Grimmauld/grimm-nixos-laptop
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Compare commits

base: Grimmauld:06b37c6d92ce93d09555de9d0bf3f48e45eb5c97
Branches Tags
Grimmauld:main
Grimmauld:server-migration
..
compare: Grimmauld:7fd47c51c033c956ff99b91b0bd0c2524ae87455
Branches Tags
Grimmauld:main
Grimmauld:server-migration

No commits in common. "06b37c6d92ce93d09555de9d0bf3f48e45eb5c97" and "7fd47c51c033c956ff99b91b0bd0c2524ae87455" have entirely different histories.
06b37c6d92 ... 7fd47c51c0

32 changed files with 514 additions and 650 deletions
Show stats Expand all files Collapse all files

2
common/cloudsync.nix
View file

@ -57,7 +57,7 @@ in
let let
remote_clean = lib.strings.concatStrings (builtins.match "/*(.+)" remote); remote_clean = lib.strings.concatStrings (builtins.match "/*(.+)" remote);
in in
"${cloud_cmd} /${remote_clean} ${local} ${sync_server} 1> /dev/null" "${cloud_cmd} /${remote_clean} ${local} ${sync_server}"
) paths ) paths
); );
in in

6
common/firefox.nix
View file

@ -38,13 +38,11 @@ in
policies = { policies = {
ExtensionSettings = ExtensionSettings =
# (mkIf firefox.disableUserPlugins { "*".installation_mode = "blocked"; }) // # (mkIf firefox.disableUserPlugins { "*".installation_mode = "blocked"; }) //
( (mapAttrs (guid: shortId: {
mapAttrs (guid: shortId: {
# explicit plugins by config # explicit plugins by config
install_url = "https://addons.mozilla.org/en-US/firefox/downloads/latest/${shortId}/latest.xpi"; install_url = "https://addons.mozilla.org/en-US/firefox/downloads/latest/${shortId}/latest.xpi";
installation_mode = "force_installed"; installation_mode = "force_installed";
}) config.grimmShared.firefox.plugins }) config.grimmShared.firefox.plugins);
);
DisableTelemetry = true; DisableTelemetry = true;
DisableFirefoxStudies = true; DisableFirefoxStudies = true;
EnableTrackingProtection = { EnableTrackingProtection = {

6
common/graphics/opengl.nix
View file

@ -50,11 +50,9 @@ in
]; ];
}; };
environment.sessionVariables = { environment.sessionVariables = { LIBVA_DRIVER_NAME = "iHD"; }; # Force intel-media-driver
LIBVA_DRIVER_NAME = "iHD";
}; # Force intel-media-driver
# chaotic.mesa-git.enable = true; # chaotic.mesa-git.enable = true;
boot.kernelParams = [ "nouveau.config=NvGspRm=1" ]; boot.kernelParams = [ "nouveau.config=NvGspRm=1" ];
environment.sessionVariables = { environment.sessionVariables = {

6
common/graphics/qt.nix
View file

@ -19,10 +19,10 @@ in
with pkgs; with pkgs;
with kdePackages; with kdePackages;
[ [
# qtstyleplugin-kvantum # qtstyleplugin-kvantum
catppuccin-sddm-corners catppuccin-sddm-corners
libsForQt5.qtgraphicaleffects libsForQt5.qtgraphicaleffects
# catppuccin-kvantum # catppuccin-kvantum
breeze breeze
kdePackages.audiocd-kio kdePackages.audiocd-kio
kdePackages.kio-extras kdePackages.kio-extras
@ -33,7 +33,7 @@ in
qtwayland qtwayland
]; ];
# environment.pathsToLink = [ "/share/Kvantum" ]; # environment.pathsToLink = [ "/share/Kvantum" ];
services.displayManager = { services.displayManager = {
sddm = { sddm = {

6
common/graphics/sway.nix
View file

@ -87,9 +87,7 @@ let
export SWAYSOCK="/run/user/$uid/sway-ipc.$uid.$pid.sock" export SWAYSOCK="/run/user/$uid/sway-ipc.$uid.$pid.sock"
if [[ -e "$SWAYSOCK" ]] ; then if [[ -e "$SWAYSOCK" ]] ; then
echo "sock is $SWAYSOCK" echo "sock is $SWAYSOCK"
${getExe' config.programs.sway.package "swaymsg"} '${ ${getExe' config.programs.sway.package "swaymsg"} '${concatMapStrings (s: s + " ; ") output_def}'
concatMapStrings (s: s + " ; ") output_def
}'
fi fi
done done
''; '';
@ -212,7 +210,7 @@ in
}; };
extraPackages = with pkgs; [ extraPackages = with pkgs; [
# swaylock # swaylock
swayidle swayidle
wl-clipboard wl-clipboard
wf-recorder wf-recorder

41
common/hardware/laptop.nix
View file

@ -32,9 +32,6 @@ in
# hardware.i2c.enable = true; # hardware.i2c.enable = true;
services.libinput.enable = true; services.libinput.enable = true;
hardware.opentabletdriver.enable = true; hardware.opentabletdriver.enable = true;
systemd.user.services.opentabletdriver.after = [ "local-fs.target" ];
services.udisks2.enable = true; services.udisks2.enable = true;
#services.udev.extraRules = '' #services.udev.extraRules = ''
@ -45,29 +42,25 @@ in
# ENV{SYSTEMD_WANTS}+="ddcci@$kernel.service" # ENV{SYSTEMD_WANTS}+="ddcci@$kernel.service"
#''; #'';
# systemd.services."ddcci@" = { systemd.services."ddcci@" = {
# scriptArgs = "%i"; scriptArgs = "%i";
# script = '' script = ''
# sleep 20 sleep 20
# echo Trying to attach ddcci to $1 echo Trying to attach ddcci to $1
# i=0 i=0
# id=$(echo $1 | cut -d "-" -f 2) id=$(echo $1 | cut -d "-" -f 2)
# if ${lib.getExe' pkgs.ddcutil "ddcutil"} getvcp 10 -b $id; then if ${lib.getExe' pkgs.ddcutil "ddcutil"} getvcp 10 -b $id; then
# echo ddcci 0x37 > /sys/bus/i2c/devices/$1/new_device echo ddcci 0x37 > /sys/bus/i2c/devices/$1/new_device
# fi fi
# ''; '';
# serviceConfig.Type = "oneshot"; serviceConfig.Type = "oneshot";
#}; };
systemd.enableCgroupAccounting = true; systemd.enableCgroupAccounting = true;
# systemd.enableUnifiedCgroupHierarchy = false; # systemd.enableUnifiedCgroupHierarchy = false;
boot = { boot = {
kernelParams = [ kernelParams = [ "intel_iommu=on" "nohibernate" ];
"intel_iommu=on"
"nohibernate"
"pcie_aspm=off"
];
loader.efi.canTouchEfiVariables = true; loader.efi.canTouchEfiVariables = true;
initrd.availableKernelModules = [ initrd.availableKernelModules = [
"xhci_pci" "xhci_pci"
@ -77,12 +70,12 @@ in
"usb_storage" "usb_storage"
"sd_mod" "sd_mod"
]; ];
# initrd.systemd.enable = true; # initrd.systemd.enable = true;
loader.systemd-boot.enable = true; loader.systemd-boot.enable = true;
# extraModulePackages = [ config.boot.kernelPackages.ddcci-driver ]; # extraModulePackages = [ config.boot.kernelPackages.ddcci-driver ];
kernelModules = [ kernelModules = [
# "ddcci_backlight" "ddcci_backlight"
# "i2c-dev" "i2c-dev"
"ec_sys" "ec_sys"
]; ];
}; };

12
common/sound/spotifyd.nix
View file

@ -61,17 +61,9 @@ in
password_cmd = password_cmd =
let let
pass = spotify.spotifyd.pass; pass = spotify.spotifyd.pass;
inherit (lib) inherit (lib) isPath isString getExe getExe';
isPath
isString
getExe
getExe'
;
in in
if (isPath pass || isString pass) then if (isPath pass || isString pass) then "${getExe' pkgs.coreutils-full "cat"} ${pass}" else (getExe pass);
"${getExe' pkgs.coreutils-full "cat"} ${pass}"
else
(getExe pass);
device_type = "computer"; device_type = "computer";
dbus_type = "system"; dbus_type = "system";
device = "default"; device = "default";

25
common/tooling/apparmor/apparmor-d-module.nix
View file

@ -5,30 +5,18 @@
... ...
}: }:
let let
inherit (lib) inherit (lib) mkIf mapAttrs assertMsg pathIsRegularFile mkForce;
mkIf
mapAttrs
assertMsg
pathIsRegularFile
mkForce
;
cfg = config.security.apparmor_d; cfg = config.security.apparmor_d;
apparmor-d = pkgs.callPackage ./apparmor-d-package.nix { }; apparmor-d = pkgs.callPackage ./apparmor-d-package.nix {};
in in
{ {
options.security.apparmor_d = with lib; { options.security.apparmor_d = with lib; {
enable = mkEnableOption "enable apparmor.d support"; enable = mkEnableOption "enable apparmor.d support";
profiles = mkOption { profiles = mkOption {
type = types.attrsOf ( type = types.attrsOf (types.enum [ "disable" "complain" "enforce" ]);
types.enum [ default = {};
"disable"
"complain"
"enforce"
]
);
default = { };
description = "set of apparmor profiles to include from apparmor.d"; description = "set of apparmor profiles to include from apparmor.d";
}; };
}; };
@ -37,8 +25,7 @@ in
security.apparmor.packages = [ apparmor-d ]; security.apparmor.packages = [ apparmor-d ];
security.apparmor.policies = mapAttrs (name: state: { security.apparmor.policies = mapAttrs (name: state: {
inherit state; inherit state;
path = path = let
let
file = "${apparmor-d}/etc/apparmor.d/${name}"; file = "${apparmor-d}/etc/apparmor.d/${name}";
in in
assert assertMsg (pathIsRegularFile file) "profile ${name} not found in apparmor.d path (${file})"; assert assertMsg (pathIsRegularFile file) "profile ${name} not found in apparmor.d path (${file})";

8
common/tooling/apparmor/apparmor-d-package.nix
View file

@ -1,10 +1,4 @@
{ { buildGoModule, fetchFromGitHub, git, lib, unstableGitUpdater }:
buildGoModule,
fetchFromGitHub,
git,
lib,
unstableGitUpdater,
}:
buildGoModule { buildGoModule {
pname = "apparmor-d"; pname = "apparmor-d";
version = "unstable-2024-10-12"; version = "unstable-2024-10-12";

97
common/tooling/apparmor/default.nix
View file

@ -23,7 +23,7 @@ in
alias /bin/spotify -> ${pkgs.spotify}/share/spotify/spotify, alias /bin/spotify -> ${pkgs.spotify}/share/spotify/spotify,
''; '';
# security.apparmor.aa-alias-manager.enable = false; # security.apparmor.aa-alias-manager.enable = false;
security.audit.backlogLimit = 512; security.audit.backlogLimit = 512;
@ -51,6 +51,7 @@ in
}; };
}; };
security.apparmor.includes = { security.apparmor.includes = {
"abstractions/base" = '' "abstractions/base" = ''
/nix/store/*/bin/** mr, /nix/store/*/bin/** mr,
@ -60,11 +61,12 @@ in
${getExe' pkgs.coreutils-full "coreutils"} rix, ${getExe' pkgs.coreutils-full "coreutils"} rix,
''; '';
# "tunables/alias.d/store" = '' # "tunables/alias.d/store" = ''
# include <tunables/global> # include <tunables/global>
# alias /bin -> @{bin}, # alias /bin -> @{bin},
# alias /bin/ -> /nix/store/*/bin/, # alias /bin/ -> /nix/store/*/bin/,
# ''; # '';
"local/speech-dispatcher" = '' "local/speech-dispatcher" = ''
@{nix_store}/libexec/speech-dispatcher-modules/* ix, @{nix_store}/libexec/speech-dispatcher-modules/* ix,
@ -83,10 +85,10 @@ in
''; '';
"local/xdg-mime" = '' "local/xdg-mime" = ''
# include <abstractions/app/bus> # include <abstractions/app/bus>
/bin/grep rix, /bin/grep rix,
/bin/gawk rix, /bin/gawk rix,
# /bin/dbus-send Cx -> bus, # /bin/dbus-send Cx -> bus,
/dev/tty* rw, /dev/tty* rw,
''; '';
@ -121,7 +123,7 @@ in
@{bin}/grep ix, @{bin}/grep ix,
/@{PROC}/version r, /@{PROC}/version r,
@{bin}/gdbus Cx -> bus, @{bin}/gdbus Cx -> bus,
# @{bin}/gdbus Ux, # @{bin}/gdbus Ux,
''; '';
"local/vesktop" = '' "local/vesktop" = ''
@ -143,16 +145,16 @@ in
@{bin}/unix_chkpwd rix, @{bin}/unix_chkpwd rix,
''; '';
# "local/spotify" = '' # "local/spotify" = ''
# @{bin}/ # @{bin}/
# ''; # '';
}; };
security.apparmor.policies = { security.apparmor.policies = {
passff = { passff = {
state = "enforce"; state = "enforce";
# enable = true; # enable = true;
# enforce = true; # enforce = true;
profile = '' profile = ''
abi <abi/4.0>, abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@ -166,8 +168,8 @@ in
swaymux = { swaymux = {
state = "enforce"; state = "enforce";
# enable = true; # enable = true;
# enforce = true; # enforce = true;
profile = '' profile = ''
abi <abi/4.0>, abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@ -180,41 +182,42 @@ in
''; '';
}; };
# speech-dispatcher-test = { # speech-dispatcher-test = {
# enable = true; # enable = true;
# enforce = true; # enforce = true;
# profile = ''# # profile = ''#
# #
#abi <abi/4.0>, #abi <abi/4.0>,
# #
#include <tunables/global> #include <tunables/global>
# #
#@{exec_path} = @{bin}/speech-dispatcher #@{exec_path} = @{bin}/speech-dispatcher
#profile speech-dispatcher ${getExe' pkgs.speechd "speech-dispatcher"} flags=(complain) { #profile speech-dispatcher ${getExe' pkgs.speechd "speech-dispatcher"} flags=(complain) {
# include <abstractions/base> # include <abstractions/base>
# include <abstractions/audio-client> # include <abstractions/audio-client>
# include <abstractions/bus-session> # include <abstractions/bus-session>
# include <abstractions/consoles> # include <abstractions/consoles>
# include <abstractions/nameservice-strict> # include <abstractions/nameservice-strict>
# network inet stream, # network inet stream,
# network inet6 stream, # network inet6 stream,
# @{exec_path} mr, # @{exec_path} mr,
# @{sh_path} ix, # @{sh_path} ix,
# @{lib}/speech-dispatcher/** r, # @{lib}/speech-dispatcher/** r,
# @{lib}/speech-dispatcher/speech-dispatcher-modules/* ix, # @{lib}/speech-dispatcher/speech-dispatcher-modules/* ix,
# /etc/machine-id r, # /etc/machine-id r,
# /etc/speech-dispatcher/{,**} r, # /etc/speech-dispatcher/{,**} r,
# owner @{run}/user/@{uid}/speech-dispatcher/ rw, # owner @{run}/user/@{uid}/speech-dispatcher/ rw,
# owner @{run}/user/@{uid}/speech-dispatcher/** rwk, # owner @{run}/user/@{uid}/speech-dispatcher/** rwk,
# include if exists <local/speech-dispatcher>
#} '';
# };
# include if exists <local/speech-dispatcher>
#} '';
# };
sleep = { sleep = {
state = "enforce"; state = "enforce";
@ -229,8 +232,8 @@ in
osu-lazer = { osu-lazer = {
state = "disable"; state = "disable";
# enable = true; # enable = true;
# enforce = true; # enforce = true;
profile = '' profile = ''
abi <abi/4.0>, abi <abi/4.0>,
include <tunables/global> include <tunables/global>

2
common/tooling/default.nix
View file

@ -54,7 +54,7 @@ in
p7zip p7zip
fbcat fbcat
# gomuks # gomuks
imagemagick imagemagick
nmap nmap

1
common/tooling/nix.nix
View file

@ -11,7 +11,6 @@
nix-output-monitor nix-output-monitor
nix-search-cli nix-search-cli
niv niv
nvd
vulnix vulnix
nix-init nix-init
]; ];

6
common/tooling/opensnitch/block_lists.nix
View file

@ -1,8 +1,4 @@
{ { stdenv, fetchFromGitHub, lib }:
stdenv,
fetchFromGitHub,
lib,
}:
stdenv.mkDerivation rec { stdenv.mkDerivation rec {
pname = "stevenblack_block"; pname = "stevenblack_block";
version = "3.14.116"; version = "3.14.116";

2
common/tooling/ranger.nix
View file

@ -21,7 +21,7 @@ let
rev = "981756147834bb485ebcfa0e41ad60d05ccc4351"; rev = "981756147834bb485ebcfa0e41ad60d05ccc4351";
hash = "sha256-5nFpEO/54MO6Esvkcqcyw2TI37ham70LkHtOXrYXfbY="; hash = "sha256-5nFpEO/54MO6Esvkcqcyw2TI37ham70LkHtOXrYXfbY=";
}; };
# inputs.ranger_udisk_menu; # inputs.ranger_udisk_menu;
}; };
in in
{ {

6
common/tooling/security.nix
View file

@ -46,7 +46,7 @@ in
gnupg gnupg
libsecret libsecret
vulnix vulnix
# agenix # agenix
yubikey-manager yubikey-manager
yubico-pam yubico-pam
@ -70,9 +70,7 @@ in
enableSSHSupport = true; enableSSHSupport = true;
}; };
grimmShared.firefox.plugins = mkIf (tooling.enable && tooling.pass) { grimmShared.firefox.plugins = mkIf (tooling.enable && tooling.pass) { "passff@invicem.pro" = "passff"; };
"passff@invicem.pro" = "passff";
};
}; };
options.grimmShared.tooling.pass = mkEnableOption "Enables password-store, gnupg and such secret handling"; options.grimmShared.tooling.pass = mkEnableOption "Enables password-store, gnupg and such secret handling";

22
common/tooling/wine.nix
View file

@ -1,9 +1,4 @@
{ { pkgs, config, lib, ... }:
pkgs,
config,
lib,
...
}:
let let
inherit (config.grimmShared) enable tooling; inherit (config.grimmShared) enable tooling;
inherit (lib) inherit (lib)
@ -20,12 +15,13 @@ in
programs.virt-manager.enable = true; programs.virt-manager.enable = true;
virtualisation.spiceUSBRedirection.enable = true; virtualisation.spiceUSBRedirection.enable = true;
# dconf.settings = { # dconf.settings = {
# "org/virt-manager/virt-manager/connections" = { # "org/virt-manager/virt-manager/connections" = {
# autoconnect = ["qemu:///system"]; # autoconnect = ["qemu:///system"];
# uris = ["qemu:///system"]; # uris = ["qemu:///system"];
# }; # };
# }; # };
environment.systemPackages = with pkgs; [ environment.systemPackages = with pkgs; [
winetricks winetricks
@ -33,7 +29,7 @@ in
dotnetCorePackages.dotnet_9.sdk dotnetCorePackages.dotnet_9.sdk
# jetbrains.rider # jetbrains.rider
mono4 mono4
# (mono4.overrideAttrs { version="4.6.1"; sha256=""; }) # (mono4.overrideAttrs { version="4.6.1"; sha256=""; })
tesseract4 tesseract4
]; ];
}; };

16
common/xdg/portals.nix
View file

@ -51,14 +51,14 @@ in
environment.sessionVariables = { environment.sessionVariables = {
XDG_CONFIG_HOME = "$HOME/.config"; XDG_CONFIG_HOME = "$HOME/.config";
XDG_DESKTOP_DIR = "$HOME/Desktop"; XDG_DESKTOP_DIR="$HOME/Desktop";
XDG_DOCUMENTS_DIR = "$HOME/Documents"; XDG_DOCUMENTS_DIR="$HOME/Documents";
XDG_DOWNLOAD_DIR = "$HOME/Downloads"; XDG_DOWNLOAD_DIR="$HOME/Downloads";
XDG_MUSIC_DIR = "$HOME/Music"; XDG_MUSIC_DIR="$HOME/Music";
XDG_PICTURES_DIR = "$HOME/Pictures"; XDG_PICTURES_DIR="$HOME/Pictures";
XDG_PUBLICSHARE_DIR = "$HOME/Public"; XDG_PUBLICSHARE_DIR="$HOME/Public";
XDG_TEMPLATES_DIR = "$HOME/Templates"; XDG_TEMPLATES_DIR="$HOME/Templates";
XDG_VIDEOS_DIR = "$HOME/Videos"; XDG_VIDEOS_DIR="$HOME/Videos";
}; };
environment.systemPackages = with pkgs; [ environment.systemPackages = with pkgs; [

2
configuration.nix
View file

@ -3,7 +3,7 @@
imports = [ imports = [
./overlays ./overlays
./common ./common
# ./fake_flake.nix # ./fake_flake.nix
./users.nix ./users.nix
]; ];

57
custom/ncspot/package.nix
View file

@ -1,32 +1,22 @@
{ { stdenv
stdenv, , lib
lib, , fetchFromGitHub
fetchFromGitHub, , rustPlatform
rustPlatform, , pkg-config
pkg-config, , ncurses
ncurses, , openssl
openssl, , darwin
darwin, , withALSA ? stdenv.isLinux, alsa-lib
withALSA ? stdenv.isLinux, , withClipboard ? true, libxcb, python3
alsa-lib, , withCover ? false, ueberzug
withClipboard ? true, , withPulseAudio ? stdenv.isLinux, libpulseaudio
libxcb, , withPortAudio ? stdenv.isDarwin, portaudio
python3, , withMPRIS ? stdenv.isLinux, withNotify ? true, dbus
withCover ? false, , withCrossterm ? true
ueberzug, , nix-update-script
withPulseAudio ? stdenv.isLinux, , testers
libpulseaudio, , ncspot
withPortAudio ? stdenv.isDarwin, }: let
portaudio,
withMPRIS ? stdenv.isLinux,
withNotify ? true,
dbus,
withCrossterm ? true,
nix-update-script,
testers,
ncspot,
}:
let
inherit (darwin.apple_sdk.frameworks) Cocoa; inherit (darwin.apple_sdk.frameworks) Cocoa;
in in
rustPlatform.buildRustPackage rec { rustPlatform.buildRustPackage rec {
@ -47,10 +37,10 @@ rustPlatform.buildRustPackage rec {
}; };
}; };
nativeBuildInputs = [ pkg-config ] ++ lib.optional withClipboard python3; nativeBuildInputs = [ pkg-config ]
++ lib.optional withClipboard python3;
buildInputs = buildInputs = [ ncurses ]
[ ncurses ]
++ lib.optional stdenv.isLinux openssl ++ lib.optional stdenv.isLinux openssl
++ lib.optional withALSA alsa-lib ++ lib.optional withALSA alsa-lib
++ lib.optional withClipboard libxcb ++ lib.optional withClipboard libxcb
@ -64,8 +54,7 @@ rustPlatform.buildRustPackage rec {
buildNoDefaultFeatures = true; buildNoDefaultFeatures = true;
buildFeatures = buildFeatures = [ "cursive/pancurses-backend" ]
[ "cursive/pancurses-backend" ]
++ lib.optional withALSA "alsa_backend" ++ lib.optional withALSA "alsa_backend"
++ lib.optional withClipboard "share_clipboard" ++ lib.optional withClipboard "share_clipboard"
++ lib.optional withCover "cover" ++ lib.optional withCover "cover"

31
flake.nix
View file

@ -22,8 +22,8 @@
url = "github:dali99/nixos-matrix-modules"; url = "github:dali99/nixos-matrix-modules";
inputs.nixpkgs.follows = "nixpkgs"; inputs.nixpkgs.follows = "nixpkgs";
}; };
# ranger_udisk_menu.url = "git+https://git.grimmauld.de/Grimmauld/ranger_udisk_menu"; # ranger_udisk_menu.url = "git+https://git.grimmauld.de/Grimmauld/ranger_udisk_menu";
# glibc-eac.url = "github:Frogging-Family/glibc-eac"; # glibc-eac.url = "github:Frogging-Family/glibc-eac";
aagl-gtk-on-nix = { aagl-gtk-on-nix = {
url = "github:ezKEa/aagl-gtk-on-nix"; url = "github:ezKEa/aagl-gtk-on-nix";
inputs.nixpkgs.follows = "nixpkgs"; inputs.nixpkgs.follows = "nixpkgs";
@ -34,18 +34,7 @@
}; };
}; };
outputs = outputs = inputs @ { self, agenix, nixpkgs, chaotic, aagl-gtk-on-nix, nixos-mailserver, nixos-matrix-modules, aa-alias-manager, ... }:
inputs@{
self,
agenix,
nixpkgs,
chaotic,
aagl-gtk-on-nix,
nixos-mailserver,
nixos-matrix-modules,
aa-alias-manager,
...
}:
let let
patches = [ patches = [
./aa_mod.patch ./aa_mod.patch
@ -55,8 +44,7 @@
} }
]; ];
customNixosSystem = customNixosSystem = system: definitions:
system: definitions:
let let
unpatched = nixpkgs.legacyPackages.${system}; unpatched = nixpkgs.legacyPackages.${system};
patched = unpatched.applyPatches { patched = unpatched.applyPatches {
@ -66,15 +54,10 @@
}; };
nixosSystem = import (patched + "/nixos/lib/eval-config.nix"); nixosSystem = import (patched + "/nixos/lib/eval-config.nix");
in in
nixosSystem ( nixosSystem ({
{
inherit system; inherit system;
specialArgs = { specialArgs = { inherit inputs system; };
inherit inputs system; } // definitions);
};
}
// definitions
);
in in
{ {
nixosConfigurations = { nixosConfigurations = {

2
modules/default.nix
View file

@ -13,7 +13,7 @@ in
./nextcloud.nix ./nextcloud.nix
./prometheus.nix ./prometheus.nix
# ./mjolnir.nix # ./mjolnir.nix
# ./fail2ban.nix # ./fail2ban.nix
./email.nix ./email.nix
# ./discord-matrix-bridge.nix # ./discord-matrix-bridge.nix
./mastodon.nix ./mastodon.nix

217
modules/matrix_legacy.nix
View file

@ -11,9 +11,7 @@ let
fqdn = vhosts.matrix_host.host; fqdn = vhosts.matrix_host.host;
base_url = "https://${fqdn}"; base_url = "https://${fqdn}";
clientConfig."m.homeserver" = { clientConfig."m.homeserver" = {inherit base_url; }; # = "https://${vhosts.matrix_host.host}";
inherit base_url;
}; # = "https://${vhosts.matrix_host.host}";
serverConfig."m.server" = "${vhosts.matrix_host.host}:443"; serverConfig."m.server" = "${vhosts.matrix_host.host}:443";
mkWellKnown = data: '' mkWellKnown = data: ''
default_type application/json; default_type application/json;
@ -35,6 +33,7 @@ in
]; ];
}; };
services.matrix-synapse = { services.matrix-synapse = {
enable = true; enable = true;
settings.server_name = domain; settings.server_name = domain;
@ -44,30 +43,21 @@ in
# in client applications. # in client applications.
settings.public_baseurl = base_url; settings.public_baseurl = base_url;
settings.listeners = [ settings.listeners = [
{ { port = 8008;
port = 8008;
bind_addresses = [ "::1" ]; bind_addresses = [ "::1" ];
type = "http"; type = "http";
tls = false; tls = false;
x_forwarded = true; x_forwarded = true;
resources = [ resources = [ {
{ names = [ "client" "federation" ];
names = [
"client"
"federation"
];
compress = true; compress = true;
} } ];
];
} }
]; ];
settings.database = { settings.database = {
name = "psycopg2"; name = "psycopg2";
args = { args = { user="synapse"; database= "synapse"; };
user = "synapse";
database = "synapse";
};
}; };
settings.log_config = ./matrix_synapse_log_config.yaml; settings.log_config = ./matrix_synapse_log_config.yaml;
settings.enable_registration = false; settings.enable_registration = false;
@ -85,47 +75,47 @@ in
]; ];
}; };
# services.matrix-synapse-next = { # services.matrix-synapse-next = {
# enable = true; # enable = true;
# #
# workers.federationSenders = 1; # workers.federationSenders = 1;
# workers.federationReceivers = 1; # workers.federationReceivers = 1;
# workers.initialSyncers = 1; # workers.initialSyncers = 1;
# workers.normalSyncers = 1; # workers.normalSyncers = 1;
# workers.eventPersisters = 2; # workers.eventPersisters = 2;
# workers.useUserDirectoryWorker = true; # workers.useUserDirectoryWorker = true;
# mainLogConfig = ./matrix_synapse_log_config.yaml; # mainLogConfig = ./matrix_synapse_log_config.yaml;
# #
# enableNginx = true; # enableNginx = true;
# enableSlidingSync = false; # enableSlidingSync = false;
# #
# settings = { # settings = {
# suppress_key_server_warning = true; # suppress_key_server_warning = true;
# server_name = domain; # server_name = domain;
# public_baseurl = "https://${domain}"; # public_baseurl = "https://${domain}";
# enable_registration = true; # enable_registration = true;
# registration_requires_token = true; # registration_requires_token = true;
# registration_shared_secret_path = config.age.secrets.synapse_registration_shared_secret.path; # registration_shared_secret_path = config.age.secrets.synapse_registration_shared_secret.path;
# # enable_registration_without_verification = true; # # enable_registration_without_verification = true;
# # mainLogConfig = ./matrix_synapse_log_config.yaml; # # mainLogConfig = ./matrix_synapse_log_config.yaml;
# #
# # registrations_require_3pid = [ "email" ]; # # registrations_require_3pid = [ "email" ];
# #
# database = { # database = {
# name = "psycopg2"; # name = "psycopg2";
# args = { # args = {
# host = "localhost"; # host = "localhost";
# port = config.services.postgresql.settings.port; # port = config.services.postgresql.settings.port;
# dbname = "synapse"; # dbname = "synapse";
# user = "synapse"; # user = "synapse";
# cp_min = 5; # cp_min = 5;
# cp_max = 10; # cp_max = 10;
# client_encoding = "auto"; # client_encoding = "auto";
# passfile = config.age.secrets.synapse_db_pass_prepared.path; # passfile = config.age.secrets.synapse_db_pass_prepared.path;
# }; # };
# }; # };
# }; # };
# }; # };
services.redis.servers."".enable = true; services.redis.servers."".enable = true;
age.secrets.synapse_db_pass = { age.secrets.synapse_db_pass = {
@ -151,6 +141,7 @@ in
matrix-synapse matrix-synapse
]; ];
services.nginx = { services.nginx = {
enable = true; enable = true;
recommendedTlsSettings = true; recommendedTlsSettings = true;
@ -190,60 +181,60 @@ in
}; };
}; };
# services.nginx = { # services.nginx = {
# enable = true; # enable = true;
# virtualHosts."${domain}" = { # virtualHosts."${domain}" = {
# forceSSL = true; # forceSSL = true;
# enableACME = lib.mkForce false; # use the cert above, not some weird one that matrix-synapse module supplies # enableACME = lib.mkForce false; # use the cert above, not some weird one that matrix-synapse module supplies
# useACMEHost = domain; # useACMEHost = domain;
# locations."/.well-known/matrix/server" = { # locations."/.well-known/matrix/server" = {
# return = "200 '{\"m.server\":\"${vhosts.matrix_host.host}:443\"}'"; # return = "200 '{\"m.server\":\"${vhosts.matrix_host.host}:443\"}'";
# extraConfig = '' # extraConfig = ''
# default_type application/json; # default_type application/json;
# add_header Access-Control-Allow-Origin *; # add_header Access-Control-Allow-Origin *;
# add_header Accept-Ranges bytes;''; # add_header Accept-Ranges bytes;'';
# }; # };
# locations."/.well-known/matrix/client" = { # locations."/.well-known/matrix/client" = {
# return = "200 '{\"m.homeserver\": {\"base_url\": \"https://${vhosts.matrix_host.host}\"}}'"; # return = "200 '{\"m.homeserver\": {\"base_url\": \"https://${vhosts.matrix_host.host}\"}}'";
# extraConfig = '' # extraConfig = ''
# add_header Access-Control-Allow-Origin *; # add_header Access-Control-Allow-Origin *;
# default_type application/json; # default_type application/json;
# ''; # '';
# }; # };
# locations."/_matrix" = { # locations."/_matrix" = {
# proxyPass = "http://$synapse_backend"; # proxyPass = "http://$synapse_backend";
# extraConfig = '' # extraConfig = ''
# add_header X-debug-backend $synapse_backend; # add_header X-debug-backend $synapse_backend;
# add_header X-debug-group $synapse_uri_group; # add_header X-debug-group $synapse_uri_group;
# client_max_body_size ${config.services.matrix-synapse-next.settings.max_upload_size}; # client_max_body_size ${config.services.matrix-synapse-next.settings.max_upload_size};
# proxy_read_timeout 10m; # proxy_read_timeout 10m;
# ''; # '';
# }; # };
# locations."/_synapse/client" = { # locations."/_synapse/client" = {
# proxyPass = "http://$synapse_backend"; # proxyPass = "http://$synapse_backend";
# }; # };
# locations."~ ^/_matrix/client/(r0|v3)/sync$" = { # locations."~ ^/_matrix/client/(r0|v3)/sync$" = {
# proxyPass = "http://$synapse_backend"; # proxyPass = "http://$synapse_backend";
# extraConfig = '' # extraConfig = ''
# proxy_read_timeout 1h; # proxy_read_timeout 1h;
# ''; # '';
# }; # };
# locations."~ ^/_matrix/client/(api/v1|r0|v3)/initialSync$" = { # locations."~ ^/_matrix/client/(api/v1|r0|v3)/initialSync$" = {
# proxyPass = "http://synapse_worker_initial_sync"; # proxyPass = "http://synapse_worker_initial_sync";
# extraConfig = '' # extraConfig = ''
# proxy_read_timeout 1h; # proxy_read_timeout 1h;
# ''; # '';
# }; # };
# locations."~ ^/_matrix/client/(api/v1|r0|v3)/rooms/[^/]+/initialSync$" = { # locations."~ ^/_matrix/client/(api/v1|r0|v3)/rooms/[^/]+/initialSync$" = {
# proxyPass = "http://synapse_worker_initial_sync"; # proxyPass = "http://synapse_worker_initial_sync";
# extraConfig = '' # extraConfig = ''
# proxy_read_timeout 1h; # proxy_read_timeout 1h;
# ''; # '';
# }; # };
# # locations."/.well-known/matrix" = { # # locations."/.well-known/matrix" = {
# proxyPass = "http://$synapse_backend"; # proxyPass = "http://$synapse_backend";
# }; # };
# }; # };
# }; # };
# networking.firewall.allowedTCPPorts = [ 8448 8008 ]; # networking.firewall.allowedTCPPorts = [ 8448 8008 ];
} }

20
modules/wireguard.nix
View file

@ -1,10 +1,7 @@
{ pkgs, ... }: {pkgs, ...}: {
{
# enable NAT # enable NAT
networking.nat.enable = true; networking.nat.enable = true; networking.nat.externalInterface = "eth0";
networking.nat.externalInterface = "eth0"; networking.nat.internalInterfaces = [ "wg0" ]; networking.firewall = {
networking.nat.internalInterfaces = [ "wg0" ];
networking.firewall = {
allowedUDPPorts = [ 51820 ]; allowedUDPPorts = [ 51820 ];
}; };
@ -21,21 +18,18 @@
# This allows the wireguard server to route your traffic to the internet and # This allows the wireguard server to route your traffic to the internet and
# hence be like a VPN For this to work you have to set the dnsserver IP of # hence be like a VPN For this to work you have to set the dnsserver IP of
# your router (or dnsserver of choice) in your clients # your router (or dnsserver of choice) in your clients
postSetup = '' postSetup = '' ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o ens18 -j MASQUERADE
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o ens18 -j MASQUERADE
''; '';
# This undoes the above command # This undoes the above command
postShutdown = '' postShutdown = '' ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o ens18 -j MASQUERADE
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o ens18 -j MASQUERADE
''; '';
generatePrivateKeyFile = true; generatePrivateKeyFile = true;
peers = [ peers = [
{ {
publicKey = "2aANdnPYtf78iXfwNVAtYjIlE5k/yDWvbdXZ2jw0hXk="; publicKey="2aANdnPYtf78iXfwNVAtYjIlE5k/yDWvbdXZ2jw0hXk=";
allowedIPs = [ "10.100.0.2/32" ]; allowedIPs = [ "10.100.0.2/32" ];
} } ];
];
}; };
}; };
environment.systemPackages = with pkgs; [ wireguard-tools ]; environment.systemPackages = with pkgs; [ wireguard-tools ];

5
overlays/factorio.nix
View file

@ -4,9 +4,6 @@ let
in in
{ {
factorio = prev.factorio.override ( factorio = prev.factorio.override (
{ { versionsJson = ./versions.json; } // lib.optionalAttrs (builtins.pathExists loginFile) (import loginFile)
versionsJson = ./versions.json;
}
// lib.optionalAttrs (builtins.pathExists loginFile) (import loginFile)
); );
} }

1
specific/grimm-nixos-laptop/configuration.nix
View file

@ -9,6 +9,7 @@
age.identityPaths = [ "/home/grimmauld/.ssh/id_ed25519" ]; age.identityPaths = [ "/home/grimmauld/.ssh/id_ed25519" ];
services.zfs.trim.enable = true; services.zfs.trim.enable = true;
boot.supportedFilesystems.zfs = true; boot.supportedFilesystems.zfs = true;
networking.hostId = "2ea79333"; networking.hostId = "2ea79333";

19
specific/grimm-nixos-ssd/configuration.nix
View file

@ -1,9 +1,4 @@
{ { config, lib, pkgs, ... }:
config,
lib,
pkgs,
...
}:
{ {
imports = [ imports = [
# Include the results of the hardware scan. # Include the results of the hardware scan.
@ -19,8 +14,7 @@
# security.pam.yubico.control = "required"; # security.pam.yubico.control = "required";
services.udev.extraRules = services.udev.extraRules = let
let
inherit (lib) getExe' getExe; inherit (lib) getExe' getExe;
inherit (pkgs) procps writeShellScriptBin; inherit (pkgs) procps writeShellScriptBin;
exitSway = writeShellScriptBin "kill-sway" '' exitSway = writeShellScriptBin "kill-sway" ''
@ -34,18 +28,17 @@
fi fi
done done
''; '';
in in ''
''
ACTION=="remove",\ ACTION=="remove",\
ENV{SUBSYSTEM}=="usb",\ ENV{SUBSYSTEM}=="usb",\
ENV{PRODUCT}=="1050/407/543",\ ENV{PRODUCT}=="1050/407/543",\
RUN+="${lib.getExe exitSway}" RUN+="${lib.getExe exitSway}"
# ''; # '';
# RUN+="${lib.getExe' pkgs.systemd "loginctl"} lock-sessions" # RUN+="${lib.getExe' pkgs.systemd "loginctl"} lock-sessions"
# networking.hostId = "2ea79333"; # networking.hostId = "2ea79333";
# boot.kernelPackages = lib.mkForce config.boot.zfs.package.latestCompatibleLinuxPackages; # boot.kernelPackages = lib.mkForce config.boot.zfs.package.latestCompatibleLinuxPackages;
grimmShared = { grimmShared = {
tooling = { tooling = {

97
specific/grimm-nixos-ssd/hardware-configuration.nix
View file

@ -1,45 +1,24 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’ # Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes # and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead. # to /etc/nixos/configuration.nix instead.
{ { config, lib, pkgs, modulesPath, ... }:
config,
lib,
pkgs,
modulesPath,
...
}:
{ {
imports = [ imports =
(modulesPath + "/installer/scan/not-detected.nix") [ (modulesPath + "/installer/scan/not-detected.nix")
]; ];
boot.initrd.availableKernelModules = [ boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "uas" "sd_mod" "kvm-intel" ];
"xhci_pci" boot.initrd.kernelModules = [ "zfs" "nls_cp437" "nls_iso8859-1" "usbhid" "usb_storage" "nvme" ];
"ahci"
"nvme"
"usbhid"
"uas"
"sd_mod"
"kvm-intel"
];
boot.initrd.kernelModules = [
"zfs"
"nls_cp437"
"nls_iso8859-1"
"usbhid"
"usb_storage"
"nvme"
];
boot.zfs = { boot.zfs = {
forceImportRoot = false; forceImportRoot = false;
requestEncryptionCredentials = false; # none of the zfs datasets that should be mounted are encrypted. User homes happen later. requestEncryptionCredentials = false; # none of the zfs datasets that should be mounted are encrypted. User homes happen later.
# [ # [
# "zpool/home" # "zpool/home"
# "zpool/root" # "zpool/root"
# "zpool/nix" # "zpool/nix"
# "zpool/var" # "zpool/var"
# ]; # ];
}; };
boot.kernelModules = [ "kvm-intel" ]; boot.kernelModules = [ "kvm-intel" ];
boot.supportedFilesystems.zfs = true; boot.supportedFilesystems.zfs = true;
@ -50,42 +29,39 @@
boot.kernelParams = [ "mds=full,nosmt" ]; boot.kernelParams = [ "mds=full,nosmt" ];
services.homed.enable = true; services.homed.enable = true;
fileSystems."/" = { fileSystems."/" =
device = "zpool/root"; { device = "zpool/root";
fsType = "zfs"; fsType = "zfs";
}; };
fileSystems."/nix" = { fileSystems."/nix" =
device = "zpool/nix"; { device = "zpool/nix";
fsType = "zfs"; fsType = "zfs";
}; };
fileSystems."/var" = { fileSystems."/var" =
device = "zpool/var"; { device = "zpool/var";
fsType = "zfs"; fsType = "zfs";
}; };
fileSystems."/etc/nixos" = { fileSystems."/etc/nixos" =
device = "zpool/nix_conf"; { device = "zpool/nix_conf";
fsType = "zfs"; fsType = "zfs";
options = [ "noacl" ]; options = [ "noacl" ];
}; };
# fileSystems."/home" = # fileSystems."/home" =
# { device = "zpool/home"; # { device = "zpool/home";
# fsType = "zfs"; # fsType = "zfs";
# }; # };
fileSystems."/boot" = { fileSystems."/boot" =
device = "/dev/disk/by-uuid/12CE-A600"; { device = "/dev/disk/by-uuid/12CE-A600";
fsType = "vfat"; fsType = "vfat";
options = [ options = [ "fmask=0022" "dmask=0022" "umask=077" ];
"fmask=0022"
"dmask=0022"
"umask=077"
];
}; };
grimmShared = { grimmShared = {
screens = { screens = {
external = { external = {
@ -104,16 +80,17 @@
laptop_hardware.enable = true; laptop_hardware.enable = true;
}; };
# fileSystems."/crypt-storage" =
# { device = "/dev/disk/by-uuid/6f0d65a8-24f0-439d-b5ee-03c0ef051fcb";
# fsType = "ext4";
# options = [ "umask=077" ]; # read only so a fat-finger can't accidentially bonk our salts, rendering the disk useless.
# };
# fileSystems."/home/grimmauld" = # fileSystems."/crypt-storage" =
# { device = "zpool/home/grimmauld"; # { device = "/dev/disk/by-uuid/6f0d65a8-24f0-439d-b5ee-03c0ef051fcb";
# fsType = "zfs"; # fsType = "ext4";
# }; # options = [ "umask=077" ]; # read only so a fat-finger can't accidentially bonk our salts, rendering the disk useless.
# };
# fileSystems."/home/grimmauld" =
# { device = "zpool/home/grimmauld";
# fsType = "zfs";
# };
security.pam = { security.pam = {
zfs = { zfs = {

22
sway/default.nix
View file

@ -1,9 +1,4 @@
{ { pkgs, lib, config, ... }:
pkgs,
lib,
config,
...
}:
{ {
imports = [ ./bar ]; imports = [ ./bar ];
@ -56,8 +51,7 @@
urgentcol = "#9e3c3c"; urgentcol = "#9e3c3c";
realwhite = "#C7D3E3"; realwhite = "#C7D3E3";
}; };
keybinds = keybinds = {
{
"$mod+d" = "exec $menu"; "$mod+d" = "exec $menu";
"$mod+Shift+d" = "exec $menu_run"; "$mod+Shift+d" = "exec $menu_run";
"$mod+Shift+s" = ''exec ${getExe grim} -g "$(${getExe slurp} -d)" - | wl-copy''; "$mod+Shift+s" = ''exec ${getExe grim} -g "$(${getExe slurp} -d)" - | wl-copy'';
@ -160,18 +154,10 @@
in in
"exec ${getExe open}"; "exec ${getExe open}";
# XF86Bluetooth = "exec blueman-manager"; # XF86Bluetooth = "exec blueman-manager";
} } // (let inherit (builtins) toString; in lib.mergeAttrsList (map (n: {
// (
let
inherit (builtins) toString;
in
lib.mergeAttrsList (
map (n: {
"$mod+${toString n}" = "workspace number ${toString n}"; "$mod+${toString n}" = "workspace number ${toString n}";
"$mod+Shift+${toString n}" = "move container to workspace number ${toString n}"; "$mod+Shift+${toString n}" = "move container to workspace number ${toString n}";
}) (lib.range 0 9) }) (lib.range 0 9)));
)
);
autolaunch = [ autolaunch = [
(getExe' pkgs.dbus "dbus-update-activation-environment") (getExe' pkgs.dbus "dbus-update-activation-environment")
(getExe' pkgs.xdg-user-dirs "xdg-user-dirs-update") (getExe' pkgs.xdg-user-dirs "xdg-user-dirs-update")

5
users.nix
View file

@ -10,6 +10,7 @@
# shell = pkgs.xonsh; # shell = pkgs.xonsh;
description = "grimmauld"; description = "grimmauld";
openssh.authorizedKeys.keys = (import ./authorizedKeys.nix); openssh.authorizedKeys.keys = (import ./authorizedKeys.nix);
extraGroups = lib.intersectLists (lib.attrNames config.users.groups) [ extraGroups = lib.intersectLists (lib.attrNames config.users.groups) [
"networkmanager" "networkmanager"
@ -40,8 +41,8 @@
[ [
vesktop vesktop
obs-studio obs-studio
# element-desktop # element-desktop
# ghidra # ghidra
rmview rmview
] ]
); );