Massive nixfmt reformatting
This commit is contained in:
parent
fe4492f004
commit
b29ddd5e65
GPG key ID:
55A032EB38B49ADB
109 changed files with 4323 additions and 2368 deletions
|
|
@ -1,4 +1,10 @@
|
|||
{ config, pkgs, lib, ... }: {
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
{
|
||||
environment.etc = {
|
||||
"wireplumber/wireplumber.conf.d/51-sdac.conf".source = ./sdac.conf.json;
|
||||
};
|
||||
|
|
|
|||
|
|
@ -2,33 +2,39 @@
|
|||
# your system. Help is available in the configuration.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
|
||||
{ lib, config, pkgs, ... }:
|
||||
{
|
||||
lib,
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
|
||||
with lib;
|
||||
let
|
||||
openrazer = { pkgs, ... }: {
|
||||
# Razer stuff
|
||||
hardware.openrazer = {
|
||||
enable = true;
|
||||
users = [ "nki" ];
|
||||
openrazer =
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
# Razer stuff
|
||||
hardware.openrazer = {
|
||||
enable = true;
|
||||
users = [ "nki" ];
|
||||
};
|
||||
environment.systemPackages = with pkgs; [ polychromatic ];
|
||||
};
|
||||
environment.systemPackages = with pkgs; [ polychromatic ];
|
||||
};
|
||||
in
|
||||
{
|
||||
imports =
|
||||
[
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
# Fonts
|
||||
../modules/personal/fonts
|
||||
# Encrypted DNS
|
||||
../modules/services/edns
|
||||
# Other services
|
||||
../modules/personal/u2f.nix
|
||||
./peertube-runner.nix
|
||||
openrazer
|
||||
];
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
# Fonts
|
||||
../modules/personal/fonts
|
||||
# Encrypted DNS
|
||||
../modules/services/edns
|
||||
# Other services
|
||||
../modules/personal/u2f.nix
|
||||
./peertube-runner.nix
|
||||
openrazer
|
||||
];
|
||||
|
||||
# Kernel
|
||||
boot.kernelPackages = pkgs.linuxKernel.packages.linux_xanmod_stable;
|
||||
|
|
@ -43,35 +49,48 @@ in
|
|||
common.linux.sops.file = ./secrets.yaml;
|
||||
|
||||
# Nix cache server
|
||||
sops.secrets."nix-cache/private-key" = { owner = "harmonia"; group = "harmonia"; mode = "0600"; };
|
||||
sops.secrets."nix-cache/private-key" = {
|
||||
owner = "harmonia";
|
||||
group = "harmonia";
|
||||
mode = "0600";
|
||||
};
|
||||
nki.services.nix-cache = {
|
||||
enableServer = true;
|
||||
privateKeyFile = config.sops.secrets."nix-cache/private-key".path;
|
||||
};
|
||||
|
||||
sops.secrets."nix-build-farm/private-key" = { mode = "0400"; };
|
||||
sops.secrets."nix-build-farm/private-key" = {
|
||||
mode = "0400";
|
||||
};
|
||||
services.nix-build-farm.hostname = "home";
|
||||
services.nix-build-farm.privateKeyFile = config.sops.secrets."nix-build-farm/private-key".path;
|
||||
|
||||
# Networking
|
||||
common.linux.networking =
|
||||
{
|
||||
hostname = "kagamiPC"; # Define your hostname.
|
||||
networks = {
|
||||
"10-wired" = {
|
||||
match = "enp*";
|
||||
isRequired = true;
|
||||
};
|
||||
"20-wireless".match = "wlan*";
|
||||
common.linux.networking = {
|
||||
hostname = "kagamiPC"; # Define your hostname.
|
||||
networks = {
|
||||
"10-wired" = {
|
||||
match = "enp*";
|
||||
isRequired = true;
|
||||
};
|
||||
dnsServers = [ "127.0.0.1" ];
|
||||
"20-wireless".match = "wlan*";
|
||||
};
|
||||
dnsServers = [ "127.0.0.1" ];
|
||||
};
|
||||
nki.services.edns.enable = true;
|
||||
nki.services.edns.ipv6 = true;
|
||||
## DTTH Wireguard
|
||||
#
|
||||
sops.secrets."dtth-wg/private-key" = { owner = "root"; group = "systemd-network"; mode = "0640"; };
|
||||
sops.secrets."dtth-wg/preshared-key" = { owner = "root"; group = "systemd-network"; mode = "0640"; };
|
||||
sops.secrets."dtth-wg/private-key" = {
|
||||
owner = "root";
|
||||
group = "systemd-network";
|
||||
mode = "0640";
|
||||
};
|
||||
sops.secrets."dtth-wg/preshared-key" = {
|
||||
owner = "root";
|
||||
group = "systemd-network";
|
||||
mode = "0640";
|
||||
};
|
||||
systemd.network.netdevs."10-dtth-wg" = {
|
||||
netdevConfig = {
|
||||
Kind = "wireguard";
|
||||
|
|
@ -81,25 +100,36 @@ in
|
|||
wireguardConfig = {
|
||||
PrivateKeyFile = config.sops.secrets."dtth-wg/private-key".path;
|
||||
};
|
||||
wireguardPeers = [{
|
||||
PublicKey = "+7iI4jwmM1Qr+/DKB1Hv8JgFkGu7lSV0PAoo+O5d3yQ=";
|
||||
PresharedKeyFile = config.sops.secrets."dtth-wg/preshared-key".path;
|
||||
AllowedIPs = [ "100.64.0.0/10" "fd00::/106" ];
|
||||
Endpoint = "vpn.dtth.ch:51820";
|
||||
PersistentKeepalive = 25;
|
||||
}];
|
||||
wireguardPeers = [
|
||||
{
|
||||
PublicKey = "+7iI4jwmM1Qr+/DKB1Hv8JgFkGu7lSV0PAoo+O5d3yQ=";
|
||||
PresharedKeyFile = config.sops.secrets."dtth-wg/preshared-key".path;
|
||||
AllowedIPs = [
|
||||
"100.64.0.0/10"
|
||||
"fd00::/106"
|
||||
];
|
||||
Endpoint = "vpn.dtth.ch:51820";
|
||||
PersistentKeepalive = 25;
|
||||
}
|
||||
];
|
||||
};
|
||||
systemd.network.networks."dtth-wg" = {
|
||||
matchConfig.Name = "dtth-wg";
|
||||
address = [ "100.73.146.80/32" "fd00::33:105b/128" ];
|
||||
address = [
|
||||
"100.73.146.80/32"
|
||||
"fd00::33:105b/128"
|
||||
];
|
||||
DHCP = "no";
|
||||
routes = [
|
||||
{ Destination = "100.64.0.0/10"; Scope = "link"; }
|
||||
{
|
||||
Destination = "100.64.0.0/10";
|
||||
Scope = "link";
|
||||
}
|
||||
{ Destination = "fd00::/106"; }
|
||||
];
|
||||
};
|
||||
|
||||
# Define a user account.
|
||||
# Define a user account.
|
||||
common.linux.username = "nki";
|
||||
services.getty.autologinUser = "nki";
|
||||
|
||||
|
|
@ -117,7 +147,11 @@ in
|
|||
ntfsMount = path: {
|
||||
device = path;
|
||||
fsType = "ntfs";
|
||||
options = [ "rw" "uid=${toString config.users.users.nki.uid}" "nofail" ];
|
||||
options = [
|
||||
"rw"
|
||||
"uid=${toString config.users.users.nki.uid}"
|
||||
"nofail"
|
||||
];
|
||||
};
|
||||
in
|
||||
{
|
||||
|
|
@ -149,7 +183,6 @@ in
|
|||
bindPort = 6565;
|
||||
};
|
||||
|
||||
|
||||
# Music server
|
||||
services.navidrome.enable = true;
|
||||
services.navidrome.settings = {
|
||||
|
|
@ -157,7 +190,10 @@ in
|
|||
MusicFolder = "/mnt/Stuff/Music";
|
||||
};
|
||||
systemd.services.navidrome.serviceConfig.BindReadOnlyPaths = lib.mkAfter [ "/etc" ];
|
||||
networking.firewall.allowedTCPPorts = [ 4533 8000 ];
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
4533
|
||||
8000
|
||||
];
|
||||
|
||||
# Printers
|
||||
services.printing.enable = true;
|
||||
|
|
@ -201,4 +237,3 @@ in
|
|||
|
||||
virtualisation.spiceUSBRedirection.enable = true;
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1,42 +1,57 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports =
|
||||
[
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
./audio
|
||||
];
|
||||
imports = [
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
./audio
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
|
||||
boot.initrd.kernelModules = [ "dm-snapshot" "amdgpu" ];
|
||||
boot.initrd.availableKernelModules = [
|
||||
"nvme"
|
||||
"xhci_pci"
|
||||
"ahci"
|
||||
"usbhid"
|
||||
"usb_storage"
|
||||
"sd_mod"
|
||||
];
|
||||
boot.initrd.kernelModules = [
|
||||
"dm-snapshot"
|
||||
"amdgpu"
|
||||
];
|
||||
boot.kernelModules = [ "kvm-amd" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{
|
||||
device = "/dev/disk/by-uuid/32a74827-4624-43ef-b066-b52e1f11793d";
|
||||
fsType = "ext4";
|
||||
};
|
||||
fileSystems."/home/nki/Projects" =
|
||||
{
|
||||
device = "/dev/disk/by-uuid/025cb533-e21b-47f2-b7d5-322b7b95b831";
|
||||
fsType = "btrfs";
|
||||
options = [ "compress=zstd" ];
|
||||
};
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-uuid/32a74827-4624-43ef-b066-b52e1f11793d";
|
||||
fsType = "ext4";
|
||||
};
|
||||
fileSystems."/home/nki/Projects" = {
|
||||
device = "/dev/disk/by-uuid/025cb533-e21b-47f2-b7d5-322b7b95b831";
|
||||
fsType = "btrfs";
|
||||
options = [ "compress=zstd" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{
|
||||
device = "/dev/disk/by-uuid/549C-7877";
|
||||
fsType = "vfat";
|
||||
};
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-uuid/549C-7877";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
fileSystems."/mnt/steam" = {
|
||||
device = "/dev/disk/by-uuid/d1db9f65-6add-4714-b9d7-16e16f687396";
|
||||
fsType = "btrfs";
|
||||
options = [ "compress=zstd" "subvol=steam" ];
|
||||
options = [
|
||||
"compress=zstd"
|
||||
"subvol=steam"
|
||||
];
|
||||
encrypted = {
|
||||
enable = true;
|
||||
label = "encdata";
|
||||
|
|
@ -45,8 +60,7 @@
|
|||
};
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[{ device = "/dev/disk/by-uuid/561f6441-1915-4059-a5e1-76a449b0c9bf"; }];
|
||||
swapDevices = [ { device = "/dev/disk/by-uuid/561f6441-1915-4059-a5e1-76a449b0c9bf"; } ];
|
||||
|
||||
# bluetooth usb
|
||||
hardware.firmware = [ pkgs.rtl8761b-firmware ];
|
||||
|
|
|
|||
|
|
@ -1,4 +1,9 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
user = "peertube-runner-nodejs";
|
||||
instance = "systemd-instance";
|
||||
|
|
@ -27,8 +32,8 @@ in
|
|||
runnerName = "kagamipc"
|
||||
'';
|
||||
|
||||
environment.etc."${user}/${instance}/config.toml".source = config.sops.templates."peertube-config.toml".path;
|
||||
|
||||
environment.etc."${user}/${instance}/config.toml".source =
|
||||
config.sops.templates."peertube-config.toml".path;
|
||||
|
||||
systemd.services.peertube-runner = {
|
||||
description = "PeerTube runner daemon";
|
||||
|
|
@ -36,20 +41,19 @@ in
|
|||
after = [ "network.target" ];
|
||||
requires = [ ];
|
||||
|
||||
serviceConfig =
|
||||
{
|
||||
ExecStart = "${lib.getExe' pkgs.peertube.runner "peertube-runner"} server --id ${instance}";
|
||||
User = user;
|
||||
RuntimeDirectory = user;
|
||||
StateDirectory = user;
|
||||
CacheDirectory = user;
|
||||
# Hardening
|
||||
ProtectSystem = "full";
|
||||
PrivateDevices = false;
|
||||
NoNewPrivileges = true;
|
||||
ProtectHome = true;
|
||||
CapabilityBoundingSet = "~CAP_SYS_ADMIN";
|
||||
};
|
||||
serviceConfig = {
|
||||
ExecStart = "${lib.getExe' pkgs.peertube.runner "peertube-runner"} server --id ${instance}";
|
||||
User = user;
|
||||
RuntimeDirectory = user;
|
||||
StateDirectory = user;
|
||||
CacheDirectory = user;
|
||||
# Hardening
|
||||
ProtectSystem = "full";
|
||||
PrivateDevices = false;
|
||||
NoNewPrivileges = true;
|
||||
ProtectHome = true;
|
||||
CapabilityBoundingSet = "~CAP_SYS_ADMIN";
|
||||
};
|
||||
|
||||
environment = {
|
||||
NODE_ENV = "production";
|
||||
|
|
@ -61,7 +65,9 @@ in
|
|||
XDG_STATE_HOME = "/var/lib";
|
||||
};
|
||||
|
||||
path = with pkgs; [ nodejs ffmpeg ];
|
||||
path = with pkgs; [
|
||||
nodejs
|
||||
ffmpeg
|
||||
];
|
||||
};
|
||||
}
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue