Compare commits
No commits in common. "f44474ec3e0010d3cf3c1e90e9dde715c01af924" and "97318f33f5efaf185f661e3c77be793de011f53d" have entirely different histories.
f44474ec3e
...
97318f33f5
8 changed files with 220 additions and 359 deletions
24
flake.lock
generated
24
flake.lock
generated
|
|
@ -608,11 +608,11 @@
|
|||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1744138333,
|
||||
"narHash": "sha256-l0Vjq1EZoYTfWImVmwsvMEuIdasrBRRCoNTV0rNtYi0=",
|
||||
"lastModified": 1742670145,
|
||||
"narHash": "sha256-xQ2F9f+ICAGBp/nNv3ddD2U4ZvzuLOci0u/5lyMXPvk=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "760eed59594f2f258db0d66b7ca4a5138681fd97",
|
||||
"rev": "63e77d09a133ac641a0c204e7cfb0c97e133706d",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -942,11 +942,11 @@
|
|||
},
|
||||
"nixpkgs-unstable": {
|
||||
"locked": {
|
||||
"lastModified": 1744032190,
|
||||
"narHash": "sha256-KSlfrncSkcu1YE+uuJ/PTURsSlThoGkRqiGDVdbiE/k=",
|
||||
"lastModified": 1742578646,
|
||||
"narHash": "sha256-GiQ40ndXRnmmbDZvuv762vS+gew1uDpFwOfgJ8tLiEs=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "b0b4b5f8f621bfe213b8b21694bab52ecfcbf30b",
|
||||
"rev": "94c4dbe77c0740ebba36c173672ca15a7926c993",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -990,11 +990,11 @@
|
|||
},
|
||||
"nixpkgs_12": {
|
||||
"locked": {
|
||||
"lastModified": 1743827369,
|
||||
"narHash": "sha256-rpqepOZ8Eo1zg+KJeWoq1HAOgoMCDloqv5r2EAa9TSA=",
|
||||
"lastModified": 1742889210,
|
||||
"narHash": "sha256-hw63HnwnqU3ZQfsMclLhMvOezpM7RSB0dMAtD5/sOiw=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "42a1c966be226125b48c384171c44c651c236c22",
|
||||
"rev": "698214a32beb4f4c8e3942372c694f40848b360d",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -1546,11 +1546,11 @@
|
|||
"nixpkgs": "nixpkgs_12"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1743912348,
|
||||
"narHash": "sha256-Ui+kUYOhkQ0wkoJbCPLN/LpYQGp+R5sNVsawZWZsEcQ=",
|
||||
"lastModified": 1743134754,
|
||||
"narHash": "sha256-NC90oFdXwjABXs7wg0tMi5yxNW/xT1bgezg+0a9+3AI=",
|
||||
"owner": "youwen5",
|
||||
"repo": "zen-browser-flake",
|
||||
"rev": "75acddf6a50f3a4dd920a3a7220828605ba91090",
|
||||
"rev": "ceb2e7122307700e9c310973c793c2c241dc0901",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
|
|||
|
|
@ -357,17 +357,6 @@ in
|
|||
# Firewall: only open to SSH now
|
||||
networking.firewall.allowedTCPPorts = [ 22 ];
|
||||
networking.firewall.allowedUDPPorts = [ 22 ];
|
||||
# Network namespaces management
|
||||
systemd.services."netns@" = {
|
||||
description = "Network namespace %I";
|
||||
before = [ "network.target" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
ExecStart = "${pkgs.iproute2}/bin/ip netns add %I";
|
||||
ExecStop = "${pkgs.iproute2}/bin/ip netns del %I";
|
||||
};
|
||||
};
|
||||
|
||||
## Time and Region
|
||||
time.timeZone = lib.mkDefault "Europe/Zurich";
|
||||
|
|
|
|||
|
|
@ -33,242 +33,207 @@ in
|
|||
# Other services
|
||||
../modules/personal/u2f.nix
|
||||
./peertube-runner.nix
|
||||
./deluge.nix
|
||||
openrazer
|
||||
];
|
||||
|
||||
config = mkMerge [
|
||||
# Kernel
|
||||
boot.kernelPackages = pkgs.linuxKernel.packages.linux_xanmod_stable;
|
||||
|
||||
# Plasma!
|
||||
services.desktopManager.plasma6.enable = true;
|
||||
|
||||
## Encryption
|
||||
# Kernel modules needed for mounting USB VFAT devices in initrd stage
|
||||
common.linux.luksDevices.root = "/dev/disk/by-uuid/7c6e40a8-900b-4f85-9712-2b872caf1892";
|
||||
common.linux.sops.enable = true;
|
||||
common.linux.sops.file = ./secrets.yaml;
|
||||
|
||||
# Nix cache server
|
||||
sops.secrets."nix-cache/private-key" = {
|
||||
owner = "harmonia";
|
||||
group = "harmonia";
|
||||
mode = "0600";
|
||||
};
|
||||
nki.services.nix-cache = {
|
||||
enableServer = true;
|
||||
privateKeyFile = config.sops.secrets."nix-cache/private-key".path;
|
||||
};
|
||||
|
||||
sops.secrets."nix-build-farm/private-key" = {
|
||||
mode = "0400";
|
||||
};
|
||||
services.nix-build-farm.hostname = "home";
|
||||
services.nix-build-farm.privateKeyFile = config.sops.secrets."nix-build-farm/private-key".path;
|
||||
|
||||
# Networking
|
||||
common.linux.networking = {
|
||||
hostname = "kagamiPC"; # Define your hostname.
|
||||
networks = {
|
||||
"10-wired" = {
|
||||
match = "enp*";
|
||||
isRequired = true;
|
||||
};
|
||||
"20-wireless".match = "wlan*";
|
||||
};
|
||||
dnsServers = [ "127.0.0.1" ];
|
||||
};
|
||||
nki.services.edns.enable = true;
|
||||
nki.services.edns.ipv6 = true;
|
||||
## DTTH Wireguard
|
||||
#
|
||||
sops.secrets."dtth-wg/private-key" = {
|
||||
owner = "root";
|
||||
group = "systemd-network";
|
||||
mode = "0640";
|
||||
};
|
||||
sops.secrets."dtth-wg/preshared-key" = {
|
||||
owner = "root";
|
||||
group = "systemd-network";
|
||||
mode = "0640";
|
||||
};
|
||||
systemd.network.netdevs."10-dtth-wg" = {
|
||||
netdevConfig = {
|
||||
Kind = "wireguard";
|
||||
Name = "dtth-wg";
|
||||
MTUBytes = "1280";
|
||||
};
|
||||
wireguardConfig = {
|
||||
PrivateKeyFile = config.sops.secrets."dtth-wg/private-key".path;
|
||||
};
|
||||
wireguardPeers = [
|
||||
{
|
||||
PublicKey = "+7iI4jwmM1Qr+/DKB1Hv8JgFkGu7lSV0PAoo+O5d3yQ=";
|
||||
PresharedKeyFile = config.sops.secrets."dtth-wg/preshared-key".path;
|
||||
AllowedIPs = [
|
||||
"100.64.0.0/10"
|
||||
"fd00::/106"
|
||||
];
|
||||
Endpoint = "vpn.dtth.ch:51820";
|
||||
PersistentKeepalive = 25;
|
||||
}
|
||||
];
|
||||
};
|
||||
systemd.network.networks."dtth-wg" = {
|
||||
matchConfig.Name = "dtth-wg";
|
||||
address = [
|
||||
"100.73.146.80/32"
|
||||
"fd00::33:105b/128"
|
||||
];
|
||||
DHCP = "no";
|
||||
routes = [
|
||||
{
|
||||
Destination = "100.64.0.0/10";
|
||||
Scope = "link";
|
||||
}
|
||||
{ Destination = "fd00::/106"; }
|
||||
];
|
||||
};
|
||||
|
||||
# Define a user account.
|
||||
common.linux.username = "nki";
|
||||
services.getty.autologinUser = "nki";
|
||||
|
||||
## Hardware
|
||||
# Peripherals
|
||||
hardware.opentabletdriver.enable = true;
|
||||
# Enable razer daemon
|
||||
hardware.openrazer.enable = true;
|
||||
hardware.openrazer.keyStatistics = true;
|
||||
hardware.openrazer.verboseLogging = true;
|
||||
|
||||
# Mounting disks!
|
||||
fileSystems =
|
||||
let
|
||||
ntfsMount = path: {
|
||||
device = path;
|
||||
fsType = "ntfs";
|
||||
options = [
|
||||
"rw"
|
||||
"uid=${toString config.users.users.nki.uid}"
|
||||
"nofail"
|
||||
];
|
||||
};
|
||||
in
|
||||
{
|
||||
"/mnt/Data" = ntfsMount "/dev/disk/by-uuid/A90680F8BBE62FE3";
|
||||
"/mnt/Stuff" = ntfsMount "/dev/disk/by-uuid/717BF2EE20BB8A62";
|
||||
"/mnt/Shared" = ntfsMount "/dev/disk/by-uuid/76AC086BAC0827E7";
|
||||
"/mnt/osu" = ntfsMount "/dev/disk/by-uuid/530D3E1648CD1C26";
|
||||
};
|
||||
|
||||
# Kernel
|
||||
boot.kernelPackages = pkgs.linuxKernel.packages.linux_xanmod_stable;
|
||||
# PAM
|
||||
personal.u2f.enable = true;
|
||||
|
||||
# Plasma!
|
||||
services.desktopManager.plasma6.enable = true;
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "22.11"; # Did you read the comment?
|
||||
|
||||
## Encryption
|
||||
# Kernel modules needed for mounting USB VFAT devices in initrd stage
|
||||
common.linux.luksDevices.root = "/dev/disk/by-uuid/7c6e40a8-900b-4f85-9712-2b872caf1892";
|
||||
common.linux.sops.enable = true;
|
||||
common.linux.sops.file = ./secrets.yaml;
|
||||
# tinc network
|
||||
sops.secrets."tinc/ed25519-private-key" = { };
|
||||
sops.secrets."tinc/rsa-private-key" = { };
|
||||
services.my-tinc = {
|
||||
enable = true;
|
||||
hostName = "home";
|
||||
rsaPrivateKey = config.sops.secrets."tinc/rsa-private-key".path;
|
||||
ed25519PrivateKey = config.sops.secrets."tinc/ed25519-private-key".path;
|
||||
bindPort = 6565;
|
||||
};
|
||||
|
||||
# Nix cache server
|
||||
sops.secrets."nix-cache/private-key" = {
|
||||
owner = "harmonia";
|
||||
group = "harmonia";
|
||||
mode = "0600";
|
||||
};
|
||||
nki.services.nix-cache = {
|
||||
enableServer = true;
|
||||
privateKeyFile = config.sops.secrets."nix-cache/private-key".path;
|
||||
};
|
||||
|
||||
sops.secrets."nix-build-farm/private-key" = {
|
||||
mode = "0400";
|
||||
};
|
||||
services.nix-build-farm.hostname = "home";
|
||||
services.nix-build-farm.privateKeyFile = config.sops.secrets."nix-build-farm/private-key".path;
|
||||
|
||||
# Networking
|
||||
common.linux.networking = {
|
||||
hostname = "kagamiPC"; # Define your hostname.
|
||||
networks = {
|
||||
"10-wired" = {
|
||||
match = "enp*";
|
||||
isRequired = true;
|
||||
};
|
||||
"20-wireless".match = "wlan*";
|
||||
};
|
||||
dnsServers = [ "127.0.0.1" ];
|
||||
};
|
||||
nki.services.edns.enable = true;
|
||||
nki.services.edns.ipv6 = true;
|
||||
## DTTH Wireguard
|
||||
#
|
||||
sops.secrets."wg-dtth/private-key" = {
|
||||
owner = "root";
|
||||
group = "systemd-network";
|
||||
mode = "0640";
|
||||
};
|
||||
sops.secrets."wg-dtth/preshared-key" = {
|
||||
owner = "root";
|
||||
group = "systemd-network";
|
||||
mode = "0640";
|
||||
};
|
||||
systemd.network.netdevs."10-wg-dtth" = {
|
||||
netdevConfig = {
|
||||
Kind = "wireguard";
|
||||
Name = "wg-dtth";
|
||||
MTUBytes = "1280";
|
||||
};
|
||||
wireguardConfig = {
|
||||
PrivateKeyFile = config.sops.secrets."wg-dtth/private-key".path;
|
||||
};
|
||||
wireguardPeers = [
|
||||
{
|
||||
PublicKey = "+7iI4jwmM1Qr+/DKB1Hv8JgFkGu7lSV0PAoo+O5d3yQ=";
|
||||
PresharedKeyFile = config.sops.secrets."wg-dtth/preshared-key".path;
|
||||
AllowedIPs = [
|
||||
"100.64.0.0/10"
|
||||
"fd00::/106"
|
||||
];
|
||||
Endpoint = "vpn.dtth.ch:51820";
|
||||
PersistentKeepalive = 25;
|
||||
}
|
||||
];
|
||||
};
|
||||
systemd.network.networks."wg-dtth" = {
|
||||
matchConfig.Name = "wg-dtth";
|
||||
address = [
|
||||
"100.73.146.80/32"
|
||||
"fd00::33:105b/128"
|
||||
];
|
||||
DHCP = "no";
|
||||
routes = [
|
||||
{
|
||||
Destination = "100.64.0.0/10";
|
||||
Scope = "link";
|
||||
}
|
||||
{ Destination = "fd00::/106"; }
|
||||
];
|
||||
};
|
||||
|
||||
# Define a user account.
|
||||
common.linux.username = "nki";
|
||||
services.getty.autologinUser = "nki";
|
||||
|
||||
## Hardware
|
||||
# Peripherals
|
||||
hardware.opentabletdriver.enable = true;
|
||||
# Enable razer daemon
|
||||
hardware.openrazer.enable = true;
|
||||
hardware.openrazer.keyStatistics = true;
|
||||
hardware.openrazer.verboseLogging = true;
|
||||
|
||||
# Mounting disks!
|
||||
fileSystems =
|
||||
let
|
||||
ntfsMount = path: {
|
||||
device = path;
|
||||
fsType = "ntfs";
|
||||
options = [
|
||||
"rw"
|
||||
"uid=${toString config.users.users.nki.uid}"
|
||||
"nofail"
|
||||
];
|
||||
};
|
||||
in
|
||||
{
|
||||
"/mnt/Data" = ntfsMount "/dev/disk/by-uuid/A90680F8BBE62FE3";
|
||||
"/mnt/Stuff" = ntfsMount "/dev/disk/by-uuid/717BF2EE20BB8A62";
|
||||
"/mnt/Shared" = ntfsMount "/dev/disk/by-uuid/76AC086BAC0827E7";
|
||||
"/mnt/osu" = ntfsMount "/dev/disk/by-uuid/530D3E1648CD1C26";
|
||||
};
|
||||
|
||||
# PAM
|
||||
personal.u2f.enable = true;
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "22.11"; # Did you read the comment?
|
||||
|
||||
# tinc network
|
||||
sops.secrets."tinc/ed25519-private-key" = { };
|
||||
sops.secrets."tinc/rsa-private-key" = { };
|
||||
services.my-tinc = {
|
||||
enable = true;
|
||||
hostName = "home";
|
||||
rsaPrivateKey = config.sops.secrets."tinc/rsa-private-key".path;
|
||||
ed25519PrivateKey = config.sops.secrets."tinc/ed25519-private-key".path;
|
||||
bindPort = 6565;
|
||||
};
|
||||
|
||||
# Music server
|
||||
services.navidrome.enable = true;
|
||||
services.navidrome.settings = {
|
||||
Address = "11.0.0.2";
|
||||
MusicFolder = "/mnt/Stuff/Music";
|
||||
};
|
||||
systemd.services.navidrome.serviceConfig.BindReadOnlyPaths = lib.mkAfter [ "/etc" ];
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
4533
|
||||
8000
|
||||
];
|
||||
|
||||
# Printers
|
||||
services.printing.enable = true;
|
||||
|
||||
# mpd
|
||||
services.mpd = {
|
||||
enable = true;
|
||||
user = "nki";
|
||||
startWhenNeeded = true;
|
||||
extraConfig = ''
|
||||
audio_output {
|
||||
type "pipewire"
|
||||
name "pipewire local"
|
||||
dsd "yes"
|
||||
}
|
||||
'';
|
||||
};
|
||||
systemd.services.mpd.environment = {
|
||||
# https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/609
|
||||
XDG_RUNTIME_DIR = "/run/user/1000"; # User-id 1000 must match above user. MPD will look inside this directory for the PipeWire socket.
|
||||
};
|
||||
sops.secrets."scrobble/lastfm" = { };
|
||||
sops.secrets."scrobble/listenbrainz" = { };
|
||||
services.mpdscribble = {
|
||||
enable = true;
|
||||
endpoints."last.fm" = {
|
||||
username = "natsukagami";
|
||||
passwordFile = config.sops.secrets."scrobble/lastfm".path;
|
||||
};
|
||||
endpoints."listenbrainz" = {
|
||||
username = "natsukagami";
|
||||
passwordFile = config.sops.secrets."scrobble/listenbrainz".path;
|
||||
};
|
||||
};
|
||||
|
||||
programs.virt-manager.enable = true;
|
||||
|
||||
users.groups.libvirtd.members = [ "nki" ];
|
||||
|
||||
virtualisation.libvirtd.enable = true;
|
||||
|
||||
virtualisation.spiceUSBRedirection.enable = true;
|
||||
}
|
||||
{
|
||||
# LLM poop
|
||||
services.ollama = {
|
||||
enable = true;
|
||||
loadModels = [
|
||||
"deepseek-r1:14b"
|
||||
"gemma3:12b"
|
||||
];
|
||||
acceleration = "rocm";
|
||||
rocmOverrideGfx = "10.3.1";
|
||||
};
|
||||
systemd.services.ollama = {
|
||||
serviceConfig.LimitMEMLOCK = "${toString (16 * 1024 * 1024 * 1024)}";
|
||||
};
|
||||
services.open-webui = {
|
||||
enable = true;
|
||||
port = 5689;
|
||||
openFirewall = true;
|
||||
host = "0.0.0.0";
|
||||
environment = {
|
||||
ANONYMIZED_TELEMETRY = "False";
|
||||
DO_NOT_TRACK = "True";
|
||||
SCARF_NO_ANALYTICS = "True";
|
||||
ENV = "prod";
|
||||
ENABLE_SIGNUP = "false";
|
||||
};
|
||||
};
|
||||
common.linux.tailscale.firewall.allowPorts = [ config.services.open-webui.port ];
|
||||
}
|
||||
# Music server
|
||||
services.navidrome.enable = true;
|
||||
services.navidrome.settings = {
|
||||
Address = "11.0.0.2";
|
||||
MusicFolder = "/mnt/Stuff/Music";
|
||||
};
|
||||
systemd.services.navidrome.serviceConfig.BindReadOnlyPaths = lib.mkAfter [ "/etc" ];
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
4533
|
||||
8000
|
||||
];
|
||||
|
||||
# Printers
|
||||
services.printing.enable = true;
|
||||
|
||||
# mpd
|
||||
services.mpd = {
|
||||
enable = true;
|
||||
user = "nki";
|
||||
startWhenNeeded = true;
|
||||
extraConfig = ''
|
||||
audio_output {
|
||||
type "pipewire"
|
||||
name "pipewire local"
|
||||
dsd "yes"
|
||||
}
|
||||
'';
|
||||
};
|
||||
systemd.services.mpd.environment = {
|
||||
# https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/609
|
||||
XDG_RUNTIME_DIR = "/run/user/1000"; # User-id 1000 must match above user. MPD will look inside this directory for the PipeWire socket.
|
||||
};
|
||||
sops.secrets."scrobble/lastfm" = { };
|
||||
sops.secrets."scrobble/listenbrainz" = { };
|
||||
services.mpdscribble = {
|
||||
enable = true;
|
||||
endpoints."last.fm" = {
|
||||
username = "natsukagami";
|
||||
passwordFile = config.sops.secrets."scrobble/lastfm".path;
|
||||
};
|
||||
endpoints."listenbrainz" = {
|
||||
username = "natsukagami";
|
||||
passwordFile = config.sops.secrets."scrobble/listenbrainz".path;
|
||||
};
|
||||
};
|
||||
|
||||
programs.virt-manager.enable = true;
|
||||
|
||||
users.groups.libvirtd.members = [ "nki" ];
|
||||
|
||||
virtualisation.libvirtd.enable = true;
|
||||
|
||||
virtualisation.spiceUSBRedirection.enable = true;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,96 +0,0 @@
|
|||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
wg = "wgdeluge";
|
||||
webui-port = "58846";
|
||||
in
|
||||
{
|
||||
services.deluge = {
|
||||
enable = true;
|
||||
web.enable = true;
|
||||
};
|
||||
|
||||
sops.secrets."wg-deluge.conf" = {
|
||||
owner = "root";
|
||||
mode = "0400";
|
||||
reloadUnits = [ "${wg}.service" ];
|
||||
};
|
||||
# setting up wireguard interface within network namespace
|
||||
systemd.services.${wg} =
|
||||
let
|
||||
ip = lib.getExe' pkgs.iproute2 "ip";
|
||||
wireguard = lib.getExe pkgs.wireguard-tools;
|
||||
in
|
||||
{
|
||||
description = "WireGuard network interface for Deluge";
|
||||
bindsTo = [ "netns@${wg}.service" ];
|
||||
requires = [ "network-online.target" ];
|
||||
after = [ "netns@${wg}.service" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
ExecStart = pkgs.writers.writeBash "wg-up" ''
|
||||
set -e
|
||||
${ip} link add ${wg} type wireguard
|
||||
${ip} link set ${wg} netns ${wg}
|
||||
${ip} -n ${wg} address add "100.123.50.189/32" dev ${wg}
|
||||
${ip} netns exec ${wg} \
|
||||
${wireguard} setconf ${wg} ${config.sops.secrets."wg-deluge.conf".path}
|
||||
${ip} -n ${wg} link set ${wg} up
|
||||
# need to set lo up as network namespace is started with lo down
|
||||
${ip} -n ${wg} link set lo up
|
||||
${ip} -n ${wg} route add default dev ${wg}
|
||||
# ${ip} -n ${wg} -6 route add default dev ${wg}
|
||||
'';
|
||||
ExecStop = pkgs.writers.writeBash "wg-down" ''
|
||||
${ip} -n ${wg} route del default dev ${wg}
|
||||
# ${ip} -n ${wg} -6 route del default dev ${wg}
|
||||
${ip} -n ${wg} link del ${wg}
|
||||
${ip} link del ${wg}
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
# binding deluged to network namespace
|
||||
systemd.services.deluged.bindsTo = [ "netns@${wg}.service" ];
|
||||
systemd.services.deluged.requires = [
|
||||
"network-online.target"
|
||||
"${wg}.service"
|
||||
];
|
||||
systemd.services.deluged.serviceConfig.NetworkNamespacePath = [ "/var/run/netns/${wg}" ];
|
||||
|
||||
# allowing delugeweb to access deluged in network namespace, a socket is necesarry
|
||||
systemd.sockets."proxy-to-deluged" = {
|
||||
enable = true;
|
||||
description = "Socket for Proxy to Deluge Daemon";
|
||||
listenStreams = [ "${webui-port}" ];
|
||||
wantedBy = [ "sockets.target" ];
|
||||
};
|
||||
|
||||
# creating proxy service on socket, which forwards the same port from the root namespace to the isolated namespace
|
||||
systemd.services."proxy-to-deluged" = {
|
||||
enable = true;
|
||||
description = "Proxy to Deluge Daemon in Network Namespace";
|
||||
requires = [
|
||||
"deluged.service"
|
||||
"proxy-to-deluged.socket"
|
||||
];
|
||||
after = [
|
||||
"deluged.service"
|
||||
"proxy-to-deluged.socket"
|
||||
];
|
||||
unitConfig = {
|
||||
JoinsNamespaceOf = "deluged.service";
|
||||
};
|
||||
serviceConfig = {
|
||||
User = "deluge";
|
||||
Group = "deluge";
|
||||
ExecStart = "${pkgs.systemd}/lib/systemd/systemd-socket-proxyd --exit-idle-time=5min 127.0.0.1:${webui-port}";
|
||||
PrivateNetwork = "yes";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -8,17 +8,20 @@ windscribe:
|
|||
scrobble:
|
||||
lastfm: ENC[AES256_GCM,data:+3G9zwmAu/B9omG0KUT0b5G+lJ4=,iv:ubrE4A35si9f6+m2sAino4SfOf9F4g2UjtF2Yy9n2e4=,tag:A/e6GECfIZuX2bVGPo9qyA==,type:str]
|
||||
listenbrainz: ENC[AES256_GCM,data:FNSJnYEQd+LgInmdyqcaAQG6imiJS/OPBEe2fBKQGKBjpCLy,iv:qhloVpcwcGwRDn6vOujgmvelbPl2korhELfyf5BvdjM=,tag:WnLaMUtHsxBaXNTAKwchkQ==,type:str]
|
||||
wg-dtth:
|
||||
private-key: ENC[AES256_GCM,data:a//pmovhmjh73YBHmae/91oVtWFmbiuh87gz6busqi7XcEZEn3KiYszuiMI=,iv:hLw5nqJDGDdiT9CfwDShXGRP6qoTWvfReq7qPs9x0n4=,tag:+b3cMjuVJTsz73wnlPW02Q==,type:str]
|
||||
preshared-key: ENC[AES256_GCM,data:go9dm+FTEq7k0ec936ay1loTJZV8espqTFpGzqAQa9TzMnB1AD/JJHLMENQ=,iv:LjXD3ySLJVkerQH5J7ylSGATykTT6jEObuJc4vUnh28=,tag:qYO5r72tjothlT16Y8Ms0Q==,type:str]
|
||||
dtth-wg:
|
||||
private-key: ENC[AES256_GCM,data:ySxPGzOplKwNLxRnPNw7If7xzxMwRkwTasT7FaQE9n5YB04R+gaQVjDqPqg=,iv:f5t94bUoo9sCGGwWytiuhg5jcKjzRjbR3Q0OIM28VDU=,tag:fJos9Hb9XytQbfGaPMa1/A==,type:str]
|
||||
preshared-key: ENC[AES256_GCM,data:96q0ZfvPz4pb53XvTGameVkcETamYH8Xbv69672RBdacH6QjRCCVvPnBTfA=,iv:Q2Yonb07/Uu6KidhMgRX4zJuNU1ZySNC7g/5TwpMU80=,tag:1qQQdk20yIQlGZmX+/25RA==,type:str]
|
||||
peertube:
|
||||
dtth-key: ENC[AES256_GCM,data:Gu7qOisVBZrFXKBr51165FJ7Ej4hV+lIf3AMC02R3UFNXOnTHF2xC8E=,iv:F83FuD1VjZEJFMcx3gkQuKCpJmYdHtO15fRHkYdMxJM=,tag:ScH42Tr5ZsIo9JMnXhylSw==,type:str]
|
||||
nix-cache:
|
||||
private-key: ENC[AES256_GCM,data:4sbfIQb10Y50CrZbgjN+1iXEbXTpDqMbIB/yA3WlaAqhLtb8HKib5aZX3DLoxFbVihJcztQsvBBgEAhT9iMijoksaT9qzBQ5yIn4NGCfFem1DK8DQdjhTLMCVTyMFCT7hQHu/2Sd7w==,iv:zTSxuKOtOLekOBKBvl9MScD/Bo1Hviqq/n8Saa+1Cgo=,tag:fx73fCDPY9d07V3KKMw3DA==,type:str]
|
||||
nix-build-farm:
|
||||
private-key: ENC[AES256_GCM,data:m5neeWCEdaZ1MRhNwTptfDIgv3ABNlYyNil3oTD81Jbe/6WxWaS5Q++CRlHCjc2hOoHsWsZixw8iGZVTA+QXgH6B9C6A4oOAhgR9m92EGTEfFw0qxQbdzs7U98Yonx/N8SApUycZZB/EU81+MrDNY4GGzCiO6s00/vZLkDTYnqRFgbo+8KTG0BQTl4q+VYP2q3l0wy+Ivz5CWPmbz42Xdin/sBnjeFHKDuof4iZZnN3i8gUJ/mMw3lbdiHd6A8DL0G5Ut46ljzMC2aMsZOATCID3mPOPgI0xIetDofPJLDqVsNqptRHo8WB+KwDidvl222f5F7JqdSqgAMOJYPscrX0odufApiJfg5bbXBygvrDfAlPSruW7GsWGoKAhw0qC4NC/j+qYCwhS0qdorCLnIy3zzMtA6HkHtE675hy7/7oLj7k9Y8MhE4PxztjXTmDazaVCtKhnA/DpaxP2mH84gfCkJFD1YF9jtPm+P3e+46FwkW+WnHaA2L+H7Evava30DLEBhh5y9Gd1A3JN4isn,iv:7KUWg7+GWgmGJkbIvsy9gtccZBb+1Y5uDWhXQFk0obk=,tag:qJdM684XPHxecLVxVb5pgw==,type:str]
|
||||
wg-deluge.conf: ENC[AES256_GCM,data:CjCqgC1458C6odMtcWigE9tZwci4bJYyk+2fVTpP2OnHYwAp38bt0TbBLwgytMqKfB5EpJZLdbeTSoL33MhT2MD4gWBuDH1++p59l9213LS+9mF6gxG/RksrnnLvz9Pnk5J19qOz1PDxm6t8ZF2qu5qAHY83CF+k32G04/p2Nl04bDllAmMUlGGHJ5TXvXCSRcNU/2tWYv/sC4SwfUfpMjRbSKJUQSTEXnQsPaKsf+fq3mhj1a/xT6zJ6sxwDAGQ3PwIY8xTDf5ucS9ULPO9Zn27NUBoFmS1g0fJd+ZCJJYIWkG2uYDf+ldu/Ag95BduHX7Juf3GolhVd24hZzaIq3LeME99+T3SYA4LBkAaASnBvrVOXmFavHPKhFfbZ1DG0mO7S2M+Ticz+dUktjTXCh/Fe4uwf2R82PieuPhNng==,iv:AKleoSHG6qKEMJ7vIFsQ+X7d/jaXt+d0kg3LnbeWrRc=,tag:zrtqRIxEBbpSh9Ryj8cwqw==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
azure_kv: []
|
||||
hc_vault: []
|
||||
age:
|
||||
- recipient: age1tt0peqg8zdfh74m5sdgwsczcqh036nhgmwvkqnvywll88uvmm9xs433rhm
|
||||
enc: |
|
||||
|
|
@ -47,7 +50,8 @@ sops:
|
|||
bUhIT0Z2b1dVWGNyS1hRVFRyZTA4d00KchP7EhSOMwBl5vFuuskzosRoi8jUu1sw
|
||||
hVjJNF2a40ewgkQgVAoWEzirHbknbQORzmepDDRth7Bve3UQU64+GA==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2025-04-08T23:20:49Z"
|
||||
mac: ENC[AES256_GCM,data:4RANoPaf4TCLkkTkY/UyOCLWKVL6o5N+bSXbNCoQLoI5hI5oW6zgPnvEKtERhJiKNttEoPStb68dt8/DRZ6enpi6h/DP+kNm7wCCT0atMnfKUXz1Hco6ixub9cyT1wpRxjU0O5EPmYSDRYTayOBOqvXzns+OpVFGMcskUAeroL8=,iv:JHMW8tsydX2k39SPqbFfyash4k8juTCi8DtufA8lL/s=,tag:lTQc62Y4nDEErT/TbL+Hbg==,type:str]
|
||||
lastmodified: "2024-08-16T13:59:20Z"
|
||||
mac: ENC[AES256_GCM,data:ncT8fbtEb9ZcLcftXwgAKJRPPSG4TRHFMArtVgWNmIjDRcCNNT7ICa+9Dl8DAYKRJ+8pgelV9StIg2f7rvypHYlckontEP5nwSFzEApLItG3AZXewTC8VPoDYb4T8/OWKDoa5kBMvGrDr1bFP/CZz7H8No+k5TV7fVExsw0PHpg=,iv:vxbkeJtHkOAq7NcaZEIOMV3qGEqBUg/vpJYumBBfY70=,tag:T0yw2x1O5Tp0UllLpcFryg==,type:str]
|
||||
pgp: []
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.10.1
|
||||
version: 3.9.0
|
||||
|
|
|
|||
|
|
@ -89,7 +89,7 @@ rec {
|
|||
environment.etc."headscale/config.yaml".mode = "0644";
|
||||
virtualisation.arion.projects.headscale-webui.settings = {
|
||||
services.webui.service = {
|
||||
image = "ghcr.io/ifargle/headscale-webui@sha256:f047209ddf2f71587d8a0f749b0cb92f22a3105dda624724a053c2a7aa23a210";
|
||||
image = "ghcr.io/ifargle/headscale-webui@sha256:b4f02337281853648b071301af4329b4e4fc9189d77ced2eb2fbb78204321cab";
|
||||
restart = "unless-stopped";
|
||||
|
||||
environment = {
|
||||
|
|
|
|||
|
|
@ -131,7 +131,7 @@ let
|
|||
kak-lsp = final.unstable.rustPlatform.buildRustPackage {
|
||||
name = "kak-lsp";
|
||||
src = inputs.kak-lsp;
|
||||
cargoLock.lockFile = "${inputs.kak-lsp}/Cargo.lock";
|
||||
cargoHash = "sha256-8Y+haxC7ssN07ODZcKoDdTv0vEnKqxYseLPoQSNmWI4=";
|
||||
buildInputs = [ final.libiconv ];
|
||||
|
||||
meta.mainProgram = "kak-lsp";
|
||||
|
|
|
|||
|
|
@ -20,8 +20,7 @@ let
|
|||
inherit src;
|
||||
pname = "kak-tree-sitter";
|
||||
version = "1.1.3";
|
||||
cargoLock.lockFile = "${src}/Cargo.lock";
|
||||
|
||||
cargoHash = "sha256-1OwPfl1446SYt1556jwR9mvWOWEv+ab+wH7GZQeS4/E=";
|
||||
cargoBuildOptions = [
|
||||
"--package"
|
||||
"kak-tree-sitter"
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue