Rewrite modules to options.

This commit is contained in:
Dmitry Voronin 2024-06-25 04:04:39 +03:00 committed by Dmitry Voronin
parent fa4b3c31b7
commit 8c7578075f
Signed by: voronind
SSH key fingerprint: SHA256:3kBb4iV2ahufEBNq+vFbUe4QYfHt98DHQjN7QaptY9k
158 changed files with 3802 additions and 3011 deletions

View file

@ -20,7 +20,7 @@
<a href="https://i.imgur.com/H943DFl.jpeg">Wallpaper link</a> <a href="https://i.imgur.com/H943DFl.jpeg">Wallpaper link</a>
</details> </details>
[My current wallpaper](https://git.voronind.com/voronind/nixos/src/branch/main/part/Wallpaper.nix#L2) [My current wallpaper](https://git.voronind.com/voronind/nixos/src/branch/main/module/common/Wallpaper.nix#L2)
Color theming based on wallpaper thanks to [Stylix](https://github.com/danth/stylix). Color theming based on wallpaper thanks to [Stylix](https://github.com/danth/stylix).

View file

@ -1,11 +1,11 @@
{ pkgs, style, util, ... }: { { pkgs, config, util, ... }: {
font = pkgs.runCommandNoCC "font" {} '' font = pkgs.runCommandNoCC "font" {} ''
cp ${pkgs.nerdfonts.override { fonts = [ "Terminus" ]; }}/share/fonts/truetype/NerdFonts/TerminessNerdFontMono-Regular.ttf $out cp ${pkgs.nerdfonts.override { fonts = [ "Terminus" ]; }}/share/fonts/truetype/NerdFonts/TerminessNerdFontMono-Regular.ttf $out
''; '';
colors = util.trimTabs '' colors = util.trimTabs ''
background=#${style.color.bg.dark} background=#${config.module.style.color.bg.dark}
foreground=#${style.color.fg.light} foreground=#${config.module.style.color.fg.light}
''; '';
initScript = util.trimTabs '' initScript = util.trimTabs ''

View file

@ -1,6 +1,29 @@
{ container, ... } @args: let { container, lib, config, ... } @args: with lib; let
cfg = container.config.change; cfg = config.container.module.change;
in { in {
options = {
container.module.change = {
enable = mkEnableOption "Change detection service";
address = mkOption {
default = "10.1.0.41";
type = types.str;
};
port = mkOption {
default = 5000;
type = types.int;
};
domain = mkOption {
default = "change.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/change";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [ systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data" "data"
]; ];
@ -22,4 +45,5 @@ in {
}; };
}; };
}; };
};
} }

View file

@ -1,6 +1,32 @@
{ container, pkgs, ... } @args: let { container, pkgs, lib, config, ... } @args: with lib; let
cfg = container.config.cloud; cfg = config.container.module.cloud;
postgres = config.container.module.postgres;
proxy = config.container.module.proxy;
in { in {
options = {
container.module.cloud = {
enable = mkEnableOption "File cloud service";
address = mkOption {
default = "10.1.0.13";
type = types.str;
};
port = mkOption {
default = 80;
type = types.int;
};
domain = mkOption {
default = "cloud.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/cloud";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [ systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data" "data"
]; ];
@ -26,7 +52,7 @@ in {
adminuser = "root"; adminuser = "root";
adminpassFile = "${pkgs.writeText "NextcloudPassword" "root"}"; adminpassFile = "${pkgs.writeText "NextcloudPassword" "root"}";
dbhost = container.config.postgres.address; dbhost = postgres.address;
dbname = "nextcloud"; dbname = "nextcloud";
dbpassFile = "${pkgs.writeText "NextcloudDbPassword" "nextcloud"}"; dbpassFile = "${pkgs.writeText "NextcloudDbPassword" "nextcloud"}";
dbtype = "pgsql"; dbtype = "pgsql";
@ -38,10 +64,11 @@ in {
extraAppsEnable = true; extraAppsEnable = true;
settings = { settings = {
trusted_domains = [ cfg.address cfg.domain ]; trusted_domains = [ cfg.address cfg.domain ];
trusted_proxies = [ container.config.proxy.address ]; trusted_proxies = [ proxy.address ];
allow_local_remote_servers = true; allow_local_remote_servers = true;
}; };
}; };
}; };
}; };
};
} }

View file

@ -1,6 +1,21 @@
{ container, domain, ... } @args: let { container, lib, config, ... } @args: with lib; let
cfg = container.config.ddns; cfg = config.container.module.ddns;
in { in {
options = {
container.module.ddns = {
enable = mkEnableOption "Dynamic dns client.";
address = mkOption {
default = "10.1.0.31";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/ddns";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [ systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data" "data"
]; ];
@ -21,7 +36,9 @@ in {
ipv4 = true; ipv4 = true;
ipv6 = false; ipv6 = false;
proxied = false; proxied = false;
domains = [ domain ] ++ map (sub: "${sub}.${domain}") [ domains = let
domain = config.container.domain;
in [ domain ] ++ map (sub: "${sub}.${domain}") [
"cloud" "cloud"
"git" "git"
"mail" "mail"
@ -33,4 +50,5 @@ in {
}; };
}; };
}; };
};
} }

View file

@ -1,20 +1,35 @@
{ container, pkgs, ... } @args: let { container, pkgs, lib, config, ... } @args: with lib; let
cfg = container.config.dns; cfg = config.container.module.dns;
in { in {
options = {
container.module.dns = {
enable = mkEnableOption "Dns server.";
address = mkOption {
default = "10.1.0.6";
type = types.str;
};
port = mkOption {
default = 53;
type = types.int;
};
};
};
config = mkIf cfg.enable {
containers.dns = container.mkContainer cfg { containers.dns = container.mkContainer cfg {
forwardPorts = [ forwardPorts = [
{ {
containerPort = 53; containerPort = cfg.port;
hostPort = 53; hostPort = cfg.port;
protocol = "udp"; protocol = "udp";
} { } {
containerPort = 53; containerPort = cfg.port;
hostPort = 53; hostPort = cfg.port;
protocol = "tcp"; protocol = "tcp";
} }
]; ];
config = { lib, ... }: container.mkContainerConfig cfg { config = { ... }: container.mkContainerConfig cfg {
environment.systemPackages = [ environment.systemPackages = [
pkgs.cloudflared pkgs.cloudflared
]; ];
@ -25,7 +40,7 @@ in {
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
serviceConfig = { serviceConfig = {
Type = "simple"; Type = "simple";
ExecStart = "${lib.getExe pkgs.cloudflared} proxy-dns --port 5054"; ExecStart = "${getExe pkgs.cloudflared} proxy-dns --port 5054";
}; };
}; };
@ -102,11 +117,13 @@ in {
}; };
customDNS = { customDNS = {
mapping = { mapping = {
"voronind.com" = "192.168.1.2"; # All subdomains to current host.
${config.container.domain} = config.container.host;
}; };
}; };
port = "53"; port = cfg.port;
httpPort = "80"; # httpPort = "80";
};
}; };
}; };
}; };

View file

@ -1,7 +1,33 @@
{ container, lib, ... } @args: let { container, lib, config, ... }: with lib; let
cfg = container.config.download; cfg = config.container.module.download;
memLimit = "4G";
in { in {
options = {
container.module.download = {
enable = mkEnableOption "Downloader.";
address = mkOption {
default = "10.1.0.12";
type = types.str;
};
port = mkOption {
default = 8112;
type = types.int;
};
domain = mkOption {
default = "download.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/download";
type = types.str;
};
memLimit = mkOption {
default = "4G";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [ systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data" "data"
]; ];
@ -14,7 +40,7 @@ in {
hostPath = "${cfg.storage}/data"; hostPath = "${cfg.storage}/data";
isReadOnly = false; isReadOnly = false;
}; };
} // container.attachMedia "download" cfg.download false; } // container.attachMedia "download" false;
config = { ... }: container.mkContainerConfig cfg { config = { ... }: container.mkContainerConfig cfg {
services.deluge = { services.deluge = {
@ -23,7 +49,8 @@ in {
web.enable = true; web.enable = true;
}; };
systemd.services.deluged.serviceConfig.MemoryLimit = memLimit; systemd.services.deluged.serviceConfig.MemoryLimit = cfg.memLimit;
};
}; };
}; };
} }

View file

@ -1,6 +1,29 @@
{ container, pkgs, ... } @args: let { container, pkgs, config, lib, ... }: with lib; let
cfg = container.config.git; cfg = config.container.module.git;
in { in {
options = {
container.module.git = {
enable = mkEnableOption "Git server.";
address = mkOption {
default = "10.1.0.8";
type = types.str;
};
port = mkOption {
default = 3000;
type = types.int;
};
domain = mkOption {
default = "git.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/git";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [ systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data" "data"
]; ];
@ -21,7 +44,7 @@ in {
stateDir = "/var/lib/gitea"; stateDir = "/var/lib/gitea";
database = let database = let
postgre = container.config.postgres; postgre = config.container.module.postgres;
in { in {
type = "postgres"; type = "postgres";
host = postgre.address; host = postgre.address;
@ -72,4 +95,5 @@ in {
}; };
}; };
}; };
};
} }

View file

@ -1,7 +1,30 @@
# ISSUE: Broken, can't read/write sda device. # ISSUE: Broken, can't read/write sda device.
{ container, pkgs, ... } @args: let { container, pkgs, config, lib, ... }: with lib; let
cfg = container.config.hdd; cfg = config.container.module.hdd;
in { in {
options = {
container.module.hdd = {
enable = mkEnableOption "Hdd health monitor.";
address = mkOption {
default = "10.1.0.10";
type = types.str;
};
port = mkOption {
default = 8080;
type = types.int;
};
domain = mkOption {
default = "hdd.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/hdd";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [ systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data" "data"
]; ];
@ -43,4 +66,5 @@ in {
}; };
}; };
}; };
};
} }

View file

@ -1,7 +1,26 @@
{ container, pkgs, util, ... } @args: let { container, pkgs, util, lib, config, ... } @args: with lib; let
cfg = container.config.home; cfg = config.container.module.home;
package = (pkgs.callPackage ./homer args); package = (pkgs.callPackage ./homer args);
in { in {
options = {
container.module.home = {
enable = mkEnableOption "Dashboard.";
address = mkOption {
default = "10.1.0.18";
type = types.str;
};
port = mkOption {
default = 80;
type = types.int;
};
domain = mkOption {
default = "home.${config.container.domain}";
type = types.str;
};
};
};
config = mkIf cfg.enable {
containers.home = container.mkContainer cfg { containers.home = container.mkContainer cfg {
config = { ... }: container.mkContainerConfig cfg { config = { ... }: container.mkContainerConfig cfg {
environment.systemPackages = [ package ]; environment.systemPackages = [ package ];
@ -22,4 +41,5 @@ in {
}; };
}; };
}; };
};
} }

View file

@ -1,6 +1,29 @@
{ container, ... } @args: let { container, lib, config, ... }: with lib; let
cfg = container.config.iot; cfg = config.container.module.iot;
in { in {
options = {
container.module.iot = {
enable = mkEnableOption "IoT service.";
address = mkOption {
default = "10.1.0.27";
type = types.str;
};
port = mkOption {
default = 8123;
type = types.int;
};
domain = mkOption {
default = "iot.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/iot";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [ systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data" "data"
]; ];
@ -19,7 +42,7 @@ in {
hostPath = "/dev/serial/by-id"; hostPath = "/dev/serial/by-id";
isReadOnly = false; isReadOnly = false;
}; };
} // container.attachMedia "photo" cfg.photo true; } // container.attachMedia "photo" true;
allowedDevices = [ allowedDevices = [
{ {
@ -67,4 +90,5 @@ in {
}; };
}; };
}; };
};
} }

View file

@ -1,7 +1,22 @@
{ container, pkgsJobber, poetry2nixJobber, lib, ... } @args: let { container, pkgsJobber, poetry2nixJobber, lib, config, ... }: with lib; let
cfg = container.config.jobber; cfg = config.container.module.jobber;
script = import ./jobber { poetry2nix = poetry2nixJobber; pkgs = pkgsJobber; }; script = import ./jobber { poetry2nix = poetry2nixJobber; pkgs = pkgsJobber; };
in { in {
options = {
container.module.jobber = {
enable = mkEnableOption "Button pusher Stanley.";
address = mkOption {
default = "10.1.0.32";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/jobber";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [ systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data" "data"
]; ];
@ -47,4 +62,5 @@ in {
}; };
}; };
}; };
};
} }

View file

@ -1,6 +1,31 @@
# Guide: https://nixos-mailserver.readthedocs.io/en/latest/setup-guide.html # Guide: https://nixos-mailserver.readthedocs.io/en/latest/setup-guide.html
{ container, domain, pkgs, util, const, ... } @args: let cfg = container.config.mail; { container, pkgs, util, const, lib, config, ... }: with lib; let
cfg = config.container.module.mail;
domain = config.container.domain;
in { in {
options = {
container.module.mail = {
enable = mkEnableOption "Email server.";
address = mkOption {
default = "10.1.0.5";
type = types.str;
};
port = mkOption {
default = 80;
type = types.int;
};
domain = mkOption {
default = "mail.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/mail";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [ systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data" "data"
# "data/indices" # "data/indices"
@ -44,7 +69,7 @@ in {
isReadOnly = false; isReadOnly = false;
}; };
"/acme" = { "/acme" = {
hostPath = "${container.config.proxy.storage}/letsencrypt"; hostPath = "${config.container.module.proxy.storage}/letsencrypt";
isReadOnly = true; isReadOnly = true;
}; };
}; };
@ -59,8 +84,8 @@ in {
mailserver = { mailserver = {
enable = true; enable = true;
fqdn = cfg.domain;
domains = [ domain ]; domains = [ domain ];
fqdn = cfg.domain;
sendingFqdn = domain; sendingFqdn = domain;
# Use `mkpasswd -sm bcrypt`. # Use `mkpasswd -sm bcrypt`.
@ -176,4 +201,5 @@ in {
}; };
}; };
}; };
};
} }

View file

@ -2,9 +2,32 @@
# 1. You need to change PSQL tables owner from root to onlyoffice, too. They don't do that automatically for some reason. # 1. You need to change PSQL tables owner from root to onlyoffice, too. They don't do that automatically for some reason.
# 2. TODO: Generate JWT secret at /var/lib/onlyoffice/jwt, i.e. 9wLfMGha1YrfvWpb5hyYjZf8pvJQ3swS # 2. TODO: Generate JWT secret at /var/lib/onlyoffice/jwt, i.e. 9wLfMGha1YrfvWpb5hyYjZf8pvJQ3swS
# See https://git.voronind.com/voronind/nixos/issues/74 # See https://git.voronind.com/voronind/nixos/issues/74
{ container, pkgs, util, lib, ... } @args: let { container, pkgs, util, lib, config, ... }: with lib; let
cfg = container.config.office; cfg = config.container.module.office;
in { in {
options = {
container.module.office = {
enable = mkEnableOption "Office web suite.";
address = mkOption {
default = "10.1.0.21";
type = types.str;
};
port = mkOption {
default = 8000;
type = types.int;
};
domain = mkOption {
default = "office.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/office";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [ systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data" "data"
]; ];
@ -25,17 +48,18 @@ in {
hostname = cfg.domain; hostname = cfg.domain;
postgresName = dbName; postgresName = dbName;
postgresHost = container.config.postgres.address; postgresHost = config.container.module.postgres.address;
postgresUser = dbName; postgresUser = dbName;
postgresPasswordFile = "${pkgs.writeText "OfficeDbPassword" dbName}"; postgresPasswordFile = "${pkgs.writeText "OfficeDbPassword" dbName}";
jwtSecretFile = "/var/lib/onlyoffice/jwt"; jwtSecretFile = "/var/lib/onlyoffice/jwt";
rabbitmqUrl = "amqp://guest:guest@${container.config.rabbitmq.address}:${toString container.config.rabbitmq.port}"; rabbitmqUrl = "amqp://guest:guest@${config.container.module.rabbitmq.address}:${toString config.container.module.rabbitmq.port}";
examplePort = cfg.port; examplePort = cfg.port;
enableExampleServer = true; enableExampleServer = true;
}; };
}; };
}; };
};
} }

View file

@ -1,6 +1,29 @@
{ container, pkgs, util, lib, ... } @args: let { container, pkgs, util, lib, config, ... }: with lib; let
cfg = container.config.paper; cfg = config.container.module.paper;
in { in {
options = {
container.module.paper = {
enable = mkEnableOption "Paper scans manager.";
address = mkOption {
default = "10.1.0.40";
type = types.str;
};
port = mkOption {
default = 28981;
type = types.int;
};
domain = mkOption {
default = "paper.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/paper";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [ systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data" "data"
]; ];
@ -12,7 +35,7 @@ in {
isReadOnly = false; isReadOnly = false;
}; };
"/var/lib/paperless/media" = { "/var/lib/paperless/media" = {
hostPath = "${lib.elemAt cfg.paper 0}"; hostPath = "${elemAt config.container.media.paper 0}";
isReadOnly = false; isReadOnly = false;
}; };
}; };
@ -30,14 +53,14 @@ in {
settings = { settings = {
PAPERLESS_URL = "https://${cfg.domain}"; PAPERLESS_URL = "https://${cfg.domain}";
PAPERLESS_ADMIN_USER = "root"; PAPERLESS_ADMIN_USER = "root";
PAPERLESS_DBHOST = container.config.postgres.address; PAPERLESS_DBHOST = config.container.module.postgres.address;
PAPERLESS_DBENGINE = "postgresql"; PAPERLESS_DBENGINE = "postgresql";
PAPERLESS_DBNAME = "paperless"; PAPERLESS_DBNAME = "paperless";
PAPERLESS_DBPASS = "paperless"; PAPERLESS_DBPASS = "paperless";
PAPERLESS_DBPORT = container.config.postgres.port; PAPERLESS_DBPORT = config.container.module.postgres.port;
PAPERLESS_DBUSER = "paperless"; PAPERLESS_DBUSER = "paperless";
PAPERLESS_OCR_LANGUAGE = "rus"; PAPERLESS_OCR_LANGUAGE = "rus";
PAPERLESS_REDIS = "redis://${container.config.redis.address}:${toString container.config.redis.port}"; PAPERLESS_REDIS = "redis://${config.container.module.redis.address}:${toString config.container.module.redis.port}";
}; };
}; };
@ -50,4 +73,5 @@ in {
}; };
}; };
}; };
};
} }

View file

@ -1,6 +1,29 @@
{ container, ... } @args: let { container, lib, config, ... }: with lib; let
cfg = container.config.pass; cfg = config.container.module.pass;
in { in {
options = {
container.module.pass = {
enable = mkEnableOption "Password manager";
address = mkOption {
default = "10.1.0.9";
type = types.str;
};
port = mkOption {
default = 8000;
type = types.int;
};
domain = mkOption {
default = "pass.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/pass";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [ systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data" "data"
]; ];
@ -30,4 +53,5 @@ in {
}; };
}; };
}; };
};
} }

View file

@ -1,7 +1,30 @@
{ pkgs, util, container, ... } @args: let { pkgs, util, container, lib, config, ... } @args: with lib; let
cfg = container.config.paste; cfg = config.container.module.paste;
package = (pkgs.callPackage ./pastebin args); package = (pkgs.callPackage ./pastebin args);
in { in {
options = {
container.module.paste = {
enable = mkEnableOption "Pastebin.";
address = mkOption {
default = "10.1.0.14";
type = types.str;
};
port = mkOption {
default = 80;
type = types.int;
};
domain = mkOption {
default = "paste.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/paste";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [ systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data" "data"
"tmp" "tmp"
@ -99,4 +122,5 @@ in {
}; };
}; };
}; };
};
} }

View file

@ -1,6 +1,25 @@
{ container, lib, pkgs, ... } @args: let { container, lib, pkgs, config, ... }: with lib; let
cfg = container.config.postgres; cfg = config.container.module.postgres;
in { in {
options = {
container.module.postgres = {
enable = mkEnableOption "Postgresql server.";
address = mkOption {
default = "10.1.0.3";
type = types.str;
};
port = mkOption {
default = 5432;
type = types.int;
};
storage = mkOption {
default = "${config.container.storage}/postgres";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [ systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data" "data"
]; ];
@ -16,7 +35,7 @@ in {
config = { ... }: container.mkContainerConfig cfg { config = { ... }: container.mkContainerConfig cfg {
services.postgresql = let services.postgresql = let
# Populate with services here. # Populate with services here.
configurations = with container.config; { configurations = with config.container.module; {
gitea = git; gitea = git;
nextcloud = cloud; nextcloud = cloud;
privatebin = paste; privatebin = paste;
@ -26,14 +45,14 @@ in {
}; };
access = configurations // { access = configurations // {
all = { address = container.host; }; all = { address = config.container.host; };
}; };
authentication = builtins.foldl' (acc: item: acc + "${item}\n") "" ( authentication = builtins.foldl' (acc: item: acc + "${item}\n") "" (
lib.mapAttrsToList (db: cfg: "host ${db} ${db} ${cfg.address}/32 trust") access mapAttrsToList (db: cfg: "host ${db} ${db} ${cfg.address}/32 trust") access
); );
ensureDatabases = [ "root" ] ++ lib.mapAttrsToList (name: _: name) configurations; ensureDatabases = [ "root" ] ++ mapAttrsToList (name: _: name) configurations;
ensureUsers = map (name: { ensureUsers = map (name: {
inherit name; inherit name;
@ -54,4 +73,5 @@ in {
}; };
}; };
}; };
};
} }

View file

@ -2,10 +2,33 @@
# ipp://192.168.2.237 # ipp://192.168.2.237
# Pantum M6500W-Series # Pantum M6500W-Series
{ container, pkgs, ... } @args: let { container, pkgs, lib, config, ... }: with lib; let
cfg = container.config.print; cfg = config.container.module.print;
package = pkgs.callPackage ./print args; package = pkgs.callPackage ./print args;
in { in {
options = {
container.module.print = {
enable = mkEnableOption "Printing server.";
address = mkOption {
default = "10.1.0.46";
type = types.str;
};
port = mkOption {
default = 631;
type = types.int;
};
domain = mkOption {
default = "print.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/print";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [ systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data" "data"
]; ];
@ -32,5 +55,6 @@ in {
}; };
}; };
}; };
};
} }

View file

@ -9,10 +9,29 @@
# ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384"; # ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
# ``` # ```
# For certbot to generate new keys: `certbot certonly --manual --manual-public-ip-logging-ok --preferred-challenges dns-01 --server https://acme-v02.api.letsencrypt.org/directory -d "*.voronind.com" -d voronind.com` # For certbot to generate new keys: `certbot certonly --manual --manual-public-ip-logging-ok --preferred-challenges dns-01 --server https://acme-v02.api.letsencrypt.org/directory -d "*.voronind.com" -d voronind.com`
{ domain, util, container, pkgs, ... } @args: let { util, container, pkgs, lib, config, ... } @args: with lib; let
cfg = container.config.proxy; cfg = config.container.module.proxy;
virtualHosts = util.catSet (util.ls ./proxy/host) args; virtualHosts = util.catSet (util.ls ./proxy/host) args;
in { in {
options = {
container.module.proxy = {
enable = mkEnableOption "Proxy server.";
address = mkOption {
default = "10.1.0.2";
type = types.str;
};
port = mkOption {
default = 443;
type = types.int;
};
storage = mkOption {
default = "${config.container.storage}/proxy";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [ systemd.tmpfiles.rules = container.mkContainerDir cfg [
"challenge" "challenge"
"letsencrypt" "letsencrypt"
@ -70,16 +89,16 @@ in {
} }
map $http_accept_language $resume { map $http_accept_language $resume {
default https://git.${domain}/voronind/resume/releases/download/latest/voronind_en.pdf; default https://git.${config.container.domain}/voronind/resume/releases/download/latest/voronind_en.pdf;
~ru https://git.${domain}/voronind/resume/releases/download/latest/voronind_ru.pdf; ~ru https://git.${config.container.domain}/voronind/resume/releases/download/latest/voronind_ru.pdf;
} }
server { server {
server_name ${domain}; server_name ${config.container.domain};
listen 443 ssl; listen 443 ssl;
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem; ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem; ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf; include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem; ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
@ -90,8 +109,8 @@ in {
listen 443 ssl default_server; listen 443 ssl default_server;
server_name _; server_name _;
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem; ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem; ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf; include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem; ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
@ -101,4 +120,5 @@ in {
}; };
}; };
}; };
};
} }

View file

@ -1,6 +1,25 @@
{ container, pkgs, util, ... } @args: let { container, pkgs, util, lib, config, ... }: with lib; let
cfg = container.config.rabbitmq; cfg = config.container.module.rabbitmq;
in { in {
options = {
container.module.rabbitmq = {
enable = mkEnableOption "Mqtt server.";
address = mkOption {
default = "10.1.0.28";
type = types.str;
};
port = mkOption {
default = 5672;
type = types.int;
};
storage = mkOption {
default = "${config.container.storage}/rabbitmq";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [ systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data" "data"
]; ];
@ -25,4 +44,5 @@ in {
}; };
}; };
}; };
};
} }

View file

@ -1,6 +1,29 @@
{ container, lib, pkgs, ... } @args: let { container, lib, pkgs, config, ... }: with lib; let
cfg = container.config.read; cfg = config.container.module.read;
in { in {
options = {
container.module.read = {
enable = mkEnableOption "Reading server.";
address = mkOption {
default = "10.1.0.39";
type = types.str;
};
port = mkOption {
default = 5000;
type = types.int;
};
domain = mkOption {
default = "read.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/read";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [ systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data" "data"
]; ];
@ -12,8 +35,8 @@ in {
isReadOnly = false; isReadOnly = false;
}; };
} }
// container.attachMedia "book" cfg.book true // container.attachMedia "book" true
// container.attachMedia "manga" cfg.manga true // container.attachMedia "manga" true
; ;
config = { ... }: container.mkContainerConfig cfg { config = { ... }: container.mkContainerConfig cfg {
@ -28,4 +51,5 @@ in {
}; };
}; };
}; };
};
} }

View file

@ -1,6 +1,21 @@
{ container, pkgs, util, ... } @args: let { container, pkgs, util, lib, config, ... }: with lib; let
cfg = container.config.redis; cfg = config.container.module.redis;
in { in {
options = {
container.module.redis = {
enable = mkEnableOption "Redis server.";
address = mkOption {
default = "10.1.0.38";
type = types.str;
};
port = mkOption {
default = 6379;
type = types.int;
};
};
};
config = mkIf cfg.enable {
containers.redis = container.mkContainer cfg { containers.redis = container.mkContainer cfg {
config = { ... }: container.mkContainerConfig cfg { config = { ... }: container.mkContainerConfig cfg {
services.redis.servers.main = { services.redis.servers.main = {
@ -11,5 +26,6 @@ in {
}; };
}; };
}; };
};
} }

View file

@ -1,6 +1,29 @@
{ container, pkgs, ... } @args: let { container, pkgs, lib, config, ... }: with lib; let
cfg = container.config.search; cfg = config.container.module.search;
in { in {
options = {
container.module.search = {
enable = mkEnableOption "Search frontend.";
address = mkOption {
default = "10.1.0.26";
type = types.str;
};
port = mkOption {
default = 8080;
type = types.int;
};
domain = mkOption {
default = "search.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/search";
type = types.str;
};
};
};
config = mkIf cfg.enable {
containers.search = container.mkContainer cfg { containers.search = container.mkContainer cfg {
config = { ... }: container.mkContainerConfig cfg { config = { ... }: container.mkContainerConfig cfg {
services.searx = { services.searx = {
@ -16,4 +39,5 @@ in {
}; };
}; };
}; };
};
} }

View file

@ -1,6 +1,29 @@
{ container, ... } @args: let { container, lib, config, ... }: with lib; let
cfg = container.config.status; cfg = config.container.module.status;
in { in {
options = {
container.module.status = {
enable = mkEnableOption "Status monitor.";
address = mkOption {
default = "10.1.0.22";
type = types.str;
};
port = mkOption {
default = 3001;
type = types.int;
};
domain = mkOption {
default = "status.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/status";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [ systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data" "data"
]; ];
@ -15,8 +38,8 @@ in {
config = { lib, ... }: container.mkContainerConfig cfg { config = { lib, ... }: container.mkContainerConfig cfg {
networking = { networking = {
nameservers = lib.mkForce [ nameservers = mkForce [
container.config.dns.address config.container.module.dns.address
]; ];
}; };
@ -30,7 +53,8 @@ in {
}; };
systemd.services.uptime-kuma = { systemd.services.uptime-kuma = {
serviceConfig.DynamicUser = lib.mkForce false; serviceConfig.DynamicUser = mkForce false;
};
}; };
}; };
}; };

View file

@ -1,6 +1,29 @@
{ container, ... } @args: let { container, lib, config, ... }: with lib; let
cfg = container.config.stock; cfg = config.container.module.stock;
in { in {
options = {
container.module.stock = {
enable = mkEnableOption "Stock management.";
address = mkOption {
default = "10.1.0.45";
type = types.str;
};
port = mkOption {
default = 80;
type = types.int;
};
domain = mkOption {
default = "stock.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/stock";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [ systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data" "data"
]; ];
@ -30,4 +53,5 @@ in {
}; };
}; };
}; };
};
} }

View file

@ -1,6 +1,39 @@
{ container, pkgs, ... } @args: let { container, pkgs, lib, config, ... }: with lib; let
cfg = container.config.vpn; cfg = config.container.module.vpn;
wireguardPeers = let
mkPeer = name: ip: PublicKey: {
inherit PublicKey;
PresharedKeyFile = "/var/lib/wireguard/preshared/${name}";
AllowedIPs = [ "${ip}/32" ];
};
in [
(mkPeer "dashaphone" "10.1.1.3" "O/3y8+QKEY8UoLVlmbc8xdhs248L4wtQcl1MsBBfoQo=")
(mkPeer "laptop" "10.1.1.9" "xxoCNPSB86zs8L8p+wXhqaIwpNDkiZu1Yjv8sj8XhgY=")
(mkPeer "phone" "10.1.1.5" "bFmFisMqbDpIrAg3o/GiRl9XhceZEVnZtkegZDTL4yg=")
(mkPeer "tablet" "10.1.1.6" "BdslswVc9OgUpEhJd0sugDBmYw44DiS0FbUPT5EjOG0=")
(mkPeer "work" "10.1.1.2" "Pk0AASSInKO9O8RaQEmm1uNrl0cwWTJDcT8rLn7PSA0=")
];
in { in {
options = {
container.module.vpn = {
enable = mkEnableOption "Vpn server.";
address = mkOption {
default = "10.1.0.23";
type = types.str;
};
port = mkOption {
default = 51820;
type = types.int;
};
storage = mkOption {
default = "${config.container.storage}/vpn";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [ systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data" "data"
"data/preshared" "data/preshared"
@ -41,19 +74,7 @@ in {
PrivateKeyFile = "/var/lib/wireguard/privkey"; PrivateKeyFile = "/var/lib/wireguard/privkey";
ListenPort = cfg.port; ListenPort = cfg.port;
}; };
wireguardPeers = let inherit wireguardPeers;
mkPeer = name: ip: PublicKey: {
inherit PublicKey;
PresharedKeyFile = "/var/lib/wireguard/preshared/${name}";
AllowedIPs = [ "${ip}/32" ];
};
in [
(mkPeer "dashaphone" "10.1.1.3" "O/3y8+QKEY8UoLVlmbc8xdhs248L4wtQcl1MsBBfoQo=")
(mkPeer "laptop" "10.1.1.9" "xxoCNPSB86zs8L8p+wXhqaIwpNDkiZu1Yjv8sj8XhgY=")
(mkPeer "phone" "10.1.1.5" "bFmFisMqbDpIrAg3o/GiRl9XhceZEVnZtkegZDTL4yg=")
(mkPeer "tablet" "10.1.1.6" "BdslswVc9OgUpEhJd0sugDBmYw44DiS0FbUPT5EjOG0=")
(mkPeer "work" "10.1.1.2" "Pk0AASSInKO9O8RaQEmm1uNrl0cwWTJDcT8rLn7PSA0=")
];
}; };
}; };
@ -68,5 +89,6 @@ in {
}; };
}; };
}; };
};
} }

View file

@ -1,7 +1,33 @@
{ container, lib, ... } @args: let { container, lib, config, ... }: with lib; let
cfg = container.config.watch; cfg = config.container.module.watch;
memLimit = "8G";
in { in {
options = {
container.module.watch = {
enable = mkEnableOption "Media server.";
address = mkOption {
default = "10.1.0.11";
type = types.str;
};
port = mkOption {
default = 8096;
type = types.int;
};
domain = mkOption {
default = "watch.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/watch";
type = types.str;
};
memLimit = mkOption {
default = "8G";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [ systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data" "data"
"cache" "cache"
@ -22,16 +48,16 @@ in {
isReadOnly = false; isReadOnly = false;
}; };
} }
// container.attachMedia "anime" cfg.anime true // container.attachMedia "anime" true
// container.attachMedia "download" cfg.download true // container.attachMedia "download" true
// container.attachMedia "movie" cfg.movie true // container.attachMedia "movie" true
// container.attachMedia "music" cfg.music true // container.attachMedia "music" true
// container.attachMedia "photo" cfg.photo true // container.attachMedia "photo" true
// container.attachMedia "porn" cfg.porn true // container.attachMedia "porn" true
// container.attachMedia "show" cfg.show true // container.attachMedia "show" true
// container.attachMedia "study" cfg.study true // container.attachMedia "study" true
// container.attachMedia "work" cfg.work true // container.attachMedia "work" true
// container.attachMedia "youtube" cfg.youtube true // container.attachMedia "youtube" true
; ;
allowedDevices = [ allowedDevices = [
@ -48,7 +74,8 @@ in {
dataDir = "/var/lib/jellyfin"; dataDir = "/var/lib/jellyfin";
}; };
systemd.services.jellyfin.serviceConfig.MemoryLimit = memLimit; systemd.services.jellyfin.serviceConfig.MemoryLimit = cfg.memLimit;
};
}; };
}; };
} }

View file

@ -1,6 +1,29 @@
{ container, pkgs, ... } @args: let { container, pkgs, lib, config, ... }: with lib; let
cfg = container.config.yt; cfg = config.container.module.yt;
in { in {
options = {
container.module.yt = {
enable = mkEnableOption "YouTube frontend.";
address = mkOption {
default = "10.1.0.19";
type = types.str;
};
port = mkOption {
default = 3000;
type = types.int;
};
domain = mkOption {
default = "yt.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/yt";
type = types.str;
};
};
};
config = mkIf cfg.enable {
containers.yt = container.mkContainer cfg { containers.yt = container.mkContainer cfg {
config = { ... }: container.mkContainerConfig cfg { config = { ... }: container.mkContainerConfig cfg {
services.invidious = { services.invidious = {
@ -9,8 +32,8 @@ in {
port = cfg.port; port = cfg.port;
nginx.enable = false; nginx.enable = false;
database = { database = {
port = container.config.postgres.port; port = config.container.module.postgres.port;
host = container.config.postgres.address; host = config.container.module.postgres.address;
createLocally = false; createLocally = false;
passwordFile = "${pkgs.writeText "InvidiousDbPassword" "invidious"}"; passwordFile = "${pkgs.writeText "InvidiousDbPassword" "invidious"}";
}; };
@ -25,4 +48,5 @@ in {
}; };
}; };
}; };
};
} }

View file

@ -1,246 +1,55 @@
{ lib { lib, config, ... }: with lib; let
, const cfg = config.container;
, host in {
, storage options = {
, domain container = {
, media enable = mkEnableOption "Containers!!";
, pkgs
, ... }: {
inherit host;
# Common configuration for all the containers. autoStart = mkOption {
mkContainer = config: cfg: lib.recursiveUpdate { default = true;
# Start containers with the system by default. type = types.bool;
autoStart = true; };
# IP Address of the host. This is required for container to have access to the Internet. host = mkOption {
hostAddress = host; default = "0.0.0.0";
type = types.str;
};
# Container's IP address. localAccess = mkOption {
localAddress = config.address; default = "0.0.0.0";
type = types.str;
};
# Isolate container from other hosts. storage = mkOption {
privateNetwork = true; default = "/tmp/container";
} cfg; type = types.str;
};
# Common configuration for the system inside the container. domain = mkOption {
mkContainerConfig = config: cfg: lib.recursiveUpdate { default = "local";
# HACK: Do not evaluate nixpkgs inside the container. Use host's instead. type = types.str;
nixpkgs.pkgs = lib.mkForce pkgs; };
# Release version. interface = mkOption {
system.stateVersion = const.stateVersion; default = "lo";
type = types.str;
};
# Allow passwordless login as root. media = mkOption {
users.users.root.password = ""; default = {};
users.mutableUsers = false; type = types.attrs;
};
};
};
networking = { config = mkIf cfg.enable {
# Default DNS servers. # This is the network for all the containers.
nameservers = [ # They are not available to the external interface by default,
"1.1.1.1" # instead they all expose specific ports in their configuration.
]; networking.nat = {
enable = true;
# HACK: Fix for upstream issue: https://github.com/NixOS/nixpkgs/issues/162686 internalInterfaces = [ "ve-+" ];
useHostResolvConf = lib.mkForce false; externalInterface = config.container.interface;
# Disable firewall.
firewall.enable = false;
};
} cfg;
# Create a directory on the host for container use.
mkContainerDir = cfg: dirs: map (path: "d '${cfg.storage}/${path}' 1777 root root - -") dirs;
# Common configuration for Nginx server.
mkServer = cfg: lib.recursiveUpdate {
forceSSL = false;
} cfg;
# Attach the host media directory to container.
# They will be added to /type/{0..9}
attachMedia = type: paths: ro: builtins.listToAttrs (lib.imap0 (i: path:
{
name = "/${type}/${toString i}";
value = {
hostPath = path;
isReadOnly = ro;
};
}
) paths);
# Range of local addresses who have access to sensitive paths like admin panels.
# Other addresses will get 403.
localAccess = "192.168.1.0/24";
# Per-container configurations.
config = {
camera = {
address = "192.168.2.249";
domain = "camera.${domain}";
port = "554";
};
change = {
address = "10.1.0.41";
port = 5000;
domain = "change.${domain}";
storage = "${storage}/change";
};
cloud = {
address = "10.1.0.13";
port = 80;
domain = "cloud.${domain}";
storage = "${storage}/cloud";
};
ddns = {
address = "10.1.0.31";
port = 53;
storage = "${storage}/ddns";
};
dns = {
address = "10.1.0.6";
};
download = {
inherit (media) download;
address = "10.1.0.12";
port = 8112;
domain = "download.${domain}";
storage = "${storage}/download";
};
git = {
address = "10.1.0.8";
port = 3000;
domain = "git.${domain}";
storage = "${storage}/git";
};
hdd = {
address = "10.1.0.10";
port = 8080;
domain = "hdd.${domain}";
storage = "${storage}/hdd";
};
home = {
address = "10.1.0.18";
port = 80;
domain = "home.${domain}";
};
iot = {
inherit (media) photo;
address = "10.1.0.27";
domain = "iot.${domain}";
port = 8123;
storage = "${storage}/iot";
};
jobber = {
address = "10.1.0.32";
storage = "${storage}/jobber";
};
mail = {
address = "10.1.0.5";
domain = "mail.${domain}";
port = 80;
storage = "${storage}/mail";
};
office = {
address = "10.1.0.21";
domain = "office.${domain}";
port = 8000;
storage = "${storage}/office";
};
paper = {
inherit (media) paper;
address = "10.1.0.40";
domain = "paper.${domain}";
port = 28981;
storage = "${storage}/paper";
};
pass = {
address = "10.1.0.9";
domain = "pass.${domain}";
port = 8000;
storage = "${storage}/pass";
};
paste = {
address = "10.1.0.14";
domain = "paste.${domain}";
port = 80;
storage = "${storage}/paste";
};
print = {
domain = "print.${domain}";
address = "10.1.0.46";
port = 631;
storage = "${storage}/print";
};
printer = {
address = "192.168.2.237";
domain = "printer.${domain}";
port = 80;
};
proxy = {
address = "10.1.0.2";
port = 443;
storage = "${storage}/proxy";
};
postgres = {
address = "10.1.0.3";
port = 5432;
storage = "${storage}/postgres";
};
rabbitmq = {
address = "10.1.0.28";
port = 5672;
storage = "${storage}/rabbitmq";
};
read = {
inherit (media) book manga;
address = "10.1.0.39";
domain = "read.${domain}";
port = 5000;
storage = "${storage}/read";
};
redis = {
address = "10.1.0.38";
port = 6379;
};
router = {
address = "192.168.1.1";
domain = "router.${domain}";
port = 80;
};
search = {
address = "10.1.0.26";
domain = "search.${domain}";
port = 8080;
};
status = {
address = "10.1.0.22";
domain = "status.${domain}";
port = 3001;
storage = "${storage}/status";
};
stock = {
address = "10.1.0.45";
domain = "stock.${domain}";
port = 80;
storage = "${storage}/stock";
};
vpn = {
address = "10.1.0.23";
port = 51820;
storage = "${storage}/vpn";
};
watch = {
inherit (media) anime download movie music photo porn show study work youtube;
address = "10.1.0.11";
domain = "watch.${domain}";
port = 8096;
storage = "${storage}/watch";
};
yt = {
address = "10.1.0.19";
domain = "yt.${domain}";
port = 3000;
}; };
}; };
} }

View file

@ -1,4 +1,4 @@
{ pkgs, container, ... }: let { pkgs, config, ... }: let
iconTheme = "fa-solid"; iconTheme = "fa-solid";
mkGroup = name: icon: items: { mkGroup = name: icon: items: {
@ -12,7 +12,7 @@
target = "_blank"; target = "_blank";
}; };
config = { cfg = {
title = "Dashboard"; title = "Dashboard";
subtitle = "Home"; subtitle = "Home";
header = false; header = false;
@ -41,33 +41,32 @@
}; };
links = [ links = [
(mkLink "Status" "fa-heartbeat" "https://status.voronind.com") (mkLink "Status" "fa-heartbeat" "https://${config.container.module.status.domain}")
]; ];
services = [ services = [
(mkGroup "App" "fa-server" [ (mkGroup "App" "fa-server" [
(mkLink "Change" "fa-user-secret" "https://${container.config.change.domain}") (mkLink "Change" "fa-user-secret" "https://${config.container.module.change.domain}")
(mkLink "Cloud" "fa-cloud" "https://${container.config.cloud.domain}") (mkLink "Cloud" "fa-cloud" "https://${config.container.module.cloud.domain}")
(mkLink "Download" "fa-download" "https://${container.config.download.domain}") (mkLink "Download" "fa-download" "https://${config.container.module.download.domain}")
(mkLink "Git" "fab fa-git-alt" "https://${container.config.download.domain}") (mkLink "Git" "fab fa-git-alt" "https://${config.container.module.download.domain}")
(mkLink "Iot" "fa-home" "https://${container.config.iot.domain}") (mkLink "Iot" "fa-home" "https://${config.container.module.iot.domain}")
(mkLink "Mail" "fa-envelope" "https://${container.config.mail.domain}") (mkLink "Mail" "fa-envelope" "https://${config.container.module.mail.domain}")
(mkLink "Paper" "fa-paperclip" "https://${container.config.paper.domain}") (mkLink "Paper" "fa-paperclip" "https://${config.container.module.paper.domain}")
(mkLink "Pass" "fa-key" "https://${container.config.pass.domain}") (mkLink "Pass" "fa-key" "https://${config.container.module.pass.domain}")
(mkLink "Paste" "fa-paste" "https://${container.config.paste.domain}/s") (mkLink "Paste" "fa-paste" "https://${config.container.module.paste.domain}/s")
(mkLink "Print" "fa-print" "https://${container.config.print.domain}") (mkLink "Print" "fa-print" "https://${config.container.module.print.domain}")
(mkLink "Read" "fa-book" "https://${container.config.read.domain}") (mkLink "Read" "fa-book" "https://${config.container.module.read.domain}")
(mkLink "Search" "fa-search" "https://${container.config.search.domain}") (mkLink "Search" "fa-search" "https://${config.container.module.search.domain}")
(mkLink "Stock" "fa-boxes-stacked" "https://${container.config.stock.domain}") (mkLink "Stock" "fa-boxes-stacked" "https://${config.container.module.stock.domain}")
(mkLink "Watch" "fa-film" "https://${container.config.watch.domain}") (mkLink "Watch" "fa-film" "https://${config.container.module.watch.domain}")
(mkLink "YouTube" "fab fa-youtube" "https://${container.config.yt.domain}") (mkLink "YouTube" "fab fa-youtube" "https://${config.container.module.yt.domain}")
]) ])
(mkGroup "System" "fa-shield" [ (mkGroup "System" "fa-shield" [
(mkLink "Camera" "fa-camera" "https://${container.config.camera.domain}") (mkLink "Camera" "fa-camera" "https://camera.${config.container.domain}")
# (mkLink "Hdd" "fa-hard-drive" "https://${container.config.hdd.domain}")
(mkLink "NixOS Search" "fa-snowflake" "https://search.nixos.org") (mkLink "NixOS Search" "fa-snowflake" "https://search.nixos.org")
(mkLink "Printer" "fa-print" "https://${container.config.printer.domain}") (mkLink "Printer" "fa-print" "https://printer.${config.container.domain}")
(mkLink "Router" "fa-route" "https://${container.config.router.domain}") (mkLink "Router" "fa-route" "https://router.${config.container.domain}")
]) ])
(mkGroup "Bookmark" "fa-bookmark" [ (mkGroup "Bookmark" "fa-bookmark" [
(mkLink "2gis" "fa-map-location-dot" "https://2gis.ru") (mkLink "2gis" "fa-map-location-dot" "https://2gis.ru")
@ -96,5 +95,5 @@
]; ];
}; };
in { in {
file = (pkgs.formats.yaml {}).generate "HomerConfig" config; file = (pkgs.formats.yaml {}).generate "HomerConfig" cfg;
} }

View file

@ -1,4 +1,4 @@
{ stdenv, pkgs, ... } @args: let { stdenv, pkgs, config, ... } @args: let
cfg = (import ./Config.nix args).file; cfg = (import ./Config.nix args).file;
in stdenv.mkDerivation (finalAttrs: { in stdenv.mkDerivation (finalAttrs: {
pname = "Homer"; pname = "Homer";

View file

@ -1,4 +1,4 @@
{ util, container, ... }: { { util, config, ... }: {
text = util.trimTabs '' text = util.trimTabs ''
;<?php http_response_code(403); /* ;<?php http_response_code(403); /*
; config file for PrivateBin ; config file for PrivateBin
@ -220,7 +220,7 @@
; example of DB configuration for PostgreSQL ; example of DB configuration for PostgreSQL
class = Database class = Database
[model_options] [model_options]
dsn = "pgsql:host=${container.config.postgres.address};dbname=privatebin" dsn = "pgsql:host=${config.container.module.postgres.address};dbname=privatebin"
tbl = "privatebin_" ; table prefix tbl = "privatebin_" ; table prefix
usr = "privatebin" usr = "privatebin"
pwd = "privatebin" pwd = "privatebin"

View file

@ -1,4 +1,4 @@
{ php, pkgs, util, ... } @args: let { php, pkgs, util, config, ... } @args: let
cfg = pkgs.writeText "PrivateBinConfig" (import ./Config.nix args).text; cfg = pkgs.writeText "PrivateBinConfig" (import ./Config.nix args).text;
in php.buildComposerProject (finalAttrs: { in php.buildComposerProject (finalAttrs: {
pname = "PrivateBin"; pname = "PrivateBin";

View file

@ -1,20 +1,22 @@
{ domain, util, container, ... }: let { util, config, lib, container, ... }: let
cfg = container.config.camera; domain = "camera.${config.container.domain}";
address = "192.168.2.249";
port = 554;
in { in {
${cfg.domain} = container.mkServer { ${domain} = container.mkServer {
extraConfig = util.trimTabs '' extraConfig = util.trimTabs ''
listen 443 ssl; listen 443 ssl;
location / { location / {
allow ${container.localAccess}; allow ${config.container.localAccess};
allow ${container.config.status.address}; allow ${config.container.module.status.address};
allow ${container.config.vpn.address}; allow ${config.container.module.vpn.address};
deny all; deny all;
return 301 rtsp://${cfg.address}:${cfg.port}/live/main; return 301 rtsp://${address}:${toString port}/live/main;
} }
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem; ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem; ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf; include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem; ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
''; '';

View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let { util, config, container, ... }: let
cfg = container.config.change; cfg = config.container.module.change;
name = "change"; name = "change";
in { in {
${cfg.domain} = container.mkServer { ${cfg.domain} = container.mkServer {
@ -8,9 +8,9 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port}; set ''$${name} ${cfg.address}:${toString cfg.port};
location / { location / {
allow ${container.localAccess}; allow ${config.container.localAccess};
allow ${container.config.status.address}; allow ${config.container.module.status.address};
allow ${container.config.vpn.address}; allow ${config.container.module.vpn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;
@ -18,8 +18,8 @@ in {
add_header Referrer-Policy 'origin'; add_header Referrer-Policy 'origin';
} }
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem; ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem; ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf; include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem; ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
''; '';

View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let { util, config, container, ... }: let
cfg = container.config.cloud; cfg = config.container.module.cloud;
name = "cloud"; name = "cloud";
in { in {
${cfg.domain} = container.mkServer { ${cfg.domain} = container.mkServer {
@ -8,9 +8,9 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port}; set ''$${name} ${cfg.address}:${toString cfg.port};
location ~ ^/(settings/admin|settings/users|settings/apps|login|api) { location ~ ^/(settings/admin|settings/users|settings/apps|login|api) {
allow ${container.localAccess}; allow ${config.container.localAccess};
allow ${container.config.status.address}; allow ${config.container.module.status.address};
allow ${container.config.vpn.address}; allow ${config.container.module.vpn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;
} }
@ -19,8 +19,8 @@ in {
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;
} }
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem; ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem; ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf; include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem; ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
''; '';

View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let { util, config, container, ... }: let
cfg = container.config.download; cfg = config.container.module.download;
name = "download"; name = "download";
in { in {
${cfg.domain} = container.mkServer { ${cfg.domain} = container.mkServer {
@ -8,15 +8,15 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port}; set ''$${name} ${cfg.address}:${toString cfg.port};
location / { location / {
allow ${container.localAccess}; allow ${config.container.localAccess};
allow ${container.config.status.address}; allow ${config.container.module.status.address};
allow ${container.config.vpn.address}; allow ${config.container.module.vpn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;
} }
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem; ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem; ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf; include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem; ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
''; '';

View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let { util, container, config, ... }: let
cfg = container.config.git; cfg = config.container.module.git;
name = "git"; name = "git";
in { in {
${cfg.domain} = container.mkServer { ${cfg.domain} = container.mkServer {
@ -8,15 +8,15 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port}; set ''$${name} ${cfg.address}:${toString cfg.port};
location ~ ^/(admin|api|user) { location ~ ^/(admin|api|user) {
allow ${container.localAccess}; allow ${config.container.localAccess};
allow ${container.config.vpn.address}; allow ${config.container.module.vpn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;
} }
location /markdown { location /markdown {
allow ${container.localAccess}; allow ${config.container.localAccess};
allow ${container.config.vpn.address}; allow ${config.container.module.vpn.address};
deny all; deny all;
proxy_set_header Content-Type "application/json"; proxy_set_header Content-Type "application/json";
@ -29,15 +29,15 @@ in {
} }
location / { location / {
# allow ${container.localAccess}; # allow ${config.container.localAccess};
# allow ${container.config.status.address}; # allow ${config.container.module.status.address};
# allow ${container.config.vpn.address}; # allow ${config.container.module.vpn.address};
# deny all; # deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;
} }
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem; ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem; ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf; include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem; ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
''; '';

View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let { util, container, config, ... }: let
cfg = container.config.hdd; cfg = config.container.module.hdd;
name = "hdd"; name = "hdd";
in { in {
${cfg.domain} = container.mkServer { ${cfg.domain} = container.mkServer {
@ -8,15 +8,15 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port}; set ''$${name} ${cfg.address}:${toString cfg.port};
location / { location / {
allow ${container.localAccess}; allow ${config.container.localAccess};
allow ${container.config.status.address}; allow ${config.container.module.status.address};
allow ${container.config.vpn.address}; allow ${config.container.module.vpn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;
} }
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem; ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem; ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf; include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem; ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
''; '';

View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let { util, config, container, ... }: let
cfg = container.config.home; cfg = config.container.module.home;
name = "home"; name = "home";
in { in {
${cfg.domain} = container.mkServer { ${cfg.domain} = container.mkServer {
@ -8,15 +8,15 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port}; set ''$${name} ${cfg.address}:${toString cfg.port};
location / { location / {
allow ${container.localAccess}; allow ${config.container.localAccess};
allow ${container.config.status.address}; allow ${config.container.module.status.address};
allow ${container.config.vpn.address}; allow ${config.container.module.vpn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;
} }
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem; ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem; ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf; include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem; ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
''; '';

View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let { util, container, config, ... }: let
cfg = container.config.iot; cfg = config.container.module.iot;
name = "iot"; name = "iot";
in { in {
${cfg.domain} = container.mkServer { ${cfg.domain} = container.mkServer {
@ -8,9 +8,9 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port}; set ''$${name} ${cfg.address}:${toString cfg.port};
location / { location / {
allow ${container.localAccess}; allow ${config.container.localAccess};
allow ${container.config.status.address}; allow ${config.container.module.status.address};
allow ${container.config.vpn.address}; allow ${config.container.module.vpn.address};
deny all; deny all;
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@ -22,8 +22,8 @@ in {
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;
} }
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem; ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem; ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf; include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem; ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
''; '';

View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let { util, container, config, ... }: let
cfg = container.config.mail; cfg = config.container.module.mail;
name = "mail"; name = "mail";
in { in {
${cfg.domain} = container.mkServer { ${cfg.domain} = container.mkServer {
@ -8,15 +8,15 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port}; set ''$${name} ${cfg.address}:${toString cfg.port};
location / { location / {
allow ${container.localAccess}; allow ${config.container.localAccess};
allow ${container.config.status.address}; allow ${config.container.module.status.address};
allow ${container.config.vpn.address}; allow ${config.container.module.vpn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;
} }
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem; ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem; ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf; include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem; ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
''; '';

View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let { util, container, config, ... }: let
cfg = container.config.office; cfg = config.container.module.office;
name = "office"; name = "office";
in { in {
${cfg.domain} = container.mkServer { ${cfg.domain} = container.mkServer {
@ -8,16 +8,16 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port}; set ''$${name} ${cfg.address}:${toString cfg.port};
location / { location / {
# allow ${container.localAccess}; # allow ${config.container.localAccess};
# allow ${container.config.status.address}; # allow ${config.container.module.status.address};
# allow ${container.config.vpn.address}; # allow ${config.container.module.vpn.address};
# deny all; # deny all;
add_header X-Forwarded-Proto https; add_header X-Forwarded-Proto https;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;
} }
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem; ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem; ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf; include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem; ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
''; '';

View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let { util, container, config, ... }: let
cfg = container.config.paper; cfg = config.container.module.paper;
name = "paper"; name = "paper";
in { in {
${cfg.domain} = container.mkServer { ${cfg.domain} = container.mkServer {
@ -8,15 +8,15 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port}; set ''$${name} ${cfg.address}:${toString cfg.port};
location / { location / {
allow ${container.localAccess}; allow ${config.container.localAccess};
allow ${container.config.status.address}; allow ${config.container.module.status.address};
allow ${container.config.vpn.address}; allow ${config.container.module.vpn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;
} }
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem; ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem; ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf; include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem; ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
''; '';

View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let { util, container, config, ... }: let
cfg = container.config.pass; cfg = config.container.module.pass;
name = "pass"; name = "pass";
in { in {
${cfg.domain} = container.mkServer { ${cfg.domain} = container.mkServer {
@ -8,15 +8,15 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port}; set ''$${name} ${cfg.address}:${toString cfg.port};
location / { location / {
allow ${container.localAccess}; allow ${config.container.localAccess};
allow ${container.config.status.address}; allow ${config.container.module.status.address};
allow ${container.config.vpn.address}; allow ${config.container.module.vpn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;
} }
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem; ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem; ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf; include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem; ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
''; '';

View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let { util, container, config, ... }: let
cfg = container.config.paste; cfg = config.container.module.paste;
name = "paste"; name = "paste";
in { in {
${cfg.domain} = container.mkServer { ${cfg.domain} = container.mkServer {
@ -15,8 +15,8 @@ in {
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;
} }
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem; ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem; ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf; include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem; ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
''; '';

View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let { util, container, config, ... }: let
cfg = container.config.print; cfg = config.container.module.print;
name = "print"; name = "print";
in { in {
${cfg.domain} = container.mkServer { ${cfg.domain} = container.mkServer {
@ -8,9 +8,9 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port}; set ''$${name} ${cfg.address}:${toString cfg.port};
location / { location / {
allow ${container.localAccess}; allow ${config.container.localAccess};
allow ${container.config.status.address}; allow ${config.container.module.status.address};
allow ${container.config.vpn.address}; allow ${config.container.module.vpn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;
@ -20,8 +20,8 @@ in {
proxy_set_header X-Forward-For $proxy_add_x_forwarded_for; proxy_set_header X-Forward-For $proxy_add_x_forwarded_for;
} }
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem; ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem; ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf; include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem; ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
''; '';

View file

@ -1,22 +1,24 @@
{ domain, util, container, ... }: let { util, container, config, ... }: let
cfg = container.config.printer; address = "192.168.2.237";
domain = "printer.${config.container.domain}";
port = 80;
name = "printer"; name = "printer";
in { in {
${cfg.domain} = container.mkServer { ${domain} = container.mkServer {
extraConfig = util.trimTabs '' extraConfig = util.trimTabs ''
listen 443 ssl; listen 443 ssl;
set ''$${name} ${cfg.address}:${toString cfg.port}; set ''$${name} ${address}:${toString port};
location / { location / {
allow ${container.localAccess}; allow ${config.container.localAccess};
allow ${container.config.status.address}; allow ${config.container.module.status.address};
allow ${container.config.vpn.address}; allow ${config.container.module.vpn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;
} }
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem; ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem; ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf; include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem; ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
''; '';

View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let { util, container, config, ... }: let
cfg = container.config.read; cfg = config.container.module.read;
name = "read"; name = "read";
in { in {
${cfg.domain} = container.mkServer { ${cfg.domain} = container.mkServer {
@ -8,15 +8,15 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port}; set ''$${name} ${cfg.address}:${toString cfg.port};
location / { location / {
allow ${container.localAccess}; allow ${config.container.localAccess};
allow ${container.config.status.address}; allow ${config.container.module.status.address};
allow ${container.config.vpn.address}; allow ${config.container.module.vpn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;
} }
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem; ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem; ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf; include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem; ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
''; '';

View file

@ -1,22 +1,24 @@
{ domain, util, container, ... }: let { util, container, config, ... }: let
cfg = container.config.router; address = "192.168.1.1";
domain = "router.${config.container.domain}";
port = 80;
name = "router"; name = "router";
in { in {
${cfg.domain} = container.mkServer { ${domain} = container.mkServer {
extraConfig = util.trimTabs '' extraConfig = util.trimTabs ''
listen 443 ssl; listen 443 ssl;
set ''$${name} ${cfg.address}:${toString cfg.port}; set ''$${name} ${address}:${toString port};
location / { location / {
allow ${container.localAccess}; allow ${config.container.localAccess};
allow ${container.config.status.address}; allow ${config.container.module.status.address};
allow ${container.config.vpn.address}; allow ${config.container.module.vpn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;
} }
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem; ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem; ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf; include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem; ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
''; '';

View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let { util, container, config, ... }: let
cfg = container.config.search; cfg = config.container.module.search;
name = "search"; name = "search";
in { in {
${cfg.domain} = container.mkServer { ${cfg.domain} = container.mkServer {
@ -8,15 +8,15 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port}; set ''$${name} ${cfg.address}:${toString cfg.port};
location / { location / {
allow ${container.localAccess}; allow ${config.container.localAccess};
allow ${container.config.status.address}; allow ${config.container.module.status.address};
allow ${container.config.vpn.address}; allow ${config.container.module.vpn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;
} }
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem; ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem; ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf; include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem; ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
''; '';

View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let { util, container, config, ... }: let
cfg = container.config.status; cfg = config.container.module.status;
name = "sstatus"; name = "sstatus";
in { in {
${cfg.domain} = container.mkServer { ${cfg.domain} = container.mkServer {
@ -8,21 +8,21 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port}; set ''$${name} ${cfg.address}:${toString cfg.port};
location ~ ^/(dashboard|settings) { location ~ ^/(dashboard|settings) {
allow ${container.localAccess}; allow ${config.container.localAccess};
allow ${container.config.vpn.address}; allow ${config.container.module.vpn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;
} }
location / { location / {
allow ${container.localAccess}; allow ${config.container.localAccess};
allow ${container.config.vpn.address}; allow ${config.container.module.vpn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;
} }
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem; ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem; ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf; include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem; ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
''; '';

View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let { util, container, config, ... }: let
cfg = container.config.stock; cfg = config.container.module.stock;
name = "stock"; name = "stock";
in { in {
${cfg.domain} = container.mkServer { ${cfg.domain} = container.mkServer {
@ -8,15 +8,15 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port}; set ''$${name} ${cfg.address}:${toString cfg.port};
location / { location / {
allow ${container.localAccess}; allow ${config.container.localAccess};
allow ${container.config.status.address}; allow ${config.container.module.status.address};
allow ${container.config.vpn.address}; allow ${config.container.module.vpn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;
} }
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem; ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem; ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf; include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem; ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
''; '';

View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let { util, container, config, ... }: let
cfg = container.config.watch; cfg = config.container.module.watch;
name = "watch"; name = "watch";
in { in {
${cfg.domain} = container.mkServer { ${cfg.domain} = container.mkServer {
@ -8,15 +8,15 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port}; set ''$${name} ${cfg.address}:${toString cfg.port};
location / { location / {
allow ${container.localAccess}; allow ${config.container.localAccess};
allow ${container.config.status.address}; allow ${config.container.module.status.address};
allow ${container.config.vpn.address}; allow ${config.container.module.vpn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;
} }
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem; ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem; ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf; include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem; ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
''; '';

View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let { util, container, config, ... }: let
cfg = container.config.yt; cfg = config.container.module.yt;
name = "yt"; name = "yt";
in { in {
${cfg.domain} = container.mkServer { ${cfg.domain} = container.mkServer {
@ -8,9 +8,9 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port}; set ''$${name} ${cfg.address}:${toString cfg.port};
location / { location / {
allow ${container.localAccess}; allow ${config.container.localAccess};
allow ${container.config.status.address}; allow ${config.container.module.status.address};
allow ${container.config.vpn.address}; allow ${config.container.module.vpn.address};
deny all; deny all;
proxy_pass http://''$${name}$request_uri; proxy_pass http://''$${name}$request_uri;
@ -25,8 +25,8 @@ in {
proxy_hide_header X-Content-Type-Options; proxy_hide_header X-Content-Type-Options;
} }
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem; ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem; ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf; include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem; ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
''; '';

193
flake.nix
View file

@ -137,22 +137,13 @@
url = "https://git.voronind.com/voronind/nixos.git"; url = "https://git.voronind.com/voronind/nixos.git";
}; };
# Common modules used across all the hosts. nixosConfigurations = let
nixosModules.common = let # List all files in a dir.
# This function allows me to get the list of all the files from the directories I need.
# It differs from the util.ls function because it also filters out all the directories.
lsFiles = path: map (f: "${path}/${f}") ( lsFiles = path: map (f: "${path}/${f}") (
builtins.filter (i: builtins.readFileType "${path}/${i}" == "regular") ( builtins.filter (i: builtins.readFileType "${path}/${i}" == "regular") (
builtins.attrNames (builtins.readDir path) builtins.attrNames (builtins.readDir path)
) )
); );
in {
# Here I import everything from those directories.
imports = (lsFiles ./module/common) ++ (lsFiles ./overlay) ++ [
./part/Setting.nix
./user/Root.nix
];
};
# Function to create a host. It does basic setup, like adding common modules. # Function to create a host. It does basic setup, like adding common modules.
mkHost = { system, hostname, modules } @args: nixpkgs.lib.nixosSystem { mkHost = { system, hostname, modules } @args: nixpkgs.lib.nixosSystem {
@ -161,7 +152,7 @@
inherit system; inherit system;
# List of modules to use by defualt for all the hosts. # List of modules to use by defualt for all the hosts.
modules = [ modules = modules ++ [
# There I put host-specific configurations. # There I put host-specific configurations.
./host/${hostname} ./host/${hostname}
@ -171,17 +162,22 @@
# Specify current release version. # Specify current release version.
{ system.stateVersion = self.const.stateVersion; } { system.stateVersion = self.const.stateVersion; }
# Add common modules. # Add modules.
inputs.self.nixosModules.common { imports =
(lsFiles ./container) ++
(lsFiles ./module) ++
(lsFiles ./module/common) ++
(lsFiles ./module/desktop) ++
(lsFiles ./overlay) ++
(lsFiles ./user);
}
# Add Home Manager module. # Add Home Manager module.
home-manager.nixosModules.home-manager home-manager.nixosModules.home-manager
# Add Stylix module. # Add Stylix module.
stylix.nixosModules.stylix stylix.nixosModules.stylix
] ];
# Also add host-specific modules from mkHost args.
++ modules;
# SpecialArgs allows you to pass objects down to other NixOS modules. # SpecialArgs allows you to pass objects down to other NixOS modules.
specialArgs = let specialArgs = let
@ -192,14 +188,15 @@
pkgsJobber = nixpkgsJobber.legacyPackages.${system}.pkgs; pkgsJobber = nixpkgsJobber.legacyPackages.${system}.pkgs;
pkgsStable = nixpkgsJobber.legacyPackages.${system}.pkgs; pkgsStable = nixpkgsJobber.legacyPackages.${system}.pkgs;
pkgsMaster = nixpkgsJobber.legacyPackages.${system}.pkgs; pkgsMaster = nixpkgsJobber.legacyPackages.${system}.pkgs;
secret = import ./secret {}; # Secrets (public keys).
container = import ./lib/Container.nix { inherit lib pkgs config; inherit (self) const; }; # Container utils.
util = import ./lib/Util.nix { inherit pkgs lib; }; # Util functions.
in { in {
const = self.const; # Constant values. flake = self;
flake = self; # This Flake itself.
inputs = inputs; # Our dependencies. inherit secret container util inputs;
secret = import ./part/Secret.nix {}; # Secrets (public keys). inherit (self) const;
style = import ./part/Style.nix { inherit config; }; # Style abstraction.
util = import ./part/Util.nix { inherit pkgs lib; }; # Util functions.
wallpaper = import ./part/Wallpaper.nix { inherit pkgs; }; # Wallpaper.
# Stable and Master pkgs. # Stable and Master pkgs.
inherit pkgsStable pkgsMaster; inherit pkgsStable pkgsMaster;
@ -209,110 +206,16 @@
}; };
}; };
# Bellow is the list of all the hosts I currently use. mkSystem = hostname: system: modules: {
# They call the `mkHost` function that I defined above "${hostname}" = mkHost {
# with their specific parameters. inherit hostname system modules;
# You might be interested in `live` and `nixOnDroidConfiguration` };
# for Live ISO and Android configurations respectively.
nixosConfigurations.basic = self.mkHost {
hostname = "basic"; # Hostname to use.
system = "x86_64-linux"; # System architecture.
# Host-specific modules.
modules = [
# Force LTS kernel.
({ pkgs, ... }: { boot.kernelPackages = nixpkgs.lib.mkForce pkgs.linuxPackages; })
];
}; };
nixosConfigurations.dasha = self.mkHost { liveModules = [
hostname = "dasha";
system = "x86_64-linux";
modules = [
./module/AmdGpu.nix
./module/CapsToggle.nix
# ./module/Gnome.nix
./module/IntelCpu.nix
./module/PowersaveIntel.nix
./module/Print.nix
./module/RemoteBuild.nix
./module/StrongSwan.nix
./module/Sway.nix
./module/Tablet.nix
./user/Dasha.nix
];
};
nixosConfigurations.desktop = self.mkHost {
hostname = "desktop";
system = "x86_64-linux";
modules = [
./module/AmdCompute.nix
./module/AmdCpu.nix
./module/AmdGpu.nix
./module/Docker.nix
./module/Ollama.nix
./module/PowersaveAmd.nix
./module/Print.nix
./module/RemoteBuild.nix
./module/Sway.nix
./module/VirtManager.nix
./user/Voronind.nix
];
};
nixosConfigurations.fsight = self.mkHost {
hostname = "fsight";
system = "x86_64-linux";
modules = [
./module/Docker.nix
];
};
nixosConfigurations.home = self.mkHost {
hostname = "home";
system = "x86_64-linux";
modules = [
./module/AmdCpu.nix
./module/AmdGpu.nix
./module/Ftpd.nix
./module/RemoteBuilder.nix
./module/Sway.nix
./user/Voronind.nix
];
};
nixosConfigurations.laptop = self.mkHost {
hostname = "laptop";
system = "x86_64-linux";
modules = [
./module/AmdCpu.nix
./module/AmdGpu.nix
./module/CapsToggle.nix
./module/Gnome.nix
./module/PowersaveAmd.nix
./module/Print.nix
./module/RemoteBuild.nix
./module/StrongSwan.nix
./module/Tablet.nix
./user/Dasha.nix
./user/Voronind.nix
];
};
# Live ISO configuration.
nixosConfigurations.live = self.mkHost {
hostname = "live";
system = "x86_64-linux";
modules = [
# Those are basic modules for Live ISO image.
# You can discover other possible base images here:
# https://github.com/NixOS/nixpkgs/tree/master/nixos/modules/installer/cd-dvd
"${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix" "${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix"
"${nixpkgs}/nixos/modules/installer/cd-dvd/channel.nix" "${nixpkgs}/nixos/modules/installer/cd-dvd/channel.nix"
# This is required for Live ISO in my case because I use NetworkManager,
# but base Live images require this.
{ networking.wireless.enable = nixpkgs.lib.mkForce false; } { networking.wireless.enable = nixpkgs.lib.mkForce false; }
# Override my settings to allow SSH logins using root password. # Override my settings to allow SSH logins using root password.
@ -320,27 +223,29 @@
{ services.openssh.settings.PermitRootLogin = nixpkgs.lib.mkForce "yes"; } { services.openssh.settings.PermitRootLogin = nixpkgs.lib.mkForce "yes"; }
# Disable auto-updates as they are not possible for Live ISO. # Disable auto-updates as they are not possible for Live ISO.
{ systemd.services.autoupdate.enable = nixpkgs.lib.mkForce false; } { module.common.autoupdate.enable = false; }
{ systemd.timers.autoupdate.enable = nixpkgs.lib.mkForce false; }
# Base Live images also require the LTS kernel. # Base Live images also require the LTS kernel.
({ pkgs, ... }: { boot.kernelPackages = nixpkgs.lib.mkForce pkgs.linuxPackages; }) { module.common.kernel.latest = false; }
]; ];
};
nixosConfigurations.work = self.mkHost { x86System = hostname: mkSystem hostname "x86_64-linux" [];
hostname = "work";
system = "x86_64-linux"; x86LiveSystem = hostname: mkSystem hostname "x86_64-linux" liveModules;
modules = [ in
./module/IntelCpu.nix # Bellow is the list of all the hosts I currently use.
./module/PowerlimitThinkpad.nix # They call the `mkSystem` function that I defined above
./module/PowersaveIntel.nix # with their specific parameters.
./module/Print.nix # You might be interested in `live` and `nixOnDroidConfiguration`
./module/RemoteBuild.nix # for Live ISO and Android configurations respectively.
./module/Sway.nix (x86System "dasha") //
./user/Voronind.nix (x86System "desktop") //
]; (x86System "fsight") //
}; (x86System "home") //
(x86System "laptop") //
(x86System "work") //
(x86LiveSystem "live")
;
# Android. # Android.
nixOnDroidConfigurations.default = nix-on-droid.lib.nixOnDroidConfiguration { nixOnDroidConfigurations.default = nix-on-droid.lib.nixOnDroidConfiguration {
@ -348,9 +253,6 @@
# Android release version. # Android release version.
{ system.stateVersion = inputs.self.const.droidStateVersion; } { system.stateVersion = inputs.self.const.droidStateVersion; }
# Common settings.
./part/Setting.nix
# I put all my Android configuration there. # I put all my Android configuration there.
./android ./android
]; ];
@ -364,9 +266,8 @@
const = self.const; # Constant values. const = self.const; # Constant values.
flake = self; # This Flake itself. flake = self; # This Flake itself.
inputs = inputs; # Our dependencies. inputs = inputs; # Our dependencies.
secret = import ./part/Secret.nix {}; # Secrets (public keys). secret = import ./lib/Secret.nix {}; # Secrets (public keys).
style = import ./part/Style.nix { config = import ./part/style/Gruvbox.nix {}; }; # Style abstraction. Stylix is not available for Android so I provide static Gruvbox style. util = import ./lib/Util.nix { inherit pkgs lib; }; # Util functions.
util = import ./part/Util.nix { inherit pkgs lib; }; # Util functions.
}; };
}; };
}; };

View file

@ -1,5 +0,0 @@
# Basic host is a dummy and has no specific configuration.
# I don't really need it, this is just a failsafe that I can definitely install and run.
{ ... }: {
imports = [ ];
}

View file

@ -3,7 +3,15 @@
./Filesystem.nix ./Filesystem.nix
]; ];
# Disable keyd. user.dasha.enable = true;
# services.keyd.enable = lib.mkForce false;
# systemd.services.keyd-application-mapper.enable = lib.mkForce false; module = {
amd.gpu.enable = true;
builder.client.enable = true;
desktop.sway.enable = true;
intel.cpu.enable = true;
print.enable = true;
strongswan.enable = true;
tablet.enable = true;
};
} }

View file

@ -3,8 +3,29 @@
./Filesystem.nix ./Filesystem.nix
]; ];
# Disable docker service. user.voronind.enable = true;
systemd.services.docker-prune.enable = lib.mkForce false;
systemd.services.docker.enable = lib.mkForce false; module = {
systemd.sockets.docker.enable = lib.mkForce false; builder.client.enable = true;
desktop.sway.enable = true;
print.enable = true;
virtmanager.enable = true;
amd = {
compute.enable = true;
cpu.enable = true;
gpu.enable = true;
};
docker = {
enable = true;
autostart = false;
rootless = false;
};
ollama = {
enable = true;
models = [
"llama3"
"llama3:70b"
];
};
};
} }

View file

@ -3,4 +3,6 @@
./Grub.nix ./Grub.nix
./Root.nix ./Root.nix
]; ];
module.docker.enable = true;
} }

View file

@ -1,27 +1,40 @@
{ pkgs { ... }: {
, const container = {
, lib enable = true;
, config
, util module = {
, poetry2nixJobber change.enable = true;
, pkgsJobber cloud.enable = true;
, pkgsMaster ddns.enable = true;
, pkgsStable dns.enable = true;
, ... }: let download.enable = true;
args = let git.enable = true;
# Path where all the container data will be stored. # ISSUE: hdd.enable = true;
home.enable = true;
iot.enable = true;
jobber.enable = true;
mail.enable = true;
# ISSUE: office.enable = true;
paper.enable = true;
pass.enable = true;
paste.enable = true;
postgres.enable = true;
proxy.enable = true;
rabbitmq.enable = true;
read.enable = true;
redis.enable = true;
search.enable = true;
status.enable = true;
stock.enable = true;
vpn.enable = true;
watch.enable = true;
yt.enable = true;
};
storage = "/storage/hot/container"; storage = "/storage/hot/container";
# Domain used to host stuff. All the services will be like `service.${domain}`.
domain = "voronind.com"; domain = "voronind.com";
# External IP address of the host, where all the services will listen to.
host = "192.168.1.2"; host = "192.168.1.2";
interface = "enp7s0";
# External interface where all the services will listen on.
externalInterface = "enp7s0";
# Paths to media content. Later they can be plugged to the containers using the `attachMedia "photo"` function.
media = { media = {
anime = [ "/storage/cold_1/media/anime" "/storage/cold_2/media/anime" ]; anime = [ "/storage/cold_1/media/anime" "/storage/cold_2/media/anime" ];
book = [ "/storage/hot/media/book" ]; book = [ "/storage/hot/media/book" ];
@ -31,59 +44,11 @@
music = [ "/storage/cold_2/media/music" ]; music = [ "/storage/cold_2/media/music" ];
paper = [ "/storage/hot/media/paper" ]; paper = [ "/storage/hot/media/paper" ];
porn = [ "/storage/cold_2/media/porn" ]; porn = [ "/storage/cold_2/media/porn" ];
photo = [ "${storage}/cloud/data/data/cakee/files/media/photo" "/storage/cold_1/backup/tmp/photo" ]; photo = [ "/storage/hot/container/cloud/data/data/cakee/files/media/photo" "/storage/cold_1/backup/tmp/photo" ];
show = [ "/storage/cold_1/media/show" "/storage/cold_2/media/show" ]; show = [ "/storage/cold_1/media/show" "/storage/cold_2/media/show" ];
study = [ "/storage/cold_1/media/study" "/storage/cold_2/media/study" ]; study = [ "/storage/cold_1/media/study" "/storage/cold_2/media/study" ];
work = [ "/storage/cold_2/media/work" ]; work = [ "/storage/cold_2/media/work" ];
youtube = [ "/storage/cold_1/media/youtube" "/storage/cold_2/media/youtube" ]; youtube = [ "/storage/cold_1/media/youtube" "/storage/cold_2/media/youtube" ];
}; };
in {
# Pass all the arguments further.
inherit storage domain host pkgs const lib config util media externalInterface;
inherit poetry2nixJobber pkgsJobber;
inherit pkgsMaster pkgsStable;
# Pass the global container configuration.
container = import ../../container args;
};
in {
# List of containers enabled on this host.
imports = [
(import ../../container/Change.nix args)
(import ../../container/Cloud.nix args)
(import ../../container/Ddns.nix args)
(import ../../container/Dns.nix args)
(import ../../container/Download.nix args)
(import ../../container/Git.nix args)
# (import ../../container/Hdd.nix args)
(import ../../container/Home.nix args)
(import ../../container/Iot.nix args)
(import ../../container/Jobber.nix args)
(import ../../container/Mail.nix args)
(import ../../container/Office.nix args)
(import ../../container/Paper.nix args)
(import ../../container/Pass.nix args)
(import ../../container/Paste.nix args)
(import ../../container/Postgres.nix args)
(import ../../container/Print.nix args)
(import ../../container/Proxy.nix args)
(import ../../container/Rabbitmq.nix args)
(import ../../container/Read.nix args)
(import ../../container/Redis.nix args)
(import ../../container/Search.nix args)
(import ../../container/Status.nix args)
(import ../../container/Stock.nix args)
(import ../../container/Vpn.nix args)
(import ../../container/Watch.nix args)
(import ../../container/Yt.nix args)
];
# This is the network for all the containers.
# They are not available to the external interface by default,
# instead they all expose specific ports in their configuration.
networking.nat = {
enable = true;
internalInterfaces = [ "ve-+" ];
inherit (args) externalInterface;
}; };
} }

View file

@ -1,4 +1,4 @@
{ lib, ... }: { { ... }: {
imports = [ imports = [
./Backup.nix ./Backup.nix
./Container.nix ./Container.nix
@ -7,7 +7,21 @@
./Photoprocess.nix ./Photoprocess.nix
]; ];
user.voronind.enable = true;
module = {
builder.server.enable = true;
desktop.sway.enable = true;
ftpd = {
enable = true;
storage = "/storage/hot/ftp";
};
amd = {
cpu.enable = true;
gpu.enable = true;
};
};
# Disable auto-switch. # Disable auto-switch.
systemd.services.autoupdate.enable = lib.mkForce false; module.common.autoupdate.enable = false;
systemd.timers.autoupdate.enable = lib.mkForce false;
} }

View file

@ -2,4 +2,21 @@
imports = [ imports = [
./Filesystem.nix ./Filesystem.nix
]; ];
user = {
dasha.enable = true;
voronind.enable = true;
};
module = {
builder.client.enable = true;
print.enable = true;
strongswan.enable = true;
tablet.enable = true;
amd = {
compute.enable = true;
cpu.enable = true;
gpu.enable = true;
};
};
} }

View file

@ -1,3 +1 @@
{ ... }: { { ... }: { }
imports = [ ];
}

View file

@ -5,4 +5,14 @@
# Keyd Print to Macro remap. # Keyd Print to Macro remap.
services.keyd.keyboards.default.settings.main.print = "layer(layer_macro)"; services.keyd.keyboards.default.settings.main.print = "layer(layer_macro)";
user.voronind.enable = true;
module = {
builder.client.enable = true;
desktop.sway.enable = true;
intel.cpu.enable = true;
powerlimit.thinkpad.enable = true;
print.enable = true;
};
} }

63
lib/Container.nix Normal file
View file

@ -0,0 +1,63 @@
{ lib, pkgs, const, config, ... }: {
mkContainer = cfg: extra: lib.recursiveUpdate {
# Start containers with the system by default.
autoStart = config.container.autoStart;
# IP Address of the host. This is required for container to have access to the Internet.
hostAddress = config.container.host;
# Container's IP address.
localAddress = cfg.address;
# Isolate container from other hosts.
privateNetwork = true;
} extra;
# Common configuration for the system inside the container.
mkContainerConfig = cfg: extra: lib.recursiveUpdate {
# HACK: Do not evaluate nixpkgs inside the container. Use host's instead.
nixpkgs.pkgs = lib.mkForce pkgs;
# Release version.
system.stateVersion = const.stateVersion;
# Allow passwordless login as root.
users = {
users.root.password = "";
mutableUsers = false;
};
networking = {
# Default DNS servers.
nameservers = [
"1.1.1.1"
];
# HACK: Fix for upstream issue: https://github.com/NixOS/nixpkgs/issues/162686
useHostResolvConf = lib.mkForce false;
# Disable firewall.
firewall.enable = false;
};
} extra;
# Create a directory on the host for container use.
mkContainerDir = cfg: dirs: map (path: "d '${cfg.storage}/${path}' 1777 root root - -") dirs;
# Common configuration for Nginx server.
mkServer = cfg: lib.recursiveUpdate {
forceSSL = false;
} cfg;
# Attach the host media directory to container.
# They will be added to /type/{0..9}
attachMedia = type: ro: builtins.listToAttrs (lib.imap0 (i: path:
{
name = "/${type}/${toString i}";
value = {
hostPath = path;
isReadOnly = ro;
};
}
) config.container.media.${type});
}

View file

@ -30,4 +30,6 @@
stopIfChanged = false; stopIfChanged = false;
unitConfig.X-StopOnRemoval = false; unitConfig.X-StopOnRemoval = false;
}; };
} }

View file

@ -1,5 +1,11 @@
# AMD Rocm support (for Blender). { pkgs, lib, config, ... }: with lib; let
{ nixpkgs, pkgs, ... }: { cfg = config.module.amd.compute;
in {
options = {
module.amd.compute.enable = mkEnableOption "Enable AMD Rocm support i.e. for Blender.";
};
config = mkIf cfg.enable {
nixpkgs.config.rocmSupport = true; nixpkgs.config.rocmSupport = true;
systemd.tmpfiles.rules = [ systemd.tmpfiles.rules = [
"L+ /opt/rocm/hip - - - - ${pkgs.rocmPackages.clr}" "L+ /opt/rocm/hip - - - - ${pkgs.rocmPackages.clr}"
@ -7,4 +13,5 @@
hardware.opengl.extraPackages = with pkgs; [ hardware.opengl.extraPackages = with pkgs; [
rocmPackages.clr.icd rocmPackages.clr.icd
]; ];
};
} }

View file

@ -1,5 +1,27 @@
# AMD CPU specific configuration. { pkgs, lib, config, ... }: with lib; let
{ lib, config, ... }: { cfg = config.module.amd.cpu;
controlFile = "/sys/devices/system/cpu/cpufreq/boost";
enableCmd = "0";
disableCmd = "1";
in {
options = {
module.amd.cpu = {
enable = mkEnableOption "Enable AMD Cpu support.";
powersave.enable = mkEnableOption "Enable AMD Cpu powersave." // { default = true; };
};
};
config = mkIf cfg.enable (mkMerge [
{
boot.kernelModules = [ "kvm-amd" ]; boot.kernelModules = [ "kvm-amd" ];
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; hardware.cpu.amd.updateMicrocode = mkDefault config.hardware.enableRedistributableFirmware;
}
(mkIf cfg.powersave.enable {
module.powersave = {
enable = true;
cpu.boost = { inherit controlFile enableCmd disableCmd; };
};
})
]);
} }

View file

@ -1,6 +1,11 @@
# AMD GPU specific configuration. { pkgs, lib, config, ... }: with lib; let
# No, I do not own any Nvidia/Intel GPUs, so I have no configuration for them. cfg = config.module.amd.gpu;
{ nixpkgs, pkgs, ... }: { in {
options = {
module.amd.gpu.enable = mkEnableOption "Enable AMD Gpu support.";
};
config = mkIf cfg.enable {
boot.initrd.kernelModules = [ "amdgpu" ]; boot.initrd.kernelModules = [ "amdgpu" ];
services.xserver.videoDrivers = [ "amdgpu" ]; services.xserver.videoDrivers = [ "amdgpu" ];
hardware.opengl.driSupport = true; hardware.opengl.driSupport = true;
@ -14,4 +19,5 @@
# hardware.opengl.extraPackages32 = with pkgs; [ # hardware.opengl.extraPackages32 = with pkgs; [
# driversi686Linux.amdvlk # driversi686Linux.amdvlk
# ]; # ];
};
} }

View file

@ -1,6 +0,0 @@
# Toggle language with CapsLock. My wife prefers this.
{ lib, ... }: {
services.xserver.xkb = {
options = lib.mkForce "grp:caps_toggle";
};
}

View file

@ -1,3 +1,41 @@
{ ... }: { { pkgs, lib, config, ... }: with lib; let
cfg = config.module.docker;
in {
options = {
module.docker = {
enable = mkEnableOption "Enable Cocker";
rootless = mkOption {
default = false;
type = types.bool;
};
autostart = mkOption {
default = true;
type = types.bool;
};
};
};
config = mkIf cfg.enable {
virtualisation.docker.enable = true; virtualisation.docker.enable = true;
virtualisation.docker.rootless = mkIf cfg.rootless {
enable = true;
setSocketVariable = true;
};
systemd.services.docker-prune.enable = mkForce cfg.autostart;
systemd.services.docker.enable = mkForce cfg.autostart;
systemd.sockets.docker.enable = mkForce cfg.autostart;
};
# NOTE: mkMerge example.
# config = mkIf cfg.enable (mkMerge [
# { virtualisation.docker.enable = true; }
# (mkIf cfg.rootless {
# virtualisation.docker.rootless = {
# enable = true;
# setSocketVariable = true;
# };
# })
# ]);
} }

View file

@ -1,7 +0,0 @@
{ ... }: {
virtualisation.docker.enable = true;
virtualisation.docker.rootless = {
enable = true;
setSocketVariable = true;
};
}

View file

@ -1,4 +1,17 @@
{ ... }: { { pkgs, lib, config, ... }: with lib; let
cfg = config.module.ftpd;
in {
options = {
module.ftpd = {
enable = mkEnableOption "Enable FTP server";
storage = mkOption {
default = null;
type = types.str;
};
};
};
config = mkIf cfg.enable {
services.vsftpd = { services.vsftpd = {
enable = true; enable = true;
anonymousUser = true; anonymousUser = true;
@ -6,7 +19,7 @@
anonymousUploadEnable = true; anonymousUploadEnable = true;
anonymousMkdirEnable = true; anonymousMkdirEnable = true;
anonymousUmask = "000"; anonymousUmask = "000";
anonymousUserHome = "/storage/hot/ftp"; anonymousUserHome = cfg.storage;
allowWriteableChroot = true; allowWriteableChroot = true;
writeEnable = true; writeEnable = true;
localUsers = false; localUsers = false;
@ -14,4 +27,5 @@
anon_other_write_enable=YES anon_other_write_enable=YES
''; '';
}; };
};
} }

View file

@ -1,48 +0,0 @@
{ pkgs, lib, ... }: {
imports = [
./desktop/App.nix
./desktop/Dconf.nix
./desktop/DisplayManager.nix
./desktop/Sound.nix
./desktop/Wayland.nix
];
services.xserver.displayManager.gdm.enable = true;
services.xserver.desktopManager.gnome.enable = true;
environment.systemPackages = with pkgs; [
gnome.gnome-tweaks # Gnome "hidden" settings.
openssl # It was needed for something, can't remember.
];
# Disable some Gnome apps.
services.gnome.gnome-keyring.enable = lib.mkForce false;
environment.gnome.excludePackages = with pkgs.gnome; [
# baobab # Disk usage analyzer.
# cheese # Photo booth.
# epiphany # Web browser.
# simple-scan # Document scanner.
# totem # Video player.
# yelp # Help viewer.
# file-roller # Archive manager.
# geary # Email client.
# seahorse # Password manager.
# gnome-calculator
# gnome-calendar
# gnome-characters
# gnome-clocks
# gnome-contacts
# gnome-font-viewer
# gnome-keyring
# gnome-logs
# gnome-maps
# gnome-music
# gnome-shell-extensions
gnome-software
# gnome-system-monitor
# gnome-weather
# gnome-disk-utility
# pkgs.gnome-text-editor
];
}

View file

@ -1,4 +1,27 @@
# Intel CPU specific configuration. # Intel CPU specific configuration.
{ ... }: { { pkgs, lib, config, ... }: with lib; let
cfg = config.module.intel.cpu;
controlFile = "/sys/devices/system/cpu/intel_pstate/no_turbo";
enableCmd = "1";
disableCmd = "0";
in {
options = {
module.intel.cpu = {
enable = mkEnableOption "Support for Shintel CPUs";
powersave.enable = mkEnableOption "Enable Shintel Cpu powersave." // { default = true; };
};
};
config = mkIf cfg.enable (mkMerge [
{
boot.kernelModules = [ "kvm-intel" ]; boot.kernelModules = [ "kvm-intel" ];
} }
(mkIf cfg.powersave.enable {
module.powersave = {
enable = true;
cpu.boost = { inherit controlFile enableCmd disableCmd; };
};
})
]);
}

View file

@ -1,13 +1,29 @@
# https://github.com/ollama/ollama # https://github.com/ollama/ollama
{ pkgsStable, lib, config, ... }: let { pkgsStable, lib, config, ... }: with lib; let
pkgs = pkgsStable; pkgs = pkgsStable;
cfg = config.module.ollama;
in { in {
options = {
module.ollama = {
enable = mkEnableOption "Local LLM server";
primaryModel = mkOption {
default = "llama3";
type = types.str;
};
models = mkOption {
default = [ cfg.primaryModel ];
type = types.listOf types.str;
};
};
};
config = mkIf cfg.enable {
environment = { environment = {
# Add Ollama CLI app. # Add Ollama CLI app.
systemPackages = with pkgs; [ ollama ]; systemPackages = with pkgs; [ ollama ];
# Specify default model. # Specify default model.
variables.OLLAMA_MODEL = config.setting.ollama.primaryModel; variables.OLLAMA_MODEL = cfg.primaryModel;
}; };
# Enable Ollama server. # Enable Ollama server.
@ -18,7 +34,7 @@ in {
after = [ "NetworkManager-wait-online.service" ]; after = [ "NetworkManager-wait-online.service" ];
serviceConfig.Type = "simple"; serviceConfig.Type = "simple";
script = '' script = ''
HOME=/root ${lib.getExe pkgs.ollama} serve HOME=/root ${getExe pkgs.ollama} serve
''; '';
}; };
@ -31,7 +47,8 @@ in {
serviceConfig.Type = "simple"; serviceConfig.Type = "simple";
script = '' script = ''
sleep 5 sleep 5
${lib.getExe pkgs.ollama} pull ${config.setting.ollama.primaryModel} ${getExe pkgs.ollama} pull ${concatStringsSep " " cfg.models}
''; '';
}; };
};
} }

24
module/Podman.nix Normal file
View file

@ -0,0 +1,24 @@
{ lib, config, ... }: with lib; let
cfg = config.module.podman;
in {
options = {
module.podman = {
enable = mkEnableOption "OCI Podman.";
};
};
config = mkIf cfg.enable {
virtualisation = {
podman = {
enable = true;
# Free the 53 port ffs.
defaultNetwork.settings.dns_enabled = false;
# Do not interfere with Docker so we can have both installed at the same time.
# Podman can't replace Docker anyway.
dockerCompat = false;
};
};
};
}

View file

@ -1,22 +1,79 @@
# ThinkPad charge limits. # ThinkPad charge limits.
{ pkgs, lib, ... } @args: let { pkgs, lib, config, ... } @args: with lib; let
cfg = config.module.powerlimit.thinkpad;
controlFileMin = "/sys/class/power_supply/BAT0/charge_control_start_threshold"; controlFileMin = "/sys/class/power_supply/BAT0/charge_control_start_threshold";
controlFileMax = "/sys/class/power_supply/BAT0/charge_control_end_threshold"; controlFileMax = "/sys/class/power_supply/BAT0/charge_control_end_threshold";
onMin = "40"; script = pkgs.writeShellScriptBin "powerlimit" ''
onMax = "80"; function toggle() {
offMin = "90"; if status; then
offMax = "95"; echo ${toString cfg.offMax} > ${controlFileMax}
echo ${toString cfg.offMin} > ${controlFileMin}
else
echo ${toString cfg.onMin} > ${controlFileMin}
echo ${toString cfg.onMax} > ${controlFileMax}
fi
script = pkgs.writeShellScriptBin "powerlimit" (import ./powerlimit/Script.nix { true
inherit controlFileMax controlFileMin onMin onMax offMin offMax; }
}).script;
in { function waybar() {
imports = [ status || echo -n ""
(import ./powerlimit ({ }
inherit controlFileMax controlFileMin onMin onMax offMin offMax;
} // args)) function status() {
]; local current=$(cat ${controlFileMax})
local enabled="${toString cfg.onMax}"
environment.systemPackages = [ script ];
[[ "''${current}" = "''${enabled}" ]]
}
''${@}
'';
in {
options = {
module.powerlimit.thinkpad = {
enable = mkEnableOption "Powerlimit Service";
onMin = mkOption {
default = 40;
type = types.int;
};
onMax = mkOption {
default = 80;
type = types.int;
};
offMin = mkOption {
default = 90;
type = types.int;
};
offMax = mkOption {
default = 95;
type = types.int;
};
};
};
config = mkIf cfg.enable {
environment.systemPackages = [ script ];
systemd = {
services.powerlimit = {
description = "Limit battery charge.";
enable = true;
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "simple";
RemainAfterExit = "yes";
ExecStart = "${getExe pkgs.bash} -c 'echo ${toString cfg.onMin} > ${controlFileMin}; echo ${toString cfg.onMax} > ${controlFileMax};'";
ExecStop = "${getExe pkgs.bash} -c 'echo ${toString cfg.offMax} > ${controlFileMax}; echo ${toString cfg.offMin} > ${controlFileMin};'";
};
};
# HACK: Allow user access.
tmpfiles.rules = [
"z ${controlFileMax} 0777 - - - -"
"z ${controlFileMin} 0777 - - - -"
];
};
};
} }

73
module/Powersave.nix Normal file
View file

@ -0,0 +1,73 @@
{ lib, config, pkgs, ... }: with lib; let
cfg = config.module.powersave;
script = pkgs.writeShellScriptBin "powersave" ''
function toggle() {
if status; then
echo ${cfg.cpu.boost.disableCmd} > ${cfg.cpu.boost.controlFile}
else
echo ${cfg.cpu.boost.enableCmd} > ${cfg.cpu.boost.controlFile}
fi
true
}
function waybar() {
status || echo -n "󰓅"
}
function status() {
local current=$(cat ${cfg.cpu.boost.controlFile})
local enabled="${cfg.cpu.boost.enableCmd}"
[[ "''${current}" = "''${enabled}" ]]
}
''${@}
'';
in {
options = {
module.powersave = {
enable = mkEnableOption "Powersave";
cpu.boost = mkOption {
default = {};
type = types.submodule {
options = {
disableCmd = mkOption {
default = null;
type = types.str;
};
enableCmd = mkOption {
default = null;
type = types.str;
};
controlFile = mkOption {
default = null;
type = types.str;
};
};
};
};
};
};
config = mkIf cfg.enable {
environment.systemPackages = [ script ];
systemd = {
services.powersave-cpu = {
description = "Disable CPU Boost";
enable = true;
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "simple";
RemainAfterExit = "yes";
ExecStart = "${getExe pkgs.bash} -c 'echo ${cfg.cpu.boost.enableCmd} > ${cfg.cpu.boost.controlFile}'";
ExecStop = "${getExe pkgs.bash} -c 'echo ${cfg.cpu.boost.disableCmd} > ${cfg.cpu.boost.controlFile}'";
};
};
# HACK: Allow user access.
tmpfiles.rules = [ "z ${cfg.cpu.boost.controlFile} 0777 - - - -" ];
};
};
}

View file

@ -1,21 +0,0 @@
# AMD CPU boost control.
{ pkgs, ... } @args: let
controlFile = "/sys/devices/system/cpu/cpufreq/boost";
enable = "0";
disable = "1";
script = pkgs.writeShellScriptBin "powersave" (import ./powersave/Script.nix {
inherit controlFile enable disable;
}).script;
in {
# Requirements:
# CPPC (Collaborative Power Control) - Disabled.
# PSS (Cool and Quiet) - Enabled.
imports = [
(import ./powersave ({
inherit controlFile enable disable;
} // args))
];
environment.systemPackages = [ script ];
}

View file

@ -1,18 +0,0 @@
# Intel CPU boost control.
{ pkgs, ... } @args: let
controlFile = "/sys/devices/system/cpu/intel_pstate/no_turbo";
enable = "1";
disable = "0";
script = pkgs.writeShellScriptBin "powersave" (import ./powersave/Script.nix {
inherit controlFile enable disable;
}).script;
in {
imports = [
(import ./powersave ({
inherit controlFile enable disable;
} // args))
];
environment.systemPackages = [ script ];
}

View file

@ -1,4 +1,11 @@
{ ... }: { { pkgs, lib, config, ... }: with lib; let
cfg = config.module.print;
in {
options = {
module.print.enable = mkEnableOption "Add support for printers.";
};
config = mkIf cfg.enable {
services.printing = { services.printing = {
enable = true; enable = true;
clientConf = '' clientConf = ''
@ -6,4 +13,5 @@
ServerName 192.168.1.2 ServerName 192.168.1.2
''; '';
}; };
};
} }

View file

@ -1,5 +1,53 @@
# Module that enables remote builds. This is a client configuration. # Module that enables remote builds. This is a client configuration.
{ lib, secret, ... }: { { pkgs, lib, config, secret, ... }: with lib; let
cfg = config.module.builder;
serverKeyPath = "/root/.nixbuilder";
in {
options = {
module.builder = {
server.enable = mkEnableOption "This is a builder server.";
client.enable = mkEnableOption "This is a builder client.";
};
};
config = mkMerge [
(mkIf cfg.server.enable {
# Service that generates new key on boot if not present.
# Don't forget to add new key to secret.ssh.buildKeys.
systemd.services.generate-nix-cache-key = {
wantedBy = [ "multi-user.target" ];
serviceConfig.Type = "oneshot";
path = [ pkgs.nix ];
script = ''
[[ -f "${serverKeyPath}/private-key" ]] && exit
mkdir ${serverKeyPath} || true
nix-store --generate-binary-cache-key "nixbuilder-1" "${serverKeyPath}/private-key" "${serverKeyPath}/public-key"
nix store sign --all -k "${serverKeyPath}/private-key"
'';
};
# Add `nixbuilder` restricted user.
users.groups.nixbuilder = {};
users.users.nixbuilder = {
openssh.authorizedKeys.keys = secret.ssh.buildKeys;
description = "Nix Remote Builder";
isNormalUser = true;
createHome = lib.mkForce false;
uid = 1234;
home = "/";
group = "nixbuilder";
};
# Sign store automatically.
# Sign existing store with: nix store sign --all -k /path/to/secret-key-file
nix.settings = {
trusted-users = [ "nixbuilder" ];
secret-key-files = [ "${serverKeyPath}/private-key" ];
};
})
(mkIf cfg.client.enable {
# NOTE: Requires host private key to be present in secret.ssh.builderKeys. # NOTE: Requires host private key to be present in secret.ssh.builderKeys.
nix.buildMachines = [{ nix.buildMachines = [{
hostName = "nixbuilder"; hostName = "nixbuilder";
@ -18,7 +66,7 @@
nix.settings = let nix.settings = let
substituters = [ "ssh-ng://nixbuilder" ]; substituters = [ "ssh-ng://nixbuilder" ];
in { in {
substituters = lib.mkForce substituters; substituters = mkForce substituters;
trusted-substituters = substituters; trusted-substituters = substituters;
builders-use-substitutes = true; builders-use-substitutes = true;
max-jobs = 0; max-jobs = 0;
@ -26,4 +74,6 @@
# require-sigs = false; # require-sigs = false;
# substitute = false; # substitute = false;
}; };
})
];
} }

View file

@ -1,37 +0,0 @@
# Module that enables remote builds. This is a server configuration.
{ pkgs, secret, lib, ... }: let
keyPath = "/root/.nixbuilder";
in {
# Service that generates new key on boot if not present.
# Don't forget to add new key to secret.ssh.buildKeys.
systemd.services.generate-nix-cache-key = {
wantedBy = [ "multi-user.target" ];
serviceConfig.Type = "oneshot";
path = [ pkgs.nix ];
script = ''
[[ -f "${keyPath}/private-key" ]] && exit
mkdir ${keyPath} || true
nix-store --generate-binary-cache-key "nixbuilder-1" "${keyPath}/private-key" "${keyPath}/public-key"
nix store sign --all -k "${keyPath}/private-key"
'';
};
# Add `nixbuilder` restricted user.
users.groups.nixbuilder = {};
users.users.nixbuilder = {
openssh.authorizedKeys.keys = secret.ssh.buildKeys;
description = "Nix Remote Builder";
isNormalUser = true;
createHome = lib.mkForce false;
uid = 1234;
home = "/";
group = "nixbuilder";
};
# Sign store automatically.
# Sign existing store with: nix store sign --all -k /path/to/secret-key-file
nix.settings = {
trusted-users = [ "nixbuilder" ];
secret-key-files = [ "${keyPath}/private-key" ];
};
}

View file

@ -5,6 +5,8 @@
,lib ,lib
, ... }: { , ... }: {
options.setting = with lib; { options.setting = with lib; {
# Ollama settings.
# I use the best light model by default.
ollama = mkOption { ollama = mkOption {
default = { }; default = { };
type = types.submodule { type = types.submodule {
@ -18,6 +20,7 @@
}; };
}; };
# Default browser settings.
browser = mkOption { browser = mkOption {
default = { }; default = { };
type = types.submodule { type = types.submodule {
@ -30,6 +33,7 @@
}; };
}; };
# Terminal settings.
terminal = mkOption { terminal = mkOption {
default = { }; default = { };
type = types.submodule { type = types.submodule {
@ -42,16 +46,19 @@
}; };
}; };
# Whether to use Dpi-aware setting in supported apps.
dpiAware = mkOption { dpiAware = mkOption {
default = false; default = false;
type = types.bool; type = types.bool;
}; };
# The key used for system-related shortcuts.
sysctrl = mkOption { sysctrl = mkOption {
default = "print"; default = "print";
type = types.str; type = types.str;
}; };
# Keyboard options.
keyboard = mkOption { keyboard = mkOption {
default = { }; default = { };
type = types.submodule { type = types.submodule {
@ -68,6 +75,7 @@
}; };
}; };
# Settings related to different refreshes, like top apps.
refresh = mkOption { refresh = mkOption {
default = { }; default = { };
type = types.submodule { type = types.submodule {
@ -80,6 +88,7 @@
}; };
}; };
# Configure steps for different actions.
step = mkOption { step = mkOption {
default = { }; default = { };
type = types.submodule { type = types.submodule {
@ -100,6 +109,7 @@
}; };
}; };
# Specify timeouts.
timeout = mkOption { timeout = mkOption {
default = { }; default = { };
type = types.submodule { type = types.submodule {

View file

@ -1,4 +1,11 @@
{ pkgs, ... }: { { pkgs, lib, config, ... }: with lib; let
cfg = config.module.strongswan;
in {
options = {
module.strongswan.enable = mkEnableOption "StrongSwan Vpn support.";
};
config = mkIf cfg.enable {
environment.systemPackages = with pkgs; [ environment.systemPackages = with pkgs; [
networkmanager-l2tp networkmanager-l2tp
gnome.networkmanager-l2tp gnome.networkmanager-l2tp
@ -18,4 +25,5 @@
# systemd.tmpfiles.rules = [ # systemd.tmpfiles.rules = [
# "L /etc/ipsec.secrets - - - - /etc/ipsec.d/ipsec.nm-l2tp.secrets" # "L /etc/ipsec.secrets - - - - /etc/ipsec.d/ipsec.nm-l2tp.secrets"
# ]; # ];
};
} }

91
module/Style.nix Normal file
View file

@ -0,0 +1,91 @@
{ pkgs, lib, config, ... }: with lib; let
cfg = config.module.style;
in {
options = let
mkTypeOption = default: type: mkOption { inherit default type; };
mkStrOption = default: mkTypeOption default types.str;
mkIntOption = default: mkTypeOption default types.int;
mkFloatOption = default: mkTypeOption default types.float;
in {
module.style = {
color = {
bg = {
dark = mkStrOption config.lib.stylix.colors.base00;
light = mkStrOption config.lib.stylix.colors.base07;
regular = mkStrOption config.lib.stylix.colors.base01;
};
fg = {
dark = mkStrOption config.lib.stylix.colors.base04;
light = mkStrOption config.lib.stylix.colors.base06;
regular = mkStrOption config.lib.stylix.colors.base05;
};
accent = mkStrOption config.lib.stylix.colors.base0A;
heading = mkStrOption config.lib.stylix.colors.base0D;
hl = mkStrOption config.lib.stylix.colors.base03;
keyword = mkStrOption config.lib.stylix.colors.base0E;
link = mkStrOption config.lib.stylix.colors.base09;
misc = mkStrOption config.lib.stylix.colors.base0F;
negative = mkStrOption config.lib.stylix.colors.base08;
neutral = mkStrOption config.lib.stylix.colors.base0C;
positive = mkStrOption config.lib.stylix.colors.base0B;
selection = mkStrOption config.lib.stylix.colors.base02;
transparent = mkStrOption "ffffff00";
accent-b = mkStrOption config.lib.stylix.colors.base0A-rgb-b;
accent-g = mkStrOption config.lib.stylix.colors.base0A-rgb-g;
accent-r = mkStrOption config.lib.stylix.colors.base0A-rgb-r;
negative-b = mkStrOption config.lib.stylix.colors.base08-rgb-b;
negative-g = mkStrOption config.lib.stylix.colors.base08-rgb-g;
negative-r = mkStrOption config.lib.stylix.colors.base08-rgb-r;
neutral-b = mkStrOption config.lib.stylix.colors.base0C-rgb-b;
neutral-g = mkStrOption config.lib.stylix.colors.base0C-rgb-g;
neutral-r = mkStrOption config.lib.stylix.colors.base0C-rgb-r;
positive-b = mkStrOption config.lib.stylix.colors.base0B-rgb-b;
positive-g = mkStrOption config.lib.stylix.colors.base0B-rgb-g;
positive-r = mkStrOption config.lib.stylix.colors.base0B-rgb-r;
bg-b = mkStrOption config.lib.stylix.colors.base00-rgb-b;
bg-g = mkStrOption config.lib.stylix.colors.base00-rgb-g;
bg-r = mkStrOption config.lib.stylix.colors.base00-rgb-r;
fg-b = mkStrOption config.lib.stylix.colors.base06-rgb-b;
fg-g = mkStrOption config.lib.stylix.colors.base06-rgb-g;
fg-r = mkStrOption config.lib.stylix.colors.base06-rgb-r;
border = mkStrOption config.lib.stylix.colors.base01;
border-b = mkStrOption config.lib.stylix.colors.base01-rgb-b;
border-g = mkStrOption config.lib.stylix.colors.base01-rgb-g;
border-r = mkStrOption config.lib.stylix.colors.base01-rgb-r;
};
font = {
emoji.name = mkStrOption config.stylix.fonts.emoji.name;
monospace.name = mkStrOption config.stylix.fonts.monospace.name;
sansSerif.name = mkStrOption config.stylix.fonts.sansSerif.name;
serif.name = mkStrOption config.stylix.fonts.serif.name;
size = {
terminal = mkIntOption config.stylix.fonts.sizes.terminal;
popup = mkIntOption config.stylix.fonts.sizes.popups;
application = mkIntOption config.stylix.fonts.sizes.applications;
desktop = mkIntOption config.stylix.fonts.sizes.desktop;
};
};
opacity = {
application = mkFloatOption config.stylix.opacity.applications;
desktop = mkFloatOption config.stylix.opacity.desktop;
popup = mkFloatOption config.stylix.opacity.popups;
terminal = mkFloatOption config.stylix.opacity.terminal;
hex = mkStrOption "D9";
};
window = {
gap = mkIntOption 8;
border = mkIntOption 4;
};
};
};
}

View file

@ -1,43 +0,0 @@
{ pkgs, lib, ... } @args: let
sway = import ./desktop/sway args;
config = pkgs.writeText "swayConfig" sway.config;
script = pkgs.writeShellScriptBin "swayscript" sway.script;
in {
imports = [
./desktop/App.nix
./desktop/Bluetooth.nix
./desktop/Brightness.nix
./desktop/Dconf.nix
./desktop/Portal.nix
./desktop/Realtime.nix
./desktop/Sound.nix
./desktop/Waybar.nix
./desktop/Wayland.nix
];
services.gnome.gnome-keyring.enable = lib.mkForce false;
environment = {
systemPackages = with pkgs; [
fuzzel # Application launcher.
grim slurp # Screenshot.
mako # Notification system.
networkmanagerapplet # Internet configuration.
pamixer pavucontrol pulseaudio # Audio.
playerctl # Multimedia controls.
script # My custom Sway shell scripts.
];
variables.XDG_CURRENT_DESKTOP = "sway";
};
programs.sway = {
enable = true;
wrapperFeatures = {
base = true;
gtk = true;
};
extraOptions = [
"--config=${config}"
];
};
}

View file

@ -1,6 +1,14 @@
{ pkgs, ... }: { { pkgs, lib, config, ... }: with lib; let
cfg = config.module.tablet;
in {
options = {
module.tablet.enable = mkEnableOption "Support for tables.";
};
config = mkIf cfg.enable {
hardware.opentabletdriver.enable = true; hardware.opentabletdriver.enable = true;
environment.systemPackages = with pkgs; [ environment.systemPackages = with pkgs; [
krita krita
]; ];
};
} }

View file

@ -1,4 +1,11 @@
{ pkgs, ... }: { { pkgs, lib, config, ... }: with lib; let
cfg = config.module.virtmanager;
in {
options = {
module.virtmanager.enable = mkEnableOption "VM support.";
};
config = mkIf cfg.enable {
virtualisation.libvirtd.enable = true; virtualisation.libvirtd.enable = true;
programs.virt-manager.enable = true; programs.virt-manager.enable = true;
@ -8,4 +15,5 @@
# glib # glib
gnome3.adwaita-icon-theme # default gnome cursors, gnome3.adwaita-icon-theme # default gnome cursors,
]; ];
};
} }

View file

@ -1,8 +1,17 @@
# I want to pull all the Apk files in their current state # I want to pull all the Apk files in their current state
# so that I always have an access to clients that match # so that I always have an access to clients that match
# my service versions. # my service versions.
{ pkgs, ... } @args: let { pkgs, lib, config, ... } @args: with lib; let
cfg = config.module.common.apks;
package = (pkgs.callPackage ./apks args); package = (pkgs.callPackage ./apks args);
in { in {
options = {
module.common.apks = {
enable = mkEnableOption "Android Apps Apk" // { default = true; };
};
};
config = mkIf cfg.enable {
environment.etc.apks.source = package; environment.etc.apks.source = package;
};
} }

View file

@ -2,7 +2,16 @@
# This is a systemd service that pulls updates every hour. # This is a systemd service that pulls updates every hour.
# Unlike system.autoUpgrade, this script also verifies my git signature # Unlike system.autoUpgrade, this script also verifies my git signature
# to prevent unathorized changes to hosts. # to prevent unathorized changes to hosts.
{ const, pkgs, lib, secret, util, ... }: { { const, pkgs, lib, util, config, ... }: with lib; let
cfg = config.module.common.autoupdate;
in {
options = {
module.common.autoupdate = {
enable = mkEnableOption "System auto-updates." // { default = true; };
};
};
config = mkIf cfg.enable {
systemd.services.autoupdate = util.mkStaticSystemdService { systemd.services.autoupdate = util.mkStaticSystemdService {
enable = true; enable = true;
description = "Signed system auto-update."; description = "Signed system auto-update.";
@ -17,13 +26,13 @@
script = '' script = ''
pushd /tmp pushd /tmp
rm -rf ./nixos rm -rf ./nixos
${lib.getExe pkgs.git} clone --depth=1 --single-branch --branch=main ${const.url} ./nixos ${getExe pkgs.git} clone --depth=1 --single-branch --branch=main ${const.url} ./nixos
pushd ./nixos pushd ./nixos
${lib.getExe pkgs.git} verify-commit HEAD || { ${getExe pkgs.git} verify-commit HEAD || {
echo "Verification failed." echo "Verification failed."
exit 1 exit 1
}; };
${lib.getExe pkgs.gnumake} switch ${getExe pkgs.gnumake} switch
''; '';
after = [ "network-online.target" ]; after = [ "network-online.target" ];
wants = [ "network-online.target" ]; wants = [ "network-online.target" ];
@ -39,4 +48,5 @@
}; };
wantedBy = [ "timers.target" ]; wantedBy = [ "timers.target" ];
}; };
};
} }

View file

@ -1,4 +1,4 @@
{ lib, style, util, pkgs, ... } @args: let { lib, util, pkgs, ... } @args: let
bash = import ./bash args; bash = import ./bash args;
in { in {
# Add my bash configuration to all *interactive* shells. # Add my bash configuration to all *interactive* shells.

View file

@ -1,8 +1,16 @@
{ pkgs, ... }: { { pkgs, lib, config, ... }: with lib; let
# Distrobox works best with Podman, so enable it here. cfg = config.module.common.distrobox;
imports = [ ./Podman.nix ]; in {
options = {
module.common.distrobox = {
enable = mkEnableOption "Distrobox." // { default = true; };
};
};
environment.systemPackages = with pkgs; [ config = mkIf cfg.enable {
distrobox # Distrobox works best with Podman, so enable it here.
]; module.podman.enable = true;
environment.systemPackages = with pkgs; [ distrobox ];
};
} }

View file

@ -13,6 +13,7 @@
}; };
# /etc overlay. # /etc overlay.
# ISSUE: Should be fixed when you read this. Try it!
# boot.initrd.systemd.enable = true; # boot.initrd.systemd.enable = true;
# systemd.sysusers.enable = true; # systemd.sysusers.enable = true;
# system.etc.overlay = { # system.etc.overlay = {

View file

@ -1,7 +1,22 @@
{ pkgs, ... }: { { pkgs, config, lib, ... }: with lib; let
cfg = config.module.common.kernel;
in {
options = {
module.common.kernel = {
latest = mkOption {
default = true;
type = types.bool;
};
};
};
config = mkMerge [
(mkIf cfg.latest {
# Use latest kernel. # Use latest kernel.
boot.kernelPackages = pkgs.linuxPackages_latest; boot.kernelPackages = pkgs.linuxPackages_latest;
})
{
boot.kernel.sysctl = { boot.kernel.sysctl = {
# # Spoof protection. # # Spoof protection.
# "net.ipv4.conf.default.rp_filter" = 1; # "net.ipv4.conf.default.rp_filter" = 1;
@ -57,3 +72,5 @@
# "net.ipv6.conf.eth0.disable_ipv6" = 1; # "net.ipv6.conf.eth0.disable_ipv6" = 1;
}; };
} }
];
}

View file

@ -1,4 +1,13 @@
{ pkgs, config, ... }: { { pkgs, config, lib, ... }: with lib; let
cfg = config.module.common.keyd;
in {
options = {
module.common.keyd = {
enable = mkEnableOption "Keyboard remaps." // { default = true; };
};
};
config = mkIf cfg.enable {
environment.systemPackages = with pkgs; [ keyd ]; environment.systemPackages = with pkgs; [ keyd ];
services.keyd = { services.keyd = {
@ -85,4 +94,5 @@
# Debug toggle just in case I need it again. # Debug toggle just in case I need it again.
# systemd.services.keyd.environment.KEYD_DEBUG = "1"; # systemd.services.keyd.environment.KEYD_DEBUG = "1";
};
} }

Some files were not shown because too many files have changed in this diff Show more