voronind/nix
0
0
Fork 0
Code Issues 41 Pull requests Packages Projects Releases Wiki Activity

Rewrite modules to options.

Browse source
This commit is contained in:
Dmitry Voronin 2024-06-25 04:04:39 +03:00 committed by Dmitry Voronin
parent fa4b3c31b7
commit 8c7578075f
Signed by: voronind
SSH key fingerprint: SHA256:3kBb4iV2ahufEBNq+vFbUe4QYfHt98DHQjN7QaptY9k
158 changed files with 3802 additions and 3011 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
Readme.md
View file

@ -20,7 +20,7 @@
<a href="https://i.imgur.com/H943DFl.jpeg">Wallpaper link</a>
</details>
[My current wallpaper](https://git.voronind.com/voronind/nixos/src/branch/main/part/Wallpaper.nix#L2)
[My current wallpaper](https://git.voronind.com/voronind/nixos/src/branch/main/module/common/Wallpaper.nix#L2)
Color theming based on wallpaper thanks to [Stylix](https://github.com/danth/stylix).

6
android/Termux.nix
View file

@ -1,11 +1,11 @@
{ pkgs, style, util, ... }: {
{ pkgs, config, util, ... }: {
font = pkgs.runCommandNoCC "font" {} ''
cp ${pkgs.nerdfonts.override { fonts = [ "Terminus" ]; }}/share/fonts/truetype/NerdFonts/TerminessNerdFontMono-Regular.ttf $out
'';
colors = util.trimTabs ''
background=#${style.color.bg.dark}
foreground=#${style.color.fg.light}
background=#${config.module.style.color.bg.dark}
foreground=#${config.module.style.color.fg.light}
'';
initScript = util.trimTabs ''

0
part/style/Gruvbox.nix → android/style/Gruvbox.nix
View file

28
container/Change.nix
View file

@ -1,6 +1,29 @@
{ container, ... } @args: let
cfg = container.config.change;
{ container, lib, config, ... } @args: with lib; let
cfg = config.container.module.change;
in {
options = {
container.module.change = {
enable = mkEnableOption "Change detection service";
address = mkOption {
default = "10.1.0.41";
type = types.str;
};
port = mkOption {
default = 5000;
type = types.int;
};
domain = mkOption {
default = "change.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/change";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data"
];
@ -22,4 +45,5 @@ in {
};
};
};
};
}

35
container/Cloud.nix
View file

@ -1,6 +1,32 @@
{ container, pkgs, ... } @args: let
cfg = container.config.cloud;
{ container, pkgs, lib, config, ... } @args: with lib; let
cfg = config.container.module.cloud;
postgres = config.container.module.postgres;
proxy = config.container.module.proxy;
in {
options = {
container.module.cloud = {
enable = mkEnableOption "File cloud service";
address = mkOption {
default = "10.1.0.13";
type = types.str;
};
port = mkOption {
default = 80;
type = types.int;
};
domain = mkOption {
default = "cloud.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/cloud";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data"
];
@ -26,7 +52,7 @@ in {
adminuser = "root";
adminpassFile = "${pkgs.writeText "NextcloudPassword" "root"}";
dbhost = container.config.postgres.address;
dbhost = postgres.address;
dbname = "nextcloud";
dbpassFile = "${pkgs.writeText "NextcloudDbPassword" "nextcloud"}";
dbtype = "pgsql";
@ -38,10 +64,11 @@ in {
extraAppsEnable = true;
settings = {
trusted_domains = [ cfg.address cfg.domain ];
trusted_proxies = [ container.config.proxy.address ];
trusted_proxies = [ proxy.address ];
allow_local_remote_servers = true;
};
};
};
};
};
}

24
container/Ddns.nix
View file

@ -1,6 +1,21 @@
{ container, domain, ... } @args: let
cfg = container.config.ddns;
{ container, lib, config, ... } @args: with lib; let
cfg = config.container.module.ddns;
in {
options = {
container.module.ddns = {
enable = mkEnableOption "Dynamic dns client.";
address = mkOption {
default = "10.1.0.31";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/ddns";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data"
];
@ -21,7 +36,9 @@ in {
ipv4 = true;
ipv6 = false;
proxied = false;
domains = [ domain ] ++ map (sub: "${sub}.${domain}") [
domains = let
domain = config.container.domain;
in [ domain ] ++ map (sub: "${sub}.${domain}") [
"cloud"
"git"
"mail"
@ -33,4 +50,5 @@ in {
};
};
};
};
}

39
container/Dns.nix
View file

@ -1,20 +1,35 @@
{ container, pkgs, ... } @args: let
cfg = container.config.dns;
{ container, pkgs, lib, config, ... } @args: with lib; let
cfg = config.container.module.dns;
in {
options = {
container.module.dns = {
enable = mkEnableOption "Dns server.";
address = mkOption {
default = "10.1.0.6";
type = types.str;
};
port = mkOption {
default = 53;
type = types.int;
};
};
};
config = mkIf cfg.enable {
containers.dns = container.mkContainer cfg {
forwardPorts = [
{
containerPort = 53;
hostPort = 53;
containerPort = cfg.port;
hostPort = cfg.port;
protocol = "udp";
} {
containerPort = 53;
hostPort = 53;
containerPort = cfg.port;
hostPort = cfg.port;
protocol = "tcp";
}
];
config = { lib, ... }: container.mkContainerConfig cfg {
config = { ... }: container.mkContainerConfig cfg {
environment.systemPackages = [
pkgs.cloudflared
];
@ -25,7 +40,7 @@ in {
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "simple";
ExecStart = "${lib.getExe pkgs.cloudflared} proxy-dns --port 5054";
ExecStart = "${getExe pkgs.cloudflared} proxy-dns --port 5054";
};
};
@ -102,11 +117,13 @@ in {
};
customDNS = {
mapping = {
"voronind.com" = "192.168.1.2";
# All subdomains to current host.
${config.container.domain} = config.container.host;
};
};
port = "53";
httpPort = "80";
port = cfg.port;
# httpPort = "80";
};
};
};
};

37
container/Download.nix
View file

@ -1,7 +1,33 @@
{ container, lib, ... } @args: let
cfg = container.config.download;
memLimit = "4G";
{ container, lib, config, ... }: with lib; let
cfg = config.container.module.download;
in {
options = {
container.module.download = {
enable = mkEnableOption "Downloader.";
address = mkOption {
default = "10.1.0.12";
type = types.str;
};
port = mkOption {
default = 8112;
type = types.int;
};
domain = mkOption {
default = "download.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/download";
type = types.str;
};
memLimit = mkOption {
default = "4G";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data"
];
@ -14,7 +40,7 @@ in {
hostPath = "${cfg.storage}/data";
isReadOnly = false;
};
} // container.attachMedia "download" cfg.download false;
} // container.attachMedia "download" false;
config = { ... }: container.mkContainerConfig cfg {
services.deluge = {
@ -23,7 +49,8 @@ in {
web.enable = true;
};
systemd.services.deluged.serviceConfig.MemoryLimit = memLimit;
systemd.services.deluged.serviceConfig.MemoryLimit = cfg.memLimit;
};
};
};
}

30
container/Git.nix
View file

@ -1,6 +1,29 @@
{ container, pkgs, ... } @args: let
cfg = container.config.git;
{ container, pkgs, config, lib, ... }: with lib; let
cfg = config.container.module.git;
in {
options = {
container.module.git = {
enable = mkEnableOption "Git server.";
address = mkOption {
default = "10.1.0.8";
type = types.str;
};
port = mkOption {
default = 3000;
type = types.int;
};
domain = mkOption {
default = "git.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/git";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data"
];
@ -21,7 +44,7 @@ in {
stateDir = "/var/lib/gitea";
database = let
postgre = container.config.postgres;
postgre = config.container.module.postgres;
in {
type = "postgres";
host = postgre.address;
@ -72,4 +95,5 @@ in {
};
};
};
};
}

28
container/Hdd.nix
View file

@ -1,7 +1,30 @@
# ISSUE: Broken, can't read/write sda device.
{ container, pkgs, ... } @args: let
cfg = container.config.hdd;
{ container, pkgs, config, lib, ... }: with lib; let
cfg = config.container.module.hdd;
in {
options = {
container.module.hdd = {
enable = mkEnableOption "Hdd health monitor.";
address = mkOption {
default = "10.1.0.10";
type = types.str;
};
port = mkOption {
default = 8080;
type = types.int;
};
domain = mkOption {
default = "hdd.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/hdd";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data"
];
@ -43,4 +66,5 @@ in {
};
};
};
};
}

24
container/Home.nix
View file

@ -1,7 +1,26 @@
{ container, pkgs, util, ... } @args: let
cfg = container.config.home;
{ container, pkgs, util, lib, config, ... } @args: with lib; let
cfg = config.container.module.home;
package = (pkgs.callPackage ./homer args);
in {
options = {
container.module.home = {
enable = mkEnableOption "Dashboard.";
address = mkOption {
default = "10.1.0.18";
type = types.str;
};
port = mkOption {
default = 80;
type = types.int;
};
domain = mkOption {
default = "home.${config.container.domain}";
type = types.str;
};
};
};
config = mkIf cfg.enable {
containers.home = container.mkContainer cfg {
config = { ... }: container.mkContainerConfig cfg {
environment.systemPackages = [ package ];
@ -22,4 +41,5 @@ in {
};
};
};
};
}

30
container/Iot.nix
View file

@ -1,6 +1,29 @@
{ container, ... } @args: let
cfg = container.config.iot;
{ container, lib, config, ... }: with lib; let
cfg = config.container.module.iot;
in {
options = {
container.module.iot = {
enable = mkEnableOption "IoT service.";
address = mkOption {
default = "10.1.0.27";
type = types.str;
};
port = mkOption {
default = 8123;
type = types.int;
};
domain = mkOption {
default = "iot.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/iot";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data"
];
@ -19,7 +42,7 @@ in {
hostPath = "/dev/serial/by-id";
isReadOnly = false;
};
} // container.attachMedia "photo" cfg.photo true;
} // container.attachMedia "photo" true;
allowedDevices = [
{
@ -67,4 +90,5 @@ in {
};
};
};
};
}

20
container/Jobber.nix
View file

@ -1,7 +1,22 @@
{ container, pkgsJobber, poetry2nixJobber, lib, ... } @args: let
cfg = container.config.jobber;
{ container, pkgsJobber, poetry2nixJobber, lib, config, ... }: with lib; let
cfg = config.container.module.jobber;
script = import ./jobber { poetry2nix = poetry2nixJobber; pkgs = pkgsJobber; };
in {
options = {
container.module.jobber = {
enable = mkEnableOption "Button pusher Stanley.";
address = mkOption {
default = "10.1.0.32";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/jobber";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data"
];
@ -47,4 +62,5 @@ in {
};
};
};
};
}

32
container/Mail.nix
View file

@ -1,6 +1,31 @@
# Guide: https://nixos-mailserver.readthedocs.io/en/latest/setup-guide.html
{ container, domain, pkgs, util, const, ... } @args: let cfg = container.config.mail;
{ container, pkgs, util, const, lib, config, ... }: with lib; let
cfg = config.container.module.mail;
domain = config.container.domain;
in {
options = {
container.module.mail = {
enable = mkEnableOption "Email server.";
address = mkOption {
default = "10.1.0.5";
type = types.str;
};
port = mkOption {
default = 80;
type = types.int;
};
domain = mkOption {
default = "mail.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/mail";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data"
# "data/indices"
@ -44,7 +69,7 @@ in {
isReadOnly = false;
};
"/acme" = {
hostPath = "${container.config.proxy.storage}/letsencrypt";
hostPath = "${config.container.module.proxy.storage}/letsencrypt";
isReadOnly = true;
};
};
@ -59,8 +84,8 @@ in {
mailserver = {
enable = true;
fqdn = cfg.domain;
domains = [ domain ];
fqdn = cfg.domain;
sendingFqdn = domain;
# Use `mkpasswd -sm bcrypt`.
@ -176,4 +201,5 @@ in {
};
};
};
};
}

32
container/Office.nix
View file

@ -2,9 +2,32 @@
# 1. You need to change PSQL tables owner from root to onlyoffice, too. They don't do that automatically for some reason.
# 2. TODO: Generate JWT secret at /var/lib/onlyoffice/jwt, i.e. 9wLfMGha1YrfvWpb5hyYjZf8pvJQ3swS
# See https://git.voronind.com/voronind/nixos/issues/74
{ container, pkgs, util, lib, ... } @args: let
cfg = container.config.office;
{ container, pkgs, util, lib, config, ... }: with lib; let
cfg = config.container.module.office;
in {
options = {
container.module.office = {
enable = mkEnableOption "Office web suite.";
address = mkOption {
default = "10.1.0.21";
type = types.str;
};
port = mkOption {
default = 8000;
type = types.int;
};
domain = mkOption {
default = "office.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/office";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data"
];
@ -25,17 +48,18 @@ in {
hostname = cfg.domain;
postgresName = dbName;
postgresHost = container.config.postgres.address;
postgresHost = config.container.module.postgres.address;
postgresUser = dbName;
postgresPasswordFile = "${pkgs.writeText "OfficeDbPassword" dbName}";
jwtSecretFile = "/var/lib/onlyoffice/jwt";
rabbitmqUrl = "amqp://guest:guest@${container.config.rabbitmq.address}:${toString container.config.rabbitmq.port}";
rabbitmqUrl = "amqp://guest:guest@${config.container.module.rabbitmq.address}:${toString config.container.module.rabbitmq.port}";
examplePort = cfg.port;
enableExampleServer = true;
};
};
};
};
}

36
container/Paper.nix
View file

@ -1,6 +1,29 @@
{ container, pkgs, util, lib, ... } @args: let
cfg = container.config.paper;
{ container, pkgs, util, lib, config, ... }: with lib; let
cfg = config.container.module.paper;
in {
options = {
container.module.paper = {
enable = mkEnableOption "Paper scans manager.";
address = mkOption {
default = "10.1.0.40";
type = types.str;
};
port = mkOption {
default = 28981;
type = types.int;
};
domain = mkOption {
default = "paper.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/paper";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data"
];
@ -12,7 +35,7 @@ in {
isReadOnly = false;
};
"/var/lib/paperless/media" = {
hostPath = "${lib.elemAt cfg.paper 0}";
hostPath = "${elemAt config.container.media.paper 0}";
isReadOnly = false;
};
};
@ -30,14 +53,14 @@ in {
settings = {
PAPERLESS_URL = "https://${cfg.domain}";
PAPERLESS_ADMIN_USER = "root";
PAPERLESS_DBHOST = container.config.postgres.address;
PAPERLESS_DBHOST = config.container.module.postgres.address;
PAPERLESS_DBENGINE = "postgresql";
PAPERLESS_DBNAME = "paperless";
PAPERLESS_DBPASS = "paperless";
PAPERLESS_DBPORT = container.config.postgres.port;
PAPERLESS_DBPORT = config.container.module.postgres.port;
PAPERLESS_DBUSER = "paperless";
PAPERLESS_OCR_LANGUAGE = "rus";
PAPERLESS_REDIS = "redis://${container.config.redis.address}:${toString container.config.redis.port}";
PAPERLESS_REDIS = "redis://${config.container.module.redis.address}:${toString config.container.module.redis.port}";
};
};
@ -50,4 +73,5 @@ in {
};
};
};
};
}

28
container/Pass.nix
View file

@ -1,6 +1,29 @@
{ container, ... } @args: let
cfg = container.config.pass;
{ container, lib, config, ... }: with lib; let
cfg = config.container.module.pass;
in {
options = {
container.module.pass = {
enable = mkEnableOption "Password manager";
address = mkOption {
default = "10.1.0.9";
type = types.str;
};
port = mkOption {
default = 8000;
type = types.int;
};
domain = mkOption {
default = "pass.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/pass";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data"
];
@ -30,4 +53,5 @@ in {
};
};
};
};
}

28
container/Paste.nix
View file

@ -1,7 +1,30 @@
{ pkgs, util, container, ... } @args: let
cfg = container.config.paste;
{ pkgs, util, container, lib, config, ... } @args: with lib; let
cfg = config.container.module.paste;
package = (pkgs.callPackage ./pastebin args);
in {
options = {
container.module.paste = {
enable = mkEnableOption "Pastebin.";
address = mkOption {
default = "10.1.0.14";
type = types.str;
};
port = mkOption {
default = 80;
type = types.int;
};
domain = mkOption {
default = "paste.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/paste";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data"
"tmp"
@ -99,4 +122,5 @@ in {
};
};
};
};
}

32
container/Postgres.nix
View file

@ -1,6 +1,25 @@
{ container, lib, pkgs, ... } @args: let
cfg = container.config.postgres;
{ container, lib, pkgs, config, ... }: with lib; let
cfg = config.container.module.postgres;
in {
options = {
container.module.postgres = {
enable = mkEnableOption "Postgresql server.";
address = mkOption {
default = "10.1.0.3";
type = types.str;
};
port = mkOption {
default = 5432;
type = types.int;
};
storage = mkOption {
default = "${config.container.storage}/postgres";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data"
];
@ -16,7 +35,7 @@ in {
config = { ... }: container.mkContainerConfig cfg {
services.postgresql = let
# Populate with services here.
configurations = with container.config; {
configurations = with config.container.module; {
gitea = git;
nextcloud = cloud;
privatebin = paste;
@ -26,14 +45,14 @@ in {
};
access = configurations // {
all = { address = container.host; };
all = { address = config.container.host; };
};
authentication = builtins.foldl' (acc: item: acc + "${item}\n") "" (
lib.mapAttrsToList (db: cfg: "host ${db} ${db} ${cfg.address}/32 trust") access
mapAttrsToList (db: cfg: "host ${db} ${db} ${cfg.address}/32 trust") access
);
ensureDatabases = [ "root" ] ++ lib.mapAttrsToList (name: _: name) configurations;
ensureDatabases = [ "root" ] ++ mapAttrsToList (name: _: name) configurations;
ensureUsers = map (name: {
inherit name;
@ -54,4 +73,5 @@ in {
};
};
};
};
}

28
container/Print.nix
View file

@ -2,10 +2,33 @@
# ipp://192.168.2.237
# Pantum M6500W-Series
{ container, pkgs, ... } @args: let
cfg = container.config.print;
{ container, pkgs, lib, config, ... }: with lib; let
cfg = config.container.module.print;
package = pkgs.callPackage ./print args;
in {
options = {
container.module.print = {
enable = mkEnableOption "Printing server.";
address = mkOption {
default = "10.1.0.46";
type = types.str;
};
port = mkOption {
default = 631;
type = types.int;
};
domain = mkOption {
default = "print.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/print";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data"
];
@ -32,5 +55,6 @@ in {
};
};
};
};
}

38
container/Proxy.nix
View file

@ -9,10 +9,29 @@
# ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
# ```
# For certbot to generate new keys: `certbot certonly --manual --manual-public-ip-logging-ok --preferred-challenges dns-01 --server https://acme-v02.api.letsencrypt.org/directory -d "*.voronind.com" -d voronind.com`
{ domain, util, container, pkgs, ... } @args: let
cfg = container.config.proxy;
{ util, container, pkgs, lib, config, ... } @args: with lib; let
cfg = config.container.module.proxy;
virtualHosts = util.catSet (util.ls ./proxy/host) args;
in {
options = {
container.module.proxy = {
enable = mkEnableOption "Proxy server.";
address = mkOption {
default = "10.1.0.2";
type = types.str;
};
port = mkOption {
default = 443;
type = types.int;
};
storage = mkOption {
default = "${config.container.storage}/proxy";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [
"challenge"
"letsencrypt"
@ -70,16 +89,16 @@ in {
}
map $http_accept_language $resume {
default https://git.${domain}/voronind/resume/releases/download/latest/voronind_en.pdf;
~ru https://git.${domain}/voronind/resume/releases/download/latest/voronind_ru.pdf;
default https://git.${config.container.domain}/voronind/resume/releases/download/latest/voronind_en.pdf;
~ru https://git.${config.container.domain}/voronind/resume/releases/download/latest/voronind_ru.pdf;
}
server {
server_name ${domain};
server_name ${config.container.domain};
listen 443 ssl;
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
@ -90,8 +109,8 @@ in {
listen 443 ssl default_server;
server_name _;
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
@ -101,4 +120,5 @@ in {
};
};
};
};
}

24
container/Rabbitmq.nix
View file

@ -1,6 +1,25 @@
{ container, pkgs, util, ... } @args: let
cfg = container.config.rabbitmq;
{ container, pkgs, util, lib, config, ... }: with lib; let
cfg = config.container.module.rabbitmq;
in {
options = {
container.module.rabbitmq = {
enable = mkEnableOption "Mqtt server.";
address = mkOption {
default = "10.1.0.28";
type = types.str;
};
port = mkOption {
default = 5672;
type = types.int;
};
storage = mkOption {
default = "${config.container.storage}/rabbitmq";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data"
];
@ -25,4 +44,5 @@ in {
};
};
};
};
}

32
container/Read.nix
View file

@ -1,6 +1,29 @@
{ container, lib, pkgs, ... } @args: let
cfg = container.config.read;
{ container, lib, pkgs, config, ... }: with lib; let
cfg = config.container.module.read;
in {
options = {
container.module.read = {
enable = mkEnableOption "Reading server.";
address = mkOption {
default = "10.1.0.39";
type = types.str;
};
port = mkOption {
default = 5000;
type = types.int;
};
domain = mkOption {
default = "read.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/read";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data"
];
@ -12,8 +35,8 @@ in {
isReadOnly = false;
};
}
// container.attachMedia "book" cfg.book true
// container.attachMedia "manga" cfg.manga true
// container.attachMedia "book" true
// container.attachMedia "manga" true
;
config = { ... }: container.mkContainerConfig cfg {
@ -28,4 +51,5 @@ in {
};
};
};
};
}

20
container/Redis.nix
View file

@ -1,6 +1,21 @@
{ container, pkgs, util, ... } @args: let
cfg = container.config.redis;
{ container, pkgs, util, lib, config, ... }: with lib; let
cfg = config.container.module.redis;
in {
options = {
container.module.redis = {
enable = mkEnableOption "Redis server.";
address = mkOption {
default = "10.1.0.38";
type = types.str;
};
port = mkOption {
default = 6379;
type = types.int;
};
};
};
config = mkIf cfg.enable {
containers.redis = container.mkContainer cfg {
config = { ... }: container.mkContainerConfig cfg {
services.redis.servers.main = {
@ -11,5 +26,6 @@ in {
};
};
};
};
}

28
container/Search.nix
View file

@ -1,6 +1,29 @@
{ container, pkgs, ... } @args: let
cfg = container.config.search;
{ container, pkgs, lib, config, ... }: with lib; let
cfg = config.container.module.search;
in {
options = {
container.module.search = {
enable = mkEnableOption "Search frontend.";
address = mkOption {
default = "10.1.0.26";
type = types.str;
};
port = mkOption {
default = 8080;
type = types.int;
};
domain = mkOption {
default = "search.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/search";
type = types.str;
};
};
};
config = mkIf cfg.enable {
containers.search = container.mkContainer cfg {
config = { ... }: container.mkContainerConfig cfg {
services.searx = {
@ -16,4 +39,5 @@ in {
};
};
};
};
}

34
container/Status.nix
View file

@ -1,6 +1,29 @@
{ container, ... } @args: let
cfg = container.config.status;
{ container, lib, config, ... }: with lib; let
cfg = config.container.module.status;
in {
options = {
container.module.status = {
enable = mkEnableOption "Status monitor.";
address = mkOption {
default = "10.1.0.22";
type = types.str;
};
port = mkOption {
default = 3001;
type = types.int;
};
domain = mkOption {
default = "status.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/status";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data"
];
@ -15,8 +38,8 @@ in {
config = { lib, ... }: container.mkContainerConfig cfg {
networking = {
nameservers = lib.mkForce [
container.config.dns.address
nameservers = mkForce [
config.container.module.dns.address
];
};
@ -30,7 +53,8 @@ in {
};
systemd.services.uptime-kuma = {
serviceConfig.DynamicUser = lib.mkForce false;
serviceConfig.DynamicUser = mkForce false;
};
};
};
};

28
container/Stock.nix
View file

@ -1,6 +1,29 @@
{ container, ... } @args: let
cfg = container.config.stock;
{ container, lib, config, ... }: with lib; let
cfg = config.container.module.stock;
in {
options = {
container.module.stock = {
enable = mkEnableOption "Stock management.";
address = mkOption {
default = "10.1.0.45";
type = types.str;
};
port = mkOption {
default = 80;
type = types.int;
};
domain = mkOption {
default = "stock.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/stock";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data"
];
@ -30,4 +53,5 @@ in {
};
};
};
};
}

52
container/Vpn.nix
View file

@ -1,6 +1,39 @@
{ container, pkgs, ... } @args: let
cfg = container.config.vpn;
{ container, pkgs, lib, config, ... }: with lib; let
cfg = config.container.module.vpn;
wireguardPeers = let
mkPeer = name: ip: PublicKey: {
inherit PublicKey;
PresharedKeyFile = "/var/lib/wireguard/preshared/${name}";
AllowedIPs = [ "${ip}/32" ];
};
in [
(mkPeer "dashaphone" "10.1.1.3" "O/3y8+QKEY8UoLVlmbc8xdhs248L4wtQcl1MsBBfoQo=")
(mkPeer "laptop" "10.1.1.9" "xxoCNPSB86zs8L8p+wXhqaIwpNDkiZu1Yjv8sj8XhgY=")
(mkPeer "phone" "10.1.1.5" "bFmFisMqbDpIrAg3o/GiRl9XhceZEVnZtkegZDTL4yg=")
(mkPeer "tablet" "10.1.1.6" "BdslswVc9OgUpEhJd0sugDBmYw44DiS0FbUPT5EjOG0=")
(mkPeer "work" "10.1.1.2" "Pk0AASSInKO9O8RaQEmm1uNrl0cwWTJDcT8rLn7PSA0=")
];
in {
options = {
container.module.vpn = {
enable = mkEnableOption "Vpn server.";
address = mkOption {
default = "10.1.0.23";
type = types.str;
};
port = mkOption {
default = 51820;
type = types.int;
};
storage = mkOption {
default = "${config.container.storage}/vpn";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data"
"data/preshared"
@ -41,19 +74,7 @@ in {
PrivateKeyFile = "/var/lib/wireguard/privkey";
ListenPort = cfg.port;
};
wireguardPeers = let
mkPeer = name: ip: PublicKey: {
inherit PublicKey;
PresharedKeyFile = "/var/lib/wireguard/preshared/${name}";
AllowedIPs = [ "${ip}/32" ];
};
in [
(mkPeer "dashaphone" "10.1.1.3" "O/3y8+QKEY8UoLVlmbc8xdhs248L4wtQcl1MsBBfoQo=")
(mkPeer "laptop" "10.1.1.9" "xxoCNPSB86zs8L8p+wXhqaIwpNDkiZu1Yjv8sj8XhgY=")
(mkPeer "phone" "10.1.1.5" "bFmFisMqbDpIrAg3o/GiRl9XhceZEVnZtkegZDTL4yg=")
(mkPeer "tablet" "10.1.1.6" "BdslswVc9OgUpEhJd0sugDBmYw44DiS0FbUPT5EjOG0=")
(mkPeer "work" "10.1.1.2" "Pk0AASSInKO9O8RaQEmm1uNrl0cwWTJDcT8rLn7PSA0=")
];
inherit wireguardPeers;
};
};
@ -68,5 +89,6 @@ in {
};
};
};
};
}

55
container/Watch.nix
View file

@ -1,7 +1,33 @@
{ container, lib, ... } @args: let
cfg = container.config.watch;
memLimit = "8G";
{ container, lib, config, ... }: with lib; let
cfg = config.container.module.watch;
in {
options = {
container.module.watch = {
enable = mkEnableOption "Media server.";
address = mkOption {
default = "10.1.0.11";
type = types.str;
};
port = mkOption {
default = 8096;
type = types.int;
};
domain = mkOption {
default = "watch.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/watch";
type = types.str;
};
memLimit = mkOption {
default = "8G";
type = types.str;
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = container.mkContainerDir cfg [
"data"
"cache"
@ -22,16 +48,16 @@ in {
isReadOnly = false;
};
}
// container.attachMedia "anime" cfg.anime true
// container.attachMedia "download" cfg.download true
// container.attachMedia "movie" cfg.movie true
// container.attachMedia "music" cfg.music true
// container.attachMedia "photo" cfg.photo true
// container.attachMedia "porn" cfg.porn true
// container.attachMedia "show" cfg.show true
// container.attachMedia "study" cfg.study true
// container.attachMedia "work" cfg.work true
// container.attachMedia "youtube" cfg.youtube true
// container.attachMedia "anime" true
// container.attachMedia "download" true
// container.attachMedia "movie" true
// container.attachMedia "music" true
// container.attachMedia "photo" true
// container.attachMedia "porn" true
// container.attachMedia "show" true
// container.attachMedia "study" true
// container.attachMedia "work" true
// container.attachMedia "youtube" true
;
allowedDevices = [
@ -48,7 +74,8 @@ in {
dataDir = "/var/lib/jellyfin";
};
systemd.services.jellyfin.serviceConfig.MemoryLimit = memLimit;
systemd.services.jellyfin.serviceConfig.MemoryLimit = cfg.memLimit;
};
};
};
}

32
container/Yt.nix
View file

@ -1,6 +1,29 @@
{ container, pkgs, ... } @args: let
cfg = container.config.yt;
{ container, pkgs, lib, config, ... }: with lib; let
cfg = config.container.module.yt;
in {
options = {
container.module.yt = {
enable = mkEnableOption "YouTube frontend.";
address = mkOption {
default = "10.1.0.19";
type = types.str;
};
port = mkOption {
default = 3000;
type = types.int;
};
domain = mkOption {
default = "yt.${config.container.domain}";
type = types.str;
};
storage = mkOption {
default = "${config.container.storage}/yt";
type = types.str;
};
};
};
config = mkIf cfg.enable {
containers.yt = container.mkContainer cfg {
config = { ... }: container.mkContainerConfig cfg {
services.invidious = {
@ -9,8 +32,8 @@ in {
port = cfg.port;
nginx.enable = false;
database = {
port = container.config.postgres.port;
host = container.config.postgres.address;
port = config.container.module.postgres.port;
host = config.container.module.postgres.address;
createLocally = false;
passwordFile = "${pkgs.writeText "InvidiousDbPassword" "invidious"}";
};
@ -25,4 +48,5 @@ in {
};
};
};
};
}

279
container/default.nix
View file

@ -1,246 +1,55 @@
{ lib
, const
, host
, storage
, domain
, media
, pkgs
, ... }: {
inherit host;
{ lib, config, ... }: with lib; let
cfg = config.container;
in {
options = {
container = {
enable = mkEnableOption "Containers!!";
# Common configuration for all the containers.
mkContainer = config: cfg: lib.recursiveUpdate {
# Start containers with the system by default.
autoStart = true;
autoStart = mkOption {
default = true;
type = types.bool;
};
# IP Address of the host. This is required for container to have access to the Internet.
hostAddress = host;
host = mkOption {
default = "0.0.0.0";
type = types.str;
};
# Container's IP address.
localAddress = config.address;
localAccess = mkOption {
default = "0.0.0.0";
type = types.str;
};
# Isolate container from other hosts.
privateNetwork = true;
} cfg;
storage = mkOption {
default = "/tmp/container";
type = types.str;
};
# Common configuration for the system inside the container.
mkContainerConfig = config: cfg: lib.recursiveUpdate {
# HACK: Do not evaluate nixpkgs inside the container. Use host's instead.
nixpkgs.pkgs = lib.mkForce pkgs;
domain = mkOption {
default = "local";
type = types.str;
};
# Release version.
system.stateVersion = const.stateVersion;
interface = mkOption {
default = "lo";
type = types.str;
};
# Allow passwordless login as root.
users.users.root.password = "";
users.mutableUsers = false;
media = mkOption {
default = {};
type = types.attrs;
};
};
};
networking = {
# Default DNS servers.
nameservers = [
"1.1.1.1"
];
# HACK: Fix for upstream issue: https://github.com/NixOS/nixpkgs/issues/162686
useHostResolvConf = lib.mkForce false;
# Disable firewall.
firewall.enable = false;
};
} cfg;
# Create a directory on the host for container use.
mkContainerDir = cfg: dirs: map (path: "d '${cfg.storage}/${path}' 1777 root root - -") dirs;
# Common configuration for Nginx server.
mkServer = cfg: lib.recursiveUpdate {
forceSSL = false;
} cfg;
# Attach the host media directory to container.
# They will be added to /type/{0..9}
attachMedia = type: paths: ro: builtins.listToAttrs (lib.imap0 (i: path:
{
name = "/${type}/${toString i}";
value = {
hostPath = path;
isReadOnly = ro;
};
}
) paths);
# Range of local addresses who have access to sensitive paths like admin panels.
# Other addresses will get 403.
localAccess = "192.168.1.0/24";
# Per-container configurations.
config = {
camera = {
address = "192.168.2.249";
domain = "camera.${domain}";
port = "554";
};
change = {
address = "10.1.0.41";
port = 5000;
domain = "change.${domain}";
storage = "${storage}/change";
};
cloud = {
address = "10.1.0.13";
port = 80;
domain = "cloud.${domain}";
storage = "${storage}/cloud";
};
ddns = {
address = "10.1.0.31";
port = 53;
storage = "${storage}/ddns";
};
dns = {
address = "10.1.0.6";
};
download = {
inherit (media) download;
address = "10.1.0.12";
port = 8112;
domain = "download.${domain}";
storage = "${storage}/download";
};
git = {
address = "10.1.0.8";
port = 3000;
domain = "git.${domain}";
storage = "${storage}/git";
};
hdd = {
address = "10.1.0.10";
port = 8080;
domain = "hdd.${domain}";
storage = "${storage}/hdd";
};
home = {
address = "10.1.0.18";
port = 80;
domain = "home.${domain}";
};
iot = {
inherit (media) photo;
address = "10.1.0.27";
domain = "iot.${domain}";
port = 8123;
storage = "${storage}/iot";
};
jobber = {
address = "10.1.0.32";
storage = "${storage}/jobber";
};
mail = {
address = "10.1.0.5";
domain = "mail.${domain}";
port = 80;
storage = "${storage}/mail";
};
office = {
address = "10.1.0.21";
domain = "office.${domain}";
port = 8000;
storage = "${storage}/office";
};
paper = {
inherit (media) paper;
address = "10.1.0.40";
domain = "paper.${domain}";
port = 28981;
storage = "${storage}/paper";
};
pass = {
address = "10.1.0.9";
domain = "pass.${domain}";
port = 8000;
storage = "${storage}/pass";
};
paste = {
address = "10.1.0.14";
domain = "paste.${domain}";
port = 80;
storage = "${storage}/paste";
};
print = {
domain = "print.${domain}";
address = "10.1.0.46";
port = 631;
storage = "${storage}/print";
};
printer = {
address = "192.168.2.237";
domain = "printer.${domain}";
port = 80;
};
proxy = {
address = "10.1.0.2";
port = 443;
storage = "${storage}/proxy";
};
postgres = {
address = "10.1.0.3";
port = 5432;
storage = "${storage}/postgres";
};
rabbitmq = {
address = "10.1.0.28";
port = 5672;
storage = "${storage}/rabbitmq";
};
read = {
inherit (media) book manga;
address = "10.1.0.39";
domain = "read.${domain}";
port = 5000;
storage = "${storage}/read";
};
redis = {
address = "10.1.0.38";
port = 6379;
};
router = {
address = "192.168.1.1";
domain = "router.${domain}";
port = 80;
};
search = {
address = "10.1.0.26";
domain = "search.${domain}";
port = 8080;
};
status = {
address = "10.1.0.22";
domain = "status.${domain}";
port = 3001;
storage = "${storage}/status";
};
stock = {
address = "10.1.0.45";
domain = "stock.${domain}";
port = 80;
storage = "${storage}/stock";
};
vpn = {
address = "10.1.0.23";
port = 51820;
storage = "${storage}/vpn";
};
watch = {
inherit (media) anime download movie music photo porn show study work youtube;
address = "10.1.0.11";
domain = "watch.${domain}";
port = 8096;
storage = "${storage}/watch";
};
yt = {
address = "10.1.0.19";
domain = "yt.${domain}";
port = 3000;
config = mkIf cfg.enable {
# This is the network for all the containers.
# They are not available to the external interface by default,
# instead they all expose specific ports in their configuration.
networking.nat = {
enable = true;
internalInterfaces = [ "ve-+" ];
externalInterface = config.container.interface;
};
};
}

45
container/homer/Config.nix
View file

@ -1,4 +1,4 @@
{ pkgs, container, ... }: let
{ pkgs, config, ... }: let
iconTheme = "fa-solid";
mkGroup = name: icon: items: {
@ -12,7 +12,7 @@
target = "_blank";
};
config = {
cfg = {
title = "Dashboard";
subtitle = "Home";
header = false;
@ -41,33 +41,32 @@
};
links = [
(mkLink "Status" "fa-heartbeat" "https://status.voronind.com")
(mkLink "Status" "fa-heartbeat" "https://${config.container.module.status.domain}")
];
services = [
(mkGroup "App" "fa-server" [
(mkLink "Change" "fa-user-secret" "https://${container.config.change.domain}")
(mkLink "Cloud" "fa-cloud" "https://${container.config.cloud.domain}")
(mkLink "Download" "fa-download" "https://${container.config.download.domain}")
(mkLink "Git" "fab fa-git-alt" "https://${container.config.download.domain}")
(mkLink "Iot" "fa-home" "https://${container.config.iot.domain}")
(mkLink "Mail" "fa-envelope" "https://${container.config.mail.domain}")
(mkLink "Paper" "fa-paperclip" "https://${container.config.paper.domain}")
(mkLink "Pass" "fa-key" "https://${container.config.pass.domain}")
(mkLink "Paste" "fa-paste" "https://${container.config.paste.domain}/s")
(mkLink "Print" "fa-print" "https://${container.config.print.domain}")
(mkLink "Read" "fa-book" "https://${container.config.read.domain}")
(mkLink "Search" "fa-search" "https://${container.config.search.domain}")
(mkLink "Stock" "fa-boxes-stacked" "https://${container.config.stock.domain}")
(mkLink "Watch" "fa-film" "https://${container.config.watch.domain}")
(mkLink "YouTube" "fab fa-youtube" "https://${container.config.yt.domain}")
(mkLink "Change" "fa-user-secret" "https://${config.container.module.change.domain}")
(mkLink "Cloud" "fa-cloud" "https://${config.container.module.cloud.domain}")
(mkLink "Download" "fa-download" "https://${config.container.module.download.domain}")
(mkLink "Git" "fab fa-git-alt" "https://${config.container.module.download.domain}")
(mkLink "Iot" "fa-home" "https://${config.container.module.iot.domain}")
(mkLink "Mail" "fa-envelope" "https://${config.container.module.mail.domain}")
(mkLink "Paper" "fa-paperclip" "https://${config.container.module.paper.domain}")
(mkLink "Pass" "fa-key" "https://${config.container.module.pass.domain}")
(mkLink "Paste" "fa-paste" "https://${config.container.module.paste.domain}/s")
(mkLink "Print" "fa-print" "https://${config.container.module.print.domain}")
(mkLink "Read" "fa-book" "https://${config.container.module.read.domain}")
(mkLink "Search" "fa-search" "https://${config.container.module.search.domain}")
(mkLink "Stock" "fa-boxes-stacked" "https://${config.container.module.stock.domain}")
(mkLink "Watch" "fa-film" "https://${config.container.module.watch.domain}")
(mkLink "YouTube" "fab fa-youtube" "https://${config.container.module.yt.domain}")
])
(mkGroup "System" "fa-shield" [
(mkLink "Camera" "fa-camera" "https://${container.config.camera.domain}")
# (mkLink "Hdd" "fa-hard-drive" "https://${container.config.hdd.domain}")
(mkLink "Camera" "fa-camera" "https://camera.${config.container.domain}")
(mkLink "NixOS Search" "fa-snowflake" "https://search.nixos.org")
(mkLink "Printer" "fa-print" "https://${container.config.printer.domain}")
(mkLink "Router" "fa-route" "https://${container.config.router.domain}")
(mkLink "Printer" "fa-print" "https://printer.${config.container.domain}")
(mkLink "Router" "fa-route" "https://router.${config.container.domain}")
])
(mkGroup "Bookmark" "fa-bookmark" [
(mkLink "2gis" "fa-map-location-dot" "https://2gis.ru")
@ -96,5 +95,5 @@
];
};
in {
file = (pkgs.formats.yaml {}).generate "HomerConfig" config;
file = (pkgs.formats.yaml {}).generate "HomerConfig" cfg;
}

2
container/homer/default.nix
View file

@ -1,4 +1,4 @@
{ stdenv, pkgs, ... } @args: let
{ stdenv, pkgs, config, ... } @args: let
cfg = (import ./Config.nix args).file;
in stdenv.mkDerivation (finalAttrs: {
pname = "Homer";

4
container/pastebin/Config.nix
View file

@ -1,4 +1,4 @@
{ util, container, ... }: {
{ util, config, ... }: {
text = util.trimTabs ''
;<?php http_response_code(403); /*
; config file for PrivateBin
@ -220,7 +220,7 @@
; example of DB configuration for PostgreSQL
class = Database
[model_options]
dsn = "pgsql:host=${container.config.postgres.address};dbname=privatebin"
dsn = "pgsql:host=${config.container.module.postgres.address};dbname=privatebin"
tbl = "privatebin_" ; table prefix
usr = "privatebin"
pwd = "privatebin"

2
container/pastebin/default.nix
View file

@ -1,4 +1,4 @@
{ php, pkgs, util, ... } @args: let
{ php, pkgs, util, config, ... } @args: let
cfg = pkgs.writeText "PrivateBinConfig" (import ./Config.nix args).text;
in php.buildComposerProject (finalAttrs: {
pname = "PrivateBin";

20
container/proxy/host/Camera.nix
View file

@ -1,20 +1,22 @@
{ domain, util, container, ... }: let
cfg = container.config.camera;
{ util, config, lib, container, ... }: let
domain = "camera.${config.container.domain}";
address = "192.168.2.249";
port = 554;
in {
${cfg.domain} = container.mkServer {
${domain} = container.mkServer {
extraConfig = util.trimTabs ''
listen 443 ssl;
location / {
allow ${container.localAccess};
allow ${container.config.status.address};
allow ${container.config.vpn.address};
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
deny all;
return 301 rtsp://${cfg.address}:${cfg.port}/live/main;
return 301 rtsp://${address}:${toString port}/live/main;
}
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
'';

14
container/proxy/host/Change.nix
View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let
cfg = container.config.change;
{ util, config, container, ... }: let
cfg = config.container.module.change;
name = "change";
in {
${cfg.domain} = container.mkServer {
@ -8,9 +8,9 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port};
location / {
allow ${container.localAccess};
allow ${container.config.status.address};
allow ${container.config.vpn.address};
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
deny all;
proxy_pass http://''$${name}$request_uri;
@ -18,8 +18,8 @@ in {
add_header Referrer-Policy 'origin';
}
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
'';

14
container/proxy/host/Cloud.nix
View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let
cfg = container.config.cloud;
{ util, config, container, ... }: let
cfg = config.container.module.cloud;
name = "cloud";
in {
${cfg.domain} = container.mkServer {
@ -8,9 +8,9 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port};
location ~ ^/(settings/admin|settings/users|settings/apps|login|api) {
allow ${container.localAccess};
allow ${container.config.status.address};
allow ${container.config.vpn.address};
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
deny all;
proxy_pass http://''$${name}$request_uri;
}
@ -19,8 +19,8 @@ in {
proxy_pass http://''$${name}$request_uri;
}
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
'';

14
container/proxy/host/Download.nix
View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let
cfg = container.config.download;
{ util, config, container, ... }: let
cfg = config.container.module.download;
name = "download";
in {
${cfg.domain} = container.mkServer {
@ -8,15 +8,15 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port};
location / {
allow ${container.localAccess};
allow ${container.config.status.address};
allow ${container.config.vpn.address};
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
deny all;
proxy_pass http://''$${name}$request_uri;
}
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
'';

22
container/proxy/host/Git.nix
View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let
cfg = container.config.git;
{ util, container, config, ... }: let
cfg = config.container.module.git;
name = "git";
in {
${cfg.domain} = container.mkServer {
@ -8,15 +8,15 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port};
location ~ ^/(admin|api|user) {
allow ${container.localAccess};
allow ${container.config.vpn.address};
allow ${config.container.localAccess};
allow ${config.container.module.vpn.address};
deny all;
proxy_pass http://''$${name}$request_uri;
}
location /markdown {
allow ${container.localAccess};
allow ${container.config.vpn.address};
allow ${config.container.localAccess};
allow ${config.container.module.vpn.address};
deny all;
proxy_set_header Content-Type "application/json";
@ -29,15 +29,15 @@ in {
}
location / {
# allow ${container.localAccess};
# allow ${container.config.status.address};
# allow ${container.config.vpn.address};
# allow ${config.container.localAccess};
# allow ${config.container.module.status.address};
# allow ${config.container.module.vpn.address};
# deny all;
proxy_pass http://''$${name}$request_uri;
}
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
'';

14
container/proxy/host/Hdd.nix
View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let
cfg = container.config.hdd;
{ util, container, config, ... }: let
cfg = config.container.module.hdd;
name = "hdd";
in {
${cfg.domain} = container.mkServer {
@ -8,15 +8,15 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port};
location / {
allow ${container.localAccess};
allow ${container.config.status.address};
allow ${container.config.vpn.address};
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
deny all;
proxy_pass http://''$${name}$request_uri;
}
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
'';

14
container/proxy/host/Home.nix
View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let
cfg = container.config.home;
{ util, config, container, ... }: let
cfg = config.container.module.home;
name = "home";
in {
${cfg.domain} = container.mkServer {
@ -8,15 +8,15 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port};
location / {
allow ${container.localAccess};
allow ${container.config.status.address};
allow ${container.config.vpn.address};
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
deny all;
proxy_pass http://''$${name}$request_uri;
}
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
'';

14
container/proxy/host/Iot.nix
View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let
cfg = container.config.iot;
{ util, container, config, ... }: let
cfg = config.container.module.iot;
name = "iot";
in {
${cfg.domain} = container.mkServer {
@ -8,9 +8,9 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port};
location / {
allow ${container.localAccess};
allow ${container.config.status.address};
allow ${container.config.vpn.address};
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
deny all;
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@ -22,8 +22,8 @@ in {
proxy_pass http://''$${name}$request_uri;
}
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
'';

14
container/proxy/host/Mail.nix
View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let
cfg = container.config.mail;
{ util, container, config, ... }: let
cfg = config.container.module.mail;
name = "mail";
in {
${cfg.domain} = container.mkServer {
@ -8,15 +8,15 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port};
location / {
allow ${container.localAccess};
allow ${container.config.status.address};
allow ${container.config.vpn.address};
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
deny all;
proxy_pass http://''$${name}$request_uri;
}
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
'';

14
container/proxy/host/Office.nix
View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let
cfg = container.config.office;
{ util, container, config, ... }: let
cfg = config.container.module.office;
name = "office";
in {
${cfg.domain} = container.mkServer {
@ -8,16 +8,16 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port};
location / {
# allow ${container.localAccess};
# allow ${container.config.status.address};
# allow ${container.config.vpn.address};
# allow ${config.container.localAccess};
# allow ${config.container.module.status.address};
# allow ${config.container.module.vpn.address};
# deny all;
add_header X-Forwarded-Proto https;
proxy_pass http://''$${name}$request_uri;
}
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
'';

14
container/proxy/host/Paper.nix
View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let
cfg = container.config.paper;
{ util, container, config, ... }: let
cfg = config.container.module.paper;
name = "paper";
in {
${cfg.domain} = container.mkServer {
@ -8,15 +8,15 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port};
location / {
allow ${container.localAccess};
allow ${container.config.status.address};
allow ${container.config.vpn.address};
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
deny all;
proxy_pass http://''$${name}$request_uri;
}
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
'';

14
container/proxy/host/Pass.nix
View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let
cfg = container.config.pass;
{ util, container, config, ... }: let
cfg = config.container.module.pass;
name = "pass";
in {
${cfg.domain} = container.mkServer {
@ -8,15 +8,15 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port};
location / {
allow ${container.localAccess};
allow ${container.config.status.address};
allow ${container.config.vpn.address};
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
deny all;
proxy_pass http://''$${name}$request_uri;
}
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
'';

8
container/proxy/host/Paste.nix
View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let
cfg = container.config.paste;
{ util, container, config, ... }: let
cfg = config.container.module.paste;
name = "paste";
in {
${cfg.domain} = container.mkServer {
@ -15,8 +15,8 @@ in {
proxy_pass http://''$${name}$request_uri;
}
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
'';

14
container/proxy/host/Print.nix
View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let
cfg = container.config.print;
{ util, container, config, ... }: let
cfg = config.container.module.print;
name = "print";
in {
${cfg.domain} = container.mkServer {
@ -8,9 +8,9 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port};
location / {
allow ${container.localAccess};
allow ${container.config.status.address};
allow ${container.config.vpn.address};
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
deny all;
proxy_pass http://''$${name}$request_uri;
@ -20,8 +20,8 @@ in {
proxy_set_header X-Forward-For $proxy_add_x_forwarded_for;
}
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
'';

20
container/proxy/host/Printer.nix
View file

@ -1,22 +1,24 @@
{ domain, util, container, ... }: let
cfg = container.config.printer;
{ util, container, config, ... }: let
address = "192.168.2.237";
domain = "printer.${config.container.domain}";
port = 80;
name = "printer";
in {
${cfg.domain} = container.mkServer {
${domain} = container.mkServer {
extraConfig = util.trimTabs ''
listen 443 ssl;
set ''$${name} ${cfg.address}:${toString cfg.port};
set ''$${name} ${address}:${toString port};
location / {
allow ${container.localAccess};
allow ${container.config.status.address};
allow ${container.config.vpn.address};
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
deny all;
proxy_pass http://''$${name}$request_uri;
}
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
'';

14
container/proxy/host/Read.nix
View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let
cfg = container.config.read;
{ util, container, config, ... }: let
cfg = config.container.module.read;
name = "read";
in {
${cfg.domain} = container.mkServer {
@ -8,15 +8,15 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port};
location / {
allow ${container.localAccess};
allow ${container.config.status.address};
allow ${container.config.vpn.address};
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
deny all;
proxy_pass http://''$${name}$request_uri;
}
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
'';

20
container/proxy/host/Router.nix
View file

@ -1,22 +1,24 @@
{ domain, util, container, ... }: let
cfg = container.config.router;
{ util, container, config, ... }: let
address = "192.168.1.1";
domain = "router.${config.container.domain}";
port = 80;
name = "router";
in {
${cfg.domain} = container.mkServer {
${domain} = container.mkServer {
extraConfig = util.trimTabs ''
listen 443 ssl;
set ''$${name} ${cfg.address}:${toString cfg.port};
set ''$${name} ${address}:${toString port};
location / {
allow ${container.localAccess};
allow ${container.config.status.address};
allow ${container.config.vpn.address};
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
deny all;
proxy_pass http://''$${name}$request_uri;
}
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
'';

14
container/proxy/host/Search.nix
View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let
cfg = container.config.search;
{ util, container, config, ... }: let
cfg = config.container.module.search;
name = "search";
in {
${cfg.domain} = container.mkServer {
@ -8,15 +8,15 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port};
location / {
allow ${container.localAccess};
allow ${container.config.status.address};
allow ${container.config.vpn.address};
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
deny all;
proxy_pass http://''$${name}$request_uri;
}
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
'';

16
container/proxy/host/Status.nix
View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let
cfg = container.config.status;
{ util, container, config, ... }: let
cfg = config.container.module.status;
name = "sstatus";
in {
${cfg.domain} = container.mkServer {
@ -8,21 +8,21 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port};
location ~ ^/(dashboard|settings) {
allow ${container.localAccess};
allow ${container.config.vpn.address};
allow ${config.container.localAccess};
allow ${config.container.module.vpn.address};
deny all;
proxy_pass http://''$${name}$request_uri;
}
location / {
allow ${container.localAccess};
allow ${container.config.vpn.address};
allow ${config.container.localAccess};
allow ${config.container.module.vpn.address};
deny all;
proxy_pass http://''$${name}$request_uri;
}
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
'';

14
container/proxy/host/Stock.nix
View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let
cfg = container.config.stock;
{ util, container, config, ... }: let
cfg = config.container.module.stock;
name = "stock";
in {
${cfg.domain} = container.mkServer {
@ -8,15 +8,15 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port};
location / {
allow ${container.localAccess};
allow ${container.config.status.address};
allow ${container.config.vpn.address};
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
deny all;
proxy_pass http://''$${name}$request_uri;
}
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
'';

14
container/proxy/host/Watch.nix
View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let
cfg = container.config.watch;
{ util, container, config, ... }: let
cfg = config.container.module.watch;
name = "watch";
in {
${cfg.domain} = container.mkServer {
@ -8,15 +8,15 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port};
location / {
allow ${container.localAccess};
allow ${container.config.status.address};
allow ${container.config.vpn.address};
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
deny all;
proxy_pass http://''$${name}$request_uri;
}
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
'';

14
container/proxy/host/Yt.nix
View file

@ -1,5 +1,5 @@
{ domain, util, container, ... }: let
cfg = container.config.yt;
{ util, container, config, ... }: let
cfg = config.container.module.yt;
name = "yt";
in {
${cfg.domain} = container.mkServer {
@ -8,9 +8,9 @@ in {
set ''$${name} ${cfg.address}:${toString cfg.port};
location / {
allow ${container.localAccess};
allow ${container.config.status.address};
allow ${container.config.vpn.address};
allow ${config.container.localAccess};
allow ${config.container.module.status.address};
allow ${config.container.module.vpn.address};
deny all;
proxy_pass http://''$${name}$request_uri;
@ -25,8 +25,8 @@ in {
proxy_hide_header X-Content-Type-Options;
}
ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
include /etc/letsencrypt/conf/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
'';

193
flake.nix
View file

@ -137,22 +137,13 @@
url = "https://git.voronind.com/voronind/nixos.git";
};
# Common modules used across all the hosts.
nixosModules.common = let
# This function allows me to get the list of all the files from the directories I need.
# It differs from the util.ls function because it also filters out all the directories.
nixosConfigurations = let
# List all files in a dir.
lsFiles = path: map (f: "${path}/${f}") (
builtins.filter (i: builtins.readFileType "${path}/${i}" == "regular") (
builtins.attrNames (builtins.readDir path)
)
);
in {
# Here I import everything from those directories.
imports = (lsFiles ./module/common) ++ (lsFiles ./overlay) ++ [
./part/Setting.nix
./user/Root.nix
];
};
# Function to create a host. It does basic setup, like adding common modules.
mkHost = { system, hostname, modules } @args: nixpkgs.lib.nixosSystem {
@ -161,7 +152,7 @@
inherit system;
# List of modules to use by defualt for all the hosts.
modules = [
modules = modules ++ [
# There I put host-specific configurations.
./host/${hostname}
@ -171,17 +162,22 @@
# Specify current release version.
{ system.stateVersion = self.const.stateVersion; }
# Add common modules.
inputs.self.nixosModules.common
# Add modules.
{ imports =
(lsFiles ./container) ++
(lsFiles ./module) ++
(lsFiles ./module/common) ++
(lsFiles ./module/desktop) ++
(lsFiles ./overlay) ++
(lsFiles ./user);
}
# Add Home Manager module.
home-manager.nixosModules.home-manager
# Add Stylix module.
stylix.nixosModules.stylix
]
# Also add host-specific modules from mkHost args.
++ modules;
];
# SpecialArgs allows you to pass objects down to other NixOS modules.
specialArgs = let
@ -192,14 +188,15 @@
pkgsJobber = nixpkgsJobber.legacyPackages.${system}.pkgs;
pkgsStable = nixpkgsJobber.legacyPackages.${system}.pkgs;
pkgsMaster = nixpkgsJobber.legacyPackages.${system}.pkgs;
secret = import ./secret {}; # Secrets (public keys).
container = import ./lib/Container.nix { inherit lib pkgs config; inherit (self) const; }; # Container utils.
util = import ./lib/Util.nix { inherit pkgs lib; }; # Util functions.
in {
const = self.const; # Constant values.
flake = self; # This Flake itself.
inputs = inputs; # Our dependencies.
secret = import ./part/Secret.nix {}; # Secrets (public keys).
style = import ./part/Style.nix { inherit config; }; # Style abstraction.
util = import ./part/Util.nix { inherit pkgs lib; }; # Util functions.
wallpaper = import ./part/Wallpaper.nix { inherit pkgs; }; # Wallpaper.
flake = self;
inherit secret container util inputs;
inherit (self) const;
# Stable and Master pkgs.
inherit pkgsStable pkgsMaster;
@ -209,110 +206,16 @@
};
};
# Bellow is the list of all the hosts I currently use.
# They call the `mkHost` function that I defined above
# with their specific parameters.
# You might be interested in `live` and `nixOnDroidConfiguration`
# for Live ISO and Android configurations respectively.
nixosConfigurations.basic = self.mkHost {
hostname = "basic"; # Hostname to use.
system = "x86_64-linux"; # System architecture.
# Host-specific modules.
modules = [
# Force LTS kernel.
({ pkgs, ... }: { boot.kernelPackages = nixpkgs.lib.mkForce pkgs.linuxPackages; })
];
mkSystem = hostname: system: modules: {
"${hostname}" = mkHost {
inherit hostname system modules;
};
};
nixosConfigurations.dasha = self.mkHost {
hostname = "dasha";
system = "x86_64-linux";
modules = [
./module/AmdGpu.nix
./module/CapsToggle.nix
# ./module/Gnome.nix
./module/IntelCpu.nix
./module/PowersaveIntel.nix
./module/Print.nix
./module/RemoteBuild.nix
./module/StrongSwan.nix
./module/Sway.nix
./module/Tablet.nix
./user/Dasha.nix
];
};
nixosConfigurations.desktop = self.mkHost {
hostname = "desktop";
system = "x86_64-linux";
modules = [
./module/AmdCompute.nix
./module/AmdCpu.nix
./module/AmdGpu.nix
./module/Docker.nix
./module/Ollama.nix
./module/PowersaveAmd.nix
./module/Print.nix
./module/RemoteBuild.nix
./module/Sway.nix
./module/VirtManager.nix
./user/Voronind.nix
];
};
nixosConfigurations.fsight = self.mkHost {
hostname = "fsight";
system = "x86_64-linux";
modules = [
./module/Docker.nix
];
};
nixosConfigurations.home = self.mkHost {
hostname = "home";
system = "x86_64-linux";
modules = [
./module/AmdCpu.nix
./module/AmdGpu.nix
./module/Ftpd.nix
./module/RemoteBuilder.nix
./module/Sway.nix
./user/Voronind.nix
];
};
nixosConfigurations.laptop = self.mkHost {
hostname = "laptop";
system = "x86_64-linux";
modules = [
./module/AmdCpu.nix
./module/AmdGpu.nix
./module/CapsToggle.nix
./module/Gnome.nix
./module/PowersaveAmd.nix
./module/Print.nix
./module/RemoteBuild.nix
./module/StrongSwan.nix
./module/Tablet.nix
./user/Dasha.nix
./user/Voronind.nix
];
};
# Live ISO configuration.
nixosConfigurations.live = self.mkHost {
hostname = "live";
system = "x86_64-linux";
modules = [
# Those are basic modules for Live ISO image.
# You can discover other possible base images here:
# https://github.com/NixOS/nixpkgs/tree/master/nixos/modules/installer/cd-dvd
liveModules = [
"${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix"
"${nixpkgs}/nixos/modules/installer/cd-dvd/channel.nix"
# This is required for Live ISO in my case because I use NetworkManager,
# but base Live images require this.
{ networking.wireless.enable = nixpkgs.lib.mkForce false; }
# Override my settings to allow SSH logins using root password.
@ -320,27 +223,29 @@
{ services.openssh.settings.PermitRootLogin = nixpkgs.lib.mkForce "yes"; }
# Disable auto-updates as they are not possible for Live ISO.
{ systemd.services.autoupdate.enable = nixpkgs.lib.mkForce false; }
{ systemd.timers.autoupdate.enable = nixpkgs.lib.mkForce false; }
{ module.common.autoupdate.enable = false; }
# Base Live images also require the LTS kernel.
({ pkgs, ... }: { boot.kernelPackages = nixpkgs.lib.mkForce pkgs.linuxPackages; })
{ module.common.kernel.latest = false; }
];
};
nixosConfigurations.work = self.mkHost {
hostname = "work";
system = "x86_64-linux";
modules = [
./module/IntelCpu.nix
./module/PowerlimitThinkpad.nix
./module/PowersaveIntel.nix
./module/Print.nix
./module/RemoteBuild.nix
./module/Sway.nix
./user/Voronind.nix
];
};
x86System = hostname: mkSystem hostname "x86_64-linux" [];
x86LiveSystem = hostname: mkSystem hostname "x86_64-linux" liveModules;
in
# Bellow is the list of all the hosts I currently use.
# They call the `mkSystem` function that I defined above
# with their specific parameters.
# You might be interested in `live` and `nixOnDroidConfiguration`
# for Live ISO and Android configurations respectively.
(x86System "dasha") //
(x86System "desktop") //
(x86System "fsight") //
(x86System "home") //
(x86System "laptop") //
(x86System "work") //
(x86LiveSystem "live")
;
# Android.
nixOnDroidConfigurations.default = nix-on-droid.lib.nixOnDroidConfiguration {
@ -348,9 +253,6 @@
# Android release version.
{ system.stateVersion = inputs.self.const.droidStateVersion; }
# Common settings.
./part/Setting.nix
# I put all my Android configuration there.
./android
];
@ -364,9 +266,8 @@
const = self.const; # Constant values.
flake = self; # This Flake itself.
inputs = inputs; # Our dependencies.
secret = import ./part/Secret.nix {}; # Secrets (public keys).
style = import ./part/Style.nix { config = import ./part/style/Gruvbox.nix {}; }; # Style abstraction. Stylix is not available for Android so I provide static Gruvbox style.
util = import ./part/Util.nix { inherit pkgs lib; }; # Util functions.
secret = import ./lib/Secret.nix {}; # Secrets (public keys).
util = import ./lib/Util.nix { inherit pkgs lib; }; # Util functions.
};
};
};

5
host/basic/default.nix
View file

@ -1,5 +0,0 @@
# Basic host is a dummy and has no specific configuration.
# I don't really need it, this is just a failsafe that I can definitely install and run.
{ ... }: {
imports = [ ];
}

14
host/dasha/default.nix
View file

@ -3,7 +3,15 @@
./Filesystem.nix
];
# Disable keyd.
# services.keyd.enable = lib.mkForce false;
# systemd.services.keyd-application-mapper.enable = lib.mkForce false;
user.dasha.enable = true;
module = {
amd.gpu.enable = true;
builder.client.enable = true;
desktop.sway.enable = true;
intel.cpu.enable = true;
print.enable = true;
strongswan.enable = true;
tablet.enable = true;
};
}

29
host/desktop/default.nix
View file

@ -3,8 +3,29 @@
./Filesystem.nix
];
# Disable docker service.
systemd.services.docker-prune.enable = lib.mkForce false;
systemd.services.docker.enable = lib.mkForce false;
systemd.sockets.docker.enable = lib.mkForce false;
user.voronind.enable = true;
module = {
builder.client.enable = true;
desktop.sway.enable = true;
print.enable = true;
virtmanager.enable = true;
amd = {
compute.enable = true;
cpu.enable = true;
gpu.enable = true;
};
docker = {
enable = true;
autostart = false;
rootless = false;
};
ollama = {
enable = true;
models = [
"llama3"
"llama3:70b"
];
};
};
}

2
host/fsight/default.nix
View file

@ -3,4 +3,6 @@
./Grub.nix
./Root.nix
];
module.docker.enable = true;
}

105
host/home/Container.nix
View file

@ -1,27 +1,40 @@
{ pkgs
, const
, lib
, config
, util
, poetry2nixJobber
, pkgsJobber
, pkgsMaster
, pkgsStable
, ... }: let
args = let
# Path where all the container data will be stored.
{ ... }: {
container = {
enable = true;
module = {
change.enable = true;
cloud.enable = true;
ddns.enable = true;
dns.enable = true;
download.enable = true;
git.enable = true;
# ISSUE: hdd.enable = true;
home.enable = true;
iot.enable = true;
jobber.enable = true;
mail.enable = true;
# ISSUE: office.enable = true;
paper.enable = true;
pass.enable = true;
paste.enable = true;
postgres.enable = true;
proxy.enable = true;
rabbitmq.enable = true;
read.enable = true;
redis.enable = true;
search.enable = true;
status.enable = true;
stock.enable = true;
vpn.enable = true;
watch.enable = true;
yt.enable = true;
};
storage = "/storage/hot/container";
# Domain used to host stuff. All the services will be like `service.${domain}`.
domain = "voronind.com";
# External IP address of the host, where all the services will listen to.
host = "192.168.1.2";
# External interface where all the services will listen on.
externalInterface = "enp7s0";
# Paths to media content. Later they can be plugged to the containers using the `attachMedia "photo"` function.
interface = "enp7s0";
media = {
anime = [ "/storage/cold_1/media/anime" "/storage/cold_2/media/anime" ];
book = [ "/storage/hot/media/book" ];
@ -31,59 +44,11 @@
music = [ "/storage/cold_2/media/music" ];
paper = [ "/storage/hot/media/paper" ];
porn = [ "/storage/cold_2/media/porn" ];
photo = [ "${storage}/cloud/data/data/cakee/files/media/photo" "/storage/cold_1/backup/tmp/photo" ];
photo = [ "/storage/hot/container/cloud/data/data/cakee/files/media/photo" "/storage/cold_1/backup/tmp/photo" ];
show = [ "/storage/cold_1/media/show" "/storage/cold_2/media/show" ];
study = [ "/storage/cold_1/media/study" "/storage/cold_2/media/study" ];
work = [ "/storage/cold_2/media/work" ];
youtube = [ "/storage/cold_1/media/youtube" "/storage/cold_2/media/youtube" ];
};
in {
# Pass all the arguments further.
inherit storage domain host pkgs const lib config util media externalInterface;
inherit poetry2nixJobber pkgsJobber;
inherit pkgsMaster pkgsStable;
# Pass the global container configuration.
container = import ../../container args;
};
in {
# List of containers enabled on this host.
imports = [
(import ../../container/Change.nix args)
(import ../../container/Cloud.nix args)
(import ../../container/Ddns.nix args)
(import ../../container/Dns.nix args)
(import ../../container/Download.nix args)
(import ../../container/Git.nix args)
# (import ../../container/Hdd.nix args)
(import ../../container/Home.nix args)
(import ../../container/Iot.nix args)
(import ../../container/Jobber.nix args)
(import ../../container/Mail.nix args)
(import ../../container/Office.nix args)
(import ../../container/Paper.nix args)
(import ../../container/Pass.nix args)
(import ../../container/Paste.nix args)
(import ../../container/Postgres.nix args)
(import ../../container/Print.nix args)
(import ../../container/Proxy.nix args)
(import ../../container/Rabbitmq.nix args)
(import ../../container/Read.nix args)
(import ../../container/Redis.nix args)
(import ../../container/Search.nix args)
(import ../../container/Status.nix args)
(import ../../container/Stock.nix args)
(import ../../container/Vpn.nix args)
(import ../../container/Watch.nix args)
(import ../../container/Yt.nix args)
];
# This is the network for all the containers.
# They are not available to the external interface by default,
# instead they all expose specific ports in their configuration.
networking.nat = {
enable = true;
internalInterfaces = [ "ve-+" ];
inherit (args) externalInterface;
};
}

20
host/home/default.nix
View file

@ -1,4 +1,4 @@
{ lib, ... }: {
{ ... }: {
imports = [
./Backup.nix
./Container.nix
@ -7,7 +7,21 @@
./Photoprocess.nix
];
user.voronind.enable = true;
module = {
builder.server.enable = true;
desktop.sway.enable = true;
ftpd = {
enable = true;
storage = "/storage/hot/ftp";
};
amd = {
cpu.enable = true;
gpu.enable = true;
};
};
# Disable auto-switch.
systemd.services.autoupdate.enable = lib.mkForce false;
systemd.timers.autoupdate.enable = lib.mkForce false;
module.common.autoupdate.enable = false;
}

17
host/laptop/default.nix
View file

@ -2,4 +2,21 @@
imports = [
./Filesystem.nix
];
user = {
dasha.enable = true;
voronind.enable = true;
};
module = {
builder.client.enable = true;
print.enable = true;
strongswan.enable = true;
tablet.enable = true;
amd = {
compute.enable = true;
cpu.enable = true;
gpu.enable = true;
};
};
}

4
host/live/default.nix
View file

@ -1,3 +1 @@
{ ... }: {
imports = [ ];
}
{ ... }: { }

10
host/work/default.nix
View file

@ -5,4 +5,14 @@
# Keyd Print to Macro remap.
services.keyd.keyboards.default.settings.main.print = "layer(layer_macro)";
user.voronind.enable = true;
module = {
builder.client.enable = true;
desktop.sway.enable = true;
intel.cpu.enable = true;
powerlimit.thinkpad.enable = true;
print.enable = true;
};
}

63
lib/Container.nix Normal file
View file

@ -0,0 +1,63 @@
{ lib, pkgs, const, config, ... }: {
mkContainer = cfg: extra: lib.recursiveUpdate {
# Start containers with the system by default.
autoStart = config.container.autoStart;
# IP Address of the host. This is required for container to have access to the Internet.
hostAddress = config.container.host;
# Container's IP address.
localAddress = cfg.address;
# Isolate container from other hosts.
privateNetwork = true;
} extra;
# Common configuration for the system inside the container.
mkContainerConfig = cfg: extra: lib.recursiveUpdate {
# HACK: Do not evaluate nixpkgs inside the container. Use host's instead.
nixpkgs.pkgs = lib.mkForce pkgs;
# Release version.
system.stateVersion = const.stateVersion;
# Allow passwordless login as root.
users = {
users.root.password = "";
mutableUsers = false;
};
networking = {
# Default DNS servers.
nameservers = [
"1.1.1.1"
];
# HACK: Fix for upstream issue: https://github.com/NixOS/nixpkgs/issues/162686
useHostResolvConf = lib.mkForce false;
# Disable firewall.
firewall.enable = false;
};
} extra;
# Create a directory on the host for container use.
mkContainerDir = cfg: dirs: map (path: "d '${cfg.storage}/${path}' 1777 root root - -") dirs;
# Common configuration for Nginx server.
mkServer = cfg: lib.recursiveUpdate {
forceSSL = false;
} cfg;
# Attach the host media directory to container.
# They will be added to /type/{0..9}
attachMedia = type: ro: builtins.listToAttrs (lib.imap0 (i: path:
{
name = "/${type}/${toString i}";
value = {
hostPath = path;
isReadOnly = ro;
};
}
) config.container.media.${type});
}

2
part/Util.nix → lib/Util.nix
View file

@ -30,4 +30,6 @@
stopIfChanged = false;
unitConfig.X-StopOnRemoval = false;
};
}

11
module/AmdCompute.nix
View file

@ -1,5 +1,11 @@
# AMD Rocm support (for Blender).
{ nixpkgs, pkgs, ... }: {
{ pkgs, lib, config, ... }: with lib; let
cfg = config.module.amd.compute;
in {
options = {
module.amd.compute.enable = mkEnableOption "Enable AMD Rocm support i.e. for Blender.";
};
config = mkIf cfg.enable {
nixpkgs.config.rocmSupport = true;
systemd.tmpfiles.rules = [
"L+ /opt/rocm/hip - - - - ${pkgs.rocmPackages.clr}"
@ -7,4 +13,5 @@
hardware.opengl.extraPackages = with pkgs; [
rocmPackages.clr.icd
];
};
}

28
module/AmdCpu.nix
View file

@ -1,5 +1,27 @@
# AMD CPU specific configuration.
{ lib, config, ... }: {
{ pkgs, lib, config, ... }: with lib; let
cfg = config.module.amd.cpu;
controlFile = "/sys/devices/system/cpu/cpufreq/boost";
enableCmd = "0";
disableCmd = "1";
in {
options = {
module.amd.cpu = {
enable = mkEnableOption "Enable AMD Cpu support.";
powersave.enable = mkEnableOption "Enable AMD Cpu powersave." // { default = true; };
};
};
config = mkIf cfg.enable (mkMerge [
{
boot.kernelModules = [ "kvm-amd" ];
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
hardware.cpu.amd.updateMicrocode = mkDefault config.hardware.enableRedistributableFirmware;
}
(mkIf cfg.powersave.enable {
module.powersave = {
enable = true;
cpu.boost = { inherit controlFile enableCmd disableCmd; };
};
})
]);
}

12
module/AmdGpu.nix
View file

@ -1,6 +1,11 @@
# AMD GPU specific configuration.
# No, I do not own any Nvidia/Intel GPUs, so I have no configuration for them.
{ nixpkgs, pkgs, ... }: {
{ pkgs, lib, config, ... }: with lib; let
cfg = config.module.amd.gpu;
in {
options = {
module.amd.gpu.enable = mkEnableOption "Enable AMD Gpu support.";
};
config = mkIf cfg.enable {
boot.initrd.kernelModules = [ "amdgpu" ];
services.xserver.videoDrivers = [ "amdgpu" ];
hardware.opengl.driSupport = true;
@ -14,4 +19,5 @@
# hardware.opengl.extraPackages32 = with pkgs; [
# driversi686Linux.amdvlk
# ];
};
}

6
module/CapsToggle.nix
View file

@ -1,6 +0,0 @@
# Toggle language with CapsLock. My wife prefers this.
{ lib, ... }: {
services.xserver.xkb = {
options = lib.mkForce "grp:caps_toggle";
};
}

40
module/Docker.nix
View file

@ -1,3 +1,41 @@
{ ... }: {
{ pkgs, lib, config, ... }: with lib; let
cfg = config.module.docker;
in {
options = {
module.docker = {
enable = mkEnableOption "Enable Cocker";
rootless = mkOption {
default = false;
type = types.bool;
};
autostart = mkOption {
default = true;
type = types.bool;
};
};
};
config = mkIf cfg.enable {
virtualisation.docker.enable = true;
virtualisation.docker.rootless = mkIf cfg.rootless {
enable = true;
setSocketVariable = true;
};
systemd.services.docker-prune.enable = mkForce cfg.autostart;
systemd.services.docker.enable = mkForce cfg.autostart;
systemd.sockets.docker.enable = mkForce cfg.autostart;
};
# NOTE: mkMerge example.
# config = mkIf cfg.enable (mkMerge [
# { virtualisation.docker.enable = true; }
# (mkIf cfg.rootless {
# virtualisation.docker.rootless = {
# enable = true;
# setSocketVariable = true;
# };
# })
# ]);
}

7
module/DockerRootless.nix
View file

@ -1,7 +0,0 @@
{ ... }: {
virtualisation.docker.enable = true;
virtualisation.docker.rootless = {
enable = true;
setSocketVariable = true;
};
}

18
module/Ftpd.nix
View file

@ -1,4 +1,17 @@
{ ... }: {
{ pkgs, lib, config, ... }: with lib; let
cfg = config.module.ftpd;
in {
options = {
module.ftpd = {
enable = mkEnableOption "Enable FTP server";
storage = mkOption {
default = null;
type = types.str;
};
};
};
config = mkIf cfg.enable {
services.vsftpd = {
enable = true;
anonymousUser = true;
@ -6,7 +19,7 @@
anonymousUploadEnable = true;
anonymousMkdirEnable = true;
anonymousUmask = "000";
anonymousUserHome = "/storage/hot/ftp";
anonymousUserHome = cfg.storage;
allowWriteableChroot = true;
writeEnable = true;
localUsers = false;
@ -14,4 +27,5 @@
anon_other_write_enable=YES
'';
};
};
}

48
module/Gnome.nix
View file

@ -1,48 +0,0 @@
{ pkgs, lib, ... }: {
imports = [
./desktop/App.nix
./desktop/Dconf.nix
./desktop/DisplayManager.nix
./desktop/Sound.nix
./desktop/Wayland.nix
];
services.xserver.displayManager.gdm.enable = true;
services.xserver.desktopManager.gnome.enable = true;
environment.systemPackages = with pkgs; [
gnome.gnome-tweaks # Gnome "hidden" settings.
openssl # It was needed for something, can't remember.
];
# Disable some Gnome apps.
services.gnome.gnome-keyring.enable = lib.mkForce false;
environment.gnome.excludePackages = with pkgs.gnome; [
# baobab # Disk usage analyzer.
# cheese # Photo booth.
# epiphany # Web browser.
# simple-scan # Document scanner.
# totem # Video player.
# yelp # Help viewer.
# file-roller # Archive manager.
# geary # Email client.
# seahorse # Password manager.
# gnome-calculator
# gnome-calendar
# gnome-characters
# gnome-clocks
# gnome-contacts
# gnome-font-viewer
# gnome-keyring
# gnome-logs
# gnome-maps
# gnome-music
# gnome-shell-extensions
gnome-software
# gnome-system-monitor
# gnome-weather
# gnome-disk-utility
# pkgs.gnome-text-editor
];
}

25
module/IntelCpu.nix
View file

@ -1,4 +1,27 @@
# Intel CPU specific configuration.
{ ... }: {
{ pkgs, lib, config, ... }: with lib; let
cfg = config.module.intel.cpu;
controlFile = "/sys/devices/system/cpu/intel_pstate/no_turbo";
enableCmd = "1";
disableCmd = "0";
in {
options = {
module.intel.cpu = {
enable = mkEnableOption "Support for Shintel CPUs";
powersave.enable = mkEnableOption "Enable Shintel Cpu powersave." // { default = true; };
};
};
config = mkIf cfg.enable (mkMerge [
{
boot.kernelModules = [ "kvm-intel" ];
}
(mkIf cfg.powersave.enable {
module.powersave = {
enable = true;
cpu.boost = { inherit controlFile enableCmd disableCmd; };
};
})
]);
}

25
module/Ollama.nix
View file

@ -1,13 +1,29 @@
# https://github.com/ollama/ollama
{ pkgsStable, lib, config, ... }: let
{ pkgsStable, lib, config, ... }: with lib; let
pkgs = pkgsStable;
cfg = config.module.ollama;
in {
options = {
module.ollama = {
enable = mkEnableOption "Local LLM server";
primaryModel = mkOption {
default = "llama3";
type = types.str;
};
models = mkOption {
default = [ cfg.primaryModel ];
type = types.listOf types.str;
};
};
};
config = mkIf cfg.enable {
environment = {
# Add Ollama CLI app.
systemPackages = with pkgs; [ ollama ];
# Specify default model.
variables.OLLAMA_MODEL = config.setting.ollama.primaryModel;
variables.OLLAMA_MODEL = cfg.primaryModel;
};
# Enable Ollama server.
@ -18,7 +34,7 @@ in {
after = [ "NetworkManager-wait-online.service" ];
serviceConfig.Type = "simple";
script = ''
HOME=/root ${lib.getExe pkgs.ollama} serve
HOME=/root ${getExe pkgs.ollama} serve
'';
};
@ -31,7 +47,8 @@ in {
serviceConfig.Type = "simple";
script = ''
sleep 5
${lib.getExe pkgs.ollama} pull ${config.setting.ollama.primaryModel}
${getExe pkgs.ollama} pull ${concatStringsSep " " cfg.models}
'';
};
};
}

24
module/Podman.nix Normal file
View file

@ -0,0 +1,24 @@
{ lib, config, ... }: with lib; let
cfg = config.module.podman;
in {
options = {
module.podman = {
enable = mkEnableOption "OCI Podman.";
};
};
config = mkIf cfg.enable {
virtualisation = {
podman = {
enable = true;
# Free the 53 port ffs.
defaultNetwork.settings.dns_enabled = false;
# Do not interfere with Docker so we can have both installed at the same time.
# Podman can't replace Docker anyway.
dockerCompat = false;
};
};
};
}

83
module/PowerlimitThinkpad.nix
View file

@ -1,22 +1,79 @@
# ThinkPad charge limits.
{ pkgs, lib, ... } @args: let
{ pkgs, lib, config, ... } @args: with lib; let
cfg = config.module.powerlimit.thinkpad;
controlFileMin = "/sys/class/power_supply/BAT0/charge_control_start_threshold";
controlFileMax = "/sys/class/power_supply/BAT0/charge_control_end_threshold";
onMin = "40";
onMax = "80";
offMin = "90";
offMax = "95";
script = pkgs.writeShellScriptBin "powerlimit" ''
function toggle() {
if status; then
echo ${toString cfg.offMax} > ${controlFileMax}
echo ${toString cfg.offMin} > ${controlFileMin}
else
echo ${toString cfg.onMin} > ${controlFileMin}
echo ${toString cfg.onMax} > ${controlFileMax}
fi
script = pkgs.writeShellScriptBin "powerlimit" (import ./powerlimit/Script.nix {
inherit controlFileMax controlFileMin onMin onMax offMin offMax;
}).script;
true
}
function waybar() {
status || echo -n ""
}
function status() {
local current=$(cat ${controlFileMax})
local enabled="${toString cfg.onMax}"
[[ "''${current}" = "''${enabled}" ]]
}
''${@}
'';
in {
imports = [
(import ./powerlimit ({
inherit controlFileMax controlFileMin onMin onMax offMin offMax;
} // args))
];
options = {
module.powerlimit.thinkpad = {
enable = mkEnableOption "Powerlimit Service";
onMin = mkOption {
default = 40;
type = types.int;
};
onMax = mkOption {
default = 80;
type = types.int;
};
offMin = mkOption {
default = 90;
type = types.int;
};
offMax = mkOption {
default = 95;
type = types.int;
};
};
};
config = mkIf cfg.enable {
environment.systemPackages = [ script ];
systemd = {
services.powerlimit = {
description = "Limit battery charge.";
enable = true;
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "simple";
RemainAfterExit = "yes";
ExecStart = "${getExe pkgs.bash} -c 'echo ${toString cfg.onMin} > ${controlFileMin}; echo ${toString cfg.onMax} > ${controlFileMax};'";
ExecStop = "${getExe pkgs.bash} -c 'echo ${toString cfg.offMax} > ${controlFileMax}; echo ${toString cfg.offMin} > ${controlFileMin};'";
};
};
# HACK: Allow user access.
tmpfiles.rules = [
"z ${controlFileMax} 0777 - - - -"
"z ${controlFileMin} 0777 - - - -"
];
};
};
}

73
module/Powersave.nix Normal file
View file

@ -0,0 +1,73 @@
{ lib, config, pkgs, ... }: with lib; let
cfg = config.module.powersave;
script = pkgs.writeShellScriptBin "powersave" ''
function toggle() {
if status; then
echo ${cfg.cpu.boost.disableCmd} > ${cfg.cpu.boost.controlFile}
else
echo ${cfg.cpu.boost.enableCmd} > ${cfg.cpu.boost.controlFile}
fi
true
}
function waybar() {
status || echo -n "󰓅"
}
function status() {
local current=$(cat ${cfg.cpu.boost.controlFile})
local enabled="${cfg.cpu.boost.enableCmd}"
[[ "''${current}" = "''${enabled}" ]]
}
''${@}
'';
in {
options = {
module.powersave = {
enable = mkEnableOption "Powersave";
cpu.boost = mkOption {
default = {};
type = types.submodule {
options = {
disableCmd = mkOption {
default = null;
type = types.str;
};
enableCmd = mkOption {
default = null;
type = types.str;
};
controlFile = mkOption {
default = null;
type = types.str;
};
};
};
};
};
};
config = mkIf cfg.enable {
environment.systemPackages = [ script ];
systemd = {
services.powersave-cpu = {
description = "Disable CPU Boost";
enable = true;
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "simple";
RemainAfterExit = "yes";
ExecStart = "${getExe pkgs.bash} -c 'echo ${cfg.cpu.boost.enableCmd} > ${cfg.cpu.boost.controlFile}'";
ExecStop = "${getExe pkgs.bash} -c 'echo ${cfg.cpu.boost.disableCmd} > ${cfg.cpu.boost.controlFile}'";
};
};
# HACK: Allow user access.
tmpfiles.rules = [ "z ${cfg.cpu.boost.controlFile} 0777 - - - -" ];
};
};
}

21
module/PowersaveAmd.nix
View file

@ -1,21 +0,0 @@
# AMD CPU boost control.
{ pkgs, ... } @args: let
controlFile = "/sys/devices/system/cpu/cpufreq/boost";
enable = "0";
disable = "1";
script = pkgs.writeShellScriptBin "powersave" (import ./powersave/Script.nix {
inherit controlFile enable disable;
}).script;
in {
# Requirements:
# CPPC (Collaborative Power Control) - Disabled.
# PSS (Cool and Quiet) - Enabled.
imports = [
(import ./powersave ({
inherit controlFile enable disable;
} // args))
];
environment.systemPackages = [ script ];
}

18
module/PowersaveIntel.nix
View file

@ -1,18 +0,0 @@
# Intel CPU boost control.
{ pkgs, ... } @args: let
controlFile = "/sys/devices/system/cpu/intel_pstate/no_turbo";
enable = "1";
disable = "0";
script = pkgs.writeShellScriptBin "powersave" (import ./powersave/Script.nix {
inherit controlFile enable disable;
}).script;
in {
imports = [
(import ./powersave ({
inherit controlFile enable disable;
} // args))
];
environment.systemPackages = [ script ];
}

10
module/Print.nix
View file

@ -1,4 +1,11 @@
{ ... }: {
{ pkgs, lib, config, ... }: with lib; let
cfg = config.module.print;
in {
options = {
module.print.enable = mkEnableOption "Add support for printers.";
};
config = mkIf cfg.enable {
services.printing = {
enable = true;
clientConf = ''
@ -6,4 +13,5 @@
ServerName 192.168.1.2
'';
};
};
}

54
module/RemoteBuild.nix
View file

@ -1,5 +1,53 @@
# Module that enables remote builds. This is a client configuration.
{ lib, secret, ... }: {
{ pkgs, lib, config, secret, ... }: with lib; let
cfg = config.module.builder;
serverKeyPath = "/root/.nixbuilder";
in {
options = {
module.builder = {
server.enable = mkEnableOption "This is a builder server.";
client.enable = mkEnableOption "This is a builder client.";
};
};
config = mkMerge [
(mkIf cfg.server.enable {
# Service that generates new key on boot if not present.
# Don't forget to add new key to secret.ssh.buildKeys.
systemd.services.generate-nix-cache-key = {
wantedBy = [ "multi-user.target" ];
serviceConfig.Type = "oneshot";
path = [ pkgs.nix ];
script = ''
[[ -f "${serverKeyPath}/private-key" ]] && exit
mkdir ${serverKeyPath} || true
nix-store --generate-binary-cache-key "nixbuilder-1" "${serverKeyPath}/private-key" "${serverKeyPath}/public-key"
nix store sign --all -k "${serverKeyPath}/private-key"
'';
};
# Add `nixbuilder` restricted user.
users.groups.nixbuilder = {};
users.users.nixbuilder = {
openssh.authorizedKeys.keys = secret.ssh.buildKeys;
description = "Nix Remote Builder";
isNormalUser = true;
createHome = lib.mkForce false;
uid = 1234;
home = "/";
group = "nixbuilder";
};
# Sign store automatically.
# Sign existing store with: nix store sign --all -k /path/to/secret-key-file
nix.settings = {
trusted-users = [ "nixbuilder" ];
secret-key-files = [ "${serverKeyPath}/private-key" ];
};
})
(mkIf cfg.client.enable {
# NOTE: Requires host private key to be present in secret.ssh.builderKeys.
nix.buildMachines = [{
hostName = "nixbuilder";
@ -18,7 +66,7 @@
nix.settings = let
substituters = [ "ssh-ng://nixbuilder" ];
in {
substituters = lib.mkForce substituters;
substituters = mkForce substituters;
trusted-substituters = substituters;
builders-use-substitutes = true;
max-jobs = 0;
@ -26,4 +74,6 @@
# require-sigs = false;
# substitute = false;
};
})
];
}

37
module/RemoteBuilder.nix
View file

@ -1,37 +0,0 @@
# Module that enables remote builds. This is a server configuration.
{ pkgs, secret, lib, ... }: let
keyPath = "/root/.nixbuilder";
in {
# Service that generates new key on boot if not present.
# Don't forget to add new key to secret.ssh.buildKeys.
systemd.services.generate-nix-cache-key = {
wantedBy = [ "multi-user.target" ];
serviceConfig.Type = "oneshot";
path = [ pkgs.nix ];
script = ''
[[ -f "${keyPath}/private-key" ]] && exit
mkdir ${keyPath} || true
nix-store --generate-binary-cache-key "nixbuilder-1" "${keyPath}/private-key" "${keyPath}/public-key"
nix store sign --all -k "${keyPath}/private-key"
'';
};
# Add `nixbuilder` restricted user.
users.groups.nixbuilder = {};
users.users.nixbuilder = {
openssh.authorizedKeys.keys = secret.ssh.buildKeys;
description = "Nix Remote Builder";
isNormalUser = true;
createHome = lib.mkForce false;
uid = 1234;
home = "/";
group = "nixbuilder";
};
# Sign store automatically.
# Sign existing store with: nix store sign --all -k /path/to/secret-key-file
nix.settings = {
trusted-users = [ "nixbuilder" ];
secret-key-files = [ "${keyPath}/private-key" ];
};
}

10
part/Setting.nix → module/Setting.nix
View file

@ -5,6 +5,8 @@
,lib
, ... }: {
options.setting = with lib; {
# Ollama settings.
# I use the best light model by default.
ollama = mkOption {
default = { };
type = types.submodule {
@ -18,6 +20,7 @@
};
};
# Default browser settings.
browser = mkOption {
default = { };
type = types.submodule {
@ -30,6 +33,7 @@
};
};
# Terminal settings.
terminal = mkOption {
default = { };
type = types.submodule {
@ -42,16 +46,19 @@
};
};
# Whether to use Dpi-aware setting in supported apps.
dpiAware = mkOption {
default = false;
type = types.bool;
};
# The key used for system-related shortcuts.
sysctrl = mkOption {
default = "print";
type = types.str;
};
# Keyboard options.
keyboard = mkOption {
default = { };
type = types.submodule {
@ -68,6 +75,7 @@
};
};
# Settings related to different refreshes, like top apps.
refresh = mkOption {
default = { };
type = types.submodule {
@ -80,6 +88,7 @@
};
};
# Configure steps for different actions.
step = mkOption {
default = { };
type = types.submodule {
@ -100,6 +109,7 @@
};
};
# Specify timeouts.
timeout = mkOption {
default = { };
type = types.submodule {

10
module/StrongSwan.nix
View file

@ -1,4 +1,11 @@
{ pkgs, ... }: {
{ pkgs, lib, config, ... }: with lib; let
cfg = config.module.strongswan;
in {
options = {
module.strongswan.enable = mkEnableOption "StrongSwan Vpn support.";
};
config = mkIf cfg.enable {
environment.systemPackages = with pkgs; [
networkmanager-l2tp
gnome.networkmanager-l2tp
@ -18,4 +25,5 @@
# systemd.tmpfiles.rules = [
# "L /etc/ipsec.secrets - - - - /etc/ipsec.d/ipsec.nm-l2tp.secrets"
# ];
};
}

91
module/Style.nix Normal file
View file

@ -0,0 +1,91 @@
{ pkgs, lib, config, ... }: with lib; let
cfg = config.module.style;
in {
options = let
mkTypeOption = default: type: mkOption { inherit default type; };
mkStrOption = default: mkTypeOption default types.str;
mkIntOption = default: mkTypeOption default types.int;
mkFloatOption = default: mkTypeOption default types.float;
in {
module.style = {
color = {
bg = {
dark = mkStrOption config.lib.stylix.colors.base00;
light = mkStrOption config.lib.stylix.colors.base07;
regular = mkStrOption config.lib.stylix.colors.base01;
};
fg = {
dark = mkStrOption config.lib.stylix.colors.base04;
light = mkStrOption config.lib.stylix.colors.base06;
regular = mkStrOption config.lib.stylix.colors.base05;
};
accent = mkStrOption config.lib.stylix.colors.base0A;
heading = mkStrOption config.lib.stylix.colors.base0D;
hl = mkStrOption config.lib.stylix.colors.base03;
keyword = mkStrOption config.lib.stylix.colors.base0E;
link = mkStrOption config.lib.stylix.colors.base09;
misc = mkStrOption config.lib.stylix.colors.base0F;
negative = mkStrOption config.lib.stylix.colors.base08;
neutral = mkStrOption config.lib.stylix.colors.base0C;
positive = mkStrOption config.lib.stylix.colors.base0B;
selection = mkStrOption config.lib.stylix.colors.base02;
transparent = mkStrOption "ffffff00";
accent-b = mkStrOption config.lib.stylix.colors.base0A-rgb-b;
accent-g = mkStrOption config.lib.stylix.colors.base0A-rgb-g;
accent-r = mkStrOption config.lib.stylix.colors.base0A-rgb-r;
negative-b = mkStrOption config.lib.stylix.colors.base08-rgb-b;
negative-g = mkStrOption config.lib.stylix.colors.base08-rgb-g;
negative-r = mkStrOption config.lib.stylix.colors.base08-rgb-r;
neutral-b = mkStrOption config.lib.stylix.colors.base0C-rgb-b;
neutral-g = mkStrOption config.lib.stylix.colors.base0C-rgb-g;
neutral-r = mkStrOption config.lib.stylix.colors.base0C-rgb-r;
positive-b = mkStrOption config.lib.stylix.colors.base0B-rgb-b;
positive-g = mkStrOption config.lib.stylix.colors.base0B-rgb-g;
positive-r = mkStrOption config.lib.stylix.colors.base0B-rgb-r;
bg-b = mkStrOption config.lib.stylix.colors.base00-rgb-b;
bg-g = mkStrOption config.lib.stylix.colors.base00-rgb-g;
bg-r = mkStrOption config.lib.stylix.colors.base00-rgb-r;
fg-b = mkStrOption config.lib.stylix.colors.base06-rgb-b;
fg-g = mkStrOption config.lib.stylix.colors.base06-rgb-g;
fg-r = mkStrOption config.lib.stylix.colors.base06-rgb-r;
border = mkStrOption config.lib.stylix.colors.base01;
border-b = mkStrOption config.lib.stylix.colors.base01-rgb-b;
border-g = mkStrOption config.lib.stylix.colors.base01-rgb-g;
border-r = mkStrOption config.lib.stylix.colors.base01-rgb-r;
};
font = {
emoji.name = mkStrOption config.stylix.fonts.emoji.name;
monospace.name = mkStrOption config.stylix.fonts.monospace.name;
sansSerif.name = mkStrOption config.stylix.fonts.sansSerif.name;
serif.name = mkStrOption config.stylix.fonts.serif.name;
size = {
terminal = mkIntOption config.stylix.fonts.sizes.terminal;
popup = mkIntOption config.stylix.fonts.sizes.popups;
application = mkIntOption config.stylix.fonts.sizes.applications;
desktop = mkIntOption config.stylix.fonts.sizes.desktop;
};
};
opacity = {
application = mkFloatOption config.stylix.opacity.applications;
desktop = mkFloatOption config.stylix.opacity.desktop;
popup = mkFloatOption config.stylix.opacity.popups;
terminal = mkFloatOption config.stylix.opacity.terminal;
hex = mkStrOption "D9";
};
window = {
gap = mkIntOption 8;
border = mkIntOption 4;
};
};
};
}

43
module/Sway.nix
View file

@ -1,43 +0,0 @@
{ pkgs, lib, ... } @args: let
sway = import ./desktop/sway args;
config = pkgs.writeText "swayConfig" sway.config;
script = pkgs.writeShellScriptBin "swayscript" sway.script;
in {
imports = [
./desktop/App.nix
./desktop/Bluetooth.nix
./desktop/Brightness.nix
./desktop/Dconf.nix
./desktop/Portal.nix
./desktop/Realtime.nix
./desktop/Sound.nix
./desktop/Waybar.nix
./desktop/Wayland.nix
];
services.gnome.gnome-keyring.enable = lib.mkForce false;
environment = {
systemPackages = with pkgs; [
fuzzel # Application launcher.
grim slurp # Screenshot.
mako # Notification system.
networkmanagerapplet # Internet configuration.
pamixer pavucontrol pulseaudio # Audio.
playerctl # Multimedia controls.
script # My custom Sway shell scripts.
];
variables.XDG_CURRENT_DESKTOP = "sway";
};
programs.sway = {
enable = true;
wrapperFeatures = {
base = true;
gtk = true;
};
extraOptions = [
"--config=${config}"
];
};
}

10
module/Tablet.nix
View file

@ -1,6 +1,14 @@
{ pkgs, ... }: {
{ pkgs, lib, config, ... }: with lib; let
cfg = config.module.tablet;
in {
options = {
module.tablet.enable = mkEnableOption "Support for tables.";
};
config = mkIf cfg.enable {
hardware.opentabletdriver.enable = true;
environment.systemPackages = with pkgs; [
krita
];
};
}

10
module/VirtManager.nix
View file

@ -1,4 +1,11 @@
{ pkgs, ... }: {
{ pkgs, lib, config, ... }: with lib; let
cfg = config.module.virtmanager;
in {
options = {
module.virtmanager.enable = mkEnableOption "VM support.";
};
config = mkIf cfg.enable {
virtualisation.libvirtd.enable = true;
programs.virt-manager.enable = true;
@ -8,4 +15,5 @@
# glib
gnome3.adwaita-icon-theme # default gnome cursors,
];
};
}

11
module/common/Apks.nix
View file

@ -1,8 +1,17 @@
# I want to pull all the Apk files in their current state
# so that I always have an access to clients that match
# my service versions.
{ pkgs, ... } @args: let
{ pkgs, lib, config, ... } @args: with lib; let
cfg = config.module.common.apks;
package = (pkgs.callPackage ./apks args);
in {
options = {
module.common.apks = {
enable = mkEnableOption "Android Apps Apk" // { default = true; };
};
};
config = mkIf cfg.enable {
environment.etc.apks.source = package;
};
}

18
module/common/AutoUpdateSigned.nix
View file

@ -2,7 +2,16 @@
# This is a systemd service that pulls updates every hour.
# Unlike system.autoUpgrade, this script also verifies my git signature
# to prevent unathorized changes to hosts.
{ const, pkgs, lib, secret, util, ... }: {
{ const, pkgs, lib, util, config, ... }: with lib; let
cfg = config.module.common.autoupdate;
in {
options = {
module.common.autoupdate = {
enable = mkEnableOption "System auto-updates." // { default = true; };
};
};
config = mkIf cfg.enable {
systemd.services.autoupdate = util.mkStaticSystemdService {
enable = true;
description = "Signed system auto-update.";
@ -17,13 +26,13 @@
script = ''
pushd /tmp
rm -rf ./nixos
${lib.getExe pkgs.git} clone --depth=1 --single-branch --branch=main ${const.url} ./nixos
${getExe pkgs.git} clone --depth=1 --single-branch --branch=main ${const.url} ./nixos
pushd ./nixos
${lib.getExe pkgs.git} verify-commit HEAD || {
${getExe pkgs.git} verify-commit HEAD || {
echo "Verification failed."
exit 1
};
${lib.getExe pkgs.gnumake} switch
${getExe pkgs.gnumake} switch
'';
after = [ "network-online.target" ];
wants = [ "network-online.target" ];
@ -39,4 +48,5 @@
};
wantedBy = [ "timers.target" ];
};
};
}

2
module/common/Bash.nix
View file

@ -1,4 +1,4 @@
{ lib, style, util, pkgs, ... } @args: let
{ lib, util, pkgs, ... } @args: let
bash = import ./bash args;
in {
# Add my bash configuration to all *interactive* shells.

20
module/common/Distrobox.nix
View file

@ -1,8 +1,16 @@
{ pkgs, ... }: {
# Distrobox works best with Podman, so enable it here.
imports = [ ./Podman.nix ];
{ pkgs, lib, config, ... }: with lib; let
cfg = config.module.common.distrobox;
in {
options = {
module.common.distrobox = {
enable = mkEnableOption "Distrobox." // { default = true; };
};
};
environment.systemPackages = with pkgs; [
distrobox
];
config = mkIf cfg.enable {
# Distrobox works best with Podman, so enable it here.
module.podman.enable = true;
environment.systemPackages = with pkgs; [ distrobox ];
};
}

1
module/common/Filesystem.nix
View file

@ -13,6 +13,7 @@
};
# /etc overlay.
# ISSUE: Should be fixed when you read this. Try it!
# boot.initrd.systemd.enable = true;
# systemd.sysusers.enable = true;
# system.etc.overlay = {

19
module/common/Kernel.nix
View file

@ -1,7 +1,22 @@
{ pkgs, ... }: {
{ pkgs, config, lib, ... }: with lib; let
cfg = config.module.common.kernel;
in {
options = {
module.common.kernel = {
latest = mkOption {
default = true;
type = types.bool;
};
};
};
config = mkMerge [
(mkIf cfg.latest {
# Use latest kernel.
boot.kernelPackages = pkgs.linuxPackages_latest;
})
{
boot.kernel.sysctl = {
# # Spoof protection.
# "net.ipv4.conf.default.rp_filter" = 1;
@ -56,4 +71,6 @@
# "net.ipv6.conf.lo.disable_ipv6" = 1;
# "net.ipv6.conf.eth0.disable_ipv6" = 1;
};
}
];
}

12
module/common/Keyd.nix
View file

@ -1,4 +1,13 @@
{ pkgs, config, ... }: {
{ pkgs, config, lib, ... }: with lib; let
cfg = config.module.common.keyd;
in {
options = {
module.common.keyd = {
enable = mkEnableOption "Keyboard remaps." // { default = true; };
};
};
config = mkIf cfg.enable {
environment.systemPackages = with pkgs; [ keyd ];
services.keyd = {
@ -85,4 +94,5 @@
# Debug toggle just in case I need it again.
# systemd.services.keyd.environment.KEYD_DEBUG = "1";
};
}

Some files were not shown because too many files have changed in this diff Show more