh://127.0.0.2:22";
|
||||
# };
|
||||
};
|
||||
};
|
||||
|
||||
openssh = {
|
||||
enable = true;
|
||||
ports = [22];
|
||||
settings = {
|
||||
PasswordAuthentication = true;
|
||||
PermitRootLogin = "no";
|
||||
AllowUsers = ["ae" "subspace"]; # allow all users by default
|
||||
UseDns = true;
|
||||
X11Forwarding = false;
|
||||
};
|
||||
};
|
||||
|
||||
vaultwarden = {
|
||||
enable = true;
|
||||
dbBackend = "sqlite";
|
||||
|
||||
# backupDir = "/var/backup/vaultwarden"; # disable with null
|
||||
|
||||
# https://mynixos.com/nixpkgs/option/services.vaultwarden.config
|
||||
config = {
|
||||
# internal address and port to listen on
|
||||
ROCKET_ADDRESS = "127.0.0.1";
|
||||
ROCKET_PORT = 8222;
|
||||
|
||||
# hostname to listen for
|
||||
DOMAIN = "https://vault.imbored.dev";
|
||||
SIGNUPS_ALLOWED = false;
|
||||
};
|
||||
# https://mynixos.com/nixpkgs/option/services.vaultwarden.environmentFile
|
||||
environmentFile = "/var/lib/vaultwarden/vaultwarden.env";
|
||||
};
|
||||
|
||||
# stalwart-mail = let
|
||||
# domain = "imbored.dev";
|
||||
# in {
|
||||
# enable = false; # true;
|
||||
# # openFirewall = true; # im doing this manually rn
|
||||
# settings = {
|
||||
# certificate."${domain}" = {
|
||||
# cert = "file://${certs.${domain}.cert}";
|
||||
# private-key = "file://${certs.${domain}.key}";
|
||||
# };
|
||||
# server = {
|
||||
# hostname = domain;
|
||||
# tls = {
|
||||
# certificate = "${domain}";
|
||||
# enable = true;
|
||||
# implicit = false;
|
||||
# };
|
||||
# listener = {
|
||||
# "smtp-submission" = {
|
||||
# bind = ["127.0.0.1:587"];
|
||||
# protocol = "smtp";
|
||||
# };
|
||||
# "imap" = {
|
||||
# bind = ["127.0.0.1:143"];
|
||||
# protocol = "imap";
|
||||
# };
|
||||
# };
|
||||
# };
|
||||
# session = {
|
||||
# rcpt.directory = "in-memory";
|
||||
# auth = {
|
||||
# mechanisms = ["PLAIN"];
|
||||
# directory = "in-memory";
|
||||
# };
|
||||
# };
|
||||
# jmap.directory = "in-memory";
|
||||
# queue.outbound.next-hop = ["local"];
|
||||
# directory."in-memory" = {
|
||||
# type = "memory";
|
||||
# users = [
|
||||
# {
|
||||
# name = "me";
|
||||
# secret = "foobar";
|
||||
# email = ["me@${domain}"];
|
||||
# }
|
||||
# {
|
||||
# name = "Emile";
|
||||
# secret = "foobar";
|
||||
# email = ["emile@${domain}"];
|
||||
# }
|
||||
# ];
|
||||
# };
|
||||
# };
|
||||
# };
|
||||
|
||||
# more options here: https://mynixos.com/nixpkgs/options/services.forgejo
|
||||
# TODO: set a favicon https://forgejo.org/docs/next/contributor/customization/#changing-the-logo
|
||||
# (might need me to override settings in the nixpkg)
|
||||
# TODO: create a custom theme for forgejo (modify the source files most likely)
|
||||
forgejo = {
|
||||
enable = true;
|
||||
# enable support for Git Large File Storage
|
||||
lfs.enable = true;
|
||||
database = {
|
||||
type = "sqlite3"; # postgres
|
||||
host = "127.0.0.1";
|
||||
port = "3306"; # 5432 if postgres
|
||||
};
|
||||
# settings are written directly to the `app.ini` config file
|
||||
# refer to: https://forgejo.org/docs/latest/admin/config-cheat-sheet/
|
||||
settings = {
|
||||
server = {
|
||||
# ENABLE_ACME = true;
|
||||
# ACME_EMAIL = "eclarkboman@gmail.com"; # change this to "me@imbored.dev"
|
||||
DOMAIN = "forge.imbored.dev"; # should this be "imbored.dev"?
|
||||
ROOT_URL = "https://forge.imbored.dev"; # full public URL of the Forgejo server
|
||||
# address and port to listen on
|
||||
HTTP_ADDR = "127.0.0.1";
|
||||
HTTP_PORT = 3000;
|
||||
PROTOCOL = "http"; # http internally, reverse proxy uses https externally
|
||||
|
||||
START_SSH_SERVER = true;
|
||||
DISABLE_SSH = false;
|
||||
SSH_PORT = 2222;
|
||||
};
|
||||
|
||||
DEFAULT = {
|
||||
APP_NAME = "Emile's Forge";
|
||||
APP_SLOGIN = "Cozy";
|
||||
APP_DISPLAY_NAME_FORMAT = "{APP_NAME}: {APP_SLOGAN}";
|
||||
};
|
||||
|
||||
repository = {
|
||||
DEFAULT_PRIVATE = "private"; # last, private, public
|
||||
DEFAULT_PUSH_CREATE_PRIVATE = true;
|
||||
MAX_CREATION_LIMIT = -1;
|
||||
};
|
||||
|
||||
"repository.upload" = {
|
||||
# max per-file size in MB
|
||||
FILE_MAX_SIZE = 50;
|
||||
# max number of files per upload
|
||||
MAX_FILES = 5;
|
||||
};
|
||||
|
||||
badges = let
|
||||
# flat, flat-square, plastic, for-the-badge, social
|
||||
style = "for-the-badge";
|
||||
in {
|
||||
ENABLED = true;
|
||||
GENERATOR_URL_TEMPLATE = "https://img.shields.io/badge/{{.label}}-{{.text}}-{{.color}}?style=${style}";
|
||||
};
|
||||
|
||||
ui = {
|
||||
DEFAULT_THEME = "forgejo-dark";
|
||||
THEMES = "forgejo-auto,forgejo-light,forgejo-dark";
|
||||
};
|
||||
"ui.meta" = {
|
||||
AUTHOR = "Emile Clark-Boman - emileclarkb";
|
||||
DESCRIPTION = "This is my personal self-hosted git forge, where I keep and maintain personal projects!";
|
||||
KEYWORDS = "emileclarkb,git,forge,forgejo,self-hosted";
|
||||
};
|
||||
|
||||
markdown = {
|
||||
ENABLE_HARD_LINE_BREAK_IN_COMMENTS = true;
|
||||
ENABLE_MATH = true;
|
||||
};
|
||||
|
||||
admin = {
|
||||
DEFAULT_EMAIL_NOTIFICATIONS = "enabled";
|
||||
SEND_NOTIFICATION_EMAIL_ON_NEW_USER = true;
|
||||
};
|
||||
|
||||
security = {
|
||||
# Controls access to the installation page.
|
||||
# When set to “true”, the installation page is not accessible.
|
||||
#INSTALL_LOCK = false;
|
||||
|
||||
PASSWORD_HASH_ALGO = "argon2"; # ARGON2 BEST ALGO FR!!
|
||||
MIN_PASSWORD_LENGTH = 12;
|
||||
PASSWORD_COMPLEXITY = "lower,upper,digit,spec";
|
||||
PASSWORD_CHECK_PWN = true;
|
||||
};
|
||||
|
||||
service = {
|
||||
# toggle to create an admin user
|
||||
DISABLE_REGISTRATION = true;
|
||||
#DEFAULT_USER_IS_RESTRICTED = true;
|
||||
# Forbid login with third-party services (ie github)
|
||||
ALLOW_ONLY_INTERNAL_REGISTRATION = true;
|
||||
ENABLE_CAPTCHA = true;
|
||||
REQUIRE_CAPTCHA_FOR_LOGIN = true;
|
||||
REQUIRE_EXTERNAL_REGISTRATION_CAPTCHA = true;
|
||||
LOGIN_REMEMBER_DAYS = 365;
|
||||
ENABLE_NOTIFY_MAIL = true;
|
||||
};
|
||||
"service.explore" = {
|
||||
REQUIRE_SIGNIN_VIEW = false;
|
||||
DISABLE_USERS_PAGE = false;
|
||||
DISABLE_ORGANIZATIONS_PAGE = false;
|
||||
DISABLE_CODE_PAGE = false;
|
||||
};
|
||||
|
||||
cache = {
|
||||
ADAPTER = "twoqueue";
|
||||
HOST = "{\"size\":100, \"recent_ratio\":0.25, \"ghost_ratio\":0.5}";
|
||||
ITEM_TTL = "16h";
|
||||
};
|
||||
|
||||
# TODO: fill this in once my mail server is configured
|
||||
# email.incoming = { ... };
|
||||
|
||||
# optional
|
||||
# TODO: fill this in once my mail server is configured
|
||||
mailer = {
|
||||
ENABLED = false;
|
||||
SMTP_ADDR = "mail.imbored.dev";
|
||||
FROM = "noreply@imbored.dev";
|
||||
USER = "noreply@imbored.dev";
|
||||
};
|
||||
|
||||
log = {
|
||||
MODE = "file";
|
||||
LEVEL = "Info"; # "Trace", "Debug", "Info", "Warn", "Error", "Critical"
|
||||
ENABLE_SSH_LOG = true;
|
||||
};
|
||||
|
||||
cron = {
|
||||
ENABLED = true;
|
||||
RUN_AT_START = false;
|
||||
};
|
||||
|
||||
other = {
|
||||
SHOW_FOOTER_VERSION = true;
|
||||
SHOW_FOOTER_TEMPLATE_LOAD_TIME = true;
|
||||
SHOW_FOOTER_POWERED_BY = true;
|
||||
ENABLE_SITEMAP = true;
|
||||
ENABLE_FEED = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
# accept Lets Encrypt's security policy (for nginx)
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
# TODO: change this to me@imbored.dev
|
||||
defaults.email = "eclarkboman@gmail.com";
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
vim
|
||||
helix
|
||||
|
||||
#wishlist
|
||||
];
|
||||
|
||||
programs = {
|
||||
fish.enable = true;
|
||||
|
||||
bash = {
|
||||
interactiveShellInit = ''
|
||||
if [[ $(${pkgs.procps}/bin/ps --no-header --pid=$PPID --format=comm) != "fish" && -z ''${BASH_EXECUTION_STRING} ]]
|
||||
then
|
||||
shopt -q login_shell && LOGIN_OPTION='--login' || LOGIN_OPTION=""
|
||||
exec ${pkgs.fish}/bin/fish $LOGIN_OPTION
|
||||
fi
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
#systemd.services.wishlist = {
|
||||
# description = "Single entrypoint for multiple SSH endpoints";
|
||||
# wantedBy = ["multi-user.target"];
|
||||
#
|
||||
# serviceConfig = {
|
||||
# DynamicUser = "yes";
|
||||
# ExecStart = "${pkgs.wishlist}/bin/wishlist serve --config /home/$USER/.ssh/config";
|
||||
# Restart = "always";
|
||||
# RestartSec = "2s";
|
||||
# };
|
||||
#};
|
||||
|
||||
system.stateVersion = "24.11"; # DO NOT MODIFY
|
||||
}
|
||||
37
hosts/hyrule/hardware-configuration.nix
Normal file
37
hosts/hyrule/hardware-configuration.nix
Normal file
|
|
@ -0,0 +1,37 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "ahci" "sd_mod" "sr_mod" "virtio_blk" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-label/NIXROOT";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-label/NIXBOOT";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0022" "dmask=0022" ];
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.ens3.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
}
|
||||
83
hosts/imbored/default.nix
Executable file
83
hosts/imbored/default.nix
Executable file
|
|
@ -0,0 +1,83 @@
|
|||
{
|
||||
pkgs,
|
||||
inputs,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
home-manager = builtins.fetchTarball {
|
||||
url = "https://github.com/nix-community/home-manager/archive/master.tar.gz";
|
||||
sha256 = "19w63qccz78v0spx03911z98w1bvlxvd07hb0ma14a4vdzi4ninj";
|
||||
};
|
||||
in {
|
||||
# TODO:
|
||||
# - add github:charmbracelet/soft-serve
|
||||
# - add forgejo
|
||||
|
||||
imports = [
|
||||
../modules/server/nginx.nix
|
||||
../modules/server/ssh.nix
|
||||
../modules/server/fail2ban.nix
|
||||
];
|
||||
|
||||
system.stateVersion = "24.05";
|
||||
nix.settings.experimental-features = [
|
||||
"nix-command"
|
||||
"flakes"
|
||||
];
|
||||
|
||||
time.timeZone = "Australia/Brisbane";
|
||||
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
console = {
|
||||
font = "Lat2-Terminus16";
|
||||
keyMap = "us";
|
||||
};
|
||||
|
||||
boot.loader = {
|
||||
# TODO
|
||||
};
|
||||
|
||||
networking = {
|
||||
hostName = "imbored";
|
||||
networkmanager.enable = true;
|
||||
firewall.allowedTCPPorts = [
|
||||
22 # sshd
|
||||
]
|
||||
};
|
||||
|
||||
users = {
|
||||
defaultUserShell = pkgs.bash;
|
||||
|
||||
users = {
|
||||
# primary user
|
||||
dev = {
|
||||
isNormalUser = true;
|
||||
extraGroups = ["wheel"];
|
||||
shell = pkgs.bash;
|
||||
packages = with pkgs; [
|
||||
];
|
||||
};
|
||||
|
||||
# user for friends to ssh into
|
||||
friends = {
|
||||
isNormalUser = true;
|
||||
shell = pkgs.bash;
|
||||
packages = with pkgs; [
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
#home-manager = {
|
||||
# users = {
|
||||
# dev = import ../../homes/dev;
|
||||
# friends = import ../../homes/friends;
|
||||
# };
|
||||
#};
|
||||
|
||||
environment.SystemPackages = with pkgs; [
|
||||
];
|
||||
|
||||
programs = {
|
||||
};
|
||||
}
|
||||
|
|
@ -4,13 +4,9 @@
|
|||
lib,
|
||||
...
|
||||
}: let
|
||||
#home-manager = builtins.fetchTarball {
|
||||
# url = "https://github.com/nix-community/home-manager/archive/release-24.05.tar.gz";
|
||||
# sha256 = "00wp0s9b5nm5rsbwpc1wzfrkyxxmqjwsc1kcibjdbfkh69arcpsn";
|
||||
#};
|
||||
home-manager = builtins.fetchTarball {
|
||||
url = "https://github.com/nix-community/home-manager/archive/master.tar.gz";
|
||||
sha256 = "19w63qccz78v0spx03911z98w1bvlxvd07hb0ma14a4vdzi4ninj";
|
||||
url = "https://github.com/nix-community/home-manager/archive/release-24.11.tar.gz";
|
||||
sha256 = "15k41il0mvmwyv6jns4z8k6khhmb22jk5gpcqs1paym3l01g6abn";
|
||||
};
|
||||
in {
|
||||
imports = [
|
||||
|
|
@ -32,7 +28,6 @@ in {
|
|||
#colorScheme = "mocha";
|
||||
};
|
||||
|
||||
# Use the systemd-boot EFI boot loader.
|
||||
boot.loader = {
|
||||
efi = {
|
||||
canTouchEfiVariables = true;
|
||||
|
|
@ -42,11 +37,12 @@ in {
|
|||
efiSupport = true;
|
||||
#efiInstallAsRemovable = true; # in case canTouchEfiVariables doesn't work on this system
|
||||
device = "nodev";
|
||||
useOSProber = true;
|
||||
};
|
||||
# GitHub: vinceliuice/grub2-themes
|
||||
grub2-theme = {
|
||||
enable = true;
|
||||
theme = "whitesur"; # sylish, vimix, or whitesur
|
||||
theme = "whitesur"; # stylish, vimix, or whitesur
|
||||
footer = true;
|
||||
customResolution = "1920x1080"; # Optional: Set a custom resolution
|
||||
};
|
||||
|
|
@ -92,13 +88,12 @@ in {
|
|||
#hardware.pulseaudio.enable = false;
|
||||
pipewire = {
|
||||
enable = true;
|
||||
wireplumber.enable = true;
|
||||
|
||||
alsa.enable = true;
|
||||
alsa.support32Bit = true;
|
||||
pulse.enable = true;
|
||||
jack.enable = true;
|
||||
|
||||
wireplumber.enable = true;
|
||||
};
|
||||
|
||||
# Enable touchpad support
|
||||
|
|
@ -107,7 +102,7 @@ in {
|
|||
tumbler.enable = true; # Thunar image thumbnail support
|
||||
gvfs.enable = true; # Thunar mount, trash, and other functionality
|
||||
};
|
||||
security.rtkit.enable = true;
|
||||
security.rtkit.enable = true; # I *think* this is for pipewire
|
||||
|
||||
# allow wheel group to use passwordless sudo
|
||||
users = {
|
||||
|
|
@ -179,12 +174,10 @@ in {
|
|||
environment.systemPackages = with pkgs; [
|
||||
# User Environment
|
||||
inputs.swww.packages.${pkgs.system}.swww
|
||||
#vesktop
|
||||
helvum
|
||||
easyeffects
|
||||
ani-cli
|
||||
wl-clipboard # clipboard for wayland
|
||||
|
||||
pavucontrol
|
||||
|
||||
(callPackage ./sddm-theme-corners.nix {}).sddm-theme-corners
|
||||
|
|
@ -276,6 +269,7 @@ in {
|
|||
texlivePackages.noto-emoji
|
||||
];
|
||||
|
||||
# TODO: change my default fonts
|
||||
fontconfig = {
|
||||
defaultFonts = {
|
||||
serif = ["Iosevka"]; # TODO: package Iosevka Etoile since Iosevka isn't a serif font
|
||||
|
|
|
|||
|
|
@ -1,11 +1,13 @@
|
|||
{
|
||||
pkgs,
|
||||
inputs,
|
||||
lib,
|
||||
wishlist,
|
||||
...
|
||||
}: let
|
||||
home-manager = builtins.fetchTarball {
|
||||
url = "https://github.com/nix-community/home-manager/archive/master.tar.gz";
|
||||
sha256 = "0kg9iaixqygpncw7avgh1grwyjgnfc9i7k9pk8hc4xrvr8jv2l3c";
|
||||
url = "https://github.com/nix-community/home-manager/archive/release-24.11.tar.gz";
|
||||
sha256 = "1dga3vsd60v9mfyhwgbil13mrchw5crbpgh4zjw9fghv1vyk89vq";
|
||||
};
|
||||
in {
|
||||
imports = [
|
||||
|
|
@ -27,19 +29,23 @@ in {
|
|||
#colorScheme = "mocha";
|
||||
};
|
||||
|
||||
# Use the systemd-boot EFI boot loader.
|
||||
# TODO: use GRUB2 instead
|
||||
#boot.loader.systemd-boot.enable = true;
|
||||
#boot.loader.efi.canTouchEfiVariables = true;
|
||||
boot.loader.systemd-boot.enable = false;
|
||||
boot.loader = {
|
||||
efi = {
|
||||
canTouchEfiVariables = true;
|
||||
efiSysMountPoint = "/boot/efi";
|
||||
efiSysMountPoint = "/boot/efi"; #/boot/efi
|
||||
};
|
||||
grub = {
|
||||
efiSupport = true;
|
||||
#efiInstallAsRemovable = true; # in case canTouchEfiVariables doesn't work on this system
|
||||
device = "nodev";
|
||||
#useOSProber = true;
|
||||
};
|
||||
grub2-theme = {
|
||||
enable = true;
|
||||
theme = "whitesur"; # stylish, vimix, or whitesur
|
||||
footer = true;
|
||||
customResolution = "1920x1080";
|
||||
};
|
||||
};
|
||||
|
||||
|
|
@ -51,13 +57,10 @@ in {
|
|||
console = {
|
||||
font = "Lat2-Terminus16";
|
||||
keyMap = "us";
|
||||
#useXkbConfig = true; # use xkb.options in tty.
|
||||
};
|
||||
|
||||
# ----- NETWORKING SECTION -----
|
||||
networking.hostName = "myputer";
|
||||
# Pick only one of the below networking options.
|
||||
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
|
||||
networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
|
||||
|
||||
# Open ports in the firewall.
|
||||
|
|
@ -72,20 +75,27 @@ in {
|
|||
displayManager = {
|
||||
sddm = {
|
||||
enable = true;
|
||||
theme = "${import ./sddm-theme.nix {inherit pkgs;}}";
|
||||
# enable experimental sddm support for wayland
|
||||
wayland.enable = true;
|
||||
wayland.enable = true; # enable experimental sddm support for wayland
|
||||
theme = "corners";
|
||||
};
|
||||
defaultSession = "hyprland";
|
||||
};
|
||||
|
||||
# Enable sound
|
||||
# TODO: use the modules/core/pipewire.nix module instead :)
|
||||
pipewire = {
|
||||
enable = true;
|
||||
wireplumber.enable = true;
|
||||
|
||||
alsa.enable = true;
|
||||
alsa.support32Bit = true;
|
||||
pulse.enable = true;
|
||||
jack.enable = true;
|
||||
};
|
||||
|
||||
tumbler.enable = true; # Thunar image thumbnail support
|
||||
gvfs.enable = true; # Thunar mount, trash, and other functionality
|
||||
};
|
||||
security.rtkit.enable = true; # I *think* this is for pipewire
|
||||
|
||||
# allow wheel group to use passwordless sudo
|
||||
security.sudo.wheelNeedsPassword = false;
|
||||
|
|
@ -100,23 +110,34 @@ in {
|
|||
# just me fr (personal account)
|
||||
me = {
|
||||
isNormalUser = true;
|
||||
extraGroups = ["wheel"];
|
||||
extraGroups = ["wheel" "docker"];
|
||||
shell = pkgs.bash; #pkgs.fish
|
||||
packages = with pkgs; [
|
||||
firefox
|
||||
nitch
|
||||
starfetch
|
||||
tldr
|
||||
];
|
||||
};
|
||||
packages = let
|
||||
# TODO: can I just do this: https://nix.dev/manual/nix/2.18/command-ref/new-cli/nix3-flake#url-like-syntax
|
||||
# instead to use colmena's flake.nix by specifying a rev hash in the flake input?
|
||||
colmena-src = pkgs.fetchFromGitHub {
|
||||
owner = "zhaofengli";
|
||||
repo = "colmena";
|
||||
rev = "47b6414d800c8471e98ca072bc0835345741a56a";
|
||||
sha256 = "rINodqeUuezuCWOnpJgrH7u9vJ86fYT+Dj8Mu8T/IBc=";
|
||||
};
|
||||
colmena-new = pkgs.callPackage "${colmena-src}/package.nix" {};
|
||||
in
|
||||
with pkgs; [
|
||||
firefox
|
||||
nitch
|
||||
starfetch
|
||||
|
||||
# programming/development account
|
||||
dev = {
|
||||
isNormalUser = true;
|
||||
extraGroups = ["wheel"];
|
||||
shell = pkgs.bash; #pkgs.zsh
|
||||
packages = with pkgs; [
|
||||
];
|
||||
# flatpak requires gnome-software
|
||||
flatpak
|
||||
gnome-software
|
||||
|
||||
colmena-new
|
||||
|
||||
gitkraken
|
||||
# NOTE: downloadthing this causes my PC to freak!! ("too many open files" error)
|
||||
#keyguard # bitwarden client app
|
||||
];
|
||||
};
|
||||
|
||||
# user for my professional jobs and stuff
|
||||
|
|
@ -133,24 +154,43 @@ in {
|
|||
home-manager = {
|
||||
users.me = import ../../homes/me;
|
||||
sharedModules = [
|
||||
#inputs.nixcord.homeManagerModules.nixcord
|
||||
#inputs.nixvim.homeManagerModules.nixvim
|
||||
inputs.nixcord.homeManagerModules.nixcord
|
||||
inputs.ags.homeManagerModules.default
|
||||
{nixpkgs.overlays = [inputs.hyprpanel.overlay];}
|
||||
];
|
||||
};
|
||||
|
||||
# set environment variables
|
||||
environment.sessionVariables = {
|
||||
# folder names with capitalisation look awful!
|
||||
XDG_DOWNLOAD_DIR = "$HOME/downloads";
|
||||
|
||||
# Hint Electrons apps to use Wayland
|
||||
NIXOS_OZONE_WL = "1";
|
||||
};
|
||||
|
||||
# ---- SYSTEM PACKAGES -----
|
||||
environment.systemPackages = with pkgs; [
|
||||
# User Environment
|
||||
inputs.swww.packages.${pkgs.system}.swww
|
||||
#vesktop
|
||||
helvum
|
||||
easyeffects
|
||||
pavucontrol
|
||||
ani-cli
|
||||
wl-clipboard # clipboard for wayland
|
||||
hyprpicker
|
||||
|
||||
#(callPackage ../sddm-theme-corners.nix {}).sddm-theme-corners
|
||||
# dependencies for my sddm theme:
|
||||
pkgs.libsForQt5.qt5.qtgraphicaleffects
|
||||
|
||||
python311 # I use 3.11 since it's in a pretty stable state now
|
||||
poetry # python dependency management and packaging
|
||||
|
||||
nixd # lsp for nix
|
||||
|
||||
neofetch # TODO: remove (installed to debug something)
|
||||
|
||||
# fish plugins
|
||||
grc # colorise command outputs
|
||||
|
||||
|
|
@ -158,28 +198,56 @@ in {
|
|||
curlie
|
||||
zoxide
|
||||
doggo
|
||||
tldr
|
||||
#btop
|
||||
|
||||
tesseract # for my work with Agribit
|
||||
|
||||
# TODO: remove this and host my nix flake on github instead
|
||||
#wishlist
|
||||
|
||||
# Pretty necessary
|
||||
git
|
||||
brightnessctl
|
||||
acpi
|
||||
vim
|
||||
nix-prefetch-git
|
||||
|
||||
# Unix Commands
|
||||
wget
|
||||
tree
|
||||
unzip
|
||||
|
||||
# Cryptography
|
||||
openssl
|
||||
libargon2
|
||||
];
|
||||
|
||||
# DEBUG: configuring xdg portal here instead?
|
||||
# REFERENCE: https://discourse.nixos.org/t/hyprland-screen-sharing/43658
|
||||
#xdg.portal = {
|
||||
# enable = true;
|
||||
# xdgOpenUsePortal = true;
|
||||
# config = {
|
||||
# common.default = ["gtk"];
|
||||
# hyprland.default = ["gtk" "hyprland"];
|
||||
# };
|
||||
# extraPortals = with pkgs; [
|
||||
# #xdg-desktop-portal-gtk
|
||||
# #xdg-desktop-portal-wlr
|
||||
# xdg-desktop-portal-hyprland
|
||||
# ];
|
||||
#};
|
||||
|
||||
# Enable the use of certain programs
|
||||
programs = {
|
||||
hyprland = {
|
||||
enable = true;
|
||||
# set the flake package
|
||||
package = inputs.hyprland.packages.${pkgs.stdenv.hostPlatform.system}.hyprland;
|
||||
# make sure to also set the portal package, so that they are in sync
|
||||
portalPackage = inputs.hyprland.packages.${pkgs.stdenv.hostPlatform.system}.xdg-desktop-portal-hyprland;
|
||||
# TODO: uncomment, I did this when hyprland wasn't working
|
||||
#package = inputs.hyprland.packages.${pkgs.stdenv.hostPlatform.system}.hyprland;
|
||||
#portalPackage = inputs.hyprland.packages.${pkgs.stdenv.hostPlatform.system}.xdg-desktop-portal-hyprland;
|
||||
|
||||
xwayland.enable = true;
|
||||
#systemd.enable = true;
|
||||
};
|
||||
|
||||
zsh.enable = true;
|
||||
|
|
@ -192,7 +260,7 @@ in {
|
|||
vimAlias = true;
|
||||
configure = {
|
||||
customRC = ''
|
||||
set number
|
||||
set number
|
||||
set tabstop=4
|
||||
set shiftwidth=4
|
||||
'';
|
||||
|
|
@ -211,32 +279,50 @@ in {
|
|||
fi
|
||||
'';
|
||||
};
|
||||
|
||||
# Thunar also users: `services.tumbler` & `services.gvfs`
|
||||
thunar = {
|
||||
enable = true;
|
||||
plugins = with pkgs.xfce; [
|
||||
thunar-volman # for removable drives (ie USBs)
|
||||
thunar-archive-plugin # create and extract archives
|
||||
thunar-media-tags-plugin # change metadata for media files
|
||||
];
|
||||
};
|
||||
|
||||
# mozilla's email client
|
||||
thunderbird.enable = true;
|
||||
};
|
||||
|
||||
# ----- FONTS -----
|
||||
fonts = {
|
||||
enableDefaultPackages = true; # no clue what this line does tbh
|
||||
packages = with pkgs; [
|
||||
/*
|
||||
(nerdfonts.override {
|
||||
fonts = [
|
||||
"Cousine" # its already i guess
|
||||
"Iosevka" # nah nah
|
||||
"IosevkaTerm" # big nah
|
||||
"CascadiaCode" # potential
|
||||
"FiraCode" # potential
|
||||
"JetBrainsMono" # for my rofi theme
|
||||
"Hasklig"
|
||||
"Hack"
|
||||
];
|
||||
})
|
||||
fonts = [
|
||||
"Cousine" # its already i guess
|
||||
"Iosevka" # nah nah
|
||||
"IosevkaTerm" # big nah
|
||||
"CascadiaCode" # potential
|
||||
"FiraCode" # potential
|
||||
"JetBrainsMono" # for my rofi theme
|
||||
"Hasklig"
|
||||
"Hack"
|
||||
];
|
||||
})
|
||||
*/
|
||||
nerdfonts
|
||||
geist-font # for my hyprlock theme
|
||||
|
||||
# texlive maintains a noto-emoji flake
|
||||
texlivePackages.noto-emoji
|
||||
];
|
||||
|
||||
# TODO: change my default fonts
|
||||
fontconfig = {
|
||||
defaultFonts = {
|
||||
serif = ["Iosevka"]; # TODO: package Iosevka Etoile since Iosevka isn't a serif font
|
||||
serif = ["Iosevka"];
|
||||
sansSerif = ["Iosevka "];
|
||||
monospace = ["Cousine"];
|
||||
emoji = ["Noto Emoji"];
|
||||
|
|
@ -244,34 +330,21 @@ in {
|
|||
};
|
||||
};
|
||||
|
||||
# ----- STYLIX -----
|
||||
|
||||
#stylix = {
|
||||
# enable = true;
|
||||
# image = pkgs.fetchurl {
|
||||
# url = "https://www.pixelstalk.net/wp-content/uploads/2016/05/Epic-Anime-Awesome-Wallpapers.jpg";
|
||||
# sha256 = "enQo3wqhgf0FEPHj2coOCvo7DuZv+x5rL/WIo4qPI50=";
|
||||
# };
|
||||
#
|
||||
# # Stylix will automatically theme applications
|
||||
# #autoEnable = true;
|
||||
# #image = ../../wallpapers/wall.png;
|
||||
# #image = "/home/me/nixdots/wallpapers/ghibli-esque-valley.png";
|
||||
#};
|
||||
|
||||
# Enable the new CLI commands and the flakes as experimental features
|
||||
nix.settings.experimental-features = [
|
||||
"nix-command"
|
||||
"flakes"
|
||||
];
|
||||
|
||||
virtualisation.docker.enable = true;
|
||||
|
||||
# Some programs need SUID wrappers, can be configured further or are
|
||||
# started in user sessions.
|
||||
# programs.mtr.enable = true;
|
||||
# programs.gnupg.agent = {
|
||||
# enable = true;
|
||||
# enableSSHSupport = true;
|
||||
# };
|
||||
#programs.gnupg.agent = {
|
||||
# enable = true;
|
||||
# enableSSHSupport = true;
|
||||
#};
|
||||
|
||||
# Enable the OpenSSH daemon.
|
||||
# services.openssh.enable = true;
|
||||
|
|
|
|||
|
|
@ -22,14 +22,11 @@
|
|||
fsType = "ext4";
|
||||
};
|
||||
|
||||
#fileSystems."/boot" = # BIOS
|
||||
fileSystems."/boot" =
|
||||
# UEFI
|
||||
{
|
||||
device = "/dev/disk/by-uuid/7046-177A";
|
||||
fsType = "vfat";
|
||||
options = ["fmask=0077" "dmask=0077"];
|
||||
};
|
||||
fileSystems."/boot/efi" = {
|
||||
device = "/dev/disk/by-uuid/7046-177A";
|
||||
fsType = "vfat";
|
||||
options = ["fmask=0077" "dmask=0077"];
|
||||
};
|
||||
|
||||
swapDevices = [
|
||||
{device = "/dev/disk/by-uuid/7f7e9d69-78e0-49f1-b792-6be26ed8e040";}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue