WIP

2024-07-23 20:46:41 -07:00
16 changed files with 100 additions and 2307 deletions
--- a/flake.lock
+++ b/flake.lock
--- a/flake.nix
+++ b/flake.nix
@@ -2,39 +2,29 @@
  description = "Nettika's NixOS Configurations";

  inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11";
-    shelvacu.url = "git+https://git.uninsane.org/shelvacu/nix-stuff";
-    phps.url = "github:fossar/nix-phps";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05";
  };

  outputs = { self, nixpkgs, ... }@inputs:
-    let
-      secrets = builtins.fromJSON (builtins.readFile ./secrets.json);
-    in
-    {
-      nixosModules = {
-        common = import ./modules/common.nix;
-        prompt = import ./modules/prompt.nix;
-        server = import ./modules/server.nix;
-        zerotier = import ./modules/zerotier.nix;
-      };
+  let
+    secrets = builtins.fromJSON (builtins.readFile ./secrets.json);
+  in {
+    nixosModules = {
+      common = import ./modules/common.nix;
+      server = import ./modules/server.nix;
+    };

-      nixosConfigurations = {
-        marauder = nixpkgs.lib.nixosSystem {
-          system = "x86_64-linux";
-          modules = [ ./hosts/marauder ];
-          specialArgs = { inherit self inputs secrets; };
-        };
-        monolith = nixpkgs.lib.nixosSystem {
-          system = "x86_64-linux";
-          modules = [ ./hosts/monolith ];
-          specialArgs = { inherit self inputs secrets; };
-        };
-        quasar = nixpkgs.lib.nixosSystem {
-          system = "x86_64-linux";
-          modules = [ ./hosts/quasar ];
-          specialArgs = { inherit self inputs secrets; };
-        };
+    nixosConfigurations = {
+      marauder = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+        modules = [ ./hosts/marauder ];
+        specialArgs = { inherit self inputs secrets; };
+      };
+      monolith = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+        modules = [ ./hosts/monolith ];
+        specialArgs = { inherit self inputs secrets; };
      };
    };
+  };
 }
--- a/hosts/marauder/backup.nix
+++ b/hosts/marauder/backup.nix
@@ -1,5 +1,11 @@
 { pkgs, config, secrets, ... }:
 {
+  environment.systemPackages = with pkgs; [
+    restic
+    libnotify
+    backblaze-b2
+  ];
+
  systemd.services = {
    notify-backup-b2-failed = {
      description = "Notify on failed backup to B2";
@@ -14,14 +20,14 @@
      script = "notify-send -u critical \"Backup to B2 failed\" \"$(journalctl -u restic-backups-b2 -n 5 -o cat)\"";
    };
    restic-backups-b2 = {
-      onFailure = [ "notify-backup-b2-failed.service" ];
+      onFailure = ["notify-backup-b2-failed.service"];
    };
  };

  environment.etc = {
    "restic-env".text = ''
-      B2_ACCOUNT_ID="${secrets.b2.accountId}"
-      B2_ACCOUNT_KEY="${secrets.b2.accountKey}"
+      export B2_ACCOUNT_ID="${secrets.b2.accountId}"
+      export B2_ACCOUNT_KEY="${secrets.b2.accountKey}"
    '';
    "restic-password".text = secrets.restic.password;
  };
@@ -33,11 +39,13 @@
      repository = "b2:marauder-backup";
      passwordFile = "/etc/restic-password";
      paths = [
-        "${config.users.users.nettika.home}/Artwork"
+        "${config.users.users.nettika.home}/Desktop"
        "${config.users.users.nettika.home}/Documents"
        "${config.users.users.nettika.home}/Music"
        "${config.users.users.nettika.home}/Pictures"
        "${config.users.users.nettika.home}/Projects"
+        "${config.users.users.nettika.home}/Public"
+        "${config.users.users.nettika.home}/Templates"
        "${config.users.users.nettika.home}/Videos"
      ];
      pruneOpts = [
--- a/hosts/marauder/default.nix
+++ b/hosts/marauder/default.nix
@@ -1,19 +1,11 @@
-{ self, pkgs, inputs, ... }:
+{ self, pkgs, inputs, secrets, ... }:
 {
  imports = [
    self.nixosModules.common
-    self.nixosModules.prompt
-    self.nixosModules.zerotier
    ./backup.nix
-    ./dev.nix
-    ./www.nix
-    ./printing.nix
  ];

-  networking = {
-    hostName = "marauder";
-    firewall.enable = false;
-  };
+  networking.hostName = "marauder";

  fileSystems = {
    "/" = {
@@ -42,66 +34,63 @@
        "sd_mod"
      ];
    };
-    kernelModules = [ "kvm-amd" ];
+    kernelModules = ["kvm-amd"];
    kernelParams = [ "amd_pstate=active" ];
  };

  hardware = {
    enableRedistributableFirmware = true;
    cpu.amd.updateMicrocode = true;
-    graphics = {
+    opengl = {
      enable = true;
-      enable32Bit = true;
-      extraPackages = [ pkgs.vaapiVdpau ];
+      driSupport32Bit = true;
+      extraPackages = [pkgs.vaapiVdpau];
    };
-    nvidia = {
-      open = true;
-      prime = {
-        offload = {
-          enable = true;
-          enableOffloadCmd = true;
-        };
-        amdgpuBusId = "PCI:05:00:0";
-        nvidiaBusId = "PCI:01:00:0";
+    nvidia.prime = {
+      offload = {
+        enable = true;
+        enableOffloadCmd = true;
      };
+      amdgpuBusId = "PCI:05:00:0";
+      nvidiaBusId = "PCI:01:00:0";
    };
  };

-  environment = {
-    systemPackages = [
-      inputs.shelvacu.packages.x86_64-linux.sm64coopdx
-    ] ++ (with pkgs; [
-      # Chat clients
-      discord
-      slack
-      element-desktop
-      telegram-desktop
-      signal-desktop
+  environment.systemPackages = with pkgs; [
+    # Chat clients
+    discord
+    element-desktop
+    telegram-desktop

-      # Browsers
-      firefox
-      filezilla
+    # Browsers
+    firefox

-      # Creative
-      inkscape
-      gimp
-      krita
-      openscad-unstable
-      bambu-studio
+    # Coding
+    vscode

-      # Multimedia
-      vlc
-      ffmpeg
-      (callPackage ./ffcheck.nix { })
+    # Art and 3D
+    inkscape
+    openscad-unstable
+    bambu-studio

-      # Misc
-      obsidian
-      intiface-central
-      prismlauncher
-      blender
-      mullvad-vpn
-      qbittorrent
-    ]);
+    # Multimedia
+    vlc
+
+    # Productivity
+    obsidian
+  ];
+
+  programs.bash = {
+    promptInit = ''
+      PS1="\[\e]0;\u@\h: \w\a\]" # window title
+      PS1+="\n"
+      PS1+="\$(printf \"%*s\" \$((\$COLUMNS + 9)) \"\[\e[1;33m\]\$(git branch --show-current 2>/dev/null)\")" # git branch
+      PS1+="\[\e[1G\]" # move cursor to beginning of line
+      PS1+="💜" # prompt symbol
+      PS1+="\[\033[1;$((UID ? 32 : 31))m\]" # prompt color
+      PS1+="[\u@\h:\w]\\$"
+      PS1+="\[\033[0m\] " # reset color
+    '';
  };

  programs.steam = {
@@ -110,27 +99,10 @@
    dedicatedServer.openFirewall = true;
  };

-  programs.ssh.extraConfig = ''
-    Host quasar
-      HostName consortium.chat
-      IdentityFile ~/.ssh/LightsailDefaultKey-us-west-2.pem
-
-    Host monolith
-      HostName 10.243.210.154
-
-    Host fennbox
-      HostName 10.243.109.199
-      User fenn
-  '';
-
-  programs.nix-ld = {
+  services.xserver = {  
    enable = true;
-  };
-
-  services.xserver = {
-    enable = true;
-    videoDrivers = [ "nvidia" ];
-    desktopManager = {
+    videoDrivers = ["nvidia"];   
+    desktopManager = {  
      cinnamon.enable = true;
      xterm.enable = false;
    };
@@ -148,14 +120,8 @@
    enable = true;
  };

-  services.mullvad-vpn = {
-    enable = true;
-    package = pkgs.mullvad-vpn; # Include GUI
-  };
-
-  promptEmoji = "💜";
-
  time.timeZone = "America/Los_Angeles";

  system.stateVersion = "24.05";
 }
+
--- a/hosts/marauder/dev.nix
+++ b/hosts/marauder/dev.nix
@@ -1,34 +0,0 @@
-{ pkgs, ... }:
-{
-  environment.variables = {
-    VISUAL = "code --wait";
-  };
-
-  environment.systemPackages = with pkgs; [
-    # Code Editors
-    vscode
-    arduino-ide
-
-    # Dev Tools
-    nixd
-    nixpkgs-fmt
-    pyenv
-    rustup
-    electron-fiddle
-    electron
-
-    # Languages
-    gcc
-    kotlin
-    nodejs
-    php
-  ];
-
-  programs.direnv = {
-    enable = true;
-  };
-
-  nixpkgs.config.permittedInsecurePackages = [
-    "electron-24.8.6"
-  ];
-}
--- a/hosts/marauder/ffcheck.nix
+++ b/hosts/marauder/ffcheck.nix
@@ -1,3 +0,0 @@
-{ writeShellScriptBin, ffmpeg }: writeShellScriptBin "ffcheck" ''
-  ${ffmpeg}/bin/ffmpeg -v error -stats -hide_banner -i "$1" -c copy -f null -
-''
--- a/hosts/marauder/printing.nix
+++ b/hosts/marauder/printing.nix
@@ -1,16 +0,0 @@
-{ pkgs, ... }:
-{
-  environment.systemPackages = with pkgs; [
-    system-config-printer
-  ];
-
-  services.printing = {
-    enable = true;
-  };
-
-  services.avahi = {
-    enable = true;
-    nssmdns4 = true;
-    openFirewall = true;
-  };
-}
--- a/hosts/marauder/www.nix
+++ b/hosts/marauder/www.nix
@@ -1,26 +0,0 @@
-{ pkgs, inputs, ... }:
-let
-  fortune = pkgs.writeShellScript "cgi" ''
-    echo "Content-type: text/html"
-    echo ""
-    ${pkgs.fortune}/bin/fortune
-  '';
-in {
-  services.mysql = {
-    enable = true;
-    package = pkgs.mariadb;
-  };
-
-  services.httpd = {
-    enable = true;
-    enablePHP = true;
-    # phpPackage = inputs.phps.packages.x86_64-linux.php74;
-    extraConfig = ''
-      ScriptAlias /fortune ${fortune}/bin/fortune
-    '';
-    virtualHosts."localhost" = {
-      documentRoot = "/var/www";
-      locations."/".index = "index.html index.php";
-    };
-  };
-}
--- a/hosts/monolith/default.nix
+++ b/hosts/monolith/default.nix
@@ -1,18 +1,15 @@
-{ self, pkgs, ... }:
+{ self, pkgs, secrets, ... }:
 {
  imports = [
    self.nixosModules.common
-    self.nixosModules.prompt
    self.nixosModules.server
-    self.nixosModules.zerotier
    ./dns.nix
-    ./vault.nix
  ];

  networking = {
    hostName = "monolith";
    hostId = "44551c32";
-    firewall.allowedTCPPorts = [ 8000 ];
+    firewall.allowedTCPPorts = [ 80 ];
  };

  fileSystems = {
@@ -41,53 +38,12 @@
    supportedFilesystems = [ "zfs" ];
  };

-  environment.systemPackages = with pkgs; [
-    rclone
-    beets
-    flac
-    screen
-    rustup
-    gcc
-    (callPackage ../marauder/ffcheck.nix { })
-    mp3val
-  ];
-
-  services.jellyfin = {
+  services.static-web-server = {
    enable = true;
-    openFirewall = true;
+    listen = "[::]:80";
+    root = "/srv/www";
  };

-  services.navidrome = {
-    enable = true;
-    openFirewall = true;
-    settings = {
-      Address = "0.0.0.0";
-      MusicFolder = "/library/music";
-      Scanner.GroupAlbumReleases = "true";
-      ScanSchedule = "0";
-    };
-  };
-
-  systemd = {
-    services.reboot = {
-      description = "Reboot the system";
-      serviceConfig = {
-        Type = "oneshot";
-        ExecStart = "${pkgs.systemd}/bin/systemctl reboot";
-      };
-    };
-    timers.reboot = {
-      description = "Reboot the system every two hours";
-      wantedBy = [ "timers.target" ];
-      timerConfig = {
-        OnBootSec = "6h";
-        Persistent = true;
-      };
-    };
-  };
-
-  promptEmoji = "🏰";
-
  time.timeZone = "America/Los_Angeles";

  system.stateVersion = "24.05";
--- a/hosts/monolith/dns.nix
+++ b/hosts/monolith/dns.nix
@@ -3,16 +3,22 @@
  systemd.services.update-dns = {
    serviceConfig.Type = "oneshot";
    description = "Update the leaf.ninja DNS records";
-    path = with pkgs; [ curl ];
+    path = with pkgs; [ curl jq ];
    script = ''
      public_ip=$(curl -s https://ifconfig.me/ip)
      endpoint="https://api.gandi.net/v5/livedns/domains/leaf.ninja/records"
-      curl \
+      curl -s \
        -X PUT \
        -H "Authorization: Bearer ${secrets.gandi.token}" \
        -H "Content-Type: application/json" \
        -d "{\"rrset_values\":[\"$public_ip\"]}" \
-        $endpoint/ostiary/A
+        "$ENDPOINT/%2A/A" | jq
+      curl -s \
+        -X PUT \
+        -H "Authorization: Bearer ${secrets.gandi.token}" \
+        -H "Content-Type: application/json" \
+        -d "{\"rrset_values\":[\"$public_ip\"]}" \
+        "$ENDPOINT/%40/A" | jq
    '';
  };

--- a/hosts/monolith/vault.nix
+++ b/hosts/monolith/vault.nix
@@ -1,20 +0,0 @@
-{ secrets, ... }:
-{
-  services.vaultwarden = {
-    enable = true;
-    config = {
-      domain = "https://vault.leaf.ninja";
-      signupsAllowed = false;
-      rocketAddress = "0.0.0.0";
-      rocketPort = 8222;
-      smtpHost = "smtp.migadu.com";
-      smtpFrom = "vaultwarden@leaf.ninja";
-      smtpPort = 587;
-      smtpSecurity = "starttls";
-      smtpUsername = "vaultwarden@leaf.ninja";
-      smtpPassword = secrets.vaultwarden.smtpPassword;
-    };
-  };
-
-  networking.firewall.allowedTCPPorts = [ 8222 ];
-}
--- a/hosts/quasar/default.nix
+++ b/hosts/quasar/default.nix
@@ -1,54 +0,0 @@
-{ self, modulesPath, pkgs, config, secrets, ... }:
-{
-  imports = [
-    "${modulesPath}/virtualisation/amazon-image.nix"
-    self.nixosModules.common
-    self.nixosModules.prompt
-    self.nixosModules.server
-  ];
-
-  networking = {
-    hostName = "quasar";
-    domain = "consortium.chat";
-    firewall.allowedTCPPorts = [ 80 443 ];
-  };
-
-  services.postgresql = {
-    enable = true;
-  };
-
-  services.caddy = {
-    enable = true;
-    virtualHosts = {
-      "${config.networking.domain}".extraConfig = ''
-        reverse_proxy localhost:8008
-        header Strict-Transport-Security "max-age=63072000; includeSubDomains;"
-      '';
-      "matrix.${config.networking.domain}".extraConfig = ''
-        reverse_proxy /_matrix/* localhost:8008
-        reverse_proxy /_synapse/client/* localhost:8008
-      '';
-      "admin.${config.networking.domain}".extraConfig = ''
-        root * ${pkgs.synapse-admin}
-        file_server
-      '';
-    };
-  };
-
-  services.matrix-synapse = {
-    enable = true;
-    settings = {
-      server_name = config.networking.domain;
-      serve_server_wellknown = true;
-      registration_shared_secret = secrets.synapse."consortium.chat".registration-shared-secret;
-      macaroon_secret_key = secrets.synapse."consortium.chat".macaroon-secret-key;
-      form_secret = secrets.synapse."consortium.chat".form-secret;
-    };
-  };
-
-  promptEmoji = "🌟";
-
-  time.timeZone = "America/Los_Angeles";
-
-  system.stateVersion = "24.05";
-}
--- a/modules/common.nix
+++ b/modules/common.nix
@@ -1,32 +1,19 @@
-{ pkgs, ... }:
+{ pkgs, secrets, ... }:
 {
  nixpkgs.config.allowUnfree = true;

  nix.settings = {
    experimental-features = [ "nix-command" "flakes" ];
-    substituters = [
-      "https://fossar.cachix.org"
-      # "https://nixcache.shelvacu.com"
-    ];
-    trusted-public-keys = [
-      "fossar.cachix.org-1:Zv6FuqIboeHPWQS7ysLCJ7UT7xExb4OE8c4LyGb5AsE="
-      "nixcache.shelvacu.com:73u5ZGBpPRoVZfgNJQKYYBt9K9Io/jPwgUfuOLsJbsM="
-    ];
    trusted-users = [ "@wheel" ];
  };

  users.users.nettika = {
    isNormalUser = true;
    extraGroups = [ "wheel" "networkmanager" ];
-    shell = pkgs.fish;
  };

  security.sudo.wheelNeedsPassword = false;

-  environment.variables = {
-    EDITOR = "nano";
-  };
-
  programs.git = {
    enable = true;
    lfs.enable = true;
@@ -48,13 +35,13 @@
    '';
  };

-  programs.fish = {
+  services.zerotierone = {
    enable = true;
+    joinNetworks = secrets.zerotier.networks;
  };

  environment.systemPackages = with pkgs; [
    git-crypt
-    htop
    jq
  ];
 }
--- a/modules/prompt.nix
+++ b/modules/prompt.nix
@@ -1,30 +0,0 @@
-{ lib, config, ... }:
-{
-  options.promptEmoji = lib.mkOption {
-    type = lib.types.str;
-  };
-
-  config.programs.bash.promptInit = ''
-    PS1="\[\e]0;\u@\h: \w\a\]\n${config.promptEmoji} \[\033[1;$((UID ? 32 : 31))m\]\w \\$\[\033[0m\] "
-  '';
-
-  config.programs.fish = {
-    promptInit = ''
-      function fish_prompt
-        echo -n '${config.promptEmoji} '
-        set_color brgreen
-        echo -n (prompt_pwd)
-        set_color normal
-        echo -n ' > '
-      end
-      function fish_right_prompt
-        set_color bryellow
-        echo -n (git branch --show-current 2>/dev/null)
-      end
-    '';
-    shellInit = ''
-      set -g fish_greeting
-      set -g fish_prompt_pwd_full_dirs 999
-    '';
-  };
-}
--- a/modules/zerotier.nix
+++ b/modules/zerotier.nix
@@ -1,7 +0,0 @@
-{ secrets, ... }:
-{
-  services.zerotierone = {
-    enable = true;
-    joinNetworks = secrets.zerotier.networks;
-  };
-}
--- a/secrets.json
+++ b/secrets.json