537 lines
13 KiB
Nix
537 lines
13 KiB
Nix
|
{ config, pkgs, lib, ... }:
|
||
|
|
|
||
|
|
let
|
||
|
|
# Add nixpkgs-unstable channel with the following command:
|
||
|
|
# nix-channel --add https://nixos.org/channels/nixpkgs-unstable nixpkgs-unstable && nix-channel --update
|
||
|
|
unstable = import <nixpkgs-unstable> { config = config.nixpkgs.config; };
|
||
|
|
host_name = "litten";
|
||
|
|
host_fqdn = "${host_name}.brenise.dev";
|
||
|
|
in
|
||
|
|
{
|
||
|
|
imports = [
|
||
|
|
./hardware-configuration.nix
|
||
|
|
];
|
||
|
|
nixpkgs = {
|
||
|
|
config.permittedInsecurePackages = [
|
||
|
|
"electron-27.3.11" # logseq
|
||
|
|
];
|
||
|
|
config.allowUnfreePredicate = pkg:
|
||
|
|
builtins.elem (lib.getName pkg) [
|
||
|
|
"obsidian" # https://github.com/obsidianmd/obsidian-releases
|
||
|
|
"packer"
|
||
|
|
"vscode"
|
||
|
|
"terraform"
|
||
|
|
"zoom"
|
||
|
|
];
|
||
|
|
overlays = [
|
||
|
|
(self: super: {
|
||
|
|
ansible = super.ansible.overrideAttrs (oldAttrs: {
|
||
|
|
propagatedBuildInputs = oldAttrs.propagatedBuildInputs ++ [ super.python311Packages.jmespath ];
|
||
|
|
});
|
||
|
|
})
|
||
|
|
];
|
||
|
|
};
|
||
|
|
|
||
|
|
boot = {
|
||
|
|
loader = {
|
||
|
|
systemd-boot.enable = true;
|
||
|
|
systemd-boot.configurationLimit = 20;
|
||
|
|
efi.canTouchEfiVariables = true;
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
hardware = {
|
||
|
|
bluetooth.enable = true;
|
||
|
|
keyboard.qmk.enable = true;
|
||
|
|
|
||
|
|
opengl = { # https://wiki.nixos.org/wiki/Accelerated_Video_Playback
|
||
|
|
enable = true;
|
||
|
|
extraPackages = with pkgs; [
|
||
|
|
intel-media-driver
|
||
|
|
];
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
networking = {
|
||
|
|
hostName = "${host_name}";
|
||
|
|
# networkmanager.enable = true;
|
||
|
|
firewall.enable = false;
|
||
|
|
interfaces = {
|
||
|
|
enp100s0.ipv4.addresses = [{
|
||
|
|
address = "192.168.1.35";
|
||
|
|
prefixLength = 24;
|
||
|
|
}];
|
||
|
|
};
|
||
|
|
defaultGateway = {
|
||
|
|
address = "192.168.1.1";
|
||
|
|
interface = "enp100s0";
|
||
|
|
};
|
||
|
|
# TODO https://nixos.wiki/wiki/Encrypted_DNS
|
||
|
|
nameservers = [ "1.1.1.1" "8.8.8.8" ];
|
||
|
|
extraHosts = ''
|
||
|
|
192.168.1.1 shinx.brenise.dev
|
||
|
|
'';
|
||
|
|
};
|
||
|
|
|
||
|
|
time.timeZone = "America/Los_Angeles";
|
||
|
|
|
||
|
|
i18n.defaultLocale = "en_US.UTF-8";
|
||
|
|
console = {
|
||
|
|
font = "Lat2-Terminus16";
|
||
|
|
# keyMap = "us";
|
||
|
|
useXkbConfig = true; # use xkbOptions in tty.
|
||
|
|
};
|
||
|
|
|
||
|
|
users = {
|
||
|
|
groups.glance = {};
|
||
|
|
users = {
|
||
|
|
|
||
|
|
root = {
|
||
|
|
openssh.authorizedKeys.keyFiles = [
|
||
|
|
/etc/nixos/ssh/authorized_keys
|
||
|
|
];
|
||
|
|
};
|
||
|
|
|
||
|
|
blee = {
|
||
|
|
openssh.authorizedKeys.keyFiles = [
|
||
|
|
/etc/nixos/ssh/authorized_keys
|
||
|
|
];
|
||
|
|
isNormalUser = true;
|
||
|
|
extraGroups = [
|
||
|
|
"wheel"
|
||
|
|
"glance"
|
||
|
|
];
|
||
|
|
packages = with pkgs; [
|
||
|
|
chromium
|
||
|
|
coreutils # base64
|
||
|
|
element-desktop
|
||
|
|
firefox
|
||
|
|
gimp
|
||
|
|
jellyfin-media-player
|
||
|
|
kate # kwrite
|
||
|
|
kdenlive
|
||
|
|
libsForQt5.kcalc
|
||
|
|
|
||
|
|
logseq # 0.10.9 # uses insecure electron version 27.3.11 https://github.com/NixOS/nixpkgs/pull/340427
|
||
|
|
#unstable.logseq # 0.10.9 BUG: https://github.com/logseq/logseq/issues/10851
|
||
|
|
|
||
|
|
moonlight-qt
|
||
|
|
nmap
|
||
|
|
obs-studio
|
||
|
|
obsidian
|
||
|
|
qbittorrent
|
||
|
|
rtorrent
|
||
|
|
spek # beat saber mapping
|
||
|
|
synergy
|
||
|
|
tenacity
|
||
|
|
thunderbird
|
||
|
|
tor-browser
|
||
|
|
via
|
||
|
|
vlc
|
||
|
|
vscode
|
||
|
|
xcaddy # warning: absolute dumpster fire
|
||
|
|
yt-dlp
|
||
|
|
zoom-us
|
||
|
|
|
||
|
|
# Build vim huge with clipboard support
|
||
|
|
(vim_configurable.overrideAttrs (oldAttrs: {
|
||
|
|
features = "huge";
|
||
|
|
}))
|
||
|
|
|
||
|
|
awscli2
|
||
|
|
#aws-sam-cli # broken, fails to init. use pip install aws-sam-cli
|
||
|
|
#unstable.aws-sam-cli
|
||
|
|
packer
|
||
|
|
terraform
|
||
|
|
ansible
|
||
|
|
python3
|
||
|
|
python311Packages.pip
|
||
|
|
python311Packages.ipython
|
||
|
|
libreoffice-qt
|
||
|
|
hunspell
|
||
|
|
hunspellDicts.uk_UA
|
||
|
|
hunspellDicts.th_TH
|
||
|
|
nodejs_20
|
||
|
|
yarn
|
||
|
|
deno
|
||
|
|
];
|
||
|
|
};
|
||
|
|
|
||
|
|
glance = {
|
||
|
|
isSystemUser = true;
|
||
|
|
group = "glance";
|
||
|
|
home = "/var/lib/glance";
|
||
|
|
createHome = true;
|
||
|
|
description = "Glance service user";
|
||
|
|
# shell = pkgs.bash;
|
||
|
|
};
|
||
|
|
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
environment = {
|
||
|
|
systemPackages = with pkgs; [
|
||
|
|
# GPU tools
|
||
|
|
android-tools
|
||
|
|
arp-scan
|
||
|
|
cryptsetup
|
||
|
|
curl
|
||
|
|
difftastic
|
||
|
|
dig
|
||
|
|
dnscontrol
|
||
|
|
dnsutils
|
||
|
|
doas
|
||
|
|
exiftool
|
||
|
|
ffmpeg
|
||
|
|
file
|
||
|
|
fzf
|
||
|
|
git
|
||
|
|
go
|
||
|
|
htop
|
||
|
|
iftop
|
||
|
|
imagemagick
|
||
|
|
iperf
|
||
|
|
jq
|
||
|
|
lego
|
||
|
|
libressl
|
||
|
|
mediainfo
|
||
|
|
net-snmp # snmpwalk
|
||
|
|
netcat
|
||
|
|
nettools
|
||
|
|
parted
|
||
|
|
pass
|
||
|
|
pciutils # lspci
|
||
|
|
psmisc
|
||
|
|
qrencode
|
||
|
|
rsync
|
||
|
|
screen
|
||
|
|
tcpdump
|
||
|
|
tmux
|
||
|
|
tree
|
||
|
|
unzip
|
||
|
|
vim
|
||
|
|
vulkan-tools
|
||
|
|
wget
|
||
|
|
whois
|
||
|
|
wireguard-tools
|
||
|
|
zbar
|
||
|
|
zip
|
||
|
|
];
|
||
|
|
|
||
|
|
shellInit = ''
|
||
|
|
pheonix() {
|
||
|
|
systemctl restart "$1"
|
||
|
|
journalctl -fu "$1"
|
||
|
|
}
|
||
|
|
'';
|
||
|
|
|
||
|
|
plasma5.excludePackages = with pkgs.libsForQt5; [
|
||
|
|
plasma-browser-integration
|
||
|
|
];
|
||
|
|
|
||
|
|
etc = lib.mkMerge [
|
||
|
|
|
||
|
|
# Generate KDE config files
|
||
|
|
(lib.attrsets.mapAttrs' (name: value:
|
||
|
|
lib.attrsets.nameValuePair
|
||
|
|
( "xdg/${name}" )
|
||
|
|
{
|
||
|
|
source = (pkgs.formats.ini {}).generate name value;
|
||
|
|
}
|
||
|
|
) {
|
||
|
|
"baloofilerc" = {
|
||
|
|
"Basic Settings" = {
|
||
|
|
"Indexing-Enabled" = false;
|
||
|
|
};
|
||
|
|
};
|
||
|
|
})
|
||
|
|
|
||
|
|
{ # normal environment.etc block
|
||
|
|
gitconfig = {
|
||
|
|
text = ''
|
||
|
|
[init]
|
||
|
|
defaultBranch = main
|
||
|
|
'';
|
||
|
|
};
|
||
|
|
}
|
||
|
|
];
|
||
|
|
|
||
|
|
};
|
||
|
|
|
||
|
|
|
||
|
|
programs = {
|
||
|
|
appimage = {
|
||
|
|
enable = true;
|
||
|
|
binfmt = true;
|
||
|
|
package = pkgs.appimage-run.override {
|
||
|
|
extraPkgs = pkgs: [
|
||
|
|
pkgs.libthai # lume
|
||
|
|
];
|
||
|
|
};
|
||
|
|
};
|
||
|
|
fish.enable = true;
|
||
|
|
vim.defaultEditor = true;
|
||
|
|
bash = {
|
||
|
|
shellAliases = {
|
||
|
|
ll = "ls -lAF --classify --group-directories-first";
|
||
|
|
l = "ls -lF --classify --group-directories-first";
|
||
|
|
};
|
||
|
|
# https://nixos.wiki/wiki/Fish
|
||
|
|
interactiveShellInit = ''
|
||
|
|
if [[ $(${pkgs.procps}/bin/ps --no-header --pid=$PPID --format=comm) != "fish" && -z ''${BASH_EXECUTION_STRING} ]]
|
||
|
|
then
|
||
|
|
shopt -q login_shell && LOGIN_OPTION='--login' || LOGIN_OPTION=""
|
||
|
|
exec ${pkgs.fish}/bin/fish $LOGIN_OPTION
|
||
|
|
fi
|
||
|
|
'';
|
||
|
|
};
|
||
|
|
mtr.enable = true;
|
||
|
|
gnupg.agent = {
|
||
|
|
enable = true;
|
||
|
|
enableSSHSupport = true;
|
||
|
|
};
|
||
|
|
kdeconnect.enable = true;
|
||
|
|
chromium = {
|
||
|
|
enable = true;
|
||
|
|
extraOpts = {
|
||
|
|
"SpellcheckEnabled" = false;
|
||
|
|
"DefaultSearchProviderEnabled" = true;
|
||
|
|
"DefaultSearchProviderName" = "Kagi";
|
||
|
|
"DefaultSearchProviderSearchURL" = "https://kagi.com/search?q={searchTerms}";
|
||
|
|
"SearchSuggestEnabled" = false;
|
||
|
|
"DefaultSearchProviderSuggestURL" = "";
|
||
|
|
};
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
security = {
|
||
|
|
sudo.enable = false;
|
||
|
|
doas = {
|
||
|
|
enable = true;
|
||
|
|
extraRules = [
|
||
|
|
{
|
||
|
|
users = [ "blee" ];
|
||
|
|
persist = true;
|
||
|
|
}
|
||
|
|
];
|
||
|
|
};
|
||
|
|
# pki.certificateFiles = [ # self-signed CA trust for start9
|
||
|
|
# "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
|
||
|
|
# # "/etc/ssl/certs/dotted-turbans.pem"
|
||
|
|
# ];
|
||
|
|
};
|
||
|
|
|
||
|
|
services = {
|
||
|
|
|
||
|
|
openssh.enable = true;
|
||
|
|
udev.packages = [ pkgs.via ];
|
||
|
|
|
||
|
|
# https://discourse.nixos.org/t/bluetooth-a2dp-sink-not-showing-up-in-pulseaudio-on-nixos/32447/4?u=bleetube
|
||
|
|
pipewire = {
|
||
|
|
enable = true;
|
||
|
|
pulse.enable = true;
|
||
|
|
};
|
||
|
|
# avahi = { # for resolving start9 hostname
|
||
|
|
# enable = true;
|
||
|
|
# nssmdns4 = true; # Enable NSS support for mDNS
|
||
|
|
# };
|
||
|
|
|
||
|
|
syncthing = {
|
||
|
|
enable = true;
|
||
|
|
user = "blee";
|
||
|
|
dataDir = "/home/blee/Documents";
|
||
|
|
};
|
||
|
|
journald.extraConfig = "MaxRetentionSec=30day";
|
||
|
|
|
||
|
|
# https://github.com/NixOS/nixpkgs/blob/nixos-23.05/nixos/modules/services/monitoring/prometheus/exporters.nix
|
||
|
|
prometheus.exporters.node = {
|
||
|
|
enable = true;
|
||
|
|
port = 8030;
|
||
|
|
enabledCollectors = [
|
||
|
|
"cpu.info"
|
||
|
|
"interrupts"
|
||
|
|
"netstat"
|
||
|
|
"vmstat"
|
||
|
|
"systemd"
|
||
|
|
"tcpstat"
|
||
|
|
"processes"
|
||
|
|
];
|
||
|
|
};
|
||
|
|
|
||
|
|
caddy = {
|
||
|
|
enable = true;
|
||
|
|
logFormat = "output discard";
|
||
|
|
extraConfig = let
|
||
|
|
tlsConfig = ''
|
||
|
|
tls {
|
||
|
|
dns namecheap {
|
||
|
|
api_key {env.NAMECHEAP_API_KEY}
|
||
|
|
user {env.NAMECHEAP_API_USER}
|
||
|
|
api_endpoint https://api.namecheap.com/xml.response
|
||
|
|
}
|
||
|
|
}
|
||
|
|
'';
|
||
|
|
in ''
|
||
|
|
${host_fqdn} { # open-webui
|
||
|
|
${tlsConfig}
|
||
|
|
reverse_proxy http://127.0.0.1:8080
|
||
|
|
|
||
|
|
# BUG: assets are all on root path
|
||
|
|
# handle /changedetection/* {
|
||
|
|
# uri strip_prefix /changedetection
|
||
|
|
# reverse_proxy http://127.0.0.1:${toString config.services.changedetection-io.port}
|
||
|
|
# }
|
||
|
|
|
||
|
|
# handle /files/* {
|
||
|
|
# root /mnt/usb/
|
||
|
|
# file_server browse
|
||
|
|
# }
|
||
|
|
}
|
||
|
|
|
||
|
|
${host_fqdn}:4430 { # node_exporter
|
||
|
|
${tlsConfig}
|
||
|
|
reverse_proxy http://127.0.0.1:8030
|
||
|
|
}
|
||
|
|
|
||
|
|
${host_fqdn}:4431 { # litellm
|
||
|
|
${tlsConfig}
|
||
|
|
reverse_proxy http://127.0.0.1:8031
|
||
|
|
}
|
||
|
|
|
||
|
|
${host_fqdn}:4432 { # glance
|
||
|
|
${tlsConfig}
|
||
|
|
reverse_proxy http://127.0.0.1:8032
|
||
|
|
}
|
||
|
|
|
||
|
|
# BUG: POST messages throw missing referrer error
|
||
|
|
${host_fqdn}:4433 { # changedetection-io
|
||
|
|
${tlsConfig}
|
||
|
|
reverse_proxy http://127.0.0.1:${toString config.services.changedetection-io.port}
|
||
|
|
header Referrer-Policy "strict-origin-when-cross-origin"
|
||
|
|
}
|
||
|
|
|
||
|
|
${host_fqdn}:4434 { # home-assistant
|
||
|
|
${tlsConfig}
|
||
|
|
reverse_proxy http://127.0.0.1:8034
|
||
|
|
}
|
||
|
|
|
||
|
|
'';
|
||
|
|
};
|
||
|
|
|
||
|
|
changedetection-io = {
|
||
|
|
enable = true;
|
||
|
|
port = 8033;
|
||
|
|
behindProxy = true;
|
||
|
|
# baseURL = "https://${host_fqdn}/changedetection/";
|
||
|
|
baseURL = "https://${host_fqdn}:4433/";
|
||
|
|
environmentFile = "/var/src/env_vars/changedetection-io";
|
||
|
|
};
|
||
|
|
|
||
|
|
displayManager = {
|
||
|
|
sddm.enable = true;
|
||
|
|
#defaultSession = "plasmawayland";
|
||
|
|
};
|
||
|
|
xserver = {
|
||
|
|
enable = true;
|
||
|
|
desktopManager.plasma5.enable = true;
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
systemd = {
|
||
|
|
services = {
|
||
|
|
caddy = {
|
||
|
|
serviceConfig = {
|
||
|
|
EnvironmentFile = "/var/src/secrets/namecheap";
|
||
|
|
ExecStart = [
|
||
|
|
"" # This empty string clears the existing ExecStart commands
|
||
|
|
"/opt/bin/caddy run --config /etc/caddy/caddy_config --adapter caddyfile"
|
||
|
|
];
|
||
|
|
ExecReload = [
|
||
|
|
"" # This empty string clears the existing ExecReload commands
|
||
|
|
"/opt/bin/caddy reload --config /etc/caddy/caddy_config --adapter caddyfile --force"
|
||
|
|
];
|
||
|
|
};
|
||
|
|
};
|
||
|
|
glance = {
|
||
|
|
wantedBy = [ "multi-user.target" ];
|
||
|
|
after = [ "network-online.target" ];
|
||
|
|
wants = [ "network-online.target" ];
|
||
|
|
serviceConfig = {
|
||
|
|
User = "glance";
|
||
|
|
Group = "glance";
|
||
|
|
WorkingDirectory = "/var/lib/glance";
|
||
|
|
# Environment = "LOG_LEVEL=debug"; # https://github.com/glanceapp/glance/issues/196
|
||
|
|
ExecStart = "${pkgs.glance}/bin/glance --config config.yaml";
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
open-webui = {
|
||
|
|
wantedBy = [ "multi-user.target" ];
|
||
|
|
after = [ "network.target" ];
|
||
|
|
serviceConfig = {
|
||
|
|
Type = "forking";
|
||
|
|
User = "blee";
|
||
|
|
WorkingDirectory = "/opt/open-webui";
|
||
|
|
Environment = "NIX_PATH=nixpkgs=/nix/var/nix/profiles/per-user/root/channels/nixos:nixos-config=/etc/nixos/configuration.nix:/nix/var/nix/profiles/per-user/root/channels";
|
||
|
|
ExecStart = "${pkgs.nix}/bin/nix-shell";
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
};
|
||
|
|
|
||
|
|
# TODO: fix errors
|
||
|
|
# systemd.services.nightly-backups = {
|
||
|
|
# description = "Nightly Backup Service";
|
||
|
|
# wantedBy = [ "multi-user.target" ];
|
||
|
|
# after = [ "network.target" ];
|
||
|
|
# # enable = false; # testing
|
||
|
|
# serviceConfig = {
|
||
|
|
# User = "blee";
|
||
|
|
# Type = "oneshot";
|
||
|
|
# Environment = "NIX_PATH=nixpkgs=/nix/var/nix/profiles/per-user/root/channels/nixos:nixos-config=/etc/nixos/configuration.nix:/nix/var/nix/profiles/per-user/root/channels";
|
||
|
|
# WorkingDirectory = "/home/blee/ops/brenise.dev/scripts/backups";
|
||
|
|
# # batch.sh calls other shell scripts which leads to nix environment hell.
|
||
|
|
# # As a workaround, I think we could add multiple ExecStart lines for other backup scripts.
|
||
|
|
# # ExecStart = "${pkgs.bash}/bin/bash /home/blee/ops/brenise.dev/scripts/backups/batch.sh";
|
||
|
|
# ExecStart = "${pkgs.bash}/bin/bash /home/blee/ops/brenise.dev/scripts/backups/hosts/litten.brenise.dev.sh";
|
||
|
|
# # Path = [
|
||
|
|
# # "${pkgs.openssh}/bin"
|
||
|
|
# # "${pkgs.coreutils}/bin"
|
||
|
|
# # "${pkgs.gnugrep}/bin"
|
||
|
|
# # "${pkgs.gnused}/bin"
|
||
|
|
# # ];
|
||
|
|
# };
|
||
|
|
# };
|
||
|
|
|
||
|
|
# systemd.timers.nightly-backups = {
|
||
|
|
# wantedBy = [ "timers.target" ];
|
||
|
|
# partOf = [ "nightly-backups.service" ];
|
||
|
|
# timerConfig = {
|
||
|
|
# OnCalendar = "daily";
|
||
|
|
# nCalendar = "*-*-* 03:00:00";
|
||
|
|
# # Persistent = true;
|
||
|
|
# Unit = "nightly-backups.service";
|
||
|
|
# };
|
||
|
|
# };
|
||
|
|
|
||
|
|
};
|
||
|
|
|
||
|
|
# virtualisation.oci-containers = {
|
||
|
|
# backend = "podman"; # systemctl status podman-homeassistant
|
||
|
|
# containers.homeassistant = {
|
||
|
|
# volumes = [ "home-assistant:/config" ];
|
||
|
|
# environment.TZ = "US/Pacific";
|
||
|
|
# # Note: The image will not be updated on rebuilds, unless the version label changes
|
||
|
|
# image = "ghcr.io/home-assistant/home-assistant:stable";
|
||
|
|
# ports = [ "8123:8034" ];
|
||
|
|
# extraOptions = [
|
||
|
|
# "--network=host"
|
||
|
|
# "--cap-add=NET_ADMIN"
|
||
|
|
# "--cap-add=NET_RAW"
|
||
|
|
# ];
|
||
|
|
# };
|
||
|
|
# };
|
||
|
|
|
||
|
|
system.stateVersion = "23.05";
|
||
|
|
}
|