Compare commits

...

801 Commits

Author SHA1 Message Date
3fc0233d42 programs: split the guiApps category into slightly smaller bits 2023-02-10 00:47:10 +00:00
9a44b96f57 moby: ship some of the base apps 2023-02-10 00:46:27 +00:00
690307e198 cross packages: cross compile more stuff 2023-02-10 00:46:04 +00:00
3da6e1fb41 gpodder: fix makeWrapper to be a nativeBuildInput 2023-02-10 00:45:44 +00:00
67c561cf8e phosh-mobile-settings: cross compile 2023-02-09 19:40:16 +00:00
f387a21dee cross packages: cross compile more gnome packages 2023-02-09 07:58:32 +00:00
172a1ed5a6 working moby cross compilation 2023-02-09 06:13:23 +00:00
60e30c643d cross packages: get more things to build and further reduce the emulated closure 2023-02-09 01:05:25 +00:00
cba200efb4 cross packages: get more things to build and further reduce the emulated closure 2023-02-08 22:30:27 +00:00
77ecde7289 cross packages: reduce the emulated package set 2023-02-07 09:46:13 +00:00
8390e3d280 phosh: disable gvfs service 2023-02-07 09:44:58 +00:00
2631d6f590 phosh: enable fewer gnome services/packages 2023-02-07 03:24:46 +00:00
fe16b72081 programs: re-enable cdrtools, fwupd; disable duplicity/backblaze 2023-02-07 03:24:10 +00:00
a3fb2f06a5 tune emulated package set (e.g. only emulate one of gvfs' deps; not the WHOLE thing 2023-02-07 03:23:18 +00:00
e8ac4fee7a WIP: moby: partially working cross compilation for phosh w/o apps (webkitgtk build OOMs) 2023-02-06 22:42:11 +00:00
fcf6f9f6f3 moby: get working cross compilation for the base image (i.e. no GUI) 2023-02-06 22:41:51 +00:00
398c07ea9f WIP: moby-cross: is cross-by-default instead of opt-in 2023-02-05 19:35:54 +00:00
39edaabcc7 gjs, libadwaita, libsecret: skip flakey check phase 2023-02-05 19:35:54 +00:00
3a14a44483 mesa: downgrade from 22.3.4 -> 22.3.2 to address a memory leak 2023-02-05 19:35:54 +00:00
bcfd8e1725 nit: remove trailing space 2023-02-05 19:35:34 +00:00
e0a6f8ea4a flake: add host-pkgs.<host>.<pkg> output
this builds packages precisely as they are defined by the given host.
significant for testing whether a cross-compiled host builds things
correctly, for example.
2023-02-05 19:34:32 +00:00
80f3d0472b handbrake patch: fix hash (updated upstream) 2023-02-05 07:18:20 +00:00
b6685c9e6c refactor: move konsole from moby/default.nix -> gui/phosh.nix 2023-02-04 10:00:10 +00:00
0c2d8af448 remove sane.gui.enable option 2023-02-04 00:50:47 +00:00
7ce0c34f43 sway: specify dependent packages more idiomatically, and fix bug where phosh wasn't actually shipping its dependents 2023-02-04 00:43:00 +00:00
f2e8be3bd1 phosh: specify dependent packages more idiomatically 2023-02-03 22:55:39 +00:00
9b2e7b02cc Merge branch 'staging/nixpkgs-2023-02-01' 2023-02-03 22:14:47 +00:00
1b3e0b95be persist: remove rust/cargo 2023-02-03 18:18:10 +00:00
f78968c73a persist /var/lib/systemd/coredump 2023-02-03 18:17:22 +00:00
d5d755a4b2 flake update: nixpkgs 2023-01-25 -> 2023-02-01; sops-nix
```
• Updated input 'nixpkgs':
    'path:/nix/store/760ff23zl95q4jza8mkg47vs9ff20hq3-source/nixpatches?lastModified=1&narHash=sha256-arp7Uy7ct5ryTcmSY032eN7hr33i7D2XvjTRLliCFDc=' (1970-01-01)
  → 'path:/nix/store/pr622dac2xv2fzxvkfdfzl3sba1m7xkm-source/nixpatches?lastModified=1&narHash=sha256-arp7Uy7ct5ryTcmSY032eN7hr33i7D2XvjTRLliCFDc=' (1970-01-01)
• Updated input 'nixpkgs-unpatched':
    'github:nixos/nixpkgs/9b97ad7b4330aacda9b2343396eb3df8a853b4fc' (2023-01-25)
  → 'github:nixos/nixpkgs/4d7c2644dbac9cf8282c0afe68fca8f0f3e7b2db' (2023-02-01)
• Updated input 'sops-nix':
    'github:Mic92/sops-nix/b6ab3c61e2ca5e07d1f4eb1b67304e2670ea230c' (2023-01-24)
  → 'github:Mic92/sops-nix/a81ce6c961480b3b93498507074000c589bd9d60' (2023-02-01)
• Updated input 'sops-nix/nixpkgs-stable':
    'github:NixOS/nixpkgs/918b760070bb8f48cb511300fcd7e02e13058a2e' (2023-01-22)
  → 'github:NixOS/nixpkgs/a3a1400571e3b9ccc270c2e8d36194cf05aab6ce' (2023-02-01)
```
2023-02-03 09:46:26 +00:00
e08281c380 fix: typo in config option name 2023-02-03 09:09:37 +00:00
afb006f6ec programs: port last users & remove the old packages.nix 2023-02-03 05:26:57 +00:00
a76cf03232 remove unused "enableDevPkgs" option 2023-02-03 05:18:38 +00:00
9c24f24306 programs: port GUI apps to new config system 2023-02-03 05:08:52 +00:00
736999eea6 programs: port console packages to new config system 2023-02-03 04:24:17 +00:00
979ed38506 programs: make system be some type of meta-program/package 2023-02-03 04:03:22 +00:00
46285852d0 modules: add a sane.programs interface which i can use going forward in place of sane.packages 2023-02-03 03:38:23 +00:00
0e756d5064 packages: add sox sound converter 2023-02-02 10:23:01 +00:00
a52ead5aec nit: document what "foliate" application is 2023-02-02 00:21:07 +00:00
c0377ff1a0 dovecot: define Drafts and Trash folders 2023-01-31 08:22:20 +00:00
062ef20d05 dovecot: auto-create the "Sent" message box 2023-01-31 06:57:35 +00:00
a0861edc5f packages: enable kitty on servo to fix login error 2023-01-31 06:43:02 +00:00
eae075acb5 flake: remove unused nixpkgs-stable argument. we can re-add it when needed 2023-01-31 04:09:49 +00:00
ef2ba01141 pins: remove dead nheko code 2023-01-31 04:05:18 +00:00
2756e15bab flake update: nixpkgs-stable 2023-01-29 -> 2023-01-30
```
• Updated input 'nixpkgs-stable':
    'github:nixos/nixpkgs/22c4a7a4796a91c297a7e59078a84ec29515f86e' (2023-01-29)
  → 'github:nixos/nixpkgs/f413457e0dd7a42adefdbcea4391dd9751509025' (2023-01-30)
• Updated input 'uninsane-dot-org':
    'git+https://git.uninsane.org/colin/uninsane?ref=refs%2fheads%2fmaster&rev=80c6ec95bd430e29d231cf745f19279bb76fb382' (2022-10-27)
  → 'git+https://git.uninsane.org/colin/uninsane?ref=refs%2fheads%2fmaster&rev=b099c24091cc192abf3997b94342d4b31cc5757b' (2023-01-31)
```
2023-01-31 03:56:39 +00:00
940aac3a22 refactor: move persist settings into persist.nix 2023-01-31 03:44:48 +00:00
5f24e029af persist stores: make private/crypt support backing stores that aren't /nix/persist 2023-01-31 03:38:41 +00:00
98b542332b persist: crypt store: make paths overridable 2023-01-31 03:36:15 +00:00
70b62e9f76 persist stores: define the path for private at the host level 2023-01-31 03:29:53 +00:00
7c81df00df move nixcache.nix from modules -> hosts/modules 2023-01-30 11:25:46 +00:00
f288f34d1e nixpkgs-stable: 2023-01-28 -> 2023-01-29
```
• Updated input 'nixpkgs-stable':
    'github:nixos/nixpkgs/ce20e9ebe1903ea2ba1ab006ec63093020c761cb' (2023-01-28)
  → 'github:nixos/nixpkgs/22c4a7a4796a91c297a7e59078a84ec29515f86e' (2023-01-29)
```
2023-01-30 11:13:37 +00:00
854977c3aa move duplicity out of modules -> hosts 2023-01-30 11:11:42 +00:00
3653776399 cleanup: modules/users.nix: allow explicitly setting home, if needed 2023-01-30 11:06:47 +00:00
e4bff9b5ef refactor: persist: remove dead code 2023-01-30 10:51:41 +00:00
ec22c128e0 remove reference to /home/colin from modules/persist 2023-01-30 10:48:32 +00:00
77cc560052 use sane.user.persist instead of sane.persist.home 2023-01-30 10:35:03 +00:00
c1f3fc502d sane.users.<user>.persist: forward to sane.persist.home 2023-01-30 10:34:36 +00:00
4d3248d315 lib: mkTypedMerge: fix to work with recursive attrsets 2023-01-30 10:33:59 +00:00
45a1c07210 refactor: make use of sane.user.fs 2023-01-30 09:27:19 +00:00
a1a711190f refactor: make use of sane.user 2023-01-30 09:13:43 +00:00
ee9a2b320d add a sane.user option which is shorthand for the default user 2023-01-30 08:53:40 +00:00
870afec07e add which is shorthand to define a fs entry inside that user's home 2023-01-30 08:32:55 +00:00
5f8154e6ce phosh: add favorite apps to homescreen 2023-01-30 03:38:46 +00:00
0bc3b78a52 docs: document how to find dconf keys/values 2023-01-30 03:02:22 +00:00
5288be1822 phosh: statically configure a few dconf settings (experimental) 2023-01-30 03:00:55 +00:00
5b1113929a refactor: link /share/zsh in the zsh config instead of hosts/common/default.nix 2023-01-30 02:32:19 +00:00
216c812f7b remove config.sane.home-manager.enable as it was always set anyway 2023-01-30 02:10:12 +00:00
39effa15ad flake: remove unused home-manager input 2023-01-30 01:56:22 +00:00
f66de76b76 disable home-manager 2023-01-30 01:54:57 +00:00
427ee669c5 refactor: home.packages: move out of home-manager 2023-01-30 01:53:59 +00:00
8e81b5827c remove dead sane.home-manager.windowManager option 2023-01-30 01:51:36 +00:00
cb3e7623ae refactor: modules/gui/default.nix: fold into hosts/modules/gui/default.nix 2023-01-30 01:49:51 +00:00
a9cf619a14 plasma: move modules/gui/plasma.nix -> hosts/modules/gui/plasma.nix 2023-01-30 01:44:32 +00:00
02100ed1a2 plasma-mobile: move modules/gui/plasma-mobile.nix -> hosts/modules/gui/plasma-mobile.nix 2023-01-30 01:43:33 +00:00
ae22865099 gnome: move modules/gui/gnome.nix -> hosts/modules/gui/gnome.nix 2023-01-30 01:42:12 +00:00
6c85c6ecd8 handbrake: disable on aarch64-linux 2023-01-30 01:40:12 +00:00
161bbc1159 phosh: move out of modules/gui/phosh.nix -> hosts/modules/gui/phosh.nix 2023-01-30 01:39:20 +00:00
b94d0672cc flake update: nixpkgs-stable 2023-01-26 -> 2023-01-28; mobile-nixos
```
• Updated input 'mobile-nixos':
    'github:nixos/mobile-nixos/80ece5a61738fbf3b96fdda402ab2dfc74ee5cee' (2023-01-27)
  → 'github:nixos/mobile-nixos/7478a9ffad737486951186b66f6c5535dc5802e2' (2023-01-28)
• Updated input 'nixpkgs':
    'path:/nix/store/6jkp58bwsyshh7gz3shjlrn8a5zi3lk2-source/nixpatches?lastModified=1&narHash=sha256-arp7Uy7ct5ryTcmSY032eN7hr33i7D2XvjTRLliCFDc=' (1970-01-01)
  → 'path:/nix/store/xm7cg47bcix1s2cfmngvz0hjf0qqsgm1-source/nixpatches?lastModified=1&narHash=sha256-arp7Uy7ct5ryTcmSY032eN7hr33i7D2XvjTRLliCFDc=' (1970-01-01)
• Updated input 'nixpkgs-stable':
    'github:nixos/nixpkgs/def9e420d27c951026d57dc96ce0218c3131f412' (2023-01-26)
  → 'github:nixos/nixpkgs/ce20e9ebe1903ea2ba1ab006ec63093020c761cb' (2023-01-28)
```
2023-01-29 19:37:50 +00:00
768bc35940 sway: enable logging at both levels (base sway and layered sway) 2023-01-29 09:48:41 +00:00
9aca00c186 sway: re-enable the greeter 2023-01-29 08:13:09 +00:00
443100daa4 sway: move out of home-manager 2023-01-29 08:11:52 +00:00
ac25909a10 Merge branch 'wip/sway2' 2023-01-29 08:07:20 +00:00
ed70e045cb waybar: fix by specifying bars as list instead of attrs (wtf home-manager?) 2023-01-29 08:07:03 +00:00
e9172fe731 zsh: add an empty .zshrc to shutup prezto 2023-01-28 12:28:47 +00:00
fd19802e91 WIP: fixup sway bugs 2023-01-28 12:25:12 +00:00
d84846e293 refactor: sway: port away from home-manager 2023-01-28 11:13:54 +00:00
b46ccb9bc2 zsh: add an empty .zshrc to shutup prezto 2023-01-28 10:59:06 +00:00
1958c1f36b refactor: port waybar config out of home-manager 2023-01-28 09:58:18 +00:00
67299ebfd7 nix-index: move out of home-manager -> nixos 2023-01-28 09:44:32 +00:00
adecfbaea4 refactor: home-manager: remove dead sysconfig hack 2023-01-28 09:31:09 +00:00
fa4a576703 refactor: zsh: enable VTE with programs.zsh.vteIntegration instead of manual sourcing 2023-01-28 09:30:45 +00:00
abb0a3c94e refactor: move xdg.nix -> xdg-dirs.nix 2023-01-28 09:27:10 +00:00
32612e6acb refactor: sort the mime associations 2023-01-28 09:26:29 +00:00
e0a3979b65 refactor: mimeapps: port from home-manager -> nixos 2023-01-28 09:23:41 +00:00
4d84ca0878 refactor: xdg.conf: move out of home-manager 2023-01-28 03:57:35 +00:00
1ae8ab2550 refactor: ~/.cache/nix-index: persist in common/users.nix instead of home-manager 2023-01-28 03:48:37 +00:00
ed1380ba70 libreoffice config: move out of home-manager 2023-01-28 03:45:51 +00:00
e1b8d3ccc3 zsh: move out of home-manager 2023-01-28 03:40:26 +00:00
392ad7c674 zsh: port from home-manager to nixos 2023-01-28 03:39:13 +00:00
4026334e51 neovim: move out of home-manager 2023-01-28 00:20:40 +00:00
2269016736 neovim: port to nixos config instead of home-manager 2023-01-28 00:19:48 +00:00
f2c61d64b7 mpv: move out of home-manager 2023-01-27 08:12:37 +00:00
840c2feba5 mpv: specify config by sane.fs instead of home-manager 2023-01-27 08:11:59 +00:00
4603f0fd8e kitty: move out of home-manager 2023-01-27 08:09:03 +00:00
64704d361b kitty: configure via sane.fs instead of home-manager 2023-01-27 08:08:22 +00:00
7df18686e0 git: move out of home-manager 2023-01-27 07:57:42 +00:00
aee928dac0 git: populate with sane.fs instead of home-manager 2023-01-27 07:55:38 +00:00
76c0c3dc6a vlc: move out of home-manager 2023-01-27 07:34:07 +00:00
796988bdeb sublime-music: move out of home-manager 2023-01-27 07:33:23 +00:00
31d28ccf23 ssh: move out of home-manager 2023-01-27 07:19:04 +00:00
a298678622 splatmoji: move out of home-manager 2023-01-27 07:18:13 +00:00
32eb3b1998 newsflash: move out of home-manager 2023-01-27 07:17:27 +00:00
7a726b8d08 keyring: move out of home-manager 2023-01-27 07:15:45 +00:00
3edbb1c873 gpodder: move out of home-manager 2023-01-27 07:12:29 +00:00
d94687e8cc gfeeds: move out of home-manager 2023-01-27 07:11:31 +00:00
641ffc3452 firefox: move out of home-manager 2023-01-27 07:09:10 +00:00
fa8016db67 aerc: migrate out of home-manager directory 2023-01-27 07:08:03 +00:00
0c9cc87728 patch handbrake instead of pinning it 2023-01-27 05:15:09 +00:00
5236da2383 Merge branch 'staging/nixpkgs-2023-01-25' 2023-01-27 04:22:25 +00:00
aa24eebf40 all hosts: declare $host-hn as an alias to speak with that host over the Home Network vpn 2023-01-27 03:18:49 +00:00
3cc0d7ec40 flake update: nixpkgs/nixos-unstable 2023-01-23 -> 2023-01-25; mobile-nixos; nixpkgs/nixos-22.11
```
• Updated input 'mobile-nixos':
    'github:nixos/mobile-nixos/4d2093efa7efa00131d385fd9d11e54ce16bc57a' (2023-01-24)
  → 'github:nixos/mobile-nixos/80ece5a61738fbf3b96fdda402ab2dfc74ee5cee' (2023-01-27)
• Updated input 'nixpkgs':
    'path:/nix/store/2yvdsmlp8nx67fh4gvn64mbm82pbgzz8-source/nixpatches?lastModified=1&narHash=sha256-hxFwrPvi%2fvd6g8BfCYtTM2CEIDde%2fgz7GjVmkmRzP+o=' (1970-01-01)
  → 'path:/nix/store/4xd16l52dabh0xgwg57j4qraj2nrijl5-source/nixpatches?lastModified=1&narHash=sha256-hxFwrPvi%2fvd6g8BfCYtTM2CEIDde%2fgz7GjVmkmRzP+o=' (1970-01-01)
• Updated input 'nixpkgs-stable':
    'github:nixos/nixpkgs/ab1254087f4cdf4af74b552d7fc95175d9bdbb49' (2023-01-22)
  → 'github:nixos/nixpkgs/def9e420d27c951026d57dc96ce0218c3131f412' (2023-01-26)
• Updated input 'nixpkgs-unpatched':
    'github:nixos/nixpkgs/1b1f50645af2a70dc93eae18bfd88d330bfbcf7f' (2023-01-23)
  → 'github:nixos/nixpkgs/9b97ad7b4330aacda9b2343396eb3df8a853b4fc' (2023-01-25)
```
2023-01-27 03:08:23 +00:00
42c2d93306 firefox: persist just the ~/.mozilla/firefox/default profile dir 2023-01-27 01:52:00 +00:00
f6f8d0e19d sane-lib.fs: new wantedDir helper 2023-01-27 01:51:35 +00:00
8ad4d8a4f9 nits: fix comments/improve docs 2023-01-27 00:00:50 +00:00
d419e10f10 moby: bump CMA 384M -> 512M 2023-01-26 23:41:22 +00:00
c56734e00e remove unused custom signaldctl package (it has been upstreamed) 2023-01-26 23:37:34 +00:00
e095149797 remove unused custom pleroma package 2023-01-26 23:36:36 +00:00
6006b84f9e moby: disable metamask 2023-01-26 23:35:57 +00:00
b3b914bc2e disable i2p on all hosts (i don't use it) 2023-01-26 23:35:29 +00:00
d6f87c7ee7 formatting: firefox: sort addons by name/attr 2023-01-26 23:31:46 +00:00
028d78437b firefox: make all addons externally configurable 2023-01-26 23:30:56 +00:00
0539bb8fd5 firefox: factor out the addons a little 2023-01-26 23:17:06 +00:00
95cc42f057 Merge branch 'staging/linux-6.2' 2023-01-26 09:21:33 +00:00
54cfde0e30 moby: linux-megous: 6.1.0-rc8 -> 6.2.0-rc5 2023-01-26 08:45:01 +00:00
b358cbe02a feeds: rifters: port to db 2023-01-26 00:07:29 +00:00
64cd562824 feeds: IEEE spectrum: port to db 2023-01-26 00:05:50 +00:00
749f59a4af feeds: palladium: port to db 2023-01-26 00:04:17 +00:00
77d5ff623e feeds: Profectus: port to db 2023-01-26 00:02:55 +00:00
6386abb8c6 feeds: SemiAccurate: port to db 2023-01-26 00:01:28 +00:00
28f8434c53 feeds: vitalik.ca: port to db 2023-01-26 00:00:16 +00:00
30fafb4837 feeds: sagacious suricata: port to db 2023-01-25 23:59:23 +00:00
c7205ed668 feeds: bunnie juang: port to db 2023-01-25 23:58:43 +00:00
c69c6612fe feeds: Daniel Janus: port to db 2023-01-25 23:57:53 +00:00
6951b277ad feeds: ian henry: port to db 2023-01-25 23:57:00 +00:00
1167c9bd0c feeds: bitbashing: port to db 2023-01-25 23:56:22 +00:00
8537fe411b feeds: idiomdrottning: port to db 2023-01-25 23:55:36 +00:00
1fb2ddbecc feeds: jefftk: port to db 2023-01-25 23:52:00 +00:00
27608cb8c7 feeds: pomeroyb: port to db 2023-01-25 23:51:12 +00:00
33ee59e80d feeds: miniature-calendar: port to db 2023-01-25 23:49:52 +00:00
edacc28e4a feeds: smbc: port to db 2023-01-25 23:45:49 +00:00
99780e30bc feeds: pbfcomics: port to db 2023-01-25 23:45:16 +00:00
140dd05bd1 feeds: xkcd: port to db 2023-01-25 23:44:06 +00:00
c35bc92ac9 feeds: Sean Carrol/Preposterous Universe: port to db 2023-01-25 23:40:55 +00:00
16b92f98e7 feeds: put a num on it: port to db 2023-01-25 23:38:58 +00:00
576b63da9c feeds: sideways view: port to db 2023-01-25 23:35:39 +00:00
e434add20d feeds: Overcoming Bias: port to db 2023-01-25 23:34:30 +00:00
d288086aa2 feeds: roots of progress: port to db 2023-01-25 23:32:53 +00:00
e9c0f692d8 feeds: gwern: port to db 2023-01-25 23:32:11 +00:00
5a75d0f56b feeds: richardcarrier: port to db 2023-01-25 23:29:58 +00:00
a222cf18a3 feeds: port slimemoldtimemold to db 2023-01-25 23:29:17 +00:00
45b9ee763b feeds: applied divinity studies: port to db 2023-01-25 23:28:23 +00:00
50a2196495 feeds: unintended consequences: port to db 2023-01-25 23:27:15 +00:00
e4419ffad4 feeds: stpeter.im: port to db 2023-01-25 23:26:23 +00:00
ae3ba64fc3 feeds: dshr.org: port to db 2023-01-25 23:25:11 +00:00
948b2489d3 feeds: port austinvernon to db 2023-01-25 22:50:41 +00:00
abe491b563 feeds: port lynalden to db 2023-01-25 22:49:45 +00:00
9911593a63 feeds: port benedict evans to db 2023-01-25 22:48:57 +00:00
798ba7f7e3 remove benjaminrosshoffman.com db entry: it only has the comments feed and is not useful 2023-01-25 22:23:06 +00:00
f72e901f57 feeds: port balaji to db 2023-01-25 22:22:06 +00:00
2047222233 RSS: add philosopher.coach 2023-01-25 21:27:18 +00:00
5d33cb66d6 feeds: add Julia Evans 2023-01-25 10:55:50 +00:00
6fded1f256 feeds: add Matt Webb 2023-01-25 10:36:10 +00:00
1d1c528abc feeds: add Merveilles forum 2023-01-25 10:31:51 +00:00
35fdd2788f feeds: add Emerge podcast 2023-01-25 10:28:15 +00:00
77cb951545 feeds: port congressionaldish to db 2023-01-25 09:46:10 +00:00
1909e0fbe8 feedsearch-crawler: fix for very large RSS feeds (like congressionaldish) 2023-01-25 09:44:32 +00:00
33d7819619 trust-dns: add a "quiet" option and enable it 2023-01-25 08:18:29 +00:00
0846abb6bf signald: update, and persist the /var/lib/signald accounts directory 2023-01-25 06:38:27 +00:00
f3568462c2 fix matrix-synapse after nixpkgs update 2023-01-25 03:46:05 +00:00
ed9291a443 Merge branch 'staging/nixpkgs-2023-01-23' 2023-01-25 03:14:41 +00:00
9eac7f7c02 pleroma: update to mainline 2023-01-25 03:13:06 +00:00
f5eaa635a5 flake update: nixpkgs-stable 2023-01-15 -> 2023-01-22
```
• Updated input 'nixpkgs-stable':
    'github:nixos/nixpkgs/2f9fd351ec37f5d479556cd48be4ca340da59b8f' (2023-01-15)
  → 'github:nixos/nixpkgs/ab1254087f4cdf4af74b552d7fc95175d9bdbb49' (2023-01-22)
• Updated input 'sops-nix/nixpkgs-stable':
    'github:NixOS/nixpkgs/7c65528c3f8462b902e09d1ccca23bb9034665c2' (2023-01-15)
  → 'github:NixOS/nixpkgs/918b760070bb8f48cb511300fcd7e02e13058a2e' (2023-01-22)
```
2023-01-25 00:19:00 +00:00
47db6f0dd4 unpin nheko 2023-01-25 00:16:37 +00:00
bba7efc535 flake update: nixpkgs 2023-01-19 -> 2023-01-23; mobile-nixos, sops-nix
```
• Updated input 'mobile-nixos':
    'github:nixos/mobile-nixos/5ee45cc1f8e43f4af14ee17ccef9156b0db8cd77' (2022-12-04)
  → 'github:nixos/mobile-nixos/4d2093efa7efa00131d385fd9d11e54ce16bc57a' (2023-01-24)
• Updated input 'nixpkgs-unpatched':
    'github:nixos/nixpkgs/d7705c01ef0a39c8ef532d1033bace8845a07d35' (2023-01-19)
  → 'github:nixos/nixpkgs/1b1f50645af2a70dc93eae18bfd88d330bfbcf7f' (2023-01-23)
• Updated input 'sops-nix':
    'github:Mic92/sops-nix/e18eefd2b133a58309475298052c341c08470717' (2023-01-15)
  → 'github:Mic92/sops-nix/b6ab3c61e2ca5e07d1f4eb1b67304e2670ea230c' (2023-01-24)
```
2023-01-25 00:15:55 +00:00
358b673344 moby: bump CMA 256MB -> 384MB 2023-01-23 07:42:51 +00:00
d9c101689d feeds: add lwn.net 2023-01-22 23:48:08 +00:00
ccbb573681 nit: remove dead comment in feeds.nix 2023-01-22 23:47:22 +00:00
f5c270233f feeds: add Tales From The Bridge (podcast) 2023-01-22 23:46:11 +00:00
bf92bb48be feeds: subscribe to project-insanity.org 2023-01-22 23:40:43 +00:00
2037b425d6 feeds: add Seattle Nice podcast 2023-01-21 09:41:20 +00:00
026746a76f flake.nix: document the init-feed "app" 2023-01-21 06:22:18 +00:00
de74c4e7d5 RSS: add Drew Devault 2023-01-21 06:21:34 +00:00
34a5f3f49b flake update: nixpkgs 2023-01-15 -> 2023-01-19
```
• Updated input 'nixpkgs-unpatched':
    'github:nixos/nixpkgs/6dccdc458512abce8d19f74195bb20fdb067df50' (2023-01-15)
  → 'github:nixos/nixpkgs/d7705c01ef0a39c8ef532d1033bace8845a07d35' (2023-01-19)
```
2023-01-21 05:33:15 +00:00
ee93141c07 splatmoji: build from upstream nixpkgs PR 2023-01-21 04:48:57 +00:00
f2d22231a3 freshrss: force sync feeds on every launch. requires to login as user "colin" 2023-01-21 03:50:27 +00:00
d5334e65ad overlays/pins.nix: act as NOOP when isn't available 2023-01-21 03:49:31 +00:00
17cdfff286 phosh: update 0.22.0 -> 0.23.0 2023-01-21 03:17:42 +00:00
8d4ff6d4e6 pkgs: fix infinite recursion around firefox-unwrapped 2023-01-21 01:41:30 +00:00
5d78bc6704 moby: enable wireguard/home VPN 2023-01-20 22:40:58 +00:00
4da19a6d34 servo: remove users.nix; move autologinUser -> default.nix 2023-01-20 22:16:47 +00:00
2f75925678 servo: lift pleroma user def out of toplevel -> pleroma.nix 2023-01-20 22:15:26 +00:00
55a1856e87 servo: lift git user def out of toplevel -> gitea.nix 2023-01-20 22:14:14 +00:00
2ee0f4efe2 servo: navidrome: give non-private dir and fix perms 2023-01-20 22:11:15 +00:00
b0c5a5907f Merge branch 'wip/hosts' 2023-01-20 19:40:49 +00:00
9af157b294 moby: enable the client role 2023-01-20 11:37:43 +00:00
c36fed8547 Revert "flake update: nixpkgs-stable: 2023-01-15 -> 2023-01-17"
This reverts commit 35e28041cd.

this "stable" update wasn't actually stable: nheko/mtxclient
is broken on all usable branches atm:
<https://github.com/NixOS/nixpkgs/issues/211758>
2023-01-20 11:31:19 +00:00
a653311f04 wg-home: enable dynamicEndpointRefreshSeconds to be robust against intermittent failure 2023-01-20 10:34:30 +00:00
f4d6ecb1cf wg-home: use the DNS endpoint for connecting to my home VPN 2023-01-20 10:34:04 +00:00
c2e5a0a2fc wg-home: when acting as client, allow server to relay all other clients' messages 2023-01-20 10:20:33 +00:00
c316e51344 desko: enable wg-home 2023-01-20 07:59:11 +00:00
f4f0c1bdd6 servo: fix broken config/typo 2023-01-20 07:45:54 +00:00
6a2374e046 wg-home: unify server and client config 2023-01-20 07:42:31 +00:00
708cb841fe wg-home: auto-generate peer list from hosts.nix config 2023-01-20 07:22:34 +00:00
094b7223c7 servo: wireguard secret is auto-generated 2023-01-20 07:11:37 +00:00
f6dfc9cf29 hosts: migrate IP addresses into hosts/modules 2023-01-20 07:07:45 +00:00
7c2ab92302 wg-home: derive wireguard key from ssh privkey 2023-01-20 06:57:49 +00:00
7c18d77046 wg-home: make wireguard pubkeys configurable; we'll want one per host 2023-01-20 06:09:57 +00:00
02f316f7f8 tweak wg-home to where i can get a p2p connection between lappy and servo 2023-01-20 05:38:14 +00:00
df848b3262 wg-home: use separate host key than client key 2023-01-20 05:10:51 +00:00
1e67b5c97e sane-mount-servo: fix so we really do prefer lan over wan mounts 2023-01-20 04:58:05 +00:00
a3a7b6c563 hosts: split wifi and bluetooth pairings into the "client" role 2023-01-20 04:25:08 +00:00
e527beb9d0 sane-bt-search: add a --full flag 2023-01-20 02:17:59 +00:00
2e942e2dd4 sane-bt-search: include size and tracker in results 2023-01-20 02:10:07 +00:00
f46e3fdf01 sane-bt-search: fix incomparable datetime objects 2023-01-20 02:05:40 +00:00
038a9034d7 hosts: remove the is-target attribute and opt into roles via the config system instead 2023-01-20 00:13:13 +00:00
5a232eb832 servo: fix secrets path 2023-01-19 23:57:40 +00:00
9301b95dbb wg-home: move to shared module so that host and client config can be adjacent 2023-01-19 23:55:56 +00:00
d13bcc49ab refactor hosts directory, and move ssh keys out of modules/data
longer-term, i want hosts/by-name to define host-specific data
that's accessible via the other hosts (things like pubkeys).

also the secrets management needs some rethinking. there's really not
much point in me specifiying where *exactly* a secret comes from at its
use site. i should really be specifying secret store manifests; i.e.
"servo.yaml contains secrets X Y and Z", and leaving the rest up to
auto-computing.
2023-01-19 23:23:43 +00:00
35e28041cd flake update: nixpkgs-stable: 2023-01-15 -> 2023-01-17
```
• Updated input 'nixpkgs-stable':
    'github:nixos/nixpkgs/2f9fd351ec37f5d479556cd48be4ca340da59b8f' (2023-01-15)
  → 'github:nixos/nixpkgs/b83e7f5a04a3acc8e92228b0c4bae68933d504eb' (2023-01-17)
```
2023-01-19 10:52:15 +00:00
58a5a8b56d wg_home_privkey: move secret to common file 2023-01-19 09:47:44 +00:00
e6d4ff3c6a experimental wg-home VPN shared across my devices 2023-01-19 09:45:03 +00:00
be29ad8bd8 servo: rename wg0 interface -> wg-ovpns 2023-01-19 09:35:07 +00:00
0fb8e2c867 persist ~/.cache/nix-index 2023-01-19 04:03:23 +00:00
580c1b74cb pkgs: bootpart-tow-boot-rpi-aarch64: fix build 2023-01-19 03:57:32 +00:00
f8595f1ed6 splatmoji: account for source paths sometimes having duplicate slashes 2023-01-18 11:53:14 +00:00
1deda148bb splatmoji: use upstream build.sh to build the package 2023-01-18 11:24:40 +00:00
5bbef18130 packages: remove mesa-demos 2023-01-18 09:16:48 +00:00
6967c331e2 matrix: fix synapse/signal permissions 2023-01-18 01:50:28 +00:00
9202345beb Merge branch 'staging/nixpkgs-2023-01-15' 2023-01-18 00:56:07 +00:00
17a8cabc09 remove trust-dns: it's been upstreamed 2023-01-17 11:22:10 +00:00
bc190f90bd flake update: nixpkgs 2023-01-13 -> 2023-01-15
```
• Updated input 'nixpkgs-stable':
    'github:nixos/nixpkgs/a83ed85c14fcf242653df6f4b0974b7e1c73c6c6' (2023-01-14)
  → 'github:nixos/nixpkgs/2f9fd351ec37f5d479556cd48be4ca340da59b8f' (2023-01-15)
• Updated input 'nixpkgs-unpatched':
    'github:nixos/nixpkgs/befc83905c965adfd33e5cae49acb0351f6e0404' (2023-01-13)
  → 'github:nixos/nixpkgs/6dccdc458512abce8d19f74195bb20fdb067df50' (2023-01-15)
```
2023-01-17 10:50:00 +00:00
bb983a5328 servo: ship with signaldctl 2023-01-17 10:31:21 +00:00
0e8fc29b01 use signaldctl via nixpkgs patch which i hope to upstream later 2023-01-17 10:28:43 +00:00
4e14f063fc Merge branch 'wip/signal' 2023-01-17 10:14:53 +00:00
10d69fb0a4 mautrix-signal: configure correct permissions so that i can use the bridge 2023-01-17 07:57:24 +00:00
7aac965e32 bootpart-tow-boot-rpi-aarch64: fix syntax error 2023-01-16 12:14:22 +00:00
98ae1a8513 matrix: persist the mautrix-signal directory 2023-01-16 11:58:21 +00:00
72a2ab78f3 matrix: allow mautrix-signal to communicate with signald 2023-01-16 11:54:32 +00:00
18c98feb34 fs: fix /var/lib/private to have expected mode (0700) 2023-01-16 11:44:07 +00:00
487af9b492 fs: fix /var/lib/private to have expected mode (0700) 2023-01-16 11:43:43 +00:00
472d25c056 mautrix-signal: define the shared secrets statically 2023-01-16 11:43:17 +00:00
9eafacad12 mautrix-signal: get a *little* closer to working
it looks like mautrix-signal reads the appserver token (AS_TOKEN) from
its config file -- which we place in the nix store. as such, we have no
easy way of getting the token from registration.yaml over to
mautrix-signal. this is presumably what the environmentFile stuff is
meant for, but it doesn't *really* help much.

i think it makes sense to pursue coffeetables' nix-matrix-appservices
module, which has good-looking AS_TOKEN support:
<https://gitlab.com/coffeetables/nix-matrix-appservices>
2023-01-16 10:22:44 +00:00
0eb46a3179 add mautrix-signal (experimental) 2023-01-16 09:03:56 +00:00
ddb184b5ff (nixos) mx-puppet-discord: move to matrix category 2023-01-16 07:31:12 +00:00
194a6b6cf4 nixpatches: remove unused fakeHash input (just omit the hash when you need to) 2023-01-16 06:47:44 +00:00
016384aa2b nixpatches: move the list to the nixpatches flake instead of injecting it 2023-01-16 06:46:59 +00:00
b4e19c037e ejabberd: TODO: fix acme/nginx group membership 2023-01-16 05:59:52 +00:00
bd504f6c83 pin nheko package 2023-01-15 07:52:21 +00:00
bdd309eb15 flake: convert path:nixpatches -> ./nixpatches to fix poor flake input invalidation 2023-01-15 07:36:04 +00:00
eedc1170ec fix: remove kiwix-tools patch & improve nixpatches sub-flake UX 2023-01-15 04:27:42 +00:00
5a586c6e3c flake: migrate back to the more-efficient github: input scheme 2023-01-15 04:10:10 +00:00
371bcad650 flake.nix: use conventional URIs, no custom shit 2023-01-14 23:28:12 +00:00
926decbea5 persist ~/.cache/nix 2023-01-14 23:21:15 +00:00
c0f76ea8d8 flake: add flake feedback info for nix devs/readers 2023-01-14 23:20:38 +00:00
40fc37930f flake update: nixpkgs 2023-01-11 -> 2023-01-12
```
• Updated input 'nixpkgs-stable':
    'github:NixOS/nixpkgs/6a3f9996408c970b99b8b992b11bb249d1455b62' (2023-01-12)
  → 'github:NixOS/nixpkgs/e285dd0ca97c264003867c7329f0d1f4f028739c' (2023-01-13)
• Updated input 'nixpkgs-unpatched':
    'github:NixOS/nixpkgs/6c8644fc37b6e141cbfa6c7dc8d98846c4ff0c2e' (2023-01-11)
  → 'github:NixOS/nixpkgs/0f213d0fee84280d8c3a97f7469b988d6fe5fcdf' (2023-01-12)
```
2023-01-14 18:37:57 +00:00
30e7eb9ab6 sane-bt-search: convert to nix-shell and increase verbosity 2023-01-14 10:23:50 +00:00
2e03f47edc gPodder: persist the whole gPodder directory 2023-01-14 05:36:31 +00:00
4d552e3f0f gpodder-configured: remove the readFile business and use linkFarm instead 2023-01-14 05:29:38 +00:00
176a98879d gpodder: auto-unsubscribe from extra feeds at start 2023-01-14 05:25:16 +00:00
fc70889c34 Revert "import nix-script": it doesn't provide benefit over nix-shell
This reverts commit fe15cdd705.

although it *does* support generating derivation text,
import-from-derivation on the results is too clunky to actually be
usable in practice. it frequently mysteriously hangs instead.
2023-01-14 04:01:04 +00:00
49b4c57826 snippets: add nixos snippets 2023-01-14 03:38:51 +00:00
5111d095ac gpodder-configured: improve docs 2023-01-13 15:09:43 +00:00
fe15cdd705 import nix-script
this is a tool i can use like `nix-shell`, but it should be more
amenable to packaging. `nix-script --export --build-root .
./my-script.sh` gives a derivation which i should be able to
`callPackage` on.
2023-01-13 15:08:30 +00:00
638420ea0d whalebird: fix tray_icon oversight during last update 2023-01-13 10:09:07 +00:00
d55dd5ace6 whalebird: fix aarch64 build (hopefully) 2023-01-13 09:53:14 +00:00
45695aed6b whalebird: 4.6.5 -> 4.7.4 2023-01-13 09:41:05 +00:00
d6e79c4d07 feeds: remove the unused update.nix file 2023-01-13 09:41:05 +00:00
380ceaf625 mfeeds: rename update.sh -> update.py 2023-01-13 09:41:05 +00:00
942c581107 feeds: port the update.sh script to use our own feedsearch package instead of the deployed version 2023-01-13 09:41:05 +00:00
b6d94c2e08 feedsearch_crawler: add to all python3XXPackages 2023-01-13 09:41:05 +00:00
fd7acc8fc8 let host nix (i.e. nix-shell, nix-locate) know about our patched nixpkgs and overlays 2023-01-13 09:41:05 +00:00
db670fc172 package feedsearch-crawler 2023-01-13 09:41:05 +00:00
6438971c8c ssh keys: add github.com's pubkey 2023-01-13 09:41:05 +00:00
e439d398b6 flake: patch using the target system instead of the host 2023-01-13 09:05:00 +00:00
0f25cba331 moby kernel: disable config option that would break build 2023-01-13 04:40:34 +00:00
39959e912d cross: fix cross compilation by setting both local AND crossSystem 2023-01-13 04:40:34 +00:00
62e649743d moby: update megous kernel 6.1-20221128-1027 -> 6.1-20221211-1046 2023-01-13 04:40:34 +00:00
b1741a18e1 feeds: include "title" in the output OPML -- when it exists 2023-01-13 04:13:44 +00:00
a829a8e027 persist: fix permission mapping when acl is specified as toplevel attribute 2023-01-13 01:50:08 +00:00
d742ae83bd flake update: nixpkgs-unpatched: 2023-01-09 -> 2023-01-11
```
• Updated input 'nixpkgs-stable':
    'github:NixOS/nixpkgs/8c54d842d9544361aac5f5b212ba04e4089e8efe' (2023-01-08)
  → 'github:NixOS/nixpkgs/6a3f9996408c970b99b8b992b11bb249d1455b62' (2023-01-12)
• Updated input 'nixpkgs-unpatched':
    'github:NixOS/nixpkgs/aa1d74709f5dac623adb4d48fdfb27cc2c92a4d4' (2023-01-09)
  → 'github:NixOS/nixpkgs/6c8644fc37b6e141cbfa6c7dc8d98846c4ff0c2e' (2023-01-11)
• Updated input 'sops-nix':
    'github:Mic92/sops-nix/2253120d2a6147e57bafb5c689e086221df8032f' (2023-01-08)
  → 'github:Mic92/sops-nix/32187b33ac6ec9b628dcd08dd941a715e6241dda' (2023-01-12)
```
2023-01-13 00:02:32 +00:00
110ab1a794 feeds: fix snowden to not be a podcast 2023-01-11 16:20:53 +00:00
7d5a81e542 feeds: port Civboot 2023-01-11 16:11:46 +00:00
1af2a3f329 feeds: port Michael Malice 2023-01-11 16:05:25 +00:00
3fa9e910a9 feeds: port Matrix Live 2023-01-11 16:03:00 +00:00
6befc40700 feeds: migrate Decoder 2023-01-11 15:51:41 +00:00
29db2d8dc5 feeds: switch to working 60 minutes feed 2023-01-11 15:46:34 +00:00
36d8052982 feeds: disable 60 minutes 2023-01-11 15:41:25 +00:00
48115231a3 feeds: port acquired, FT 2023-01-11 15:32:42 +00:00
8b56ddd1ca feeds: port acquired 2023-01-11 15:27:28 +00:00
c1457f5bfb feeds: port 99% Invisible 2023-01-11 15:25:32 +00:00
7dfaf77a71 feeds: port Sam Harris / Waking Up 2023-01-11 15:15:03 +00:00
72dc7029e6 feeds: port Dan Carlin 2023-01-11 15:06:18 +00:00
95f3215b00 feeds: port darknet diaries and radiolab 2023-01-11 15:03:24 +00:00
baac8df8c2 feeds: fix Econtalk; port Doctorow, 80000hrs, deconstructed, intercepted, Post, The Portal 2023-01-11 14:51:17 +00:00
dc6a08a12b convert some of my feeds to db entries 2023-01-11 13:16:26 +00:00
2413e2eb5f feeds: update ACX feed to its non-forwarded origin 2023-01-11 10:59:35 +00:00
7327128493 feed-init: don't actually need to do the git actions 2023-01-11 10:52:10 +00:00
ed8059f4c4 feed init now also initializes the feed info 2023-01-11 10:49:56 +00:00
3a72295610 feeds: import xkcd, lesswrong, lexfridman 2023-01-11 10:42:05 +00:00
e6d9edf27d feeds: add a script to initialize a feed, as well 2023-01-11 10:41:39 +00:00
78782d5f7e flake: update-feeds now actually does update *all* feeds 2023-01-11 10:31:00 +00:00
91275f3723 flake: make an app which updates one feed 2023-01-11 10:22:25 +00:00
8115edea8d readme: fix some outdated info 2023-01-11 09:53:27 +00:00
4c475bbf9c flake: formatting nit 2023-01-11 09:33:59 +00:00
7040e1f07c flake: rename decl-host -> evalHost 2023-01-11 09:31:05 +00:00
aafa64942c flake: simplify the definition of packages 2023-01-11 09:29:49 +00:00
a44a99e371 flake: simplify the imgs/nixosConfigurations definition 2023-01-11 09:24:24 +00:00
a7ff90c843 flake: nixpkgs can now be built without specifying nixpkgs. as a prefix 2023-01-11 09:21:09 +00:00
d4996d6f31 flake: fix passthru overlays (fixes broken image building) 2023-01-11 09:08:46 +00:00
bd5209c655 move cross compilation out of the flake and into the host definitions 2023-01-11 08:56:06 +00:00
9588108fd5 restructure flake so that nixosConfigurations mostly just references the other flake outputs 2023-01-11 08:45:41 +00:00
942e302afb flake: fix crossFrom.aarch64-linux to actually be compiled from that system 2023-01-11 07:51:19 +00:00
2bd98e6764 flake: clean up nixpkgsFor-related functions 2023-01-11 07:50:32 +00:00
7b9910f287 reorder pkgs.cross definition for better readability 2023-01-11 07:37:01 +00:00
917afe209e try to do cross-compiling in a slightly less hacky way 2023-01-11 07:22:21 +00:00
cc5cf9b6f4 flake: format 2023-01-11 05:58:07 +00:00
57d95dd298 flake: document the weird importing 2023-01-10 17:51:04 +00:00
0b78df53be change the nixpkgs url type so that it hashes stably 2023-01-10 17:44:58 +00:00
c8dcb4ac59 flake: lift the nixpkgs patching out to its own flake
i hope it's a *little* cleaner this way, but tbh i'm not really sure.
2023-01-10 17:00:48 +00:00
241f4ae58f packages: add nano for when things go really wrong 2023-01-10 12:53:54 +00:00
965d7eedbb define a per-feed update script
it currently has to be run manually:
```
./pkgs/feeds/update.sh <...>
```

it looks like `nix-update` might not really support flakes
2023-01-10 10:53:59 +00:00
cdc881e887 feeds: write the basis for a module which reads feed metadata from disk and can (in the future) update it 2023-01-10 03:52:33 +00:00
33967554a5 servo: fix missing "lib" in nginx file 2023-01-09 13:25:56 +00:00
5af55ecdbf merge: cleanup/document 2023-01-09 11:47:39 +00:00
6ca3e7086e merge: simplify the implementation and make fully compatible with lib.mkMerge 2023-01-09 11:14:59 +00:00
ca62f1b62f rename flattenAttrsets -> joinAttrsets to disambiguate 2023-01-09 09:52:37 +00:00
eef66df36d lib: split merge out of the toplevel 2023-01-09 09:51:35 +00:00
9ca6a1c907 way overcomplicated way to merge toplevel config 2023-01-09 09:42:17 +00:00
dbb78088f4 refactor: cleanup instances where we map to attrs to be more resilient against duplicate names 2023-01-09 03:48:07 +00:00
f17ae1ca7b refactor: avoid using // where we know the sets should be disjoint 2023-01-09 03:11:14 +00:00
b2774a4004 move pubkeys out a modules/data/ directory 2023-01-09 02:40:25 +00:00
0ae548d47c flake update: nixpkgs 2023-01-04 -> 2023-01-05; sops
vim was segfaulting?? i'm hoping this fixes it, we'll see.

```
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/9813adc7f7c0edd738c6bdd8431439688bb0cb3d' (2023-01-04)
  → 'github:NixOS/nixpkgs/a518c77148585023ff56022f09c4b2c418a51ef5' (2023-01-05)
• Updated input 'nixpkgs-stable':
    'github:NixOS/nixpkgs/e9ade2c8240e00a4784fac282a502efff2786bdc' (2023-01-04)
  → 'github:NixOS/nixpkgs/8c54d842d9544361aac5f5b212ba04e4089e8efe' (2023-01-08)
• Updated input 'sops-nix':
    'github:Mic92/sops-nix/b35586cc5abacd4eba9ead138b53e2a60920f781' (2023-01-01)
  → 'github:Mic92/sops-nix/2253120d2a6147e57bafb5c689e086221df8032f' (2023-01-08)
• Updated input 'sops-nix/nixpkgs-stable':
    'github:NixOS/nixpkgs/feda52be1d59f13b9aa02f064b4f14784b9a06c8' (2022-12-31)
  → 'github:NixOS/nixpkgs/9f11a2df77cb945c115ae2a65f53f38121597d73' (2023-01-07)
```
2023-01-08 23:52:40 +00:00
760505db20 snippets: add NUR package search 2023-01-08 14:16:06 +00:00
71fc1a2fd7 ssh: define system-wide knownHosts 2023-01-08 08:51:06 +00:00
a457fc1416 ssh: move sys config out of hosts/common 2023-01-08 08:43:23 +00:00
2c0b0f6947 ssh: explain why we specify host_keys the way we do instead of through sane.persist 2023-01-08 08:41:48 +00:00
f10de6c2c4 ids: improve docs 2023-01-08 06:54:29 +00:00
a6be200a82 ids: define the assertions more idiomatically 2023-01-08 06:51:25 +00:00
fb57e9aa5b cleanup the 'every user/group has an id' enforcement 2023-01-08 06:46:07 +00:00
f5acbbd830 image.nix: feed bug where enable flag wasnt actually being read 2023-01-08 05:37:25 +00:00
af77417531 feeds: add Perry Bible Fellowship comic 2023-01-08 05:30:36 +00:00
eea80b575d feeds: disable dilbert (it doesn't embed well) 2023-01-08 05:28:15 +00:00
6a209d27fd freshrss: only show text and image feeds 2023-01-08 05:27:45 +00:00
e8f778fecd feeds: convert to module 2023-01-08 05:24:56 +00:00
488036beb3 ssh: add git.uninsane.org host key back 2023-01-08 03:22:05 +00:00
00b681eca5 ssh: manager ourself instead of using home-manager 2023-01-08 03:14:47 +00:00
72d589cb2d ssh: port to modules system 2023-01-08 03:07:57 +00:00
ea5552daa7 bluetooth: accept that LinkKeys are device/host-specific and stop trying to share them across machines 2023-01-07 11:31:35 +00:00
fb7d94209c bluetooth: update key for portable speaker
i was having difficulty connecting from lappy.
i re-paired: the old LinkKey doesn't seem to work...?
this new key gave a file without `PublicAddress=true`: i don't *think*
that actually matters, though the device *does* appear to be a public
address on first glance (00: prefix, and last 2 bits aren't 11).
2023-01-07 10:18:36 +00:00
8f5b92685b install-bluetooth: just copy the keys, dont bother symlinking 2023-01-07 09:59:06 +00:00
32a4cb19fd sway: start pipewire early, to support bluetooth 2023-01-07 09:58:27 +00:00
031cfa2bcd get bluetooth working in gnome-control-center 2023-01-07 08:35:51 +00:00
e93fbea1e6 phosh: reorder the users defs 2023-01-07 08:08:49 +00:00
85a2fbc38a bluetooth: dont persist /var/lib/bluetooth 2023-01-07 08:08:29 +00:00
9e902c8eb2 preserve backlight settings across reboots 2023-01-07 05:17:43 +00:00
dc15091ea7 install-bluetooth: disable verbosity 2023-01-07 03:44:45 +00:00
c063ecd047 bluetooth keys: use sane.fs instead of activationScripts
also auto-determines the device ID, which was previously broken
2023-01-07 03:43:31 +00:00
70a43c770d net: fix a iwd error by not encoding a network name which didn't need encoding 2023-01-07 03:11:12 +00:00
cc9e2d8e15 net: simplify the iwd psk setup 2023-01-07 03:10:39 +00:00
bb41fb95fe iwd: populate net config with systemd service, not activationScript 2023-01-07 03:03:19 +00:00
d852adf806 move keyring to private store 2023-01-07 02:04:28 +00:00
5443542cba move keyring activation out of home-manager 2023-01-07 01:41:56 +00:00
81effb01a3 new script: sane-shutdown, validates host 2023-01-06 16:40:41 +00:00
83f416999f splatmoji: persist history file 2023-01-06 16:35:31 +00:00
dd34883246 move feed consumers out of home-manager 2023-01-06 16:27:05 +00:00
e47f9e38ce remove old nb module 2023-01-06 16:15:49 +00:00
0f0b728911 splatmoji: store config with sane.fs instead of home-manager 2023-01-06 16:13:51 +00:00
1839f87a4e vlc: handle the config file with sane.fs 2023-01-06 16:11:56 +00:00
53edf4e6af firefox: handle config files manually, instead of leveraging home-manager 2023-01-06 16:11:06 +00:00
fb6e0ddb34 convert some home-manager files to be manually managed 2023-01-06 15:48:51 +00:00
0a48d79174 fs: introduce some helpers to make writing symlinks easier 2023-01-06 15:38:29 +00:00
b6208e1a19 fs: allow specifying text for a symlink directly 2023-01-06 15:26:39 +00:00
e46ab4ec14 ssh: use sane.persist/sane.fs instead of home-manager to ensure keys 2023-01-06 15:05:01 +00:00
19c254c266 fs: make symlinking more resilient when something's already at the location 2023-01-06 14:51:25 +00:00
1d0cadce85 persist: configure the private store to symlink everyting by default 2023-01-06 14:44:32 +00:00
e8342b8044 persist: clean up the "byPath" conversions 2023-01-06 14:20:30 +00:00
40e642bfc3 persist: add a 'method' option to allow symlinking in favor of binding 2023-01-06 14:05:49 +00:00
f008565e22 persist: for options common to entries specified by both path and store, move to a common submodule 2023-01-06 13:58:36 +00:00
4ea2835d9d persist: handle inline acl options more cleanly 2023-01-06 13:47:59 +00:00
493d317bb1 moby: override browser-cache persistence more cleanly 2023-01-06 13:28:18 +00:00
e446bfba58 fs: fix eval error when told about a mount but not told about anything *in* that mount 2023-01-06 13:27:27 +00:00
a7bac5de18 persist: convert the sane.persist.home.<store> => mappings back to a strongly-typed module & add a byPath shorthand 2023-01-06 13:06:39 +00:00
b0950e90f4 persist: prefer mkMerge instead of manually folding attrsets 2023-01-06 12:44:29 +00:00
d8cd0e1f57 persist: fold redundant lines 2023-01-06 12:39:55 +00:00
fd7d67ee05 persist: simplify & remove dead code 2023-01-06 12:28:55 +00:00
1a712b4d47 rename sane.persist.{all -> byPath} 2023-01-06 12:19:03 +00:00
4520e1d1f5 persist: auto-map user-provided store values earlier 2023-01-06 11:56:22 +00:00
841a2a3bcb persist: change sane.persist.all to be an attrsOf that maps path to settings 2023-01-06 11:52:28 +00:00
fe816e9110 persist: lift sane.persist.dirs.{home,sys} up one level 2023-01-06 11:29:13 +00:00
426e0c3ae2 persist: lift sane.persist.dirs.all up to sane.persist.all 2023-01-06 11:24:11 +00:00
a95b91a556 refactor the dirsSubModule type so that we don't reference 'config.sane.persist' while creating options 2023-01-06 10:35:32 +00:00
837e5438c3 persist: document the dirsSubModule type better 2023-01-06 10:31:01 +00:00
8217b22c86 rename impermanence -> persist 2023-01-06 10:04:51 +00:00
0b35ce4dec Merge branch 'staging/nixpkgs-2023-01-04' 2023-01-06 10:00:37 +00:00
413f9a171b impermanence: remove /home perms hack 2023-01-06 09:59:29 +00:00
43a46af43b impermanence: cleanup backing directory creation. this should let me remove the per-store /home/<user> perms hack 2023-01-06 09:56:06 +00:00
1a0f05bfd6 flake update: nixpkgs 2022-12-31 -> 2023-01-04
```
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/8ba56d7c0d7490680f2d51ba46a141eca7c46afa' (2022-12-31)
  → 'github:NixOS/nixpkgs/9813adc7f7c0edd738c6bdd8431439688bb0cb3d' (2023-01-04)
• Updated input 'nixpkgs-stable':
    'github:NixOS/nixpkgs/6a0d2701705c3cf6f42c15aa92b7885f1f8a477f' (2022-12-30)
  → 'github:NixOS/nixpkgs/e9ade2c8240e00a4784fac282a502efff2786bdc' (2023-01-04)
```
2023-01-06 08:57:39 +00:00
c18dd9636d fs: symlinking: fix recursive links (don't follow links when creating new ones) 2023-01-06 05:32:31 +00:00
0977721af5 moby: fix to preserve browser cache across boots 2023-01-04 13:27:20 +00:00
122d3cd7e4 impermanence: fix home perms in ~/private dir 2023-01-04 13:24:23 +00:00
cd5f8054c0 fs: rename "mountpt" -> "origin" to reflect that it doesnt have to be a device 2023-01-04 12:19:32 +00:00
3db388b105 servo: relocate ext device to /mnt/impermanence/ext and fixup deps 2023-01-04 12:12:30 +00:00
2ba6116f10 fs/impermanence: more precisely control unit dependencies/ordering 2023-01-04 11:22:26 +00:00
592d17b725 impermanence: crypt: simplify setup (experimental) 2023-01-04 09:28:59 +00:00
4d9c15f9b8 fs: fix file mode even if not newly created 2023-01-04 08:12:53 +00:00
abced7dd0d navidrome: don't try to chown to an invalid user 2023-01-04 08:00:04 +00:00
5c42365912 sane-stop-all-servo: add missing services 2023-01-04 07:49:21 +00:00
247ad326b2 freshrss: be conservative and use explicit octal mode bits 2023-01-04 07:14:54 +00:00
170008f345 home.files symlinks: port to sane.fs 2023-01-04 07:14:38 +00:00
2c48e61854 fs: fix mode of deployed files; simplify 2023-01-04 07:14:01 +00:00
f89f756489 fs: create symlinks at multi-user target by default 2023-01-04 06:32:53 +00:00
c0da19951b fs: fix symlink ownership/perms 2023-01-04 06:28:44 +00:00
5fb67306e4 fs: rework for dir to not be mandatory 2023-01-04 06:17:34 +00:00
5533b586d7 fs: lift depends out of dir, to toplevel 2023-01-04 04:32:20 +00:00
68c2eb7363 impermanence: clean up the deps for the crypt store 2023-01-04 04:22:17 +00:00
fd79026366 fs: fix loose mount dependency 2023-01-04 04:06:19 +00:00
a76471cb1f fs: simplify the mount configuration 2023-01-04 03:57:24 +00:00
c94b8299a6 fs: add experimental support for symlink entries 2023-01-04 02:51:07 +00:00
175bc0709f remove external impermanence library 2023-01-04 02:18:03 +00:00
7b02477486 servo: define /etc/persist via sane impermanence module 2023-01-04 02:15:43 +00:00
d7c8638fea impermanence: add a storeDescription field per store 2023-01-04 01:54:13 +00:00
9d7d1acc80 sane.impermanence.dirs.home.<store> is now auto-generated and options can vary across deployments 2023-01-04 01:45:05 +00:00
787857d27f firefox: update plugin hashes 2023-01-04 01:39:42 +00:00
9c248a8a31 impermanence: cleanup the dirs submodule 2023-01-04 01:34:19 +00:00
829680fb00 impermanence: simplify dir-acl handling by using a helper 2023-01-04 01:19:22 +00:00
a9ee26388c guest account: make home-dir writable by other users 2023-01-04 01:09:23 +00:00
2960b895b6 lib: lift acl type into sane-lib/types 2023-01-04 00:59:52 +00:00
933063115b moby: fix home-dirs for newer impermanence module 2023-01-04 00:47:48 +00:00
afe684ca2c modules: impermanence: use sane-lib.path 2023-01-03 14:55:27 +00:00
93f1411522 fs: split helpers out into sane-lib module 2023-01-03 14:20:02 +00:00
01e44c1f7f flake.nix: remove unused specialArgs 2023-01-03 14:18:57 +00:00
618e9bd2fa gocryptfs: place package in system.fsPackages instead of environment.systemPackages (it propagates anyway) 2023-01-03 12:00:49 +00:00
fbc39d0584 modules: fs: move to subdir 2023-01-03 08:27:28 +00:00
2d7b3750cd impermanence: split the /home/colin perms fix into more appropriate places 2023-01-03 08:25:43 +00:00
e6ccd2e4f7 impermanence: split plaintext store to own file (this will bypass some recursion in the next patch) 2023-01-03 08:02:03 +00:00
d4bf491e9c impermanence: improve docs 2023-01-03 07:45:19 +00:00
5a2bbcce3b move plaintext home-dirs out of home-manager module into users module 2023-01-03 07:35:42 +00:00
327e6b536f impermanence: large refactor, and experimental bind mounting of things from ~/private 2023-01-03 07:22:37 +00:00
bace7403e7 Merge branch 'staging/nixpkgs-2022-12-31' 2023-01-03 03:05:21 +00:00
57f5521ef3 grpc: unpin (seems to build OK) 2023-01-03 03:05:07 +00:00
9e32211c12 impermanence: cange "encryptedClearOnBoot" to a broader "store" argument
in the future it can support ~/private as a backing store
2023-01-03 03:04:19 +00:00
edf6bd4455 fs: add a "mount.bind" option & use it for impermanence bind-mounts 2023-01-03 02:45:23 +00:00
a9a14786f9 packages: disable fractal (unused, slow build) 2023-01-02 23:35:43 +00:00
eade5fe16e flake update: 2022-12-22 -> 2022-12-31
```
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/652e92b8064949a11bc193b90b74cb727f2a1405' (2022-12-22)
  → 'github:NixOS/nixpkgs/8ba56d7c0d7490680f2d51ba46a141eca7c46afa' (2022-12-31)
• Updated input 'nixpkgs-stable':
    'github:NixOS/nixpkgs/dac57a4eccf1442e8bf4030df6fcbb55883cb682' (2022-12-24)
  → 'github:NixOS/nixpkgs/6a0d2701705c3cf6f42c15aa92b7885f1f8a477f' (2022-12-30)
• Updated input 'sops-nix':
    'github:Mic92/sops-nix/855b8d51fc3991bd817978f0f093aa6ae0fae738' (2022-12-25)
  → 'github:Mic92/sops-nix/b35586cc5abacd4eba9ead138b53e2a60920f781' (2023-01-01)
• Updated input 'sops-nix/nixpkgs-stable':
    'github:NixOS/nixpkgs/939c05a176b8485971463c18c44f48e56a7801c9' (2022-12-24)
  → 'github:NixOS/nixpkgs/feda52be1d59f13b9aa02f064b4f14784b9a06c8' (2022-12-31)
```
2023-01-02 22:34:22 +00:00
be222c1d70 trust-dns: allow shorthand assignment of record lists 2023-01-02 13:23:52 +00:00
88a33dd5de snippets: add private links 2023-01-02 13:23:29 +00:00
875e923197 declare ~/private in fileSystems and reuse for pamMount 2023-01-02 11:34:02 +00:00
54dd643cf0 trust-dns: make a note about another DNS library we could draw from 2023-01-02 11:33:32 +00:00
3c726f148b remove some stale references to mobile-nixos 2023-01-02 10:00:20 +00:00
e225e2e704 modules/packages: directly set impermanence.home-dirs instead of working through home-manager 2023-01-02 07:45:05 +00:00
cf0bf8190e modules/packages: clean up loose typing of sane.packages 2023-01-02 07:16:16 +00:00
b8f7f68d4c packages: telegram: persist data in private storage 2023-01-02 07:06:58 +00:00
7a3aae8c97 fs: tidy 2022-12-31 12:38:50 +00:00
89e519810d impermanence: clean up the bind mounts 2022-12-31 12:31:49 +00:00
0e920230ba impermanence: fix systemd service ordering for crypt mount 2022-12-31 12:18:27 +00:00
6ffae00e17 fs: rename "service" option to "unit" option 2022-12-31 11:31:16 +00:00
be19985440 impermanence: crypt: more robust perms and ordering of backing device 2022-12-31 10:45:43 +00:00
f7e3e7294a impermanence: transform gocryptfs key generation from activation script to systemd unit 2022-12-31 10:15:08 +00:00
d745e3c1ee impermanence: remove fuse module: we don't need it now that we're mounting after activation 2022-12-31 09:13:31 +00:00
c1890ce82b impermanence: cleanup some previously verbose code 2022-12-31 09:09:51 +00:00
53a0b621d8 impermanence: use sane.fs to inherit permissions instead of specifying defaults here 2022-12-31 01:04:49 +00:00
aeb2f63d65 impermanence: defer to fs.nix module for permissions & dir creation 2022-12-31 00:38:15 +00:00
528ffdb58e add a new 'fs.nix' file i'll use to factor the impermanence stuff better 2022-12-30 14:45:34 +00:00
b6887b305e impermanence: split out the root-on-tmpfs stuff 2022-12-30 04:35:34 +00:00
08dfc80c98 impermanence: split out sops setup 2022-12-30 04:31:24 +00:00
5a273213f6 sops: remove sops.age.sshKeyPaths override: sops gets this from openssh config already 2022-12-30 03:49:31 +00:00
0a6d88dfc1 impermanence: simplify /etc/ssh/host_keys setup 2022-12-30 03:34:59 +00:00
50dfd482cf document plans for better handling of /etc/ssh 2022-12-29 19:19:51 +00:00
9743aee79d ssh keys: document the issues i'm seeing 2022-12-29 18:42:59 +00:00
0819899102 remove dead commented-out code 2022-12-29 18:34:03 +00:00
d3ff68217e impermanence: enable hyphenated folder names 2022-12-29 18:29:27 +00:00
1a96859994 impermanence: re-enable mpv watch_later dir 2022-12-29 18:10:40 +00:00
af92a2250e impermanence: fix up circular dependencies and permissions
this is now a proof of concept. still has some rough edges.
2022-12-29 18:03:41 +00:00
d00f9b15d7 impermanence: fix typo in permissions service 2022-12-29 17:16:27 +00:00
aa1c1f40cb WIP: impermanence rework (gut 3rd-party lib) 2022-12-29 16:38:58 +00:00
530b2d6385 impermanence: factor out some helpers for generating fileSystems and services 2022-12-29 08:42:15 +00:00
e6919dd16f impermanence: use systemd/fileSystems for the crypt mounts, instead of 3rd-party impermanence 2022-12-29 01:17:40 +00:00
760f2ac66d move ~/.cache into encrypted private dir 2022-12-29 01:17:40 +00:00
8e5ca11259 cleanup gocryptfs mounting
there's possibly some latent issues. i think my changes to the gocryptfs
package *might* not be necessary: if you work via the fuse front-door,
it's a lot harder to get it into these weird places.
2022-12-29 01:17:40 +00:00
121936620a impermanence: add support for encrypted clear-on-boot storage
this is useful for when we need to store files to disk purely due to
their size, but don't actually want them to be persisted.
2022-12-29 01:17:40 +00:00
f5b49e014c net: add parent's wifi 2022-12-29 00:57:36 +00:00
4bdb34775d consolidate filesystems./ across devices 2022-12-28 01:36:22 +00:00
f5fbc206f5 package signaldctl (partially tested)
it includes an extra `bin/generator` output: i'm not sure if this is
necessary yet or not.
2022-12-28 00:48:44 +00:00
a9096f3312 sane-scripts: remove /run/wrappers hack now that prologue is fixed in resholve 2022-12-26 10:02:51 +00:00
67cddecab4 Merge branch 'staging/nixpkgs-2022-12-22' 2022-12-26 09:30:21 +00:00
9a002c99eb python-data template: add requests module 2022-12-26 09:29:23 +00:00
a0ac7fa98d snippets: add secret snippets 2022-12-26 09:29:04 +00:00
b03043e513 add sane-bt-search script to search jackett/torrents 2022-12-26 09:05:26 +00:00
0713e3bad1 secrets: move bluetooth/vpn secret defn to toplevel nix file 2022-12-26 08:28:44 +00:00
d3a3f39756 move universal secrets out of net.nix -> secrets.nix 2022-12-26 08:09:58 +00:00
a7d9e5cc54 flake update: nixpkgs 2022-12-18 -> 2022-12-22
```
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/04f574a1c0fde90b51bf68198e2297ca4e7cccf4' (2022-12-18)
  → 'github:NixOS/nixpkgs/652e92b8064949a11bc193b90b74cb727f2a1405' (2022-12-22)
• Updated input 'nixpkgs-stable':
    'github:NixOS/nixpkgs/cbe419ed4c8f98bd82d169c321d339ea30904f1f' (2022-12-20)
  → 'github:NixOS/nixpkgs/dac57a4eccf1442e8bf4030df6fcbb55883cb682' (2022-12-24)
• Updated input 'sops-nix':
    'github:Mic92/sops-nix/32840f16ffa0856cdf9503a8658f2dd42bf70342' (2022-12-19)
  → 'github:Mic92/sops-nix/855b8d51fc3991bd817978f0f093aa6ae0fae738' (2022-12-25)
• Updated input 'sops-nix/nixpkgs-stable':
    'github:NixOS/nixpkgs/87b58217c9a05edcf7630b9be32570f889217aef' (2022-12-19)
  → 'github:NixOS/nixpkgs/939c05a176b8485971463c18c44f48e56a7801c9' (2022-12-24)
```
2022-12-26 05:19:58 +00:00
13f3b322b0 alias to cd ~/Videos 2022-12-26 04:40:21 +00:00
5c25330891 packages: add nheko matrix client 2022-12-26 03:52:04 +00:00
dc6dc2e475 discord: remove the SKIP_HOST_UPDATE hack. it's been upstreamed 2022-12-26 03:30:25 +00:00
c4352fa9bb packages: move Signal, Discord, Tokodon to private storage 2022-12-26 03:26:50 +00:00
2c6629a658 packages: allow specifying multiple dir and private paths 2022-12-26 03:02:19 +00:00
c0496b25b5 init-keyring: try to make atomic 2022-12-25 12:02:33 +00:00
9e0346c329 snippets: update jackett to be a search query 2022-12-25 08:43:29 +00:00
364a598324 pkgs: clean up the imports to not explicitly pass pkgs 2022-12-25 07:33:24 +00:00
c6850aff23 ship fractal-latest (git tip) instead of fractal-next 2022-12-25 07:23:09 +00:00
730ef272d1 feeds: add put a num on it; remove Kaiteki code feed 2022-12-25 03:39:44 +00:00
16fa1e0eda sane-date-math: convert to LR parser 2022-12-24 05:08:17 +00:00
51a96525d9 sane-date-math: use Productions as objects 2022-12-24 01:17:19 +00:00
7b01822ee7 some kind of sane-date-math date/time util thing. idk, parsers are fun ig 2022-12-23 15:57:56 +00:00
f9aa36a620 flake update: nixos-stable 2022-12-17 -> 2022-12-20
```

• Updated input 'nixpkgs-stable':
    'github:NixOS/nixpkgs/0938d73bb143f4ae037143572f11f4338c7b2d1c' (2022-12-17)
  → 'github:NixOS/nixpkgs/cbe419ed4c8f98bd82d169c321d339ea30904f1f' (2022-12-20)
```
2022-12-22 22:45:27 +00:00
9b75d8705b ejabberd: enable push notifications (verified working on iOS/Modal IM) 2022-12-22 14:12:15 +00:00
217ecec250 ejabberd: enable xmpps-{client,server} SRV records 2022-12-22 13:13:09 +00:00
6c7ca7630a zsh: add tmp alias for ~/tmp 2022-12-22 11:35:35 +00:00
1f99d44288 /home/colin: fix perms to 0700 2022-12-22 11:33:13 +00:00
f1aa685a03 fix p10k variable expansion 2022-12-22 11:00:49 +00:00
2b31fc8776 powerlevel10k: always show user/host 2022-12-22 10:58:02 +00:00
0c35e2b3c1 servo: enable nsncd 2022-12-22 10:34:47 +00:00
77b8d0ddc0 fuzzel: tune dialog widths 2022-12-22 10:10:03 +00:00
84f23c602e new snipper: nixos options search 2022-12-22 10:06:55 +00:00
ea5fbc63cf zsh/p10k: selectively disable gitstatus acceleration on ~/private/ 2022-12-21 14:13:20 +00:00
69361ee9a2 zsh: document prezto modules, switch dir aliases to dirHashes 2022-12-21 13:53:22 +00:00
1808d153b2 zsh: configure p10k 2022-12-21 13:08:23 +00:00
b3ad0f8f1f update ~/knowledge to live in ~/private 2022-12-21 08:52:27 +00:00
c745612cfd Merge branch 'master' of git.uninsane.org:colin/nix-files 2022-12-21 08:51:12 +00:00
278cc98c6d minor ejabberd config changes, simplify DNS %NATIVE% updating 2022-12-21 08:50:41 +00:00
fac661af15 new script: sane-git-init 2022-12-21 08:40:22 +00:00
65777c70ad snippets: add link to home-manager docs 2022-12-21 08:30:16 +00:00
09c524a5b1 Merge remote-tracking branch 'origin/staging/nixpkgs-2022-12-18' 2022-12-21 07:47:55 +00:00
0db7f0857a moby: reduce the number of configurations we keep in /boot 2022-12-21 06:33:50 +00:00
38befe502c new script to free space in /boot 2022-12-21 06:29:13 +00:00
55e09c2dbf ejabberd: port to dns-dns; add experimental STUN/TURN support
during startup it says:
```
Ignoring TLS-enabled STUN/TURN listener
```

and later
```
Invalid certificate in /var/lib/acme/uninsane.org/fullchain.pem: at line 61: certificate is signed by unknown CA
```

the invalid cert thing has always been here. it's for the root cert. idk
if i need to tell ejabberd that one's self-signed, or what.
2022-12-20 03:26:08 +00:00
bd699c887c sane-ssl-dump: new script to help debug ssl stuff 2022-12-20 03:25:07 +00:00
2de6f7d364 fix i2p to build on aarch64 2022-12-20 03:10:05 +00:00
d60e5264f3 don't bind-mount /etc/ssh/host_keys: symlink them instead 2022-12-20 00:04:09 +00:00
c66699b697 update nixpkgs: 2022-12-11 -> 2022-12-18; sops-nix
```
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/64e0bf055f9d25928c31fb12924e59ff8ce71e60' (2022-12-11)
  → 'github:NixOS/nixpkgs/04f574a1c0fde90b51bf68198e2297ca4e7cccf4' (2022-12-18)
• Updated input 'nixpkgs-stable':
    'github:NixOS/nixpkgs/06278c77b5d162e62df170fec307e83f1812d94b' (2022-12-12)
  → 'github:NixOS/nixpkgs/0938d73bb143f4ae037143572f11f4338c7b2d1c' (2022-12-17)
• Updated input 'sops-nix':
    'github:Mic92/sops-nix/da98a111623101c64474a14983d83dad8f09f93d' (2022-12-04)
  → 'github:Mic92/sops-nix/32840f16ffa0856cdf9503a8658f2dd42bf70342' (2022-12-19)
• Updated input 'sops-nix/nixpkgs-stable':
    'github:NixOS/nixpkgs/86370507cb20c905800527539fc049a2bf09c667' (2022-12-04)
  → 'github:NixOS/nixpkgs/87b58217c9a05edcf7630b9be32570f889217aef' (2022-12-19)
```
2022-12-19 22:42:58 +00:00
97044bf70e trust-dns: port to dyn-dns for determining WAN IP
although the systemd wantedBy directive is working,
`before` seems to be ignored when the unit fails. so on first run,
dyn-dns runs, fails (poor net connectivity), then trust-dns starts
(fails), then they both restart 10s later.

it's not great, but good enough. also, wan IP is persisted, so this
likely won't happen much in practice.
2022-12-19 13:12:23 +00:00
3122334a41 dyn-dns: fix to only react when the IP actually changes 2022-12-19 11:54:27 +00:00
0b2faef989 /etc/ssh/host_keys: fix endlessly stacked mounts
i believe this was mounting a new /etc/ssh/host_keys on every
activation, resulting in literally thousands of mounts and slowing down
later activations
2022-12-19 11:18:08 +00:00
8acd6ca4f1 create sane.services.dyn-dns to manage dynamic DNS stuff
not yet integrated into servo
2022-12-19 11:16:30 +00:00
8169f7c6b2 ddns-trust-dns: use ddns from router rather than ipinfo.io 2022-12-19 08:24:11 +00:00
cd1aa0b376 sane-vpn-*: reference sane-ip-check instead of duplicating 2022-12-19 06:19:13 +00:00
72b627100c sane-scripts: simplify recursively referencing sane scripts 2022-12-19 06:18:44 +00:00
567c08460a add sane-ip-check-router-wan to query WAN with a more trustworthy source 2022-12-19 05:59:44 +00:00
9b66aecf1b trust-dns: port the remaining records to a structured format
SRV and MX _could_ have more structure (priority, etc).
not sure the best path there (option submodule, i guess).
2022-12-19 04:38:43 +00:00
16cb3b83a2 trust-dns: more idiomatic way to define SOA records 2022-12-19 04:00:27 +00:00
970438be8a trust-dns: rename records option -> extraConfig
i'll be adding special options for records
2022-12-19 03:12:32 +00:00
51da29555e sane-ip-reconnect: fix issue where we'd reconnect to the existing, subpar network 2022-12-19 01:47:30 +00:00
8a745a9b8a ejabberd: enable STUN (with partial discovery support)
discovery is probably not working:
```
Won't auto-announce STUN/TURN service on port 3478 (udp) without public IP address, please specify 'turn_ipv4_address' and optionally 'turn_ipv6_address'
Won't auto-announce STUN/TURN service on port 3478 (tcp) without public IP address, please specify 'turn_ipv4_address' and optionally 'turn_ipv6_address'
```

no messages for the TLS implementation, so maybe that's working?
2022-12-19 01:22:20 +00:00
3505f3b9f3 ejabberd: provision cert for conference.xmpp.uninsane.org
i guess the cert already had that because of legacy prosody setup (?),
but we weren't setup so that new requests would work, i expect.

either that or all of these nginx entries aren't necessary?
2022-12-19 01:22:20 +00:00
444595e847 disable HE and afraid DDNS 2022-12-19 01:22:20 +00:00
3e1407c30b new script to reconnect to best wifi network 2022-12-19 00:29:48 +00:00
0a744117a4 rename sane-check-ip -> sane-ip-check 2022-12-18 23:54:41 +00:00
a2935cedaa snippets: add wikipedia search 2022-12-18 22:58:53 +00:00
22e46d52c2 trust-dns: distribute records across service files 2022-12-17 01:29:12 +00:00
1e0c213adf split webconfig into each service file 2022-12-17 00:52:48 +00:00
3e1340ed61 enable i2p in firefox 2022-12-16 22:15:19 +00:00
341dd3f2b2 new zsh alias: ref -> cd ~/ref 2022-12-16 20:56:48 +00:00
1c9caa40bd snippets: update nixos wiki to include search param 2022-12-16 20:35:33 +00:00
3be15c6d05 podcasts: add Michael Malice (is it any good? we'll see.) 2022-12-16 08:04:28 +00:00
8e8168ec28 add splatmoji package and sway config 2022-12-16 07:46:06 +00:00
28397807fc gpt2tc: disable, because the mirror is unreliable 2022-12-16 07:08:55 +00:00
42ebb9a155 sane-private-do: run a command with the private store unlocked; then re-lock it 2022-12-16 06:10:44 +00:00
a8a4b8e739 kiwix: serve the full english Wikipedia 2022-12-16 05:58:51 +00:00
2550601179 serve w.uninsane.org through kiwix-serve 2022-12-16 02:25:57 +00:00
199a49755a create a kiwix-serve service 2022-12-16 02:15:17 +00:00
8c7700688f nixpatches: add kiwix-tools package that's being upstreamed 2022-12-16 01:22:38 +00:00
8fe304d6c1 trust-dns: split the service into a generic config interface 2022-12-15 11:17:50 +00:00
700fef7df3 servo: mediawiki: remove dead commented-out code 2022-12-15 11:17:50 +00:00
01db7e1f23 servo: install mediawiki 2022-12-15 11:17:50 +00:00
df6e8f1562 Merge branch 'master' of git.uninsane.org:colin/nix-files 2022-12-15 09:59:53 +00:00
1f0a40c81f snippets: add nixos wiki 2022-12-15 09:54:32 +00:00
995b41d1e8 flake: update nixpkgs-stable 22.05 -> 22.11 2022-12-14 22:32:41 +00:00
7674735d42 Merge branch 'master' of git.uninsane.org:colin/nix-files 2022-12-14 12:28:58 +00:00
329693c9ce pin grpc & users, until the grpc aarch64 build is fixed 2022-12-14 12:27:24 +00:00
5ae3bb2f6c sane-rcp: allow a destination 2022-12-14 10:07:02 +00:00
e0b1aef127 snippets: add sci-hub 2022-12-14 09:52:07 +00:00
9b8363dfb4 firefox addons: bypass-paywalls-clean: update hash 2022-12-14 08:00:42 +00:00
58ad87df8e vpns: add us-mi[ami] 2022-12-13 04:26:00 +00:00
5fc894cda9 vpn: fix us-atlanta -> us-atl to match interface length limit 2022-12-13 04:13:01 +00:00
07e6ec2533 sane-scripts: better vpn factoring 2022-12-13 04:11:58 +00:00
005a79e680 vpn: factor out more helpers 2022-12-13 03:55:18 +00:00
0f5279bbca add us-atlanta VPN 2022-12-13 03:26:23 +00:00
e9b3b7ebab simplify ovpn impl 2022-12-13 03:17:27 +00:00
7a83c1d6df trust-dns: use upstream build 2022-12-13 02:03:09 +00:00
46788fe565 servo: make uninsane.org NS records consistent with upstream 2022-12-13 01:00:16 +00:00
a473ef6db3 flake update: nixpkgs: 2022-12-02 -> 2022-12-11; others
```
• Updated input 'mobile-nixos':
    'github:nixos/mobile-nixos/25eec596116553112681d72ee4880107fc3957fa' (2022-11-19)
  → 'github:nixos/mobile-nixos/5ee45cc1f8e43f4af14ee17ccef9156b0db8cd77' (2022-12-04)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/b72b8b94cf0c012b0252a9100a636cad69696666' (2022-12-02)
  → 'github:NixOS/nixpkgs/64e0bf055f9d25928c31fb12924e59ff8ce71e60' (2022-12-11)
• Updated input 'nixpkgs-stable':
    'github:NixOS/nixpkgs/5d7d1d5f742e6bb57dd2e3d7b433fb4010c7af22' (2022-12-02)
  → 'github:NixOS/nixpkgs/7b9eeb856cbf976482fa8d1cb295ea03fb3e1277' (2022-12-10)
• Updated input 'sops-nix':
    'github:Mic92/sops-nix/8295b8139ef7baadeb90c5cad7a40c4c9297ebf7' (2022-11-29)
  → 'github:Mic92/sops-nix/da98a111623101c64474a14983d83dad8f09f93d' (2022-12-04)
• Removed input 'sops-nix/nixpkgs-22_05'
• Added input 'sops-nix/nixpkgs-stable':
    'github:NixOS/nixpkgs/86370507cb20c905800527539fc049a2bf09c667' (2022-12-04)
```
2022-12-13 00:52:54 +00:00
3627d47f12 firefox: add uBlacklist 2022-12-13 00:44:38 +00:00
115f8d7054 servo: vpn services are part of 'wireguard-wg0'
this makes it so if we restart the wireguard connection, the services
themeselves _also_ restart. that should avoid leaving any of them in an
orphaned namespace
2022-12-12 11:53:34 +00:00
ac44b04d99 servo: trust-dns: note about maybe using dig instead of diff'ing the config 2022-12-12 11:35:47 +00:00
afff0aff19 servo: trust-dns: fix up the timers/ddns reliability 2022-12-12 11:33:20 +00:00
f0086dc5bd servo: trust-dns: implement some dynamic DNS shim 2022-12-12 10:30:08 +00:00
acabd34f28 servo: net: forward http requests from vpn -> host w/o NATing the source address
this ensures we have access to the source IP in our host-side logs
2022-12-12 05:21:29 +00:00
d0e6b82739 make it so wireguard-wg0 is restartable 2022-12-11 17:07:53 +00:00
dc09b7b9b2 Merge branch 'master' of git.uninsane.org:colin/nix-files 2022-12-11 16:48:16 +00:00
38c5b82a08 servo: fold wg0 setup into one single service
it doesn't restart cleanly (maybe i can't kill a netns while stuff lives
inside it?). problem for another day.
2022-12-11 16:46:55 +00:00
89def1a073 servo: remove dead net code 2022-12-11 16:15:43 +00:00
ad2ed370d9 servo: split the firewall rules across services 2022-12-11 16:12:23 +00:00
3e8f7a9ba2 servo: use ISP-provided DNS resolvers by default
this is really hacky and i hate it, but there's not a lot of good
options.
2022-12-11 16:03:41 +00:00
028ecfe93f snippets: add HN 2022-12-11 13:14:24 +00:00
c5ac792c13 servo: connect wg0 via IP addr instead of hostname
i think this fixes the connectivity issues i've seen.
2022-12-11 12:48:50 +00:00
bd1624bef9 servo: un-firewall tcp port 53 to fix trust-dns over TCP 2022-12-11 12:48:11 +00:00
3ae53d7f32 services: add RestartSec to anything which auto-restarts
this is to prevent rapid restart failures from killing the service
permanently.
2022-12-10 13:28:46 +00:00
e7f2d41b1f servo: forward DNS to root ns without NAT'ing the source address 2022-12-10 13:28:19 +00:00
3394a79e2b trust-dns: restart on failure
if the network isn't up, won't be able to bind to eth, and fails.
2022-12-10 13:02:17 +00:00
b01501663d trust-dns: listen on each address explicitly 2022-12-10 12:29:10 +00:00
cbd5ccd1c8 desko: disable wifi 2022-12-10 12:27:02 +00:00
cf857eaf9f zsh: more cd aliases (knowledge, secrets) 2022-12-10 12:16:16 +00:00
3a7eb294c7 servo: fix jackett DNS entry 2022-12-10 09:47:28 +00:00
2ccb470adc packages: add tcpdump 2022-12-10 02:56:00 +00:00
0a2a929507 Merge branch 'master' of git.uninsane.org:colin/nix-files 2022-12-09 14:18:40 +00:00
2014d5ce77 servo: bridge port 80/53 from ovpns to native using iptables instead of socat
i should probably narrow the rules to match specifically things destined
for the ovpns address, but for now this should work.
2022-12-09 14:16:48 +00:00
041adb7092 snippets: add nixos search URL 2022-12-09 01:25:24 +00:00
a979521a98 servo: enable ddns against freedns.afraid.org 2022-12-08 14:30:17 +00:00
77881be955 trust-dns: document SOA parameters 2022-12-08 14:23:35 +00:00
0450b4d9a6 trust-dns: fix SOA 2022-12-08 00:46:32 +00:00
edea64a41c trust-dns: move nameserver to subdomain ns1,ns2 2022-12-08 00:39:22 +00:00
90e479592f trust-dns: enable port 53 forward 2022-12-08 00:06:20 +00:00
62d83d94f2 add script to query public IP 2022-12-07 23:39:20 +00:00
52bbe4e9f4 trust-dns: don't restart on failure
for in case anything goes wrong
2022-12-07 12:17:03 +00:00
ab176b8d4b servo: enable trust-dns (experimental) 2022-12-07 12:15:35 +00:00
62df4492a3 Merge branch 'master' of git.uninsane.org:colin/nix-files 2022-12-07 09:47:03 +00:00
f4ed194abc package trust-dns 2022-12-07 09:45:11 +00:00
6420c9fd16 packages: add gajim (at least temporarily, for debugging) 2022-12-07 08:02:14 +00:00
86245b460b Merge branch 'master' of git.uninsane.org:colin/nix-files 2022-12-07 07:41:58 +00:00
bf1ba786b3 packages: add imagemagick (for convert) 2022-12-07 07:41:05 +00:00
35a896a3e2 shell aliases to cd to common places 2022-12-07 07:40:52 +00:00
b4314bd919 mess with XMPP stuff. ejabberd: enable mam, some other acl's that probably aren't used
prosody is still broken
2022-12-07 01:31:17 +00:00
4696209822 nixpatches: update aerc fix hash 2022-12-07 01:14:24 +00:00
c3957d81c2 ejabberd: enable MUC 2022-12-07 00:08:08 +00:00
8a5be00c93 sway: define a "snippets.txt" file for e.g. browser bookmarks 2022-12-06 11:12:27 +00:00
c2db9fe28e periodically archive my torrents so i don't lose them again 2022-12-06 07:17:19 +00:00
ccaac901f7 Merge branch 'master' of git.uninsane.org:colin/nix-files 2022-12-06 07:06:32 +00:00
7f285a8254 ejabberd: enable some more modules which don't conflict 2022-12-06 07:05:59 +00:00
b0b82a3d88 feeds: add Matrix Live podcast
haven't listened. just searching.
2022-12-06 06:58:59 +00:00
b0664d81ab ejabberd: enable mod_pubsub, mod_avatar
i'm able to do this without breaking federation now,
but it doesn't seem to fullly work.
2022-12-05 02:37:35 +00:00
8ba52bb9cd ejabberd: enable mod_{carboncopy,last,offline,private,stream_mgmt} 2022-12-05 02:16:28 +00:00
20f0a19e25 ejabberd: fix federation: disable mod_pubsub and mod_avatar
now i can send messages FROM uninsane.org again
2022-12-05 00:47:48 +00:00
9dc17a3874 ejabberd: enable avatar support
haven't tested that it federates properly -- only that Dino is able to
set it.
2022-12-04 12:38:47 +00:00
2992644901 bluetooth: persist bluetooth earbuds connection 2022-12-04 11:33:03 +00:00
d5d89a10b9 bluetooth: add key for connecting to my car 2022-12-04 10:56:50 +00:00
f7d9fdfe04 packages: add pstree 2022-12-04 03:42:54 +00:00
c42aa2847b aerc: apply patch to fix awk / message reading 2022-12-04 02:48:37 +00:00
768c5c910f update nixpkgs: 2022-11-27 -> 2022-12-02
```
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/a115bb9bd56831941be3776c8a94005867f316a7' (2022-11-27)
  → 'github:NixOS/nixpkgs/b72b8b94cf0c012b0252a9100a636cad69696666' (2022-12-02)
• Updated input 'nixpkgs-stable':
    'github:NixOS/nixpkgs/fecf05d4861f3985e8dee73f08bc82668ef75125' (2022-11-27)
  → 'github:NixOS/nixpkgs/5d7d1d5f742e6bb57dd2e3d7b433fb4010c7af22' (2022-12-02)
```
2022-12-03 22:56:00 +00:00
8790a7d9fd note about persisting bluetooth config 2022-12-03 11:35:03 +00:00
7c36a0d522 bluetooth: share connections across machines 2022-12-03 11:05:09 +00:00
977a80d59e Merge branch 'staging/moby-6.1.0-rc7' 2022-12-03 09:05:13 +00:00
63c92a44ed servo: ejabberd: enable file uploads 2022-12-03 08:57:10 +00:00
bf838ea203 packages: add tree as system package 2022-12-03 08:56:26 +00:00
e8a7a1dc75 moby: upgrade kernel 6.0.2 -> 6.1.0-rc7 2022-12-03 08:41:38 +00:00
992efc1093 moby: persist pulseaudio volume status 2022-12-03 07:30:09 +00:00
d320fa39f3 packages: move gpt2tc to x86-only group
it doesn't support arm
2022-12-03 07:29:53 +00:00
e40156ed9a RSS: add Peter Saint-Andre 2022-12-03 06:31:29 +00:00
656837c810 add gpt2tc package for gpt-2 generation 2022-12-03 06:31:29 +00:00
0533ea1cc2 add awk as a system-level package 2022-12-03 06:31:29 +00:00
a1911f3001 ejabberd: fix TLS config (now successfully federating!)
TODO: verify file uploading
TODO: wire up admin panel
2022-12-03 02:16:29 +00:00
24967c53a7 servo: disable ipfs 2022-12-02 08:33:50 +00:00
8b9c18aee1 firefox: update plugin hashes 2022-12-02 04:23:20 +00:00
8d3acb104a sublime-music: ship the mobile fork
it *works* on Desktop. it's not *perfect*, but likely better than the
non-mobile one.
2022-12-02 01:24:51 +00:00
69eacf6c4d ship strace on all platforms 2022-12-02 01:02:08 +00:00
d7ad414a9c package a mobile-friendly fork of sublime-music (untested) 2022-12-01 22:03:13 +00:00
533b0a91bd remove unused vim package: nabla 2022-12-01 21:05:23 +00:00
56d87da650 feeds: add pomeroyb 2022-12-01 19:00:08 +00:00
3f33b2cb76 nginx: supply x509 certs for assorted websites under /var/www/sites 2022-11-30 11:37:37 +00:00
f8a1df790f servo: allow hosting arbitrary websites by stashing them in /var/www 2022-11-30 05:33:04 +00:00
e94186e9c9 Merge branch 'staging/nixpkgs-2022-11-27' 2022-11-30 05:15:03 +00:00
82d11a7ae1 nginx: note that OCSP stapling isn't actually working 2022-11-30 02:09:35 +00:00
0253774622 add templates.python-data
for more info, see
<https://nixos.org/manual/nix/stable/command-ref/new-cli/nix3-flake-init.html>
2022-11-30 00:48:27 +00:00
2f45c57310 nix flake update: nixpkgs 2022-11-21 -> 2022-11-27, others
```
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/af50806f7c6ab40df3e6b239099e8f8385f6c78b' (2022-11-21)
  → 'github:NixOS/nixpkgs/a115bb9bd56831941be3776c8a94005867f316a7' (2022-11-27)
• Updated input 'nixpkgs-stable':
    'github:NixOS/nixpkgs/cf63ade6f74bbc9d2a017290f1b2e33e8fbfa70a' (2022-11-20)
  → 'github:NixOS/nixpkgs/fecf05d4861f3985e8dee73f08bc82668ef75125' (2022-11-27)
• Updated input 'sops-nix':
    'github:Mic92/sops-nix/f72e050c3ef148b1131a0d2df55385c045e4166b' (2022-11-20)
  → 'github:Mic92/sops-nix/8295b8139ef7baadeb90c5cad7a40c4c9297ebf7' (2022-11-29)
• Updated input 'sops-nix/nixpkgs-22_05':
    'github:NixOS/nixpkgs/b68a6a27adb452879ab66c0eaac0c133e32823b2' (2022-11-20)
  → 'github:NixOS/nixpkgs/6649e08812f579581bfb4cada3ba01e30485c891' (2022-11-27)
```
2022-11-29 23:12:43 +00:00
5d1e8f5f60 servo: store media on external storage 2022-11-29 21:54:33 +00:00
ff9c26b03d servo: port to Ryzen/x86 machine 2022-11-29 02:20:18 +00:00
b9533d7ee3 packages: ship some tools useful for debugging boot/HW state 2022-11-29 02:18:56 +00:00
103f7b1b2c sane-stop-all-servo script: update for currently deployed services 2022-11-29 02:18:31 +00:00
16327fd323 nix patches: fix hashes 2022-11-29 02:18:05 +00:00
abcfa2dbea update phosh: phosh: 0.21.1 -> 0.22.0 2022-11-26 08:13:52 +00:00
27403fa36d zecwallet: move data to private dir 2022-11-24 17:47:34 +00:00
96b3ac26dd remove systemd HDD spindown patch
i haven't used this for several months. it doesn't seem to matter, and
maintaining custom systemd patches is very impractical.
2022-11-24 10:28:06 +00:00
1accf264cf browserpass-extension: update the PR which generalizes file extensions 2022-11-24 10:26:32 +00:00
3772a428da browserpass: apply PR feedback: <https://github.com/browserpass/browserpass-extension/pull/312> 2022-11-23 12:59:08 +00:00
a56f2008d3 fix 'nixserv' -> 'nixserve' typo 2022-11-23 04:09:58 +00:00
04ea55499a gocryptfs: don't cross build 2022-11-22 13:46:44 +00:00
59244fa50c flake update: nixpkgs 2022-11-09 -> 2022-11-21, others
```
• Updated input 'impermanence':
    'github:nix-community/impermanence/def994adbdfc28974e87b0e4c949e776207d5557' (2022-08-31)
  → 'github:nix-community/impermanence/5df9108b346f8a42021bf99e50de89c9caa251c3' (2022-11-17)
• Updated input 'mobile-nixos':
    'github:nixos/mobile-nixos/0b69b36c989d13f08c3bc563253f68c9d6ed7244' (2022-11-01)
  → 'github:nixos/mobile-nixos/25eec596116553112681d72ee4880107fc3957fa' (2022-11-19)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/872fceeed60ae6b7766cc0a4cd5bf5901b9098ec' (2022-11-09)
  → 'github:NixOS/nixpkgs/af50806f7c6ab40df3e6b239099e8f8385f6c78b' (2022-11-21)
• Updated input 'nixpkgs-stable':
    'github:NixOS/nixpkgs/fa842715565307b7e05cdb187b08c05f16ed08f1' (2022-11-09)
  → 'github:NixOS/nixpkgs/cf63ade6f74bbc9d2a017290f1b2e33e8fbfa70a' (2022-11-20)
• Updated input 'sops-nix':
    'github:Mic92/sops-nix/4407353739ad74a3d9744cf2988ab10f3b83e288' (2022-11-06)
  → 'github:Mic92/sops-nix/f72e050c3ef148b1131a0d2df55385c045e4166b' (2022-11-20)
• Updated input 'sops-nix/nixpkgs-22_05':
    'github:NixOS/nixpkgs/6440d13df2327d2db13d3b17e419784020b71d22' (2022-10-30)
  → 'github:NixOS/nixpkgs/b68a6a27adb452879ab66c0eaac0c133e32823b2' (2022-11-20)
```
2022-11-22 12:03:33 +00:00
c2a2b27002 servo: disable duplicity 2022-11-22 12:01:55 +00:00
7bd6015a9f browserpass: start pushing gpg-agnostic support upstream 2022-11-22 11:50:07 +00:00
2a010f7882 readme: update contact info, explain modules/ dir 2022-11-22 05:34:11 +00:00
b566910da0 home-manager: hide behind an enable flag 2022-11-22 05:28:41 +00:00
ca43811c16 remove sane.home-manager.extraPackages
replaced by sane.packages.extraUserPkgs
2022-11-22 05:11:02 +00:00
7284452aa5 re-enable some environment stuff that got lost during refactors 2022-11-22 04:51:03 +00:00
f772300d88 move system-packages into the main packages.nix file 2022-11-22 04:40:24 +00:00
eccb5ff3d6 rename home-packages -> packages 2022-11-22 04:31:55 +00:00
0c6b949a72 lift some more files out of modules -> hosts 2022-11-22 04:29:17 +00:00
9a6c83776d vpn: move out of modules/ 2022-11-22 03:46:25 +00:00
e408e77026 move secrets.nix out of modules 2022-11-22 03:37:57 +00:00
e0612ccfa8 move allocations out of universal
it doesn't cause any changes to the system
2022-11-22 03:35:11 +00:00
a0e85ff31b nixserve: remove the default sops path
it might make more sense to make this a runtime path (/run/secrets/...)
2022-11-22 03:20:50 +00:00
1d448a4114 migrate common settings from hosts/{instantiate -> common/default}.nix 2022-11-22 03:10:19 +00:00
ed52b5f251 nixcache: modularize 2022-11-22 03:07:11 +00:00
dc21b0d68c modularize image.nix image building 2022-11-22 03:02:41 +00:00
18ec4f9b4d browserpass-extension: update to latest tip
my PR got merged
2022-11-22 02:59:25 +00:00
84a17f4599 move hardware out of modules into hosts/common
i want for `modules/` to behave like a more typical `modules` directory,
where functionality is opt-in.
2022-11-22 02:52:07 +00:00
43fa7fdd9f rename machines -> hosts
- shorter.
- congruent with `nixos-rebuild .` choosing what to build based on `hostname`.
- more widely used within other nix repos i've seen.
- more accurate in the case that i migrate a host to a different
machine (which i plan to do with servo).
2022-11-22 02:33:47 +00:00
8fc6b05c07 duplicity: add script to restore from backup 2022-11-21 11:47:07 +00:00
439c7d9ef2 duplicity: add utility to list backup files 2022-11-21 11:31:51 +00:00
9633c4f012 packages: add kdenlive 2022-11-21 10:39:58 +00:00
b869617b09 duplicity: refactor and update files list 2022-11-21 10:39:52 +00:00
ce323ffcf9 servo: ejabberd: enable starttls on server-to-server protocol 2022-11-15 12:55:45 +00:00
ac153aecd3 servo: ejabberd: enable 2022-11-15 12:52:45 +00:00
353d97b661 servo: ejabberd: provide access to certs 2022-11-15 12:47:50 +00:00
1150ee4b50 servo: prosody: disable 2022-11-15 12:45:23 +00:00
9e51eafff0 servo: add libraspberrypi 2022-11-15 12:28:49 +00:00
afaa6343ab update nixpkgs: 2022-11-05 -> 2022-11-09
```
• Updated input 'home-manager':
    'github:nix-community/home-manager/87d55517f6f36aa1afbd7a4a064869d5a1d405b8' (2022-11-05)
  → 'github:nix-community/home-manager/6639e3a837fc5deb6f99554072789724997bc8e5' (2022-11-08)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/3bacde6273b09a21a8ccfba15586fb165078fb62' (2022-11-05)
  → 'github:NixOS/nixpkgs/872fceeed60ae6b7766cc0a4cd5bf5901b9098ec' (2022-11-09)
• Updated input 'nixpkgs-stable':
    'github:NixOS/nixpkgs/f09ad462c5a121d0239fde645aacb2221553a217' (2022-11-05)
  → 'github:NixOS/nixpkgs/fa842715565307b7e05cdb187b08c05f16ed08f1' (2022-11-09)
• Updated input 'sops-nix':
    'github:Mic92/sops-nix/486b4455da16272c1ed31bc82adcdbe7af829465' (2022-11-02)
  → 'github:Mic92/sops-nix/4407353739ad74a3d9744cf2988ab10f3b83e288' (2022-11-06)
```
2022-11-15 10:04:25 +00:00
67dff6069c sane-rcp: do incremental syncs (append mode) 2022-11-15 09:46:11 +00:00
dea7ca9474 new script to locate dotfiles easier 2022-11-13 01:05:06 +00:00
ad7ae94501 home: ship dino XMPP client 2022-11-12 10:18:13 +00:00
1a0bd16b44 servo: enable prosody XMPP server 2022-11-12 10:02:06 +00:00
56f89bb3f7 servo: ejabberd: configure, but then disable because broken 2022-11-12 01:43:14 +00:00
92a67253c3 servo: lay the skeleton files for a XMPP (jabber) server 2022-11-11 12:56:09 +00:00
8d0ded0ea1 postgresql: leave some notes about future optimization opportunities 2022-11-11 10:58:57 +00:00
de820e32b7 servo: pleroma: remove unneeded prepare: :named config
doing this should increase perf
2022-11-11 10:58:29 +00:00
be286cd190 servo: nginx: enable gzip and TLS optimizations 2022-11-11 10:57:57 +00:00
7cacbd9580 goaccess: optimization only refresh stats once per 30s 2022-11-11 10:56:54 +00:00
c84f10e060 freshrss: update feeds less frequently
Freshrss is throwing some error in the logs... but it still looks to
*kinda* work? ugh.
2022-11-11 08:48:48 +00:00
fd8f660ee0 feeds: add Jeff Kaufman 2022-11-11 07:50:42 +00:00
205b6a9afb nginx: forceSSL for git and fedi 2022-11-08 13:28:41 +00:00
6b7a544df3 lightdm-mobile-greeter: update button styling 2022-11-08 10:42:08 +00:00
c3eacf7126 unpin electrum, sequoia
they build now
2022-11-08 09:08:51 +00:00
3b6f638f98 lightdm-mobile-greeter: update interface.ui 2022-11-08 09:08:39 +00:00
6057a2e665 lightdm-mobile-greeter: update libhandy dependency 2022-11-07 23:36:18 -08:00
f45b032e48 home: add plasmatube (though it might not be working well) 2022-11-08 05:34:02 +00:00
1c810dc1b8 time: switch to UTC
Daylight Savings Time is too confusing for me.
2022-11-08 02:35:50 +00:00
fdd9833b01 lightdm-mobile-greeter: update upstream (minor description change) 2022-11-07 06:32:04 -08:00
25854d3135 lightdm-mobile-greeter: update upstream 2022-11-07 05:25:25 -08:00
45f8cc3894 browserpass-native: update enableOTP PR fix 2022-11-07 04:39:16 -08:00
fc4138327a home-packaged: add rsync 2022-11-06 20:53:22 -08:00
889c47e884 link debug symbols into /run/current-system/sw/lib/debug 2022-11-06 19:25:50 -08:00
f6f500c592 fs: hopefully fix /mnt/servo-root by linking sftp-server at the remote endpoint 2022-11-06 18:54:22 -08:00
6fa9fb740a servo: update rpi linux to fix build 2022-11-06 17:12:22 -08:00
10a665d11c add a servo-cross target
though it looks like rpi4 linux actually fails to cross-compile due to
some RMW page error
2022-11-06 06:04:54 -08:00
77baf03496 Revert "servo: don't ship custom linux kernel packages anymore"
This reverts commit 12b5e68b25.
2022-11-06 05:27:04 -08:00
26f920e119 disable default environment packages 2022-11-06 05:22:16 -08:00
88fba6f496 document --substituters nix options 2022-11-06 03:47:10 -08:00
9f43444f0c ipfs: migrate settings
did not explicitly test these
2022-11-06 03:32:35 -08:00
b68fd881e4 servo: import an element-web patch which allows configuring it without rebuilding 2022-11-06 03:32:35 -08:00
5cca6ede0d emote: fix persistence dir 2022-11-06 02:30:53 -08:00
3b4e394ce8 flake update nixpkgs: 2022-11-03 -> 2022-11-05, home-manager
```
• Updated input 'home-manager':
    'github:nix-community/home-manager/d78b3488a76d251701ab58a9b7f0dd092b806c1e' (2022-11-03)
  → 'github:nix-community/home-manager/87d55517f6f36aa1afbd7a4a064869d5a1d405b8' (2022-11-05)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/a2a777538d971c6b01c6e54af89ddd6567c055e8' (2022-11-03)
  → 'github:NixOS/nixpkgs/3bacde6273b09a21a8ccfba15586fb165078fb62' (2022-11-05)
• Updated input 'nixpkgs-stable':
    'github:NixOS/nixpkgs/1404483f4531560aad73bdebae4096881c910ac0' (2022-11-04)
  → 'github:NixOS/nixpkgs/f09ad462c5a121d0239fde645aacb2221553a217' (2022-11-05)
```
2022-11-06 02:20:04 -08:00
d9b3fccdfa persist emote dir 2022-11-06 02:07:32 -08:00
94366d4bf6 browserpass: patch to support OTP codes better 2022-11-06 02:00:41 -08:00
12b5e68b25 servo: don't ship custom linux kernel packages anymore
it's probably not necessary. i confirmed the kernel provides rpi400 dtb
by default.
2022-11-05 22:29:20 -07:00
a0d332766a nixcache: always trust my own caches, even if not enabled by default 2022-11-05 20:13:17 -07:00
cdd9672654 libreoffice: disable first-run dialog 2022-11-05 17:24:19 -07:00
887a431956 podcasts: add The Verge - Decoder 2022-11-05 06:16:20 -07:00
502ebafb0a update: nixpkgs 2022-11-05 05:42:11 -07:00
57ada6af4f tokodon: fix segfault on launch
also persist the ~/.cache/KDE/tokodon directory.
since the login form isn't working yet (partially the fault of my
Pleroma install?), i can't tell if this is where tokens are stashed or
not.
2022-11-04 06:52:18 -07:00
d1d64b7376 import and update Tokodon package from <https://github.com/NixOS/nixpkgs/pull/170466>
this hangs and then segfaults at start. i suppose i should `gdb` it.
2022-11-03 22:23:14 -07:00
f2188be9f2 flake update: nixpkgs 2022-10-31 -> 2022-11-02, home-manager, sops, mobile-nixos
```
• Updated input 'home-manager':
    'github:nix-community/home-manager/f0ecd4b1db5e15103e955b18cb94bea4296e5c45' (2022-11-01)
  → 'github:nix-community/home-manager/d78b3488a76d251701ab58a9b7f0dd092b806c1e' (2022-11-03)
• Updated input 'mobile-nixos':
    'github:nixos/mobile-nixos/da56c338a2b00c868697b75bdbd388f60d50c820' (2022-10-30)
  → 'github:nixos/mobile-nixos/0b69b36c989d13f08c3bc563253f68c9d6ed7244' (2022-11-01)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/d40fea9aeb8840fea0d377baa4b38e39b9582458' (2022-10-31)
  → 'github:NixOS/nixpkgs/636051e353461f073ac55d5d42c1ed062a345046' (2022-11-02)
• Updated input 'nixpkgs-stable':
    'github:NixOS/nixpkgs/1b4722674c315de0e191d0d79790b4eac51570a1' (2022-10-31)
  → 'github:NixOS/nixpkgs/b3a8f7ed267e0a7ed100eb7d716c9137ff120fe3' (2022-11-01)
• Updated input 'sops-nix':
    'github:Mic92/sops-nix/448ec3e7eb7c7e4563cc2471db748a71baaf9698' (2022-10-30)
  → 'github:Mic92/sops-nix/486b4455da16272c1ed31bc82adcdbe7af829465' (2022-11-02)
```
2022-11-03 17:31:47 -07:00
6d52c0e8ab new option: sane.gui.plasma.enable to enable desktop KDE plasma
this is useful for testing applications which are designed for KDE
first.
2022-11-03 03:09:14 -07:00
14b334ff55 new script: sane-reboot, to prevent me from rebooting the wrong machine when working with multiple hosts 2022-11-03 01:27:56 -07:00
730fa8ba4b moby: fix lightdm-mobile-greeter config to work again 2022-11-02 04:59:36 -07:00
8817f661ac browser: temporarily switch back to firefox
recompiling librewolf is not practical -- until the addon signing is
upstreamed
2022-11-02 04:21:55 -07:00
3b0f505864 moby: move lightdm-mobile-greeter stuff into nixpkgs 2022-11-02 04:14:00 -07:00
b559d334c3 librewolf: work toward upstreaming the MOZ_REQUIRE_SIGNING patch 2022-11-02 02:39:56 -07:00
f6e4c0058c add mercurial to dev packages 2022-11-01 22:20:05 -07:00
775fc979fc browser: fix Extensions.Uninstall + refactor nits 2022-11-01 19:29:33 -07:00
ad6daa4e5b librewolf: allow sideloading unsigned addons
still defaulting to firefox, because this requires a recompilation of
the browser -- particularly expensive for moby.
2022-11-01 19:17:49 -07:00
3ecfea158a browser: make more easily swappable between firefox and librewolf 2022-11-01 16:23:50 -07:00
5ff47b3719 remove unused rycee flake input
it was previously used for browser addons: i've since moved those
in-house for technical reasons.
2022-11-01 16:07:57 -07:00
03ea7e7fa5 flake update: nixpkgs 2022-10-30 -> 2022-10-31 and stable home-manager
```
• Updated input 'home-manager':
    'github:nix-community/home-manager/d8b233ad03dd3d82424561512b40971569b2e5d2' (2022-10-31)
  → 'github:nix-community/home-manager/f0ecd4b1db5e15103e955b18cb94bea4296e5c45' (2022-11-01)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/412b9917cea092f3d39f9cd5dead4effd5bc4053' (2022-10-30)
  → 'github:NixOS/nixpkgs/d40fea9aeb8840fea0d377baa4b38e39b9582458' (2022-10-31)
• Updated input 'nixpkgs-stable':
    'github:NixOS/nixpkgs/26eb67abc9a7370a51fcb86ece18eaf19ae9207f' (2022-10-30)
  → 'github:NixOS/nixpkgs/1b4722674c315de0e191d0d79790b4eac51570a1' (2022-10-31)
```
2022-11-01 05:09:04 -07:00
ca93518dda browser: switch from librewolf to firefox-esr
librewolf doesn't allow unsigned addons. i believe this is a bug, as the
nixpkg build file looks like it *meant* to allow addons (and maybe at
some point did)
2022-11-01 04:58:45 -07:00
7f7041351b browserpass-extension: init at 3.7.2
bringing this in-tree instead of fetching it from the mozilla addons
webpage because i plan to develop on it.
2022-11-01 04:57:34 -07:00
1c62bcd50c lightdm-mobile-greeter: update git rev & remove the Cargo.lock patch
Raatty was kind enough to upstream the Cargo.lock fix.
2022-11-01 01:15:36 -07:00
bad4fe0e76 browserpass: add support for totp, and auto-unlock the secrets store on first run
note that one needs to manually enable the TOTP setting in the
browserpass settings for this to work -- TOTP parsing is disabled by
default
2022-10-31 23:57:47 -07:00
8b473ff88f neovim: fix python tree-sitter plugin
which was otherwise yielding parsing errors.
2022-10-31 23:05:27 -07:00
ad54b9c5fb flake update: rycee: 2022-10-29 -> 2022-11-01
```
• Updated input 'rycee':
    'gitlab:rycee/nur-expressions/5fb3c4733c00a7e7be69877d057f6760d85cecb8' (2022-10-29)
  → 'gitlab:rycee/nur-expressions/f4bf327807f86c85e85050101467835a65754b51' (2022-11-01)
```
2022-10-31 23:04:39 -07:00
b805a101ba flake update: nixpkgs 2022-10-29 -> 2022-10-30; home-manager
wouldn't ordinarily update so regularly, but on the lookout for that
openssl CVE...

```
• Updated input 'home-manager':
    'github:nix-community/home-manager/b81e128fc053ab3159d7b464d9b7dedc9d6a6891' (2022-10-17)
  → 'github:nix-community/home-manager/d8b233ad03dd3d82424561512b40971569b2e5d2' (2022-10-31)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/fdebb81f45a1ba2c4afca5fd9f526e1653ad0949' (2022-10-29)
  → 'github:NixOS/nixpkgs/412b9917cea092f3d39f9cd5dead4effd5bc4053' (2022-10-30)
```
2022-10-31 20:54:11 -07:00
69a3aaa086 new script: sane-private-lock
this is handy esp for `servo`, where i don't want my keys to be
accessible after i logout.

longterm, i suppose i could run this automatically on session close
(pam-umount or something i think exists for that?)
2022-10-31 04:21:25 -07:00
9acf2dfde1 gocryptfs: cross-compile for aarch64 2022-10-31 03:05:24 -07:00
4b5accac88 flake update: nixpkgs: 2022-10-22 -> 2022-10-29 and others
```
• Updated input 'mobile-nixos':
    'github:nixos/mobile-nixos/1351091d2537040454fa232d8b94e745ab0eb5a3' (2022-10-24)
  → 'github:nixos/mobile-nixos/da56c338a2b00c868697b75bdbd388f60d50c820' (2022-10-30)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/95aeaf83c247b8f5aa561684317ecd860476fcd6' (2022-10-22)
  → 'github:NixOS/nixpkgs/fdebb81f45a1ba2c4afca5fd9f526e1653ad0949' (2022-10-29)
• Updated input 'nixpkgs-stable':
    'github:NixOS/nixpkgs/3933d8bb9120573c0d8d49dc5e890cb211681490' (2022-10-22)
  → 'github:NixOS/nixpkgs/26eb67abc9a7370a51fcb86ece18eaf19ae9207f' (2022-10-30)
• Updated input 'rycee':
    'gitlab:rycee/nur-expressions/43d3a363c126968db46585b88b8eb97dd32634ad' (2022-10-27)
  → 'gitlab:rycee/nur-expressions/5fb3c4733c00a7e7be69877d057f6760d85cecb8' (2022-10-29)
• Updated input 'sops-nix':
    'github:Mic92/sops-nix/1b5f9512a265f0c9687dbff47893180f777f4809' (2022-10-23)
  → 'github:Mic92/sops-nix/448ec3e7eb7c7e4563cc2471db748a71baaf9698' (2022-10-30)
• Updated input 'sops-nix/nixpkgs-22_05':
    'github:NixOS/nixpkgs/f9115594149ebcb409a42e303bec4956814a8419' (2022-10-23)
  → 'github:NixOS/nixpkgs/6440d13df2327d2db13d3b17e419784020b71d22' (2022-10-30)
• Updated input 'uninsane':
    'git+https://git.uninsane.org/colin/uninsane?ref=refs%2fheads%2fmaster&rev=4ad1801f6cecd678bbeae5dfe5933448dd7b3360' (2022-10-14)
  → 'git+https://git.uninsane.org/colin/uninsane?ref=refs%2fheads%2fmaster&rev=80c6ec95bd430e29d231cf745f19279bb76fb382' (2022-10-27)
```
2022-10-30 23:47:29 -07:00
cb00ae4f92 update nautilus gtk4 patch SHA
it's been merged into nixpkgs; manual patch will likely go away after
next nixpkgs update
2022-10-30 21:33:58 -07:00
7c38c1dbe9 de-persist /etc/machine-id, and generate it from the ssh key instead
note that /etc/machine-id now contains a different value than before,
meaning `journalctl` will not show logs from before the time of this
change.
2022-10-30 21:02:41 -07:00
b3b45ec0f2 fix host ssh key persistence 2022-10-30 20:03:00 -07:00
34d77542e7 impermanence: ensure /etc/ssh is populated before we decode machine secrets during activation
the impermanence activation scripts don't appear to mount folders --
only files. rather, the impermanence module creates fstab entries for
each bind mount folder, and *something* (systemd?) mounts these *after*
/run/current-system/activate is run.

therefore, if we want access to a bind-mounted directory during
activateion, we have to manually mount it.
i.e. `mount /etc/ssh/host_keys`.
2022-10-30 05:59:55 -07:00
6236c14def vendor librewolf addons instead of fetching them on first run
this obviously speeds up startup, it's hopefully also less likely to
break surprisingly, and i hope it's the path to me shipping forks of
official extensions.
2022-10-27 03:20:29 -07:00
0c0f8c44bd Merge branch 'master' of git.uninsane.org:colin/nix-files 2022-10-26 07:18:41 -07:00
7f97786a88 librewolf: use browserpass password store
this is working -- forked to support sops as a backend --
without totp support yet. it's possible in theory: i might just need to
write some adapter logic.

upstream discussion about genericizing backend support:
- <https://github.com/browserpass/browserpass-native/issues/127>
2022-10-26 07:13:55 -07:00
db2e156f15 home: enable celluloid mpv frontend
i want to test this on mobile
2022-10-26 05:31:11 -07:00
43efec495e librewolf: integrate with gopass
it's able to list passwords, but not decrypt them:
i think i can solve this on the store side?
2022-10-26 00:10:54 -07:00
279f9ce614 lightdm-mobile-greeter: point directly to upstream, with a patch for their Cargo.lock 2022-10-25 22:05:49 -07:00
7d02652e08 servo: freshrss: fix ExecStart path 2022-10-25 06:31:18 -07:00
10e224be0d ssh: set known hosts via ~/.ssh/config
this prevents the ssh agent from updating the known_hosts file
and confusing home-manager.
2022-10-25 05:17:28 -07:00
e25c92794f refactor: split ssh settings out of home-manager/default.nix 2022-10-25 05:06:33 -07:00
a8d2b7196d statically populate ssh known_hosts 2022-10-25 05:01:32 -07:00
a6cbecbc74 Merge branch 'staging/pleroma-update' 2022-10-25 04:18:25 -07:00
518d2f60c0 pleroma: port ExifTool config
the old path is deprecated, if my syslog is to be believed.
2022-10-25 04:11:47 -07:00
c44cad9c16 fractal: persist data in ~/private 2022-10-25 02:12:55 -07:00
e3bf585382 persist ssh host keys in a subdirectory 2022-10-25 02:09:27 -07:00
1fea9618ba zsh: remove rm and mv confirmations 2022-10-25 01:42:46 -07:00
8d89f828b6 new sane script: sane-rcp
i guess this could just be an alias? 🤷
2022-10-25 01:19:05 -07:00
323 changed files with 13653 additions and 5691 deletions

131
flake.lock generated
View File

@@ -15,50 +15,14 @@
"type": "github"
}
},
"home-manager": {
"inputs": {
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1665996265,
"narHash": "sha256-/k9og6LDBQwT+f/tJ5ClcWiUl8kCX5m6ognhsAxOiCY=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "b81e128fc053ab3159d7b464d9b7dedc9d6a6891",
"type": "github"
},
"original": {
"owner": "nix-community",
"ref": "release-22.05",
"repo": "home-manager",
"type": "github"
}
},
"impermanence": {
"locked": {
"lastModified": 1661933071,
"narHash": "sha256-RFgfzldpbCvS+H2qwH+EvNejvqs+NhPVD5j1I7HQQPY=",
"owner": "nix-community",
"repo": "impermanence",
"rev": "def994adbdfc28974e87b0e4c949e776207d5557",
"type": "github"
},
"original": {
"owner": "nix-community",
"repo": "impermanence",
"type": "github"
}
},
"mobile-nixos": {
"flake": false,
"locked": {
"lastModified": 1666573922,
"narHash": "sha256-CqB8Y5HajptSFE8Em990dcYZIHJWBiO9zd1us4Mzx8M=",
"lastModified": 1674880620,
"narHash": "sha256-JMALuC7xcoH/T66sKTVLuItHfOJBCWsNKpE49Qrvs80=",
"owner": "nixos",
"repo": "mobile-nixos",
"rev": "1351091d2537040454fa232d8b94e745ab0eb5a3",
"rev": "7478a9ffad737486951186b66f6c5535dc5802e2",
"type": "github"
},
"original": {
@@ -68,60 +32,61 @@
}
},
"nixpkgs": {
"inputs": {
"nixpkgs": [
"nixpkgs-unpatched"
]
},
"locked": {
"lastModified": 1666447894,
"narHash": "sha256-i9WHX4w/et4qPMzEXd9POmnO0/bthjr7R4cblKNHGms=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "95aeaf83c247b8f5aa561684317ecd860476fcd6",
"type": "github"
"lastModified": 1,
"narHash": "sha256-rkVbviFmYYmbbVfvFRtOM95IjETbNu3I517Hrxp8EF4=",
"path": "/nix/store/8azr0ivnzf0y1sh2r7alxaxab3w49ggx-source/nixpatches",
"type": "path"
},
"original": {
"id": "nixpkgs",
"ref": "nixos-unstable",
"type": "indirect"
}
},
"nixpkgs-22_05": {
"locked": {
"lastModified": 1666488099,
"narHash": "sha256-DANs2epN5QgvxWzH7xF3dzb4WE0lEuMLrMEu/vPmQxw=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "f9115594149ebcb409a42e303bec4956814a8419",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "release-22.05",
"repo": "nixpkgs",
"type": "github"
"path": "/nix/store/8azr0ivnzf0y1sh2r7alxaxab3w49ggx-source/nixpatches",
"type": "path"
}
},
"nixpkgs-stable": {
"locked": {
"lastModified": 1666401273,
"narHash": "sha256-AG3MoIjcWwz1SPjJ2nymWu4NmeVj9P40OpB1lsmxFtg=",
"lastModified": 1675265860,
"narHash": "sha256-PZNqc4ZnTRT34NsHJYbXn+Yhghh56l8HEXn39SMpGNc=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "3933d8bb9120573c0d8d49dc5e890cb211681490",
"rev": "a3a1400571e3b9ccc270c2e8d36194cf05aab6ce",
"type": "github"
},
"original": {
"id": "nixpkgs",
"ref": "nixos-22.05",
"type": "indirect"
"owner": "NixOS",
"ref": "release-22.11",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs-unpatched": {
"locked": {
"lastModified": 1675273418,
"narHash": "sha256-tpYc4TEGvDzh9uRf44QemyQ4TpVuUbxb07b2P99XDbM=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "4d7c2644dbac9cf8282c0afe68fca8f0f3e7b2db",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"root": {
"inputs": {
"home-manager": "home-manager",
"impermanence": "impermanence",
"mobile-nixos": "mobile-nixos",
"nixpkgs": "nixpkgs",
"nixpkgs-stable": "nixpkgs-stable",
"nixpkgs-unpatched": "nixpkgs-unpatched",
"sops-nix": "sops-nix",
"uninsane": "uninsane"
"uninsane-dot-org": "uninsane-dot-org"
}
},
"sops-nix": {
@@ -129,14 +94,14 @@
"nixpkgs": [
"nixpkgs"
],
"nixpkgs-22_05": "nixpkgs-22_05"
"nixpkgs-stable": "nixpkgs-stable"
},
"locked": {
"lastModified": 1666499473,
"narHash": "sha256-q1eFnBFL0kHgcnUPeKagw3BfbE/5sMJNGL2E2AR+a2M=",
"lastModified": 1675288837,
"narHash": "sha256-76s8TLENa4PzWDeuIpEF78gqeUrXi6rEJJaKEAaJsXw=",
"owner": "Mic92",
"repo": "sops-nix",
"rev": "1b5f9512a265f0c9687dbff47893180f777f4809",
"rev": "a81ce6c961480b3b93498507074000c589bd9d60",
"type": "github"
},
"original": {
@@ -145,7 +110,7 @@
"type": "github"
}
},
"uninsane": {
"uninsane-dot-org": {
"inputs": {
"flake-utils": "flake-utils",
"nixpkgs": [
@@ -153,11 +118,11 @@
]
},
"locked": {
"lastModified": 1665758541,
"narHash": "sha256-ibR8bPwHlDjavri5cNVnoo5FmFk1IfNMmQXxat5biqs=",
"lastModified": 1675131883,
"narHash": "sha256-yBgJDG72YqIr1bltasqHD1E/kHc9uRFgDjxDmy6kI8M=",
"ref": "refs/heads/master",
"rev": "4ad1801f6cecd678bbeae5dfe5933448dd7b3360",
"revCount": 163,
"rev": "b099c24091cc192abf3997b94342d4b31cc5757b",
"revCount": 170,
"type": "git",
"url": "https://git.uninsane.org/colin/uninsane"
},

240
flake.nix
View File

@@ -1,77 +1,104 @@
# docs:
# - <https://nixos.wiki/wiki/Flakes>
# FLAKE FEEDBACK:
# - if flake inputs are meant to be human-readable, a human should be able to easily track them down given the URL.
# - this is not the case with registry URLs, like `nixpkgs/nixos-22.11`.
# - this is marginally the case with schemes like `github:nixos/nixpkgs`.
# - given the *existing* `git+https://` scheme, i propose expressing github URLs similarly:
# - `github+https://github.com/nixos/nixpkgs/tree/nixos-22.11`
# - need some way to apply local patches to inputs.
#
#
# DEVELOPMENT DOCS:
# - Flake docs: <https://nixos.wiki/wiki/Flakes>
# - Flake RFC: <https://github.com/tweag/rfcs/blob/flakes/rfcs/0049-flakes.md>
# - Discussion: <https://github.com/NixOS/rfcs/pull/49>
# - <https://serokell.io/blog/practical-nix-flakes>
{
# XXX: use the `github:` scheme instead of the more readable git+https: because it's *way* more efficient
# preferably, i would rewrite the human-readable https URLs to nix-specific github: URLs with a helper,
# but `inputs` is required to be a strict attrset: not an expression.
inputs = {
nixpkgs-stable.url = "nixpkgs/nixos-22.05";
nixpkgs.url = "nixpkgs/nixos-unstable";
# <https://github.com/nixos/nixpkgs/tree/nixos-22.11>
# nixpkgs-stable.url = "github:nixos/nixpkgs?ref=nixos-22.11";
# <https://github.com/nixos/nixpkgs/tree/nixos-unstable>
nixpkgs-unpatched.url = "github:nixos/nixpkgs?ref=nixos-unstable";
nixpkgs = {
url = "./nixpatches";
inputs.nixpkgs.follows = "nixpkgs-unpatched";
};
mobile-nixos = {
# <https://github.com/nixos/mobile-nixos>
url = "github:nixos/mobile-nixos";
flake = false;
};
home-manager = {
url = "github:nix-community/home-manager/release-22.05";
inputs.nixpkgs.follows = "nixpkgs";
};
sops-nix = {
# <https://github.com/Mic92/sops-nix>
url = "github:Mic92/sops-nix";
inputs.nixpkgs.follows = "nixpkgs";
};
impermanence.url = "github:nix-community/impermanence";
uninsane = {
uninsane-dot-org = {
url = "git+https://git.uninsane.org/colin/uninsane";
inputs.nixpkgs.follows = "nixpkgs";
};
};
outputs = { self, nixpkgs, nixpkgs-stable, mobile-nixos, home-manager, sops-nix, impermanence, uninsane }:
let
patchedPkgs = system: nixpkgs.legacyPackages.${system}.applyPatches {
name = "nixpkgs-patched-uninsane";
src = nixpkgs;
patches = import ./nixpatches/list.nix nixpkgs.legacyPackages.${system}.fetchpatch;
};
# return something which behaves like `pkgs`, for the provided system
# `local` = architecture of builder. `target` = architecture of the system beying deployed to
nixpkgsFor = local: target: import (patchedPkgs target) { crossSystem = target; localSystem = local; };
# evaluate ONLY our overlay, for the provided system
customPackagesFor = local: target: import ./pkgs/overlay.nix (nixpkgsFor local target) (nixpkgsFor local target);
decl-machine = { name, local, target }:
outputs = {
self,
nixpkgs,
nixpkgs-unpatched,
mobile-nixos,
sops-nix,
uninsane-dot-org,
...
}@inputs:
let
nixosSystem = import ((patchedPkgs target) + "/nixos/lib/eval-config.nix");
in (nixosSystem {
# by default the local system is the same as the target, employing emulation when they differ
system = target;
specialArgs = { inherit mobile-nixos home-manager impermanence; };
modules = [
./modules
(import ./machines/instantiate.nix name)
home-manager.nixosModule
impermanence.nixosModule
sops-nix.nixosModules.sops
{
nixpkgs.overlays = [
(import "${mobile-nixos}/overlay/overlay.nix")
uninsane.overlay
(import ./pkgs/overlay.nix)
(next: prev: rec {
# non-emulated packages build *from* local *for* target.
# for large packages like the linux kernel which are expensive to build under emulation,
# the config can explicitly pull such packages from `pkgs.cross` to do more efficient cross-compilation.
cross = (nixpkgsFor local target) // (customPackagesFor local target);
stable = import nixpkgs-stable { system = target; };
# pinned packages:
electrum = stable.electrum; # 2022-10-10: build break
sequoia = stable.sequoia; # 2022-10-13: build break
})
];
}
];
});
nixpkgsCompiledBy = local: nixpkgs.legacyPackages."${local}";
decl-bootable-machine = { name, local, target }: rec {
nixosConfiguration = decl-machine { inherit name local target; };
evalHost = { name, local, target }:
let
# XXX: we'd prefer to use `nixosSystem = (nixpkgsCompiledBy target).nixos`
# but it doesn't propagate config to the underlying pkgs, meaning it doesn't let you use
# non-free packages even after setting nixpkgs.allowUnfree.
# XXX: patch using the target -- not local -- otherwise the target will
# need to emulate the host in order to rebuild!
nixosSystem = import ((nixpkgsCompiledBy target).path + "/nixos/lib/eval-config.nix");
in
(nixosSystem {
# we use pkgs built for and *by* the target, i.e. emulation, by default.
# cross compilation only happens on explicit access to `pkgs.cross`
system = target;
modules = [
(import ./hosts/instantiate.nix { localSystem = local; hostName = name; })
self.nixosModules.default
self.nixosModules.passthru
{
nixpkgs.overlays = [
self.overlays.default
self.overlays.passthru
self.overlays.pins
];
# nixpkgs.crossSystem = target;
nixpkgs.hostPlatform = target;
nixpkgs.buildPlatform = local;
}
];
});
in {
nixosConfigurations = {
servo = evalHost { name = "servo"; local = "x86_64-linux"; target = "x86_64-linux"; };
desko = evalHost { name = "desko"; local = "x86_64-linux"; target = "x86_64-linux"; };
lappy = evalHost { name = "lappy"; local = "x86_64-linux"; target = "x86_64-linux"; };
moby = evalHost { name = "moby"; local = "aarch64-linux"; target = "aarch64-linux"; };
# special cross-compiled variant, to speed up deploys from an x86 box to the arm target
# note that these *do* produce different store paths, because the closure for the tools used to cross compile
# v.s. emulate differ.
# so deploying foo-cross and then foo incurs some rebuilding.
moby-cross = evalHost { name = "moby"; local = "x86_64-linux"; target = "aarch64-linux"; };
rescue = evalHost { name = "rescue"; local = "x86_64-linux"; target = "x86_64-linux"; };
};
# unofficial output
# this produces a EFI-bootable .img file (GPT with a /boot partition and a system (/ or /nix) partition).
# after building this:
# - flash it to a bootable medium (SD card, flash drive, HDD)
@@ -84,37 +111,82 @@
# - boot
# - if fs wasn't resized automatically, then `sudo btrfs filesystem resize max /`
# - checkout this flake into /etc/nixos AND UPDATE THE FS UUIDS.
# - `nixos-rebuild --flake './#<machine>' switch`
img = nixosConfiguration.config.system.build.img;
};
machines.servo = decl-bootable-machine { name = "servo"; local = "aarch64-linux"; target = "aarch64-linux"; };
machines.desko = decl-bootable-machine { name = "desko"; local = "x86_64-linux"; target = "x86_64-linux"; };
machines.lappy = decl-bootable-machine { name = "lappy"; local = "x86_64-linux"; target = "x86_64-linux"; };
machines.moby = decl-bootable-machine { name = "moby"; local = "aarch64-linux"; target = "aarch64-linux"; };
# special cross-compiled variant, to speed up deploys from an x86 box to the arm target
# note that these *do* produce different store paths, because the closure for the tools used to cross compile
# v.s. emulate differ.
# so deploying moby-cross and then moby incurs some rebuilding.
machines.moby-cross = decl-bootable-machine { name = "moby"; local = "x86_64-linux"; target = "aarch64-linux"; };
machines.rescue = decl-bootable-machine { name = "rescue"; local = "x86_64-linux"; target = "x86_64-linux"; };
in {
nixosConfigurations = builtins.mapAttrs (name: value: value.nixosConfiguration) machines;
imgs = builtins.mapAttrs (name: value: value.img) machines;
packages = let
custom-x86_64 = customPackagesFor "x86_64-linux" "x86_64-linux";
custom-aarch64 = customPackagesFor "aarch64-linux" "aarch64-linux";
nixpkgs-x86_64 = nixpkgsFor "x86_64-linux" "x86_64-linux";
nixpkgs-aarch64 = nixpkgsFor "aarch64-linux" "aarch64-linux";
in {
x86_64-linux = custom-x86_64 // {
nixpkgs = nixpkgs-x86_64;
uninsane = uninsane.packages.x86_64-linux;
# - `nixos-rebuild --flake './#<host>' switch`
imgs = builtins.mapAttrs (_: host-dfn: host-dfn.config.system.build.img) self.nixosConfigurations;
host-pkgs = builtins.mapAttrs (_: host-dfn: host-dfn.config.system.build.pkgs) self.nixosConfigurations;
overlays = rec {
default = pkgs;
pkgs = import ./overlays/pkgs.nix;
pins = import ./overlays/pins.nix; # TODO: move to `nixpatches/` input
passthru =
let
stable =
if inputs ? "nixpkgs-stable" then (
next: prev: {
stable = inputs.nixpkgs-stable.legacyPackages."${prev.stdenv.hostPlatform.system}";
}
) else (next: prev: {});
mobile = (import "${mobile-nixos}/overlay/overlay.nix");
uninsane = uninsane-dot-org.overlay;
in
next: prev:
(stable next prev) // (mobile next prev) // (uninsane next prev);
};
aarch64-linux = custom-aarch64 // {
nixpkgs = nixpkgs-aarch64;
uninsane = uninsane.packages.aarch64-linux;
nixosModules = rec {
default = sane;
sane = import ./modules;
passthru = { ... }: {
imports = [
sops-nix.nixosModules.sops
];
};
};
# this includes both our native packages and all the nixpkgs packages.
legacyPackages =
let
allPkgsFor = sys: (nixpkgsCompiledBy sys).appendOverlays [
self.overlays.passthru self.overlays.pkgs
];
in {
x86_64-linux = allPkgsFor "x86_64-linux";
aarch64-linux = allPkgsFor "aarch64-linux";
};
# extract only our own packages from the full set
packages = builtins.mapAttrs
(_: full: full.sane // { inherit (full) sane uninsane-dot-org; })
self.legacyPackages;
apps."x86_64-linux" =
let
pkgs = self.legacyPackages."x86_64-linux";
in {
update-feeds = {
type = "app";
program = "${pkgs.feeds.passthru.updateScript}";
};
init-feed = {
# use like `nix run '.#init-feed' uninsane.org`
type = "app";
program = "${pkgs.feeds.passthru.initFeedScript}";
};
};
templates = {
python-data = {
# initialize with:
# - `nix flake init -t '/home/colin/dev/nixos/#python-data'`
# then enter with:
# - `nix develop`
path = ./templates/python-data;
description = "python environment for data processing";
};
};
};
};
}

View File

@@ -4,25 +4,32 @@
./fs.nix
];
sane.gui.sway.enable = true;
sane.roles.client = true;
sane.services.wg-home.enable = true;
sane.services.wg-home.ip = config.sane.hosts.by-name."desko".wg-home.ip;
sane.services.duplicity.enable = true;
sane.services.nixserve.enable = true;
sane.services.nixserve.sopsFile = ../../secrets/desko.yaml;
sane.impermanence.enable = true;
sane.services.nixserve.sopsFile = ../../../secrets/desko.yaml;
sane.persist.enable = true;
sane.gui.sway.enable = true;
sane.programs.guiApps.suggestedPrograms = [ "desktopGuiApps" ];
boot.loader.efi.canTouchEfiVariables = false;
sane.image.extraBootFiles = [ pkgs.bootpart-uefi-x86_64 ];
# needed to use libimobiledevice/ifuse, for iphone sync
services.usbmuxd.enable = true;
users.users.usbmux.uid = config.sane.allocations.usbmux-uid;
users.groups.usbmux.gid = config.sane.allocations.usbmux-gid;
sops.secrets.colin-passwd = {
sopsFile = ../../secrets/desko.yaml;
sopsFile = ../../../secrets/desko.yaml;
neededForUsers = true;
};
# don't enable wifi by default: it messes with connectivity.
systemd.services.iwd.enable = false;
# default config: https://man.archlinux.org/man/snapper-configs.5
# defaults to something like:
# - hourly snapshots
@@ -38,7 +45,7 @@
};
sops.secrets.duplicity_passphrase = {
sopsFile = ../../secrets/desko.yaml;
sopsFile = ../../../secrets/desko.yaml;
};
programs.steam = {
@@ -47,7 +54,7 @@
remotePlay.openFirewall = true; # Open ports in the firewall for Steam Remote Play
dedicatedServer.openFirewall = true; # Open ports in the firewall for Source Dedicated Server
};
sane.impermanence.home-dirs = [
sane.user.persist.plaintext = [
".steam"
".local/share/Steam"
];

View File

@@ -1,16 +1,7 @@
{ ... }:
{
# root is a tmpfs so that we have an ephemeral system ("impermanence" handles the state)
fileSystems."/" = {
device = "none";
fsType = "tmpfs";
options = [
"mode=755"
"size=1G"
"defaults"
];
};
sane.persist.root-on-tmpfs = true;
# we need a /tmp for building large nix things.
# a cross-compiled kernel, particularly, will easily use 30+GB of tmp
fileSystems."/tmp" = {

View File

@@ -1,18 +1,24 @@
{ pkgs, ... }:
{ config, pkgs, ... }:
{
imports = [
./fs.nix
];
# sane.users.guest.enable = true;
sane.roles.client = true;
sane.services.wg-home.enable = true;
sane.services.wg-home.ip = config.sane.hosts.by-name."lappy".wg-home.ip;
# sane.guest.enable = true;
sane.gui.sway.enable = true;
sane.impermanence.enable = true;
sane.persist.enable = true;
sane.nixcache.enable = true;
boot.loader.efi.canTouchEfiVariables = false;
sane.image.extraBootFiles = [ pkgs.bootpart-uefi-x86_64 ];
sane.programs.guiApps.suggestedPrograms = [ "desktopGuiApps" ];
sops.secrets.colin-passwd = {
sopsFile = ../../secrets/lappy.yaml;
sopsFile = ../../../secrets/lappy.yaml;
neededForUsers = true;
};

View File

@@ -1,16 +1,7 @@
{ ... }:
{
# root is a tmpfs so that we have an ephemeral system ("impermanence" handles the state)
fileSystems."/" = {
device = "none";
fsType = "tmpfs";
options = [
"mode=755"
"size=1G"
"defaults"
];
};
sane.persist.root-on-tmpfs = true;
# we need a /tmp of default size (half RAM) for building large nix things
fileSystems."/tmp" = {
device = "none";

View File

@@ -1,4 +1,4 @@
{ config, pkgs, lib, mobile-nixos, ... }:
{ config, pkgs, lib, ... }:
{
imports = [
./firmware.nix
@@ -6,6 +6,18 @@
./kernel.nix
];
sane.roles.client = true;
sane.services.wg-home.enable = true;
sane.services.wg-home.ip = config.sane.hosts.by-name."moby".wg-home.ip;
# TODO: re-enable once base is cross-compiled
sane.programs.guiApps.enableSuggested = false;
# compile a subset of the larger mobile package set, until we're ready for it.
sane.programs.gpodder-configured.enableFor.user.colin = true;
sane.programs.nheko.enableFor.user.colin = true;
sane.programs.sublime-music-mobile.enableFor.user.colin = true;
sane.programs.vlc.enableFor.user.colin = true;
# cross-compiled documentation is *slow*.
# no obvious way to natively compile docs (2022/09/29).
# entrypoint is nixos/modules/misc/documentation.nix
@@ -19,27 +31,33 @@
services.getty.autologinUser = "root"; # allows for emergency maintenance?
sops.secrets.colin-passwd = {
sopsFile = ../../secrets/moby.yaml;
sopsFile = ../../../secrets/moby.yaml;
neededForUsers = true;
};
# usability compromises
sane.impermanence.home-dirs = [
".librewolf"
];
sane.web-browser = {
# compromise impermanence for the sake of usability
persistCache = "private";
persistData = "private";
# sane.home-packages.enableGuiPkgs = false; # XXX faster builds/imaging for debugging
sane.home-manager.extraPackages = [
pkgs.plasma5Packages.konsole # terminal
# i don't do crypto stuff on moby
addons.ether-metamask.enable = false;
# addons.sideberry.enable = false;
};
sane.user.persist.plaintext = [
".config/pulse" # persist pulseaudio volume
];
sane.nixcache.enable = true;
sane.impermanence.enable = true;
sane.persist.enable = true;
sane.gui.phosh.enable = true;
boot.loader.efi.canTouchEfiVariables = false;
# /boot space is at a premium. default was 20.
boot.loader.generic-extlinux-compatible.configurationLimit = 10;
# even 10 can be too much
# TODO: compress moby kernels!
boot.loader.generic-extlinux-compatible.configurationLimit = 8;
# mobile.bootloader.enable = false;
# mobile.boot.stage-1.enable = false;
# boot.initrd.systemd.enable = false;
@@ -50,9 +68,10 @@
# without this some GUI apps fail: `DRM_IOCTL_MODE_CREATE_DUMB failed: Cannot allocate memory`
# this is because they can't allocate enough video ram.
# the default CMA seems to be 32M. we could probably get by with as little as 64M, and safely with 128M.
# the default CMA seems to be 32M.
# i was running fine with 256MB from 2022/07-ish through 2022/12-ish, but then the phone quit reliably coming back from sleep: maybe a memory leak?
# `cat /proc/meminfo` to see CmaTotal/CmaFree if interested in tuning this.
boot.kernelParams = [ "cma=256M" ];
boot.kernelParams = [ "cma=512M" ];
# mobile-nixos' /lib/firmware includes:
# rtl_bt (bluetooth)

View File

@@ -1,17 +1,7 @@
{ ... }:
{
# root is a tmpfs so that we have an ephemeral system ("impermanence" handles the state)
fileSystems."/" = {
device = "none";
fsType = "tmpfs";
options = [
"mode=755"
"size=1G"
"defaults"
];
};
sane.persist.root-on-tmpfs = true;
fileSystems."/nix" = {
device = "/dev/disk/by-uuid/1f1271f8-53ce-4081-8a29-60a4a6b5d6f9";
fsType = "btrfs";

View File

@@ -125,6 +125,9 @@ in
# aarch64-unknown-linux-gnu-gcc: error: unrecognized command line option '-mfpu=neon'
# make[3]: *** [../scripts/Makefile.build:289: drivers/video/fbdev/sun5i-eink-neon.o] Error 1
FB_SUN5I_EINK = no;
# used by the pinephone pro, but fails to compile with:
# ../drivers/media/i2c/ov8858.c:1834:27: error: implicit declaration of function 'compat_ptr'
VIDEO_OV8858 = no;
})
))
];

View File

@@ -8,9 +8,6 @@
boot.loader.efi.canTouchEfiVariables = false;
sane.image.extraBootFiles = [ pkgs.bootpart-uefi-x86_64 ];
users.users.dhcpcd.uid = config.sane.allocations.dhcpcd-uid;
users.groups.dhcpcd.gid = config.sane.allocations.dhcpcd-gid;
# docs: https://nixos.org/manual/nixos/stable/options.html#opt-system.stateVersion
system.stateVersion = "21.05";
}

View File

@@ -1,38 +1,37 @@
{ pkgs, ... }:
{ config, pkgs, ... }:
{
imports = [
./fs.nix
./hardware.nix
./net.nix
./users.nix
./secrets.nix
./services
];
sane.home-manager.extraPackages = [
sane.programs = {
# for administering services
pkgs.matrix-synapse
pkgs.freshrss
pkgs.goaccess
];
sane.impermanence.enable = true;
sane.services.duplicity.enable = true;
sane.services.nixserve.enable = true;
# TODO: look into the EFI stuff
boot.loader.grub.enable = false;
boot.loader.generic-extlinux-compatible.enable = true;
boot.loader.efi.canTouchEfiVariables = false;
sane.image.extraBootFiles = [ pkgs.bootpart-u-boot-rpi-aarch64 ];
sops.secrets.duplicity_passphrase = {
sopsFile = ../../secrets/servo.yaml;
freshrss.enableFor.user.colin = true;
matrix-synapse.enableFor.user.colin = true;
signaldctl.enableFor.user.colin = true;
};
sane.persist.enable = true;
sane.services.dyn-dns.enable = true;
sane.services.wg-home.enable = true;
sane.services.wg-home.ip = config.sane.hosts.by-name."servo".wg-home.ip;
# sane.services.duplicity.enable = true; # TODO: re-enable after HW upgrade
# automatically log in at the virtual consoles.
# using root here makes sure we always have an escape hatch
services.getty.autologinUser = "root";
boot.loader.efi.canTouchEfiVariables = false;
sane.image.extraBootFiles = [ pkgs.bootpart-uefi-x86_64 ];
# both transmission and ipfs try to set different net defaults.
# we just use the most aggressive of the two here:
boot.kernel.sysctl = {
"net.core.rmem_max" = "4194304"; # 4MB
"net.core.rmem_max" = 4194304; # 4MB
};
# This value determines the NixOS release from which the default
@@ -41,6 +40,6 @@
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "21.11"; # Did you read the comment?
system.stateVersion = "21.11";
}

View File

@@ -0,0 +1,93 @@
{ ... }:
{
sane.persist.root-on-tmpfs = true;
# we need a /tmp for building large nix things
fileSystems."/tmp" = {
device = "none";
fsType = "tmpfs";
options = [
"mode=777"
"defaults"
];
};
fileSystems."/nix" = {
device = "/dev/disk/by-uuid/cc81cca0-3cc7-4d82-a00c-6243af3e7776";
fsType = "btrfs";
options = [
"compress=zstd"
"defaults"
];
};
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/6EE3-4171";
fsType = "vfat";
};
# slow, external storage (for archiving, etc)
fileSystems."/mnt/persist/ext" = {
device = "/dev/disk/by-uuid/aa272cff-0fcc-498e-a4cb-0d95fb60631b";
fsType = "btrfs";
options = [
"compress=zstd"
"defaults"
];
};
sane.persist.stores."ext" = {
origin = "/mnt/persist/ext/persist";
storeDescription = "external HDD storage";
};
sane.fs."/mnt/persist/ext".mount = {};
sane.persist.sys.plaintext = [
# TODO: this is overly broad; only need media and share directories to be persisted
{ user = "colin"; group = "users"; directory = "/var/lib/uninsane"; }
];
# make sure large media is stored to the HDD
sane.persist.sys.ext = [
{
user = "colin";
group = "users";
mode = "0777";
directory = "/var/lib/uninsane/media/Videos";
}
{
user = "colin";
group = "users";
mode = "0777";
directory = "/var/lib/uninsane/media/freeleech";
}
];
# in-memory compressed RAM (seems to be dynamically sized)
# zramSwap = {
# enable = true;
# };
# btrfs doesn't easily support swapfiles
# swapDevices = [
# { device = "/nix/persist/swapfile"; size = 4096; }
# ];
# this can be a partition. create with:
# fdisk <dev>
# n
# <default partno>
# <start>
# <end>
# t
# <partno>
# 19 # set part type to Linux swap
# w # write changes
# mkswap -L swap <part>
# swapDevices = [
# {
# label = "swap";
# # TODO: randomEncryption.enable = true;
# }
# ];
}

209
hosts/by-name/servo/net.nix Normal file
View File

@@ -0,0 +1,209 @@
{ config, pkgs, ... }:
{
networking.domain = "uninsane.org";
# The global useDHCP flag is deprecated, therefore explicitly set to false here.
# Per-interface useDHCP will be mandatory in the future, so this generated config
# replicates the default behaviour.
networking.useDHCP = false;
networking.interfaces.eth0.useDHCP = true;
# XXX colin: probably don't need this. wlan0 won't be populated unless i touch a value in networking.interfaces.wlan0
networking.wireless.enable = false;
# networking.firewall.enable = false;
networking.firewall.enable = true;
# this is needed to forward packets from the VPN to the host
boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
# unless we add interface-specific settings for each VPN, we have to define nameservers globally.
# networking.nameservers = [
# "1.1.1.1"
# "9.9.9.9"
# ];
# use systemd's stub resolver.
# /etc/resolv.conf isn't sophisticated enough to use different servers per net namespace (or link).
# instead, running the stub resolver on a known address in the root ns lets us rewrite packets
# in the ovnps namespace to use the provider's DNS resolvers.
# a weakness is we can only query 1 NS at a time (unless we were to clone the packets?)
# there also seems to be some cache somewhere that's shared between the two namespaces.
# i think this is a libc thing. might need to leverage proper cgroups to _really_ kill it.
# - getent ahostsv4 www.google.com
# - try fix: <https://serverfault.com/questions/765989/connect-to-3rd-party-vpn-server-but-dont-use-it-as-the-default-route/766290#766290>
services.resolved.enable = true;
networking.nameservers = [
# use systemd-resolved resolver
# full resolver (which understands /etc/hosts) lives on 127.0.0.53
# stub resolver (just forwards upstream) lives on 127.0.0.54
"127.0.0.53"
];
# nscd -- the Name Service Caching Daemon -- caches DNS query responses
# in a way that's unaware of my VPN routing, so routes are frequently poor against
# services which advertise different IPs based on geolocation.
# nscd claims to be usable without a cache, but in practice i can't get it to not cache!
# nsncd is the Name Service NON-Caching Daemon. it's a drop-in that doesn't cache;
# this is OK on the host -- because systemd-resolved caches. it's probably sub-optimal
# in the netns and we query upstream DNS more often than needed. hm.
# TODO: run a separate recursive resolver in each namespace.
services.nscd.enableNsncd = true;
# services.resolved.extraConfig = ''
# # docs: `man resolved.conf`
# # DNS servers to use via the `wg-ovpns` interface.
# # i hope that from the root ns, these aren't visible.
# DNS=46.227.67.134%wg-ovpns 192.165.9.158%wg-ovpns
# FallbackDNS=1.1.1.1 9.9.9.9
# '';
# OVPN CONFIG (https://www.ovpn.com):
# DOCS: https://nixos.wiki/wiki/WireGuard
# if you `systemctl restart wireguard-wg-ovpns`, make sure to also restart any other services in `NetworkNamespacePath = .../ovpns`.
# TODO: why not create the namespace as a seperate operation (nix config for that?)
networking.wireguard.enable = true;
networking.wireguard.interfaces.wg-ovpns = let
ip = "${pkgs.iproute2}/bin/ip";
in-ns = "${ip} netns exec ovpns";
iptables = "${pkgs.iptables}/bin/iptables";
veth-host-ip = "10.0.1.5";
veth-local-ip = "10.0.1.6";
vpn-ip = "185.157.162.178";
# DNS = 46.227.67.134, 192.165.9.158, 2a07:a880:4601:10f0:cd45::1, 2001:67c:750:1:cafe:cd45::1
vpn-dns = "46.227.67.134";
in {
privateKeyFile = config.sops.secrets.wg_ovpns_privkey.path;
# wg is active only in this namespace.
# run e.g. ip netns exec ovpns <some command like ping/curl/etc, it'll go through wg>
# sudo ip netns exec ovpns ping www.google.com
interfaceNamespace = "ovpns";
ips = [
"185.157.162.178/32"
];
peers = [
{
publicKey = "SkkEZDCBde22KTs/Hc7FWvDBfdOCQA4YtBEuC3n5KGs=";
endpoint = "185.157.162.10:9930";
# alternatively: use hostname, but that presents bootstrapping issues (e.g. if host net flakes)
# endpoint = "vpn36.prd.amsterdam.ovpn.com:9930";
allowedIPs = [ "0.0.0.0/0" ];
# nixOS says this is important for keeping NATs active
persistentKeepalive = 25;
# re-executes wg this often. docs hint that this might help wg notice DNS/hostname changes.
# so, maybe that helps if we specify endpoint as a domain name
# dynamicEndpointRefreshSeconds = 30;
# when refresh fails, try it again after this period instead.
# TODO: not avail until nixpkgs upgrade
# dynamicEndpointRefreshRestartSeconds = 5;
}
];
preSetup = "" + ''
${ip} netns add ovpns || echo "ovpns already exists"
'';
postShutdown = "" + ''
${in-ns} ip link del ovpns-veth-b || echo "couldn't delete ovpns-veth-b"
${ip} link del ovpns-veth-a || echo "couldn't delete ovpns-veth-a"
${ip} netns delete ovpns || echo "couldn't delete ovpns"
# restore rules/routes
${ip} rule del from ${veth-host-ip} lookup ovpns pref 50 || echo "couldn't delete init -> ovpns rule"
${ip} route del default via ${veth-local-ip} dev ovpns-veth-a proto kernel src ${veth-host-ip} metric 1002 table ovpns || echo "couldn't delete init -> ovpns route"
${ip} rule add from all lookup local pref 0
${ip} rule del from all lookup local pref 100
'';
postSetup = "" + ''
# DOCS:
# - some of this approach is described here: <https://josephmuia.ca/2018-05-16-net-namespaces-veth-nat/>
# - iptables primer: <https://danielmiessler.com/study/iptables/>
# create veth pair
${ip} link add ovpns-veth-a type veth peer name ovpns-veth-b
${ip} addr add ${veth-host-ip}/24 dev ovpns-veth-a
${ip} link set ovpns-veth-a up
# mv veth-b into the ovpns namespace
${ip} link set ovpns-veth-b netns ovpns
${in-ns} ip addr add ${veth-local-ip}/24 dev ovpns-veth-b
${in-ns} ip link set ovpns-veth-b up
# make it so traffic originating from the host side of the veth
# is sent over the veth no matter its destination.
${ip} rule add from ${veth-host-ip} lookup ovpns pref 50
# for traffic originating at the host veth to the WAN, use the veth as our gateway
# not sure if the metric 1002 matters.
${ip} route add default via ${veth-local-ip} dev ovpns-veth-a proto kernel src ${veth-host-ip} metric 1002 table ovpns
# give the default route lower priority
${ip} rule add from all lookup local pref 100
${ip} rule del from all lookup local pref 0
# bridge HTTP traffic:
# any external port-80 request sent to the VPN addr will be forwarded to the rootns.
# this exists so LetsEncrypt can procure a cert for the MX over http.
# TODO: we could use _acme_challence.mx.uninsane.org CNAME to avoid this forwarding
# - <https://community.letsencrypt.org/t/where-does-letsencrypt-resolve-dns-from/37607/8>
${in-ns} ${iptables} -A PREROUTING -t nat -p tcp --dport 80 -m iprange --dst-range ${vpn-ip} \
-j DNAT --to-destination ${veth-host-ip}:80
# we also bridge DNS traffic
${in-ns} ${iptables} -A PREROUTING -t nat -p udp --dport 53 -m iprange --dst-range ${vpn-ip} \
-j DNAT --to-destination ${veth-host-ip}:53
${in-ns} ${iptables} -A PREROUTING -t nat -p tcp --dport 53 -m iprange --dst-range ${vpn-ip} \
-j DNAT --to-destination ${veth-host-ip}:53
# in order to access DNS in this netns, we need to route it to the VPN's nameservers
# - alternatively, we could fix DNS servers like 1.1.1.1.
${in-ns} ${iptables} -A OUTPUT -t nat -p udp --dport 53 -m iprange --dst-range 127.0.0.53 \
-j DNAT --to-destination ${vpn-dns}:53
'';
};
# create a new routing table that we can use to proxy traffic out of the root namespace
# through the ovpns namespace, and to the WAN via VPN.
networking.iproute2.rttablesExtraConfig = ''
5 ovpns
'';
networking.iproute2.enable = true;
# HURRICANE ELECTRIC CONFIG:
# networking.sits = {
# hurricane = {
# remote = "216.218.226.238";
# local = "192.168.0.5";
# # local = "10.0.0.5";
# # remote = "10.0.0.1";
# # local = "10.0.0.22";
# dev = "eth0";
# ttl = 255;
# };
# };
# networking.interfaces."hurricane".ipv6 = {
# addresses = [
# # mx.uninsane.org (publically routed /64)
# {
# address = "2001:470:b:465::1";
# prefixLength = 128;
# }
# # client addr
# # {
# # address = "2001:470:a:466::2";
# # prefixLength = 64;
# # }
# ];
# routes = [
# {
# address = "::";
# prefixLength = 0;
# # via = "2001:470:a:466::1";
# }
# ];
# };
# # after configuration, we want the hurricane device to look like this:
# # hurricane: flags=209<UP,POINTOPOINT,RUNNING,NOARP> mtu 1480
# # inet6 2001:470:a:450::2 prefixlen 64 scopeid 0x0<global>
# # inet6 fe80::c0a8:16 prefixlen 64 scopeid 0x20<link>
# # sit txqueuelen 1000 (IPv6-in-IPv4)
# # test with:
# # curl --interface hurricane http://[2607:f8b0:400a:80b::2004]
# # ping 2607:f8b0:400a:80b::2004
}

View File

@@ -0,0 +1,41 @@
{ ... }:
{
sops.secrets."ddns_afraid" = {
sopsFile = ../../../secrets/servo.yaml;
};
sops.secrets."ddns_he" = {
sopsFile = ../../../secrets/servo.yaml;
};
sops.secrets."dovecot_passwd" = {
sopsFile = ../../../secrets/servo.yaml;
};
sops.secrets."duplicity_passphrase" = {
sopsFile = ../../../secrets/servo.yaml;
};
sops.secrets."freshrss_passwd" = {
sopsFile = ../../../secrets/servo.yaml;
};
sops.secrets."matrix_synapse_secrets" = {
sopsFile = ../../../secrets/servo.yaml;
};
sops.secrets."mautrix_signal_env" = {
sopsFile = ../../../secrets/servo/mautrix_signal_env.bin;
};
sops.secrets."mediawiki_pw" = {
sopsFile = ../../../secrets/servo.yaml;
};
sops.secrets."pleroma_secrets" = {
sopsFile = ../../../secrets/servo.yaml;
};
sops.secrets."wg_ovpns_privkey" = {
sopsFile = ../../../secrets/servo.yaml;
};
}

View File

@@ -0,0 +1,27 @@
{ config, lib, pkgs, ... }:
# using manual ddns now
lib.mkIf false
{
systemd.services.ddns-afraid = {
description = "update dynamic DNS entries for freedns.afraid.org";
serviceConfig = {
EnvironmentFile = config.sops.secrets.ddns_afraid.path;
# TODO: ProtectSystem = "strict";
# TODO: ProtectHome = "full";
# TODO: PrivateTmp = true;
};
script = let
curl = "${pkgs.curl}/bin/curl -4";
in ''
${curl} "https://freedns.afraid.org/dynamic/update.php?$AFRAID_KEY"
'';
};
systemd.timers.ddns-afraid = {
wantedBy = [ "multi-user.target" ];
timerConfig = {
OnStartupSec = "2min";
OnUnitActiveSec = "10min";
};
};
}

View File

@@ -1,5 +1,7 @@
{ config, pkgs, ... }:
{ config, lib, pkgs, ... }:
# we use manual DDNS now
lib.mkIf false
{
systemd.services.ddns-he = {
description = "update dynamic DNS entries for HurricaneElectric";
@@ -25,8 +27,4 @@
OnUnitActiveSec = "10min";
};
};
sops.secrets."ddns_he" = {
sopsFile = ../../../secrets/servo.yaml;
};
}

View File

@@ -1,19 +1,26 @@
{ ... }:
{
imports = [
./ddns-afraid.nix
./ddns-he.nix
./ejabberd.nix
./freshrss.nix
./gitea.nix
./goaccess.nix
./ipfs.nix
./jackett.nix
./jellyfin.nix
./kiwix-serve.nix
./matrix
./navidrome.nix
./nixserve.nix
./nginx.nix
./pleroma.nix
./postfix.nix
./postgres.nix
./prosody.nix
./transmission.nix
./trust-dns.nix
./wikipedia.nix
];
}

View File

@@ -0,0 +1,395 @@
# docs:
# - <https://docs.ejabberd.im/admin/configuration/basic>
# example configs:
# - <https://github.com/vkleen/machines/blob/138a2586ce185d7cf201d4e1fe898c83c4af52eb/hosts/europium/ejabberd.nix>
# - <https://github.com/Mic92/stockholm/blob/675ef0088624c9de1cb531f318446316884a9d3d/tv/3modules/ejabberd/default.nix>
# - <https://github.com/buffet/tararice/blob/master/programs/ejabberd.nix>
# - enables STUN and TURN
# - only over UDP 3478, not firewall-forwarding any TURN port range
# - uses stun_disco module (but with no options)
# - <https://github.com/leo60228/dotfiles/blob/39b3abba3009bdc31413d4757ca2f882a33eec8b/files/ejabberd.yml>
# - <https://github.com/Mic92/dotfiles/blob/ddf0f4821f554f7667fc803344657367c55fb9e6/nixos/eve/modules/ejabberd.nix>
# - <nixpkgs:nixos/tests/xmpp/ejabberd.nix>
# - 2013: <https://github.com/processone/ejabberd/blob/master/ejabberd.yml.example>
#
# compliance tests:
# - <https://compliance.conversations.im/server/uninsane.org/#xep0352>
{ config, lib, pkgs, ... }:
# XXX: avatar support works in MUCs but not DMs
# lib.mkIf false
{
sane.persist.sys.plaintext = [
{ user = "ejabberd"; group = "ejabberd"; directory = "/var/lib/ejabberd"; }
];
networking.firewall.allowedTCPPorts = [
3478 # STUN/TURN
5222 # XMPP client -> server
5223 # XMPPS client -> server (XMPP over TLS)
5269 # XMPP server -> server
5270 # XMPPS server -> server (XMPP over TLS)
5280 # bosh
5281 # bosh (https) ??
5349 # STUN/TURN (TLS)
5443 # web services (file uploads, websockets, admin)
];
networking.firewall.allowedUDPPorts = [
3478 # STUN/TURN
];
networking.firewall.allowedTCPPortRanges = [{
from = 49152; # TURN
to = 65535;
}];
networking.firewall.allowedUDPPortRanges = [{
from = 49152; # TURN
to = 65535;
}];
# provide access to certs
# TODO: this should just be `acme`. then we also add nginx to the `acme` group.
# why is /var/lib/acme/* owned by `nginx` group??
users.users.ejabberd.extraGroups = [ "nginx" ];
security.acme.certs."uninsane.org".extraDomainNames = [
"xmpp.uninsane.org"
"muc.xmpp.uninsane.org"
"pubsub.xmpp.uninsane.org"
"upload.xmpp.uninsane.org"
"vjid.xmpp.uninsane.org"
];
# exists so the XMPP server's cert can obtain altNames for all its resources
services.nginx.virtualHosts."xmpp.uninsane.org" = {
useACMEHost = "uninsane.org";
};
services.nginx.virtualHosts."muc.xmpp.uninsane.org" = {
useACMEHost = "uninsane.org";
};
services.nginx.virtualHosts."pubsub.xmpp.uninsane.org" = {
useACMEHost = "uninsane.org";
};
services.nginx.virtualHosts."upload.xmpp.uninsane.org" = {
useACMEHost = "uninsane.org";
};
services.nginx.virtualHosts."vjid.xmpp.uninsane.org" = {
useACMEHost = "uninsane.org";
};
sane.services.trust-dns.zones."uninsane.org".inet = {
# XXX: SRV records have to point to something with a A/AAAA record; no CNAMEs
A."xmpp" = "%NATIVE%";
CNAME."muc.xmpp" = "xmpp";
CNAME."pubsub.xmpp" = "xmpp";
CNAME."upload.xmpp" = "xmpp";
CNAME."vjid.xmpp" = "xmpp";
# _Service._Proto.Name TTL Class SRV Priority Weight Port Target
# - <https://xmpp.org/extensions/xep-0368.html>
# something's requesting the SRV records for muc.xmpp, so let's include it
# nothing seems to request XMPP SRVs for the other records (except @)
# lower numerical priority field tells clients to prefer this method
SRV."_xmpps-client._tcp.muc.xmpp" = "3 50 5223 xmpp";
SRV."_xmpps-server._tcp.muc.xmpp" = "3 50 5270 xmpp";
SRV."_xmpp-client._tcp.muc.xmpp" = "5 50 5222 xmpp";
SRV."_xmpp-server._tcp.muc.xmpp" = "5 50 5269 xmpp";
SRV."_xmpps-client._tcp" = "3 50 5223 xmpp";
SRV."_xmpps-server._tcp" = "3 50 5270 xmpp";
SRV."_xmpp-client._tcp" = "5 50 5222 xmpp";
SRV."_xmpp-server._tcp" = "5 50 5269 xmpp";
SRV."_stun._udp" = "5 50 3478 xmpp";
SRV."_stun._tcp" = "5 50 3478 xmpp";
SRV."_stuns._tcp" = "5 50 5349 xmpp";
SRV."_turn._udp" = "5 50 3478 xmpp";
SRV."_turn._tcp" = "5 50 3478 xmpp";
SRV."_turns._tcp" = "5 50 5349 xmpp";
};
# TODO: allocate UIDs/GIDs ?
services.ejabberd.enable = true;
services.ejabberd.configFile = "/var/lib/ejabberd/ejabberd.yaml";
systemd.services.ejabberd.preStart = let
config-in = pkgs.writeTextFile {
name = "ejabberd.yaml.in";
text = ''
hosts:
- uninsane.org
# none | emergency | alert | critical | error | warning | notice | info | debug
loglevel: debug
# loglevel: info
# loglevel: notice
acme:
auto: false
certfiles:
- /var/lib/acme/uninsane.org/full.pem
# ca_file: ${pkgs.cacert.unbundled}/etc/ssl/certs/
# ca_file: ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
pam_userinfotype: jid
acl:
admin:
user:
- "colin@uninsane.org"
local:
user_regexp: ""
loopback:
ip:
- 127.0.0.0/8
- ::1/128
access_rules:
local:
allow: local
c2s_access:
allow: all
announce:
allow: admin
configure:
allow: admin
muc_create:
allow: local
pubsub_createnode_access:
allow: all
trusted_network:
allow: loopback
# docs: <https://docs.ejabberd.im/admin/configuration/basic/#shaper-rules>
shaper_rules:
# setting this to above 1 may break outgoing messages
# - maybe some servers rate limit? or just don't understand simultaneous connections?
max_s2s_connections: 1
max_user_sessions: 10
max_user_offline_messages: 5000
c2s_shaper:
fast: all
s2s_shaper:
med: all
# docs: <https://docs.ejabberd.im/admin/configuration/basic/#shapers>
# this limits the bytes/sec.
# for example, burst: 3_000_000 and rate: 100_000 means:
# - each client has a BW budget that accumulates 100kB/sec and is capped at 3 MB
shaper:
fast: 1000000
med: 500000
# fast:
# - rate: 1000000
# - burst_size: 10000000
# med:
# - rate: 500000
# - burst_size: 5000000
# see: <https://docs.ejabberd.im/admin/configuration/listen/>
# s2s_use_starttls: true
s2s_use_starttls: optional
# lessens 504: remote-server-timeout errors
# see: <https://github.com/processone/ejabberd/issues/3105#issuecomment-562182967>
negotiation_timeout: 60
listen:
-
port: 5222
module: ejabberd_c2s
shaper: c2s_shaper
starttls: true
access: c2s_access
-
port: 5223
module: ejabberd_c2s
shaper: c2s_shaper
tls: true
access: c2s_access
-
port: 5269
module: ejabberd_s2s_in
shaper: s2s_shaper
-
port: 5270
module: ejabberd_s2s_in
shaper: s2s_shaper
tls: true
-
port: 5443
module: ejabberd_http
tls: true
request_handlers:
/admin: ejabberd_web_admin # TODO: ensure this actually works
/api: mod_http_api # ejabberd API endpoint (to control server)
/bosh: mod_bosh
/upload: mod_http_upload
/ws: ejabberd_http_ws
# /.well-known/host-meta: mod_host_meta
# /.well-known/host-meta.json: mod_host_meta
-
# STUN+TURN TCP
# note that the full port range should be forwarded ("not NAT'd")
# `use_turn=true` enables both TURN *and* STUN
port: 3478
module: ejabberd_stun
transport: tcp
use_turn: true
turn_min_port: 49152
turn_max_port: 65535
turn_ipv4_address: %NATIVE%
-
# STUN+TURN UDP
port: 3478
module: ejabberd_stun
transport: udp
use_turn: true
turn_min_port: 49152
turn_max_port: 65535
turn_ipv4_address: %NATIVE%
-
# STUN+TURN TLS over TCP
port: 5349
module: ejabberd_stun
transport: tcp
tls: true
certfile: /var/lib/acme/uninsane.org/full.pem
use_turn: true
turn_min_port: 49152
turn_max_port: 65535
turn_ipv4_address: %NATIVE%
# TODO: enable mod_fail2ban
# TODO(low): look into mod_http_fileserver for serving macros?
modules:
# mod_adhoc: {}
# mod_announce:
# access: admin
# allows users to set avatars in vCard
# - <https://docs.ejabberd.im/admin/configuration/modules/#mod-avatar>
mod_avatar: {}
mod_caps: {} # for mod_pubsub
mod_carboncopy: {} # allows multiple clients to receive a user's message
# queues messages when recipient is offline, including PEP and presence messages.
# compliance test suggests this be enabled
mod_client_state: {}
# mod_conversejs: TODO: enable once on 21.12
# allows clients like Dino to discover where to upload files
mod_disco:
server_info:
-
modules: all
name: abuse-addresses
urls:
- "mailto:admin.xmpp@uninsane.org"
- "xmpp:colin@uninsane.org"
-
modules: all
name: admin-addresses
urls:
- "mailto:admin.xmpp@uninsane.org"
- "xmpp:colin@uninsane.org"
mod_http_upload:
host: upload.xmpp.uninsane.org
hosts:
- upload.xmpp.uninsane.org
put_url: "https://@HOST@:5443/upload"
dir_mode: "0750"
file_mode: "0750"
rm_on_unregister: false
# allow discoverability of BOSH and websocket endpoints
# TODO: enable once on ejabberd 22.05 (presently 21.04)
# mod_host_meta: {}
mod_jidprep: {} # probably not needed: lets clients normalize jids
mod_last: {} # allow other users to know when i was last online
mod_mam:
# Mnesia is limited to 2GB, better to use an SQL backend
# For small servers SQLite is a good fit and is very easy
# to configure. Uncomment this when you have SQL configured:
# db_type: sql
assume_mam_usage: true
default: always
mod_muc:
access:
- allow
access_admin:
- allow: admin
access_create: muc_create
access_persistent: muc_create
access_mam:
- allow
history_size: 100 # messages to show new participants
host: muc.xmpp.uninsane.org
hosts:
- muc.xmpp.uninsane.org
default_room_options:
anonymous: false
lang: en
persistent: true
mam: true
mod_muc_admin: {}
mod_offline: # store messages for a user when they're offline (TODO: understand multi-client workflow?)
access_max_user_messages: max_user_offline_messages
store_groupchat: true
mod_ping: {}
mod_privacy: {} # deprecated, but required for `ejabberctl export_piefxis`
mod_private: {} # allow local clients to persist arbitrary data on my server
# push notifications to services integrated with e.g. Apple/Android.
# default is for a maximum amount of PII to be withheld, since these push notifs
# generally traverse 3rd party services. can opt to include message body, etc, though.
mod_push: {}
# i don't fully understand what this does, but it seems aimed at making push notifs more reliable.
mod_push_keepalive: {}
mod_roster:
versioning: true
# docs: <https://docs.ejabberd.im/admin/configuration/modules/#mod-s2s-dialback>
# s2s dialback to verify inbound messages
# unclear to what degree the XMPP network requires this
mod_s2s_dialback: {}
mod_shared_roster: {} # creates groups for @all, @online, and anything manually administered?
mod_stream_mgmt:
resend_on_timeout: if_offline # resend undelivered messages if the origin client is offline
# fallback for when DNS-based STUN discovery is unsupported.
# - see: <https://xmpp.org/extensions/xep-0215.html>
# docs: <https://docs.ejabberd.im/admin/configuration/modules/#mod-stun-disco>
# people say to just keep this defaulted (i guess ejabberd knows to return its `host` option of uninsane.org?)
mod_stun_disco: {}
# docs: <https://docs.ejabberd.im/admin/configuration/modules/#mod-vcard>
mod_vcard:
allow_return_all: true # all users are discoverable (?)
host: vjid.xmpp.uninsane.org
hosts:
- vjid.xmpp.uninsane.org
search: true
mod_vcard_xupdate: {} # needed for avatars
# docs: <https://docs.ejabberd.im/admin/configuration/modules/#mod-pubsub>
mod_pubsub: # needed for avatars
access_createnode: pubsub_createnode_access
host: pubsub.xmpp.uninsane.org
hosts:
- pubsub.xmpp.uninsane.org
ignore_pep_from_offline: false
last_item_cache: true
plugins:
- pep
- flat
force_node_config:
# ensure client bookmarks are private
storage:bookmarks:
access_model: whitelist
urn:xmpp:avatar:data:
access_model: open
urn:xmpp:avatar:metadata:
access_model: open
mod_version: {}
'';
};
sed = "${pkgs.gnused}/bin/sed";
in ''
ip=$(cat '${config.sane.services.dyn-dns.ipPath}')
# config is 444 (not 644), so we want to write out-of-place and then atomically move
# TODO: factor this out into `sane-woop` helper?
rm -f /var/lib/ejabberd/ejabberd.yaml.new
${sed} "s/%NATIVE%/$ip/" ${config-in} > /var/lib/ejabberd/ejabberd.yaml.new
mv /var/lib/ejabberd/ejabberd.yaml{.new,}
'';
sane.services.dyn-dns.restartOnChange = [ "ejabberd.service" ];
}

View File

@@ -9,19 +9,16 @@
# $ sudo -u freshrss -g freshrss FRESHRSS_DATA_PATH=/var/lib/freshrss ./result/cli/export-opml-for-user.php --user admin
# ```
{ config, lib, pkgs, ... }:
{ config, lib, pkgs, sane-lib, ... }:
{
sops.secrets.freshrss_passwd = {
sopsFile = ../../../secrets/servo.yaml;
sops.secrets."freshrss_passwd" = {
owner = config.users.users.freshrss.name;
mode = "400";
mode = "0400";
};
sane.impermanence.service-dirs = [
sane.persist.sys.plaintext = [
{ user = "freshrss"; group = "freshrss"; directory = "/var/lib/freshrss"; }
];
users.users.freshrss.uid = config.sane.allocations.freshrss-uid;
users.groups.freshrss.gid = config.sane.allocations.freshrss-gid;
services.freshrss.enable = true;
services.freshrss.baseUrl = "https://rss.uninsane.org";
services.freshrss.virtualHost = "rss.uninsane.org";
@@ -29,9 +26,11 @@
systemd.services.freshrss-import-feeds =
let
feeds = sane-lib.feeds;
fresh = config.systemd.services.freshrss-config;
feeds = import ../../../modules/universal/home-manager/feeds.nix { inherit lib; };
opml = pkgs.writeText "sane-freshrss.opml" (feeds.feedsToOpml feeds.all);
all-feeds = config.sane.feeds;
wanted-feeds = feeds.filterByFormat ["text" "image"] all-feeds;
opml = pkgs.writeText "sane-freshrss.opml" (feeds.feedsToOpml wanted-feeds);
in {
inherit (fresh) wantedBy environment;
serviceConfig = {
@@ -42,7 +41,23 @@
description = "import sane RSS feed list";
after = [ "freshrss-config.service" ];
script = ''
${pkgs.freshrss}/cli/import-for-user.php --user admin --filename ${opml}
# easiest way to preserve feeds: delete the user, recreate it, import feeds
${pkgs.freshrss}/cli/delete-user.php --user colin || true
${pkgs.freshrss}/cli/create-user.php --user colin --password "$(cat ${config.services.freshrss.passwordFile})" || true
${pkgs.freshrss}/cli/import-for-user.php --user colin --filename ${opml}
'';
};
# the default ("*:0/5") is to run every 5 minutes.
# `systemctl list-timers` to show
systemd.services.freshrss-updater.startAt = lib.mkForce "*:3/30";
services.nginx.virtualHosts."rss.uninsane.org" = {
addSSL = true;
enableACME = true;
# inherit kTLS;
# the routing is handled by services.freshrss.virtualHost
};
sane.services.trust-dns.zones."uninsane.org".inet.CNAME."rss" = "native";
}

View File

@@ -1,11 +1,10 @@
{ config, pkgs, lib, ... }:
{
sane.impermanence.service-dirs = [
sane.persist.sys.plaintext = [
# TODO: mode? could be more granular
{ user = "git"; group = "gitea"; directory = "/var/lib/gitea"; }
];
users.groups.gitea.gid = config.sane.allocations.gitea-gid;
services.gitea.enable = true;
services.gitea.user = "git"; # default is 'gitea'
services.gitea.database.type = "postgres";
@@ -16,6 +15,17 @@
services.gitea.settings.session.COOKIE_SECURE = true;
# services.gitea.disableRegistration = true;
# gitea doesn't create the git user
users.users.git = {
description = "Gitea Service";
home = "/var/lib/gitea";
useDefaultShell = true;
group = "gitea";
isSystemUser = true;
# sendmail access (not 100% sure if this is necessary)
extraGroups = [ "postdrop" ];
};
services.gitea.settings = {
server = {
# options: "home", "explore", "organizations", "login" or URL fragment (or full URL)
@@ -72,4 +82,18 @@
"/var/lib/gitea"
];
};
# hosted git (web view and for `git <cmd>` use
# TODO: enable publog?
services.nginx.virtualHosts."git.uninsane.org" = {
forceSSL = true; # gitea complains if served over a different protocol than its config file says
enableACME = true;
# inherit kTLS;
locations."/" = {
proxyPass = "http://127.0.0.1:3000";
};
};
sane.services.trust-dns.zones."uninsane.org".inet.CNAME."git" = "native";
}

View File

@@ -14,6 +14,7 @@
-f /var/log/nginx/public.log \
--log-format=VCOMBINED \
--real-time-html \
--html-refresh=30 \
--no-query-string \
--anonymize-ip \
--ignore-panel=HOSTS \
@@ -24,6 +25,7 @@
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
Type = "simple";
Restart = "on-failure";
RestartSec = "10s";
# hardening
WorkingDirectory = "/tmp";
@@ -41,4 +43,26 @@
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
};
# server statistics
services.nginx.virtualHosts."sink.uninsane.org" = {
addSSL = true;
enableACME = true;
# inherit kTLS;
root = "/var/lib/uninsane/sink";
locations."/ws" = {
proxyPass = "http://127.0.0.1:7890";
# XXX not sure how much of this is necessary
extraConfig = ''
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_buffering off;
proxy_read_timeout 7d;
'';
};
};
sane.services.trust-dns.zones."uninsane.org".inet.CNAME."sink" = "native";
}

View File

@@ -6,26 +6,50 @@
# - number of open peer connections:
# - sudo -u ipfs -g ipfs ipfs -c /var/lib/ipfs/ swarm peers | wc -l
{ ... }:
{ lib, ... }:
lib.mkIf false # i don't actively use ipfs anymore
{
sane.impermanence.service-dirs = [
sane.persist.sys.plaintext = [
# TODO: mode? could be more granular
{ user = "261"; group = "261"; directory = "/var/lib/ipfs"; }
];
networking.firewall.allowedTCPPorts = [ 4001 ];
networking.firewall.allowedUDPPorts = [ 4001 ];
services.nginx.virtualHosts."ipfs.uninsane.org" = {
# don't default to ssl upgrades, since this may be dnslink'd from a different domain.
# ideally we'd disable ssl entirely, but some places assume it?
addSSL = true;
enableACME = true;
# inherit kTLS;
locations."/" = {
proxyPass = "http://127.0.0.1:8080";
extraConfig = ''
proxy_set_header Host $host;
proxy_set_header X-Ipfs-Gateway-Prefix "";
'';
};
};
sane.services.trust-dns.zones."uninsane.org".inet.CNAME."ipfs" = "native";
# services.ipfs.enable = true;
services.kubo.localDiscovery = true;
services.kubo.swarmAddress = [
# "/dns4/ipfs.uninsane.org/tcp/4001"
# "/ip4/0.0.0.0/tcp/4001"
"/dns4/ipfs.uninsane.org/udp/4001/quic"
"/ip4/0.0.0.0/udp/4001/quic"
];
services.kubo.extraConfig = {
services.kubo.settings = {
Addresses = {
Announce = [
# "/dns4/ipfs.uninsane.org/tcp/4001"
"/dns4/ipfs.uninsane.org/udp/4001/quic"
];
Swarm = [
# "/dns4/ipfs.uninsane.org/tcp/4001"
# "/ip4/0.0.0.0/tcp/4001"
"/dns4/ipfs.uninsane.org/udp/4001/quic"
"/ip4/0.0.0.0/udp/4001/quic"
];
};
Gateway = {
# the gateway can only be used to serve content already replicated on this host

View File

@@ -1,18 +1,32 @@
{ ... }:
{
sane.impermanence.service-dirs = [
sane.persist.sys.plaintext = [
# TODO: mode? we only need this to save Indexer creds ==> migrate to config?
{ user = "root"; group = "root"; directory = "/var/lib/jackett"; }
];
services.jackett.enable = true;
systemd.services.jackett.after = ["wg0veth.service"];
systemd.services.jackett.after = [ "wireguard-wg-ovpns.service" ];
systemd.services.jackett.partOf = [ "wireguard-wg-ovpns.service" ];
systemd.services.jackett.serviceConfig = {
# run this behind the OVPN static VPN
NetworkNamespacePath = "/run/netns/ovpns";
# patch jackett to listen on the public interfaces
# ExecStart = lib.mkForce "${pkgs.jackett}/bin/Jackett --NoUpdates --DataFolder /var/lib/jackett/.config/Jackett --ListenPublic";
};
# jackett torrent search
services.nginx.virtualHosts."jackett.uninsane.org" = {
forceSSL = true;
enableACME = true;
# inherit kTLS;
locations."/" = {
# proxyPass = "http://ovpns.uninsane.org:9117";
proxyPass = "http://10.0.1.6:9117";
};
};
sane.services.trust-dns.zones."uninsane.org".inet.CNAME."jackett" = "native";
}

View File

@@ -0,0 +1,67 @@
{ config, lib, ... }:
# TODO: re-enable after migrating media dir to /var/lib/uninsane/media
# else it's too spammy
lib.mkIf false
{
networking.firewall.allowedUDPPorts = [
1900 7359 # DLNA: https://jellyfin.org/docs/general/networking/index.html
];
sane.persist.sys.plaintext = [
# TODO: mode? could be more granular
{ user = "jellyfin"; group = "jellyfin"; directory = "/var/lib/jellyfin"; }
];
# Jellyfin multimedia server
# this is mostly taken from the official jellfin.org docs
services.nginx.virtualHosts."jelly.uninsane.org" = {
addSSL = true;
enableACME = true;
# inherit kTLS;
locations."/" = {
proxyPass = "http://127.0.0.1:8096";
extraConfig = ''
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Protocol $scheme;
proxy_set_header X-Forwarded-Host $http_host;
# Disable buffering when the nginx proxy gets very resource heavy upon streaming
proxy_buffering off;
'';
};
# locations."/web/" = {
# proxyPass = "http://127.0.0.1:8096/web/index.html";
# extraConfig = ''
# proxy_set_header Host $host;
# proxy_set_header X-Real-IP $remote_addr;
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# proxy_set_header X-Forwarded-Proto $scheme;
# proxy_set_header X-Forwarded-Protocol $scheme;
# proxy_set_header X-Forwarded-Host $http_host;
# '';
# };
locations."/socket" = {
proxyPass = "http://127.0.0.1:8096";
extraConfig = ''
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Protocol $scheme;
proxy_set_header X-Forwarded-Host $http_host;
'';
};
};
sane.services.trust-dns.zones."uninsane.org".inet.CNAME."jelly" = "native";
services.jellyfin.enable = true;
}

View File

@@ -0,0 +1,17 @@
{ ... }:
{
sane.services.kiwix-serve = {
enable = true;
port = 8013;
zimPaths = [ "/var/lib/uninsane/www-archive/wikipedia_en_all_maxi_2022-05.zim" ];
};
services.nginx.virtualHosts."w.uninsane.org" = {
forceSSL = true;
enableACME = true;
# inherit kTLS;
locations."/".proxyPass = "http://127.0.0.1:8013";
};
sane.services.trust-dns.zones."uninsane.org".inet.CNAME."w" = "native";
}

View File

@@ -1,17 +1,23 @@
# docs: https://nixos.wiki/wiki/Matrix
# docs: https://nixos.org/manual/nixos/stable/index.html#module-services-matrix-synapse
{ config, lib, ... }:
{ config, lib, pkgs, ... }:
{
imports = [
./discord-puppet.nix
# ./irc.nix
./signal.nix
];
sane.impermanence.service-dirs = [
# allow synapse to read the registration files of its appservices
users.users.matrix-synapse.extraGroups = [ "mautrix-signal" ];
sane.persist.sys.plaintext = [
{ user = "matrix-synapse"; group = "matrix-synapse"; directory = "/var/lib/matrix-synapse"; }
];
services.matrix-synapse.enable = true;
# this changes the default log level from INFO to WARN.
# maybe there's an easier way?
services.matrix-synapse.settings.log_config = ./synapse-log_level.yaml;
services.matrix-synapse.settings.server_name = "uninsane.org";
@@ -77,9 +83,57 @@
# create a token with limited uses:
# curl -d '{ "uses_allowed": 1 }' --header "Authorization: Bearer <my_token>" localhost:8008/_synapse/admin/v1/registration_tokens/new
# matrix chat server
# TODO: was `publog`
services.nginx.virtualHosts."matrix.uninsane.org" = {
addSSL = true;
enableACME = true;
# inherit kTLS;
sops.secrets.matrix_synapse_secrets = {
sopsFile = ../../../../secrets/servo.yaml;
# TODO colin: replace this with something helpful to the viewer
# locations."/".extraConfig = ''
# return 404;
# '';
locations."/" = {
proxyPass = "http://127.0.0.1:8008";
};
# redirect browsers to the web client.
# i don't think native matrix clients ever fetch the root.
# ideally this would be put behind some user-agent test though.
locations."= /" = {
return = "301 https://web.matrix.uninsane.org";
};
# locations."/_matrix" = {
# proxyPass = "http://127.0.0.1:8008";
# };
};
# matrix web client
# docs: https://nixos.org/manual/nixos/stable/index.html#module-services-matrix-element-web
services.nginx.virtualHosts."web.matrix.uninsane.org" = {
forceSSL = true;
enableACME = true;
# inherit kTLS;
root = pkgs.element-web.override {
conf = {
default_server_config."m.homeserver" = {
"base_url" = "https://matrix.uninsane.org";
"server_name" = "uninsane.org";
};
};
};
};
sane.services.trust-dns.zones."uninsane.org".inet = {
CNAME."matrix" = "native";
CNAME."web.matrix" = "native";
};
sops.secrets."matrix_synapse_secrets" = {
owner = config.users.users.matrix-synapse.name;
};
}

View File

@@ -1,6 +1,6 @@
{ lib, ... }:
{
sane.impermanence.service-dirs = [
sane.persist.sys.plaintext = [
{ user = "matrix-synapse"; group = "matrix-synapse"; directory = "/var/lib/mx-puppet-discord"; }
];
@@ -43,6 +43,7 @@
};
};
# TODO: should use a dedicated user
systemd.services.mx-puppet-discord.serviceConfig = {
# fix up to not use /var/lib/private, but just /var/lib
DynamicUser = lib.mkForce false;

View File

@@ -1,7 +1,7 @@
{ config, lib, ... }:
{
sane.impermanence.service-dirs = [
sane.persist.sys.plaintext = [
# TODO: mode?
# user and group are both "matrix-appservice-irc"
{ user = "993"; group = "992"; directory = "/var/lib/matrix-appservice-irc"; }

View File

@@ -0,0 +1,35 @@
# config options:
# - <https://github.com/mautrix/signal/blob/master/mautrix_signal/example-config.yaml>
{ config, pkgs, ... }:
{
sane.persist.sys.plaintext = [
{ user = "mautrix-signal"; group = "mautrix-signal"; directory = "/var/lib/mautrix-signal"; }
{ user = "signald"; group = "signald"; directory = "/var/lib/signald"; }
];
services.signald.enable = true;
services.mautrix-signal.enable = true;
services.mautrix-signal.environmentFile =
config.sops.secrets.mautrix_signal_env.path;
services.mautrix-signal.settings.signal.socket_path = "/run/signald/signald.sock";
services.mautrix-signal.settings.homeserver.domain = "uninsane.org";
services.mautrix-signal.settings.bridge.permissions."@colin:uninsane.org" = "admin";
services.matrix-synapse.settings.app_service_config_files = [
# auto-created by mautrix-signal service
"/var/lib/mautrix-signal/signal-registration.yaml"
];
systemd.services.mautrix-signal.serviceConfig = {
# allow communication to signald
SupplementaryGroups = [ "signald" ];
ReadWritePaths = [ "/run/signald" ];
};
sops.secrets."mautrix_signal_env" = {
format = "binary";
mode = "0440";
owner = config.users.users.mautrix-signal.name;
group = config.users.users.matrix-synapse.name;
};
}

View File

@@ -0,0 +1,40 @@
{ lib, ... }:
{
sane.persist.sys.plaintext = [
{ user = "navidrome"; group = "navidrome"; directory = "/var/lib/navidrome"; }
];
services.navidrome.enable = true;
services.navidrome.settings = {
# docs: https://www.navidrome.org/docs/usage/configuration-options/
Address = "127.0.0.1";
Port = 4533;
MusicFolder = "/var/lib/uninsane/media/Music";
CovertArtPriority = "*.jpg, *.JPG, *.png, *.PNG, embedded";
AutoImportPlaylists = false;
ScanSchedule = "@every 1h";
};
systemd.services.navidrome.serviceConfig = {
# fix to use a normal user so we can configure perms correctly
DynamicUser = lib.mkForce false;
User = "navidrome";
Group = "navidrome";
};
users.groups.navidrome = {};
users.users.navidrome = {
group = "navidrome";
isSystemUser = true;
};
services.nginx.virtualHosts."music.uninsane.org" = {
forceSSL = true;
enableACME = true;
# inherit kTLS;
locations."/".proxyPass = "http://127.0.0.1:4533";
};
sane.services.trust-dns.zones."uninsane.org".inet.CNAME."music" = "native";
}

View File

@@ -0,0 +1,166 @@
# docs: https://nixos.wiki/wiki/Nginx
{ config, lib, pkgs, ... }:
let
# make the logs for this host "public" so that they show up in e.g. metrics
publog = vhost: lib.attrsets.unionOfDisjoint vhost {
extraConfig = (vhost.extraConfig or "") + ''
access_log /var/log/nginx/public.log vcombined;
'';
};
# kTLS = true; # in-kernel TLS for better perf
in
{
networking.firewall.allowedTCPPorts = [ 80 443 ];
services.nginx.enable = true;
services.nginx.appendConfig = ''
# use 1 process per core.
# may want to increase worker_connections too, but `ulimit -n` must be increased first.
worker_processes auto;
'';
# this is the standard `combined` log format, with the addition of $host
# so that we have the virtualHost in the log.
# KEEP IN SYNC WITH GOACCESS
# goaccess calls this VCOMBINED:
# - <https://gist.github.com/jyap808/10570005>
services.nginx.commonHttpConfig = ''
log_format vcombined '$host:$server_port $remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referrer" "$http_user_agent"';
access_log /var/log/nginx/private.log vcombined;
'';
# sets gzip_comp_level = 5
services.nginx.recommendedGzipSettings = true;
# enables OCSP stapling (so clients don't need contact the OCSP server -- i do instead)
# - doesn't seem to, actually: <https://www.ssllabs.com/ssltest/analyze.html?d=uninsane.org>
# caches TLS sessions for 10m
services.nginx.recommendedTlsSettings = true;
# enables sendfile, tcp_nopush, tcp_nodelay, keepalive_timeout 65
services.nginx.recommendedOptimisation = true;
# web blog/personal site
services.nginx.virtualHosts."uninsane.org" = publog {
root = "${pkgs.uninsane-dot-org}/share/uninsane-dot-org";
# a lot of places hardcode https://uninsane.org,
# and then when we mix http + non-https, we get CORS violations
# and things don't look right. so force SSL.
forceSSL = true;
enableACME = true;
# inherit kTLS;
# for OCSP stapling
sslTrustedCertificate = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
# uninsane.org/share/foo => /var/lib/uninsane/root/share/foo.
# yes, nginx does not strip the prefix when evaluating against the root.
locations."/share".root = "/var/lib/uninsane/root";
# allow matrix users to discover that @user:uninsane.org is reachable via matrix.uninsane.org
locations."= /.well-known/matrix/server".extraConfig =
let
# use 443 instead of the default 8448 port to unite
# the client-server and server-server port for simplicity
server = { "m.server" = "matrix.uninsane.org:443"; };
in ''
add_header Content-Type application/json;
return 200 '${builtins.toJSON server}';
'';
locations."= /.well-known/matrix/client".extraConfig =
let
client = {
"m.homeserver" = { "base_url" = "https://matrix.uninsane.org"; };
"m.identity_server" = { "base_url" = "https://vector.im"; };
};
# ACAO required to allow element-web on any URL to request this json file
in ''
add_header Content-Type application/json;
add_header Access-Control-Allow-Origin *;
return 200 '${builtins.toJSON client}';
'';
# static URLs might not be aware of .well-known (e.g. registration confirmation URLs),
# so hack around that.
locations."/_matrix" = {
proxyPass = "http://127.0.0.1:8008";
};
locations."/_synapse" = {
proxyPass = "http://127.0.0.1:8008";
};
# allow ActivityPub clients to discover how to reach @user@uninsane.org
# TODO: waiting on https://git.pleroma.social/pleroma/pleroma/-/merge_requests/3361/
# locations."/.well-known/nodeinfo" = {
# proxyPass = "http://127.0.0.1:4000";
# extraConfig = pleromaExtraConfig;
# };
};
# serve any site not listed above, if it's static.
# because we define it dynamically, SSL isn't trivial. support only http
# documented <https://nginx.org/en/docs/http/ngx_http_core_module.html#server_name>
services.nginx.virtualHosts."~^(?<domain>.+)$" = {
default = true;
addSSL = true;
enableACME = false;
sslCertificate = "/var/www/certs/wildcard/cert.pem";
sslCertificateKey = "/var/www/certs/wildcard/key.pem";
# sslCertificate = "/var/lib/acme/.minica/cert.pem";
# sslCertificateKey = "/var/lib/acme/.minica/key.pem";
# serverName = null;
locations."/" = {
# somehow this doesn't escape -- i get error 400 if i:
# curl 'http://..' --resolve '..:80:127.0.0.1'
root = "/var/www/sites/$domain";
# tryFiles = "$domain/$uri $domain/$uri/ =404";
};
};
security.acme.acceptTerms = true;
security.acme.defaults.email = "admin.acme@uninsane.org";
sane.persist.sys.plaintext = [
# TODO: mode?
{ user = "acme"; group = "acme"; directory = "/var/lib/acme"; }
{ user = "colin"; group = "users"; directory = "/var/www/sites"; }
];
# let's encrypt default chain looks like:
# - End-entity certificate ← R3 ← ISRG Root X1 ← DST Root CA X3
# - <https://community.letsencrypt.org/t/production-chain-changes/150739>
# DST Root CA X3 expired in 2021 (?)
# the alternative chain is:
# - End-entity certificate ← R3 ← ISRG Root X1 (self-signed)
# using this alternative chain grants more compatibility for services like ejabberd
# but might decrease compatibility with very old clients that don't get updates (e.g. old android, iphone <= 4).
# security.acme.defaults.extraLegoFlags = [
security.acme.certs."uninsane.org" = rec {
# ISRG Root X1 results in lets encrypt sending the same chain as default,
# just without the final ISRG Root X1 ← DST Root CA X3 link.
# i.e. we could alternative clip the last item and achieve the exact same thing.
extraLegoRunFlags = [
"--preferred-chain" "ISRG Root X1"
];
extraLegoRenewFlags = extraLegoRunFlags;
};
# TODO: alternatively, we could clip the last cert IF it's expired,
# optionally outputting that to a new cert file.
# security.acme.defaults.postRun = "";
# create a self-signed SSL certificate for use with literally any domain.
# browsers will reject this, but proxies and local testing tools can be configured
# to accept it.
system.activationScripts.generate-x509-self-signed.text = ''
mkdir -p /var/www/certs/wildcard
test -f /var/www/certs/wildcard/key.pem || ${pkgs.openssl}/bin/openssl \
req -x509 -newkey rsa:4096 \
-keyout /var/www/certs/wildcard/key.pem \
-out /var/www/certs/wildcard/cert.pem \
-sha256 -nodes -days 3650 \
-addext 'subjectAltName=DNS:*' \
-subj '/CN=self-signed'
chmod 640 /var/www/certs/wildcard/{key,cert}.pem
chown root:nginx /var/www/certs/wildcard /var/www/certs/wildcard/{key,cert}.pem
'';
}

View File

@@ -0,0 +1,21 @@
{ config, ... }:
{
services.nginx.virtualHosts."nixcache.uninsane.org" = {
addSSL = true;
enableACME = true;
# inherit kTLS;
# serverAliases = [ "nixcache" ];
locations."/".extraConfig = ''
proxy_pass http://localhost:${toString config.services.nix-serve.port};
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
'';
};
sane.services.trust-dns.zones."uninsane.org".inet.CNAME."nixcache" = "native";
sane.services.nixserve.enable = true;
sane.services.nixserve.sopsFile = ../../../../secrets/servo.yaml;
}

View File

@@ -1,15 +1,15 @@
# docs: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/networking/pleroma.nix
# docs:
# - https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/networking/pleroma.nix
# - https://docs.pleroma.social/backend/configuration/cheatsheet/
#
# to run it in a oci-container: https://github.com/barrucadu/nixfiles/blob/master/services/pleroma.nix
{ config, pkgs, ... }:
{
sane.impermanence.service-dirs = [
sane.persist.sys.plaintext = [
# TODO: mode? could be more granular
{ user = "pleroma"; group = "pleroma"; directory = "/var/lib/pleroma"; }
];
users.users.pleroma.uid = config.sane.allocations.pleroma-uid;
users.groups.pleroma.gid = config.sane.allocations.pleroma-gid;
services.pleroma.enable = true;
services.pleroma.secretConfigFile = config.sops.secrets.pleroma_secrets.path;
services.pleroma.configs = [
@@ -48,16 +48,19 @@
redirect_on_failure: true
#base_url: "https://cache.pleroma.social"
# see for reference:
# - `force_custom_plan`: <https://docs.pleroma.social/backend/configuration/postgresql/#disable-generic-query-plans>
config :pleroma, Pleroma.Repo,
adapter: Ecto.Adapters.Postgres,
username: "pleroma",
database: "pleroma",
hostname: "localhost",
pool_size: 10,
prepare: :named,
parameters: [
plan_cache_mode: "force_custom_plan"
]
# XXX: prepare: :named is needed only for PG <= 12
# prepare: :named,
# password: "{secrets.pleroma.db_password}",
# Configure web push notifications
@@ -74,9 +77,10 @@
config :pleroma, configurable_from_database: false
# strip metadata from uploaded images
config :pleroma, Pleroma.Upload, filters: [Pleroma.Upload.Filter.Exiftool]
config :pleroma, Pleroma.Upload, filters: [Pleroma.Upload.Filter.Exiftool.StripLocation]
# TODO: GET /api/pleroma/captcha is broken
# there was a nixpkgs PR to fix this around 2022/10 though.
config :pleroma, Pleroma.Captcha,
enabled: false,
method: Pleroma.Captcha.Native
@@ -107,11 +111,11 @@
''
];
systemd.services.pleroma.path = [
systemd.services.pleroma.path = [
# something inside pleroma invokes `sh` w/o specifying it by path, so this is needed to allow pleroma to start
pkgs.bash
pkgs.bash
# used by Pleroma to strip geo tags from uploads
pkgs.exiftool
pkgs.exiftool
# i saw some errors when pleroma was shutting down about it not being able to find `awk`. probably not critical
pkgs.gawk
# needed for email operations like password reset
@@ -121,6 +125,7 @@
systemd.services.pleroma.serviceConfig = {
# postgres can be slow to service early requests, preventing pleroma from starting on the first try
Restart = "on-failure";
RestartSec = "10s";
};
# systemd.services.pleroma.serviceConfig = {
@@ -130,8 +135,56 @@
# CapabilityBoundingSet = lib.mkForce "~";
# };
sops.secrets.pleroma_secrets = {
sopsFile = ../../../secrets/servo.yaml;
# this is required to allow pleroma to send email.
# raw `sendmail` works, but i think pleroma's passing it some funny flags or something, idk.
# hack to fix that.
users.users.pleroma.extraGroups = [ "postdrop" ];
# Pleroma server and web interface
# TODO: enable publog?
services.nginx.virtualHosts."fed.uninsane.org" = {
forceSSL = true; # pleroma redirects to https anyway
enableACME = true;
# inherit kTLS;
locations."/" = {
proxyPass = "http://127.0.0.1:4000";
# documented: https://git.pleroma.social/pleroma/pleroma/-/blob/develop/installation/pleroma.nginx
extraConfig = ''
# XXX colin: this block is in the nixos examples: i don't understand all of it
add_header 'Access-Control-Allow-Origin' '*' always;
add_header 'Access-Control-Allow-Methods' 'POST, PUT, DELETE, GET, PATCH, OPTIONS' always;
add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, Idempotency-Key' always;
add_header 'Access-Control-Expose-Headers' 'Link, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining, X-Request-Id' always;
if ($request_method = OPTIONS) {
return 204;
}
add_header X-XSS-Protection "1; mode=block";
add_header X-Permitted-Cross-Domain-Policies none;
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
add_header Referrer-Policy same-origin;
add_header X-Download-Options noopen;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
# proxy_set_header Host $http_host;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# colin: added this due to Pleroma complaining in its logs
# proxy_set_header X-Real-IP $remote_addr;
# proxy_set_header X-Forwarded-Proto $scheme;
client_max_body_size 16m;
'';
};
};
sane.services.trust-dns.zones."uninsane.org".inet.CNAME."fed" = "native";
sops.secrets."pleroma_secrets" = {
owner = config.users.users.pleroma.name;
};
}

View File

@@ -1,3 +1,6 @@
# DOCS:
# - dovecot config: <https://doc.dovecot.org/configuration_manual/>
{ config, lib, ... }:
let
@@ -16,7 +19,7 @@ let
};
in
{
sane.impermanence.service-dirs = [
sane.persist.sys.plaintext = [
# TODO: mode? could be more granular
{ user = "opendkim"; group = "opendkim"; directory = "/var/lib/opendkim"; }
{ user = "root"; group = "root"; directory = "/var/lib/postfix"; }
@@ -25,6 +28,61 @@ in
# "/var/lib/dhparams" # https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/security/dhparams.nix
# "/var/lib/dovecot"
];
networking.firewall.allowedTCPPorts = [
25 # SMTP
143 # IMAP
465 # SMTPS
587 # SMTPS/submission
993 # IMAPS
];
# exists only to manage certs for dovecot
services.nginx.virtualHosts."imap.uninsane.org" = {
enableACME = true;
};
# exists only to manage certs for Postfix
services.nginx.virtualHosts."mx.uninsane.org" = {
enableACME = true;
};
sane.services.trust-dns.zones."uninsane.org".inet = {
MX."@" = "10 mx.uninsane.org.";
# XXX: RFC's specify that the MX record CANNOT BE A CNAME
A."mx" = "185.157.162.178";
CNAME."imap" = "native";
# Sender Policy Framework:
# +mx => mail passes if it originated from the MX
# +a => mail passes if it originated from the A address of this domain
# +ip4:.. => mail passes if it originated from this IP
# -all => mail fails if none of these conditions were met
TXT."@" = "v=spf1 a mx -all";
# DKIM public key:
TXT."mx._domainkey" =
"v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCkSyMufc2KrRx3j17e/LyB+3eYSBRuEFT8PUka8EDX04QzCwDPdkwgnj3GNDvnB5Ktb05Cf2SJ/S1OLqNsINxJRWtkVfZd/C339KNh9wrukMKRKNELL9HLUw0bczOI4gKKFqyrRE9qm+4csCMAR79Te9FCjGV/jVnrkLdPT0GtFwIDAQAB"
;
# DMARC fields <https://datatracker.ietf.org/doc/html/rfc7489>:
# p=none|quarantine|reject: what to do with failures
# sp = p but for subdomains
# rua = where to send aggregrate reports
# ruf = where to send individual failure reports
# fo=0|1|d|s controls WHEN to send failure reports
# (1=on bad alignment; d=on DKIM failure; s=on SPF failure);
# Additionally:
# adkim=r|s (is DKIM relaxed [default] or strict)
# aspf=r|s (is SPF relaxed [default] or strict)
# pct = sampling ratio for punishing failures (default 100 for 100%)
# rf = report format
# ri = report interval
TXT."_dmarc" =
"v=DMARC1;p=quarantine;sp=reject;rua=mailto:admin+mail@uninsane.org;ruf=mailto:admin+mail@uninsane.org;fo=1:d:s"
;
};
services.postfix.enable = true;
services.postfix.hostname = "mx.uninsane.org";
services.postfix.origin = "uninsane.org";
@@ -55,7 +113,8 @@ in
services.postfix.enableSubmissions = true;
services.postfix.submissionsOptions = submissionOptions;
systemd.services.postfix.after = [ "wg0veth.service" ];
systemd.services.postfix.after = [ "wireguard-wg-ovpns.service" ];
systemd.services.postfix.partOf = [ "wireguard-wg-ovpns.service" ];
systemd.services.postfix.serviceConfig = {
# run this behind the OVPN static VPN
NetworkNamespacePath = "/run/netns/ovpns";
@@ -76,7 +135,8 @@ in
# keeping this the same as the hostname seems simplest
services.opendkim.selector = "mx";
systemd.services.opendkim.after = [ "wg0veth.service" ];
systemd.services.opendkim.after = [ "wireguard-wg-ovpns.service" ];
systemd.services.opendkim.partOf = [ "wireguard-wg-ovpns.service" ];
systemd.services.opendkim.serviceConfig = {
# run this behind the OVPN static VPN
NetworkNamespacePath = "/run/netns/ovpns";
@@ -86,6 +146,25 @@ in
# inspired by https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/
services.dovecot2.enable = true;
services.dovecot2.mailboxes = {
# special-purpose mailboxes: "All" "Archive" "Drafts" "Flagged" "Junk" "Sent" "Trash"
# RFC6154 describes these special mailboxes: https://www.ietf.org/rfc/rfc6154.html
# how these boxes are treated is 100% up to the client and server to decide.
# client behavior:
# iOS
# - Drafts: ?
# - Sent: works
# - Trash: works
# aerc
# - Drafts: works
# - Sent: works
# - Trash: no; deleted messages are actually deleted
# use `:move trash` instead
# Sent mailbox: all sent messages are copied to it. unclear if this happens server-side or client-side.
Drafts = { specialUse = "Drafts"; auto = "create"; };
Sent = { specialUse = "Sent"; auto = "create"; };
Trash = { specialUse = "Trash"; auto = "create"; };
};
services.dovecot2.sslServerCert = "/var/lib/acme/imap.uninsane.org/fullchain.pem";
services.dovecot2.sslServerKey = "/var/lib/acme/imap.uninsane.org/key.pem";
services.dovecot2.enablePAM = false;
@@ -140,8 +219,7 @@ in
# }
];
sops.secrets.dovecot_passwd = {
sopsFile = ../../../secrets/servo.yaml;
sops.secrets."dovecot_passwd" = {
owner = config.users.users.dovecot2.name;
# TODO: debug why mail can't be sent without this being world-readable
mode = "0444";

View File

@@ -1,7 +1,7 @@
{ ... }:
{
sane.impermanence.service-dirs = [
sane.persist.sys.plaintext = [
# TODO: mode?
{ user = "postgres"; group = "postgres"; directory = "/var/lib/postgresql"; }
];
@@ -17,6 +17,11 @@
# LC_CTYPE = "C";
# '';
# TODO: perf tuning
# - for recommended values see: <https://pgtune.leopard.in.ua/>
# - for official docs (sparse), see: <https://www.postgresql.org/docs/11/config-setting.html#CONFIG-SETTING-CONFIGURATION-FILE>
# services.postgresql.settings = { ... }
# daily backups to /var/backup
services.postgresqlBackup.enable = true;

View File

@@ -0,0 +1,64 @@
# example configs:
# - <https://github.com/kittywitch/nixfiles/blob/main/services/prosody.nix>
# create users with:
# - `sudo -u prosody prosodyctl adduser colin@uninsane.org`
{ lib, ... }:
# XXX disabled: doesn't send messages to nixnet.social (only receives them).
# nixnet runs ejabberd, so revisiting that.
lib.mkIf false
{
sane.persist.sys.plaintext = [
{ user = "prosody"; group = "prosody"; directory = "/var/lib/prosody"; }
];
networking.firewall.allowedTCPPorts = [
5222 # XMPP client -> server
5269 # XMPP server -> server
5280 # bosh
5281 # Prosody HTTPS port (necessary?)
];
# provide access to certs
users.users.prosody.extraGroups = [ "nginx" ];
security.acme.certs."uninsane.org".extraDomainNames = [
"conference.xmpp.uninsane.org"
"upload.xmpp.uninsane.org"
];
services.prosody = {
enable = true;
admins = [ "colin@uninsane.org" ];
# allowRegistration = false;
# extraConfig = ''
# s2s_require_encryption = true
# c2s_require_encryption = true
# '';
extraModules = [ "private" "vcard" "privacy" "compression" "component" "muc" "pep" "adhoc" "lastactivity" "admin_adhoc" "blocklist"];
ssl.cert = "/var/lib/acme/uninsane.org/fullchain.pem";
ssl.key = "/var/lib/acme/uninsane.org/key.pem";
muc = [
{
domain = "conference.xmpp.uninsane.org";
}
];
uploadHttp.domain = "upload.xmpp.uninsane.org";
virtualHosts = {
localhost = {
domain = "localhost";
enabled = true;
};
"xmpp.uninsane.org" = {
domain = "uninsane.org";
enabled = true;
ssl.cert = "/var/lib/acme/uninsane.org/fullchain.pem";
ssl.key = "/var/lib/acme/uninsane.org/key.pem";
};
};
};
}

View File

@@ -1,7 +1,7 @@
{ ... }:
{ pkgs, ... }:
{
sane.impermanence.service-dirs = [
sane.persist.sys.plaintext = [
# TODO: mode? we need this specifically for the stats tracking in .config/
{ user = "transmission"; group = "transmission"; directory = "/var/lib/transmission"; }
];
@@ -40,11 +40,41 @@
# transmission will by default not allow the world to read its files.
services.transmission.downloadDirPermissions = "775";
systemd.services.transmission.after = ["wg0veth.service"];
systemd.services.transmission.after = [ "wireguard-wg-ovpns.service" ];
systemd.services.transmission.partOf = [ "wireguard-wg-ovpns.service" ];
systemd.services.transmission.serviceConfig = {
# run this behind the OVPN static VPN
NetworkNamespacePath = "/run/netns/ovpns";
LogLevelMax = "warning";
};
# service to automatically backup torrents i add to transmission
systemd.services.backup-torrents = {
description = "archive torrents to storage not owned by transmission";
script = ''
${pkgs.rsync}/bin/rsync -arv /var/lib/transmission/.config/transmission-daemon/torrents/ /var/backup/torrents/
'';
};
systemd.timers.backup-torrents = {
wantedBy = [ "multi-user.target" ];
timerConfig = {
OnStartupSec = "11min";
OnUnitActiveSec = "240min";
};
};
# transmission web client
services.nginx.virtualHosts."bt.uninsane.org" = {
# basicAuth is literally cleartext user/pw, so FORCE this to happen over SSL
forceSSL = true;
enableACME = true;
# inherit kTLS;
locations."/" = {
# proxyPass = "http://ovpns.uninsane.org:9091";
proxyPass = "http://10.0.1.6:9091";
};
};
sane.services.trust-dns.zones."uninsane.org".inet.CNAME."bt" = "native";
}

View File

@@ -0,0 +1,67 @@
{ config, pkgs, ... }:
{
sane.services.trust-dns.enable = true;
sane.services.trust-dns.listenAddrsIPv4 = [
# specify each address explicitly, instead of using "*".
# this ensures responses are sent from the address at which the request was received.
"192.168.0.5"
"10.0.1.5"
];
sane.services.trust-dns.quiet = true;
sane.services.trust-dns.zones."uninsane.org".TTL = 900;
# SOA record structure: <https://en.wikipedia.org/wiki/SOA_record#Structure>
# SOA MNAME RNAME (... rest)
# MNAME = Master name server for this zone. this is where update requests should be sent.
# RNAME = admin contact (encoded email address)
# Serial = YYYYMMDDNN, where N is incremented every time this file changes, to trigger secondary NS to re-fetch it.
# Refresh = how frequently secondary NS should query master
# Retry = how long secondary NS should wait until re-querying master after a failure (must be < Refresh)
# Expire = how long secondary NS should continue to reply to queries after master fails (> Refresh + Retry)
sane.services.trust-dns.zones."uninsane.org".inet = {
SOA."@" = ''
ns1.uninsane.org. admin-dns.uninsane.org. (
2022122101 ; Serial
4h ; Refresh
30m ; Retry
7d ; Expire
5m) ; Negative response TTL
'';
TXT."rev" = "2022122101";
# XXX NS records must also not be CNAME
# it's best that we keep this identical, or a superset of, what org. lists as our NS.
# so, org. can specify ns2/ns3 as being to the VPN, with no mention of ns1. we provide ns1 here.
A."ns1" = "%NATIVE%";
A."ns2" = "185.157.162.178";
A."ns3" = "185.157.162.178";
A."ovpns" = "185.157.162.178";
A."native" = "%NATIVE%";
A."@" = "%NATIVE%";
NS."@" = [
"ns1.uninsane.org."
"ns2.uninsane.org."
"ns3.uninsane.org."
];
};
sane.services.trust-dns.zones."uninsane.org".file =
"/var/lib/trust-dns/uninsane.org.zone";
systemd.services.trust-dns.preStart = let
sed = "${pkgs.gnused}/bin/sed";
zone-dir = "/var/lib/trust-dns";
zone-out = "${zone-dir}/uninsane.org.zone";
zone-template = pkgs.writeText "uninsane.org.zone.in" config.sane.services.trust-dns.generatedZones."uninsane.org";
in ''
# make WAN records available to trust-dns
mkdir -p ${zone-dir}
ip=$(cat '${config.sane.services.dyn-dns.ipPath}')
${sed} s/%NATIVE%/$ip/ ${zone-template} > ${zone-out}
'';
sane.services.dyn-dns.restartOnChange = [ "trust-dns.service" ];
}

View File

@@ -0,0 +1,30 @@
# docs: <https://nixos.wiki/wiki/MediaWiki>
{ config, lib, ... }:
# XXX: working to host wikipedia with kiwix instead of mediawiki
# mediawiki does more than i need and isn't obviously superior in any way
# except that the dumps are more frequent/up-to-date.
lib.mkIf false
{
sops.secrets."mediawiki_pw" = {
owner = config.users.users.mediawiki.name;
};
services.mediawiki.enable = true;
services.mediawiki.name = "Uninsane Wiki";
services.mediawiki.passwordFile = config.sops.secrets.mediawiki_pw.path;
services.mediawiki.extraConfig = ''
# Disable anonymous editing
$wgGroupPermissions['*']['edit'] = false;
'';
services.mediawiki.virtualHost.listen = [
{
ip = "127.0.0.1";
port = 8013;
ssl = false;
}
];
services.mediawiki.virtualHost.hostName = "w.uninsane.org";
services.mediawiki.virtualHost.adminAddr = "admin+mediawiki@uninsane.org";
# services.mediawiki.extensions = TODO: wikipedia sync extension?
}

534
hosts/common/cross.nix Normal file
View File

@@ -0,0 +1,534 @@
# cross compiling
# - for edge-casey things (e.g. `mesonEmulatorHook`, `depsBuildBuild`), see in nixpkgs:
# `git show da9a9a440415b236f22f57ba67a24ab3fb53f595`
#
# build a particular package as evaluated here with:
# - toplevel: `nix build '.#host-pkgs.moby-cross.xdg-utils'`
# - scoped: `nix build '.#host-pkgs.moby-cross.gnome.mutter'`
# - python: `nix build '.#host-pkgs.moby-cross.python310Packages.pandas'`
# - perl: `nix build '.#host-pkgs.moby-cross.perl536Packages.ModuleBuild'`
# - qt: `nix build '.#host-pkgs.moby-cross.libsForQt5.qtbase'`
# most of these can be built in a nixpkgs source root like:
# - `nix build '.#pkgsCross.aarch64-multiplatform.xdg-utils'`
#
# tracking issues, PRs:
# - libuv tests fail: <https://github.com/NixOS/nixpkgs/issues/190807>
# - last checked: 2023-02-07
# - opened: 2022-09-11
# - perl Module Build broken: <https://github.com/NixOS/nixpkgs/issues/66741>
# - last checked: 2023-02-07
# - opened: 2019-08
# - perl536Packages.Testutf8 fails to cross: <https://github.com/NixOS/nixpkgs/issues/198548>
# - last checked: 2023-02-07
# - opened: 2022-10
# - python310Packages.psycopg2: <https://github.com/NixOS/nixpkgs/issues/210265>
# - last checked: 2023-02-06
# - i have a potential fix:
# """
# i was able to just add `postgresql` to the `buildInputs` (so that it's in both `buildInputs` and `nativeBuildInputs`):
# it fixed the build for `pkgsCross.aarch64-multiplatform.python310Packages.psycopg2` but not for `armv7l-hf-multiplatform` that this issue description calls out.
#
# also i haven't deployed it yet to make sure this doesn't cause anything funky at runtime though.
# """
{ config, lib, pkgs, ... }:
let
# these are the overlays which we *also* pass through to the cross and emulated package sets.
# TODO: refactor to not specify same overlay in multiple places (here and flake.nix).
overlays = [
(import ./../../overlays/pkgs.nix)
(import ./../../overlays/pins.nix)
];
mkCrossFrom = localSystem: pkgs:
import pkgs.path {
inherit localSystem; # localSystem is equivalent to buildPlatform
crossSystem = pkgs.stdenv.hostPlatform.system;
inherit (config.nixpkgs) config;
inherit overlays;
};
mkEmulated = pkgs:
import pkgs.path {
localSystem = pkgs.stdenv.hostPlatform.system;
inherit (config.nixpkgs) config;
inherit overlays;
};
in
{
# options = {
# perlPackageOverrides = lib.mkOption {
# };
# };
config = {
# the configuration of which specific package set `pkgs.cross` refers to happens elsewhere;
# here we just define them all.
nixpkgs.overlays = [
(next: prev: {
# non-emulated packages build *from* local *for* target.
# for large packages like the linux kernel which are expensive to build under emulation,
# the config can explicitly pull such packages from `pkgs.cross` to do more efficient cross-compilation.
crossFrom."x86_64-linux" = mkCrossFrom "x86_64-linux" prev;
crossFrom."aarch64-linux" = mkCrossFrom "aarch64-linux" prev;
emulated = mkEmulated prev;
})
(next: prev:
let
emulated = prev.emulated;
in {
# packages which don't cross compile
inherit (emulated)
# adwaita-qt # psqlodbc
apacheHttpd_2_4 # `configure: error: Size of "void *" is less than size of "long"`
appstream # meson.build:139:0: ERROR: Program 'gperf' not found or not executable
cantarell-fonts # python3.10-skia-pathops
colord # (meson) ERROR: An exe_wrapper is needed but was not found. Please define one in cross file and check the command and/or add it to PATH.
dante # "configure: error: error: getaddrinfo() error value count too low"
# duplicity # python3.10-s3transfer
emacs # "configure: error: cannot run test program while cross compiling"
flatpak # No package 'libxml-2.0' found
fwupd-efi # efi/meson.build:162:0: ERROR: Program or command 'gcc' not found or not executable
fwupd # "Run-time dependency libgcab-1.0 found: NO (tried pkgconfig and cmake)"
gcr_4 # meson ERROR: Program 'gpg2 gpg' not found or not executable
gmime3 # "checking preferred charset formats for system iconv... cannot run test program while cross compiling"
# gnome-keyring
# gnome-remote-desktop
# gnome-tour
gnustep # gnustep.base: "configure: error: Your compiler does not appear to implement the -fconstant-string-class option needed for support of strings."
gocryptfs # gocryptfs-2.3-go-modules
# grpc
gst_all_1 # (gst_all_1.gst-editing-services) `Run-time dependency gst-validate-1.0 found: NO (tried pkgconfig and cmake)`
# gupnp_1_6 # subprojects/gi-docgen/meson.build:10:0: ERROR: python3 not found
gvfs # meson.build:312:2: ERROR: Assert failed: http required but libxml-2.0 not found
# flatpak
hdf5 # configure: error: cannot run test program while cross compiling
# http2
ibus # configure.ac:152: error: possibly undefined macro: AM_PATH_GLIB_2_0
kitty # "FileNotFoundError: [Errno 2] No such file or directory: 'pkg-config'"
iio-sensor-proxy # "./autogen.sh: line 26: gtkdocize: not found"
libgccjit # "../../gcc-9.5.0/gcc/jit/jit-result.c:52:3: error: 'dlclose' was not declared in this scope"
libgweather # "Run-time dependency vapigen found: NO (tried pkgconfig)"
libjcat # data/tests/meson.build:10:0: ERROR: Program 'gnutls-certtool certtool' not found or not executable
libsForQt5 # qtbase # make: g++: No such file or directory
mod_dnssd # "configure: error: *** Sorry, could not find apxs ***"
networkmanager-iodine # configure.ac:58: error: possibly undefined macro: AM_GLIB_GNU_GETTEXT
notmuch # "Error: The dependencies of notmuch could not be satisfied" (xapian, gmime, glib, talloc)
obex_data_server # "/nix/store/0wk6nr1mryvylf5g5frckjam7g7p9gpi-bash-5.2-p15/bin/bash: line 2: --prefix=ods_manager: command not found"
openfortivpn # "checking for /proc/net/route... configure: error: cannot check for file existence when cross compiling"
ostree # "configure: error: Need GPGME_PTHREAD version 1.1.8 or later"
perlInterpreters # perl5.36.0-Module-Build perl5.36.0-Test-utf8 (see tracking issues ^)
phoc # Program wayland-scanner found: NO
phosh # libadwaita-1 not found
phosh-mobile-settings # meson.build:26:0: ERROR: Dependency "phosh-plugins" not found, tried pkgconfig
psqlodbc # "configure: error: odbc_config not found (required for unixODBC build)"
# qgnomeplatform
# qtbase
qt6 # error in psqlodbc, not fixed by emulating only psqlodbc above for some reason
rapidfuzz-cpp # error: could not find git for clone of catch2-populate
re2 # FAILED: CMakeFiles/test.util
rmlint # "Checking whether the C compiler works... no"
sequoia # "/nix/store/q8hg17w47f9xr014g36rdc2gi8fv02qc-clang-aarch64-unknown-linux-gnu-12.0.1-lib/lib/libclang.so.12: cannot open shared object file: No such file or directory"', /build/sequoia-0.27.0-vendor.tar.gz/bindgen/src/lib.rs:1975:31"
# splatmoji
squeekboard # meson.build:1:0: ERROR: 'rust' compiler binary not defined in cross or native file
tracker-miners # "meson.build:183:0: ERROR: Can not run test applications in this cross environment."
twitter-color-emoji # /nix/store/0wk6nr1mryvylf5g5frckjam7g7p9gpi-bash-5.2-p15/bin/bash: line 1: pkg-config: command not found
# unar has multiple failures:
# - "configure: error: Your compiler does not appear to implement the -fconstant-string-class option needed for support of strings. Please check for a more recent version or consider using --enable-nxconstantstring"
# - "/nix/store/0wk6nr1mryvylf5g5frckjam7g7p9gpi-bash-5.2-p15/bin/bash: line 1: ar: command not found"
unar
visidata # python3.10-psycopg2 python3.10-pandas python3.10-h5py
# vpnc # "/nix/store/0wk6nr1mryvylf5g5frckjam7g7p9gpi-bash-5.2-p15/bin/bash: line 1: perl: command not found"
webp-pixbuf-loader # install phase: "Builder called die: Cannot wrap '/nix/store/kpp8qhzdjqgvw73llka5gpnsj0l4jlg8-gdk-pixbuf-aarch64-unknown-linux-gnu-2.42.10/bin/gdk-pixbuf-thumbnailer' because it is not an executable file"
# webkitgtk_4_1 # requires nativeBuildInputs = perl.pkgs.FileCopyRecursive => perl5.36.0-Test-utf8
# xdg-desktop-portal-gnome # data/meson.build:33:5: ERROR: Program 'msgfmt' not found or not executable
# xdg-utils # perl5.36.0-File-BaseDir / perl5.36.0-Module-Build
;
# apacheHttpdPackagesFor = apacheHttpd: self:
# let
# prevHttpdPkgs = lib.fix (emulated.apacheHttpdPackagesFor apacheHttpd);
# in
# (prev.apacheHttpdPackagesFor apacheHttpd self) // {
# # inherit (prevHttpdPkgs) mod_dnssd;
# mod_dnssd = prevHttpdPkgs.mod_dnssd.override {
# inherit (self) apacheHttpd;
# };
# };
# appstream = prev.appstream.override {
# # doesn't fix: "ld: error adding symbols: file in wrong format"
# inherit (emulated) stdenv;
# };
# appstream = prev.appstream.overrideAttrs (orig: {
# # fixes "Program 'gperf' not found or not executable"
# # does not fix "ERROR: An exe_wrapper is needed but was not found. Please define one in cross file and check the command and/or add it to PATH."
# nativeBuildInputs = orig.nativeBuildInputs ++ [ next.gperf ];
# });
blueman = prev.blueman.overrideAttrs (orig: {
# configure: error: ifconfig or ip not found, install net-tools or iproute2
nativeBuildInputs = orig.nativeBuildInputs ++ [ next.iproute2 ];
});
brltty = prev.brltty.override {
# configure: error: no acceptable C compiler found in $PATH
inherit (emulated) stdenv;
};
cdrtools = prev.cdrtools.override {
# "configure: error: installation or configuration problem: C compiler cc not found."
inherit (emulated) stdenv;
};
# colord = prev.colord.override {
# # doesn't fix: "ld: error adding symbols: file in wrong format"
# inherit (emulated) stdenv;
# };
# evince = prev.evince.override {
# # doesn't fix: "ld: error adding symbols: file in wrong format"
# inherit (emulated) stdenv;
# };
# flatpak = prev.flatpak.override {
# # doesn't fix: "ld: error adding symbols: file in wrong format"
# inherit (emulated) stdenv;
# };
fuzzel = prev.fuzzel.override {
# meson.build:100:0: ERROR: Dependency lookup for wayland-scanner with method 'pkgconfig' failed: Pkg-config binary for machine 0 not found. Giving up.
inherit (emulated) stdenv;
};
# fwupd-efi = prev.fwupd-efi.override {
# # efi/meson.build:33:2: ERROR: Problem encountered: gnu-efi support requested, but headers were not found
# inherit (emulated) stdenv;
# };
# fwupd = prev.fwupd.overrideAttrs (orig: {
# # solves (meson) "Run-time dependency libgcab-1.0 found: NO (tried pkgconfig and cmake)", and others.
# # some of these are kinda sus. maybe upstream fwupd buildscript is iffy
# buildInputs = orig.buildInputs ++ [ next.gcab next.gi-docgen next.gnutls next.pkg-config ];
# });
gmime = prev.gmime.overrideAttrs (orig: {
# "checking preferred charset formats for system iconv... cannot run test program while cross compiling"
configureFlags = orig.configureFlags ++ [ "ac_cv_have_iconv_detect_h=no" ];
});
# gmime3 = prev.gmime3.overrideAttrs (orig: {
# # "checking preferred charset formats for system iconv... cannot run test program while cross compiling"
# # unsolved: "ImportError: /nix/store/c190src4bjkfp7bdgc5sadnmvgzv7kxb-gobject-introspection-aarch64-unknown-linux-gnu-1.74.0/lib/gobject-introspection/giscanner/_giscanner.cpython-310-x86_64-linux-gnu.so: cannot open shared object file: No such file or directory"
# configureFlags = orig.configureFlags ++ [ "ac_cv_have_iconv_detect_h=no" ];
# });
gupnp_1_6 = prev.gupnp_1_6.overrideAttrs (orig: {
# "subprojects/gi-docgen/meson.build:10:0: ERROR: python3 not found"
# this patch is copied from the default gupnp.
# TODO: upstream
outputs = [ "out" "dev" ]
++ lib.optionals (prev.stdenv.buildPlatform == prev.stdenv.hostPlatform) [ "devdoc" ];
mesonFlags = [
"-Dgtk_doc=${lib.boolToString (prev.stdenv.buildPlatform == prev.stdenv.hostPlatform)}"
"-Dintrospection=${lib.boolToString (prev.stdenv.buildPlatform == prev.stdenv.hostPlatform)}"
];
});
gnome = prev.gnome.overrideScope' (self: super: {
inherit (emulated.gnome)
evolution-data-server # "The 'perl' not found, not installing csv2vcard"
gnome-keyring # configure.ac:374: error: possibly undefined macro: AM_PATH_LIBGCRYPT
gnome-shell # "meson.build:128:0: ERROR: Program 'gjs' not found or not executable"
gnome-settings-daemon # subprojects/gvc/meson.build:30:0: ERROR: Program 'glib-mkenums mkenums' not found or not executable
mutter # meson.build:237:2: ERROR: Dependency "gbm" not found, tried pkgconfig (it's provided by mesa)
;
evince = super.evince.overrideAttrs (orig: {
# fixes (meson) "Run-time dependency gi-docgen found: NO (tried pkgconfig and cmake)"
# inspired by gupnp
outputs = [ "out" "dev" ]
++ lib.optionals (prev.stdenv.buildPlatform == prev.stdenv.hostPlatform) [ "devdoc" ];
mesonFlags = orig.mesonFlags ++ [
"-Dgtk_doc=${lib.boolToString (prev.stdenv.buildPlatform == prev.stdenv.hostPlatform)}"
];
});
# evolution-data-server = super.evolution-data-server.override {
# inherit (next) stdenv;
# };
# evolution-data-server = super.evolution-data-server.overrideAttrs (orig: {
# # fixes "The 'perl' not found, not installing csv2vcard"
# # doesn't fix "CMake Error: try_run() invoked in cross-compiling mode, please set the following cache variables appropriately"
# nativeBuildInputs = orig.nativeBuildInputs ++ [ next.perl ];
# });
gnome-color-manager = super.gnome-color-manager.overrideAttrs (orig: {
# fixes: "src/meson.build:3:0: ERROR: Program 'glib-compile-resources' not found or not executable"
nativeBuildInputs = orig.nativeBuildInputs ++ [ next.glib ];
});
gnome-control-center = super.gnome-control-center.overrideAttrs (orig: {
# fixes "subprojects/gvc/meson.build:30:0: ERROR: Program 'glib-mkenums mkenums' not found or not executable"
nativeBuildInputs = orig.nativeBuildInputs ++ [ next.glib ];
});
# gnome-control-center = super.gnome-control-center.override {
# inherit (next) stdenv;
# };
gnome-remote-desktop = super.gnome-remote-desktop.overrideAttrs (orig: {
# TODO: remove gnome-remote-desktop (wanted by gnome-control-center)
# fixes: "Program gdbus-codegen found: NO"
nativeBuildInputs = orig.nativeBuildInputs ++ [ next.glib ];
});
# gnome-shell = super.gnome-shell.overrideAttrs (orig: {
# # fixes "meson.build:128:0: ERROR: Program 'gjs' not found or not executable"
# # does not fix "_giscanner.cpython-310-x86_64-linux-gnu.so: cannot open shared object file: No such file or directory" (python import failure)
# nativeBuildInputs = orig.nativeBuildInputs ++ [ next.gjs next.gobject-introspection ];
# # try to reduce gobject-introspection/shew dependencies
# mesonFlags = [
# "-Dextensions_app=false"
# "-Dextensions_tool=false"
# "-Dman=false"
# ];
# # fixes "gvc| Build-time dependency gobject-introspection-1.0 found: NO"
# # inspired by gupnp_1_6
# # outputs = [ "out" "dev" ]
# # ++ lib.optionals (prev.stdenv.buildPlatform == prev.stdenv.hostPlatform) [ "devdoc" ];
# # mesonFlags = [
# # "-Dgtk_doc=${lib.boolToString (prev.stdenv.buildPlatform == prev.stdenv.hostPlatform)}"
# # ];
# });
# gnome-shell = super.gnome-shell.override {
# inherit (next) stdenv;
# };
# gnome-settings-daemon = super.gnome-settings-daemon.overrideAttrs (orig: {
# # fixes "subprojects/gvc/meson.build:30:0: ERROR: Program 'glib-mkenums mkenums' not found or not executable"
# # new error: "plugins/power/meson.build:22:0: ERROR: Dependency lookup for glib-2.0 with method 'pkgconfig' failed: Pkg-config binary for machine 0 not found. Giving up."
# nativeBuildInputs = orig.nativeBuildInputs ++ [ next.glib ];
# });
gnome-session = super.gnome-session.overrideAttrs (orig: {
# fixes: "gdbus-codegen not found or executable"
nativeBuildInputs = orig.nativeBuildInputs ++ [ next.glib ];
});
gnome-user-share = super.gnome-user-share.overrideAttrs (orig: {
# fixes: meson.build:111:6: ERROR: Program 'glib-compile-schemas' not found or not executable
nativeBuildInputs = orig.nativeBuildInputs ++ [ next.glib ];
});
# mutter = super.mutter.override {
# # DOES NOT FIX: "meson.build:237:2: ERROR: Dependency "gbm" not found, tried pkgconfig (it's provided by mesa)"
# inherit (next) stdenv;
# };
});
# gst_all_1.gst-editing-services = emulated.gst_all_1.gst-editing-services;
# gst_all_1 = prev.gst_all_1.overrideScope' (self: super: {
# inherit (emulated.gst_all_1)
# gst-editing-services
# ;
# });
# gvfs = prev.gvfs.overrideAttrs (orig: {
# # meson.build:312:2: ERROR: Assert failed: http required but libxml-2.0 not found
# # nativeBuildInputs = orig.nativeBuildInputs ++ [ prev.libxml2 prev.mesonEmulatorHook ];
# # TODO: gvfs 1.50.2 -> 1.50.3 upgrade is upstreamed, and fixed cross compilation
# version = "1.50.3";
# src = next.fetchurl {
# url = "mirror://gnome/sources/gvfs/1.50/gvfs-1.50.3.tar.xz";
# sha256 = "aJcRnpe7FgKdJ3jhpaVKamWSYx+LLzoqHepO8rAYA/0=";
# };
# patches = [
# # Hardcode the ssh path again.
# # https://gitlab.gnome.org/GNOME/gvfs/-/issues/465
# (next.fetchpatch2 {
# url = "https://gitlab.gnome.org/GNOME/gvfs/-/commit/8327383e262e1e7f32750a8a2d3dd708195b0f53.patch";
# hash = "sha256-ReD7qkezGeiJHyo9jTqEQNBjECqGhV9nSD+dYYGZWJ8=";
# revert = true;
# })
# ];
# });
# ibus = prev.ibus.override {
# # "_giscanner.cpython-310-x86_64-linux-gnu.so: cannot open shared object file: No such file or directory"
# inherit (emulated) stdenv;
# };
libHX = prev.libHX.overrideAttrs (orig: {
# "Can't exec "libtoolize": No such file or directory at /nix/store/r4fvx9hazsm0rdm7s393zd5v665dsh1c-autoconf-2.71/share/autoconf/Autom4te/FileUtils.pm line 294."
nativeBuildInputs = orig.nativeBuildInputs ++ [ next.libtool ];
});
librest = prev.librest.overrideAttrs (orig: {
# fixes "You must have gtk-doc >= 1.13 installed to build documentation"
# by removing the "--enable-gtk-doc" flag
configureFlags = [ "--with-ca-certificates=/etc/ssl/certs/ca-certificates.crt" ];
});
librest_1_0 = prev.librest_1_0.overrideAttrs (orig: {
# fixes (meson) "Run-time dependency gi-docgen found: NO (tried pkgconfig and cmake)"
# inspired by gupnp
outputs = [ "out" "dev" ]
++ lib.optionals (prev.stdenv.buildPlatform == prev.stdenv.hostPlatform) [ "devdoc" ];
mesonFlags = orig.mesonFlags ++ [
"-Dgtk_doc=${lib.boolToString (prev.stdenv.buildPlatform == prev.stdenv.hostPlatform)}"
];
});
# libsForQt5 = prev.libsForQt5.overrideScope' (self: super: {
# inherit (emulated.libsForQt5)
# qtbase
# ;
# });
libuv = prev.libuv.overrideAttrs (orig: {
# 2 tests fail:
# - not ok 261 - tcp_bind6_error_addrinuse
# - not ok 267 - tcp_bind_error_addrinuse_listen
doCheck = false;
});
ncftp = prev.ncftp.override {
# fixes: "ar: No such file or directory"
inherit (emulated) stdenv;
};
networkmanager-fortisslvpn = prev.networkmanager-fortisslvpn.overrideAttrs (orig: {
# fixes "gdbus-codegen: command not found"
nativeBuildInputs = orig.nativeBuildInputs ++ [ prev.glib ];
});
# networkmanager-iodine = prev.networkmanager-iodine.overrideAttrs (orig: {
# # fails to fix "configure.ac:58: error: possibly undefined macro: AM_GLIB_GNU_GETTEXT"
# nativeBuildInputs = orig.nativeBuildInputs ++ [ prev.gettext ];
# });
networkmanager-l2tp = prev.networkmanager-l2tp.overrideAttrs (orig: {
# fixes "gdbus-codegen: command not found"
# fixes "gtk4-builder-tool: command not found"
nativeBuildInputs = orig.nativeBuildInputs ++ [ prev.glib prev.gtk4 ];
});
networkmanager-openconnect = prev.networkmanager-openconnect.overrideAttrs (orig: {
# fixes "properties/gresource.xml: Permission denied"
# - by providing glib-compile-resources
nativeBuildInputs = orig.nativeBuildInputs ++ [ prev.glib ];
});
networkmanager-openvpn = prev.networkmanager-openvpn.overrideAttrs (orig: {
# fixes "properties/gresource.xml: Permission denied"
# - by providing glib-compile-resources
nativeBuildInputs = orig.nativeBuildInputs ++ [ prev.glib ];
});
networkmanager-sstp = prev.networkmanager-sstp.overrideAttrs (orig: {
# fixes "gdbus-codegen: command not found"
nativeBuildInputs = orig.nativeBuildInputs ++ [ prev.glib ];
});
networkmanager-vpnc = prev.networkmanager-vpnc.overrideAttrs (orig: {
# fixes "properties/gresource.xml: Permission denied"
# - by providing glib-compile-resources
nativeBuildInputs = orig.nativeBuildInputs ++ [ prev.glib ];
});
nheko = prev.nheko.overrideAttrs (orig: {
# fixes "fatal error: lmdb++.h: No such file or directory
buildInputs = orig.buildInputs ++ [ next.lmdbxx ];
});
pam_mount = prev.pam_mount.overrideAttrs (orig: {
# fixes: "perl: command not found"
nativeBuildInputs = orig.nativeBuildInputs ++ [ next.perl ];
});
# perlPackageOverrides = _perl: {
# inherit (pkgs.emulated.perl.pkgs)
# Testutf8
# ;
# };
pipewire = prev.pipewire.overrideAttrs (orig: {
# fix `spa/plugins/bluez5/meson.build:41:0: ERROR: Program 'gdbus-codegen' not found or not executable`
nativeBuildInputs = orig.nativeBuildInputs ++ [ prev.glib ];
});
pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
(py-next: py-prev: {
defcon = py-prev.defcon.overridePythonAttrs (orig: {
# TODO: diagnose and upstream
nativeBuildInputs = orig.nativeBuildInputs ++ orig.nativeCheckInputs;
});
executing = py-prev.executing.overridePythonAttrs (orig: {
# TODO: confirm & upstream
# test has an assertion that < 1s of CPU time elapsed => flakey
disabledTestPaths = orig.disabledTestPaths or [] ++ [
# "tests/test_main.py::TestStuff::test_many_source_for_filename_calls"
"tests/test_main.py"
];
});
# h5py = py-prev.h5py.overridePythonAttrs (orig: {
# # XXX: can't upstream until its dependency, hdf5, is fixed. that looks TRICKY.
# # - the `setup_configure.py` in h5py tries to dlopen (and call into) the hdf5 lib to query the version and detect features like MPI
# # - it could be patched with ~10 LoC in the HDF5LibWrapper class.
# #
# # expose numpy and hdf5 as available at build time
# nativeBuildInputs = orig.nativeBuildInputs ++ orig.propagatedBuildInputs ++ orig.buildInputs;
# buildInputs = [];
# # HDF5_DIR = "${hdf5}";
# });
mutatormath = py-prev.mutatormath.overridePythonAttrs (orig: {
# TODO: diagnose and upstream
nativeBuildInputs = orig.nativeBuildInputs or [] ++ orig.nativeCheckInputs;
});
pandas = py-prev.pandas.overridePythonAttrs (orig: {
# TODO: upstream
# XXX: we only actually need numpy when building in ~/nixpkgs repo: not sure why we need all the propagatedBuildInputs here.
# nativeBuildInputs = orig.nativeBuildInputs ++ [ py-next.numpy ];
nativeBuildInputs = orig.nativeBuildInputs ++ orig.propagatedBuildInputs;
});
psycopg2 = py-prev.psycopg2.overridePythonAttrs (orig: {
# TODO: upstream (see tracking issue)
#
# psycopg2 *links* against libpg, so we need the host postgres available at build time!
# present-day nixpkgs only includes it in nativeBuildInputs
buildInputs = orig.buildInputs ++ [ next.postgresql ];
});
s3transfer = py-prev.s3transfer.overridePythonAttrs (orig: {
# tests explicitly expect host CPU == build CPU
# Bail out! ERROR:../plugins/core.c:221:qemu_plugin_vcpu_init_hook: assertion failed: (success)
# Bail out! ERROR:../accel/tcg/cpu-exec.c:954:cpu_exec: assertion failed: (cpu == current_cpu)
disabledTestPaths = orig.disabledTestPaths ++ [
# "tests/functional/test_processpool.py::TestProcessPoolDownloader::test_cleans_up_tempfile_on_failure"
"tests/functional/test_processpool.py"
# "tests/unit/test_compat.py::TestBaseManager::test_can_provide_signal_handler_initializers_to_start"
"tests/unit/test_compat.py"
];
});
# skia-pathops
# it tries to call `cc` during the build, but can't find it.
})
];
# squeekboard = prev.squeekboard.overrideAttrs (orig: {
# # fixes: "meson.build:1:0: ERROR: 'rust' compiler binary not defined in cross or native file"
# # new error: "meson.build:1:0: ERROR: Rust compiler rustc --target aarch64-unknown-linux-gnu -C linker=aarch64-unknown-linux-gnu-gcc can not compile programs."
# mesonFlags =
# let
# # ERROR: 'rust' compiler binary not defined in cross or native file
# crossFile = next.writeText "cross-file.conf" ''
# [binaries]
# rust = [ 'rustc', '--target', '${next.rust.toRustTargetSpec next.stdenv.hostPlatform}' ]
# '';
# in
# orig.mesonFlags or [] ++ lib.optionals (next.stdenv.hostPlatform != next.stdenv.buildPlatform) [ "--cross-file=${crossFile}" ];
# });
strp = prev.srtp.overrideAttrs (orig: {
# roc_driver test times out after 30s
doCheck = false;
});
sysprof = prev.sysprof.overrideAttrs (orig: {
# fixes: "src/meson.build:12:2: ERROR: Program 'gdbus-codegen' not found or not executable"
nativeBuildInputs = orig.nativeBuildInputs ++ [ next.glib ];
});
tpm2-abrmd = prev.tpm2-abrmd.overrideAttrs (orig: {
# fixes "configure: error: *** gdbus-codegen is required to build tpm2-abrmd; No package 'gio-unix-2.0' found"
nativeBuildInputs = orig.nativeBuildInputs ++ [ next.glib ];
});
# unar = (prev.unar.override {
# # fixes "ar: command not found"
# # new error: "gcc: error: unrecognized command line option '-fobjc-runtime=gnustep-2.0'"
# inherit (emulated) stdenv;
# });
vpnc = prev.vpnc.overrideAttrs (orig: {
# fixes "perl: command not found"
nativeBuildInputs = orig.nativeBuildInputs ++ [ next.perl ];
});
xdg-desktop-portal-gtk = prev.xdg-desktop-portal-gtk.overrideAttrs (orig: {
# fixes "No package 'xdg-desktop-portal' found"
buildInputs = orig.buildInputs ++ [ next.xdg-desktop-portal ];
});
xdg-desktop-portal-gnome = prev.xdg-desktop-portal-gnome.overrideAttrs (orig: {
# fixes: "data/meson.build:33:5: ERROR: Program 'msgfmt' not found or not executable"
# fixes: "src/meson.build:25:0: ERROR: Program 'gdbus-codegen' not found or not executable"
nativeBuildInputs = orig.nativeBuildInputs ++ [ next.gettext next.glib ];
});
})
];
};
}

88
hosts/common/default.nix Normal file
View File

@@ -0,0 +1,88 @@
{ pkgs, ... }:
{
imports = [
./cross.nix
./feeds.nix
./fs.nix
./hardware.nix
./home
./i2p.nix
./ids.nix
./machine-id.nix
./net.nix
./persist.nix
./programs.nix
./secrets.nix
./ssh.nix
./users.nix
./vpn.nix
];
sane.nixcache.enable-trusted-keys = true;
sane.programs.sysadminUtils.enableFor.system = true;
sane.programs.consoleUtils.enableFor.user.colin = true;
# some services which use private directories error if the parent (/var/lib/private) isn't 700.
sane.fs."/var/lib/private".dir.acl.mode = "0700";
nixpkgs.config.allowUnfree = true;
# time.timeZone = "America/Los_Angeles";
time.timeZone = "Etc/UTC"; # DST is too confusing for me => use a stable timezone
# allow `nix flake ...` command
nix.extraOptions = ''
experimental-features = nix-command flakes
'';
# allow `nix-shell` (and probably nix-index?) to locate our patched and custom packages
nix.nixPath = [
"nixpkgs=${pkgs.path}"
"nixpkgs-overlays=${../..}/overlays"
];
fonts = {
enableDefaultFonts = true;
fonts = with pkgs; [ font-awesome twitter-color-emoji hack-font ];
fontconfig.enable = true;
fontconfig.defaultFonts = {
emoji = [ "Font Awesome 6 Free" "Twitter Color Emoji" ];
monospace = [ "Hack" ];
serif = [ "DejaVu Serif" ];
sansSerif = [ "DejaVu Sans" ];
};
};
# disable non-required packages like nano, perl, rsync, strace
environment.defaultPackages = [];
# programs.vim.defaultEditor = true;
environment.variables = {
EDITOR = "vim";
# git claims it should use EDITOR, but it doesn't!
GIT_EDITOR = "vim";
# TODO: these should be moved to `home.sessionVariables` (home-manager)
# Electron apps should use native wayland backend:
# https://nixos.wiki/wiki/Slack#Wayland
# Discord under sway crashes with this.
# NIXOS_OZONE_WL = "1";
# LIBGL_ALWAYS_SOFTWARE = "1";
};
# dconf docs: <https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/desktop_migration_and_administration_guide/profiles>
# find keys/values with `dconf dump /`
programs.dconf.enable = true;
programs.dconf.packages = [
(pkgs.writeTextFile {
name = "dconf-user-profile";
destination = "/etc/dconf/profile/user";
text = ''
user-db:user
system-db:site
'';
})
];
# link debug symbols into /run/current-system/sw/lib/debug
# hopefully picked up by gdb automatically?
environment.enableDebugInfo = true;
}

203
hosts/common/feeds.nix Normal file
View File

@@ -0,0 +1,203 @@
{ lib, sane-data, ... }:
let
hourly = { freq = "hourly"; };
daily = { freq = "daily"; };
weekly = { freq = "weekly"; };
infrequent = { freq = "infrequent"; };
art = { cat = "art"; };
humor = { cat = "humor"; };
pol = { cat = "pol"; }; # or maybe just "social"
rat = { cat = "rat"; };
tech = { cat = "tech"; };
uncat = { cat = "uncat"; };
text = { format = "text"; };
img = { format = "image"; };
mkRss = format: url: { inherit url format; } // uncat // infrequent;
# format-specific helpers
mkText = mkRss "text";
mkImg = mkRss "image";
mkPod = mkRss "podcast";
# host-specific helpers
mkSubstack = subdomain: { substack = subdomain; };
fromDb = name:
let
raw = sane-data.feeds."${name}";
in {
url = raw.url;
# not sure the exact mapping with velocity here: entries per day?
freq = lib.mkIf (raw.velocity or 0 != 0) (lib.mkDefault (
if raw.velocity > 2 then
"hourly"
else if raw.velocity > 0.5 then
"daily"
else if raw.velocity > 0.1 then
"weekly"
else
"infrequent"
));
} // lib.optionalAttrs (raw.is_podcast or false) {
format = "podcast";
} // lib.optionalAttrs (raw.title or "" != "") {
title = lib.mkDefault raw.title;
};
podcasts = [
(fromDb "lexfridman.com/podcast" // rat)
## Astral Codex Ten
(fromDb "sscpodcast.libsyn.com" // rat)
## Econ Talk
(fromDb "feeds.simplecast.com/wgl4xEgL" // rat)
## Cory Doctorow -- both podcast & text entries
(fromDb "craphound.com" // pol)
(fromDb "congressionaldish.libsyn.com" // pol)
## Civboot -- https://anchor.fm/civboot
(fromDb "anchor.fm/s/34c7232c/podcast/rss" // tech)
## Emerge: making sense of what's next -- <https://www.whatisemerging.com/emergepodcast>
(mkPod "https://anchor.fm/s/21bc734/podcast/rss" // pol // infrequent)
(fromDb "feeds.feedburner.com/80000HoursPodcast" // rat)
(fromDb "allinchamathjason.libsyn.com" // pol)
(fromDb "acquired.libsyn.com" // tech)
# The Intercept - Deconstructed; also available: <rss.acast.com/deconstructed>
(fromDb "rss.prod.firstlook.media/deconstructed/podcast.rss" // pol)
## The Daily
(mkPod "https://feeds.simplecast.com/54nAGcIl" // pol // daily)
# The Intercept - Intercepted; also available: <https://rss.acast.com/intercepted-with-jeremy-scahill>
(fromDb "rss.prod.firstlook.media/intercepted/podcast.rss" // pol)
(fromDb "podcast.posttv.com/itunes/post-reports.xml" // pol)
## Eric Weinstein
(fromDb "rss.art19.com/the-portal" // rat)
(fromDb "darknetdiaries.com" // tech)
## Radiolab -- also available here, but ONLY OVER HTTP: <http://feeds.wnyc.org/radiolab>
(fromDb "feeds.feedburner.com/radiolab" // pol)
## Sam Harris
(fromDb "wakingup.libsyn.com" // pol)
## 99% Invisible -- also available here: <https://feeds.simplecast.com/BqbsxVfO>
(fromDb "feeds.99percentinvisible.org/99percentinvisible" // pol)
(fromDb "rss.acast.com/ft-tech-tonic" // tech)
(fromDb "feeds.feedburner.com/dancarlin/history" // rat)
(fromDb "rss.art19.com/60-minutes" // pol)
## The Verge - Decoder
(fromDb "feeds.megaphone.fm/recodedecode" // tech)
## Matrix (chat) Live
(fromDb "feed.podbean.com/matrixlive/feed.xml" // tech)
## Michael Malice - Your Welcome -- also available here: <https://origin.podcastone.com/podcast?categoryID2=2232>
(fromDb "rss.art19.com/your-welcome" // pol)
(fromDb "seattlenice.buzzsprout.com" // pol)
## Sci-Fi? has Peter Watts; author of No Moods, Ads or Cutesy Fucking Icons (rifters.com)
(fromDb "talesfromthebridge.buzzsprout.com" // tech)
];
texts = [
# AGGREGATORS (> 1 post/day)
(fromDb "lwn.net" // tech)
(fromDb "lesswrong.com" // rat)
(fromDb "econlib.org" // pol)
# AGGREGATORS (< 1 post/day)
(fromDb "palladiummag.com" // uncat)
(fromDb "profectusmag.com" // uncat)
(fromDb "semiaccurate.com" // tech)
(mkText "https://linuxphoneapps.org/blog/atom.xml" // tech // infrequent)
(fromDb "spectrum.ieee.org" // tech)
## n.b.: quality RSS list here: <https://forum.merveilles.town/thread/57/share-your-rss-feeds%21-6/>
(mkText "https://forum.merveilles.town/rss.xml" // pol // infrequent)
## No Moods, Ads or Cutesy Fucking Icons
(fromDb "rifters.com/crawl" // uncat)
# DEVELOPERS
(fromDb "uninsane.org" // tech)
(fromDb "mg.lol" // tech)
(fromDb "drewdevault.com" // tech)
## Ken Shirriff
(fromDb "righto.com" // tech)
## shared blog by a few NixOS devs, notably onny
(fromDb "project-insanity.org" // tech)
## Vitalik Buterin
(fromDb "vitalik.ca" // tech)
## ian (Sanctuary)
(fromDb "sagacioussuricata.com" // tech)
## Bunnie Juang
(fromDb "bunniestudios.com" // tech)
(fromDb "blog.danieljanus.pl" // tech)
(fromDb "ianthehenry.com" // tech)
(fromDb "bitbashing.io" // tech)
(fromDb "idiomdrottning.org" // uncat)
(mkText "https://anish.lakhwara.com/home.html" // tech // weekly)
(fromDb "jefftk.com" // tech)
(fromDb "pomeroyb.com" // tech)
# (TECH; POL) COMMENTATORS
## Matt Webb -- engineering-ish, but dreamy
(fromDb "interconnected.org/home/feed" // rat)
(fromDb "edwardsnowden.substack.com" // pol // text)
## Julia Evans
(mkText "https://jvns.ca/atom.xml" // tech // weekly)
(mkText "http://benjaminrosshoffman.com/feed" // pol // weekly)
## Ben Thompson
(mkText "https://www.stratechery.com/rss" // pol // weekly)
## Balaji
(fromDb "balajis.com" // pol)
(fromDb "ben-evans.com/benedictevans" // pol)
(fromDb "lynalden.com" // pol)
(fromDb "austinvernon.site" // tech)
(mkSubstack "oversharing" // pol // daily)
(mkSubstack "doomberg" // tech // weekly)
## David Rosenthal
(fromDb "blog.dshr.org" // pol)
## Matt Levine
(mkText "https://www.bloomberg.com/opinion/authors/ARbTQlRLRjE/matthew-s-levine.rss" // pol // weekly)
(fromDb "stpeter.im/atom.xml" // pol)
## Peter Saint-Andre -- side project of stpeter.im
(fromDb "philosopher.coach" // rat)
# RATIONALITY/PHILOSOPHY/ETC
(mkSubstack "samkriss" // humor // infrequent)
(fromDb "unintendedconsequenc.es" // rat)
(fromDb "applieddivinitystudies.com" // rat)
(fromDb "slimemoldtimemold.com" // rat)
(fromDb "richardcarrier.info" // rat)
(fromDb "gwern.net" // rat)
## Jason Crawford
(fromDb "rootsofprogress.org" // rat)
## Robin Hanson
(fromDb "overcomingbias.com" // rat)
## Scott Alexander
(mkSubstack "astralcodexten" // rat // daily)
## Paul Christiano
(fromDb "sideways-view.com" // rat)
## Sean Carroll
(fromDb "preposterousuniverse.com" // rat)
## mostly dating topics. not advice, or humor, but looking through a social lens
(fromDb "putanumonit.com" // rat)
# CODE
# (mkText "https://github.com/Kaiteki-Fedi/Kaiteki/commits/master.atom" // tech // infrequent)
];
images = [
(fromDb "smbc-comics.com" // img // humor)
(fromDb "xkcd.com" // img // humor)
(fromDb "pbfcomics.com" // img // humor)
# (mkImg "http://dilbert.com/feed" // humor // daily)
# ART
(fromDb "miniature-calendar.com" // img // art // daily)
];
in
{
sane.feeds = texts ++ images ++ podcasts;
assertions = builtins.map
(p: {
assertion = p.format or "unknown" == "podcast";
message = ''${p.url} is not a podcast: ${p.format or "unknown"}'';
})
podcasts;
}

View File

@@ -19,11 +19,17 @@ let sshOpts = rec {
optionsRoot = optionsBase ++ [
# we don't transform_symlinks because that breaks the validity of remote /nix stores
"sftp_server=/run/wrappers/bin/sudo\\040${pkgs.openssh}/libexec/sftp-server"
"sftp_server=/run/wrappers/bin/sudo\\040/run/current-system/sw/libexec/sftp-server"
];
};
in
{
environment.pathsToLink = [
# needed to achieve superuser access for user-mounted filesystems (see optionsRoot above)
# we can only link whole directories here, even though we're only interested in pkgs.openssh
"/libexec"
];
fileSystems."/mnt/servo-media-wan" = {
device = "colin@uninsane.org:/var/lib/uninsane/media";
inherit (sshOpts) fsType;

View File

@@ -0,0 +1,11 @@
# Terminal UI mail client
{ config, sane-lib, ... }:
{
sops.secrets."aerc_accounts" = {
owner = config.users.users.colin.name;
sopsFile = ../../../secrets/universal/aerc_accounts.conf;
format = "binary";
};
sane.user.fs.".config/aerc/accounts.conf" = sane-lib.fs.wantedSymlinkTo config.sops.secrets.aerc_accounts.path;
}

View File

@@ -0,0 +1,23 @@
{ ... }:
{
imports = [
./aerc.nix
./firefox.nix
./gfeeds.nix
./git.nix
./gpodder.nix
./keyring.nix
./kitty.nix
./libreoffice.nix
./mime.nix
./mpv.nix
./neovim.nix
./newsflash.nix
./splatmoji.nix
./ssh.nix
./sublime-music.nix
./vlc.nix
./xdg-dirs.nix
./zsh
];
}

View File

@@ -0,0 +1,202 @@
# common settings to toggle (at runtime, in about:config):
# > security.ssl.require_safe_negotiation
# librewolf is a forked firefox which patches firefox to allow more things
# (like default search engines) to be configurable at runtime.
# many of the settings below won't have effect without those patches.
# see: https://gitlab.com/librewolf-community/settings/-/blob/master/distribution/policies.json
{ config, lib, pkgs, sane-lib, ...}:
with lib;
let
cfg = config.sane.web-browser;
# allow easy switching between firefox and librewolf with `defaultSettings`, below
librewolfSettings = {
browser = pkgs.librewolf-unwrapped;
# browser = pkgs.librewolf-unwrapped.overrideAttrs (drv: {
# # this allows side-loading unsigned addons
# MOZ_REQUIRE_SIGNING = false;
# });
libName = "librewolf";
dotDir = ".librewolf";
cacheDir = ".cache/librewolf"; # TODO: is it?
desktop = "librewolf.desktop";
};
firefoxSettings = {
browser = pkgs.firefox-esr-unwrapped;
libName = "firefox";
dotDir = ".mozilla/firefox";
cacheDir = ".cache/mozilla";
desktop = "firefox.desktop";
};
defaultSettings = firefoxSettings;
# defaultSettings = librewolfSettings;
addon = name: extid: hash: pkgs.fetchFirefoxAddon {
inherit name hash;
url = "https://addons.mozilla.org/firefox/downloads/latest/${name}/latest.xpi";
# extid can be found by unar'ing the above xpi, and copying browser_specific_settings.gecko.id field
fixedExtid = extid;
};
localAddon = pkg: pkgs.fetchFirefoxAddon {
inherit (pkg) name;
src = "${pkg}/share/mozilla/extensions/\\{ec8030f7-c20a-464f-9b0e-13a3a9e97384\\}/${pkg.extid}.xpi";
fixedExtid = pkg.extid;
};
package = pkgs.wrapFirefox cfg.browser.browser {
# inherit the default librewolf.cfg
# it can be further customized via ~/.librewolf/librewolf.overrides.cfg
inherit (pkgs.librewolf-unwrapped) extraPrefsFiles;
inherit (cfg.browser) libName;
extraNativeMessagingHosts = [ pkgs.browserpass ];
# extraNativeMessagingHosts = [ pkgs.gopass-native-messaging-host ];
nixExtensions = concatMap (ext: optional ext.enable ext.package) (attrValues cfg.addons);
extraPolicies = {
NoDefaultBookmarks = true;
SearchEngines = {
Default = "DuckDuckGo";
};
AppUpdateURL = "https://localhost";
DisableAppUpdate = true;
OverrideFirstRunPage = "";
OverridePostUpdatePage = "";
DisableSystemAddonUpdate = true;
DisableFirefoxStudies = true;
DisableTelemetry = true;
DisableFeedbackCommands = true;
DisablePocket = true;
DisableSetDesktopBackground = false;
# remove many default search providers
# XXX this seems to prevent the `nixExtensions` from taking effect
# Extensions.Uninstall = [
# "google@search.mozilla.org"
# "bing@search.mozilla.org"
# "amazondotcom@search.mozilla.org"
# "ebay@search.mozilla.org"
# "twitter@search.mozilla.org"
# ];
# XXX doesn't seem to have any effect...
# docs: https://github.com/mozilla/policy-templates#homepage
# Homepage = {
# HomepageURL = "https://uninsane.org/";
# StartPage = "homepage";
# };
# NewTabPage = true;
};
};
addonOpts = types.submodule {
options = {
package = mkOption {
type = types.package;
};
enable = mkOption {
type = types.bool;
};
};
};
in
{
options = {
sane.web-browser.browser = mkOption {
default = defaultSettings;
type = types.attrs;
};
sane.web-browser.persistData = mkOption {
description = "optional store name to which persist browsing data (like history)";
type = types.nullOr types.str;
default = null;
};
sane.web-browser.persistCache = mkOption {
description = "optional store name to which persist browser cache";
type = types.nullOr types.str;
default = "cryptClearOnBoot";
};
sane.web-browser.addons = mkOption {
type = types.attrsOf addonOpts;
default = {
# get names from:
# - ~/ref/nix-community/nur-combined/repos/rycee/pkgs/firefox-addons/generated-firefox-addons.nix
# `wget ...xpi`; `unar ...xpi`; `cat */manifest.json | jq '.browser_specific_settings.gecko.id'`
# browserpass-ce.package = addon "browserpass-ce" "browserpass@maximbaz.com" "sha256-sXgUBbRvMnRpeIW1MTkmTcoqtW/8RDXAkxAq1evFkpc=";
browserpass-extension.package = localAddon pkgs.browserpass-extension;
bypass-paywalls-clean.package = addon "bypass-paywalls-clean" "{d133e097-46d9-4ecc-9903-fa6a722a6e0e}" "sha256-oUwdqdAwV3DezaTtOMx7A/s4lzIws+t2f08mwk+325k=";
ether-metamask.package = addon "ether-metamask" "webextension@metamask.io" "sha256-G+MwJDOcsaxYSUXjahHJmkWnjLeQ0Wven8DU/lGeMzA=";
i2p-in-private-browsing.package = addon "i2p-in-private-browsing" "i2ppb@eyedeekay.github.io" "sha256-dJcJ3jxeAeAkRvhODeIVrCflvX+S4E0wT/PyYzQBQWs=";
sidebery.package = addon "sidebery" "{3c078156-979c-498b-8990-85f7987dd929}" "sha256-YONfK/rIjlsrTgRHIt3km07Q7KnpIW89Z9r92ZSCc6w=";
sponsorblock.package = addon "sponsorblock" "sponsorBlocker@ajay.app" "sha256-hRsvLaAsVm3dALsTrJqHTNgRFAQcU7XSaGhr5G6+mFs=";
ublacklist.package = addon "ublacklist" "@ublacklist" "sha256-RqY5iHzbL2qizth7aguyOKWPyINXmrwOlf/OsfqAS48=";
ublock-origin.package = addon "ublock-origin" "uBlock0@raymondhill.net" "sha256-a/ivUmY1P6teq9x0dt4CbgHt+3kBsEMMXlOfZ5Hx7cg=";
browserpass-extension.enable = lib.mkDefault true;
bypass-paywalls-clean.enable = lib.mkDefault true;
ether-metamask.enable = lib.mkDefault true;
i2p-in-private-browsing.enable = lib.mkDefault config.services.i2p.enable;
sidebery.enable = lib.mkDefault true;
sponsorblock.enable = lib.mkDefault true;
ublacklist.enable = lib.mkDefault true;
ublock-origin.enable = lib.mkDefault true;
};
};
};
config = {
sane.programs.web-browser = {
inherit package;
# TODO: define the persistence & fs config here
};
sane.programs.guiApps.suggestedPrograms = [ "web-browser" ];
# uBlock filter list configuration.
# specifically, enable the GDPR cookie prompt blocker.
# data.toOverwrite.filterLists is additive (i.e. it supplements the default filters)
# this configuration method is documented here:
# - <https://github.com/gorhill/uBlock/issues/2986#issuecomment-364035002>
# the specific attribute path is found via scraping ublock code here:
# - <https://github.com/gorhill/uBlock/blob/master/src/js/storage.js>
# - <https://github.com/gorhill/uBlock/blob/master/assets/assets.json>
sane.user.fs."${cfg.browser.dotDir}/managed-storage/uBlock0@raymondhill.net.json" = sane-lib.fs.wantedText ''
{
"name": "uBlock0@raymondhill.net",
"description": "ignored",
"type": "storage",
"data": {
"toOverwrite": "{\"filterLists\": [\"fanboy-cookiemonster\"]}"
}
}
'';
sane.user.fs."${cfg.browser.dotDir}/${cfg.browser.libName}.overrides.cfg" = sane-lib.fs.wantedText ''
// if we can't query the revocation status of a SSL cert because the issuer is offline,
// treat it as unrevoked.
// see: <https://librewolf.net/docs/faq/#im-getting-sec_error_ocsp_server_error-what-can-i-do>
defaultPref("security.OCSP.require", false);
'';
# flush the cache to disk to avoid it taking up too much tmp
sane.user.persist.byPath."${cfg.browser.cacheDir}" = lib.mkIf (cfg.persistCache != null) {
store = cfg.persistCache;
};
sane.user.persist.byPath."${cfg.browser.dotDir}/default" = lib.mkIf (cfg.persistData != null) {
store = cfg.persistData;
};
sane.user.fs."${cfg.browser.dotDir}/default" = sane-lib.fs.wantedDir;
# instruct Firefox to put the profile in a predictable directory (so we can do things like persist just it).
# XXX: the directory *must* exist, even if empty; Firefox will not create the directory itself.
sane.user.fs."${cfg.browser.dotDir}/profiles.ini" = sane-lib.fs.wantedText ''
[Profile0]
Name=default
IsRelative=1
Path=default
Default=1
[General]
StartWithLastProfile=1
'';
};
}

View File

@@ -0,0 +1,42 @@
# gnome feeds RSS viewer
{ config, lib, sane-lib, ... }:
let
feeds = sane-lib.feeds;
all-feeds = config.sane.feeds;
wanted-feeds = feeds.filterByFormat ["text" "image"] all-feeds;
in {
sane.user.fs.".config/org.gabmus.gfeeds.json" = sane-lib.fs.wantedText (
builtins.toJSON {
# feed format is a map from URL to a dict,
# with dict["tags"] a list of string tags.
feeds = sane-lib.mapToAttrs (feed: {
name = feed.url;
value.tags = [ feed.cat feed.freq ];
}) wanted-feeds;
dark_reader = false;
new_first = true;
# windowsize = {
# width = 350;
# height = 650;
# };
max_article_age_days = 90;
enable_js = false;
max_refresh_threads = 3;
# saved_items = {};
# read_items = [];
show_read_items = true;
full_article_title = true;
# views: "webview", "reader", "rsscont"
default_view = "rsscont";
open_links_externally = true;
full_feed_name = false;
refresh_on_startup = true;
tags = lib.unique (
(builtins.catAttrs "cat" wanted-feeds) ++ (builtins.catAttrs "freq" wanted-feeds)
);
open_youtube_externally = false;
media_player = "vlc"; # default: mpv
}
);
}

18
hosts/common/home/git.nix Normal file
View File

@@ -0,0 +1,18 @@
{ lib, pkgs, sane-lib, ... }:
let
mkCfg = lib.generators.toINI { };
in
{
sane.user.fs.".config/git/config" = sane-lib.fs.wantedText (mkCfg {
user.name = "Colin";
user.email = "colin@uninsane.org";
alias.co = "checkout";
# difftastic docs:
# - <https://difftastic.wilfred.me.uk/git.html>
diff.tool = "difftastic";
difftool.prompt = false;
"difftool \"difftastic\"".cmd = ''${pkgs.difftastic}/bin/difft "$LOCAL" "$REMOTE"'';
# now run `git difftool` to use difftastic git
});
}

View File

@@ -0,0 +1,12 @@
# gnome feeds RSS viewer
{ config, sane-lib, ... }:
let
feeds = sane-lib.feeds;
all-feeds = config.sane.feeds;
wanted-feeds = feeds.filterByFormat ["podcast"] all-feeds;
in {
sane.user.fs.".config/gpodderFeeds.opml" = sane-lib.fs.wantedText (
feeds.feedsToOpml wanted-feeds
);
}

View File

@@ -0,0 +1,11 @@
{ config, sane-lib, ... }:
{
sane.user.persist.private = [ ".local/share/keyrings" ];
sane.user.fs."private/.local/share/keyrings/default" = {
generated.script.script = builtins.readFile ../../../scripts/init-keyring;
# TODO: is this `wantedBy` needed? can we inherit it?
wantedBy = [ config.sane.fs."/home/colin/private".unit ];
};
}

View File

@@ -0,0 +1,68 @@
{ pkgs, sane-lib, ... }:
{
sane.user.fs.".config/kitty/kitty.conf" = sane-lib.fs.wantedText ''
# docs: https://sw.kovidgoyal.net/kitty/conf/
# disable terminal bell (when e.g. you backspace too many times)
enable_audio_bell no
map ctrl+n new_os_window_with_cwd
include ${pkgs.kitty-themes}/themes/PaperColor_dark.conf
'';
# THEME CHOICES:
# docs: https://github.com/kovidgoyal/kitty-themes
# theme = "1984 Light"; # dislike: awful, harsh blues/teals
# theme = "Adventure Time"; # dislike: harsh (dark)
# theme = "Atom One Light"; # GOOD: light theme. all color combos readable. not a huge fan of the blue.
# theme = "Belafonte Day"; # dislike: too low contrast for text colors
# theme = "Belafonte Night"; # better: dark theme that's easy on the eyes. all combos readable. low contrast.
# theme = "Catppuccin"; # dislike: a bit pale/low-contrast (dark)
# theme = "Desert"; # mediocre: colors are harsh
# theme = "Earthsong"; # BEST: dark theme. readable, good contrast. unique, but decent colors.
# theme = "Espresso Libre"; # better: dark theme. readable, but meh colors
# theme = "Forest Night"; # decent: very pastel. it's workable, but unconventional and muted/flat.
# theme = "Gruvbox Material Light Hard"; # mediocre light theme.
# theme = "kanagawabones"; # better: dark theme. colors are too background-y
# theme = "Kaolin Dark"; # dislike: too dark
# theme = "Kaolin Breeze"; # mediocre: not-too-harsh light theme, but some parts are poor contrast
# theme = "Later This Evening"; # mediocre: not-too-harsh dark theme, but cursor is poor contrast
# theme = "Material"; # decent: light theme, few colors.
# theme = "Mayukai"; # decent: not-too-harsh dark theme. the teal is a bit straining
# theme = "Nord"; # mediocre: pale background, low contrast
# theme = "One Half Light"; # better: not-too-harsh light theme. contrast could be better
# theme = "PaperColor Dark"; # BEST: dark theme, very readable still the colors are background-y
# theme = "Parasio Dark"; # dislike: too low contrast
# theme = "Pencil Light"; # better: not-too-harsh light theme. decent contrast.
# theme = "Pnevma"; # dislike: too low contrast
# theme = "Piatto Light"; # better: readable light theme. pleasing colors. powerline prompt is hard to read.
# theme = "Rosé Pine Dawn"; # GOOD: light theme. all color combinations are readable. it is very mild -- may need to manually tweak contrast. tasteful colors
# theme = "Rosé Pine Moon"; # GOOD: dark theme. tasteful colors. but background is a bit intense
# theme = "Sea Shells"; # mediocre. not all color combos are readable
# theme = "Solarized Light"; # mediocre: not-too-harsh light theme; GREAT background; but some colors are low contrast
# theme = "Solarized Dark Higher Contrast"; # better: dark theme, decent colors
# theme = "Sourcerer"; # mediocre: ugly colors
# theme = "Space Gray"; # mediocre: too muted
# theme = "Space Gray Eighties"; # better: all readable, decent colors
# theme = "Spacemacs"; # mediocre: too muted
# theme = "Spring"; # mediocre: readable light theme, but the teal is ugly.
# theme = "Srcery"; # better: highly readable. colors are ehhh
# theme = "Substrata"; # decent: nice colors, but a bit flat.
# theme = "Sundried"; # mediocre: the solar text makes me squint
# theme = "Symfonic"; # mediocre: the dark purple has low contrast to the black bg.
# theme = "Tango Light"; # dislike: teal is too grating
# theme = "Tokyo Night Day"; # medicore: too muted
# theme = "Tokyo Night"; # better: tasteful. a bit flat
# theme = "Tomorrow"; # GOOD: all color combinations are readable. contrast is slightly better than Rose. on the blander side
# theme = "Treehouse"; # dislike: the orange is harsh on my eyes.
# theme = "Urple"; # dislike: weird palette
# theme = "Warm Neon"; # decent: not-too-harsh dark theme. the green is a bit unattractive
# theme = "Wild Cherry"; # GOOD: dark theme: nice colors. a bit flat
# theme = "Xcodedark"; # dislike: bad palette
# theme = "citylights"; # decent: dark theme. some parts have just a bit low contrast
# theme = "neobones_light"; # better light theme. the background is maybe too muted
# theme = "vimbones";
# theme = "zenbones_dark"; # mediocre: readable, but meh colors
# theme = "zenbones_light"; # decent: light theme. all colors are readable. contrast is passable but not excellent. highlight color is BAD
# theme = "zenwritten_dark"; # mediocre: looks same as zenbones_dark
}

View File

@@ -0,0 +1,14 @@
{ sane-lib, ... }:
{
# libreoffice: disable first-run stuff
sane.user.fs.".config/libreoffice/4/user/registrymodifications.xcu" = sane-lib.fs.wantedText ''
<?xml version="1.0" encoding="UTF-8"?>
<oor:items xmlns:oor="http://openoffice.org/2001/registry" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<item oor:path="/org.openoffice.Office.Common/Misc"><prop oor:name="FirstRun" oor:op="fuse"><value>false</value></prop></item>
<item oor:path="/org.openoffice.Office.Common/Misc"><prop oor:name="ShowTipOfTheDay" oor:op="fuse"><value>false</value></prop></item>
</oor:items>
'';
# <item oor:path="/org.openoffice.Setup/Product"><prop oor:name="LastTimeDonateShown" oor:op="fuse"><value>1667693880</value></prop></item>
# <item oor:path="/org.openoffice.Setup/Product"><prop oor:name="LastTimeGetInvolvedShown" oor:op="fuse"><value>1667693880</value></prop></item>
}

View File

@@ -0,0 +1,42 @@
{ config, sane-lib, ...}:
let
www = config.sane.web-browser.browser.desktop;
pdf = "org.gnome.Evince.desktop";
md = "obsidian.desktop";
thumb = "org.gnome.gThumb.desktop";
video = "vlc.desktop";
# audio = "mpv.desktop";
audio = "vlc.desktop";
in
{
# the xdg mime type for a file can be found with:
# - `xdg-mime query filetype path/to/thing.ext`
# we can have single associations or a list of associations.
# there's also options to *remove* [non-default] associations from specific apps
xdg.mime.enable = true;
xdg.mime.defaultApplications = {
# AUDIO
"audio/flac" = audio;
"audio/mpeg" = audio;
"audio/x-vorbis+ogg" = audio;
# IMAGES
"image/heif" = thumb; # apple codec
"image/png" = thumb;
"image/jpeg" = thumb;
# VIDEO
"video/mp4" = video;
"video/quicktime" = video;
"video/x-matroska" = video;
# HTML
"text/html" = www;
"x-scheme-handler/http" = www;
"x-scheme-handler/https" = www;
"x-scheme-handler/about" = www;
"x-scheme-handler/unknown" = www;
# RICH-TEXT DOCUMENTS
"application/pdf" = pdf;
"text/markdown" = md;
};
}

10
hosts/common/home/mpv.nix Normal file
View File

@@ -0,0 +1,10 @@
{ sane-lib, ... }:
{
# format is <key>=%<length>%<value>
sane.user.fs.".config/mpv/mpv.conf" = sane-lib.fs.wantedText ''
save-position-on-quit=%3%yes
keep-open=%3%yes
'';
}

View File

@@ -0,0 +1,129 @@
{ lib, pkgs, ... }:
let
inherit (builtins) map;
inherit (lib) concatMapStrings optionalString;
# this structure roughly mirrors home-manager's `programs.neovim.plugins` option
plugins = with pkgs.vimPlugins; [
# docs: surround-nvim: https://github.com/ur4ltz/surround.nvim/
# docs: vim-surround: https://github.com/tpope/vim-surround
{ plugin = vim-surround; }
# docs: fzf-vim (fuzzy finder): https://github.com/junegunn/fzf.vim
{ plugin = fzf-vim; }
({
# docs: tex-conceal-vim: https://github.com/KeitaNakamura/tex-conceal.vim/
plugin = tex-conceal-vim;
type = "viml";
config = ''
" present prettier fractions
let g:tex_conceal_frac=1
'';
})
({
plugin = vim-SyntaxRange;
type = "viml";
config = ''
" enable markdown-style codeblock highlighting for tex code
autocmd BufEnter * call SyntaxRange#Include('```tex', '```', 'tex', 'NonText')
" autocmd Syntax tex set conceallevel=2
'';
})
({
# treesitter syntax highlighting: https://nixos.wiki/wiki/Tree_sitters
# docs: https://github.com/nvim-treesitter/nvim-treesitter
# config taken from: https://github.com/i077/system/blob/master/modules/home/neovim/default.nix
# this is required for tree-sitter to even highlight
plugin = nvim-treesitter.withAllGrammars;
type = "lua";
config = ''
require'nvim-treesitter.configs'.setup {
highlight = {
enable = true,
-- disable treesitter on Rust so that we can use SyntaxRange
-- and leverage TeX rendering in rust projects
disable = { "rust", "tex", "latex" },
-- disable = { "tex", "latex" },
-- true to also use builtin vim syntax highlighting when treesitter fails
additional_vim_regex_highlighting = false
},
incremental_selection = {
enable = true,
keymaps = {
init_selection = "gnn",
node_incremental = "grn",
mcope_incremental = "grc",
node_decremental = "grm"
}
},
indent = {
enable = true,
disable = {}
}
}
vim.o.foldmethod = 'expr'
vim.o.foldexpr = 'nvim_treesitter#foldexpr()'
'';
})
];
plugin-packages = map (p: p.plugin) plugins;
plugin-config-tex = concatMapStrings (p: optionalString (p.type or "" == "viml") p.config) plugins;
plugin-config-lua = concatMapStrings (p: optionalString (p.type or "" == "lua") p.config) plugins;
in
{
# private because there could be sensitive things in the swap
sane.user.persist.private = [ ".cache/vim-swap" ];
programs.neovim = {
# neovim: https://github.com/neovim/neovim
enable = true;
viAlias = true;
vimAlias = true;
configure = {
packages.myVimPackage = {
start = plugin-packages;
};
customRC = ''
" let the terminal handle mouse events, that way i get OS-level ctrl+shift+c/etc
" this used to be default, until <https://github.com/neovim/neovim/pull/19290>
set mouse=
" copy/paste to system clipboard
set clipboard=unnamedplus
" screw tabs; always expand them into spaces
set expandtab
" at least don't open files with sections folded by default
set nofoldenable
" allow text substitutions for certain glyphs.
" higher number = more aggressive substitution (0, 1, 2, 3)
" i only make use of this for tex, but it's unclear how to
" apply that *just* to tex and retain the SyntaxRange stuff.
set conceallevel=2
" horizontal rule under the active line
" set cursorline
" highlight trailing space & related syntax errors (doesn't seem to work??)
" let c_space_errors=1
" let python_space_errors=1
" enable highlighting of leading/trailing spaces,
" and especially tabs
" source: https://www.reddit.com/r/neovim/comments/chlmfk/highlight_trailing_whitespaces_in_neovim/
set list
set listchars=tab:\·,trail:·,extends:,precedes:,nbsp:
""""" PLUGIN CONFIG (tex)
${plugin-config-tex}
""""" PLUGIN CONFIG (lua)
lua <<EOF
${plugin-config-lua}
EOF
'';
};
};
}

View File

@@ -0,0 +1,12 @@
# news-flash RSS viewer
{ config, sane-lib, ... }:
let
feeds = sane-lib.feeds;
all-feeds = config.sane.feeds;
wanted-feeds = feeds.filterByFormat ["text" "image"] all-feeds;
in {
sane.user.fs.".config/newsflashFeeds.opml" = sane-lib.fs.wantedText (
feeds.feedsToOpml wanted-feeds
);
}

View File

@@ -0,0 +1,19 @@
# borrows from:
# - default config: <https://github.com/cspeterson/splatmoji/blob/master/splatmoji.config>
# - wayland: <https://github.com/cspeterson/splatmoji/issues/32#issuecomment-830862566>
{ pkgs, sane-lib, ... }:
{
sane.user.persist.plaintext = [ ".local/state/splatmoji" ];
sane.user.fs.".config/splatmoji/splatmoji.config" = sane-lib.fs.wantedText ''
history_file=~/.local/state/splatmoji/history
history_length=5
# TODO: wayland equiv
paste_command=xdotool key ctrl+v
# rofi_command=${pkgs.wofi}/bin/wofi --dmenu --insensitive --cache-file /dev/null
rofi_command=${pkgs.fuzzel}/bin/fuzzel -d -i -w 60
xdotool_command=${pkgs.wtype}/bin/wtype
# TODO: wayland equiv
xsel_command=xsel -b -i
'';
}

24
hosts/common/home/ssh.nix Normal file
View File

@@ -0,0 +1,24 @@
{ config, lib, sane-lib, ... }:
with lib;
let
host = config.networking.hostName;
user-pubkey = config.sane.ssh.pubkeys."colin@${host}".asUserKey;
host-keys = filter (k: k.user == "root") (attrValues config.sane.ssh.pubkeys);
known-hosts-text = concatStringsSep
"\n"
(map (k: k.asHostKey) host-keys)
;
in
{
# ssh key is stored in private storage
sane.user.persist.private = [ ".ssh/id_ed25519" ];
sane.user.fs.".ssh/id_ed25519.pub" = sane-lib.fs.wantedText user-pubkey;
sane.user.fs.".ssh/known_hosts" = sane-lib.fs.wantedText known-hosts-text;
users.users.colin.openssh.authorizedKeys.keys =
let
user-keys = filter (k: k.user == "colin") (attrValues config.sane.ssh.pubkeys);
in
map (k: k.asUserKey) user-keys;
}

View File

@@ -0,0 +1,11 @@
{ config, sane-lib, ... }:
{
# TODO: this should only be shipped on gui platforms
sops.secrets."sublime_music_config" = {
owner = config.users.users.colin.name;
sopsFile = ../../../secrets/universal/sublime_music_config.json.bin;
format = "binary";
};
sane.user.fs.".config/sublime-music/config.json" = sane-lib.fs.wantedSymlinkTo config.sops.secrets.sublime_music_config.path;
}

20
hosts/common/home/vlc.nix Normal file
View File

@@ -0,0 +1,20 @@
{ config, lib, sane-lib, ... }:
let
feeds = sane-lib.feeds;
all-feeds = config.sane.feeds;
wanted-feeds = feeds.filterByFormat ["podcast"] all-feeds;
podcast-urls = lib.concatStringsSep "|" (
builtins.map (feed: feed.url) wanted-feeds
);
in
{
sane.user.fs.".config/vlc/vlcrc" = sane-lib.fs.wantedText ''
[podcast]
podcast-urls=${podcast-urls}
[core]
metadata-network-access=0
[qt]
qt-privacy-ask=0
'';
}

View File

@@ -0,0 +1,20 @@
{ lib, sane-lib, ...}:
{
# XDG defines things like ~/Desktop, ~/Downloads, etc.
# these clutter the home, so i mostly don't use them.
sane.user.fs.".config/user-dirs.dirs" = sane-lib.fs.wantedText ''
XDG_DESKTOP_DIR="$HOME/.xdg/Desktop"
XDG_DOCUMENTS_DIR="$HOME/dev"
XDG_DOWNLOAD_DIR="$HOME/tmp"
XDG_MUSIC_DIR="$HOME/Music"
XDG_PICTURES_DIR="$HOME/Pictures"
XDG_PUBLICSHARE_DIR="$HOME/.xdg/Public"
XDG_TEMPLATES_DIR="$HOME/.xdg/Templates"
XDG_VIDEOS_DIR="$HOME/Videos"
'';
# prevent `xdg-user-dirs-update` from overriding/updating our config
# see <https://manpages.ubuntu.com/manpages/bionic/man5/user-dirs.conf.5.html>
sane.user.fs.".config/user-dirs.conf" = sane-lib.fs.wantedText "enabled=False";
}

View File

@@ -0,0 +1,143 @@
{ pkgs, sane-lib, ... }:
let
# powerlevel10k prompt config
# p10k.zsh is the auto-generated config, and i overwrite those defaults here, below.
p10k-overrides = ''
# powerlevel10k launches a gitstatusd daemon to accelerate git prompt queries.
# this keeps open file handles for any git repo i touch for 60 minutes (by default).
# that prevents unmounting whatever device the git repo is on -- particularly problematic for ~/private.
# i can disable gitstatusd and get slower fallback git queries:
# - either universally
# - or selectively by path
# see: <https://github.com/romkatv/powerlevel10k/issues/246>
typeset -g POWERLEVEL9K_VCS_DISABLED_DIR_PATTERN='(/home/colin/private/*|/home/colin/knowledge/*)'
# typeset -g POWERLEVEL9K_DISABLE_GITSTATUS=true
# show user@host also when logged into the current machine.
# default behavior is to show it only over ssh.
typeset -g POWERLEVEL9K_CONTEXT_{DEFAULT,SUDO}_CONTENT_EXPANSION='$P9K_CONTENT'
'';
prezto-init = ''
source ${pkgs.zsh-autosuggestions}/share/zsh-autosuggestions/zsh-autosuggestions.zsh
source ${pkgs.zsh-syntax-highlighting}/share/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh
source ${pkgs.zsh-prezto}/share/zsh-prezto/init.zsh
'';
in
{
sane.user.persist.plaintext = [
# we don't need to full zsh dir -- just the history file --
# but zsh will sometimes backup the history file and we get fewer errors if we do proper mounts instead of symlinks.
# TODO: should be private?
".local/share/zsh"
# cache gitstatus otherwise p10k fetched it from the net EVERY BOOT
".cache/gitstatus"
];
# zsh/prezto complains if zshrc doesn't exist; but it does allow an "empty" file.
sane.user.fs.".config/zsh/.zshrc" = sane-lib.fs.wantedText "# ";
# enable zsh completions
environment.pathsToLink = [ "/share/zsh" ];
programs.zsh = {
enable = true;
histFile = "$HOME/.local/share/zsh/history";
shellAliases = {
":q" = "exit";
# common typos
"cd.." = "cd ..";
"cd../" = "cd ../";
};
setOptions = [
# defaults:
"HIST_IGNORE_DUPS"
"SHARE_HISTORY"
"HIST_FCNTL_LOCK"
# disable `rm *` confirmations
"rmstarsilent"
];
# .zshenv config:
shellInit = ''
ZDOTDIR=$HOME/.config/zsh
'';
# .zshrc config:
interactiveShellInit =
(builtins.readFile ./p10k.zsh)
+ p10k-overrides
+ prezto-init
+ ''
# zmv is a way to do rich moves/renames, with pattern matching/substitution.
# see for an example: <https://filipe.kiss.ink/zmv-zsh-rename/>
autoload -Uz zmv
HISTORY_IGNORE='(sane-shutdown *|sane-reboot *|rm *)'
# extra aliases
# TODO: move to `shellAliases` config?
function nd() {
mkdir -p "$1";
pushd "$1";
}
# auto-cd into any of these dirs by typing them and pressing 'enter':
hash -d 3rd="/home/colin/dev/3rd"
hash -d dev="/home/colin/dev"
hash -d knowledge="/home/colin/knowledge"
hash -d nixos="/home/colin/nixos"
hash -d nixpkgs="/home/colin/dev/3rd/nixpkgs"
hash -d ref="/home/colin/ref"
hash -d secrets="/home/colin/knowledge/secrets"
hash -d tmp="/home/colin/tmp"
hash -d uninsane="/home/colin/dev/uninsane"
hash -d Videos="/home/colin/Videos"
'';
syntaxHighlighting.enable = true;
vteIntegration = true;
};
# enable a command-not-found hook to show nix packages that might provide the binary typed.
programs.nix-index.enable = true;
programs.command-not-found.enable = false; #< mutually exclusive with nix-index
# prezto = oh-my-zsh fork; controls prompt, auto-completion, etc.
# see: https://github.com/sorin-ionescu/prezto
# i believe this file is auto-sourced by the prezto init.zsh script.
sane.user.fs.".config/zsh/.zpreztorc" = sane-lib.fs.wantedText ''
zstyle ':prezto:*:*' color 'yes'
# modules (they ship with prezto):
# ENVIRONMENT: configures jobs to persist after shell exit; other basic niceties
# TERMINAL: auto-titles terminal (e.g. based on cwd)
# EDITOR: configures shortcuts like Ctrl+U=undo, Ctrl+L=clear
# HISTORY: `history-stat` alias, setopts for good history defaults
# DIRECTORY: sets AUTO_CD, adds `d` alias to list directory stack, and `1`-`9` to cd that far back the stack
# SPECTRUM: helpers for term colors and styling. used by prompts? might be unnecessary
# UTILITY: configures aliases like `ll`, `la`, disables globbing for things like rsync
# adds aliases like `get` to fetch a file. also adds `http-serve` alias??
# COMPLETION: tab completion. requires `utility` module prior to loading
# TODO: enable AUTO_PARAM_SLASH
zstyle ':prezto:load' pmodule \
'environment' \
'terminal' \
'editor' \
'history' \
'directory' \
'spectrum' \
'utility' \
'completion' \
'prompt'
# default keymap. try also `vicmd` (vim normal mode, AKA "cmd mode") or `vi`.
zstyle ':prezto:module:editor' key-bindings 'emacs'
zstyle ':prezto:module:prompt' theme 'powerlevel10k'
# disable `mv` confirmation (and `rm`, too, unfortunately)
zstyle ':prezto:module:utility' safe-ops 'no'
'';
}

File diff suppressed because it is too large Load Diff

4
hosts/common/i2p.nix Normal file
View File

@@ -0,0 +1,4 @@
{ ... }:
{
# services.i2p.enable = true;
}

66
hosts/common/ids.nix Normal file
View File

@@ -0,0 +1,66 @@
{ ... }:
{
# legacy servo users, some are inconvenient to migrate
sane.ids.dhcpcd.gid = 991;
sane.ids.dhcpcd.uid = 992;
sane.ids.gitea.gid = 993;
sane.ids.git.uid = 994;
sane.ids.jellyfin.gid = 994;
sane.ids.pleroma.gid = 995;
sane.ids.jellyfin.uid = 996;
sane.ids.acme.gid = 996;
sane.ids.pleroma.uid = 997;
sane.ids.acme.uid = 998;
# greetd (used by sway)
sane.ids.greeter.uid = 999;
sane.ids.greeter.gid = 999;
# new servo users
sane.ids.freshrss.uid = 2401;
sane.ids.freshrss.gid = 2401;
sane.ids.mediawiki.uid = 2402;
sane.ids.signald.uid = 2403;
sane.ids.signald.gid = 2403;
sane.ids.mautrix-signal.uid = 2404;
sane.ids.mautrix-signal.gid = 2404;
sane.ids.navidrome.uid = 2405;
sane.ids.navidrome.gid = 2405;
sane.ids.colin.uid = 1000;
sane.ids.guest.uid = 1100;
# found on all hosts
sane.ids.sshd.uid = 2001; # 997
sane.ids.sshd.gid = 2001; # 997
sane.ids.polkituser.gid = 2002; # 998
sane.ids.systemd-coredump.gid = 2003; # 996
sane.ids.nscd.uid = 2004;
sane.ids.nscd.gid = 2004;
sane.ids.systemd-oom.uid = 2005;
sane.ids.systemd-oom.gid = 2005;
# found on graphical hosts
sane.ids.nm-iodine.uid = 2101; # desko/moby/lappy
# found on desko host
# from services.usbmuxd
sane.ids.usbmux.uid = 2204;
sane.ids.usbmux.gid = 2204;
# originally found on moby host
# gnome core-shell
sane.ids.avahi.uid = 2304;
sane.ids.avahi.gid = 2304;
sane.ids.colord.uid = 2305;
sane.ids.colord.gid = 2305;
sane.ids.geoclue.uid = 2306;
sane.ids.geoclue.gid = 2306;
# gnome core-os-services
sane.ids.rtkit.uid = 2307;
sane.ids.rtkit.gid = 2307;
# phosh
sane.ids.feedbackd.gid = 2308;
}

View File

@@ -0,0 +1,16 @@
{ ... }:
{
# /etc/machine-id is a globally unique identifier used for:
# - systemd-networkd: DHCP lease renewal (instead of keying by the MAC address)
# - systemd-journald: to filter logs by host
# - chromium (potentially to track re-installations)
# - gdbus; system services that might upgrade to AF_LOCAL if both services can confirm they're on the same machine
# because of e.g. the chromium use, we *don't want* to persist this.
# however, `journalctl` won't show logs from previous boots unless the machine-ids match.
# so for now, generate something unique from the host ssh key.
# TODO: move this into modules?
system.activationScripts.machine-id = {
deps = [ "etc" ];
text = "sha256sum /etc/ssh/host_keys/ssh_host_ed25519_key | cut -c 1-32 > /etc/machine-id";
};
}

23
hosts/common/net.nix Normal file
View File

@@ -0,0 +1,23 @@
{ config, lib, pkgs, ... }:
{
# the default backend is "wpa_supplicant".
# wpa_supplicant reliably picks weak APs to connect to.
# see: <https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/474>
# iwd is an alternative that shouldn't have this problem
# docs:
# - <https://nixos.wiki/wiki/Iwd>
# - <https://iwd.wiki.kernel.org/networkmanager>
# - `man iwd.config` for global config
# - `man iwd.network` for per-SSID config
# use `iwctl` to control
networking.networkmanager.wifi.backend = "iwd";
networking.wireless.iwd.enable = true;
networking.wireless.iwd.settings = {
# auto-connect to a stronger network if signal drops below this value
# bedroom -> bedroom connection is -35 to -40 dBm
# bedroom -> living room connection is -60 dBm
General.RoamThreshold = "-52"; # default -70
General.RoamThreshold5G = "-52"; # default -76
};
}

18
hosts/common/persist.nix Normal file
View File

@@ -0,0 +1,18 @@
{ ... }:
{
sane.persist.stores.private.origin = "/home/colin/private";
# store /home/colin/a/b in /home/private/a/b instead of /home/private/home/colin/a/b
sane.persist.stores.private.prefix = "/home/colin";
sane.persist.sys.plaintext = [
"/var/log"
"/var/backup" # for e.g. postgres dumps
# TODO: move elsewhere
"/var/lib/alsa" # preserve output levels, default devices
"/var/lib/colord" # preserve color calibrations (?)
"/var/lib/machines" # maybe not needed, but would be painful to add a VM and forget.
"/var/lib/systemd/backlight" # backlight brightness
"/var/lib/systemd/coredump"
];
}

340
hosts/common/programs.nix Normal file
View File

@@ -0,0 +1,340 @@
{ lib, pkgs, ... }:
let
inherit (builtins) attrNames concatLists;
inherit (lib) mapAttrs mapAttrsToList mkDefault mkMerge optional;
flattenedPkgs = pkgs // (with pkgs; {
# XXX can't `inherit` a nested attr, so we move them to the toplevel
"cacert.unbundled" = pkgs.cacert.unbundled;
"gnome.cheese" = gnome.cheese;
"gnome.dconf-editor" = gnome.dconf-editor;
"gnome.file-roller" = gnome.file-roller;
"gnome.gnome-disk-utility" = gnome.gnome-disk-utility;
"gnome.gnome-maps" = gnome.gnome-maps;
"gnome.nautilus" = gnome.nautilus;
"gnome.gnome-system-monitor" = gnome.gnome-system-monitor;
"gnome.gnome-terminal" = gnome.gnome-terminal;
"gnome.gnome-weather" = gnome.gnome-weather;
"libsForQt5.plasmatube" = libsForQt5.plasmatube;
});
sysadminPkgs = {
inherit (flattenedPkgs)
btrfs-progs
"cacert.unbundled" # some services require unbundled /etc/ssl/certs
cryptsetup
dig
efibootmgr
fatresize
fd
file
gawk
git
gptfdisk
hdparm
htop
iftop
inetutils # for telnet
iotop
iptables
jq
killall
lsof
nano
netcat
nethogs
nmap
openssl
parted
pciutils
powertop
pstree
ripgrep
screen
smartmontools
socat
strace
tcpdump
tree
usbutils
wget
;
};
# TODO: split these into smaller groups.
# - iphone utils (libimobiledevice, ifuse) only wanted on desko, maybe lappy
# - transcoders (ffmpeg, imagemagick) only wanted on desko/lappy
consolePkgs = {
inherit (pkgs)
aerc # email client
# backblaze-b2 # TODO: put into the same package set as duplicity
cdrtools
dmidecode
# duplicity # TODO: enable as part of some smaller package set
efivar
flashrom
fwupd
ghostscript # TODO: imagemagick wrapper should add gs to PATH
gnupg
gocryptfs
gopass
gopass-jsonapi
ifuse
imagemagick
ipfs
kitty # TODO: move to GUI, but `ssh servo` from kitty sets `TERM=xterm-kitty` in the remove and breaks things
libimobiledevice
libsecret # for managing user keyrings
lm_sensors # for sensors-detect
lshw
ffmpeg
memtester
networkmanager
nixpkgs-review
# nixos-generators
# nettools
nmon
oathToolkit # for oathtool
# ponymix
pulsemixer
python3
rsync
# python3Packages.eyeD3 # music tagging
sane-scripts
sequoia
snapper
sops
sox
speedtest-cli
sqlite # to debug sqlite3 databases
ssh-to-age
sudo
# tageditor # music tagging
unar
visidata
w3m
wireguard-tools
xdg-utils # for xdg-open
# youtube-dl
yt-dlp
;
};
guiPkgs = {
inherit (flattenedPkgs)
celluloid # mpv frontend
clinfo
emote
evince # works on phosh
# { pkg = fluffychat-moby; dir = [ ".local/share/chat.fluffy.fluffychat" ]; } # TODO: ship normal fluffychat on non-moby?
# foliate # e-book reader
# XXX by default fractal stores its state in ~/.local/share/<UUID>.
# after logging in, manually change ~/.local/share/keyrings/... to point it to some predictable subdir.
# then reboot (so that libsecret daemon re-loads the keyring...?)
# { pkg = fractal-latest; private = [ ".local/share/fractal" ]; }
# { pkg = fractal-next; private = [ ".local/share/fractal" ]; }
# "gnome.cheese"
"gnome.dconf-editor"
gnome-feeds # RSS reader (with claimed mobile support)
"gnome.file-roller"
# "gnome.gnome-maps" # works on phosh
"gnome.nautilus"
# gnome-podcasts
"gnome.gnome-system-monitor"
"gnome.gnome-terminal" # works on phosh
"gnome.gnome-weather"
gpodder-configured
gthumb
# lollypop
mpv
networkmanagerapplet
# newsflash
nheko
pavucontrol
# picard # music tagging
playerctl
# "libsForQt5.plasmatube" # Youtube player
soundconverter
# sublime music persists any downloaded albums here.
# it doesn't obey a conventional ~/Music/{Artist}/{Album}/{Track} notation, so no symlinking
# config (e.g. server connection details) is persisted in ~/.config/sublime-music/config.json
# possible to pass config as a CLI arg (sublime-music -c config.json)
# { pkg = sublime-music; dir = [ ".local/share/sublime-music" ]; }
sublime-music-mobile
# tdesktop # broken on phosh
# tokodon
vlc
# pleroma client (Electron). input is broken on phosh. TODO(2023/02/02): fix electron19 input (insecure)
# whalebird
xterm # broken on phosh
;
};
desktopGuiPkgs = {
inherit (flattenedPkgs)
audacity
chromium
dino
electrum
element-desktop
font-manager
gajim # XMPP client
gimp # broken on phosh
"gnome.gnome-disk-utility"
inkscape
kdenlive
kid3 # audio tagging
krita
libreoffice-fresh # XXX colin: maybe don't want this on mobile
obsidian
;
};
x86GuiPkgs = {
inherit (pkgs)
discord
# kaiteki # Pleroma client
# gnome.zenity # for kaiteki (it will use qarma, kdialog, or zenity)
# gpt2tc # XXX: unreliable mirror
# TODO(unpin): handbrake is broken on aarch64-linux 2023/01/29
handbrake
logseq
losslesscut-bin
makemkv
monero-gui
signal-desktop
spotify
tor-browser-bundle-bin
zecwallet-lite
;
};
# define -- but don't enable -- the packages in some attrset.
# use `mkDefault` for the package here so we can customize some of them further down this file
declarePkgs = pkgsAsAttrs: mapAttrs (_n: p: {
package = mkDefault p;
}) pkgsAsAttrs;
in
{
config = {
sane.programs = mkMerge [
(declarePkgs sysadminPkgs)
(declarePkgs consolePkgs)
(declarePkgs guiPkgs)
(declarePkgs desktopGuiPkgs)
(declarePkgs x86GuiPkgs)
{
# link the various package sets into their own meta packages
sysadminUtils = {
package = null;
suggestedPrograms = attrNames sysadminPkgs;
};
consoleUtils = {
package = null;
suggestedPrograms = attrNames consolePkgs;
};
guiApps = {
package = null;
suggestedPrograms = (attrNames guiPkgs)
++ optional (pkgs.system == "x86_64-linux") "x86GuiApps";
};
desktopGuiApps = {
package = null;
suggestedPrograms = attrNames desktopGuiPkgs;
};
x86GuiApps = {
package = null;
suggestedPrograms = attrNames x86GuiPkgs;
};
}
{
# nontrivial package definitions
imagemagick.package = pkgs.imagemagick.override {
ghostscriptSupport = true;
};
dino.private = [ ".local/share/dino" ];
# creds, but also 200 MB of node modules, etc
discord = {
package = pkgs.discord.override {
# XXX 2022-07-31: fix to allow links to open in default web-browser:
# https://github.com/NixOS/nixpkgs/issues/78961
nss = pkgs.nss_latest;
};
private = [ ".config/discord" ];
};
# creds/session keys, etc
element-desktop.private = [ ".config/Element" ];
# `emote` will show a first-run dialog based on what's in this directory.
# mostly, it just keeps a LRU of previously-used emotes to optimize display order.
# TODO: package [smile](https://github.com/mijorus/smile) for probably a better mobile experience.
emote.dir = [ ".local/share/Emote" ];
# XXX: we preserve the whole thing because if we only preserve gPodder/Downloads
# then startup is SLOW during feed import, and we might end up with zombie eps in the dl dir.
gpodder-configured.dir = [ "gPodder" ];
# actual monero blockchain (not wallet/etc; safe to delete, just slow to regenerate)
# XXX: is it really safe to persist this? it doesn't have info that could de-anonymize if captured?
monero-gui.dir = [ ".bitmonero" ];
mpv.dir = [ ".config/mpv/watch_later" ];
# not strictly necessary, but allows caching articles; offline use, etc.
newsflash.dir = [ ".local/share/news-flash" ];
nheko.private = [
".config/nheko" # config file (including client token)
".cache/nheko" # media cache
".local/share/nheko" # per-account state database
];
# settings (electron app)
obsidian.dir = [ ".config/obsidian" ];
# creds, media
signal-desktop.private = [ ".config/Signal" ];
# creds, widevine .so download. TODO: could easily manage these statically.
spotify.dir = [ ".config/spotify" ];
# sublime music persists any downloaded albums here.
# it doesn't obey a conventional ~/Music/{Artist}/{Album}/{Track} notation, so no symlinking
# config (e.g. server connection details) is persisted in ~/.config/sublime-music/config.json
# possible to pass config as a CLI arg (sublime-music -c config.json)
# { pkg = sublime-music; dir = [ ".local/share/sublime-music" ]; }
sublime-music-mobile.dir = [ ".local/share/sublime-music" ];
tdesktop.private = [ ".local/share/TelegramDesktop" ];
tokodon.private = [ ".cache/KDE/tokodon" ];
# hardenedMalloc solves a crash at startup
# TODO 2023/02/02: is this safe to remove yet?
tor-browser-bundle-bin.package = pkgs.tor-browser-bundle-bin.override {
useHardenedMalloc = false;
};
# vlc remembers play position in ~/.config/vlc/vlc-qt-interface.conf
vlc.dir = [ ".config/vlc" ];
whalebird.private = [ ".config/Whalebird" ];
# zcash coins. safe to delete, just slow to regenerate (10-60 minutes)
zecwallet-lite.private = [ ".zcash" ];
}
];
# XXX: this might not be necessary. try removing this and cacert.unbundled (servo)?
environment.etc."ssl/certs".source = "${pkgs.cacert.unbundled}/etc/ssl/certs/*";
};
}

124
hosts/common/secrets.nix Normal file
View File

@@ -0,0 +1,124 @@
{ config, ... }:
{
# SOPS configuration:
# docs: https://github.com/Mic92/sops-nix
#
# for each new user you want to edit sops files:
# create a private age key from ssh key:
# $ mkdir -p ~/.config/sops/age; ssh-to-age -private-key -i ~/.ssh/id_ed25519 > ~/.config/sops/age/keys.txt; chmod 600 ~/.config/sops/age/keys.txt
# if the private key was password protected, then first decrypt it:
# $ cp ~/.ssh/id_ed25519 /tmp/id_ed25519
# $ ssh-keygen -p -N "" -f /tmp/id_ed25519
#
# for each user you want to decrypt secrets:
# $ cat ~/.ssh/id_ed25519.pub | ssh-to-age
# add the result to .sops.yaml
# since we specify ssh pubkeys in the nix config, you can just grep for `ssh-ed25519` here and use those instead
#
# for each host you want to decrypt secrets:
# $ cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age
# add the result to .sops.yaml
# $ sops updatekeys secrets/example.yaml
#
# to create a new secret:
# $ sops secrets/example.yaml
# control access below (sops.secret.<x>.owner = ...)
#
# to read a secret:
# $ cat /run/secrets/example_key
# sops.age.sshKeyPaths = [ "/home/colin/.ssh/id_ed25519_dec" ];
# This will add secrets.yaml to the nix store
# You can avoid this by adding a string to the full path instead, i.e.
# sops.defaultSopsFile = "/root/.sops/secrets/example.yaml";
sops.defaultSopsFile = ../../secrets/universal.yaml;
sops.gnupg.sshKeyPaths = []; # disable RSA key import
# This is using an age key that is expected to already be in the filesystem
# sops.age.keyFile = "/home/colin/.ssh/age.pub";
# sops.age.keyFile = "/var/lib/sops-nix/key.txt";
# This will generate a new key if the key specified above does not exist
# sops.age.generateKey = true;
# This is the actual specification of the secrets.
# sops.secrets.example_key = {
# owner = config.users.users.colin.name;
# };
# sops.secrets."myservice/my_subdir/my_secret" = {};
## universal secrets
# TODO: glob these?
sops.secrets."jackett_apikey" = {
sopsFile = ../../secrets/universal.yaml;
owner = config.users.users.colin.name;
};
sops.secrets."router_passwd" = {
sopsFile = ../../secrets/universal.yaml;
};
sops.secrets."wg_ovpnd_us_privkey" = {
sopsFile = ../../secrets/universal.yaml;
};
sops.secrets."wg_ovpnd_us-atl_privkey" = {
sopsFile = ../../secrets/universal.yaml;
};
sops.secrets."wg_ovpnd_us-mi_privkey" = {
sopsFile = ../../secrets/universal.yaml;
};
sops.secrets."wg_ovpnd_ukr_privkey" = {
sopsFile = ../../secrets/universal.yaml;
};
sops.secrets."snippets" = {
sopsFile = ../../secrets/universal/snippets.bin;
format = "binary";
owner = config.users.users.colin.name;
};
sops.secrets."bt/car" = {
sopsFile = ../../secrets/universal/bt/car.bin;
format = "binary";
};
sops.secrets."bt/earbuds" = {
sopsFile = ../../secrets/universal/bt/earbuds.bin;
format = "binary";
};
sops.secrets."bt/portable-speaker" = {
sopsFile = ../../secrets/universal/bt/portable-speaker.bin;
format = "binary";
};
sops.secrets."iwd/community-university.psk" = {
sopsFile = ../../secrets/universal/net/community-university.psk.bin;
format = "binary";
};
sops.secrets."iwd/friend-libertarian-dod.psk" = {
sopsFile = ../../secrets/universal/net/friend-libertarian-dod.psk.bin;
format = "binary";
};
sops.secrets."iwd/friend-rationalist-empathist.psk" = {
sopsFile = ../../secrets/universal/net/friend-rationalist-empathist.psk.bin;
format = "binary";
};
sops.secrets."iwd/home-bedroom.psk" = {
sopsFile = ../../secrets/universal/net/home-bedroom.psk.bin;
format = "binary";
};
sops.secrets."iwd/home-shared-24G.psk" = {
sopsFile = ../../secrets/universal/net/home-shared-24G.psk.bin;
format = "binary";
};
sops.secrets."iwd/home-shared.psk" = {
sopsFile = ../../secrets/universal/net/home-shared.psk.bin;
format = "binary";
};
sops.secrets."iwd/iphone" = {
sopsFile = ../../secrets/universal/net/iphone.psk.bin;
format = "binary";
};
sops.secrets."iwd/parents" = {
sopsFile = ../../secrets/universal/net/parents.psk.bin;
format = "binary";
};
}

33
hosts/common/ssh.nix Normal file
View File

@@ -0,0 +1,33 @@
{ config, lib, sane-data, sane-lib, ... }:
let
inherit (builtins) head map mapAttrs tail;
inherit (lib) concatStringsSep mkMerge reverseList;
in
{
sane.ssh.pubkeys =
let
# path is a DNS-style path like [ "org" "uninsane" "root" ]
keyNameForPath = path:
let
rev = reverseList path;
name = head rev;
host = concatStringsSep "." (tail rev);
in
"${name}@${host}";
# [{ path :: [String], value :: String }] for the keys we want to install
globalKeys = sane-lib.flattenAttrs sane-data.keys;
domainKeys = sane-lib.flattenAttrs (
mapAttrs (host: cfg: {
colin = cfg.ssh.user_pubkey;
root = cfg.ssh.host_pubkey;
}) config.sane.hosts.by-name
);
in mkMerge (map
({ path, value }: {
"${keyNameForPath path}" = lib.mkIf (value != null) value;
})
(globalKeys ++ domainKeys)
);
}

136
hosts/common/users.nix Normal file
View File

@@ -0,0 +1,136 @@
{ config, pkgs, lib, sane-lib, ... }:
# installer docs: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/profiles/installation-device.nix
with lib;
let
cfg = config.sane.guest;
fs = sane-lib.fs;
in
{
options = {
sane.guest.enable = mkOption {
default = false;
type = types.bool;
};
};
config = {
# Users are exactly these specified here;
# old ones will be deleted (from /etc/passwd, etc) upon upgrade.
users.mutableUsers = false;
# docs: https://nixpkgs-manual-sphinx-markedown-example.netlify.app/generated/options-db.xml.html#users-users
users.users.colin = {
# sets group to "users" (?)
isNormalUser = true;
home = "/home/colin";
createHome = true;
homeMode = "0700";
# i don't get exactly what this is, but nixos defaults to this non-deterministically
# in /var/lib/nixos/auto-subuid-map and i don't want that.
subUidRanges = [
{ startUid=100000; count=1; }
];
group = "users";
extraGroups = [
"wheel"
"nixbuild"
"networkmanager"
# phosh/mobile. XXX colin: unsure if necessary
"video"
"feedbackd"
"dialout" # required for modem access
];
# initial password is empty, in case anything goes wrong.
# if `colin-passwd` (a password hash) is successfully found/decrypted, that becomes the password at boot.
initialPassword = lib.mkDefault "";
passwordFile = lib.mkIf (config.sops.secrets ? "colin-passwd") config.sops.secrets.colin-passwd.path;
shell = pkgs.zsh;
# mount encrypted stuff at login
# some other nix pam users:
# - <https://github.com/g00pix/nixconf/blob/32c04f6fa843fed97639dd3f09e157668d3eea1f/profiles/sshfs.nix>
# - <https://github.com/lourkeur/distro/blob/11173454c6bb50f7ccab28cc2c757dca21446d1d/nixos/profiles/users/louis-full.nix>
# - <https://github.com/dnr/sample-nix-code/blob/03494480c1fae550c033aa54fd96aeb3827761c5/nixos/laptop.nix>
pamMount = let
priv = config.fileSystems."/home/colin/private";
in {
fstype = priv.fsType;
path = priv.device;
mountpoint = priv.mountPoint;
options = builtins.concatStringsSep "," priv.options;
};
};
security.pam.mount.enable = true;
sane.users.colin.default = true;
# ensure ~ perms are known to sane.fs module.
# TODO: this is generic enough to be lifted up into sane.fs itself.
sane.fs."/home/colin".dir.acl = {
user = "colin";
group = config.users.users.colin.group;
mode = config.users.users.colin.homeMode;
};
sane.user.persist.plaintext = [
"archive"
"dev"
# TODO: records should be private
"records"
"ref"
"tmp"
"use"
"Music"
"Pictures"
"Videos"
".cache/nix"
".cache/nix-index"
# ".cargo"
# ".rustup"
];
# convenience
sane.user.fs."knowledge" = fs.wantedSymlinkTo "private/knowledge";
sane.user.fs."nixos" = fs.wantedSymlinkTo "dev/nixos";
sane.user.fs."Videos/servo" = fs.wantedSymlinkTo "/mnt/servo-media/Videos";
sane.user.fs."Videos/servo-incomplete" = fs.wantedSymlinkTo "/mnt/servo-media/incomplete";
sane.user.fs."Music/servo" = fs.wantedSymlinkTo "/mnt/servo-media/Music";
# used by password managers, e.g. unix `pass`
sane.user.fs.".password-store" = fs.wantedSymlinkTo "knowledge/secrets/accounts";
sane.persist.sys.plaintext = mkIf cfg.enable [
# intentionally allow other users to write to the guest folder
{ directory = "/home/guest"; user = "guest"; group = "users"; mode = "0775"; }
];
users.users.guest = mkIf cfg.enable {
isNormalUser = true;
home = "/home/guest";
subUidRanges = [
{ startUid=200000; count=1; }
];
group = "users";
initialPassword = lib.mkDefault "";
shell = pkgs.zsh;
openssh.authorizedKeys.keys = [
# TODO: insert pubkeys that should be allowed in
];
};
security.sudo = {
enable = true;
wheelNeedsPassword = false;
};
services.openssh = {
enable = true;
settings.PermitRootLogin = "no";
settings.PasswordAuthentication = false;
};
};
}

66
hosts/common/vpn.nix Normal file
View File

@@ -0,0 +1,66 @@
{ config, lib, ... }:
# to add a new OVPN VPN:
# - generate a privkey `wg genkey`
# - add this key to `sops secrets/universal.yaml`
# - upload pubkey to OVPN.com
# - generate config @ OVPN.com
# - copy the Address, PublicKey, Endpoint from OVPN's config
# N.B.: maximum interface name in Linux is 15 characters.
let
def-ovpn = name: { endpoint, publicKey, address }: {
networking.wg-quick.interfaces."ovpnd-${name}" = {
inherit address;
privateKeyFile = config.sops.secrets."wg_ovpnd_${name}_privkey".path;
dns = [
"46.227.67.134"
"192.165.9.158"
];
peers = [
{
allowedIPs = [
"0.0.0.0/0"
"::/0"
];
inherit endpoint publicKey;
}
];
# to start: `systemctl start wg-quick-ovpnd-${name}`
autostart = false;
};
};
in lib.mkMerge [
(def-ovpn "us" {
endpoint = "vpn31.prd.losangeles.ovpn.com:9929";
publicKey = "VW6bEWMOlOneta1bf6YFE25N/oMGh1E1UFBCfyggd0k=";
address = [
"172.27.237.218/32"
"fd00:0000:1337:cafe:1111:1111:ab00:4c8f/128"
];
})
# NB: us-* share the same wg key and link-local addrs, but distinct public addresses
(def-ovpn "us-atl" {
endpoint = "vpn18.prd.atlanta.ovpn.com:9929";
publicKey = "Dpg/4v5s9u0YbrXukfrMpkA+XQqKIFpf8ZFgyw0IkE0=";
address = [
"172.21.182.178/32"
"fd00:0000:1337:cafe:1111:1111:cfcb:27e3/128"
];
})
(def-ovpn "us-mi" {
endpoint = "vpn34.prd.miami.ovpn.com:9929";
publicKey = "VtJz2irbu8mdkIQvzlsYhU+k9d55or9mx4A2a14t0V0=";
address = [
"172.21.182.178/32"
"fd00:0000:1337:cafe:1111:1111:cfcb:27e3/128"
];
})
(def-ovpn "ukr" {
endpoint = "vpn96.prd.kyiv.ovpn.com:9929";
publicKey = "CjZcXDxaaKpW8b5As1EcNbI6+42A6BjWahwXDCwfVFg=";
address = [
"172.18.180.159/32"
"fd00:0000:1337:cafe:1111:1111:ec5c:add3/128"
];
})
]

27
hosts/instantiate.nix Normal file
View File

@@ -0,0 +1,27 @@
# trampoline from flake.nix into the specific host definition, while doing a tiny bit of common setup
# args from flake-level `import`
{ hostName, localSystem }:
# module args
{ config, ... }:
{
imports = [
./by-name/${hostName}
./common
./modules
];
networking.hostName = hostName;
nixpkgs.overlays = [
(next: prev: {
# for local != target we by default just emulate the target while building.
# provide a `pkgs.cross.<pkg>` alias that consumers can use instead of `pkgs.<foo>`
# to explicitly opt into non-emulated cross compilation for any specific package.
# this is most beneficial for large packages with few pre-requisites -- like Linux.
cross = prev.crossFrom."${localSystem}";
})
];
}

15
hosts/modules/default.nix Normal file
View File

@@ -0,0 +1,15 @@
{ ... }:
{
imports = [
./derived-secrets.nix
./gui
./hardware
./hostnames.nix
./hosts.nix
./nixcache.nix
./roles
./services
./wg-home.nix
];
}

View File

@@ -0,0 +1,47 @@
{ config, lib, ... }:
let
inherit (builtins) toString;
inherit (lib) mapAttrs mkOption types;
cfg = config.sane.derived-secrets;
secret = types.submodule {
options = {
len = mkOption {
type = types.int;
};
encoding = mkOption {
type = types.enum [ "base64" ];
};
};
};
in
{
options = {
sane.derived-secrets = mkOption {
type = types.attrsOf secret;
default = {};
description = ''
fs path => secret options.
for each entry, we create an item at the given path whose value is deterministic,
but also pseudo-random and not predictable by anyone without root access to the machine.
as PRNG source we use the host ssh key, and derived secrets are salted based on the destination path.
'';
};
};
config = {
sane.fs = mapAttrs (path: c: {
generated.script.script = ''
echo "$1" | cat /dev/stdin /etc/ssh/host_keys/ssh_host_ed25519_key \
| sha512sum \
| cut -c 1-${toString (c.len * 2)} \
| tr a-z A-Z \
| basenc -d --base16 \
| basenc --${c.encoding} \
> "$1"
'';
generated.script.scriptArgs = [ path ];
generated.acl.mode = "0600";
}) cfg;
};
}

View File

@@ -0,0 +1,15 @@
{ lib, config, ... }:
let
inherit (lib) mkDefault mkIf mkOption types;
cfg = config.sane.gui;
in
{
imports = [
./gnome.nix
./phosh.nix
./plasma.nix
./plasma-mobile.nix
./sway.nix
];
}

View File

@@ -13,16 +13,7 @@ in
};
config = mkIf cfg.enable {
sane.gui.enable = true;
users.users.avahi.uid = config.sane.allocations.avahi-uid;
users.groups.avahi.gid = config.sane.allocations.avahi-gid;
users.users.colord.uid = config.sane.allocations.colord-uid;
users.groups.colord.gid = config.sane.allocations.colord-gid;
users.users.geoclue.uid = config.sane.allocations.geoclue-uid;
users.groups.geoclue.gid = config.sane.allocations.geoclue-gid;
users.users.rtkit.uid = config.sane.allocations.rtkit-uid;
users.groups.rtkit.gid = config.sane.allocations.rtkit-gid;
sane.programs.guiApps.enableFor.user.colin = true;
# start gnome/gdm on boot
services.xserver.enable = true;
@@ -34,7 +25,7 @@ in
networking.networkmanager.enable = true;
networking.wireless.enable = lib.mkForce false;
};
# home-mananger.users.colin extras
# user extras:
# obtain these by running `dconf dump /` after manually customizing gnome
# TODO: fix "is not of type `GVariant value'"
# dconf.settings = lib.mkIf (gui == "gnome") {

155
hosts/modules/gui/phosh.nix Normal file
View File

@@ -0,0 +1,155 @@
{ lib, config, pkgs, ... }:
with lib;
let
cfg = config.sane.gui.phosh;
in
{
options = {
sane.gui.phosh.enable = mkOption {
default = false;
type = types.bool;
};
sane.gui.phosh.useGreeter = mkOption {
description = ''
launch phosh via a greeter (like lightdm-mobile-greeter).
phosh is usable without a greeter, but skipping the greeter means no PAM session.
'';
default = true;
type = types.bool;
};
};
config = mkMerge [
{
sane.programs.phoshApps = {
package = null;
suggestedPrograms = [
"guiApps"
# TODO: see about removing gnome-bluetooth if the in-built gnome-settings bluetooth manager can work
"gnome.gnome-bluetooth"
"phosh-mobile-settings"
"plasma5Packages.konsole" # more reliable terminal
];
};
}
{
sane.programs = {
inherit (pkgs // {
"gnome.gnome-bluetooth" = pkgs.gnome.gnome-bluetooth;
"plasma5Packages.konsole" = pkgs.plasma5Packages.konsole;
})
phosh-mobile-settings
"plasma5Packages.konsole"
# "gnome.gnome-bluetooth"
;
};
}
(mkIf cfg.enable {
sane.programs.phoshApps.enableFor.user.colin = true;
# docs: https://github.com/NixOS/nixpkgs/blob/nixos-22.05/nixos/modules/services/x11/desktop-managers/phosh.nix
services.xserver.desktopManager.phosh = {
enable = true;
user = "colin";
group = "users";
phocConfig = {
# xwayland = "true";
# find default outputs by catting /etc/phosh/phoc.ini
outputs.DSI-1 = {
scale = 1.5;
};
};
};
# phosh enables `services.gnome.{core-os-services, core-shell}`
# and this in turn enables some default apps we don't really care about.
# see <nixos/modules/services/x11/desktop-managers/gnome.nix>
environment.gnome.excludePackages = with pkgs; [
# gnome.gnome-menus # unused outside gnome classic, but probably harmless
gnome-tour
];
services.dleyna-renderer.enable = false;
services.dleyna-server.enable = false;
services.gnome.gnome-browser-connector.enable = false;
services.gnome.gnome-initial-setup.enable = false;
services.gnome.gnome-online-accounts.enable = false;
services.gnome.gnome-remote-desktop.enable = false;
services.gnome.gnome-user-share.enable = false;
services.gnome.rygel.enable = false;
# gnome doesn't use mkDefault for these -- unclear why not
services.gnome.evolution-data-server.enable = mkForce false;
services.gnome.gnome-online-miners.enable = mkForce false;
# TODO: re-enable this once we can cross-compile gvfs
services.gvfs.enable = mkForce false;
# XXX: phosh enables networkmanager by default; can probably disable these lines
networking.useDHCP = false;
networking.networkmanager.enable = true;
networking.wireless.enable = lib.mkForce false;
# XXX: not clear if these are actually needed?
hardware.bluetooth.enable = true;
services.blueman.enable = true;
hardware.opengl.enable = true;
hardware.opengl.driSupport = true;
environment.variables = {
# Qt apps won't always start unless this env var is set
QT_QPA_PLATFORM = "wayland";
# electron apps (e.g. Element) should use the wayland backend
# toggle this to have electron apps (e.g. Element) use the wayland backend.
# phocConfig.xwayland should be disabled if you do this
NIXOS_OZONE_WL = "1";
};
programs.dconf.packages = [
(pkgs.writeTextFile {
name = "dconf-phosh-settings";
destination = "/etc/dconf/db/site.d/00_phosh_settings";
text = ''
[org/gnome/desktop/interface]
show-battery-percentage=true
[org/gnome/settings-daemon/plugins/power]
sleep-inactive-ac-timeout=5400
sleep-inactive-battery-timeout=5400
[sm/puri/phosh]
favorites=['gpodder.desktop', 'nheko.desktop', 'sublime-music.desktop', 'firefox.desktop', 'org.kde.konsole.desktop']
'';
})
];
})
(mkIf (cfg.enable && cfg.useGreeter) {
services.xserver.enable = true;
# NB: setting defaultSession has the critical side-effect that it lets org.freedesktop.AccountsService
# know that our user exists. this ensures lightdm succeeds when calling /org/freedesktop/AccountsServices ListCachedUsers
# lightdm greeters get the login users from lightdm which gets it from org.freedesktop.Accounts.ListCachedUsers.
# this requires the user we want to login as to be cached.
services.xserver.displayManager.job.preStart = ''
${pkgs.systemd}/bin/busctl call org.freedesktop.Accounts /org/freedesktop/Accounts org.freedesktop.Accounts CacheUser s colin
'';
# services.xserver.displayManager.defaultSession = "sm.puri.Phosh"; # XXX: not sure why this doesn't propagate correctly.
services.xserver.displayManager.lightdm.extraSeatDefaults = ''
user-session = phosh
'';
# services.xserver.displayManager.lightdm.greeters.gtk.enable = false; # gtk greeter overrides our own?
# services.xserver.displayManager.lightdm.greeter = {
# enable = true;
# package = pkgs.lightdm-mobile-greeter.xgreeters;
# name = "lightdm-mobile-greeter";
# };
# # services.xserver.displayManager.lightdm.enable = true;
services.xserver.displayManager.lightdm.enable = true;
services.xserver.displayManager.lightdm.greeters.mobile.enable = true;
systemd.services.phosh.wantedBy = lib.mkForce []; # disable auto-start
})
];
}

View File

@@ -13,7 +13,8 @@ in
};
config = mkIf cfg.enable {
sane.gui.enable = true;
sane.programs.guiApps.enableFor.user.colin = true;
# start plasma-mobile on boot
services.xserver.enable = true;
services.xserver.desktopManager.plasma5.mobile.enable = true;

View File

@@ -0,0 +1,28 @@
{ lib, config, ... }:
with lib;
let
cfg = config.sane.gui.plasma;
in
{
options = {
sane.gui.plasma.enable = mkOption {
default = false;
type = types.bool;
};
};
config = mkIf cfg.enable {
sane.programs.guiApps.enableFor.user.colin = true;
# start plasma on boot
services.xserver.enable = true;
services.xserver.desktopManager.plasma5.enable = true;
services.xserver.displayManager.sddm.enable = true;
# gnome does networking stuff with networkmanager
networking.useDHCP = false;
networking.networkmanager.enable = true;
networking.wireless.enable = lib.mkForce false;
};
}

View File

@@ -0,0 +1,13 @@
https://search.nixos.org/options?channel=unstable&query=
https://search.nixos.org/packages?channel=unstable&query=
https://nixos.wiki/index.php?go=Go&search=
https://nixos.org/manual/nix/stable/language/builtins.html
https://github.com/nixos/nixpkgs/pulls?q=
https://nur.nix-community.org/
https://nix-community.github.io/home-manager/options.html
https://w.uninsane.org/viewer#search?books.name=wikipedia_en_all_maxi_2022-05&pattern=
https://jackett.uninsane.org/UI/Dashboard#search=
https://fed.uninsane.org
https://bt.uninsane.org
https://sci-hub.se
https://news.ycombinator.com

662
hosts/modules/gui/sway.nix Normal file
View File

@@ -0,0 +1,662 @@
{ config, lib, pkgs, sane-lib, ... }:
# docs: https://nixos.wiki/wiki/Sway
with lib;
let
cfg = config.sane.gui.sway;
# docs: https://github.com/Alexays/Waybar/wiki/Configuration
# format specifiers: https://fmt.dev/latest/syntax.html#syntax
waybar-config = [
{ # TOP BAR
layer = "top";
height = 40;
modules-left = ["sway/workspaces" "sway/mode"];
modules-center = ["sway/window"];
modules-right = ["custom/mediaplayer" "clock" "battery" "cpu" "network"];
"sway/window" = {
max-length = 50;
};
# include song artist/title. source: https://www.reddit.com/r/swaywm/comments/ni0vso/waybar_spotify_tracktitle/
"custom/mediaplayer" = {
exec = pkgs.writeShellScript "waybar-mediaplayer" ''
player_status=$(${pkgs.playerctl}/bin/playerctl status 2> /dev/null)
if [ "$player_status" = "Playing" ]; then
echo "$(${pkgs.playerctl}/bin/playerctl metadata artist) - $(${pkgs.playerctl}/bin/playerctl metadata title)"
elif [ "$player_status" = "Paused" ]; then
echo " $(${pkgs.playerctl}/bin/playerctl metadata artist) - $(${pkgs.playerctl}/bin/playerctl metadata title)"
fi
'';
interval = 2;
format = "{} ";
# return-type = "json";
on-click = "${pkgs.playerctl}/bin/playerctl play-pause";
on-scroll-up = "${pkgs.playerctl}/bin/playerctl next";
on-scroll-down = "${pkgs.playerctl}/bin/playerctl previous";
};
network = {
# docs: https://github.com/Alexays/Waybar/blob/master/man/waybar-network.5.scd
interval = 2;
max-length = 40;
# custom :> format specifier explained here: https://github.com/Alexays/Waybar/pull/472
format-ethernet = " {bandwidthUpBits:>} {bandwidthDownBits:>}";
tooltip-format-ethernet = "{ifname} {bandwidthUpBits:>} {bandwidthDownBits:>}";
format-wifi = "{ifname} ({signalStrength}%) {bandwidthUpBits:>} {bandwidthDownBits:>}";
tooltip-format-wifi = "{essid} ({signalStrength}%) {bandwidthUpBits:>} {bandwidthDownBits:>}";
format-disconnected = "";
};
cpu = {
format = " {usage:2}%";
tooltip = false;
};
battery = {
states = {
good = 95;
warning = 30;
critical = 10;
};
format = "{icon} {capacity}%";
format-icons = [
""
""
""
""
""
];
};
clock = {
format-alt = "{:%a, %d. %b %H:%M}";
};
}
];
# waybar-config-text = lib.generators.toJSON {} waybar-config;
waybar-config-text = (pkgs.formats.json {}).generate "waybar-config.json" waybar-config;
# bare sway launcher
sway-launcher = pkgs.writeShellScriptBin "sway-launcher" ''
${pkgs.sway}/bin/sway --debug > /tmp/sway.log 2>&1
'';
# start sway and have it construct the gtkgreeter
sway-as-greeter = pkgs.writeShellScriptBin "sway-as-greeter" ''
${pkgs.sway}/bin/sway --debug --config ${sway-config-into-gtkgreet} > /tmp/sway-as-greeter.log 2>&1
'';
# (config file for the above)
sway-config-into-gtkgreet = pkgs.writeText "greetd-sway-config" ''
exec "${gtkgreet-launcher}"
'';
# gtkgreet which launches a layered sway instance
gtkgreet-launcher = pkgs.writeShellScript "gtkgreet-launcher" ''
# NB: the "command" field here is run in the user's shell.
# so that command must exist on the specific user's path who is logging in. it doesn't need to exist system-wide.
${pkgs.greetd.gtkgreet}/bin/gtkgreet --layer-shell --command sway-launcher
'';
greeter-session = {
# greeter session config
command = "${sway-as-greeter}/bin/sway-as-greeter";
# alternatives:
# - TTY: `command = "${pkgs.greetd.greetd}/bin/agreety --cmd ${pkgs.sway}/bin/sway";`
# - autologin: `command = "${pkgs.sway}/bin/sway"; user = "colin";`
# - Dumb Login (doesn't work)": `command = "${pkgs.greetd.dlm}/bin/dlm";`
};
greeterless-session = {
# no greeter
command = "${sway-launcher}/bin/sway-launcher";
user = "colin";
};
in
{
options = {
sane.gui.sway.enable = mkOption {
default = false;
type = types.bool;
};
sane.gui.sway.useGreeter = mkOption {
description = ''
launch sway via a greeter (like greetd's gtkgreet).
sway is usable without a greeter, but skipping the greeter means no PAM session.
'';
default = true;
type = types.bool;
};
};
config = mkMerge [
{
sane.programs.swayApps = {
package = null;
suggestedPrograms = [
"guiApps"
"swaylock"
"swayidle"
"wl-clipboard"
"mako" # notification daemon
# # "pavucontrol"
"gnome.gnome-bluetooth"
"gnome.gnome-control-center"
];
};
}
{
sane.programs = {
inherit (pkgs // {
"gnome.gnome-bluetooth" = pkgs.gnome.gnome-bluetooth;
"gnome.gnome-control-center" = pkgs.gnome.gnome-control-center;
})
swaylock
swayidle
wl-clipboard
mako
"gnome.gnome-bluetooth"
"gnome.gnome-control-center"
;
};
}
(mkIf cfg.enable {
sane.programs.swayApps.enableFor.user.colin = true;
# swap in these lines to use SDDM instead of `services.greetd`.
# services.xserver.displayManager.sddm.enable = true;
# services.xserver.enable = true;
services.greetd = {
# greetd source/docs:
# - <https://git.sr.ht/~kennylevinsen/greetd>
enable = true;
settings = {
default_session = if cfg.useGreeter then greeter-session else greeterless-session;
};
};
# we need the greeter's command to be on our PATH
users.users.colin.packages = [ sway-launcher ];
# some programs (e.g. fractal) **require** a "Secret Service Provider"
services.gnome.gnome-keyring.enable = true;
# unlike other DEs, sway configures no audio stack
# administer with pw-cli, pw-mon, pw-top commands
services.pipewire = {
enable = true;
alsa.enable = true;
alsa.support32Bit = true; # ??
pulse.enable = true;
};
networking.useDHCP = false;
networking.networkmanager.enable = true;
networking.wireless.enable = lib.mkForce false;
hardware.bluetooth.enable = true;
services.blueman.enable = true;
# gsd provides Rfkill, which is required for the bluetooth pane in gnome-control-center to work
services.gnome.gnome-settings-daemon.enable = true;
# start the components of gsd we need at login
systemd.user.targets."org.gnome.SettingsDaemon.Rfkill".wantedBy = [ "graphical-session.target" ];
# go ahead and `systemctl --user cat gnome-session-initialized.target`. i dare you.
# the only way i can figure out how to get Rfkill to actually load is to just disable all the shit it depends on.
# it doesn't actually seem to need ANY of them in the first place T_T
systemd.user.targets."gnome-session-initialized".enable = false;
# bluez can't connect to audio devices unless pipewire is running.
# a system service can't depend on a user service, so just launch it at graphical-session
systemd.user.services."pipewire".wantedBy = [ "graphical-session.target" ];
programs.sway = {
enable = true;
wrapperFeatures.gtk = true;
};
sane.user.fs.".config/sway/config" =
let
fuzzel = "${pkgs.fuzzel}/bin/fuzzel";
sed = "${pkgs.gnused}/bin/sed";
wtype = "${pkgs.wtype}/bin/wtype";
kitty = "${pkgs.kitty}/bin/kitty";
launcher-cmd = fuzzel;
terminal-cmd = kitty;
lock-cmd = "${pkgs.swaylock}/bin/swaylock --indicator-idle-visible --indicator-radius 100 --indicator-thickness 30";
vol-up-cmd = "${pkgs.pulsemixer}/bin/pulsemixer --change-volume +5";
vol-down-cmd = "${pkgs.pulsemixer}/bin/pulsemixer --change-volume -5";
mute-cmd = "${pkgs.pulsemixer}/bin/pulsemixer --toggle-mute";
brightness-up-cmd = "${pkgs.brightnessctl}/bin/brightnessctl set +2%";
brightness-down-cmd = "${pkgs.brightnessctl}/bin/brightnessctl set 2%-";
screenshot-cmd = "${pkgs.sway-contrib.grimshot}/bin/grimshot copy area";
# "bookmarking"/snippets inspired by Luke Smith:
# - <https://www.youtube.com/watch?v=d_11QaTlf1I>
snip-file = ./snippets.txt;
# TODO: querying sops here breaks encapsulation
list-snips = "cat ${snip-file} ${config.sops.secrets.snippets.path}";
strip-comments = "${sed} 's/ #.*$//'";
snip-cmd = "${wtype} $(${list-snips} | ${fuzzel} -d -i -w 60 | ${strip-comments})";
# TODO: next splatmoji release should allow `-s none` to disable skin tones
emoji-cmd = "${pkgs.splatmoji}/bin/splatmoji -s medium-light type";
in sane-lib.fs.wantedText ''
### default font
font pango:monospace 8
### pixel boundary between windows
default_border pixel 3
default_floating_border pixel 2
hide_edge_borders smart
### defaults
focus_wrapping no
focus_follows_mouse yes
focus_on_window_activation smart
mouse_warping output
workspace_layout default
workspace_auto_back_and_forth no
### default colors (#border #background #text #indicator #childBorder)
client.focused #4c7899 #285577 #ffffff #2e9ef4 #285577
client.focused_inactive #333333 #5f676a #ffffff #484e50 #5f676a
client.unfocused #333333 #222222 #888888 #292d2e #222222
client.urgent #2f343a #900000 #ffffff #900000 #900000
client.placeholder #000000 #0c0c0c #ffffff #000000 #0c0c0c
client.background #ffffff
### key bindings
floating_modifier Mod1
## media keys
bindsym XF86AudioRaiseVolume exec ${vol-up-cmd}
bindsym XF86AudioLowerVolume exec ${vol-down-cmd}
bindsym Mod1+Page_Up exec ${vol-up-cmd}
bindsym Mod1+Page_Down exec ${vol-down-cmd}
bindsym XF86AudioMute exec ${mute-cmd}
bindsym XF86MonBrightnessUp exec ${brightness-up-cmd}
bindsym XF86MonBrightnessDown exec ${brightness-down-cmd}
## special functions
bindsym Mod1+Print exec ${screenshot-cmd}
bindsym Mod1+l exec ${lock-cmd}
bindsym Mod1+s exec ${snip-cmd}
bindsym Mod1+slash exec ${emoji-cmd}
bindsym Mod1+d exec ${launcher-cmd}
bindsym Mod1+Return exec ${terminal-cmd}
bindsym Mod1+Shift+q kill
bindsym Mod1+Shift+e exec swaynag -t warning -m 'You pressed the exit shortcut. Do you really want to exit sway? This will end your Wayland session.' -b 'Yes, exit sway' 'swaymsg exit'
bindsym Mod1+Shift+c reload
## layout
bindsym Mod1+b splith
bindsym Mod1+v splitv
bindsym Mod1+f fullscreen toggle
bindsym Mod1+a focus parent
bindsym Mod1+w layout tabbed
bindsym Mod1+e layout toggle split
bindsym Mod1+Shift+space floating toggle
bindsym Mod1+space focus mode_toggle
bindsym Mod1+r mode resize
## movement
bindsym Mod1+Up focus up
bindsym Mod1+Down focus down
bindsym Mod1+Left focus left
bindsym Mod1+Right focus right
bindsym Mod1+Shift+Up move up
bindsym Mod1+Shift+Down move down
bindsym Mod1+Shift+Left move left
bindsym Mod1+Shift+Right move right
## workspaces
bindsym Mod1+1 workspace number 1
bindsym Mod1+2 workspace number 2
bindsym Mod1+3 workspace number 3
bindsym Mod1+4 workspace number 4
bindsym Mod1+5 workspace number 5
bindsym Mod1+6 workspace number 6
bindsym Mod1+7 workspace number 7
bindsym Mod1+8 workspace number 8
bindsym Mod1+9 workspace number 9
bindsym Mod1+Shift+1 move container to workspace number 1
bindsym Mod1+Shift+2 move container to workspace number 2
bindsym Mod1+Shift+3 move container to workspace number 3
bindsym Mod1+Shift+4 move container to workspace number 4
bindsym Mod1+Shift+5 move container to workspace number 5
bindsym Mod1+Shift+6 move container to workspace number 6
bindsym Mod1+Shift+7 move container to workspace number 7
bindsym Mod1+Shift+8 move container to workspace number 8
bindsym Mod1+Shift+9 move container to workspace number 9
## "scratchpad" = ??
bindsym Mod1+Shift+minus move scratchpad
bindsym Mod1+minus scratchpad show
### defaults
mode "resize" {
bindsym Down resize grow height 10 px
bindsym Escape mode default
bindsym Left resize shrink width 10 px
bindsym Return mode default
bindsym Right resize grow width 10 px
bindsym Up resize shrink height 10 px
bindsym h resize shrink width 10 px
bindsym j resize grow height 10 px
bindsym k resize shrink height 10 px
bindsym l resize grow width 10 px
}
### lightly modified bars
bar {
# TODO: fonts was:
# config.fonts.fontconfig.defaultFonts; (monospace ++ emoji)
font pango:Hack, Font Awesome 6 Free, Twitter Color Emoji 24.000000
mode dock
hidden_state hide
position top
status_command ${pkgs.i3status}/bin/i3status
swaybar_command ${pkgs.waybar}/bin/waybar
workspace_buttons yes
strip_workspace_numbers no
tray_output primary
colors {
background #000000
statusline #ffffff
separator #666666
# #border #background #text
focused_workspace #4c7899 #285577 #ffffff
active_workspace #333333 #5f676a #ffffff
inactive_workspace #333333 #222222 #888888
urgent_workspace #2f343a #900000 #ffffff
binding_mode #2f343a #900000 #ffffff
}
}
### displays
## DESKTOP
output "Samsung Electric Company S22C300 0x00007F35" {
pos 0,0
res 1920x1080
}
output "Goldstar Company Ltd LG ULTRAWIDE 0x00004E94" {
pos 1920,0
res 3440x1440
}
## LAPTOP
# sh/en TV
output "Pioneer Electronic Corporation VSX-524 0x00000101" {
pos 0,0
res 1920x1080
}
# internal display
output "Unknown 0x0637 0x00000000" {
pos 1920,0
res 1920x1080
}
'';
sane.user.fs.".config/waybar/config" = sane-lib.fs.wantedSymlinkTo waybar-config-text;
# style docs: https://github.com/Alexays/Waybar/wiki/Styling
sane.user.fs.".config/waybar/style.css" = sane-lib.fs.wantedText ''
* {
font-family: monospace;
}
/* defaults below: https://github.com/Alexays/Waybar/blob/master/resources/style.css */
window#waybar {
background-color: rgba(43, 48, 59, 0.5);
border-bottom: 3px solid rgba(100, 114, 125, 0.5);
color: #ffffff;
transition-property: background-color;
transition-duration: .5s;
}
window#waybar.hidden {
opacity: 0.2;
}
/*
window#waybar.empty {
background-color: transparent;
}
window#waybar.solo {
background-color: #FFFFFF;
}
*/
window#waybar.termite {
background-color: #3F3F3F;
}
window#waybar.chromium {
background-color: #000000;
border: none;
}
#workspaces button {
padding: 0 5px;
background-color: transparent;
color: #ffffff;
/* Use box-shadow instead of border so the text isn't offset */
box-shadow: inset 0 -3px transparent;
/* Avoid rounded borders under each workspace name */
border: none;
border-radius: 0;
}
/* https://github.com/Alexays/Waybar/wiki/FAQ#the-workspace-buttons-have-a-strange-hover-effect */
#workspaces button:hover {
background: rgba(0, 0, 0, 0.2);
box-shadow: inset 0 -3px #ffffff;
}
#workspaces button.focused {
background-color: #64727D;
box-shadow: inset 0 -3px #ffffff;
}
#workspaces button.urgent {
background-color: #eb4d4b;
}
#mode {
background-color: #64727D;
border-bottom: 3px solid #ffffff;
}
#clock,
#battery,
#cpu,
#memory,
#disk,
#temperature,
#backlight,
#network,
#pulseaudio,
#custom-media,
#tray,
#mode,
#idle_inhibitor,
#mpd {
padding: 0 10px;
color: #ffffff;
}
#window,
#workspaces {
margin: 0 4px;
}
/* If workspaces is the leftmost module, omit left margin */
.modules-left > widget:first-child > #workspaces {
margin-left: 0;
}
/* If workspaces is the rightmost module, omit right margin */
.modules-right > widget:last-child > #workspaces {
margin-right: 0;
}
#clock {
background-color: #64727D;
}
#battery {
background-color: #ffffff;
color: #000000;
}
#battery.charging, #battery.plugged {
color: #ffffff;
background-color: #26A65B;
}
@keyframes blink {
to {
background-color: #ffffff;
color: #000000;
}
}
#battery.critical:not(.charging) {
background-color: #f53c3c;
color: #ffffff;
animation-name: blink;
animation-duration: 0.5s;
animation-timing-function: linear;
animation-iteration-count: infinite;
animation-direction: alternate;
}
label:focus {
background-color: #000000;
}
#cpu {
background-color: #2ecc71;
color: #000000;
}
#memory {
background-color: #9b59b6;
}
#disk {
background-color: #964B00;
}
#backlight {
background-color: #90b1b1;
}
#network {
background-color: #2980b9;
}
#network.disconnected {
background-color: #f53c3c;
}
#pulseaudio {
background-color: #f1c40f;
color: #000000;
}
#pulseaudio.muted {
background-color: #90b1b1;
color: #2a5c45;
}
#custom-media {
background-color: #66cc99;
color: #2a5c45;
min-width: 100px;
}
#custom-media.custom-spotify {
background-color: #66cc99;
}
#custom-media.custom-vlc {
background-color: #ffa000;
}
#temperature {
background-color: #f0932b;
}
#temperature.critical {
background-color: #eb4d4b;
}
#tray {
background-color: #2980b9;
}
#tray > .passive {
-gtk-icon-effect: dim;
}
#tray > .needs-attention {
-gtk-icon-effect: highlight;
background-color: #eb4d4b;
}
#idle_inhibitor {
background-color: #2d3436;
}
#idle_inhibitor.activated {
background-color: #ecf0f1;
color: #2d3436;
}
#mpd {
background-color: #66cc99;
color: #2a5c45;
}
#mpd.disconnected {
background-color: #f53c3c;
}
#mpd.stopped {
background-color: #90b1b1;
}
#mpd.paused {
background-color: #51a37a;
}
#language {
background: #00b093;
color: #740864;
padding: 0 5px;
margin: 0 5px;
min-width: 16px;
}
#keyboard-state {
background: #97e1ad;
color: #000000;
padding: 0 0px;
margin: 0 5px;
min-width: 16px;
}
#keyboard-state > label {
padding: 0 5px;
}
#keyboard-state > label.locked {
background: rgba(0, 0, 0, 0.2);
}
'';
# style = ''
# * {
# border: none;
# border-radius: 0;
# font-family: Source Code Pro;
# }
# window#waybar {
# background: #16191C;
# color: #AAB2BF;
# }
# #workspaces button {
# padding: 0 5px;
# }
# .custom-spotify {
# padding: 0 10px;
# margin: 0 4px;
# background-color: #1DB954;
# color: black;
# }
# '';
})
];
}

View File

@@ -2,7 +2,6 @@
{
imports = [
./all.nix
./x86_64.nix
];
}

View File

@@ -1,8 +1,7 @@
{ lib, pkgs, ... }:
with lib;
{
config = mkIf (pkgs.system == "x86_64-linux") {
config = lib.mkIf (pkgs.system == "x86_64-linux") {
boot.initrd.availableKernelModules = [
"xhci_pci" "ahci" "sd_mod" "sdhci_pci" # nixos-generate-config defaults
"usb_storage" # rpi needed this to boot from usb storage, i think.

View File

@@ -0,0 +1,21 @@
{ config, lib, ... }:
{
# give each host a shortname that all the other hosts know, to allow easy comms.
networking.hosts = lib.mkMerge [
(lib.mapAttrs' (host: cfg: {
# bare-name for LAN addresses
# if using router's DNS, these mappings will already exist.
# if using a different DNS provider (which servo does), then we need to explicity provide them.
# ugly hack. would be better to get servo to somehow use the router's DNS
name = cfg.lan-ip;
value = [ host ];
}) config.sane.hosts.by-name)
(lib.mapAttrs' (host: cfg: {
# -hn suffixed name for communication over my wg-home VPN.
# hn = "home network"
name = cfg.wg-home.ip;
value = [ "${host}-hn" ];
}) config.sane.hosts.by-name)
];
}

100
hosts/modules/hosts.nix Normal file
View File

@@ -0,0 +1,100 @@
{ config, lib, ... }:
let
inherit (lib) attrValues filterAttrs mkMerge mkOption types;
cfg = config.sane.hosts;
host = types.submodule ({ config, ... }: {
options = {
ssh.user_pubkey = mkOption {
type = types.str;
description = ''
ssh pubkey that the primary user of this machine will use when connecting to other machines.
e.g. "ssh-ed25519 AAAA<base64>".
'';
};
ssh.host_pubkey = mkOption {
type = types.str;
description = ''
ssh pubkey which this host will present to connections initiated against it.
e.g. "ssh-ed25519 AAAA<base64>".
'';
};
wg-home.pubkey = mkOption {
type = types.nullOr types.str;
default = null;
description = ''
wireguard public key for the wg-home VPN.
e.g. "pWtnKW7f7sNIZQ2M83uJ7cHg3IL1tebE3IoVkCgjkXM=".
'';
};
wg-home.ip = mkOption {
type = types.nullOr types.str;
default = null;
description = ''
IP address to use on the wg-home VPN.
e.g. "10.0.10.5";
'';
};
wg-home.endpoint = mkOption {
type = types.nullOr types.str;
default = null;
};
lan-ip = mkOption {
type = types.str;
description = ''
ip address when on the lan.
e.g. "192.168.0.5";
'';
};
};
});
in
{
options = {
sane.hosts.by-name = mkOption {
type = types.attrsOf host;
default = {};
description = ''
map of hostname => attrset of information specific to that host,
like its ssh pubkey, etc.
'';
};
};
config = {
# TODO: this should be populated per-host
sane.hosts.by-name."desko" = {
ssh.user_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPU5GlsSfbaarMvDA20bxpSZGWviEzXGD8gtrIowc1pX";
ssh.host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFw9NoRaYrM6LbDd3aFBc4yyBlxGQn8HjeHd/dZ3CfHk";
wg-home.pubkey = "17PMZssYi0D4t2d0vbmhjBKe1sGsE8kT8/dod0Q2CXc=";
wg-home.ip = "10.0.10.22";
lan-ip = "192.168.0.22";
};
sane.hosts.by-name."lappy" = {
ssh.user_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDpmFdNSVPRol5hkbbCivRhyeENzb9HVyf9KutGLP2Zu";
ssh.host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILSJnqmVl9/SYQ0btvGb0REwwWY8wkdkGXQZfn/1geEc";
wg-home.pubkey = "FTUWGw2p4/cEcrrIE86PWVnqctbv8OYpw8Gt3+dC/lk=";
wg-home.ip = "10.0.10.20";
lan-ip = "192.168.0.20";
};
sane.hosts.by-name."moby" = {
ssh.user_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICrR+gePnl0nV/vy7I5BzrGeyVL+9eOuXHU1yNE3uCwU";
ssh.host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO1N/IT3nQYUD+dBlU1sTEEVMxfOyMkrrDeyHcYgnJvw";
wg-home.pubkey = "I7XIR1hm8bIzAtcAvbhWOwIAabGkuEvbWH/3kyIB1yA=";
wg-home.ip = "10.0.10.48";
lan-ip = "192.168.0.48";
};
sane.hosts.by-name."servo" = {
ssh.user_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPS1qFzKurAdB9blkWomq8gI1g0T3sTs9LsmFOj5VtqX";
ssh.host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfdSmFkrVT6DhpgvFeQKm3Fh9VKZ9DbLYOPOJWYQ0E8";
wg-home.pubkey = "roAw+IUFVtdpCcqa4khB385Qcv9l5JAB//730tyK4Wk=";
wg-home.ip = "10.0.10.5";
wg-home.endpoint = "uninsane.org:51820";
lan-ip = "192.168.0.5";
};
};
}

View File

@@ -0,0 +1,47 @@
# speed up builds from e.g. moby or lappy by having them query desko and servo first.
# if one of these hosts is offline, instead manually specify just cachix:
# - `nixos-rebuild --option substituters https://cache.nixos.org/`
#
# future improvements:
# - apply for community arm build box:
# - <https://github.com/nix-community/aarch64-build-box>
# - don't require all substituters to be online:
# - <https://github.com/NixOS/nix/pull/7188>
{ lib, config, ... }:
with lib;
let
cfg = config.sane.nixcache;
in
{
options = {
sane.nixcache.enable = mkOption {
default = false;
type = types.bool;
};
sane.nixcache.enable-trusted-keys = mkOption {
default = config.sane.nixcache.enable;
type = types.bool;
};
};
config = {
# use our own binary cache
# to explicitly build from a specific cache (in case others are down):
# - `nixos-rebuild ... --option substituters https://cache.nixos.org`
# - `nix build ... --substituters http://desko:5000`
nix.settings.substituters = mkIf cfg.enable [
"https://nixcache.uninsane.org"
"http://desko:5000"
"https://nix-community.cachix.org"
"https://cache.nixos.org/"
];
# always trust our keys (so one can explicitly use a substituter even if it's not the default
nix.settings.trusted-public-keys = mkIf cfg.enable-trusted-keys [
"nixcache.uninsane.org:r3WILM6+QrkmsLgqVQcEdibFD7Q/4gyzD9dGT33GP70="
"desko:Q7mjjqoBMgNQ5P0e63sLur65A+D4f3Sv4QiycDIKxiI="
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
];
};
}

View File

@@ -0,0 +1,18 @@
{ config, lib, pkgs, ... }:
{
config = lib.mkIf config.sane.roles.client {
# persist external pairings by default
sane.persist.sys.plaintext = [ "/var/lib/bluetooth" ];
sane.fs."/var/lib/bluetooth".generated.acl.mode = "0700";
sane.fs."/var/lib/bluetooth/.secrets.stamp" = {
wantedBeforeBy = [ "bluetooth.service" ];
# XXX: install-bluetooth uses sed, but that's part of the default systemd unit path, it seems
generated.script.script = builtins.readFile ../../../../scripts/install-bluetooth + ''
touch "/var/lib/bluetooth/.secrets.stamp"
'';
generated.script.scriptArgs = [ "/run/secrets/bt" ];
};
};
}

View File

@@ -0,0 +1,17 @@
{ config, lib, ... }:
let
inherit (lib) mkIf mkOption types;
in
{
imports = [
./bluetooth-pairings.nix
./wifi-pairings.nix
];
# option is consumed by the other imports in this dir
options.sane.roles.client = mkOption {
type = types.bool;
default = false;
};
}

View File

@@ -0,0 +1,15 @@
{ config, lib, pkgs, ... }:
{
config = lib.mkIf config.sane.roles.client {
sane.fs."/var/lib/iwd/.secrets.psk.stamp" = {
wantedBeforeBy = [ "iwd.service" ];
generated.acl.mode = "0600";
# XXX: install-iwd uses sed, but that's part of the default systemd unit path, it seems
generated.script.script = builtins.readFile ../../../../scripts/install-iwd + ''
touch "/var/lib/iwd/.secrets.psk.stamp"
'';
generated.script.scriptArgs = [ "/run/secrets/iwd" "/var/lib/iwd" ];
};
};
}

View File

@@ -0,0 +1,6 @@
{ ... }:
{
imports = [
./client
];
}

Some files were not shown because too many files have changed in this diff Show More