Compare commits
239 Commits
wip-comman
...
wip-2024-0
Author | SHA1 | Date | |
---|---|---|---|
![]() |
135354ea65 | ||
![]() |
2ff3cbe417 | ||
![]() |
6c2e19d398 | ||
![]() |
eda2b3085d | ||
![]() |
608c4899ec | ||
![]() |
b54e90049b | ||
![]() |
046252da60 | ||
![]() |
d587f2ae84 | ||
![]() |
9935f280c0 | ||
![]() |
5e62f70951 | ||
![]() |
c99528ad0a | ||
![]() |
063869e616 | ||
![]() |
d365fe304a | ||
![]() |
0bce429ad0 | ||
![]() |
bb1c2bbbb8 | ||
![]() |
b17125ebaf | ||
![]() |
7ca34cf82c | ||
![]() |
bfda13b128 | ||
![]() |
04d47744d7 | ||
![]() |
64c031ed71 | ||
![]() |
53141d7be7 | ||
![]() |
4a2ad61a8b | ||
![]() |
12827583f2 | ||
![]() |
e6b5c98bcd | ||
![]() |
014961aef8 | ||
![]() |
ccba74fb9c | ||
![]() |
6bb5486180 | ||
![]() |
9dc0718386 | ||
![]() |
27bd4077cf | ||
![]() |
54abbe179a | ||
![]() |
76036a25b2 | ||
![]() |
8b062011ad | ||
![]() |
cfb2b44b77 | ||
![]() |
332d43e768 | ||
![]() |
1f8bd06367 | ||
![]() |
c7921cb8ed | ||
![]() |
74180f9a41 | ||
![]() |
d80f4b3a02 | ||
![]() |
4c4c4dc675 | ||
![]() |
46dea07a6f | ||
![]() |
3e1f3b4c97 | ||
![]() |
56fdf9c128 | ||
![]() |
a459afdad2 | ||
![]() |
94e08bc6fe | ||
![]() |
def7296ec7 | ||
![]() |
82819646b1 | ||
![]() |
c31446e3cb | ||
![]() |
b707e6ae8d | ||
![]() |
420a2d8d02 | ||
![]() |
0c546acefd | ||
![]() |
1b13226c50 | ||
![]() |
4876654145 | ||
![]() |
9ed4e80418 | ||
![]() |
46ec04a967 | ||
![]() |
311fbb0904 | ||
![]() |
6453c4cdf0 | ||
![]() |
1a74b58b44 | ||
![]() |
4f256663ae | ||
![]() |
4c6df8c5e5 | ||
![]() |
7312aab991 | ||
![]() |
c56a26ff6d | ||
![]() |
88af0f1e93 | ||
![]() |
1b3aa80fe9 | ||
![]() |
fccda582ef | ||
![]() |
8b9e199a23 | ||
![]() |
addf748d1f | ||
![]() |
b7b281604b | ||
![]() |
6782539b4a | ||
![]() |
0637a617e8 | ||
![]() |
4fc5864466 | ||
![]() |
e6e0fe6e47 | ||
![]() |
3e7bb2d2f8 | ||
![]() |
c197b31a5f | ||
![]() |
a1e4e2aa91 | ||
![]() |
94d28b7f57 | ||
![]() |
03fc273124 | ||
![]() |
8d9de94083 | ||
![]() |
359be2b446 | ||
![]() |
9c8fdd958f | ||
![]() |
f248b0cb52 | ||
![]() |
2740141b2b | ||
![]() |
7665e92138 | ||
![]() |
0a4350f191 | ||
![]() |
b0d9d1a987 | ||
![]() |
e5a12a1f17 | ||
![]() |
9d8a096916 | ||
![]() |
2f498e49c7 | ||
![]() |
a351665606 | ||
![]() |
cd1865dbc5 | ||
![]() |
2458df3d17 | ||
![]() |
daaa70e148 | ||
![]() |
0d20e797ba | ||
![]() |
0354a47c12 | ||
![]() |
797ec7dd07 | ||
![]() |
09561eca09 | ||
![]() |
d5d28c940e | ||
![]() |
0d2d0688f7 | ||
![]() |
e8d2b3aa63 | ||
![]() |
7cab530d40 | ||
![]() |
c79ca06af3 | ||
![]() |
876dbb2dc9 | ||
![]() |
3c77d14e9b | ||
![]() |
546247a569 | ||
![]() |
e6ff9373dd | ||
![]() |
4d66f3d9a2 | ||
![]() |
86bf3807bc | ||
![]() |
332f6aeb76 | ||
![]() |
4eeaa337b9 | ||
![]() |
22f6270a06 | ||
![]() |
18387da12a | ||
![]() |
3e8df621c7 | ||
![]() |
78ffdde588 | ||
![]() |
16fc9d93ad | ||
![]() |
500ab33b1b | ||
![]() |
7920bacadd | ||
![]() |
61149ff1dd | ||
![]() |
be44048523 | ||
![]() |
e9e0c87752 | ||
![]() |
ee29b1a997 | ||
![]() |
20b5803eb9 | ||
![]() |
d03709f9d2 | ||
![]() |
265c0abd68 | ||
![]() |
582ac9ec34 | ||
![]() |
7b554988b8 | ||
![]() |
4e333b948e | ||
![]() |
543f7dec34 | ||
![]() |
568bbc1d89 | ||
![]() |
8be73f95d0 | ||
![]() |
17b63089e6 | ||
![]() |
a4b195c389 | ||
![]() |
d77d0d720a | ||
![]() |
6807f5c960 | ||
![]() |
7e6cf686bb | ||
![]() |
f37b6a4a46 | ||
![]() |
7211ffb30a | ||
![]() |
4ced20fb2d | ||
![]() |
f5af9886f5 | ||
![]() |
383b57bace | ||
![]() |
4eb20970b6 | ||
![]() |
0288181706 | ||
![]() |
a0f11550c5 | ||
![]() |
80b2ff8951 | ||
![]() |
d7b37b0353 | ||
![]() |
ab5168632e | ||
![]() |
569043b6ca | ||
![]() |
620fec48ea | ||
![]() |
3d734769cd | ||
![]() |
14fce1d271 | ||
![]() |
d09117418f | ||
![]() |
0c4c590dc3 | ||
![]() |
06d40673dd | ||
![]() |
63e44f4766 | ||
![]() |
4b54a38998 | ||
![]() |
e9c0ba445c | ||
![]() |
13564a3655 | ||
![]() |
c30b275bb7 | ||
![]() |
f809262290 | ||
![]() |
789dc5397d | ||
![]() |
5464a052ed | ||
![]() |
7d0c463de1 | ||
![]() |
ce37f30c39 | ||
![]() |
52a54f1b50 | ||
![]() |
a5585d8bb7 | ||
![]() |
4f31ae0727 | ||
![]() |
08a778a4d5 | ||
![]() |
26194a2994 | ||
![]() |
7055fe0678 | ||
![]() |
a0cd2fb6a2 | ||
![]() |
cba177bc03 | ||
![]() |
18f1c074de | ||
![]() |
c08442e624 | ||
![]() |
540531634b | ||
![]() |
e39fe28776 | ||
![]() |
5bbf66e323 | ||
![]() |
992c0301e3 | ||
![]() |
603cb25f95 | ||
![]() |
be2071785d | ||
![]() |
2977a455db | ||
![]() |
b3d3ff1c96 | ||
![]() |
9a79e42184 | ||
![]() |
4fbbbaad24 | ||
![]() |
f363261a26 | ||
![]() |
9b62f51b4e | ||
![]() |
52d81bc607 | ||
![]() |
4624dbea90 | ||
![]() |
df117c4eed | ||
![]() |
35edf8667b | ||
![]() |
7d773121c4 | ||
![]() |
b544246cf0 | ||
![]() |
a39ee64db6 | ||
![]() |
e54d387104 | ||
![]() |
56dee4d47c | ||
![]() |
044359ac25 | ||
![]() |
3f5200b574 | ||
![]() |
702d48e825 | ||
![]() |
6d6ab0baf4 | ||
![]() |
e304d4d20b | ||
![]() |
95d8f3b836 | ||
![]() |
aadbf8e874 | ||
![]() |
9d9ee9b083 | ||
![]() |
b918fff3dd | ||
![]() |
0e15d716f0 | ||
![]() |
b45f539fb1 | ||
![]() |
0b63217f7b | ||
![]() |
73b465bd30 | ||
![]() |
55338e81ac | ||
![]() |
6e005ff10f | ||
![]() |
2f5cc60b00 | ||
![]() |
a6f8543ac9 | ||
![]() |
d7cff14bae | ||
![]() |
9049153ff4 | ||
![]() |
0756e0d8bf | ||
![]() |
691a54cbfc | ||
![]() |
2434e6693f | ||
![]() |
77e3232ad7 | ||
![]() |
782aea9f1a | ||
![]() |
64c6bcbe7a | ||
![]() |
4d4a6c13cc | ||
![]() |
217fba6035 | ||
![]() |
e7a60417a2 | ||
![]() |
e3196b48ca | ||
![]() |
d69fffef05 | ||
![]() |
eff8c52c91 | ||
![]() |
378d98b277 | ||
![]() |
3773e5abf5 | ||
![]() |
31a661f9b9 | ||
![]() |
862ecfd4b6 | ||
![]() |
89373871ac | ||
![]() |
452120fa68 | ||
![]() |
7c6325a22a | ||
![]() |
afbd1ee645 | ||
![]() |
4584200632 | ||
![]() |
90fc0c3f5b | ||
![]() |
b69d831569 | ||
![]() |
b288aa824d | ||
![]() |
b4a5e9515d | ||
![]() |
ea3e3e3ef3 | ||
![]() |
3a774033ee | ||
![]() |
71a27e50f4 |
45
.sops.yaml
45
.sops.yaml
@@ -1,8 +1,15 @@
|
||||
shel_keys: &shel_keys
|
||||
- &pixel-termux age1y4zp4ddq6xyffd8fgmn2jkl78qfh4m94gcls2cu6vvjnwwznx5uqywjekm
|
||||
- &t460s age1g9sh8u6s344569d3cg8h30g9h7thld5pexcwzc4549jc84jvceqqjt9cfh
|
||||
- &pixel-nix age1t5s3txyj403rfecdhq5q2z3cnavy6m543gzyhkl2nu5t8fz0zctqtvm2tj
|
||||
- &compute-deck-user age1dzdf4rgep3ctk3dnrmrqtdgrchaa8nszfc4dp29gqwsst3z6jyrq57vfsj
|
||||
- &a age1y4zp4ddq6xyffd8fgmn2jkl78qfh4m94gcls2cu6vvjnwwznx5uqywjekm
|
||||
- &b age1g9sh8u6s344569d3cg8h30g9h7thld5pexcwzc4549jc84jvceqqjt9cfh
|
||||
- &c age1t5s3txyj403rfecdhq5q2z3cnavy6m543gzyhkl2nu5t8fz0zctqtvm2tj
|
||||
- &d age1dzdf4rgep3ctk3dnrmrqtdgrchaa8nszfc4dp29gqwsst3z6jyrq57vfsj
|
||||
- &e age197a33mlf5294amjx59hycctu6wm4l3cu3w7n9rv3fs9340ql64rqjzpr7s
|
||||
- &f age1sqj8z3feqm2dk3gj8mxpfn5dpqnsmus862e8ayd0d4cdresqffdswcf9ru
|
||||
- &g age1rz75dqzfd6gulwh270ukmt5amcau6j8dpxgzx8fm6u8sjkyx9usq69y4s2
|
||||
- &h age148huz6rc3q9xx5t873ncx75sja2sazlescwspxl7lsmxsqkz0apsy8cldp
|
||||
- &i age1ck6lhd8thjcrdcnkn2epc8npztg0sfswahunjkwcf57rr0xaevys8fh0x6
|
||||
- &j age13j6l33g0ghk4vezn0qwfal2qmcgqwkv89ejwezpe3n47mw8yxyuslj6y7d
|
||||
- &k age13x0f3glnz4jvqty2v92cxrrnjcna6ed4qegrhulw9jjy08zuy3aqzvrfc6
|
||||
machine_host_keys:
|
||||
- &trip age10lv32k2guszr5y69sez3z5xj92wzmdxvfejd6hm8xr0pmclw2cvq0hk6pe
|
||||
- &compute-deck-host age1hcqem868xhjdj3lzsvgf0duylwrdp9nqs06a9d0043cpsuhms4as7cqnv4
|
||||
@@ -15,11 +22,33 @@ creation_rules:
|
||||
- path_regex: ^secrets/liam/
|
||||
key_groups:
|
||||
- age:
|
||||
- *pixel-termux
|
||||
- *t460s
|
||||
- *pixel-nix
|
||||
- *compute-deck-user
|
||||
- *a
|
||||
- *b
|
||||
- *c
|
||||
- *d
|
||||
- *e
|
||||
- *f
|
||||
- *g
|
||||
- *h
|
||||
- *i
|
||||
- *j
|
||||
- *k
|
||||
- *liam
|
||||
- path_regex: ^secrets/triple-dezert/
|
||||
key_groups:
|
||||
- age:
|
||||
- *a
|
||||
- *b
|
||||
- *c
|
||||
- *d
|
||||
- *e
|
||||
- *f
|
||||
- *g
|
||||
- *h
|
||||
- *i
|
||||
- *j
|
||||
- *k
|
||||
- *trip
|
||||
- path_regex: ^tests/test_secrets/
|
||||
key_groups:
|
||||
- age:
|
||||
|
18
README.md
18
README.md
@@ -1,13 +1,31 @@
|
||||
more just notes for now
|
||||
|
||||
---
|
||||
|
||||
deploy:
|
||||
|
||||
```sh
|
||||
nixos-rebuild switch --flake .#triple-dezert --target-host trip.shelvacu.com --use-remote-sudo
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
build flake on remote machine, including eval:
|
||||
|
||||
```sh
|
||||
git add . && ssh trip nix flake check $(nix flake archive --to ssh://trip --json | jq .path -r)
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
search for string in closure
|
||||
|
||||
```sh
|
||||
rg search_str $(nix path-info --recursive ./result)
|
||||
```
|
||||
|
||||
or
|
||||
|
||||
```sh
|
||||
rg search_str $(nix path-info --recursive .#qb.trip)
|
||||
```
|
||||
|
@@ -1,288 +0,0 @@
|
||||
{ config, pkgs, lib, inputs, ... }: let
|
||||
inherit (lib) mkOption types flip concatMapStringsSep optionalString concatStringsSep readFile mapAttrsToList literalExpression;
|
||||
inherit (builtins) attrValues;
|
||||
cfg = config.vacu;
|
||||
knownHosts = attrValues cfg.ssh.knownHosts;
|
||||
knownHostsText = (flip (concatMapStringsSep "\n") knownHosts
|
||||
(h: assert h.hostNames != [];
|
||||
optionalString h.certAuthority "@cert-authority " + concatStringsSep "," h.hostNames + " "
|
||||
+ (if h.publicKey != null then h.publicKey else readFile h.publicKeyFile)
|
||||
)) + "\n";
|
||||
packageNames = lib.splitString "\n" ''
|
||||
nixos-rebuild
|
||||
nano
|
||||
vim
|
||||
wget
|
||||
screen
|
||||
tmux
|
||||
lsof
|
||||
htop
|
||||
mosh
|
||||
dnsutils
|
||||
iperf3
|
||||
nmap
|
||||
rsync
|
||||
ethtool
|
||||
sshfs
|
||||
ddrescue
|
||||
pciutils
|
||||
ncdu
|
||||
nix-index
|
||||
git
|
||||
pv
|
||||
unzip
|
||||
file
|
||||
ripgrep
|
||||
jq
|
||||
units
|
||||
tree
|
||||
rclone
|
||||
iputils
|
||||
ssh-to-age
|
||||
sops
|
||||
inetutils
|
||||
neovim
|
||||
diffutils
|
||||
findutils
|
||||
utillinux
|
||||
tzdata
|
||||
hostname
|
||||
man
|
||||
gnugrep
|
||||
gnused
|
||||
gnutar
|
||||
bzip2
|
||||
gzip
|
||||
xz
|
||||
zip
|
||||
unzip
|
||||
openssh
|
||||
dig
|
||||
bash
|
||||
git'';
|
||||
plainPackageOpts = map (name: { name = name; value = { enable = lib.mkDefault true; }; }) packageNames;
|
||||
packageOpts = lib.recursiveUpdate (builtins.listToAttrs plainPackageOpts) {
|
||||
nix-search-cli.package = inputs.nix-search-cli.packages.${pkgs.system}.default;
|
||||
nix-search-cli.enable = lib.mkDefault true;
|
||||
nix-inspect.package = inputs.nix-inspect.packages.${pkgs.system}.default;
|
||||
nix-inspect.enable = lib.mkDefault true;
|
||||
};
|
||||
in {
|
||||
imports = [ ./package-set.nix ];
|
||||
options = {
|
||||
vacu.ssh.authorizedKeys = mkOption {
|
||||
type = types.listOf types.str;
|
||||
};
|
||||
vacu.ssh.config = mkOption {
|
||||
type = types.lines;
|
||||
};
|
||||
# Straight copied from nixpkgs
|
||||
# https://github.com/NixOS/nixpkgs/blob/46397778ef1f73414b03ed553a3368f0e7e33c2f/nixos/modules/programs/ssh.nix
|
||||
vacu.ssh.knownHosts = mkOption {
|
||||
default = {};
|
||||
type = types.attrsOf (types.submodule ({ name, config, options, ... }: {
|
||||
options = {
|
||||
certAuthority = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
This public key is an SSH certificate authority, rather than an
|
||||
individual host's key.
|
||||
'';
|
||||
};
|
||||
hostNames = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [ name ] ++ config.extraHostNames;
|
||||
defaultText = literalExpression "[ ${name} ] ++ config.${options.extraHostNames}";
|
||||
description = ''
|
||||
A list of host names and/or IP numbers used for accessing
|
||||
the host's ssh service. This list includes the name of the
|
||||
containing `knownHosts` attribute by default
|
||||
for convenience. If you wish to configure multiple host keys
|
||||
for the same host use multiple `knownHosts`
|
||||
entries with different attribute names and the same
|
||||
`hostNames` list.
|
||||
'';
|
||||
};
|
||||
extraHostNames = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [];
|
||||
description = ''
|
||||
A list of additional host names and/or IP numbers used for
|
||||
accessing the host's ssh service. This list is ignored if
|
||||
`hostNames` is set explicitly.
|
||||
'';
|
||||
};
|
||||
publicKey = mkOption {
|
||||
default = null;
|
||||
type = types.nullOr types.str;
|
||||
example = "ecdsa-sha2-nistp521 AAAAE2VjZHN...UEPg==";
|
||||
description = ''
|
||||
The public key data for the host. You can fetch a public key
|
||||
from a running SSH server with the {command}`ssh-keyscan`
|
||||
command. The public key should not include any host names, only
|
||||
the key type and the key itself.
|
||||
'';
|
||||
};
|
||||
publicKeyFile = mkOption {
|
||||
default = null;
|
||||
type = types.nullOr types.path;
|
||||
description = ''
|
||||
The path to the public key file for the host. The public
|
||||
key file is read at build time and saved in the Nix store.
|
||||
You can fetch a public key file from a running SSH server
|
||||
with the {command}`ssh-keyscan` command. The content
|
||||
of the file should follow the same format as described for
|
||||
the `publicKey` option. Only a single key
|
||||
is supported. If a host has multiple keys, use
|
||||
{option}`programs.ssh.knownHostsFiles` instead.
|
||||
'';
|
||||
};
|
||||
};
|
||||
}));
|
||||
description = ''
|
||||
The set of system-wide known SSH hosts. To make simple setups more
|
||||
convenient the name of an attribute in this set is used as a host name
|
||||
for the entry. This behaviour can be disabled by setting
|
||||
`hostNames` explicitly. You can use
|
||||
`extraHostNames` to add additional host names without
|
||||
disabling this default.
|
||||
'';
|
||||
example = literalExpression ''
|
||||
{
|
||||
myhost = {
|
||||
extraHostNames = [ "myhost.mydomain.com" "10.10.1.4" ];
|
||||
publicKeyFile = ./pubkeys/myhost_ssh_host_dsa_key.pub;
|
||||
};
|
||||
"myhost2.net".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILIRuJ8p1Fi+m6WkHV0KWnRfpM1WxoW8XAS+XvsSKsTK";
|
||||
"myhost2.net/dsa" = {
|
||||
hostNames = [ "myhost2.net" ];
|
||||
publicKeyFile = ./pubkeys/myhost2_ssh_host_dsa_key.pub;
|
||||
};
|
||||
}
|
||||
'';
|
||||
};
|
||||
vacu.nix.extraSubstituters = mkOption { type = types.listOf types.str; };
|
||||
vacu.nix.extraTrustedKeys = mkOption { type = types.listOf types.str; };
|
||||
};
|
||||
config = {
|
||||
vacu.packages = packageOpts;
|
||||
vacu.nix.extraSubstituters = [
|
||||
"https://nixcache.shelvacu.com/"
|
||||
"https://nix-community.cachix.org/"
|
||||
];
|
||||
vacu.nix.extraTrustedKeys = [
|
||||
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
|
||||
"nixcache.shelvacu.com:73u5ZGBpPRoVZfgNJQKYYBt9K9Io/jPwgUfuOLsJbsM="
|
||||
];
|
||||
assertions = flip mapAttrsToList cfg.ssh.knownHosts (name: data: {
|
||||
assertion = (data.publicKey == null && data.publicKeyFile != null) ||
|
||||
(data.publicKey != null && data.publicKeyFile == null);
|
||||
message = "knownHost ${name} must contain either a publicKey or publicKeyFile";
|
||||
});
|
||||
vacu.ssh.authorizedKeys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC4LYvUe9dsQb9OaTDFI4QKPtMmOHOGLwWsXsEmcJW86" # Termux on pixel6pro
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHcYwYy9/0Gu/GsqS72Nkz6OkId+zevqXA/aTIcvqflp" # t460s windows
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFsErA6M9LSHj2hPlLuHD8Lpei7WjMup1JxI1vxA6B8W" # pixel6pro nix-on-droid
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKoy1TrmfhBGWtVedgOM1FB1oD2UdodN3LkBnnLx6Tug" # compute-deck
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICVeSzDkGTueZijB0xUa08e06ovAEwwZK/D+Cc7bo91g" # triple-dezert
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOtwtao/TXbiuQOYJbousRPVesVcb/2nP0PCFUec0Nv8" # triple-dezert (root)
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAxAFFxQMXAgi+0cmGaNE/eAkVfEl91wafUqFIuAkI5I" # compute-deck (root)
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDcRDekd8ZOYfQS5X95/yNof3wFYIbHqWeq4jY0+ywQX" # pro1x nix-on-droid
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIExSObd1lZprdqAFLqFhtxDEckV0q/vZZIYqrYFKfkoC" # devver
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGHLPOxRd68+DJ/bYmqn0wsgwwIcMSMyuU1Ya16hCb/m" # fw (root)
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINQ2c0GzlVMjV06CS7bWbCaAbzG2+7g5FCg/vClJPe0C" # fw
|
||||
];
|
||||
vacu.ssh.config = ''
|
||||
Host deckvacu
|
||||
User deck
|
||||
|
||||
Host rsb
|
||||
User user
|
||||
HostName finaltask.xyz
|
||||
Port 2222
|
||||
|
||||
Host awoo
|
||||
HostName 45.142.157.71
|
||||
|
||||
Host trip
|
||||
HostName trip.shelvacu.com
|
||||
Port 6922
|
||||
|
||||
Host liam
|
||||
HostName 178.128.79.152
|
||||
|
||||
Host pluto
|
||||
HostName pluto.somevideogam.es
|
||||
|
||||
Host *
|
||||
User shelvacu
|
||||
GlobalKnownHostsFile ${pkgs.writeText "known_hosts" knownHostsText}
|
||||
'';
|
||||
|
||||
vacu.ssh.knownHosts = {
|
||||
#public hosts
|
||||
"github.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
|
||||
"gitlab.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf";
|
||||
|
||||
#colin's stuff
|
||||
"uninsane.org" = {
|
||||
extraHostNames = [ "git.uninsane.org" ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfdSmFkrVT6DhpgvFeQKm3Fh9VKZ9DbLYOPOJWYQ0E8";
|
||||
};
|
||||
"desko" = {
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFw9NoRaYrM6LbDd3aFBc4yyBlxGQn8HjeHd/dZ3CfHk";
|
||||
};
|
||||
|
||||
#daymocker's stuff
|
||||
"pluto" = {
|
||||
extraHostNames = [ "74.208.184.137" ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICpHY4fLZ1hNuB2oRQM7R3b4eQyIHbFB45ZYp3XCELLg";
|
||||
};
|
||||
|
||||
#personal hosts
|
||||
"zigbee-hub" = {
|
||||
extraHostNames = [ "10.78.79.114" ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBJxwUYddOxgViJDOiokfaQ6CsCx/Sw+b3IisdJv8zFN root@zigbee-hub";
|
||||
};
|
||||
trip = {
|
||||
extraHostNames = [ "triple-dezert" "trip.shelvacu.com" "[trip.shelvacu.com]:6922" ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGUQux9V0mSF5IauoO1z311NXR7ymEbwRMzT+OaaNQr+";
|
||||
};
|
||||
servacu = {
|
||||
extraHostNames = [ "mail.dis8.net" "servacu.shelvacu.com" ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE+E6na7np0HnBV2X7owno+Fg+bNNRSHLxO6n1JzdUTV";
|
||||
};
|
||||
finaltask = {
|
||||
extraHostNames = [ "rsb" "finaltask.xyz" "[finaltask.xyz]:2222" ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPTx8WBNNKBVRV98HgDChpd59SHbreJ87SXU+zOKan6y";
|
||||
};
|
||||
compute-deck = {
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGt43GmXCxkl5QjgPQ/QimW11lKfXmV4GFWvlxQSf4TQ";
|
||||
};
|
||||
"2esrever" = {
|
||||
extraHostNames = [ "10.4.5.218" "10.244.46.71" ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH0LnPrJxAdffZ//uRe3NBiIfFCBNMLqKVylkyU0llvT";
|
||||
};
|
||||
awoo = {
|
||||
extraHostNames = [ "45.142.157.71" ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQaDjjfSK8jnk9aFIiYH9LZO4nLY/oeAc7BKIPUXMh1";
|
||||
};
|
||||
deckvacu = {
|
||||
publicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEa8qpFkIlLLJkH8rmEAn6/MZ9ilCGmEQWC3CeFae7r1kOqfwRk0nq0oyOGJ50uIh+PpwEh3rbgq6mLfpRfsFmM=";
|
||||
};
|
||||
liam = {
|
||||
extraHostNames = [ "liam.dis8.net" "178.128.79.152" ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHOqJYVHOIFmEA5uRbbirIupWvyBLAFwic/8EZQRdN/c";
|
||||
};
|
||||
devver = {
|
||||
extraHostNames = [ "devver.t2d.lan" "10.78.79.10" ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFeFaH2tzWIiCPdKNmxl3NqCnPTdmVIOBinauUAEl+UU";
|
||||
};
|
||||
fw = {
|
||||
extraHostNames = [ "fw.t2d.lan" ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA6lX25mCy35tf1NpcHMAdeRgvT7l0Dw0FWBH3eX4TE2";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
@@ -1,81 +0,0 @@
|
||||
{ lib, pkgs, config, inputs, utils, ... }:
|
||||
{
|
||||
imports = [ ./common-config.nix ];
|
||||
options.vacu.acmeCertDependencies = lib.mkOption {
|
||||
default = {};
|
||||
example = ''
|
||||
vacu.acmeCertDependencies."mail.example.com" = [ "postfix.service" ];
|
||||
'';
|
||||
type = lib.types.attrsOf (lib.types.listOf utils.systemdUtils.lib.unitNameType);
|
||||
};
|
||||
config = let
|
||||
for-systemd-services = lib.concatMapAttrs
|
||||
(cert: units:
|
||||
{
|
||||
"acme-selfsigned-${cert}" = {
|
||||
wantedBy = units;
|
||||
before = units;
|
||||
};
|
||||
}
|
||||
)
|
||||
config.vacu.acmeCertDependencies;
|
||||
for-security-acme-certs = lib.concatMapAttrs
|
||||
(cert: units:
|
||||
{
|
||||
${cert}.reloadServices = units;
|
||||
}
|
||||
)
|
||||
config.vacu.acmeCertDependencies;
|
||||
in {
|
||||
console = {
|
||||
keyMap = lib.mkDefault "us";
|
||||
};
|
||||
vacu.packages."xorg-xev" = {
|
||||
enable = config.services.xserver.enable;
|
||||
package = pkgs.xorg.xev;
|
||||
};
|
||||
environment.systemPackages = config.vacu.packageList;
|
||||
|
||||
i18n.defaultLocale = lib.mkDefault "en_US.UTF-8";
|
||||
time.timeZone = "America/Los_Angeles";
|
||||
|
||||
users.users.shelvacu = {
|
||||
openssh.authorizedKeys.keys = config.vacu.ssh.authorizedKeys;
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" ];
|
||||
};
|
||||
systemd.services = for-systemd-services;
|
||||
security.acme.certs = for-security-acme-certs;
|
||||
services.openssh = {
|
||||
# require public key authentication for better security
|
||||
settings.PasswordAuthentication = false;
|
||||
settings.KbdInteractiveAuthentication = false;
|
||||
settings.PermitRootLogin = "prohibit-password";
|
||||
};
|
||||
|
||||
nix.settings.trusted-users = [ "shelvacu" ];
|
||||
security.sudo.wheelNeedsPassword = lib.mkDefault false;
|
||||
|
||||
programs.screen = {
|
||||
screenrc = ''
|
||||
defscrollback 10000
|
||||
termcapinfo xterm* ti@:te@
|
||||
'';
|
||||
} // (if config.system.nixos.release == "23.11" then {} else { enable = true; });
|
||||
|
||||
programs.tmux.enable = true;
|
||||
programs.tmux.extraConfig = "setw mouse";
|
||||
programs.tmux.clock24 = true;
|
||||
|
||||
nix.settings = {
|
||||
experimental-features = [ "nix-command" "flakes" ];
|
||||
substituters = config.vacu.nix.extraSubstituters;
|
||||
trusted-public-keys = config.vacu.nix.extraTrustedKeys;
|
||||
};
|
||||
nixpkgs.config.allowUnfree = lib.mkDefault true;
|
||||
|
||||
programs.mosh.enable = lib.mkDefault true;
|
||||
|
||||
programs.ssh.extraConfig = config.vacu.ssh.config;
|
||||
};
|
||||
}
|
@@ -1,37 +0,0 @@
|
||||
{ pkgs, inputs }: (with pkgs; [
|
||||
inputs.nix-search-cli.packages.${pkgs.system}.default
|
||||
inputs.nix-inspect.packages.${pkgs.system}.default
|
||||
nixos-rebuild
|
||||
nano
|
||||
vim
|
||||
wget
|
||||
screen
|
||||
tmux
|
||||
lsof
|
||||
htop
|
||||
mosh
|
||||
dnsutils
|
||||
iperf3
|
||||
nmap
|
||||
rsync
|
||||
ethtool
|
||||
sshfs
|
||||
ddrescue
|
||||
pciutils
|
||||
ncdu
|
||||
nix-index
|
||||
git
|
||||
pv
|
||||
unzip
|
||||
file
|
||||
ripgrep
|
||||
jq
|
||||
units
|
||||
tree
|
||||
rclone
|
||||
iputils
|
||||
ssh-to-age
|
||||
sops
|
||||
inetutils
|
||||
neovim
|
||||
])
|
9
common/common-but-not.nix
Normal file
9
common/common-but-not.nix
Normal file
@@ -0,0 +1,9 @@
|
||||
# todo: rename this module
|
||||
# stuff that does actual configuring (so can't be in ./module.nix) but works in nixos module, home-manager modules, and nix-on-droid modules
|
||||
{ inputs, ... }:
|
||||
{
|
||||
nix.registry.vacu.to = {
|
||||
type = "path";
|
||||
path = inputs.self.outPath;
|
||||
};
|
||||
}
|
79
common/defaultPackages.nix
Normal file
79
common/defaultPackages.nix
Normal file
@@ -0,0 +1,79 @@
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
inputs,
|
||||
lib,
|
||||
...
|
||||
}: lib.mkMerge [
|
||||
(lib.mkIf (!config.vacu.minimal) {
|
||||
vacu.packages =
|
||||
(with pkgs; [
|
||||
home-manager
|
||||
nix-index
|
||||
rclone
|
||||
termscp
|
||||
man
|
||||
neovim
|
||||
nmap
|
||||
ruby
|
||||
])
|
||||
++ [
|
||||
inputs.nix-search-cli.packages.${pkgs.system}.default
|
||||
inputs.nix-inspect.packages.${pkgs.system}.default
|
||||
];
|
||||
}) {
|
||||
vacu.packages =
|
||||
with pkgs; [
|
||||
nixos-rebuild
|
||||
which
|
||||
nano
|
||||
vim
|
||||
wget
|
||||
screen
|
||||
tmux
|
||||
lsof
|
||||
htop
|
||||
mosh
|
||||
dnsutils
|
||||
iperf3
|
||||
rsync
|
||||
ethtool
|
||||
sshfs
|
||||
ddrescue
|
||||
pciutils
|
||||
ncdu
|
||||
pv
|
||||
unzip
|
||||
file
|
||||
ripgrep
|
||||
jq
|
||||
units
|
||||
tree
|
||||
iputils
|
||||
ssh-to-age
|
||||
sops
|
||||
inetutils
|
||||
diffutils
|
||||
findutils
|
||||
utillinux
|
||||
tzdata
|
||||
hostname
|
||||
gnugrep
|
||||
gnused
|
||||
gnutar
|
||||
bzip2
|
||||
gzip
|
||||
xz
|
||||
zip
|
||||
unzip
|
||||
openssh
|
||||
dig
|
||||
bash
|
||||
usbutils
|
||||
psutils
|
||||
killall
|
||||
git
|
||||
curl
|
||||
];
|
||||
}
|
||||
]
|
7
common/home.nix
Normal file
7
common/home.nix
Normal file
@@ -0,0 +1,7 @@
|
||||
{ ... }:
|
||||
let
|
||||
|
||||
in
|
||||
{
|
||||
imports = [ ./common-but-not.nix ];
|
||||
}
|
45
common/minimal-nixos.nix
Normal file
45
common/minimal-nixos.nix
Normal file
@@ -0,0 +1,45 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
inherit (lib) mkIf mkDefault;
|
||||
in
|
||||
{
|
||||
config = mkIf config.vacu.minimal {
|
||||
programs.git.lfs.enable = false;
|
||||
programs.git.package = pkgs.gitMinimal;
|
||||
# mostly copied from nixos's /profiles/minimal.nix
|
||||
environment.noXlibs = mkDefault true;
|
||||
|
||||
documentation.enable = mkDefault false;
|
||||
|
||||
documentation.doc.enable = mkDefault false;
|
||||
|
||||
documentation.info.enable = mkDefault false;
|
||||
|
||||
documentation.man.enable = mkDefault false;
|
||||
|
||||
documentation.nixos.enable = mkDefault false;
|
||||
|
||||
# Perl is a default package.
|
||||
environment.defaultPackages = mkDefault [ ];
|
||||
|
||||
environment.stub-ld.enable = false;
|
||||
|
||||
# The lessopen package pulls in Perl.
|
||||
programs.less.lessopen = mkDefault null;
|
||||
|
||||
programs.command-not-found.enable = mkDefault false;
|
||||
|
||||
services.logrotate.enable = mkDefault false;
|
||||
|
||||
services.udisks2.enable = mkDefault false;
|
||||
|
||||
xdg.autostart.enable = mkDefault false;
|
||||
xdg.icons.enable = mkDefault false;
|
||||
xdg.mime.enable = mkDefault false;
|
||||
xdg.sounds.enable = mkDefault false;
|
||||
};
|
||||
}
|
215
common/module.nix
Normal file
215
common/module.nix
Normal file
@@ -0,0 +1,215 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
inputs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (lib) mkOption types;
|
||||
inherit (inputs) self;
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
./package-set.nix
|
||||
./shell
|
||||
./nixvim.nix
|
||||
./ssh.nix
|
||||
./nix.nix
|
||||
./verify-system
|
||||
./defaultPackages.nix
|
||||
];
|
||||
options = {
|
||||
vacu.rootCAs = mkOption { type = types.listOf types.str; };
|
||||
vacu.versionId = mkOption {
|
||||
type = types.str;
|
||||
readOnly = true;
|
||||
};
|
||||
vacu.versionInfo = mkOption { readOnly = true; };
|
||||
vacu.hostName = mkOption { type = types.str; };
|
||||
vacu.shortHostName = mkOption {
|
||||
type = types.str;
|
||||
default = config.vacu.hostName;
|
||||
};
|
||||
vacu.nixvimPkg = mkOption { readOnly = true; };
|
||||
vacu.minimal = lib.mkEnableOption "minimal system";
|
||||
};
|
||||
config = {
|
||||
vacu.versionId = toString (self.shortRev or self.dirtyShortRev);
|
||||
vacu.versionInfo = {
|
||||
id = self.rev or self.dirtyRev;
|
||||
flakePath = self.outPath;
|
||||
inherit inputs;
|
||||
} // (if config.nixpkgs ? flake then { nixpkgs = config.nixpkgs.flake.source; } else {});
|
||||
|
||||
vacu.nix.caches.nixcache-shelvacu = {
|
||||
url = "https://nixcache.shelvacu.com/";
|
||||
keys = [ "nixcache.shelvacu.com:73u5ZGBpPRoVZfgNJQKYYBt9K9Io/jPwgUfuOLsJbsM=" ];
|
||||
};
|
||||
vacu.nix.caches.nix-community = {
|
||||
url = "https://nix-community.cachix.org/";
|
||||
keys = [ "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" ];
|
||||
};
|
||||
vacu.nix.caches.nix-on-droid = {
|
||||
url = "https://nix-on-droid.cachix.org/";
|
||||
keys = [ "nix-on-droid.cachix.org-1:56snoMJTXmDRC1Ei24CmKoUqvHJ9XCp+nidK7qkMQrU=" ];
|
||||
};
|
||||
vacu.nix.caches.nixos = {
|
||||
url = "https://cache.nixos.org/";
|
||||
keys = [ "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" ];
|
||||
};
|
||||
vacu.rootCAs = [
|
||||
''
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIBnjCCAUWgAwIBAgIBBTAKBggqhkjOPQQDAjAgMQswCQYDVQQGEwJVUzERMA8G
|
||||
A1UEAxMIdm5vcG4gQ0EwHhcNMjQwODEyMjExNTQwWhcNMzQwODEwMjExNTQwWjAg
|
||||
MQswCQYDVQQGEwJVUzERMA8GA1UEAxMIdm5vcG4gQ0EwWTATBgcqhkjOPQIBBggq
|
||||
hkjOPQMBBwNCAARqRbSeq00FfYUGeCHVkzwrjrydI56T12xy+iut0c4PemSuhyxC
|
||||
AgfdKYtDqMNZmSqMaLihzkBenD0bN5i0ndjho3AwbjAPBgNVHRMBAf8EBTADAQH/
|
||||
MCwGA1UdHgEB/wQiMCCgGDAKhwgKTkwA///8ADAKgggudDJkLmxhbqEEMAKBADAO
|
||||
BgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFAjSkbJQCQc1WP6nIP5iLDIKGFrdMAoG
|
||||
CCqGSM49BAMCA0cAMEQCIFtyawkZqFhvzgmqG/mYNNO6DdsQTPQ46x/08yrEiiF4
|
||||
AiA+FwAPqX+CBkaSdIhuhv1kIecmvacnDL5kpyB+9nDodw==
|
||||
-----END CERTIFICATE-----
|
||||
''
|
||||
];
|
||||
|
||||
vacu.ssh.authorizedKeys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC4LYvUe9dsQb9OaTDFI4QKPtMmOHOGLwWsXsEmcJW86" # Termux on pixel6pro
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHcYwYy9/0Gu/GsqS72Nkz6OkId+zevqXA/aTIcvqflp" # t460s windows
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFsErA6M9LSHj2hPlLuHD8Lpei7WjMup1JxI1vxA6B8W" # pixel6pro nix-on-droid
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKoy1TrmfhBGWtVedgOM1FB1oD2UdodN3LkBnnLx6Tug" # compute-deck
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICVeSzDkGTueZijB0xUa08e06ovAEwwZK/D+Cc7bo91g" # triple-dezert
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOtwtao/TXbiuQOYJbousRPVesVcb/2nP0PCFUec0Nv8" # triple-dezert (root)
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAxAFFxQMXAgi+0cmGaNE/eAkVfEl91wafUqFIuAkI5I" # compute-deck (root)
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDcRDekd8ZOYfQS5X95/yNof3wFYIbHqWeq4jY0+ywQX" # pro1x nix-on-droid
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGHLPOxRd68+DJ/bYmqn0wsgwwIcMSMyuU1Ya16hCb/m" # fw (root)
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINQ2c0GzlVMjV06CS7bWbCaAbzG2+7g5FCg/vClJPe0C" # fw
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINznGot+L8kYoVQqdLV/R17XCd1ILMoDCILOg+I3s5wC" # pixel9pro nix-on-droid
|
||||
];
|
||||
vacu.ssh.config = ''
|
||||
Host deckvacu
|
||||
User deck
|
||||
|
||||
Host rsb
|
||||
User user
|
||||
HostName finaltask.xyz
|
||||
Port 2222
|
||||
|
||||
Host awoo
|
||||
HostName 45.142.157.71
|
||||
|
||||
Host trip
|
||||
HostName trip.shelvacu.com
|
||||
Port 6922
|
||||
|
||||
Host liam
|
||||
HostName 178.128.79.152
|
||||
|
||||
Host pluto
|
||||
HostName pluto.somevideogam.es
|
||||
|
||||
Host *
|
||||
User shelvacu
|
||||
GlobalKnownHostsFile ${pkgs.writeText "known_hosts" config.vacu.ssh.knownHostsText}
|
||||
'';
|
||||
|
||||
vacu.ssh.knownHosts = {
|
||||
#public hosts
|
||||
"github.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
|
||||
"gitlab.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf";
|
||||
"git.sr.ht".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZvRd4EtM7R+IHVMWmDkVU3VLQTSwQDSAvW0t2Tkj60";
|
||||
|
||||
#colin's stuff
|
||||
"uninsane.org" = {
|
||||
extraHostNames = [ "git.uninsane.org" ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfdSmFkrVT6DhpgvFeQKm3Fh9VKZ9DbLYOPOJWYQ0E8";
|
||||
};
|
||||
"desko" = {
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFw9NoRaYrM6LbDd3aFBc4yyBlxGQn8HjeHd/dZ3CfHk";
|
||||
};
|
||||
|
||||
#daymocker's stuff
|
||||
"pluto" = {
|
||||
extraHostNames = [ "74.208.184.137" ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICpHY4fLZ1hNuB2oRQM7R3b4eQyIHbFB45ZYp3XCELLg";
|
||||
};
|
||||
|
||||
#powerhouse hosts
|
||||
"ostiary" = {
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBSYyd1DGPXGaV4mD34tUbXvbtIi/Uv2otoMUsCkxRse";
|
||||
};
|
||||
"habitat" = {
|
||||
# previously known as zigbee-hub
|
||||
extraHostNames = [ "10.78.79.114" ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBJxwUYddOxgViJDOiokfaQ6CsCx/Sw+b3IisdJv8zFN";
|
||||
};
|
||||
"vnopn" = {
|
||||
extraHostNames = [
|
||||
"10.78.79.1"
|
||||
"vnopn.t2d.lan"
|
||||
];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEMgJE8shlTYF3nxKR/aILd1SzwDwhtCrjz9yHL7lgSZ";
|
||||
};
|
||||
|
||||
#work laptop
|
||||
"tebbs-MBP" = {
|
||||
extraHostNames = [ "10.244.10.3" ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKO/ks07zSByDH/qmDrghtBSFwWnze2s62zEmtXwaMJe";
|
||||
};
|
||||
|
||||
#personal hosts
|
||||
trip = {
|
||||
extraHostNames = [
|
||||
"triple-dezert"
|
||||
"trip.shelvacu.com"
|
||||
"[trip.shelvacu.com]:6922"
|
||||
];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGUQux9V0mSF5IauoO1z311NXR7ymEbwRMzT+OaaNQr+";
|
||||
};
|
||||
servacu = {
|
||||
extraHostNames = [
|
||||
"mail.dis8.net"
|
||||
"servacu.shelvacu.com"
|
||||
];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE+E6na7np0HnBV2X7owno+Fg+bNNRSHLxO6n1JzdUTV";
|
||||
};
|
||||
finaltask = {
|
||||
extraHostNames = [
|
||||
"rsb"
|
||||
"finaltask.xyz"
|
||||
"[finaltask.xyz]:2222"
|
||||
];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPTx8WBNNKBVRV98HgDChpd59SHbreJ87SXU+zOKan6y";
|
||||
};
|
||||
compute-deck = {
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGt43GmXCxkl5QjgPQ/QimW11lKfXmV4GFWvlxQSf4TQ";
|
||||
};
|
||||
"2esrever" = {
|
||||
extraHostNames = [
|
||||
"10.4.5.218"
|
||||
"10.244.46.71"
|
||||
];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH0LnPrJxAdffZ//uRe3NBiIfFCBNMLqKVylkyU0llvT";
|
||||
};
|
||||
awoo = {
|
||||
extraHostNames = [ "45.142.157.71" ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQaDjjfSK8jnk9aFIiYH9LZO4nLY/oeAc7BKIPUXMh1";
|
||||
};
|
||||
deckvacu = {
|
||||
publicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEa8qpFkIlLLJkH8rmEAn6/MZ9ilCGmEQWC3CeFae7r1kOqfwRk0nq0oyOGJ50uIh+PpwEh3rbgq6mLfpRfsFmM=";
|
||||
};
|
||||
liam = {
|
||||
extraHostNames = [
|
||||
"liam.dis8.net"
|
||||
"178.128.79.152"
|
||||
];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHOqJYVHOIFmEA5uRbbirIupWvyBLAFwic/8EZQRdN/c";
|
||||
};
|
||||
fw = {
|
||||
extraHostNames = [ "fw.t2d.lan" ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA6lX25mCy35tf1NpcHMAdeRgvT7l0Dw0FWBH3eX4TE2";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
21
common/nix-on-droid.nix
Normal file
21
common/nix-on-droid.nix
Normal file
@@ -0,0 +1,21 @@
|
||||
{ config, lib, ... }:
|
||||
let
|
||||
inherit (lib) mkDefault;
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
./module.nix
|
||||
./common-but-not.nix
|
||||
];
|
||||
environment.packages = config.vacu.packageList;
|
||||
environment.etc."ssh/ssh_config".text = config.vacu.ssh.config;
|
||||
nix.substituters = lib.mkForce config.vacu.nix.substituterUrls;
|
||||
nix.trustedPublicKeys = lib.mkForce config.vacu.nix.trustedKeys;
|
||||
vacu.shell.functionsDir = "${config.user.home}/.nix-profile/share/vacufuncs";
|
||||
environment.etc.bashrc.text = config.vacu.shell.interactiveLines;
|
||||
environment.etc.profile.text = config.vacu.shell.interactiveLines;
|
||||
environment.etc."vacu.json".text = builtins.toJSON config.vacu.versionInfo;
|
||||
|
||||
vacu.hostName = mkDefault "nix-on-droid";
|
||||
vacu.shortHostName = mkDefault "nod";
|
||||
}
|
36
common/nix.nix
Normal file
36
common/nix.nix
Normal file
@@ -0,0 +1,36 @@
|
||||
{ lib, config, ... }:
|
||||
let
|
||||
inherit (lib) mkOption types;
|
||||
caches = builtins.attrValues config.vacu.nix.caches;
|
||||
enabledCaches = builtins.filter (c: c.enable) caches;
|
||||
in
|
||||
{
|
||||
options = {
|
||||
vacu.nix.caches = mkOption {
|
||||
type = types.attrsOf (
|
||||
types.submodule (
|
||||
{ name, ... }:
|
||||
{
|
||||
options = {
|
||||
url = mkOption { type = types.str; };
|
||||
keys = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [ ];
|
||||
};
|
||||
enable = mkOption {
|
||||
default = true;
|
||||
type = types.bool;
|
||||
};
|
||||
};
|
||||
}
|
||||
)
|
||||
);
|
||||
};
|
||||
vacu.nix.substituterUrls = mkOption { readOnly = true; };
|
||||
vacu.nix.trustedKeys = mkOption { readOnly = true; };
|
||||
vacu.nix.plainOptions = mkOption { };
|
||||
};
|
||||
config.vacu.nix.substituterUrls = map (c: c.url) enabledCaches;
|
||||
config.vacu.nix.trustedKeys = builtins.concatMap (c: c.keys) enabledCaches;
|
||||
config.vacu.nix.plainOptions.allowUnfree = true;
|
||||
}
|
33
common/nixos-rebuild.nix
Normal file
33
common/nixos-rebuild.nix
Normal file
@@ -0,0 +1,33 @@
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
nixos-rebuild = pkgs.nixos-rebuild.override { nix = config.nix.package.out; };
|
||||
in
|
||||
{
|
||||
options.vacu.alwaysUseRemoteSudo =
|
||||
(lib.mkEnableOption "always deploy to this machine with --use-remote-sudo")
|
||||
// {
|
||||
default = true;
|
||||
};
|
||||
config = lib.mkIf config.vacu.alwaysUseRemoteSudo {
|
||||
system.build.nixos-rebuild = lib.mkForce (
|
||||
pkgs.runCommandLocal "nixos-rebuild-wrapped"
|
||||
{
|
||||
nativeBuildInputs = [ pkgs.makeShellWrapper ];
|
||||
meta.mainProgram = "nixos-rebuild";
|
||||
}
|
||||
''
|
||||
runHook preInstall
|
||||
|
||||
mkdir -p $out/bin
|
||||
makeShellWrapper ${lib.getExe nixos-rebuild} $out/bin/nixos-rebuild --add-flags "--use-remote-sudo"
|
||||
|
||||
runHook postInstall
|
||||
''
|
||||
);
|
||||
};
|
||||
}
|
120
common/nixos.nix
Normal file
120
common/nixos.nix
Normal file
@@ -0,0 +1,120 @@
|
||||
{
|
||||
lib,
|
||||
pkgs,
|
||||
config,
|
||||
utils,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = [
|
||||
./module.nix
|
||||
./common-but-not.nix
|
||||
./verify-system/nixos.nix
|
||||
./nixos-rebuild.nix
|
||||
./minimal-nixos.nix
|
||||
];
|
||||
options.vacu.underTest = lib.mkOption {
|
||||
default = false;
|
||||
type = lib.types.bool;
|
||||
};
|
||||
options.vacu.acmeCertDependencies = lib.mkOption {
|
||||
default = { };
|
||||
example = ''
|
||||
vacu.acmeCertDependencies."mail.example.com" = [ "postfix.service" ];
|
||||
'';
|
||||
type = lib.types.attrsOf (lib.types.listOf utils.systemdUtils.lib.unitNameType);
|
||||
};
|
||||
config =
|
||||
let
|
||||
for-systemd-services = lib.concatMapAttrs (cert: units: {
|
||||
"acme-selfsigned-${cert}" = {
|
||||
wantedBy = units;
|
||||
before = units;
|
||||
};
|
||||
}) config.vacu.acmeCertDependencies;
|
||||
for-security-acme-certs = lib.concatMapAttrs (cert: units: {
|
||||
${cert}.reloadServices = units;
|
||||
}) config.vacu.acmeCertDependencies;
|
||||
in
|
||||
{
|
||||
# the security warning might as well have said "its insecure maybe but there's nothing you can do about it"
|
||||
# presumably needed by nheko
|
||||
nixpkgs.config.permittedInsecurePackages = [ "olm-3.2.16" ];
|
||||
|
||||
console = {
|
||||
keyMap = lib.mkDefault "us";
|
||||
};
|
||||
networking.hostName = config.vacu.hostName;
|
||||
vacu.packages."xorg-xev" = {
|
||||
enable = config.services.xserver.enable;
|
||||
package = pkgs.xorg.xev;
|
||||
};
|
||||
environment.systemPackages = config.vacu.packageList;
|
||||
programs.git = lib.mkDefault {
|
||||
enable = true;
|
||||
lfs.enable = true;
|
||||
};
|
||||
programs.nix-ld.enable = true;
|
||||
system.nixos.tags = [
|
||||
"vacu${config.vacu.versionId}"
|
||||
config.vacu.hostName
|
||||
];
|
||||
environment.etc."vacu.json".text = builtins.toJSON config.vacu.versionInfo;
|
||||
|
||||
i18n.defaultLocale = lib.mkDefault "en_US.UTF-8";
|
||||
time.timeZone = "America/Los_Angeles";
|
||||
|
||||
users.users.shelvacu = {
|
||||
openssh.authorizedKeys.keys = config.vacu.ssh.authorizedKeys;
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" ];
|
||||
};
|
||||
systemd.services = for-systemd-services;
|
||||
security.acme.certs = for-security-acme-certs;
|
||||
services.openssh = {
|
||||
# require public key authentication for better security
|
||||
settings.PasswordAuthentication = false;
|
||||
settings.KbdInteractiveAuthentication = false;
|
||||
settings.PermitRootLogin = "prohibit-password";
|
||||
};
|
||||
|
||||
nix.settings.trusted-users = [ "shelvacu" ];
|
||||
security.sudo.wheelNeedsPassword = lib.mkDefault false;
|
||||
|
||||
programs.screen = {
|
||||
screenrc = ''
|
||||
defscrollback 10000
|
||||
termcapinfo xterm* ti@:te@
|
||||
maptimeout 5
|
||||
'';
|
||||
} // (if config.system.nixos.release == "23.11" then { } else { enable = true; });
|
||||
|
||||
programs.tmux.enable = true;
|
||||
programs.tmux.extraConfig = "setw mouse";
|
||||
programs.tmux.clock24 = true;
|
||||
|
||||
nix.settings = {
|
||||
experimental-features = [
|
||||
"nix-command"
|
||||
"flakes"
|
||||
];
|
||||
substituters = lib.mkForce config.vacu.nix.substituterUrls;
|
||||
extra-substituters = lib.mkForce [ ];
|
||||
trusted-public-keys = lib.mkForce config.vacu.nix.trustedKeys;
|
||||
extra-trusted-public-keys = lib.mkForce [ ];
|
||||
};
|
||||
nixpkgs.config.allowUnfree = lib.mkDefault true;
|
||||
|
||||
programs.mosh.enable = lib.mkDefault true;
|
||||
|
||||
programs.ssh.extraConfig = config.vacu.ssh.config;
|
||||
|
||||
security.pki.certificates = config.vacu.rootCAs;
|
||||
|
||||
# commands.nix
|
||||
environment.pathsToLink = [ "/share/vacufuncs" ];
|
||||
vacu.shell.functionsDir = "/run/current-system/sw/share/vacufuncs";
|
||||
programs.bash.interactiveShellInit = config.vacu.shell.interactiveLines;
|
||||
programs.bash.promptInit = lib.mkForce "";
|
||||
};
|
||||
}
|
15
common/nixvim.nix
Normal file
15
common/nixvim.nix
Normal file
@@ -0,0 +1,15 @@
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
inputs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
{
|
||||
vacu.nixvimPkg = inputs.self.packages.${pkgs.system}.nixvim;
|
||||
vacu.shell.functions = lib.mkIf (!config.vacu.minimal) {
|
||||
nvim-plain = ''${pkgs.neovim}/bin/nvim "$@"'';
|
||||
nvim-nixvim = ''${config.vacu.nixvimPkg}/bin/nvim "$@"'';
|
||||
nvim = ''nvim-nixvim "$@"'';
|
||||
};
|
||||
}
|
74
common/package-set.nix
Normal file
74
common/package-set.nix
Normal file
@@ -0,0 +1,74 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (lib) mkOption types;
|
||||
pkgOptions = builtins.attrValues config.vacu.packages;
|
||||
enabledOptions = builtins.filter (o: o.enable) pkgOptions;
|
||||
enabledPkgs = builtins.map (o: o.package) enabledOptions;
|
||||
packagesSetType = types.attrsOf (
|
||||
types.submodule (
|
||||
{
|
||||
name,
|
||||
...
|
||||
}:
|
||||
{
|
||||
options = {
|
||||
enable = mkOption {
|
||||
type = types.bool;
|
||||
description = "Will this package be installed (included in environment.systemPackages)";
|
||||
};
|
||||
package = mkOption {
|
||||
type = types.package;
|
||||
default = pkgs.${name};
|
||||
defaultText = "pkgs.${name}";
|
||||
};
|
||||
};
|
||||
}
|
||||
)
|
||||
);
|
||||
packageListToSet = (
|
||||
from:
|
||||
let
|
||||
keyvals = map (
|
||||
val:
|
||||
if builtins.isString val then
|
||||
{
|
||||
name = val;
|
||||
value = {
|
||||
package = pkgs."${val}";
|
||||
enable = lib.mkDefault true;
|
||||
};
|
||||
}
|
||||
else
|
||||
{
|
||||
name = val.pname or val.name;
|
||||
value = {
|
||||
package = lib.mkDefault val;
|
||||
enable = lib.mkDefault true;
|
||||
};
|
||||
}
|
||||
) from;
|
||||
in
|
||||
builtins.listToAttrs keyvals
|
||||
);
|
||||
in
|
||||
{
|
||||
options = {
|
||||
vacu.packages = mkOption {
|
||||
default = { };
|
||||
type = types.coercedTo (types.listOf (
|
||||
types.either types.str types.package
|
||||
)) packageListToSet packagesSetType;
|
||||
};
|
||||
vacu.packageList = mkOption {
|
||||
type = types.listOf types.package;
|
||||
readOnly = true;
|
||||
};
|
||||
};
|
||||
|
||||
config.vacu.packageList = enabledPkgs;
|
||||
}
|
95
common/shell/default.nix
Normal file
95
common/shell/default.nix
Normal file
@@ -0,0 +1,95 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
vaculib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (lib) mkOption types;
|
||||
cfg = config.vacu.shell;
|
||||
writeShellFunction =
|
||||
name: text:
|
||||
pkgs.writeTextFile {
|
||||
inherit name;
|
||||
executable = false;
|
||||
destination = "/share/vacufuncs/${name}";
|
||||
text = ''
|
||||
${text}
|
||||
'';
|
||||
checkPhase = ''
|
||||
${pkgs.stdenv.shellDryRun} "$target"
|
||||
'';
|
||||
};
|
||||
functionPackages = lib.mapAttrsToList writeShellFunction cfg.functions;
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
./not-aliases.nix
|
||||
./ps1.nix
|
||||
];
|
||||
options = {
|
||||
vacu.shell.functionsDir = mkOption { type = types.path; };
|
||||
vacu.shell.interactiveLines = mkOption {
|
||||
type = types.lines;
|
||||
default = "";
|
||||
};
|
||||
vacu.shell.idempotentShellLines = mkOption {
|
||||
type = types.lines;
|
||||
default = "";
|
||||
};
|
||||
vacu.shell.color = mkOption { type = types.enum (builtins.attrNames vaculib.shellColors); };
|
||||
vacu.shell.functions = mkOption { type = types.attrsOf types.str; };
|
||||
};
|
||||
config = {
|
||||
_module.args.vaculib = {
|
||||
# https://en.wikipedia.org/wiki/ANSI_escape_code#Colors
|
||||
shellColors = {
|
||||
black = 30;
|
||||
red = 31;
|
||||
green = 32;
|
||||
yellow = 33;
|
||||
blue = 34;
|
||||
magenta = 35;
|
||||
cyan = 36;
|
||||
white = 37;
|
||||
};
|
||||
};
|
||||
vacu.shell.interactiveLines = ''
|
||||
if [[ $- == *i* ]] && [[ -f ${cfg.functionsDir}/vacureload ]]; then
|
||||
function __vacushell_load() { eval "$(cat ${cfg.functionsDir}/vacureload)"; }
|
||||
__vacushell_load
|
||||
unset __vacushell_load
|
||||
fi
|
||||
'';
|
||||
vacu.shell.functions."vacureload" = ''
|
||||
declare -gA vacuShellFunctionsLoaded
|
||||
if ! [[ -f ${cfg.functionsDir}/vacureload ]]; then
|
||||
echo "vacureload: I think that's my cue to leave (${cfg.functionsDir}/vacureload not found, assuming vacureload-less config has been loaded and unloading myself)" 1>&2
|
||||
for funcname in "''${!vacuShellFunctionsLoaded[@]}"; do
|
||||
unset -f $funcname
|
||||
done
|
||||
return
|
||||
fi
|
||||
for funcname in "''${!vacuShellFunctionsLoaded[@]}"; do
|
||||
if ! [[ -f ${cfg.functionsDir}/$funcname ]]; then
|
||||
unset -f $funcname
|
||||
fi
|
||||
done
|
||||
for fullPath in ${cfg.functionsDir}/*; do
|
||||
local funcname="$(basename "$fullPath")"
|
||||
local followedPath="$(readlink -f "$fullPath")"
|
||||
if [[ "''${vacuShellFunctionsLoaded[$funcname]}" != "$followedPath" ]]; then
|
||||
unset -f $funcname
|
||||
eval "function ''${funcname}() { if [[ -f '$fullPath' ]]; then eval "'"$'"(cat '$fullPath')"'"'"; else echo '$funcname is no longer there, kindly removing myself.' 1>&2; unset $funcname; return 1; fi }"
|
||||
vacuShellFunctionsLoaded[$funcname]=$followedPath
|
||||
fi
|
||||
unset followedPath
|
||||
unset funcname
|
||||
done
|
||||
__set_idempotents
|
||||
'';
|
||||
vacu.shell.functions."__set_idempotents" = cfg.idempotentShellLines;
|
||||
vacu.packages = functionPackages;
|
||||
};
|
||||
}
|
45
common/shell/not-aliases.nix
Normal file
45
common/shell/not-aliases.nix
Normal file
@@ -0,0 +1,45 @@
|
||||
# These are the things that might in a simpler time go in ~/.bashrc as aliases. But they're not aliases, cuz aliases are bad
|
||||
{ pkgs, ... }:
|
||||
let
|
||||
inherit (pkgs) writeScriptBin;
|
||||
in
|
||||
{
|
||||
vacu.packages = [
|
||||
(writeScriptBin "ms" ''
|
||||
set -e
|
||||
if [[ $# != 1 ]]; then
|
||||
echo "wrong number of args" 1>&2
|
||||
exit 1
|
||||
fi
|
||||
set -x
|
||||
mosh -- $1 screen -Rd
|
||||
'')
|
||||
(writeScriptBin "mss" ''
|
||||
set -e
|
||||
if [[ $# != 1 ]]; then
|
||||
echo "wrong number of args" 1>&2
|
||||
exit 1
|
||||
fi
|
||||
set -x
|
||||
mosh -- $1 sudo screen -Rd
|
||||
'')
|
||||
(writeScriptBin "rmln" ''
|
||||
set -eo pipefail
|
||||
for arg in "$@"; do
|
||||
if [[ "$arg" != "-*" ]] && [[ ! -L "$arg" ]]; then
|
||||
echo "$0: $arg is not a symlink" 1>&2
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
rm "$@"
|
||||
'')
|
||||
];
|
||||
vacu.shell.functions = {
|
||||
nd = ''
|
||||
declare -a args
|
||||
args=("$@")
|
||||
mkdir "''${args[@]}" && cd "''${args[-1]}"
|
||||
'';
|
||||
nt = ''pushd $(mktemp -d "$@")'';
|
||||
};
|
||||
}
|
36
common/shell/ps1.nix
Normal file
36
common/shell/ps1.nix
Normal file
@@ -0,0 +1,36 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
vaculib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.vacu.shell;
|
||||
# https://en.wikipedia.org/wiki/ANSI_escape_code#Colors
|
||||
colors = vaculib.shellColors;
|
||||
# https://man.archlinux.org/man/bash.1#PROMPTING
|
||||
# \[ and \] begins and ends "a sequence of non-printing characters"
|
||||
set_color = colornum: ''\[\e[1;${toString colornum}m\]'';
|
||||
set_inverted_color = colornum: ''\[\e[1;37;${toString (colornum + 10)}m\]'';
|
||||
reset_color = ''\[\e[0m\]'';
|
||||
colornum = colors.${cfg.color};
|
||||
root_text = root: lib.optionalString root "ROOT@";
|
||||
final = root: if root then (set_inverted_color colors.red) + "!!" else "$";
|
||||
default_ps1 =
|
||||
root:
|
||||
''\n''
|
||||
+ (set_color colornum)
|
||||
+ ''${root_text root}${config.vacu.shortHostName}:\w''
|
||||
+ (final root)
|
||||
+ reset_color
|
||||
+ " ";
|
||||
in
|
||||
{
|
||||
vacu.shell.idempotentShellLines = ''
|
||||
if [ $UID = 0 ]; then
|
||||
export PS1=${lib.escapeShellArg (default_ps1 true)}
|
||||
else
|
||||
export PS1=${lib.escapeShellArg (default_ps1 false)}
|
||||
fi
|
||||
'';
|
||||
}
|
147
common/ssh.nix
Normal file
147
common/ssh.nix
Normal file
@@ -0,0 +1,147 @@
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (lib)
|
||||
mkOption
|
||||
types
|
||||
flip
|
||||
concatMapStringsSep
|
||||
optionalString
|
||||
concatStringsSep
|
||||
readFile
|
||||
mapAttrsToList
|
||||
literalExpression
|
||||
;
|
||||
inherit (builtins) attrValues;
|
||||
cfg = config.vacu;
|
||||
knownHosts = attrValues cfg.ssh.knownHosts;
|
||||
knownHostsText =
|
||||
(flip (concatMapStringsSep "\n") knownHosts (
|
||||
h:
|
||||
assert h.hostNames != [ ];
|
||||
optionalString h.certAuthority "@cert-authority "
|
||||
+ concatStringsSep "," h.hostNames
|
||||
+ " "
|
||||
+ (if h.publicKey != null then h.publicKey else readFile h.publicKeyFile)
|
||||
))
|
||||
+ "\n";
|
||||
in
|
||||
{
|
||||
options = {
|
||||
vacu.ssh.knownHostsText = mkOption {
|
||||
type = types.str;
|
||||
readOnly = true;
|
||||
default = knownHostsText;
|
||||
};
|
||||
vacu.ssh.authorizedKeys = mkOption { type = types.listOf types.str; };
|
||||
vacu.ssh.config = mkOption { type = types.lines; };
|
||||
# Straight copied from nixpkgs
|
||||
# https://github.com/NixOS/nixpkgs/blob/46397778ef1f73414b03ed553a3368f0e7e33c2f/nixos/modules/programs/ssh.nix
|
||||
vacu.ssh.knownHosts = mkOption {
|
||||
default = { };
|
||||
type = types.attrsOf (
|
||||
types.submodule (
|
||||
{
|
||||
name,
|
||||
config,
|
||||
options,
|
||||
...
|
||||
}:
|
||||
{
|
||||
options = {
|
||||
certAuthority = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
This public key is an SSH certificate authority, rather than an
|
||||
individual host's key.
|
||||
'';
|
||||
};
|
||||
hostNames = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [ name ] ++ config.extraHostNames;
|
||||
defaultText = literalExpression "[ ${name} ] ++ config.${options.extraHostNames}";
|
||||
description = ''
|
||||
A list of host names and/or IP numbers used for accessing
|
||||
the host's ssh service. This list includes the name of the
|
||||
containing `knownHosts` attribute by default
|
||||
for convenience. If you wish to configure multiple host keys
|
||||
for the same host use multiple `knownHosts`
|
||||
entries with different attribute names and the same
|
||||
`hostNames` list.
|
||||
'';
|
||||
};
|
||||
extraHostNames = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [ ];
|
||||
description = ''
|
||||
A list of additional host names and/or IP numbers used for
|
||||
accessing the host's ssh service. This list is ignored if
|
||||
`hostNames` is set explicitly.
|
||||
'';
|
||||
};
|
||||
publicKey = mkOption {
|
||||
default = null;
|
||||
type = types.nullOr types.str;
|
||||
example = "ecdsa-sha2-nistp521 AAAAE2VjZHN...UEPg==";
|
||||
description = ''
|
||||
The public key data for the host. You can fetch a public key
|
||||
from a running SSH server with the {command}`ssh-keyscan`
|
||||
command. The public key should not include any host names, only
|
||||
the key type and the key itself.
|
||||
'';
|
||||
};
|
||||
publicKeyFile = mkOption {
|
||||
default = null;
|
||||
type = types.nullOr types.path;
|
||||
description = ''
|
||||
The path to the public key file for the host. The public
|
||||
key file is read at build time and saved in the Nix store.
|
||||
You can fetch a public key file from a running SSH server
|
||||
with the {command}`ssh-keyscan` command. The content
|
||||
of the file should follow the same format as described for
|
||||
the `publicKey` option. Only a single key
|
||||
is supported. If a host has multiple keys, use
|
||||
{option}`programs.ssh.knownHostsFiles` instead.
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
)
|
||||
);
|
||||
description = ''
|
||||
The set of system-wide known SSH hosts. To make simple setups more
|
||||
convenient the name of an attribute in this set is used as a host name
|
||||
for the entry. This behaviour can be disabled by setting
|
||||
`hostNames` explicitly. You can use
|
||||
`extraHostNames` to add additional host names without
|
||||
disabling this default.
|
||||
'';
|
||||
example = literalExpression ''
|
||||
{
|
||||
myhost = {
|
||||
extraHostNames = [ "myhost.mydomain.com" "10.10.1.4" ];
|
||||
publicKeyFile = ./pubkeys/myhost_ssh_host_dsa_key.pub;
|
||||
};
|
||||
"myhost2.net".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILIRuJ8p1Fi+m6WkHV0KWnRfpM1WxoW8XAS+XvsSKsTK";
|
||||
"myhost2.net/dsa" = {
|
||||
hostNames = [ "myhost2.net" ];
|
||||
publicKeyFile = ./pubkeys/myhost2_ssh_host_dsa_key.pub;
|
||||
};
|
||||
}
|
||||
'';
|
||||
};
|
||||
config.assertions = lib.flip lib.mapAttrsToList config.vacu.ssh.knownHosts (
|
||||
name: data: {
|
||||
assertion =
|
||||
(data.publicKey == null && data.publicKeyFile != null)
|
||||
|| (data.publicKey != null && data.publicKeyFile == null);
|
||||
message = "knownHost ${name} must contain either a publicKey or publicKeyFile";
|
||||
}
|
||||
);
|
||||
};
|
||||
}
|
60
common/verify-system/default.nix
Normal file
60
common/verify-system/default.nix
Normal file
@@ -0,0 +1,60 @@
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (lib) mkOption mkEnableOption types;
|
||||
cfg = config.vacu.verifySystem;
|
||||
in
|
||||
{
|
||||
options.vacu.verifySystem = {
|
||||
enable = (mkEnableOption "verify system is what is expected") // {
|
||||
default = true;
|
||||
};
|
||||
verifiers = mkOption {
|
||||
default = { };
|
||||
type = types.attrsOf (
|
||||
types.submodule (
|
||||
{ name, config, ... }:
|
||||
{
|
||||
options = {
|
||||
enable = mkEnableOption "Enable system ident check ${name}";
|
||||
name = mkOption {
|
||||
type = types.str;
|
||||
default = name;
|
||||
};
|
||||
script = mkOption {
|
||||
type = types.lines;
|
||||
default = "## system ident check ${config.name}";
|
||||
};
|
||||
};
|
||||
}
|
||||
)
|
||||
);
|
||||
};
|
||||
|
||||
verifyAllScript =
|
||||
let
|
||||
verifiers = (builtins.attrValues cfg.verifiers);
|
||||
enabled = builtins.filter (s: s.enable) verifiers;
|
||||
files = map (s: pkgs.writeText "vacu-verify-system-${s.name}.sh" s.script) enabled;
|
||||
script = ''
|
||||
## vacu verify-system
|
||||
for f in ${lib.concatStringsSep " " files}; do
|
||||
echo "verifying system with $f"
|
||||
if ! source $f; then
|
||||
echo "ERR: $f failed" >&2
|
||||
return 1
|
||||
fi
|
||||
done
|
||||
'';
|
||||
scriptFile = pkgs.writeText "vacu-verify-system-all.sh" script;
|
||||
in
|
||||
mkOption {
|
||||
readOnly = true;
|
||||
default = scriptFile;
|
||||
};
|
||||
};
|
||||
}
|
65
common/verify-system/nixos.nix
Normal file
65
common/verify-system/nixos.nix
Normal file
@@ -0,0 +1,65 @@
|
||||
{
|
||||
lib,
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (lib) mkOption types;
|
||||
in
|
||||
{
|
||||
options.vacu.verifySystem.expectedMac = mkOption {
|
||||
type = types.nullOr (types.strMatching "[A-Fa-f0-9]{2}(:[A-Fa-f0-9]{2}){5}");
|
||||
default = null;
|
||||
};
|
||||
config = lib.mkIf config.vacu.verifySystem.enable {
|
||||
# system.activationScripts."00-verify-system" = {
|
||||
# text = "if ! source ${config.vacu.verifySystem.verifyAllScript}; then exit $?; fi";
|
||||
# supportsDryActivation = true;
|
||||
# };
|
||||
|
||||
system.extraSystemBuilderCmds = ''
|
||||
mv $out/bin/switch-to-configuration $out/bin/.switch-to-configuration-unverified
|
||||
cat <<EOF > $out/bin/switch-to-configuration
|
||||
#!${pkgs.bash}/bin/bash
|
||||
oldpath="$PATH"
|
||||
export PATH="${pkgs.coreutils}/bin"
|
||||
if ! source ${config.vacu.verifySystem.verifyAllScript}; then exit \$?; fi
|
||||
export PATH="$oldpath"
|
||||
exec $out/bin/.switch-to-configuration-unverified "\$@"
|
||||
EOF
|
||||
|
||||
${pkgs.coreutils}/bin/chmod a+x $out/bin/switch-to-configuration
|
||||
'';
|
||||
|
||||
vacu.verifySystem.verifiers = {
|
||||
hostname = {
|
||||
enable = lib.mkDefault config.vacu.verifySystem.expectedMac == null;
|
||||
script = ''
|
||||
expected=${config.networking.hostName}
|
||||
actual=$(cat /proc/sys/kernel/hostname)
|
||||
if [[ "$expected" != "$actual" ]]; then
|
||||
echo "ERR: unexpected hostname; Trying to deploy to $expected but this is $actual" >&2
|
||||
return 1
|
||||
fi
|
||||
'';
|
||||
};
|
||||
expectedMac = {
|
||||
enable = config.vacu.verifySystem.expectedMac != null;
|
||||
script = ''
|
||||
expected=${lib.toUpper config.vacu.verifySystem.expectedMac}
|
||||
declare -a actual=($(${pkgs.iproute2}/bin/ip -j link | ${pkgs.jq}/bin/jq 'map([.permaddr, .address] | map(strings | ascii_upcase)) | flatten | join("\n")' -r))
|
||||
for ifMac in "''${actual[@]}"; do
|
||||
if [[ "$ifMac" == "$expected" ]]; then
|
||||
# all is well
|
||||
return 0
|
||||
fi
|
||||
done
|
||||
echo "ERR: Interface MAC address $expected not present, this may not be the system you intend to deploy to." >&2
|
||||
echo " Found MAC addresses: ''${actual[*]}" >&2
|
||||
return 1
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
@@ -1,6 +1,7 @@
|
||||
{ ... }: {
|
||||
hardware.bluetooth.enable = true;
|
||||
hardware.bluetooth.powerOnBoot = true;
|
||||
{ ... }:
|
||||
{
|
||||
hardware.bluetooth.enable = true;
|
||||
hardware.bluetooth.powerOnBoot = true;
|
||||
|
||||
services.blueman.enable = true;
|
||||
services.blueman.enable = true;
|
||||
}
|
||||
|
@@ -1,18 +1,24 @@
|
||||
{ config, pkgs, lib, jovian, inputs, ... }:
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
jovian,
|
||||
inputs,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports = [
|
||||
inputs.jovian.nixosModules.jovian
|
||||
inputs.disko.nixosModules.default
|
||||
inputs.homeManager.nixosModules.default
|
||||
# inputs.disko.nixosModules.default
|
||||
inputs.home-manager.nixosModules.default
|
||||
./hardware.nix
|
||||
./partitioning.nix
|
||||
./home.nix
|
||||
./bluetooth.nix
|
||||
./partitioning.nix
|
||||
./padtype.nix
|
||||
../common-nixos-config.nix
|
||||
../common/nixos.nix
|
||||
];
|
||||
system.nixos.tags = [ "host-${config.networking.hostName}" ];
|
||||
|
||||
boot.loader.systemd-boot.enable = false;
|
||||
boot.loader.efi.efiSysMountPoint = "/boot/EFI";
|
||||
@@ -23,7 +29,9 @@
|
||||
|
||||
boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
|
||||
|
||||
networking.hostName = "compute-deck";
|
||||
vacu.hostName = "compute-deck";
|
||||
vacu.shortHostName = "cd";
|
||||
vacu.shell.color = "blue";
|
||||
networking.hostId = "e595d9b0";
|
||||
|
||||
boot.supportedFilesystems = [ "zfs" ];
|
||||
@@ -55,22 +63,22 @@
|
||||
rustup
|
||||
];
|
||||
|
||||
boot.kernelPatches = [
|
||||
{
|
||||
name = "gadget";
|
||||
patch = null;
|
||||
extraStructuredConfig = with lib.kernel; {
|
||||
USB_ETH=module;
|
||||
USB_GADGET=yes;
|
||||
USB_LIBCOMPOSITE=yes;
|
||||
USB_CONFIGFS=yes;
|
||||
USB_DWC3=module;
|
||||
USB_DWC3_PCI=module;
|
||||
USB_DWC3_DUAL_ROLE=yes;
|
||||
USB_DWC3_HOST=no;
|
||||
USB_DWC3_GADGET=no;
|
||||
USB_ROLE_SWITCH=yes;
|
||||
};
|
||||
}
|
||||
];
|
||||
# boot.kernelPatches = [
|
||||
# {
|
||||
# name = "gadget";
|
||||
# patch = null;
|
||||
# extraStructuredConfig = with lib.kernel; {
|
||||
# USB_ETH=module;
|
||||
# USB_GADGET=yes;
|
||||
# USB_LIBCOMPOSITE=yes;
|
||||
# USB_CONFIGFS=yes;
|
||||
# USB_DWC3=module;
|
||||
# USB_DWC3_PCI=module;
|
||||
# USB_DWC3_DUAL_ROLE=yes;
|
||||
# USB_DWC3_HOST=no;
|
||||
# USB_DWC3_GADGET=no;
|
||||
# USB_ROLE_SWITCH=yes;
|
||||
# };
|
||||
# }
|
||||
# ];
|
||||
}
|
||||
|
@@ -1,16 +1,26 @@
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "nvme" "usbhid" "sdhci_pci" ];
|
||||
boot.initrd.availableKernelModules = [
|
||||
"nvme"
|
||||
"xhci_pci"
|
||||
"usbhid"
|
||||
"sdhci_pci"
|
||||
"dwc3_pci"
|
||||
];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-amd" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
/*
|
||||
/*
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/63f25199-ee0b-4991-8861-c3ba3b464ef2";
|
||||
fsType = "btrfs";
|
||||
@@ -34,16 +44,15 @@
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=boot" ];
|
||||
};
|
||||
*/
|
||||
*/
|
||||
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/2aad8cab-7b97-47de-8608-fe9f12e211a4";
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-uuid/2aad8cab-7b97-47de-8608-fe9f12e211a4";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot/EFI" =
|
||||
{ device = "/dev/disk/by-uuid/C268-79C8";
|
||||
fileSystems."/boot/EFI" = {
|
||||
device = "/dev/disk/by-uuid/C268-79C8";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
|
@@ -2,9 +2,7 @@
|
||||
{
|
||||
home-manager.users.shelvacu = {
|
||||
# these make vscode-remote work
|
||||
imports = [
|
||||
inputs.vscode-server.homeModules.default
|
||||
];
|
||||
imports = [ inputs.vscode-server.homeModules.default ];
|
||||
services.vscode-server.enable = true;
|
||||
|
||||
home.stateVersion = "23.11";
|
||||
|
@@ -1,6 +1,8 @@
|
||||
{ inputs, ... }: let
|
||||
{ inputs, ... }:
|
||||
let
|
||||
padtype-pkg = inputs.padtype.packages."x86_64-linux".default;
|
||||
in {
|
||||
in
|
||||
{
|
||||
environment.systemPackages = [ padtype-pkg ];
|
||||
|
||||
systemd.services."padtype" = {
|
||||
|
@@ -1,5 +1,6 @@
|
||||
{ ... }:
|
||||
{ inputs, ... }:
|
||||
{
|
||||
imports = [ inputs.disko.nixosModules.default ];
|
||||
disko.devices.disk.blarg = {
|
||||
device = "/dev/disk/by-id/nvme-Micron_2400_MTFDKBK2T0QFM_230341951668_1-part11";
|
||||
content = {
|
||||
@@ -13,20 +14,29 @@
|
||||
subvolumes = {
|
||||
"/root" = {
|
||||
mountpoint = "/";
|
||||
mountOptions = [ "compress=zstd" "noatime" ];
|
||||
mountOptions = [
|
||||
"compress=zstd"
|
||||
"noatime"
|
||||
];
|
||||
};
|
||||
"/home" = {
|
||||
mountpoint = "/home";
|
||||
mountOptions = [ "compress=zstd" "noatime" ];
|
||||
mountOptions = [
|
||||
"compress=zstd"
|
||||
"noatime"
|
||||
];
|
||||
};
|
||||
"/nix" = {
|
||||
mountpoint = "/nix";
|
||||
mountOptions = [ "compress=zstd" "noatime" ];
|
||||
mountOptions = [
|
||||
"compress=zstd"
|
||||
"noatime"
|
||||
];
|
||||
};
|
||||
# "/swap" = {
|
||||
# mountpoint = "/.swapvol";
|
||||
# swap.swapfile.size = "20M";
|
||||
# };
|
||||
# "/swap" = {
|
||||
# mountpoint = "/.swapvol";
|
||||
# swap.swapfile.size = "20M";
|
||||
# };
|
||||
};
|
||||
};
|
||||
};
|
||||
|
104
coopdx.nix
Normal file
104
coopdx.nix
Normal file
@@ -0,0 +1,104 @@
|
||||
{
|
||||
callPackage,
|
||||
fetchFromGitHub,
|
||||
autoPatchelfHook,
|
||||
zlib,
|
||||
curl,
|
||||
libcxx,
|
||||
stdenvNoCC,
|
||||
nixpkgs ? <nixpkgs>,
|
||||
writeTextFile,
|
||||
lib,
|
||||
bash,
|
||||
|
||||
enableTextureFix ? true,
|
||||
enableDiscord ? false,
|
||||
}:
|
||||
let
|
||||
libc_hack = writeTextFile {
|
||||
name = "libc-hack";
|
||||
# https://stackoverflow.com/questions/21768542/libc-h-no-such-file-or-directory-when-compiling-nanomsg-pipeline-sample
|
||||
text = ''
|
||||
#include <unistd.h>
|
||||
#include <string.h>
|
||||
#include <pthread.h>
|
||||
'';
|
||||
destination = "/include/libc.h";
|
||||
};
|
||||
target = stdenvNoCC.targetPlatform;
|
||||
bits =
|
||||
if target.is64bit then
|
||||
"64"
|
||||
else if target.is32bit then
|
||||
"32"
|
||||
else
|
||||
throw "unspported bits";
|
||||
pname = "sm64coopdx";
|
||||
version = "1.0.3";
|
||||
region = "us"; # dx removed support for other regions
|
||||
in
|
||||
(callPackage "${nixpkgs}/pkgs/games/sm64ex/generic.nix" {
|
||||
inherit pname version region;
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "coop-deluxe";
|
||||
repo = pname;
|
||||
rev = "v${version}";
|
||||
hash = "sha256-cIH3escLFMcHgtFxeSKIo5nZXvaknti+EVt72uB4XXc=";
|
||||
};
|
||||
|
||||
extraNativeBuildInputs = [ autoPatchelfHook ];
|
||||
|
||||
extraBuildInputs = [
|
||||
zlib
|
||||
curl
|
||||
libcxx
|
||||
libc_hack
|
||||
];
|
||||
|
||||
# Normally there's no need to set TARGET_ARCH, but if we don't it adds -march=native which is impure
|
||||
compileFlags = [
|
||||
"BREW_PREFIX=/not-exist"
|
||||
"TARGET_ARCH=generic"
|
||||
"TARGET_BITS=${bits}"
|
||||
"DISCORD_SDK=${if enableDiscord then "1" else "0"}"
|
||||
"TEXTURE_FIX=${if enableTextureFix then "1" else "0"}"
|
||||
];
|
||||
|
||||
extraMeta = {
|
||||
mainProgram = pname;
|
||||
homepage = "https://sm64coopdx.com/";
|
||||
description = "Super Mario 64 online co-op mod, forked from sm64ex";
|
||||
};
|
||||
}).overrideAttrs
|
||||
{
|
||||
installPhase =
|
||||
let
|
||||
sharedLib = target.extensions.sharedLibrary;
|
||||
in
|
||||
''
|
||||
runHook preInstall
|
||||
|
||||
local built=$PWD/build/${region}_pc
|
||||
|
||||
share=$out/share/${pname}
|
||||
mkdir -p $share
|
||||
cp $built/${pname} $share/${pname}-unwrapped
|
||||
cp -r $built/{dynos,lang,mods,palettes} $share
|
||||
cp ./baserom.*.z64 $share
|
||||
|
||||
${lib.optionalString enableDiscord ''
|
||||
cp $built/libdiscord_game_sdk${sharedLib} $share
|
||||
''}
|
||||
|
||||
mkdir -p $out/bin
|
||||
(
|
||||
echo '#!${bash}/bin/bash'
|
||||
echo "cd $out/share/${pname}"
|
||||
echo 'exec ./${pname}-unwrapped "$@"'
|
||||
) > $out/bin/${pname}
|
||||
chmod a+x $out/bin/${pname}
|
||||
|
||||
runHook postInstall
|
||||
'';
|
||||
}
|
93
deterministic-certs.nix
Normal file
93
deterministic-certs.nix
Normal file
@@ -0,0 +1,93 @@
|
||||
{
|
||||
nixpkgs ? import <nixpkgs>,
|
||||
}:
|
||||
let
|
||||
pkgs = nixpkgs;
|
||||
lib = nixpkgs.lib;
|
||||
defaultCertTemplate = {
|
||||
serial = 1;
|
||||
activation_date = "1970-01-01 00:00:00 UTC";
|
||||
expiration_date = "2500-01-01 00:00:00 UTC";
|
||||
};
|
||||
keyValToConfigLines = (
|
||||
key: value:
|
||||
if (builtins.isString value) || (builtins.isPath value) then
|
||||
"${key} = \"${value}\""
|
||||
else if builtins.isInt value then
|
||||
"${key} = ${builtins.toString value}"
|
||||
else if builtins.isList value then
|
||||
map (innerValue: keyValToConfigLines key innerValue)
|
||||
else if builtins.isBool value then
|
||||
(if value then "${key}" else "# no ${key}")
|
||||
else
|
||||
throw "don't know how to handle ${builtins.typeOf value}"
|
||||
);
|
||||
mkTemplateConfig =
|
||||
config:
|
||||
lib.concatStringsSep "\n" (
|
||||
lib.lists.flatten (lib.attrsets.mapAttrsToList keyValToConfigLines config)
|
||||
);
|
||||
certCfg = pkgs.writeText "deterministic-cert.cfg" ''
|
||||
serial = 1
|
||||
activation_date = "1970-01-01 00:00:00 UTC"
|
||||
expiration_date = "2500-01-01 00:00:00 UTC"
|
||||
'';
|
||||
privKeyFile =
|
||||
name:
|
||||
let
|
||||
keySizeBits = 256;
|
||||
keySizeHex = builtins.toString (keySizeBits / 4);
|
||||
in
|
||||
pkgs.runCommand "deterministic-privkey-${name}.pem" { } ''
|
||||
seed=$(echo ${lib.escapeShellArg (builtins.toJSON name)} | ${pkgs.ruby_3_2}/bin/ruby -rjson -e 'name = JSON.parse(STDIN.gets); print name.unpack("H*")[0].ljust(${keySizeHex}, "0")')
|
||||
${pkgs.gnutls}/bin/certtool --generate-privkey --outfile=$out --key-type=rsa --sec-param=high --seed=$seed
|
||||
'';
|
||||
generateCert =
|
||||
{
|
||||
name,
|
||||
config,
|
||||
args,
|
||||
preCommands ? "",
|
||||
}:
|
||||
let
|
||||
deriv = pkgs.runCommand "deterministic-cert-${name}" { } ''
|
||||
mkdir -p $out
|
||||
cd $out
|
||||
ln -s ${privKeyFile name} privkey.pem
|
||||
ln -s ${
|
||||
pkgs.writeText "${name}-template.cfg" (mkTemplateConfig (defaultCertTemplate // config))
|
||||
} template.cfg
|
||||
${preCommands}
|
||||
${pkgs.gnutls}/bin/certtool ${lib.escapeShellArgs args} --load-privkey=privkey.pem --outfile=cert.pem --template=template.cfg
|
||||
'';
|
||||
in
|
||||
deriv
|
||||
// {
|
||||
privateKeyPath = "${deriv}/privkey.pem";
|
||||
certificatePath = "${deriv}/cert.pem";
|
||||
};
|
||||
|
||||
in
|
||||
{
|
||||
inherit privKeyFile;
|
||||
selfSigned =
|
||||
name: config:
|
||||
generateCert {
|
||||
inherit name config;
|
||||
args = [ "--generate-self-signed" ];
|
||||
};
|
||||
caSigned =
|
||||
name: ca: config:
|
||||
generateCert {
|
||||
inherit name config;
|
||||
preCommands = ''
|
||||
ln -s ${ca.privateKeyPath} ca-privkey.pem
|
||||
ln -s ${ca.certificatePath} ca-cert.pem
|
||||
'';
|
||||
args = [
|
||||
"--generate-certificate"
|
||||
"--load-ca-certificate=ca-cert.pem"
|
||||
"--load-ca-privkey=ca-privkey.pem"
|
||||
];
|
||||
};
|
||||
}
|
@@ -1,57 +0,0 @@
|
||||
{ config, pkgs, lib, inputs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
inputs.homeManager.nixosModules.default
|
||||
../common-nixos-config.nix
|
||||
(modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
|
||||
boot.initrd.availableKernelModules = [ "virtio_pci" "usbhid" "virtio_blk" "9pnet_virtio" "9p" "autofs4" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" "9pnet_virtio" "9p" "autofs4" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
system.nixos.tags = [ "host-${config.networking.hostName}" ];
|
||||
networking.hostName = "devver";
|
||||
boot.loader.external.enable = true;
|
||||
boot.loader.external.installHook = pkgs.writeShellScript "vacuDirectBootInstaller" ''
|
||||
PATH="$PATH:${pkgs.coreutils}/bin:${pkgs.gnused}/bin"
|
||||
set -xev
|
||||
mkdir -p /boot
|
||||
cp $1/kernel /boot/kernel
|
||||
cp $1/initrd /boot/initrd
|
||||
cp $1/kernel-params /boot/kernel-params
|
||||
sed -i "1 s|$| init=$1/sw/bin/init|" /boot/kernel-params
|
||||
'';
|
||||
|
||||
users.users.root.shell = pkgs.bashInteractive;
|
||||
|
||||
fileSystems."/boot" = {
|
||||
fsType = "9p";
|
||||
device = "boot";
|
||||
options = [
|
||||
"trans=virtio"
|
||||
"access=any"
|
||||
"version=9p2000.L"
|
||||
"posixacl"
|
||||
"cache=mmap"
|
||||
"nofail"
|
||||
"noauto"
|
||||
];
|
||||
};
|
||||
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-uuid/a373835d-b942-4232-85fe-922cb1880af3";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
#boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
|
||||
|
||||
services.openssh.enable = true;
|
||||
|
||||
vacu.packages.nix-inspect.enable = false; #its broken for some reason I don't understand
|
||||
|
||||
system.stateVersion = "23.11";
|
||||
}
|
1148
flake.lock
generated
1148
flake.lock
generated
File diff suppressed because it is too large
Load Diff
312
flake.nix
312
flake.nix
@@ -2,140 +2,346 @@
|
||||
description = "Config for triple-dezert server";
|
||||
|
||||
inputs = {
|
||||
nixpkgs-unstable.url = "nixpkgs/nixos-unstable"; #todo: put this back to -small once jovian-nixos is fixed
|
||||
nixpkgs.url = "nixpkgs/nixos-23.11-small";
|
||||
nixpkgs2405.url = "nixpkgs/nixos-24.05-small";
|
||||
nixpkgs.url = "nixpkgs/nixos-24.05-small";
|
||||
# nixpkgs.url = "github:nixos/nixpkgs/be0ec1a45fe1a6f6534c451b935724ab48405f26";
|
||||
nixpkgs-unstable.url = "nixpkgs/nixos-unstable";
|
||||
|
||||
flake-utils.url = "github:numtide/flake-utils";
|
||||
nixvim = {
|
||||
url = "github:nix-community/nixvim/nixos-24.05";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
nixvim-unstable = {
|
||||
url = "github:nix-community/nixvim";
|
||||
inputs.nixpkgs.follows = "nixpkgs-unstable";
|
||||
};
|
||||
nix-inspect = {
|
||||
url = "github:bluskript/nix-inspect";
|
||||
#inputs.nixpkgs.follows = "nixpkgs";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
nix-inspect-unstable = {
|
||||
url = "github:bluskript/nix-inspect";
|
||||
inputs.nixpkgs.follows = "nixpkgs-unstable";
|
||||
};
|
||||
vscode-server-unstable = {
|
||||
url = "github:nix-community/nixos-vscode-server";
|
||||
inputs.nixpkgs.follows = "nixpkgs-unstable";
|
||||
inputs.flake-utils.follows = "flake-utils";
|
||||
};
|
||||
vscode-server = {
|
||||
url = "github:nix-community/nixos-vscode-server";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
inputs.flake-utils.follows = "flake-utils";
|
||||
};
|
||||
nix-on-droid = {
|
||||
url = "github:nix-community/nix-on-droid/release-23.05";
|
||||
url = "github:nix-community/nix-on-droid";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
inputs.home-manager.follows = "home-manager";
|
||||
};
|
||||
jovian = {
|
||||
jovian-unstable = {
|
||||
# there is no stable jovian :cry:
|
||||
url = "github:Jovian-Experiments/Jovian-NixOS";
|
||||
inputs.nixpkgs.follows = "nixpkgs-unstable";
|
||||
};
|
||||
disko = {
|
||||
disko-unstable = {
|
||||
url = "github:nix-community/disko";
|
||||
inputs.nixpkgs.follows = "nixpkgs-unstable";
|
||||
};
|
||||
homeManager = {
|
||||
url = "github:nix-community/home-manager/master";
|
||||
home-manager = {
|
||||
url = "github:nix-community/home-manager/release-24.05";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
home-manager-unstable = {
|
||||
url = "github:nix-community/home-manager";
|
||||
inputs.nixpkgs.follows = "nixpkgs-unstable";
|
||||
};
|
||||
nix-search-cli-unstable = {
|
||||
url = "github:peterldowns/nix-search-cli";
|
||||
inputs.nixpkgs.follows = "nixpkgs-unstable";
|
||||
inputs.flake-utils.follows = "flake-utils";
|
||||
};
|
||||
nix-search-cli = {
|
||||
url = "github:peterldowns/nix-search-cli";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
inputs.flake-utils.follows = "flake-utils";
|
||||
};
|
||||
padtype = {
|
||||
padtype-unstable = {
|
||||
url = "gitlab:shelvacu/padtype";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
inputs.nixpkgs.follows = "nixpkgs-unstable";
|
||||
};
|
||||
sops-nix = {
|
||||
url = "github:Mic92/sops-nix";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
microvm = {
|
||||
url = "github:astro/microvm.nix";
|
||||
nixos-hardware.url = "github:nixos/nixos-hardware";
|
||||
most-winningest = {
|
||||
url = "github:captain-jean-luc/most-winningest";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
inputs.flake-utils.follows = "flake-utils";
|
||||
};
|
||||
};
|
||||
|
||||
outputs = { self, nixpkgs, nix-on-droid, ... }@inputs: {
|
||||
debug.isoDeriv = (import "${inputs.nixpkgs}/nixos/release-small.nix" { nixpkgs = ({ revCount = 0; } // inputs.nixpkgs); });
|
||||
outputs =
|
||||
{
|
||||
self,
|
||||
nixpkgs,
|
||||
nix-on-droid,
|
||||
home-manager,
|
||||
...
|
||||
}@inputs:
|
||||
let
|
||||
lib = import "${nixpkgs}/lib";
|
||||
pkgs = import nixpkgs {
|
||||
system = "x86_64-linux";
|
||||
config.allowUnfree = true;
|
||||
};
|
||||
defaultInputs = {
|
||||
inherit (inputs)
|
||||
self
|
||||
nix-search-cli
|
||||
nix-inspect
|
||||
nixvim
|
||||
;
|
||||
};
|
||||
defaultArgs = {
|
||||
inputs = defaultInputs;
|
||||
};
|
||||
in
|
||||
{
|
||||
debug.isoDeriv = (
|
||||
import "${inputs.nixpkgs}/nixos/release-small.nix" {
|
||||
nixpkgs = ({ revCount = 0; } // inputs.nixpkgs);
|
||||
}
|
||||
);
|
||||
nixosConfigurations.triple-dezert = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [ ./triple-dezert ];
|
||||
specialArgs = { inherit inputs; };
|
||||
specialArgs = {
|
||||
inputs = defaultInputs // {
|
||||
inherit (inputs) most-winningest sops;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
nixosConfigurations.compute-deck = inputs.nixpkgs-unstable.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [ ./compute-deck ];
|
||||
specialArgs = { inherit inputs; };
|
||||
specialArgs = {
|
||||
inputs = {
|
||||
jovian = inputs.jovian-unstable;
|
||||
home-manager = inputs.home-manager-unstable;
|
||||
vscode-server = inputs.vscode-server-unstable;
|
||||
disko = inputs.disko-unstable;
|
||||
padtype = inputs.padtype-unstable;
|
||||
nix-search-cli = inputs.nix-search-cli-unstable;
|
||||
nix-inspect = inputs.nix-inspect-unstable;
|
||||
nixvim = inputs.nixvim-unstable;
|
||||
self = inputs.self;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
nixosConfigurations.liam = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [ ./liam ];
|
||||
specialArgs = { inherit inputs; };
|
||||
specialArgs = {
|
||||
inputs = defaultInputs // {
|
||||
inherit (inputs) sops-nix;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
nixosConfigurations.lp0 = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [ ./lp0 ];
|
||||
specialArgs = { inherit inputs; };
|
||||
specialArgs = defaultArgs;
|
||||
};
|
||||
|
||||
nixosConfigurations.shel-installer = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [ ./installer.nix ];
|
||||
specialArgs = { inherit inputs; };
|
||||
specialArgs = defaultArgs;
|
||||
};
|
||||
|
||||
nixosConfigurations.devver = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [ ./devver ];
|
||||
specialArgs = { inherit inputs; };
|
||||
};
|
||||
|
||||
nixosConfigurations.fw = inputs.nixpkgs2405.lib.nixosSystem {
|
||||
nixosConfigurations.fw = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [ ./fw ];
|
||||
specialArgs = { inherit inputs; };
|
||||
specialArgs = {
|
||||
inputs = defaultInputs // {
|
||||
inherit (inputs) nixos-hardware;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
nixosConfigurations.legtop = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [ ./legtop ];
|
||||
specialArgs = {
|
||||
inputs = defaultInputs // {
|
||||
inherit (inputs) nixos-hardware;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
nixOnDroidConfigurations.default = nix-on-droid.lib.nixOnDroidConfiguration {
|
||||
modules = [ ./nix-on-droid.nix ];
|
||||
extraSpecialArgs = { inherit inputs; };
|
||||
modules = [ ./nix-on-droid ];
|
||||
extraSpecialArgs = {
|
||||
inputs = defaultInputs // {
|
||||
inherit (inputs) nixpkgs;
|
||||
};
|
||||
};
|
||||
pkgs = import nixpkgs { system = "aarch64-linux"; };
|
||||
};
|
||||
|
||||
diskoConfigurations.compute-deck = import ./compute-deck/partitioning.nix;
|
||||
homeConfigurations."nix-on-droid" = home-manager.lib.homeManagerConfiguration {
|
||||
modules = [
|
||||
./home/nix-on-droid.nix
|
||||
{ _module.args.inputs = defaultInputs; }
|
||||
];
|
||||
pkgs = import nixpkgs { system = "aarch64-linux"; };
|
||||
};
|
||||
|
||||
checks = nixpkgs.lib.genAttrs [ "x86_64-linux" ] (system:
|
||||
checks = nixpkgs.lib.genAttrs [ "x86_64-linux" ] (
|
||||
system:
|
||||
let
|
||||
pkgs = nixpkgs.legacyPackages.${system};
|
||||
pkgs = import nixpkgs { inherit system; };
|
||||
config = {
|
||||
node.pkgs = pkgs;
|
||||
node.pkgsReadOnly = false;
|
||||
node.specialArgs.selfPackages = self.packages.${system};
|
||||
node.specialArgs.inputs = inputs;
|
||||
};
|
||||
in
|
||||
{
|
||||
liam = nixpkgs.lib.nixos.runTest {
|
||||
hostPkgs = pkgs;
|
||||
imports = [ config ./tests/liam.nix ];
|
||||
imports = [
|
||||
config
|
||||
./tests/liam.nix
|
||||
{ node.specialArgs.inputs = self.nixosConfigurations.liam._module.specialArgs.inputs; }
|
||||
];
|
||||
};
|
||||
trip = nixpkgs.lib.nixos.runTest {
|
||||
hostPkgs = pkgs;
|
||||
imports = [ config ./tests/triple-dezert.nix ];
|
||||
imports = [
|
||||
config
|
||||
./tests/triple-dezert.nix
|
||||
{ node.specialArgs.inputs = self.nixosConfigurations.triple-dezert._module.specialArgs.inputs; }
|
||||
];
|
||||
};
|
||||
# trip_haproxy_config = let
|
||||
# hacfg = self.nixosConfigurations.triple-dezert.config.containers.frontproxy.config.services.haproxy;
|
||||
# in pkgs.stdenvNoCC.mkDerivation {
|
||||
# name = "trip-haproxy-config-check";
|
||||
# script = ''
|
||||
# mkdir -p certs/shelvacu.com/
|
||||
# touch certs/shelvacu.com/full.pem
|
||||
# ${hacfg.package}/bin/haproxy \
|
||||
# -f ${pkgs.writeText "haproxy-config" hacfg.config} \
|
||||
# -c \
|
||||
# -dW \
|
||||
# -dD \
|
||||
# -C $PWD
|
||||
# '';
|
||||
# };
|
||||
}
|
||||
);
|
||||
|
||||
nixosModules.common = import ./common-config.nix;
|
||||
packages.x86_64-linux.digitalOceanImage = import ./generic-digitalocean-nixos.nix { inherit inputs; };
|
||||
nixosModules.common = import ./common/module.nix;
|
||||
|
||||
qb = # qb is "quick build"
|
||||
let
|
||||
toplevelOf = name: self.nixosConfigurations.${name}.config.system.build.toplevel;
|
||||
deterministicCerts = import ./deterministic-certs.nix { nixpkgs = pkgs; };
|
||||
renamedAarchPackages = lib.mapAttrs' (
|
||||
name: value: lib.nameValuePair (name + "-aarch64") value
|
||||
) self.packages.aarch64-linux;
|
||||
packages = self.packages.x86_64-linux // renamedAarchPackages;
|
||||
in
|
||||
rec {
|
||||
fw = toplevelOf "fw";
|
||||
triple-dezert = toplevelOf "triple-dezert";
|
||||
trip = triple-dezert;
|
||||
compute-deck = toplevelOf "compute-deck";
|
||||
cd = compute-deck;
|
||||
liam = toplevelOf "liam";
|
||||
lp0 = toplevelOf "lp0";
|
||||
legtop = toplevelOf "legtop";
|
||||
lt = legtop;
|
||||
shel-installer = toplevelOf "shel-installer";
|
||||
iso = self.nixosConfigurations.shel-installer.config.system.build.isoImage;
|
||||
check-triple-dezert = self.checks.x86_64-linux.trip.driver;
|
||||
check-trip = check-triple-dezert;
|
||||
check-liam = self.checks.x86_64-linux.liam.driver;
|
||||
|
||||
nix-on-droid = self.nixOnDroidConfigurations.default.activationPackage;
|
||||
nod = nix-on-droid;
|
||||
|
||||
nod-bootstrap-x86_64 = inputs.nix-on-droid.packages.x86_64-linux.bootstrapZip-x86_64;
|
||||
nod-bootstrap-aarch64 = inputs.nix-on-droid.packages.x86_64-linux.bootstrapZip-aarch64;
|
||||
|
||||
dc-priv = deterministicCerts.privKeyFile "test";
|
||||
dc-cert = deterministicCerts.selfSigned "test" { };
|
||||
|
||||
sm64 = packages.sm64coopdx;
|
||||
ak = packages.authorizedKeys;
|
||||
}
|
||||
// packages;
|
||||
|
||||
brokenBuilds = [ "sm64coopdx-aarch64" ];
|
||||
|
||||
all =
|
||||
pkgs.runCommand "nix-stuff-all"
|
||||
{
|
||||
__structuredAttrs = true;
|
||||
links = removeAttrs self.qb self.brokenBuilds;
|
||||
}
|
||||
''
|
||||
mkdir $out
|
||||
cd $out
|
||||
eval "$(${pkgs.jq}/bin/jq '.links | to_entries | map("ln -s "+.value+" "+.key) | join("\n")' /build/.attrs.json -r)"
|
||||
'';
|
||||
|
||||
allPure = self.all.overrideAttrs (prev: {
|
||||
links = removeAttrs prev.links [
|
||||
"nix-on-droid"
|
||||
"nod"
|
||||
"nod-bootstrap-x86_64"
|
||||
"nod-bootstrap-aarch64"
|
||||
];
|
||||
});
|
||||
|
||||
archive =
|
||||
let
|
||||
# We don't want iso/img derivations here because they de-dupe terribly. Any change anywhere requires generating a new iso/img file.
|
||||
allButImgs = self.all.overrideAttrs (prev: {
|
||||
links = removeAttrs prev.links [ "iso" ];
|
||||
});
|
||||
isoContents = lib.concatStringsSep "\n" (
|
||||
map (
|
||||
c: "${c.source} => ${c.target}"
|
||||
) self.nixosConfigurations.shel-installer.config.isoImage.contents
|
||||
);
|
||||
isoContentsPkg = pkgs.writeText "iso-contents" isoContents;
|
||||
info = pkgs.closureInfo { rootPaths = [ allButImgs.drvPath ]; };
|
||||
in
|
||||
allButImgs.overrideAttrs (prev: {
|
||||
links = prev.links // {
|
||||
iso-contents = isoContentsPkg;
|
||||
build-deps = info;
|
||||
};
|
||||
});
|
||||
}
|
||||
// (inputs.flake-utils.lib.eachDefaultSystem (
|
||||
system:
|
||||
let
|
||||
pkgs = import nixpkgs {
|
||||
inherit system;
|
||||
config.allowUnfree = true;
|
||||
};
|
||||
in
|
||||
{
|
||||
formatter = pkgs.nixfmt-rfc-style;
|
||||
packages = {
|
||||
sm64coopdx = pkgs.callPackage ./coopdx.nix { inherit nixpkgs; };
|
||||
# snmpb = pkgs.libsForQt5.callPackage ./packages/snmpb/package.nix { };
|
||||
# snmp-mibs-downloader = pkgs.callPackage ./packages/snmp-mibs-downloader.nix { };
|
||||
authorizedKeys = pkgs.writeText "authorizedKeys" (
|
||||
lib.concatStringsSep "\n" self.nixosConfigurations.fw.config.vacu.ssh.authorizedKeys
|
||||
);
|
||||
nixvim = inputs.nixvim.legacyPackages.${system}.makeNixvimWithModule {
|
||||
extraSpecialArgs = {
|
||||
inputs = { };
|
||||
};
|
||||
module = {
|
||||
imports = [ ./nixvim ];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
));
|
||||
}
|
||||
|
5
fw/android.nix
Normal file
5
fw/android.nix
Normal file
@@ -0,0 +1,5 @@
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
vacu.packages = pkgs.androidStudioPackages.stable.all;
|
||||
users.users.shelvacu.extraGroups = [ "kvm" ];
|
||||
}
|
69
fw/apex.nix
Normal file
69
fw/apex.nix
Normal file
@@ -0,0 +1,69 @@
|
||||
# everything to interact with my apex flex, pcsc stuff, fido2 stuff, etc
|
||||
{ pkgs, config, ... }:
|
||||
let
|
||||
# to match package used in config.services.pcscd, unfortunately not exposed like usual
|
||||
pcsclite-pkg = if config.security.polkit.enable then pkgs.pcscliteWithPolkit else pkgs.pcsclite;
|
||||
in
|
||||
{
|
||||
# apparently this is already enabled??
|
||||
# nixpkgs.overlays = [ ( final: prev: {
|
||||
# libfido2 = prev.libfido2.override { withPcsclite = true; };
|
||||
# } ) ];
|
||||
vacu.packages =
|
||||
(with pkgs; [
|
||||
libfido2
|
||||
pcsc-tools
|
||||
scmccid
|
||||
opensc
|
||||
])
|
||||
++ [ pcsclite-pkg ];
|
||||
|
||||
services.pcscd.enable = true;
|
||||
# conflicts with pcscd, see https://stackoverflow.com/questions/55144458/unable-to-claim-usb-interface-device-or-resource-busy-stuck
|
||||
boot.blacklistedKernelModules = [
|
||||
"pn533_usb"
|
||||
"pn533"
|
||||
"nfc"
|
||||
];
|
||||
|
||||
# bunch of stuff from https://wiki.nixos.org/wiki/Web_eID
|
||||
|
||||
# Tell p11-kit to load/proxy opensc-pkcs11.so, providing all available slots
|
||||
# (PIN1 for authentication/decryption, PIN2 for signing).
|
||||
# environment.etc."pkcs11/modules/opensc-pkcs11".text = ''
|
||||
# module: ${pkgs.opensc}/lib/opensc-pkcs11.so
|
||||
# '';
|
||||
|
||||
# environment.etc."opensc.conf".text = ''
|
||||
# app default {
|
||||
# reader_driver pcsc {
|
||||
# enable_pinpad = false;
|
||||
# }
|
||||
# }
|
||||
# '';
|
||||
|
||||
environment.systemPackages = [
|
||||
# Wrapper script to tell to Chrome/Chromium to use p11-kit-proxy to load
|
||||
# security devices, so they can be used for TLS client auth.
|
||||
# Each user needs to run this themselves, it does not work on a system level
|
||||
# due to a bug in Chromium:
|
||||
#
|
||||
# https://bugs.chromium.org/p/chromium/issues/detail?id=16387
|
||||
(pkgs.writeShellScriptBin "setup-browser-eid" ''
|
||||
NSSDB="''${HOME}/.pki/nssdb"
|
||||
mkdir -p ''${NSSDB}
|
||||
|
||||
${pkgs.nssTools}/bin/modutil -force -dbdir sql:$NSSDB -add p11-kit-proxy \
|
||||
-libfile ${pkgs.p11-kit}/lib/p11-kit-proxy.so
|
||||
'')
|
||||
];
|
||||
|
||||
programs.firefox.enable = true;
|
||||
#programs.firefox.policies.SecurityDevices.p11-kit-proxy = "${pkgs.p11-kit}/lib/p11-kit-proxy.so";
|
||||
|
||||
# trying CTAP-bridge
|
||||
services.udev.extraRules = ''
|
||||
KERNEL=="hidg[0-9]", SUBSYSTEM=="hidg", SYMLINK+="ctaphid", MODE+="0666", TAG+="uaccess"
|
||||
KERNEL=="ccidg[0-9]", SUBSYSTEM=="ccidg", SYMLINK+="ccidsc", MODE+="0666", TAG+="uaccess"
|
||||
'';
|
||||
}
|
122
fw/default.nix
122
fw/default.nix
@@ -1,24 +1,67 @@
|
||||
{ config, inputs, pkgs, lib, ... }: {
|
||||
{
|
||||
config,
|
||||
inputs,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = [
|
||||
../common-nixos-config.nix
|
||||
../common/nixos.nix
|
||||
inputs.nixos-hardware.nixosModules.framework-16-7040-amd
|
||||
./apex.nix
|
||||
./android.nix
|
||||
./thunderbolt.nix
|
||||
./fwupd.nix
|
||||
./zfs.nix
|
||||
#./experiment.nix
|
||||
];
|
||||
system.nixos.tags = [ "host-${config.networking.hostName}" ];
|
||||
|
||||
vacu.hostName = "fw"; # Define your hostname.
|
||||
vacu.shell.color = "magenta";
|
||||
vacu.verifySystem.expectedMac = "e8:65:38:52:5c:59";
|
||||
|
||||
boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
|
||||
networking.networkmanager.enable = true;
|
||||
# boot.kernelParams = [ "nvme.noacpi=1" ]; # DONT DO IT: breaks shit even more
|
||||
|
||||
vacu.packages.bitwarden-desktop.enable = true;
|
||||
vacu.packages.nheko.enable = true;
|
||||
vacu.packages.librewolf.enable = true;
|
||||
vacu.packages.brave.enable = true;
|
||||
vacu.packages.thunderbird.enable = true;
|
||||
vacu.packages.wl-clipboard.enable = true;
|
||||
vacu.packages.nextcloud-client.enable = true;
|
||||
vacu.packages.signal-desktop.enable = true;
|
||||
vacu.packages.fw-ectool.enable = true;
|
||||
vacu.packages.framework-tool.enable = true;
|
||||
vacu.packages.iio-sensor-proxy.enable = true;
|
||||
vacu.packages.power-profiles-daemon.enable = true;
|
||||
vacu.packages.acpi.enable = true;
|
||||
services.fprintd.enable = false; # kinda broken
|
||||
|
||||
vacu.packages =
|
||||
(with pkgs; [
|
||||
bitwarden-desktop
|
||||
nheko
|
||||
librewolf
|
||||
brave
|
||||
thunderbird
|
||||
wl-clipboard
|
||||
nextcloud-client
|
||||
signal-desktop
|
||||
fw-ectool
|
||||
framework-tool
|
||||
iio-sensor-proxy
|
||||
power-profiles-daemon
|
||||
acpi
|
||||
jellyfin-media-player
|
||||
vlc
|
||||
dmidecode
|
||||
prismlauncher
|
||||
ffmpeg_7-full
|
||||
wireshark
|
||||
obsidian
|
||||
dino
|
||||
aircrack-ng
|
||||
libreoffice-qt6-fresh
|
||||
gimp
|
||||
# null actually means everything https://github.com/NixOS/nixpkgs/commit/5efd65b2d94b0ac0cf155e013b6747fa22bc04c3
|
||||
(inkscape-with-extensions.override { inkscapeExtensions = null; })
|
||||
libsmi
|
||||
net-snmp
|
||||
android-tools
|
||||
ghidra
|
||||
])
|
||||
++ [ inputs.self.packages.${pkgs.system}.sm64coopdx ];
|
||||
|
||||
networking.firewall.enable = false;
|
||||
|
||||
services.xserver.enable = true;
|
||||
services.displayManager.sddm.enable = true;
|
||||
@@ -40,34 +83,43 @@
|
||||
}
|
||||
];
|
||||
|
||||
networking.hostName = "fw"; # Define your hostname.
|
||||
networking.hostId = "c6e309d5";
|
||||
boot.zfs.extraPools = [ "fw" ];
|
||||
boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
|
||||
systemd.services.zfs-mount.enable = false;
|
||||
|
||||
services.openssh.enable = true;
|
||||
system.stateVersion = "23.11"; # Did you read the comment?
|
||||
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "thunderbolt" "usb_storage" "usbhid" "sd_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.initrd.availableKernelModules = [
|
||||
"nvme"
|
||||
"xhci_pci"
|
||||
"thunderbolt"
|
||||
"usb_storage"
|
||||
"usbhid"
|
||||
"sd_mod"
|
||||
];
|
||||
#boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-amd" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
#boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "fw/root";
|
||||
fileSystems."/" = {
|
||||
device = "fw/root";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
fileSystems."/boot0" =
|
||||
{ device = "/dev/disk/by-label/BOOT0";
|
||||
fileSystems."/boot0" = {
|
||||
device = "/dev/disk/by-label/BOOT0";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0022" "dmask=0022" ];
|
||||
options = [
|
||||
"fmask=0022"
|
||||
"dmask=0022"
|
||||
];
|
||||
};
|
||||
|
||||
fileSystems."/boot1" =
|
||||
{ device = "/dev/disk/by-label/BOOT1";
|
||||
fileSystems."/boot1" = {
|
||||
device = "/dev/disk/by-label/BOOT1";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0022" "dmask=0022" ];
|
||||
options = [
|
||||
"fmask=0022"
|
||||
"dmask=0022"
|
||||
];
|
||||
};
|
||||
|
||||
hardware.cpu.amd.updateMicrocode = true;
|
||||
@@ -75,6 +127,10 @@
|
||||
hardware.opengl = {
|
||||
driSupport = true;
|
||||
driSupport32Bit = true;
|
||||
extraPackages = [
|
||||
pkgs.rocmPackages.clr.icd
|
||||
pkgs.amdvlk
|
||||
];
|
||||
};
|
||||
programs.nix-ld.enable = true;
|
||||
programs.steam = {
|
||||
@@ -91,4 +147,8 @@
|
||||
hardware.bluetooth.enable = true;
|
||||
hardware.bluetooth.powerOnBoot = true;
|
||||
services.blueman.enable = true;
|
||||
|
||||
services.postgresql.enable = true; # for development
|
||||
|
||||
virtualisation.waydroid.enable = true;
|
||||
}
|
||||
|
38
fw/experiment.nix
Normal file
38
fw/experiment.nix
Normal file
@@ -0,0 +1,38 @@
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
version = "6.10.4";
|
||||
hash = "sha256:1y2m2pqrvsgr9ng72nnh4yvsprkvkznhnmn4p8g78350bzyrvip2";
|
||||
customKernel = pkgs.linux_6_10.override {
|
||||
inherit version;
|
||||
src = pkgs.fetchurl {
|
||||
url = "mirror://kernel/linux/kernel/v${lib.versions.major version}.x/linux-${version}.tar.xz";
|
||||
inherit hash;
|
||||
};
|
||||
modDirVersion = lib.versions.pad 3 version;
|
||||
};
|
||||
customKernelPackages = pkgs.linuxPackagesFor customKernel;
|
||||
in {
|
||||
system.nixos.tags = ["EXPERIMENT" "kernel-${config.boot.kernelPackages.kernel.version}"];
|
||||
|
||||
boot.kernelPackages = lib.mkForce customKernelPackages;
|
||||
# boot.zfs.extraPools = lib.mkForce [];
|
||||
# fileSystems."/".fsType = lib.mkForce "ext4";
|
||||
|
||||
vacu.packages.sm64coopdx.enable = false;
|
||||
vacu.verifySystem.expectedMac = lib.mkForce null;
|
||||
}
|
||||
|
||||
# good:
|
||||
# Linux fw 6.6.50 #1-NixOS SMP PREEMPT_DYNAMIC Sun Sep 8 05:54:49 UTC 2024 x86_64 GNU/Linux
|
||||
# Linux fw 6.8.12 #1-NixOS SMP PREEMPT_DYNAMIC Thu May 30 07:49:53 UTC 2024 x86_64 GNU/Linux
|
||||
# linux-6.9.12
|
||||
# 6.10.4 (maybe?? sus)
|
||||
# Linux fw 6.10.10 #1-NixOS SMP PREEMPT_DYNAMIC Thu Sep 12 09:13:13 UTC 2024 x86_64 GNU/Linux (but this was supposed to be 6.10.4....)
|
||||
|
||||
# bad:
|
||||
# Linux fw 6.10.10-gnu #1-NixOS SMP PREEMPT_DYNAMIC Tue Jan 1 00:00:00 UTC 1980 x86_64 GNU/Linux
|
||||
# linux linux-6.10.10
|
8
fw/fwupd.nix
Normal file
8
fw/fwupd.nix
Normal file
@@ -0,0 +1,8 @@
|
||||
{ config, lib, ... }:
|
||||
{
|
||||
vacu.packages = [ config.services.fwupd.package ];
|
||||
services.fwupd.enable = true;
|
||||
#fwupd gets confused by the multiple EFI partitions, I think I just have to pick one
|
||||
#update: it didn't work, I dunno why. Leaving this here anyways
|
||||
services.fwupd.daemonSettings.EspLocation = lib.mkForce "/boot0";
|
||||
}
|
10
fw/thunderbolt.nix
Normal file
10
fw/thunderbolt.nix
Normal file
@@ -0,0 +1,10 @@
|
||||
{ pkgs, config, ... }:
|
||||
{
|
||||
services.hardware.bolt.enable = true;
|
||||
|
||||
vacu.packages = [
|
||||
pkgs.thunderbolt
|
||||
config.services.hardware.bolt.package
|
||||
pkgs.kdePackages.plasma-thunderbolt
|
||||
];
|
||||
}
|
21
fw/zfs.nix
Normal file
21
fw/zfs.nix
Normal file
@@ -0,0 +1,21 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
# latestCompatibleLinuxPackages = lib.pipe pkgs.linuxKernel.packages [
|
||||
# builtins.attrValues
|
||||
# (builtins.filter (kPkgs: (builtins.tryEval kPkgs).success && kPkgs ? kernel && kPkgs.kernel.pname == "linux" && kernelCompatible kPkgs.kernel))
|
||||
# (builtins.sort (a: b: (lib.versionOlder a.kernel.version b.kernel.version)))
|
||||
# lib.last
|
||||
# ];
|
||||
in
|
||||
{
|
||||
boot.zfs.extraPools = [ "fw" ];
|
||||
# config.boot.zfs.package.latestCompatibleLinuxPackages is fucked, if there are multiple compatible linuxes of the same version, it picks effectively an arbitrary one
|
||||
boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_10;
|
||||
systemd.services.zfs-mount.enable = false;
|
||||
|
||||
# see also fileSystems."/"
|
||||
}
|
@@ -1,10 +0,0 @@
|
||||
{ inputs, system ? "x86_64-linux" }:
|
||||
let
|
||||
pkgs = inputs.nixpkgs.legacyPackages.${system};
|
||||
config = { config, ... }: {
|
||||
imports = [ "${inputs.nixpkgs}/nixos/modules/virtualisation/digital-ocean-image.nix" ];
|
||||
|
||||
system.stateVersion = config.system.nixos.release;
|
||||
};
|
||||
in
|
||||
(pkgs.nixos config).digitalOceanImage
|
7
home/nix-on-droid.nix
Normal file
7
home/nix-on-droid.nix
Normal file
@@ -0,0 +1,7 @@
|
||||
{ ... }:
|
||||
{
|
||||
imports = [ ../common/home.nix ];
|
||||
home.stateVersion = "24.05";
|
||||
home.homeDirectory = "/data/data/com.termux.nix/files/home";
|
||||
home.username = "nix-on-droid";
|
||||
}
|
@@ -1,12 +1,21 @@
|
||||
{ config, inputs, modulesPath, lib, ... }: {
|
||||
{
|
||||
config,
|
||||
inputs,
|
||||
modulesPath,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = [
|
||||
"${modulesPath}/installer/cd-dvd/installation-cd-minimal.nix"
|
||||
./common-nixos-config.nix
|
||||
./common/nixos.nix
|
||||
];
|
||||
# this is an installer image, created anew every time. There's no state we need to worry about messing up
|
||||
system.stateVersion = config.system.nixos.version;
|
||||
isoImage.isoBaseName = "nixos-shel-installer";
|
||||
services.openssh.settings.PermitRootLogin = lib.mkForce "yes";
|
||||
vacu.hostName = "vacuInstaller";
|
||||
vacu.shell.color = "red";
|
||||
# boot.kernelPatches = [{
|
||||
# name = "foo";
|
||||
# patch = null;
|
||||
|
7
legtop/bluetooth.nix
Normal file
7
legtop/bluetooth.nix
Normal file
@@ -0,0 +1,7 @@
|
||||
{ ... }:
|
||||
{
|
||||
hardware.bluetooth.enable = true;
|
||||
hardware.bluetooth.powerOnBoot = true;
|
||||
|
||||
services.blueman.enable = true;
|
||||
}
|
76
legtop/default.nix
Normal file
76
legtop/default.nix
Normal file
@@ -0,0 +1,76 @@
|
||||
{
|
||||
pkgs,
|
||||
inputs,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
../common/nixos.nix
|
||||
inputs.nixos-hardware.nixosModules.gpd-micropc
|
||||
./hardware.nix
|
||||
./bluetooth.nix
|
||||
];
|
||||
|
||||
vacu.hostName = "legtop";
|
||||
vacu.shortHostName = "lt";
|
||||
vacu.shell.color = "blue";
|
||||
vacu.verifySystem.expectedMac = "30:9e:90:33:01:07";
|
||||
|
||||
system.stateVersion = "24.05";
|
||||
|
||||
boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
|
||||
networking.networkmanager.enable = true;
|
||||
vacu.packages =
|
||||
(with pkgs; [
|
||||
bitwarden-desktop
|
||||
nheko
|
||||
librewolf
|
||||
brave
|
||||
thunderbird
|
||||
wl-clipboard
|
||||
nextcloud-client
|
||||
signal-desktop
|
||||
iio-sensor-proxy
|
||||
power-profiles-daemon
|
||||
acpi
|
||||
jellyfin-media-player
|
||||
vlc
|
||||
dmidecode
|
||||
prismlauncher
|
||||
ffmpeg_7-full
|
||||
wireshark
|
||||
obsidian
|
||||
dino
|
||||
aircrack-ng
|
||||
libreoffice-qt6-fresh
|
||||
gimp
|
||||
# null actually means everything https://github.com/NixOS/nixpkgs/commit/5efd65b2d94b0ac0cf155e013b6747fa22bc04c3
|
||||
(inkscape-with-extensions.override { inkscapeExtensions = null; })
|
||||
libsmi
|
||||
net-snmp
|
||||
android-tools
|
||||
ghidra
|
||||
])
|
||||
++ [ inputs.self.packages.${pkgs.system}.sm64coopdx ];
|
||||
|
||||
services.openssh.enable = true;
|
||||
|
||||
services.xserver.enable = true;
|
||||
services.displayManager.sddm.enable = true;
|
||||
services.desktopManager.plasma6.enable = true;
|
||||
|
||||
boot.loader.grub.enable = true;
|
||||
boot.loader.grub.efiSupport = true;
|
||||
boot.loader.grub.device = "nodev";
|
||||
|
||||
hardware.cpu.intel.updateMicrocode = true;
|
||||
hardware.enableAllFirmware = true;
|
||||
|
||||
services.fwupd.enable = true;
|
||||
|
||||
services.pipewire = {
|
||||
enable = true;
|
||||
alsa.enable = true;
|
||||
alsa.support32Bit = true;
|
||||
pulse.enable = true;
|
||||
};
|
||||
}
|
25
legtop/hardware.nix
Normal file
25
legtop/hardware.nix
Normal file
@@ -0,0 +1,25 @@
|
||||
{
|
||||
...
|
||||
}:
|
||||
{
|
||||
boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "usbhid" "usb_storage" "sd_mod" "sdhci_pci" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/e3aebf24-be76-4064-a9f5-3930c8cd1382";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
boot.initrd.luks.devices."root".device = "/dev/disk/by-uuid/7fd2ca2d-7faf-4d40-8cde-ce531fa679b5";
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/4C47-D9A3";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0022" "dmask=0022" ];
|
||||
};
|
||||
nixpkgs.hostPlatform = "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = true;
|
||||
}
|
||||
|
@@ -1,19 +1,33 @@
|
||||
{ modulesPath, config, lib, ... }: {
|
||||
{
|
||||
modulesPath,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = [
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
(modulesPath + "/virtualisation/digital-ocean-config.nix")
|
||||
../common-nixos-config.nix
|
||||
../common/nixos.nix
|
||||
./nginx.nix
|
||||
./sops.nix
|
||||
./dovecot.nix
|
||||
./mail.nix
|
||||
./dkim.nix
|
||||
./sieve.nix
|
||||
./network.nix
|
||||
];
|
||||
|
||||
options = let
|
||||
mkReadOnly = val: lib.options.mkOption { default = val; readOnly = true; };
|
||||
in {
|
||||
options =
|
||||
let
|
||||
mkReadOnly =
|
||||
val:
|
||||
lib.options.mkOption {
|
||||
default = val;
|
||||
readOnly = true;
|
||||
};
|
||||
in
|
||||
{
|
||||
vacu.liam = {
|
||||
shel_domains = mkReadOnly [
|
||||
"shelvacu.com"
|
||||
@@ -29,28 +43,31 @@
|
||||
"shop.theviolincase.com"
|
||||
];
|
||||
domains = mkReadOnly (config.vacu.liam.shel_domains ++ config.vacu.liam.julie_domains);
|
||||
relayhost = lib.options.mkOption {
|
||||
type = lib.types.str;
|
||||
# mailhop is duocircle
|
||||
default = "[outbound.mailhop.org]:587 [relay.dynu.com]:587";
|
||||
};
|
||||
reservedIpLocal = mkReadOnly "10.46.0.7";
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
system.nixos.tags = [ "host-${config.networking.hostName}" ];
|
||||
networking.hostName = "liam";
|
||||
vacu.hostName = "liam";
|
||||
vacu.shell.color = "cyan";
|
||||
networking.domain = "dis8.net";
|
||||
vacu.minimal = true;
|
||||
|
||||
hardware.enableAllFirmware = false;
|
||||
hardware.enableRedistributableFirmware = false;
|
||||
|
||||
# networking.interfaces."ens3".useDHCP = false;
|
||||
# from `curl -fsSL http://169.254.169.254/metadata/v1.json | jq '.interfaces.public[0].anchor_ipv4'`
|
||||
# {
|
||||
# "ip_address": "10.46.0.7",
|
||||
# "netmask": "255.255.0.0",
|
||||
# "gateway": "10.46.0.1"
|
||||
# }
|
||||
|
||||
services.openssh.enable = true;
|
||||
|
||||
virtualisation.digitalOcean.setSshKeys = false;
|
||||
|
||||
users.users.root.openssh.authorizedKeys.keys = config.users.users.shelvacu.openssh.authorizedKeys.keys;
|
||||
users.users.root.openssh.authorizedKeys.keys =
|
||||
config.users.users.shelvacu.openssh.authorizedKeys.keys;
|
||||
|
||||
system.stateVersion = "23.11";
|
||||
};
|
||||
|
@@ -1,7 +1,13 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (config.vacu.liam) domains;
|
||||
in {
|
||||
inherit (config.vacu.liam) domains;
|
||||
in
|
||||
{
|
||||
services.opendkim = {
|
||||
enable = true;
|
||||
keyPath = "/run/secrets/dkimkeys";
|
||||
|
@@ -1,4 +1,9 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
{
|
||||
networking.firewall.allowedTCPPorts = [ 993 ];
|
||||
systemd.tmpfiles.settings.whatever."/var/lib/mail".d = {
|
||||
@@ -17,7 +22,11 @@
|
||||
sslServerKey = config.security.acme.certs."liam.dis8.net".directory + "/key.pem";
|
||||
sslServerCert = config.security.acme.certs."liam.dis8.net".directory + "/full.pem";
|
||||
enablePAM = false;
|
||||
protocols = lib.mkForce [ "imap" "lmtp" "sieve" ];
|
||||
protocols = lib.mkForce [
|
||||
"imap"
|
||||
"lmtp"
|
||||
"sieve"
|
||||
];
|
||||
modules = [ pkgs.dovecot_pigeonhole ];
|
||||
mailUser = "vmail";
|
||||
mailGroup = "vmail";
|
||||
@@ -75,13 +84,13 @@
|
||||
|
||||
userdb {
|
||||
driver = passwd-file
|
||||
args = username_format=%n /run/secrets/dovecot-passwd
|
||||
args = username_format=%n ${config.sops.secrets."dovecot-passwd".path}
|
||||
override_fields = uid=${config.services.dovecot2.mailUser} gid=${config.services.dovecot2.mailGroup} user=%n
|
||||
}
|
||||
|
||||
passdb {
|
||||
driver = passwd-file
|
||||
args = username_format=%n /run/secrets/dovecot-passwd
|
||||
args = username_format=%n ${config.sops.secrets."dovecot-passwd".path}
|
||||
override_fields = user=%n
|
||||
}
|
||||
|
||||
|
@@ -1,10 +1,25 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (config.vacu.liam) shel_domains julie_domains domains;
|
||||
fqdn = config.networking.fqdn;
|
||||
dovecot_transport = "lmtp:unix:private/dovecot-lmtp";
|
||||
in {
|
||||
networking.firewall.allowedTCPPorts = [ 25 465 ];
|
||||
inherit (config.vacu.liam)
|
||||
shel_domains
|
||||
julie_domains
|
||||
domains
|
||||
relayhost
|
||||
;
|
||||
debug = false;
|
||||
fqdn = config.networking.fqdn;
|
||||
dovecot_transport = "lmtp:unix:private/dovecot-lmtp";
|
||||
in
|
||||
{
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
25
|
||||
465
|
||||
];
|
||||
|
||||
vacu.acmeCertDependencies."liam.dis8.net" = [ "postfix.service" ];
|
||||
services.postfix = {
|
||||
@@ -13,11 +28,14 @@ in {
|
||||
|
||||
# this goes into virtual_alias_maps
|
||||
# "Note: for historical reasons, virtual_alias_maps apply to recipients in all domain classes, not only the virtual alias domain class."
|
||||
virtual = ''
|
||||
virtual =
|
||||
''
|
||||
julie@shelvacu.com julie
|
||||
mom@shelvacu.com julie
|
||||
psv@shelvacu.com psv
|
||||
'' + (lib.concatMapStringsSep "\n" (d: "@${d} shelvacu") shel_domains) + "\n"
|
||||
''
|
||||
+ (lib.concatMapStringsSep "\n" (d: "@${d} shelvacu") shel_domains)
|
||||
+ "\n"
|
||||
+ (lib.concatMapStringsSep "\n" (d: "@${d} julie") julie_domains);
|
||||
|
||||
transport = ''
|
||||
@@ -33,19 +51,34 @@ in {
|
||||
rootAlias = "shelvacu";
|
||||
enableSubmission = false;
|
||||
enableSubmissions = true;
|
||||
mapFiles.header_checks = pkgs.writeText "header-checks" ("/./ INFO checker headers\n" + (lib.concatMapStringsSep "\n" (d: "/^(from|x-original-from|return-path|mail-?from):.*@${lib.escape [ "." ] d}\\s*>?\\s*$/ REJECT") domains));
|
||||
mapFiles.sender_access = pkgs.writeText "sender-access" (lib.concatMapStringsSep "\n" (d: "${d} REJECT") domains);
|
||||
mapFiles.header_checks = pkgs.writeText "header-checks" (
|
||||
"/./ INFO checker headers\n"
|
||||
+ (lib.concatMapStringsSep "\n" (
|
||||
d: "/^(from|x-original-from|return-path|mail-?from):.*@${lib.escape [ "." ] d}\\s*>?\\s*$/ REJECT"
|
||||
) domains)
|
||||
);
|
||||
mapFiles.sender_access = pkgs.writeText "sender-access" (
|
||||
lib.concatMapStringsSep "\n" (d: "${d} REJECT") domains
|
||||
);
|
||||
# hack to get postfix to add a X-Original-To header
|
||||
mapFiles.add_envelope_to = pkgs.writeText "addenvelopeto" "/(.+)/ PREPEND X-Envelope-To: $1";
|
||||
mapFiles.sender_transport = pkgs.writeText "sender-transport" "@shelvacu.com relayservice";
|
||||
mapFiles.sender_relay = pkgs.writeText "sender-relay" "@shelvacu.com ${relayhost}";
|
||||
|
||||
# verbatim appended to main.cf
|
||||
extraConfig = ''
|
||||
smtp_tls_CAfile = /etc/pki/tls/certs/ca-bundle.crt
|
||||
inet_protocols = ipv4
|
||||
virtual_alias_domains =
|
||||
${lib.concatStringsSep ",\n " domains}
|
||||
|
||||
sender_dependent_default_transport_maps = hash:/etc/postfix/sender_transport
|
||||
sender_dependent_relayhost_maps = hash:/etc/postfix/sender_relay
|
||||
|
||||
header_checks = pcre:/etc/postfix/header_checks
|
||||
smtpd_sender_restrictions = check_sender_access hash:/etc/postfix/sender_access
|
||||
smtpd_recipient_restrictions = check_recipient_access pcre:/etc/postfix/add_envelope_to
|
||||
recipient_delimiter = +
|
||||
|
||||
#we should never use these transport methods unless thru transport map
|
||||
# RFC3463:
|
||||
@@ -66,13 +99,38 @@ in {
|
||||
smtpd_tls_dh1024_param_file = ${lib.optionalString config.services.dovecot2.enableDHE config.security.dhparams.params.dovecot2.path}
|
||||
|
||||
# smtp_bind_address = 10.46.0.7
|
||||
|
||||
${lib.optionalString config.services.opendkim.enable (assert (config.services.opendkim.socket == "local:/run/opendkim/opendkim.sock"); ''
|
||||
# inet_interfaces = all
|
||||
# inet_protocols = ipv4
|
||||
${lib.optionalString config.services.opendkim.enable (
|
||||
assert (config.services.opendkim.socket == "local:/run/opendkim/opendkim.sock");
|
||||
''
|
||||
smtpd_milters = unix:/run/opendkim/opendkim.sock
|
||||
non_smtpd_milters = unix:/run/opendkim/opendkim.sock
|
||||
'')}
|
||||
''
|
||||
)}
|
||||
'';
|
||||
|
||||
masterConfig."relayservice" = {
|
||||
command = "smtp";
|
||||
type = "unix";
|
||||
args = [
|
||||
"-o"
|
||||
"smtp_sasl_auth_enable=yes"
|
||||
"-o"
|
||||
"smtp_sasl_security_options=noanonymous"
|
||||
"-o"
|
||||
"smtp_tls_security_level=secure"
|
||||
"-o"
|
||||
"smtp_sasl_password_maps=texthash:${config.sops.secrets.relay_creds.path}"
|
||||
"-o"
|
||||
"smtp_tls_wrappermode=no"
|
||||
#"-o" "relayhost=${relayhost}"
|
||||
] ++ (if debug then [ "-v" ] else [ ]);
|
||||
};
|
||||
|
||||
masterConfig.qmgr = lib.mkIf debug { args = [ "-v" ]; };
|
||||
masterConfig.cleanup = lib.mkIf debug { args = [ "-v" ]; };
|
||||
masterConfig.smtpd = lib.mkIf debug { args = [ "-v" ]; };
|
||||
submissionsOptions = {
|
||||
smtpd_tls_key_file = config.security.acme.certs."liam.dis8.net".directory + "/key.pem";
|
||||
smtpd_tls_cert_file = config.security.acme.certs."liam.dis8.net".directory + "/full.pem";
|
||||
@@ -99,6 +157,5 @@ in {
|
||||
tls_preempt_cipherlist = "no";
|
||||
};
|
||||
|
||||
|
||||
};
|
||||
}
|
32
liam/network.nix
Normal file
32
liam/network.nix
Normal file
@@ -0,0 +1,32 @@
|
||||
{ lib, config, ... }:
|
||||
let
|
||||
# from `curl -fsSL http://169.254.169.254/metadata/v1.json | jq '.interfaces.public[0].anchor_ipv4'`
|
||||
# {
|
||||
# "ip_address": "10.46.0.7",
|
||||
# "netmask": "255.255.0.0",
|
||||
# "gateway": "10.46.0.1"
|
||||
# }
|
||||
interface_conf = {
|
||||
useDHCP = true;
|
||||
ipv4.addresses = [
|
||||
{
|
||||
address = "10.46.0.7";
|
||||
prefixLength = 24;
|
||||
}
|
||||
];
|
||||
ipv4.routes = [
|
||||
{
|
||||
address = "0.0.0.0";
|
||||
prefixLength = 0;
|
||||
via = "10.46.0.1";
|
||||
options.scope = "global";
|
||||
options.src = "10.46.0.7";
|
||||
options.metric = "1200";
|
||||
}
|
||||
];
|
||||
};
|
||||
in
|
||||
{
|
||||
networking.interfaces."ens3" = lib.mkIf (!config.vacu.underTest) interface_conf;
|
||||
networking.interfaces."eth0" = lib.mkIf (config.vacu.underTest) interface_conf;
|
||||
}
|
@@ -1,16 +1,19 @@
|
||||
{ config, ... }:
|
||||
let
|
||||
domains = [
|
||||
domains = [
|
||||
"smtp.shelvacu.com"
|
||||
"imap.shelvacu.com"
|
||||
"mail.shelvacu.com"
|
||||
"autoconfig.shelvacu.com"
|
||||
"mail.dis8.net"
|
||||
"liam.dis8.net"
|
||||
];
|
||||
];
|
||||
in
|
||||
{
|
||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
80
|
||||
443
|
||||
];
|
||||
security.acme.acceptTerms = true;
|
||||
security.acme.defaults.webroot = "/var/lib/acme/acme-challenge";
|
||||
security.acme.defaults.email = "shelvacu@gmail.com";
|
||||
|
@@ -1,4 +1,12 @@
|
||||
{ config, pkgs, lib, ... }: with lib.strings; with lib.lists; let
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
with lib.strings;
|
||||
with lib.lists;
|
||||
let
|
||||
email_folders = [
|
||||
"24nm-domain@shelvacu.com"
|
||||
"agora@shelvacu.com"
|
||||
@@ -32,33 +40,55 @@
|
||||
"xn--tulp-yoa.info"
|
||||
];
|
||||
valid_ish_domain = domain: match "[a-z0-9][a-z0-9-]*(\\.[a-z0-9][a-z0-9-]*)+" domain != null;
|
||||
mk_domain_folder_name = domain: assert valid_ish_domain domain; concatStringsSep "." (reverseList (splitString "." domain));
|
||||
mk_email_folder_name = email: let
|
||||
mk_domain_folder_name =
|
||||
domain:
|
||||
assert valid_ish_domain domain;
|
||||
concatStringsSep "." (reverseList (splitString "." domain));
|
||||
mk_email_folder_name =
|
||||
email:
|
||||
let
|
||||
parts = splitString "@" email;
|
||||
domain_part = assert (length parts) == 2; elemAt parts 1;
|
||||
user_part = assert (length parts) == 2; elemAt parts 0;
|
||||
domain_part =
|
||||
assert (length parts) == 2;
|
||||
elemAt parts 1;
|
||||
user_part =
|
||||
assert (length parts) == 2;
|
||||
elemAt parts 0;
|
||||
domain_folder = mk_domain_folder_name domain_part;
|
||||
folder_name = domain_folder + ".@" + user_part;
|
||||
in folder_name;
|
||||
in
|
||||
folder_name;
|
||||
is_quoteable = s: match "[ -~]*" s != null;
|
||||
sieve_quote_string = s: assert is_quoteable s; "\"" + (replaceStrings ["\"" "\\"] ["\\\"" "\\\\"] s) + "\"";
|
||||
email_filters = map (e:
|
||||
''
|
||||
sieve_quote_string =
|
||||
s:
|
||||
assert is_quoteable s;
|
||||
"\""
|
||||
+ (replaceStrings
|
||||
[
|
||||
"\""
|
||||
"\\"
|
||||
]
|
||||
[
|
||||
"\\\""
|
||||
"\\\\"
|
||||
]
|
||||
s
|
||||
)
|
||||
+ "\"";
|
||||
email_filters = map (e: ''
|
||||
elsif header :is "X-Envelope-To" ${sieve_quote_string e} {
|
||||
fileinto :create ${sieve_quote_string (mk_email_folder_name e)};
|
||||
}
|
||||
''
|
||||
) email_folders;
|
||||
domain_filters = map (d:
|
||||
''
|
||||
'') email_folders;
|
||||
domain_filters = map (d: ''
|
||||
elsif header :matches "X-Envelope-To" ${sieve_quote_string ("*@" + d)} {
|
||||
fileinto :create ${sieve_quote_string (mk_domain_folder_name d)};
|
||||
}
|
||||
''
|
||||
) domain_folders;
|
||||
'') domain_folders;
|
||||
sieve_text = ''
|
||||
require ["fileinto", "mailbox"];
|
||||
|
||||
if header :is "Delivered-To" "shelvacu@liam.dis8.net" {
|
||||
if header :is "X-Envelope-To" "brandcrowd@shelvacu.com" {
|
||||
discard;
|
||||
}
|
||||
@@ -67,7 +97,13 @@
|
||||
}
|
||||
${concatStrings email_filters}
|
||||
${concatStrings domain_filters}
|
||||
}
|
||||
'';
|
||||
in {
|
||||
services.dovecot2.sieveScripts.before = pkgs.writeText "blargsieve" sieve_text;
|
||||
in
|
||||
{
|
||||
services.dovecot2.sieve.extensions = [
|
||||
"fileinto"
|
||||
"mailbox"
|
||||
];
|
||||
services.dovecot2.sieve.scripts.before = pkgs.writeText "blargsieve" sieve_text;
|
||||
}
|
@@ -1,8 +1,11 @@
|
||||
{ inputs, lib, config, ... }:
|
||||
{
|
||||
imports = [
|
||||
inputs.sops-nix.nixosModules.sops
|
||||
];
|
||||
inputs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = [ inputs.sops-nix.nixosModules.sops ];
|
||||
|
||||
options.vacu.secretsFolder = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
@@ -20,5 +23,9 @@
|
||||
restartUnits = [ "opendkim.service" ];
|
||||
owner = config.services.opendkim.user;
|
||||
};
|
||||
sops.secrets.relay_creds = {
|
||||
restartUnits = [ "postfix.service" ];
|
||||
owner = config.services.postfix.user;
|
||||
};
|
||||
};
|
||||
}
|
@@ -1,7 +1,7 @@
|
||||
{ config, pkgs, ... }:
|
||||
{
|
||||
imports = [
|
||||
../common-nixos-config.nix
|
||||
../common/nixos.nix
|
||||
./hardware-config.nix
|
||||
];
|
||||
|
||||
@@ -9,7 +9,9 @@
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
networking.hostName = "lp0onfire"; # Define your hostname.
|
||||
vacu.hostName = "lp0onfire"; # Define your hostname.
|
||||
vacu.shortHostName = "lp0";
|
||||
vacu.shell.color = "green";
|
||||
|
||||
# Set your time zone.
|
||||
time.timeZone = "America/Los_Angeles";
|
||||
@@ -73,4 +75,3 @@
|
||||
# internalInterfaces = [ "ztrf26rjvk" ];
|
||||
# };
|
||||
}
|
||||
|
||||
|
@@ -1,25 +1,35 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
|
||||
boot.initrd.availableKernelModules = [
|
||||
"xhci_pci"
|
||||
"ahci"
|
||||
"usb_storage"
|
||||
"usbhid"
|
||||
"sd_mod"
|
||||
];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/51a9c6de-3231-469f-a292-ada7d2531d63";
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-uuid/51a9c6de-3231-469f-a292-ada7d2531d63";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/36B4-78A2";
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-uuid/36B4-78A2";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
|
@@ -1,19 +1,27 @@
|
||||
{ config, lib, pkgs, inputs, ... }:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
inputs,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports = [ ./common-config.nix ];
|
||||
environment.packages = config.vacu.packageList;
|
||||
imports = [
|
||||
../common/nix-on-droid.nix
|
||||
./flake-registry.nix
|
||||
];
|
||||
|
||||
vacu.shell.color = "white";
|
||||
|
||||
environment.etc."resolv.conf".text = lib.mkForce ''
|
||||
nameserver 10.78.79.1
|
||||
# nameserver 10.78.79.1
|
||||
nameserver 9.9.9.10
|
||||
nameserver 149.112.112.10
|
||||
|
||||
options timeout:1 attempts:5
|
||||
'';
|
||||
|
||||
environment.etc."ssh/ssh_config".text = config.vacu.ssh.config;
|
||||
|
||||
# Backup etc files instead of failing to activate generation if a file already exists in /etc
|
||||
environment.etcBackupExtension = ".bak";
|
||||
|
||||
@@ -24,10 +32,8 @@
|
||||
nix.extraOptions = ''
|
||||
experimental-features = nix-command flakes
|
||||
'';
|
||||
nix.substituters = config.vacu.nix.extraSubstituters;
|
||||
nix.trustedPublicKeys = config.vacu.nix.extraTrustedKeys;
|
||||
|
||||
environment.sessionVariables."PS1" = "\\w $ ";
|
||||
#environment.sessionVariables."PS1" = "\\w $ ";
|
||||
|
||||
# Set your time zone
|
||||
time.timeZone = "America/Los_Angeles";
|
9
nix-on-droid/flake-registry.nix
Normal file
9
nix-on-droid/flake-registry.nix
Normal file
@@ -0,0 +1,9 @@
|
||||
# To make `nix run nixpkgs#hello` and such use the same nixpkgs used to build this, so that it doesn't take forever
|
||||
{ inputs, ... }:
|
||||
{
|
||||
nix.registry.nixpkgs.to = {
|
||||
type = "path";
|
||||
path = inputs.nixpkgs.outPath;
|
||||
};
|
||||
nix.nixPath = [ "nixpkgs=flake:nixpkgs" ];
|
||||
}
|
35
nixvim/default.nix
Normal file
35
nixvim/default.nix
Normal file
@@ -0,0 +1,35 @@
|
||||
{ ... }:
|
||||
let
|
||||
in
|
||||
{
|
||||
opts = {
|
||||
smartindent = true;
|
||||
expandtab = true;
|
||||
shiftwidth = 2;
|
||||
softtabstop = -1;
|
||||
};
|
||||
plugins.comment.enable = true;
|
||||
plugins.surround.enable = true;
|
||||
plugins.lsp = {
|
||||
enable = true;
|
||||
onAttach = builtins.readFile ./nixd-init.lua;
|
||||
servers = {
|
||||
bashls.enable = true;
|
||||
jsonls.enable = true;
|
||||
# nil-ls.enable = true;
|
||||
nixd = {
|
||||
enable = true;
|
||||
};
|
||||
pyright.enable = true;
|
||||
tsserver.enable = true;
|
||||
lua-ls.enable = true;
|
||||
rust-analyzer = {
|
||||
enable = true;
|
||||
installCargo = false;
|
||||
installRustc = false;
|
||||
};
|
||||
html.enable = true;
|
||||
yamlls.enable = true;
|
||||
};
|
||||
};
|
||||
}
|
22
nixvim/nixd-init.lua
Normal file
22
nixvim/nixd-init.lua
Normal file
@@ -0,0 +1,22 @@
|
||||
--@param client vim.lsp.Client
|
||||
local function init_per_dir_nixd(client)
|
||||
if client.workspace_folders == nil then
|
||||
return
|
||||
end
|
||||
local path = client.workspace_folders[1].name
|
||||
local command = client.config.cmd[1]
|
||||
local name = string.gsub(command, "(.*/)(.*)", "%2")
|
||||
local is_nixd = name == "nixd"
|
||||
local is_nix_stuff = (path == '/home/shelvacu/dev/nix-stuff' or path == '/home/shelvacu/nix-stuff' or path == '/data/data/com.termux.nix/files/home/nix-stuff')
|
||||
if is_nixd and is_nix_stuff then
|
||||
local get_flake = "(builtins.getFlake \"" .. path .. "\")"
|
||||
client.config.settings["nixd"].options = {
|
||||
nixos = { expr = get_flake .. ".nixosConfigurations.fw.options", },
|
||||
["home-manager"] = { expr = get_flake .. ".homeConfigurations.\"nix-on-droid\".options", },
|
||||
["nix-on-droid"] = { expr = get_flake .. ".nixOnDroidConfigurations.default.options", },
|
||||
}
|
||||
client.notify("workspace/didChangeConfiguration", { settings = client.config.settings, })
|
||||
end
|
||||
end
|
||||
|
||||
init_per_dir_nixd(client)
|
@@ -1,32 +0,0 @@
|
||||
{ config, pkgs, lib, ... }: let
|
||||
inherit (lib) mkOption types;
|
||||
pkgOptions = builtins.attrValues config.vacu.packages;
|
||||
enabledOptions = builtins.filter (o: o.enable) pkgOptions;
|
||||
enabledPkgs = builtins.map (o: o.package) enabledOptions;
|
||||
in {
|
||||
options = {
|
||||
vacu.packages = mkOption {
|
||||
default = {};
|
||||
type = types.attrsOf (types.submodule ({ name, config, options, ... }: {
|
||||
options = {
|
||||
enable = mkOption {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
description = "Will this package be installed (included in environment.systemPackages)";
|
||||
};
|
||||
package = mkOption {
|
||||
type = types.package;
|
||||
default = pkgs.${name};
|
||||
defaultText = "pkgs.${name}";
|
||||
};
|
||||
};
|
||||
}));
|
||||
};
|
||||
vacu.packageList = mkOption {
|
||||
type = types.listOf types.package;
|
||||
readOnly = true;
|
||||
};
|
||||
};
|
||||
|
||||
config.vacu.packageList = enabledPkgs;
|
||||
}
|
124
packages/snmp-mibs-downloader.nix
Normal file
124
packages/snmp-mibs-downloader.nix
Normal file
@@ -0,0 +1,124 @@
|
||||
{
|
||||
bash,
|
||||
coreutils,
|
||||
gzip,
|
||||
gnutar,
|
||||
unzip,
|
||||
wget,
|
||||
gnupatch,
|
||||
|
||||
fetchFromGitLab,
|
||||
fetchurl,
|
||||
#libsmi,
|
||||
#resholve,
|
||||
stdenv,
|
||||
writeText,
|
||||
lib,
|
||||
}@args:
|
||||
stdenv.mkDerivation (
|
||||
self:
|
||||
let
|
||||
# this script depends on an old version of libsmi's smistrip
|
||||
libsmi = stdenv.mkDerivation rec {
|
||||
pname = "libsmi";
|
||||
version = "0.4.8";
|
||||
|
||||
src = fetchurl {
|
||||
url = "https://www.ibr.cs.tu-bs.de/projects/libsmi/download/${pname}-${version}.tar.gz";
|
||||
hash = "sha256-8EilJw9BvIiww7Co/nDKTXFqRrUxoOyqqHxGL0nXSEk=";
|
||||
};
|
||||
|
||||
env.NIX_CFLAGS_COMPILE = "-std=gnu90";
|
||||
#env.CFLAGS="-Wno-error";
|
||||
#env.NIX_DEBUG="7";
|
||||
|
||||
hardeningDisable = [ "format" ];
|
||||
|
||||
meta = with lib; {
|
||||
description = "A Library to Access SMI MIB Information";
|
||||
homepage = "https://www.ibr.cs.tu-bs.de/projects/libsmi/index.html";
|
||||
license = licenses.free;
|
||||
platforms = lib.platforms.linux ++ lib.platforms.darwin;
|
||||
};
|
||||
};
|
||||
in
|
||||
rec {
|
||||
pname = "snmp-mibs-downloader";
|
||||
version = "1.6";
|
||||
|
||||
src = fetchFromGitLab {
|
||||
domain = "salsa.debian.org";
|
||||
owner = "debian";
|
||||
repo = "${pname}";
|
||||
rev = "debian/${version}";
|
||||
hash = "sha256-W2VW3EJWmHwlqMoL12dFcfkYmAADLOtUWCydcL5qUKc=";
|
||||
};
|
||||
|
||||
# installPhase = ''
|
||||
# install -Dm755 download-mibs $out/bin
|
||||
# install -Dm644 *.conf *list $out/etc/snmp-mips-downloader
|
||||
# cp mibrfcs/* $out/share/snmp/mibs-downloader/mibrfcs
|
||||
# cp mibiana/* $out/share/snmp/mibs-downloader/mibiana
|
||||
# gzip -9 $out/share/snmp/mibs-downloader/*/*
|
||||
|
||||
# '';
|
||||
postPatch = ''
|
||||
substituteInPlace download-mibs \
|
||||
--replace-fail SMISTRIP=/usr/bin/smistrip "" \
|
||||
--replace-fail CONFDIR=/etc/snmp-mibs-downloader "BASEDIR=/var/lib/mibs; AUTOLOAD='rfc ianarfc iana'" \
|
||||
--replace-fail '. $CONFDIR/snmp-mibs-downloader.conf' ""
|
||||
'';
|
||||
preInstall = ''
|
||||
mkdir -p $out/usr/bin $out/etc/snmp-mibs-downloader $out/usr/share/snmp/mibs-downloader/mib{rfcs,iana} $out/usr/share/snmp/mibs
|
||||
'';
|
||||
installFlags = [
|
||||
"INSTALL=install"
|
||||
"DESTDIR=$(out)"
|
||||
];
|
||||
postInstall = ''
|
||||
mv $out/usr/* $out
|
||||
rmdir $out/usr
|
||||
substituteInPlace $out/etc/snmp-mibs-downloader/* \
|
||||
--replace-quiet 'DIR=/usr/share/snmp/mibs-downloader' 'DIR='$out'/share/snmp/mibs-downloader'
|
||||
mv $out/bin/download-mibs $out/bin/.download-mibs-unwrapped
|
||||
cat <<EOF > $out/bin/download-mibs
|
||||
#!${bash}/bin/bash
|
||||
PATH=${
|
||||
lib.escapeShellArg (
|
||||
lib.concatStringsSep ":" (
|
||||
lib.flip map [
|
||||
coreutils
|
||||
gzip
|
||||
gnutar
|
||||
unzip
|
||||
wget
|
||||
gnupatch
|
||||
] (p: "${p}/bin")
|
||||
)
|
||||
)
|
||||
}
|
||||
SMISTRIP=${libsmi}/bin/smistrip
|
||||
CONFDIR=$out/etc/snmp-mibs-downloader
|
||||
source $out/bin/.download-mibs-unwrapped
|
||||
EOF
|
||||
chmod u+x $out/bin/download-mibs
|
||||
'';
|
||||
|
||||
env.NIX_DEBUG = "7";
|
||||
# solutions.default = {
|
||||
# scripts = [ "bin/download-mibs" ];
|
||||
# interpreter = "${bash}/bin/bash";
|
||||
# inputs = [ coreutils gzip gnutar unzip wget gnupatch ];
|
||||
# keep = {
|
||||
# "$archive_fetcher" = true;
|
||||
# source = [ "$CONFDIR/$i.conf" ];
|
||||
# "${wget}/bin/wget" = true;
|
||||
# };
|
||||
# fix = { "$SMISTRIP" = [ "${libsmi}/bin/smistrip" ]; };
|
||||
# };
|
||||
|
||||
meta = {
|
||||
mainProgram = "download-mibs";
|
||||
};
|
||||
}
|
||||
)
|
133
packages/snmpb/package.nix
Normal file
133
packages/snmpb/package.nix
Normal file
@@ -0,0 +1,133 @@
|
||||
{
|
||||
fetchgit,
|
||||
lib,
|
||||
libsmi,
|
||||
libtomcrypt,
|
||||
qmake,
|
||||
qtbase,
|
||||
qwt,
|
||||
stdenv,
|
||||
wrapQtAppsHook,
|
||||
|
||||
breakpointHook,
|
||||
}@args:
|
||||
|
||||
stdenv.mkDerivation (
|
||||
finalAttrs:
|
||||
let
|
||||
# ./configure --disable-shared --disable-yang --with-pathseparator=';' --with-dirseparator='/' --with-smipath=${INSTALL_PREFIX}'/${SHARE}/snmpb/mibs;'${INSTALL_PREFIX}'/${SHARE}/snmpb/pibs'
|
||||
libsmi = finalAttrs.passthru.libsmi;
|
||||
# $(INSTALL) -m 444 ${ROOT_OWNER} libsmi/mibs/iana/* ${INSTALL_PREFIX}/${SHARE}/snmpb/mibs
|
||||
# $(INSTALL) -m 444 ${ROOT_OWNER} libsmi/mibs/ietf/* ${INSTALL_PREFIX}/${SHARE}/snmpb/mibs
|
||||
# $(INSTALL) -m 444 ${ROOT_OWNER} libsmi/mibs/tubs/* ${INSTALL_PREFIX}/${SHARE}/snmpb/mibs
|
||||
# $(INSTALL) -m 444 ${ROOT_OWNER} libsmi/pibs/ietf/* ${INSTALL_PREFIX}/${SHARE}/snmpb/pibs
|
||||
# $(INSTALL) -m 444 ${ROOT_OWNER} libsmi/pibs/tubs/* ${INSTALL_PREFIX}/${SHARE}/snmpb/pibs
|
||||
|
||||
in
|
||||
{
|
||||
pname = "snmpb";
|
||||
version = "0.9pre1";
|
||||
|
||||
# __structuredAttrs = true;
|
||||
|
||||
passthru = {
|
||||
proFile = "${finalAttrs.pname}.pro";
|
||||
makeFile = "makefile.${finalAttrs.pname}";
|
||||
smipath = "${finalAttrs.passthru.libsmi-data}/share/snmpb/mibs;${finalAttrs.passthru.libsmi-data}/share/snmpb/pibs";
|
||||
libsmi = args.libsmi.overrideAttrs (
|
||||
final: prev: {
|
||||
#preConfigure = (prev.preConfigure or "") + "\n" + ''
|
||||
# appendToVar configureFlags --prefix=$out/ --disable-yang --with-pathseparator=';' --with-dirseparator='/'
|
||||
#'';
|
||||
configureFlags = (prev.configureFlags or [ ]) ++ [
|
||||
"--with-pathseparator=;"
|
||||
"--with-smipath=${finalAttrs.passthru.smipath}"
|
||||
];
|
||||
env.NIX_DEBUG = "2";
|
||||
pname = prev.pname + "-for-snmpb";
|
||||
}
|
||||
);
|
||||
libsmi-data = stdenv.mkDerivation {
|
||||
name = "libsmi-snmpb-data";
|
||||
phases = "unpackPhase installPhase";
|
||||
src = libsmi.src;
|
||||
installPhase = ''
|
||||
mkdir -p $out/share/snmpb/{mibs,pibs}
|
||||
shopt -s globstar
|
||||
for foo in mibs pibs; do
|
||||
for node in $foo/**/*; do
|
||||
[[ -f $node ]] && install -m444 $node $out/share/snmpb/$foo/
|
||||
done
|
||||
done
|
||||
rm $out/share/snmpb/*/Makefile*
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
src = fetchgit {
|
||||
url = "https://git.code.sf.net/p/snmpb/code";
|
||||
rev = "a092855bfd201778f87be578b91aeb062726e329";
|
||||
hash = "sha256-nlS1pqv2ERZGkk0SJ8ByXqBHHho1GTSq/oxrXL2tytM=";
|
||||
};
|
||||
|
||||
patches = [ ./unvendor.patch ];
|
||||
|
||||
buildInputs = [
|
||||
qwt
|
||||
qtbase
|
||||
libtomcrypt
|
||||
libsmi
|
||||
];
|
||||
|
||||
nativeBuildInputs = [
|
||||
wrapQtAppsHook
|
||||
qmake
|
||||
breakpointHook
|
||||
];
|
||||
|
||||
#setSourceRoot = "sourceRoot=$(echo */app)";
|
||||
|
||||
#NIX_DEBUG="7";
|
||||
#installFlags = "INSTALL_PREFIX=$(out) NO_ROOT=1";
|
||||
installPhase = ''
|
||||
popd
|
||||
install -Dm 555 -s app/snmpb $out/bin/snmpb
|
||||
#mkdir -p $out/share/snmpb/{mibs,pibs}
|
||||
#for foo in mibs pibs; do
|
||||
# for file in ${libsmi}/share/$foo/*; do
|
||||
# ln -s $file $out/share/snmpb/$foo/
|
||||
# done
|
||||
#done
|
||||
install -Dm 444 app/snmpb.desktop $out/share/applications
|
||||
install -Dm 444 app/snmpb.xml $out/share/mime/packages
|
||||
install -Dm 444 app/images/snmpb.png $out/share/icons/hicolor/128x128/apps
|
||||
install -Dm 444 app/images/snmpb.png $out/share/pixmaps
|
||||
install -Dm 444 app/images/snmpb.svg $out/share/icons/hicolor/scalable/apps
|
||||
'';
|
||||
postPatch = ''
|
||||
rm -rf libsmi libtomcrypt qwt #ensures un-vendoring worked correctly
|
||||
#smipath_parts=(${libsmi}/share/{mibs,pibs}/*)
|
||||
#smipath=$(IFS=";" ; echo "''${smipath_parts[*]}")
|
||||
substituteInPlace app/preferences.cpp --subst-var smipath
|
||||
substituteInPlace app/*.pro \
|
||||
--subst-var libs \
|
||||
--subst-var include
|
||||
pushd app
|
||||
'';
|
||||
env = {
|
||||
include = "${qwt.dev}/include ${libsmi}/include ${libtomcrypt}/include";
|
||||
libs = "${qwt}/lib/libqwt.so ${libsmi}/lib/libsmi.so ${libtomcrypt}/lib/libtomcrypt.so -lqwt -lsmi -ltomcrypt";
|
||||
inherit (finalAttrs.passthru) smipath;
|
||||
};
|
||||
|
||||
preConfigure = ''
|
||||
qmakeFlags+=( "${finalAttrs.passthru.proFile}" "-o" "${finalAttrs.passthru.makeFile}" )
|
||||
'';
|
||||
makefile = finalAttrs.passthru.makeFile;
|
||||
|
||||
meta = {
|
||||
description = "GUI SNMP browser and MIB editor wrtten with Qt";
|
||||
|
||||
};
|
||||
}
|
||||
)
|
61
packages/snmpb/unvendor.patch
Normal file
61
packages/snmpb/unvendor.patch
Normal file
@@ -0,0 +1,61 @@
|
||||
diff --git a/app/preferences.cpp b/app/preferences.cpp
|
||||
index 29fa8c8..98e842f 100644
|
||||
--- a/app/preferences.cpp
|
||||
+++ b/app/preferences.cpp
|
||||
@@ -22,13 +22,6 @@
|
||||
#include <qfileinfo.h>
|
||||
#include <qtextstream.h>
|
||||
|
||||
-// For DEFAULT_SMIPATH
|
||||
-#ifdef WIN32
|
||||
-#include "../libsmi/win/config.h"
|
||||
-#else
|
||||
-#include "../libsmi/config.h"
|
||||
-#endif
|
||||
-
|
||||
#include "mibmodule.h"
|
||||
#include "preferences.h"
|
||||
|
||||
@@ -288,7 +281,7 @@ void Preferences::MibPathRefresh()
|
||||
void Preferences::MibPathReset()
|
||||
{
|
||||
// "Reset to default" for MIB paths
|
||||
- QStringList defaultpaths = QString(DEFAULT_SMIPATH).split(SMI_PATH_SEPARATOR);
|
||||
+ QStringList defaultpaths = QString("@smipath@").split(SMI_PATH_SEPARATOR);
|
||||
|
||||
QSettings settings;
|
||||
settings.beginWriteArray("mibpaths");
|
||||
diff --git a/app/snmpb.h b/app/snmpb.h
|
||||
index 63f0d6e..c1da1b8 100644
|
||||
--- a/app/snmpb.h
|
||||
+++ b/app/snmpb.h
|
||||
@@ -20,6 +20,7 @@
|
||||
#ifndef SNMPB_H
|
||||
#define SNMPB_H
|
||||
|
||||
+#include <qwt_text.h>
|
||||
#include "ui_mainw.h"
|
||||
|
||||
#define SNMPB_VERSION_STRING "1.0"
|
||||
diff --git a/app/snmpb.pro b/app/snmpb.pro
|
||||
index b6ee631..a5ff14a 100644
|
||||
--- a/app/snmpb.pro
|
||||
+++ b/app/snmpb.pro
|
||||
@@ -83,14 +83,9 @@ FORMS += \
|
||||
INCLUDEPATH += \
|
||||
../snmp++/include \
|
||||
../snmp++/ \
|
||||
- ../libtomcrypt/src/headers \
|
||||
- ../libsmi/lib \
|
||||
- ../qwt/src
|
||||
-LIBS += \
|
||||
- -L../libtomcrypt \
|
||||
- -L../libsmi/lib/.libs \
|
||||
- -L../qwt/lib \
|
||||
- -lsmi -ltomcrypt -lqwt
|
||||
+ @include@
|
||||
+
|
||||
+LIBS += @libs@
|
||||
|
||||
RESOURCES = snmpb.qrc
|
||||
|
@@ -1,6 +1,7 @@
|
||||
dovecot-passwd: ENC[AES256_GCM,data:cZt43pgPNbORpqX6KyXvzVt1Q8tNz1cMF9YVUyL7saZyFqA5XA+uywU5yVerjdsTXfx4QeoYbA+bDE7qwdjTQBpEoEMm99WBb77rac652VGXXCas4nrbwMmZbUY2Z57PKd4GPN/i57VAD6eHiTV8HCd5OwiX7AlpmHXImgL9jr4P9skyTPIEnLF3NUVxktmAjn+X7IwmBH1mtn5Gesc5Q+6hoTQMwLn7ilYWfcOvaf5UOsHS6zvuTlGPuISaLPEvx2CLBccu7I38kKafCLTc1FOhdrFRu2n9/6gD1yIxUnbCkDWpcIV1e/3FlU5aQM7c7duQFVuIW9KpY2U0R2Y5Miv0ciU2D1GaJWMud7S/HCxPrQo=,iv:Arppozvg9+bjNCIJl7kRwbwGm2fuf7CjBfEfDT45+MQ=,tag:+PeAznYRW9S0Ok5uEn/qpQ==,type:str]
|
||||
dovecot-passwd: ENC[AES256_GCM,data:pcj7T1AKqZfMBGiHiihW0WxVKzAiy6xsGGlOhOV4IeHPEn+SXNoQjTQQVhZoNxYsENptH54SgWwlMETCcQrQzq6prrktlT3iZCnwlwvzaNRXrMe1mk/WT+OiTpaQ0PWGfrhVkQXj4bxWKCRc2i3NJxm1AtYfE0nNL/1dUk9rzwYTH6zjiQFYmZHbwzjtxiE3YbZCwYnpNR3Ql08S4kNf5TtsecFtTY1VOPFRycjEfIIIUbVLUM06DZ5savKVNRdgaVMUuXyPoOxy65YbkwZ9vkoBleRShY0v6FOgG1YLmQmr7f8QtiHlFbA0NJ0vUkg8bgSTsw27jC/JQU0qTSNVrMHgzfApw6GUQgGTYZK24tFCVNBJ3sxvTbuVOcShy01yJA==,iv:5gTo8ySgq//ZaY88F7AcAa2CEe2hXR415EqqSsYIbF8=,tag:DOf4yEXW5kzYAL89KQOAdQ==,type:str]
|
||||
dkim_key: ENC[AES256_GCM,data:CZC/1U1cJUIyNhXAWp+YFJd0pZZKvZClJxOh3uZ3YyfEQBiK9nEQryAJHirpFXAmZTcGhsuotkAuJvVQtoh/pM9YGkrncCKlw+P96hiafHGoSOnqd77DazcVERwGEGYBPK7fIZfhpAaYiIvjwq6FbMzkkZ4vLcYRNRj+LCtrXu4K5cy5ZJaRFkLCiaIVHhrOfjyhDFCkFBd3pZ/oCGH57teisjFl+LWFqGOQFyGs3Vkv0bY1fUTUtFvpYcTdrRe6A7yI3OGveX3Q9JnDKD+PBqHhd/a/OjBF0Xme6BeipRnv6/Md2F5LNDfUWugOtDy0xigtWAp/mbVel8GYgTXEQYv+sxVu0kFM7bX8fa/A/BHNx98HFoScwLCt8VmCc26asfGvGFfADrJMBIk2IbmqjQ2NV7/ejB6Zym7tjLLpYI24LBAyZDH/Rtw7CqGPmpHXCQ9xILFxLMdqMSmgPPJtF/75qFICCQH2p3CHj7b/TmTpu8RLIVu2pxG48u4VnUgJE1zPBeaY5EY1uS7L5sF37CI+vMy1mY/3m5ZsWeOu9YigZouYy/Y6OrdtOzaEVaipQ2cYirD00MOYqO57izmjuUdw47OJ5zK7XInR4MHoLX0PfdJiw5Oq8OVir6KJf9UWPSXBbSZlj6PMkqbvQ+7VWJmDT0jKTbRg2M1eZCbcRrJAnE/YenMqYFXiVY1dOGjcrrxUn0zcnJ51UJmfDU2+UQc7urBVtqm7jfegudQ+Em735ynclMfYRWvRXQGQUm2YCUFXTwd6RhY4hHb32j6x00hi6iLjt1gjlMx8pHAcVbqcOdHFoLvNe1DlBsl/7jmL7otyY5m1VF3+H0tksDTSYfil5oudMEECTPypsZfp8iLU4xgjuh/+fXjZf4hQJMiA6OaGMw7R2cwvfiuSaHL/iz57ZtlHFW6TMWK77UBU2xZACVfylnqEaaIgzhYX0/wAsVQI+gqt03EsUx/AqlCFOCrOSwjov06k2bTDzSDcITayLkf9UjwOo/lmRz+7fCfvCaw26wZCEsEtRBfLrZc+Ibwq9uvNDsrV1hthi0qh1ngZonQOA1Y2NURDom3VMKkfu++nFIV+CGrAI5n0CVlVLkJn4RbPCDcmNGd9Kr8pYv7rU4MnMmD2n2M1OzAJbScrbb+f4Z8hEOIUk0dMVxOr/clrg+7F3vqceZC8VTzBbBAH4QuBAf67VwmZTpDB5bobFv/UwEC8pJ4HWmKcBN+s1QihtD7x+WYz+8pSNucr+oN56fiY8xAyvFFyTE7/zNWlXVi94E0is30q3/ZB/Gog5eOQT21tOI4Ak0N4y+ElfNIXSqtEUGhck2DIjfegygpvwiuu8ktEZwje9Q4SAYK8/0THT8ANyzDunwSocMdztL1zF6/ZhDub8hmOuaRJWotXzmL/zCXSGR0nEPXVSmyXKwHt/4MMGkasXOXetrENKIwDqYdm1eZBMCl8EGnyAbAo21LAfVTI0GLrNoFWNTPkpBIo3dKoBofmdRei/jHtQmBtvaILUv6UsIAyjJ+x2cpARW+yMIrv/0g8MnDMj4cCiIFk+AIXI279BvMrkVP1cOA7ESJkLe1hsL6+b7lmrhAWK1cpDnIWTXJG+v9aKlc0jz9D47gr7kD/ePC8sMaI95aQBbA93ftzYhKzsU9hINsU/IKGmT0rXS4j/BPZ0o8uC1HRaMjdE5Z0KHsebS9tn8lXfHFgX5wTDMaES9h+usUJrjc6F1lj2zYP5oTOjM8YmN6YQedo3wmi/PnA/8YMXz0tRFAZvg8VAYYtsfdV/2GLtjfD2YRK3iHsg5+GSEwqFafmWGgr+uhsl4JmKiASWJvx0Ron8RwdEzK2MC6WD1JERLU4UojOfx2xy5v15eveNnEufb7o1MJSAbjuRbVYiABqNFjIwe9hquIyTYVsiqiXi6fLeIV4fsTtiI5LLKx/6dOw31nFg/WfFWzvzLiLJ6b0NZowECP+Rsvzl3U0Qo/LbePyY/o8UYOo7u1zLpzxIOPyTqdKh64WqGYnqXmWy1ga57vnyl9mWhzr9ZlEuhM+0U8bVelIXmLTZp1Nredrs8E5ERdVnKmThbrLr8GvJAl4B7g5BIrGhSBB841wMm9h/SheKdq8SN9gUDRNgW0QNFkflBhX5ZsAHlPiJxddePbbAxfChv+ClG0oDuFDoSwSElCRR9GRayLRiws6CCDhviU8ub5JApSPTI9p/UjSJePSj+GqyqljTge0J/wgxRL2pAHk1HDQyOnv4kFZ5UhMFjU6GvbuPl2W2lqICJOcK9UuKdvivGsYkSSrOfke3mZMh52/f+03ciZ4xlwjDGV91kGONq5GME8dFEPD093xg0KbScfWanRWSoV3fOxitPWpcJ+xuNnDDOHjzLOYgt07u1QQs62rg/6BII+1XKBowLwG9Z5aWexZ3yCzrOR70pLRWPbOJNCAggEIaTkIa0ukOlaPbGzSZ6LuIyup7ex0Uabd2cOuvmAdMqGwnIB7fhtkdR7G4iDbnUqu7hbFurJn/3IZalJvbyZUuvC5X4oGU/CTWzDtdSgv5jQQ9qnr9ehCNCWjdg9T05v65XsW/OwHnRUN8A+1vxBIZ884lvFoOhJYeKXMufdAg4bCzUE/kdctRPwAVt3OjLnykXYcJV/3Ch+YIwv2vNA4pXqsMw8wgxX7DCvrCrVpkZAC1JIE32aKCXrN4tRUMrc0mnqUXa9M1rc6HCGa/vFCMj5ZW8xP9mOG+HEJFiJaV6ydxvhI7NMyXW2YDSxVh5RMMjXHUBq/bKMHPrLN57qmzvtcKUNcmS+VTvjS64wZlUsA1PEVwaJ/EQVAaY6ZeZi0CJ2A3YpklXYJpNqYhv8ICtFK2Uf6STfNYGaLTW2bgfZpWhic1y/V4wAWKa5A/XALXec+ioFr0foQR2ADiUycQYhMLZPSKPnWhcmwUPY+KPrjP11raVSM4ehtKdDlrbL3vmw6SlwowveyC3aqiceYzISWAw9o+ccvLs/bedEBeC2af2V53/vIuN4XYWjtZArRyqpzeeqlnTOb7vhpI84plXJdGHlmw0bml0yV3r3ucgB50wbAMRvQtJQ6ePPfOLOYLpDYFLPZJci8Vc3vRInskPOF39m9tSTT1noUSRZ3IxGi4LiUT76nAgI8BeTp3bqNuA6Of6I4yYS4Jmmby5C5eel0Ozl3gkMk1xuM5UTwcE7EDkr9rnzxs6rbx3CpQB3y6QB3tAe00zPpMm5YKJq1AKqvSzPco58g1vVu06e3l+tcGyt85t5wQTco3OX2kgBBxsiA629yAWcSIqKFZ+o7nTpA+zZmQrjVganWflbOhVNkvRSkLpThkYVlnkqBU9ixzQa79xVOF3WmNYBhdWfnO9VxFwE4MqgpOyL7sz0PsV5/ZsOy8m7DadM3GCS2mFtWZiM1RnGCayZvyY2KFNj3I8qM1HGMMfeF+3KXjyCBSyBkD25in85M0QaPlMzBxFZupSoleJLLwqd4BfsLk+POiZjLQQseSDVSqrjqWyE6d+baiy+m6d+z6sx4ojRf+q9wlMjZ2oRa+wsLnhbCrdHsZi6Q9eZawU6Vlsy3/KjarJABnapJsMbHYTlwPHlPYU6Du9T3lO2aJuTewOzA42Aoqm2Tlm4xh0GRV6Rx7najkMjc3cex1DAu0PNaFzWVBD7yPuv9FS+DzdEneEj9Tx81v245I9U8Oc6yacu72Ry2CG03ONld70oEU2BHrIgswoyMNg72hnhot9jfDutjJrB10b65pP5WZOAUGtwDh2a2KrdnYG/TGId+ehnkkwS2Sd87/CM4aaSYlsVneId6bXYpUcxSLroXUAHsigA3rjMpNpvR8XRiQZUfLWRQ+d8gyL5PVLp1H7R6LEDO4sZP8IuDJfxDzlP0Rh6GOQgu+dlkcxWGVHQxcexBThMURJYVMhTDoYopEfUqo3j+q7Fla4Q3HdypKg17VyVfEA/J7Nie+eDZvTEuvX0jWQmGAFdC9GbkVuT7hlzYx4kZ6/B81kVyQi8e3L3ZBAYHQXbHeK4GhSWQDwHG6ZBU16KrD6dhjIvn4HlXaGYaPMvv0Rp+yjeiur/n0NOWyvx0R1RrksbsyeaLIEDhOS19wXP4kiDrTR2qJN4LHcWu3m/hYuB4Fj72qyr2K7osXvbC/up2bSpY0IOcei8Nc/hIhqoe7uM4Jg3cpXt0hTpcDZ74HNIsd/6f592BqpoXIy5Cr1ZOxmnpkHdgZIyJ3KqwZEhYa7pSkOIIEAY9EnTPm3ViBHQdqjUpghYNzntO8EomNNw0sXUFFrwlGAY+ntLYUty0kREWt4l8Iot+XblCc8FX1gKYSqhnJOGjHHjOHO22Cr6NPJdcHfgkIBCknwwFWWMRPwZOomE=,iv:7LF3l52m6YRKGd/8rxDady3AbSEcXuVRsIaLlgNfKOs=,tag:UCjMRgFZFHQyXY5NfbZRcg==,type:str]
|
||||
dkim_pub: ENC[AES256_GCM,data:XLYRTAviK+r6DnRU4+lc58elI3FJ+FPsB1A5sQOk+pb+fNu7zFCiZdz/MwTVkE9izDP1Onv+VhV8sRgmxacTv4nW5GcukCrm3FmCp2jm6QF1/40/WRv6Lkbek0tV1bMOQPy9Zj8wdO9M05XCXUVXk4x17rj+lw8ApwJS2pJMoultMFx34tx2pNEnmO3MFtuBOxzeU2yP+NhF2sJNA62to78AiH5EblkoF0a6sUYk553U+sv3Ob0lo1nSv6c8zwl7y1WSNQnLK+/3WxSVGfePHVsVM8Zze1KFTVLQQggIzWTdcr7AgcTGbk3kaYCeucfQ60pVlqOyPnkJoUJ8HR1RSajFk6Ylzw0xBpY85qAXNT2YIRiq0HTUc1s5lD0luXLQEP+g+XUwZfzFRZgt1nWBlPmpbj2Ylj1FfrA7EXsIK9nyo+rf0qRn/4HusJATr9ddYmZdxwazl1FXkOKLHPyu1NlzwoTNSQQgMHlzxzUvrrv7+mI2nQvXRx82TSRytqrMvoBTF1NFX+pRjhNg9fcq0oPJ2ORqOVQsxzhLhB+tw7Cg+UHGWlnKnkqaKH1JDmOFyJDB96aPUnSQT2J8qkyb+hMBXz9mme8rZopkHrA4WyDXv3zpEi0P5Sj0DDwdRxKMdDdZ4hw79YQIrd63cIorN8XG6Icevb25LfekLEq/C2FS8+kADagyOM0uzCw2p/qacNz37ZNGqPK6gYkjnyoAfSm14zbgoLX/5dnf7eCuMatevTm4AcE53RawQfzz0YNJuEv5uqD/WUy+UIKHIwxPYY9FWBBPmH+8eaPC1mMPh54I444b39FwpnPU8GwxEPsjRg8TSnohawNmmhEWEpmlawEKw+C+BE6A2DmVJzyeBvVRwe/W6CPgyYxgSGWUuvfZFm1GrzwZDjCOEMRn7qMwMBxh1nr2BOAiNxA38UtsymaZO5ZOknClWlKIkIFl8NJdVITNNsI48KMuSY20o1puzkxMaAUH3OrGEhtoHrEOeIq+KCFzH2gZo6L5hbv9CHM7QgCYsbtVIMwL+cRZZaSNubS3K48OmWJnHNuqkcrSI4lqfjLhz1DbnQ==,iv:/cNMmlpq9LSOk0MwVq8NaWvp47q68lKWTx4s5nkwF5c=,tag:ZNX+yZsSxdhFsavDpX380g==,type:str]
|
||||
relay_creds: ENC[AES256_GCM,data:yWG53NaiA2s5aUudZWecDS1+fOURTHd0D0rNxZ9Tud9TsTO2F/6+5i3vRz/4qP4FoBexEVoW5Xhkqo8o8OaGOpZHh/Nla7TJTnaSCgJw9QPfFoRNiE9f46LytXYThiCGBdy3Z3gtNmSX5BQk1zNI1TiHBFG4IYfauq7e6jJ4Bp/9z3LRknDITdlLjzAPjIO5kUG95IrQQCl3SeAjS+LwxPFRuV1+zWNdOXJLmSeWv1JcAcyhkwutMhQYRGMaS09bbXp29N8DX3lsAK9pYZLr5F3gXwOrZN7nG4+K0KOqfMI4UcLpIOlCPdj9XjgAYcWC+LL5bA0W53e7je3IDVebevDheKPowKK/A6le2TfqXKfhOVi4qXaEsjOBIJzLylOqXoAb1ZCM3nTHCC3M/r3/il+6RnFgISOCHezTiEYM,iv:0kAJzoV/HEIRuEAxzWAaQqwlzWlBSwklipWquF9WeoY=,tag:SCQOQCXm6kmLSYhkT6dubQ==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
@@ -10,50 +11,113 @@ sops:
|
||||
- recipient: age1y4zp4ddq6xyffd8fgmn2jkl78qfh4m94gcls2cu6vvjnwwznx5uqywjekm
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3S0FqZWxDYmxHYU5FZVQz
|
||||
V2FZMFFSVXJubVRaNDZORDJPSXhHMnludmpRCjJrendscEdqU0p6K1R6eE9FUGtj
|
||||
RVB4Z3dlNHlBSHRhZ0ZMODdDRkN6ZFEKLS0tIFlzUStVWmhlYWExV1JscHE0KzhG
|
||||
Vm1uUmhQRzAvL1YzTWVVbllRUlE2Z0EKwg6SBat+CG8E7/j7K0sakqGSyJYNzXqt
|
||||
b0DMsGq9GnHE1Ph6gGVVWO+pos/FGuunSDyL0lcXk9xJE02FErnw+w==
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZREpDaXVwSjBPZEtaUFU1
|
||||
d1FTYnV1STlUdW5oeis4RStVckcvUFhPcndRCnNUdndTenhxN1M1STNlZmtqcWtI
|
||||
amkxZitGZ2p1ZlNTRFVaYkNvWWdnRkUKLS0tIExLYm5PYVI4aFViaER2L1dUOGMy
|
||||
d05BTDlqanFMQ1hjazRLUUVlaXpHL2cK+kXvv9khiwYlBK+lmqgYmHNNjMXHU5FZ
|
||||
x5dpXndIiTRJ0cGtEgK78efbQmVNsHAae2X0E0IxbvrSe26S5PIbMQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1g9sh8u6s344569d3cg8h30g9h7thld5pexcwzc4549jc84jvceqqjt9cfh
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwNVl3ZTNGWGdMT280MnhQ
|
||||
R2RHTGRWVFpjMWltMDVIWk1YSUc2eEhjbWwwCnNiTjA4dUZuOU1tNTZtd240VXpU
|
||||
c0FKY3VoR1dYUVo1MDZjMEJ5MmhjeEEKLS0tIGhuT3k2VlFpTWpJdFJYM0JhZWtS
|
||||
dzNFb0FDcERGTFVUOTgxN3czTmRUME0KihoqiXkph3sNWTwn6tFi29z9jnht6JRT
|
||||
zOMNiaWjMHQ7GiR+Yv1JMWrEvKRrEjNaFXt89z0Ebx4llTtyH8W2fw==
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBONXlpMm5KTmZuKysybU0z
|
||||
OUJCMmdrZ0V4amI4NTNtOEFqSXVtbW92cjFVCmlCZGF4bXMycXhJS3h6OWVpV000
|
||||
SjZuQUFxelVpT3BXOVh5eU1vYnNKMjAKLS0tIG1KYjZJU1dMd1Y3bmxWaDhOSEJn
|
||||
SUp1akQ2bUU0VmQvVkhheXZ4Zk5jWVkKqJ12/g0H8l6WwpiHxA0K3g3Ry4dpPb/h
|
||||
2m84IYzpQA28BRCSHeIEeH1hQ1jU33/625XlNE1iJncPqu9YH5mXug==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1t5s3txyj403rfecdhq5q2z3cnavy6m543gzyhkl2nu5t8fz0zctqtvm2tj
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzWE91QUFmTzdEUjJ3TTFX
|
||||
Y2o0Yy9BZjdkc2VVcis4a3FlcDVScDF5eGwwCkZocDFIN3B5dHdNTDNaVXI2WHBF
|
||||
dDVXMDdvOXVBM3V1NW01YngzclJ1RXMKLS0tIDV5M2JURHkvWWFlbGtUNEhxZ2ZE
|
||||
RVlDMDgvNVFOamlFR1BZMUtrMzJ4N1UK6r7QbX3nEBu+S8e7oqCk3ys6hqXHkyW4
|
||||
z4hWz1rr/23JpGR2ENRS+DpHRCRo4KKRhUx2hLc6C2XijNgD4YsUCA==
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLM3NCcGVPTS9hWHQvMCsv
|
||||
RlJ5M0tVQWZIUm1tWSt2NlFVRGtHaTN1Rmd3CndVUHpEcU15S2lmbHpIY0h6WW1B
|
||||
aEpRZVgzN0puRmlMNWNQNW94TXh6UUkKLS0tIEVXSVVVL2JaMGRFcldoVnZ1TFZz
|
||||
bzJ3UGl1aGpsa0FGSVkzeGRHZDJWdmMKZgg4UtokzNDBuVZYoyYirTI1NEC3QGmm
|
||||
ilOukMvpTZFYtKbwWVOuB8kyeudlkupavzlnHYAGBbpMVccpPeZHAw==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1dzdf4rgep3ctk3dnrmrqtdgrchaa8nszfc4dp29gqwsst3z6jyrq57vfsj
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqelVSdDFFcVZxODBiVkEv
|
||||
QUhYUzM5SDZLVWQ4YlB2UGorZWlidUhIa1N3Ck96TXFGTXBtSVFLdFY1b3BKK3g5
|
||||
ejZFTkZOTDdqdHFsWmRKNEcyaUZZWW8KLS0tIDJtL2JaRE5XaHNvYW9HMFYrbTFP
|
||||
NUFlUTVvQVdiTlBZOVZqSjA1ODNhUHcK8hnqUuHjUgjF8nbZgY4BTkk58BbRCYWV
|
||||
NOPw/jUdEZBRoTJqoEdOLAtW/x1h7Xo+mpVuDW0K7h07LiaU7FL8xQ==
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOZ0tyczJoVzZxUmhIZG14
|
||||
WDZjSlM0Q2F6VE9Yb1hRV0d5dGVoVmErVkJFCi9HbXdxZE9NZ0pLaFo1Nlk5QjRV
|
||||
TSsrMlFqV2Z0OVlWVjRnYXpyTlNWdUUKLS0tIGZ5M2ZEWFR0NDNQUFQxMW1tTXlP
|
||||
dDRaYnFZajR2S3ZoZ1FFWURYVFVpSFkK8YuczSfs+j3dL1OT4sr2/kfdAxPRstJj
|
||||
SeDlvg4C0e2wKrqj0QwjN5oz8t21ELerXska7yZ3cod5gaQcFxB44w==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age197a33mlf5294amjx59hycctu6wm4l3cu3w7n9rv3fs9340ql64rqjzpr7s
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBNWlKeHh6UjNIRTAycEJ1
|
||||
UVhJMi9CUVBsVld3YlBEYjVwaWE0T2V0cFJzCnpEb2ZxNkNwMDBDQ3JsQXVjY1lS
|
||||
eFhqSkcvenkvOHNOclI3dkc5NytmQjAKLS0tIHkrc3ZEQjhJVVZlZWVJMVE0b0x5
|
||||
QkxVMkhOK2hUS0lQVGlXYXUrVm1LVFkKyFIvkGHeykZBib8gNln1mEHtU5+Xr9rC
|
||||
RpphkvAU9AA4J5/LXQs3To/WzTg9gt2fSxtrwk9TLheheRfUcHDuRQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1sqj8z3feqm2dk3gj8mxpfn5dpqnsmus862e8ayd0d4cdresqffdswcf9ru
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6aENxNUpXUUxTcEZobkpW
|
||||
SFo1UWlUSXRWbzF2bWp6WU9Idi93OWQvdGl3Ck1rdlNYZFR5dThKa3NaVFU4NWY4
|
||||
dTdUNUdEQ1hkWkRsT0dNbVVqMytnTXcKLS0tIExXZlgydnhXTktyeDNrZmg0RFlt
|
||||
QXAzNGk3MmRCSng2SlN5bGdiSTlJRTQKXy5hTxS47WVjw1ILaaNfMaW7YMIS3FGP
|
||||
hvYeGGL2WHstUapyYb/Rgn46KJgk1gfDchYyHq+06SkpZRaUzCBDUw==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1rz75dqzfd6gulwh270ukmt5amcau6j8dpxgzx8fm6u8sjkyx9usq69y4s2
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUYWl1NUQzMElhbFBrbVBu
|
||||
eURzOGFJSW85dFMzLzR4M3UvOVhQUGYvS0ZRCm1qYXJTUnpUcUVWUTFtRWQ2OHBO
|
||||
UVg2UC9OSDJkL21vV3VNV0l1Z3ZHcHcKLS0tIDhVaGpFZ1djSnFaRnVKckxtQU0z
|
||||
YlAyNGxsYno2U1NIMDVtVXJwcFA0ZWsKdNW5iANSWOGdSRYeBf/+/gtk7b+IN/ir
|
||||
lo1HtaIT1a5tA28JfAo6ixIKdF5nnSIunM6Z0JlF9zKuJbBOmdVbHw==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age148huz6rc3q9xx5t873ncx75sja2sazlescwspxl7lsmxsqkz0apsy8cldp
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIWDd5Yk1pNGZ0UHRrc3lu
|
||||
WWlPZTd5bFIvNVBqTWplR3NzdS8rQ0gyZVdVCkUvMEg5eWxCWHNyYTcvMFd6ek9y
|
||||
Z0RudTRHanlTTVhYZDBuMkpsYTcwWjAKLS0tIGtDemJabDRVakJxMUdVUWQ2VjIv
|
||||
NTBabFVLNENzWlNoUmZSUXU2eEJtdEEKuOXBlsIBsgjQvRZ4fKdoLfs1gqZYa4og
|
||||
9o/mo+ciXYU3xPPOhnd/OTar/8pBpCBBCO0Ag+1Me/dVYbA0s8Jvvw==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1ck6lhd8thjcrdcnkn2epc8npztg0sfswahunjkwcf57rr0xaevys8fh0x6
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCUnNZSEtpb0JVOTVjazFB
|
||||
NHdXSnVxRm4vaXN6VE5leGU1Z1JGOHFEUUNVCnNwdUxweTVlanR2ODdvTzlDWkZR
|
||||
NWVsY0k3WmFOWktsUVJGT1p6QUlKbGsKLS0tIEtnRVdxeWVYd29XZHVQWmZCNnhE
|
||||
OElkbHNtUG1ncXdQWEpOcDNMeUg1d0EKF9OjITJDrkfZA2wI6Gm+0+MTDw4OPkQt
|
||||
SDbNe5Gllo8BC1jTRM3H+uxsQ5L0TRrwnrSxNYjNdDIRHMrIxi3qcg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age13j6l33g0ghk4vezn0qwfal2qmcgqwkv89ejwezpe3n47mw8yxyuslj6y7d
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqVk12WUxKdWdDVWRCU1dk
|
||||
VkhNZWhNeWJ6OWJJaWdXNFZwRlZMT0lOTFdJClRyYkQvank0cGlZSzJGaE1LVVpO
|
||||
VURjMnBIY3VvMkVnbzlJVGF0dU1FR2MKLS0tIHZlV0U4azN4aEVRU1YzWDN6U3Nz
|
||||
YlIzbFBDd1pqMTVQa0diYnZjRmRRa2MKcPAvAB0B/zNj+mcavMkJdksWl8o1j8oQ
|
||||
gGG8xdIEPT9wjfbL75IvHOy/7TKJR0uVomD8IB4QuVi1MxJh6jNJQw==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age13x0f3glnz4jvqty2v92cxrrnjcna6ed4qegrhulw9jjy08zuy3aqzvrfc6
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpbmxpNlZvV2JWYmRJS3lq
|
||||
Um5GVDQ0ampMTDdzZHB1RFFqZ012bFZMd3g4CjdoMzdOUXhtSEF4Tjk1UTJlNGNG
|
||||
TzAwSDAvK3VCL3ZheW1HOHFCclU0OEkKLS0tIDY5anhYeTQ5RGxNUlZNRXg5Rm1o
|
||||
QVk5dm5RaWpocUZrWk02Slg3N2lONjAKxWKAmAHt9x2T/9bh2mnQIF03ufffO9wF
|
||||
79jffMh/3GyX5Pk0IbjMWwOn7ahQWOEgD58C1Lja2wpixLdwb0wgfA==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1hkve3khk7fthyrwxjqdf4r37lrqpmnkz6mke7psuphvu2ykynqaq9g6ja5
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3UDNVSG9Fb01YSWJTdXRD
|
||||
UFB1dWhpRUFhWmMwTzdHeTNRdlg2YXd1ZnlnCndBRXBpMTJWdFRsMVNYeDBBY2g2
|
||||
ZEZKTEw4dHpHSlFNT1BsSXQvaCs4MDQKLS0tIDg3YUlJYU1nUjRTTGtIeTJBVEhR
|
||||
SjZLWG4xNmxoSmtaTFZweEd3TDJ2QUkKcI4MdgglGFJT58ugHebiE6YQUehEomnH
|
||||
qPZdH0SZAtJxBPqt78wJqvndR5INt5HBmLtXMDLLEk8o43lqfIkK5Q==
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhcUJUTFRrZmxiN1MrZkZB
|
||||
V2FjSlM5ZUxyUFZMKzRoYzY1M0plcmhjckJ3CjBhY0VRT2VMRUR2N01YZWZVRkJk
|
||||
VEdqSTNvLzNBOElZVVUxZ0VBekx6RnMKLS0tIHNtVlA4V1R2bkFBaVJMYkk3eUNm
|
||||
TjhQY0VoNU91Zi96VzZGaitsWHptT0UKZ3Vx/iqilkHrFkAbaSeJZNmSOzXvMDX6
|
||||
HhcXrrq+sVjnq0XhOqWVY72h8Hp3d0JWA9VOxNQRyM9hdVENXur8YA==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2024-03-21T22:00:22Z"
|
||||
mac: ENC[AES256_GCM,data:wnRif4PVGh1P29ZXv1XPF4GdFFhrsRkYmdlun4WsLDFs0Y3xIjPQRScAbDzPnhY6vaiGKZfx0+RZHHMMFyVCz4bmo85MzGuF9H2QECBfWBNgCNCKXqz7pLQHA4c0u9jiatuc9PVc42RokJ+rITn1cWV9tLGot98ealpYkJbN91w=,iv:EL2Y5WZtWB6IRwnrGmWV5QO3XiPOB8IJkATbZTY1/oY=,tag:/z3ULuFshOw/ed+G3W8OmQ==,type:str]
|
||||
lastmodified: "2024-07-10T20:44:49Z"
|
||||
mac: ENC[AES256_GCM,data:tSTKCP7HUUCSCrbeiLutPghjfbL9TsxuCmbARUqwQBH8pyeOsyFHyPCqmqjCDSu2ha0QTldNGM9baiIQa/05DV5KNmFfVuoWy6dd4/3L5yNd3FPkzR2SvBua1g09YZpC1G2IaGrOcqBEOY9baILeBGgXfxRtcpMVAR2C3bOqJyQ=,iv:4phBdZ/4u5DAbUn4Z7pdrJym+iG9oxZSsIPZqoDEqco=,tag:RJn0416yl+0FV9bTu5tA5w==,type:str]
|
||||
pgp: []
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.8.1
|
||||
|
120
secrets/triple-dezert/main.yaml
Normal file
120
secrets/triple-dezert/main.yaml
Normal file
@@ -0,0 +1,120 @@
|
||||
wireguard_key: ENC[AES256_GCM,data:Ioqe0/obRUgMNJsM/R92HB+OMsyRbQxvzjI7we6X4gOw7B+QlsP3ofAd4HI=,iv:tcw8FSYKh3yIKDivM7TRD832KiFFbr2NA9UrUjo74D4=,tag:st6P6iYXxg4aPO7a2g9gIQ==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
azure_kv: []
|
||||
hc_vault: []
|
||||
age:
|
||||
- recipient: age1y4zp4ddq6xyffd8fgmn2jkl78qfh4m94gcls2cu6vvjnwwznx5uqywjekm
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmZGlscG0ySERXNU44cWFu
|
||||
a2NYL1NGMjlNeUVpbTZkWWVFRk5aMUVGTGxVCm50ditHM3JHUnBzTWxvVnRvblhq
|
||||
YjhQQWZOeXIwUUxEeVlhVlJyM1I3c0UKLS0tIEVHcDFTa0c0YUd2OEcxSG5Pd3V3
|
||||
Sm45MXdxbDlnME00OU14NWROQkIzbkUKa047XyOqiwi/x8pf2zOk1j3jBCxGdU2e
|
||||
vL1csTIcipPN1RVdoauCzQd5KPTsRXUarD44eHVIz1VS8WZZuXoOfw==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1g9sh8u6s344569d3cg8h30g9h7thld5pexcwzc4549jc84jvceqqjt9cfh
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBReXh1SW1SUVJBaGowTjhp
|
||||
NnE1NHZzeE1KUGFJSWs5a085NW9MT0JZYUVBCktxMWlHeEN1SDJISEFqM1prSEdY
|
||||
cTFSMFVVNDRQMGd2TkhMcWoySDJ6OWsKLS0tIGl4eXdFR1dBVWMyeWVsVHlaWlZU
|
||||
OG95ZUV0M0g2YlBpY2pnT3FRczhtUFEKaOMBpksiSZx4QD8WbwuHEvPV4QkOKriG
|
||||
MIMxbs6C5aAmvS9PwbBwpYCntI+tnuZyvKU+rFzxs4yQO8Al+hf/XA==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1t5s3txyj403rfecdhq5q2z3cnavy6m543gzyhkl2nu5t8fz0zctqtvm2tj
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0UkFQSXROaGpONGNYbCtD
|
||||
NzBVcjY0SHVQS0FUaWFZYUFSR1luRWpaY3gwCmI0N3FpbGNReGRQTVMzMmtOTGdS
|
||||
MFFLbnhwWUdueHFUUVBDbVREL3JYZ0UKLS0tIG4zK3dHejBWeDljckp6ZlVVeXpp
|
||||
TjZIZTllaEJDQ3hGcTFoMm1LYzh1bG8KLs2VVtIaM6iLON8HYpR+YUKFZe2MKYZH
|
||||
z4pIVN1LGu5pQ3woN341FD7U4ewhMFkDy/LveQ6Q99VjnyTmeHEhlg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1dzdf4rgep3ctk3dnrmrqtdgrchaa8nszfc4dp29gqwsst3z6jyrq57vfsj
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhUXVZQjdEZWxzemdmTTVF
|
||||
cVhvYzJFbWkvdERLdjJBblpWUHJXdmpzS1RzCkdlNXpxYm1DWTUxZVVHcmtmT2Zx
|
||||
cUZlSXoyOWMzSnhzOStmbHA4YlJBcGMKLS0tIDhqSG0rUWRKMzJISjlWSzRoVDQ3
|
||||
NjJwbUlaK0JoMi9kU0FyM3NGUEVzazQKXzxR+hFpk8zQD7OMvf6ub7OG4BXsLRXJ
|
||||
aHXwbu0DcEvBm66CDDkmvAJVrZ+dntyWt9CRD7WRgJ1C36qq8l2eMQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age197a33mlf5294amjx59hycctu6wm4l3cu3w7n9rv3fs9340ql64rqjzpr7s
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyaDdBZytQc1ZHU2drVmdQ
|
||||
c25kbmhEajlQOVB0dEZHK3FFV2lIL1E4R0VvCjdoK2NaNlE4aVZPOFNQbWxxNjBv
|
||||
b3diWFJ3c0g0cnN0aWFPODlHVExiejgKLS0tIEwvMlR0aG94QWRsazEwTm9xdFM2
|
||||
ZDExY3UwRzcrNCtybFJUbW5Ga3JkcmMK2U2GtnIfUHTpqW2nikOVqCMjynLiRyv+
|
||||
qFu5i7gpf/O5pzEOoTOO6ezFwY4WbnUJydbjAEFQ8Zymr1cWaR5g5Q==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1sqj8z3feqm2dk3gj8mxpfn5dpqnsmus862e8ayd0d4cdresqffdswcf9ru
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxUE8yRzNCbnhGQ2FXTWJS
|
||||
M2M0cDl5R2NxT1ZKNXMwaHlDdUorbmRtWGdzCmdocnh2a29LczZ5czhUTHJpYlVE
|
||||
NkFOUE50SGZMZXFjRXZueEk3bnpzNXcKLS0tIDBvZkNyWHdMNzVkbzZRK212VW1M
|
||||
WkFXaGZEOGdsbjN4UnNUYVZ0MTdNN0EKPMY1BU1RpECDLvGY0TJKtTdXuRX8HTtW
|
||||
i+VTbWFsw92itL5Sjy3dAYBECpopQWQRNFz9WYH8LpfUOO9jhAGNyQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1rz75dqzfd6gulwh270ukmt5amcau6j8dpxgzx8fm6u8sjkyx9usq69y4s2
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArd1hwM2FQUUZkMDZIcS9G
|
||||
UGVESCs5UzhYaTFXMkxaWTdYdGFEMnZVZFNzCm1ubXF2Ulpkek0zVytkRU9KOGZF
|
||||
Qzc1M0lpN0ZyVE5tZWZHOTRhYk8yZjAKLS0tIFFMMWU0MzFSNVBxbS9JL2RlS0xm
|
||||
Y01DWlBqVW9UbGI0bnR3Z0dnOHpDM28KzmIZ130SqrzrDHt/T7EuRcrhDudxkaWg
|
||||
uOquZK6CmGhI0ZvLWwpCvANj6drTL7c+aVcATxOsrOp1FNi4c5jzoA==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age148huz6rc3q9xx5t873ncx75sja2sazlescwspxl7lsmxsqkz0apsy8cldp
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBncjBwUUl6blJTTXBNRHpo
|
||||
U1VKYlV5OS9SWkN2UlpQUGdFZWU5OG5KT1ZrCnpkeXA2WnlrSm0zQUJJVFRuNXY5
|
||||
SFFiMnp3alJxOCtRQTdpM0JGb0s2cGsKLS0tIDFHVFhXb211ZXVHNUgrYkJQTTdY
|
||||
elZzWGVLamN5dVVBQmhURGdVdWhxQ2MKbeFLihAg/OfeAiEgtCL+FBBGrzwNIijS
|
||||
oNAjQiMN+g2+5P1Z6J9KN+zU3tVPeHk2vSTceZQA2kbRdOOZUYsunA==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1ck6lhd8thjcrdcnkn2epc8npztg0sfswahunjkwcf57rr0xaevys8fh0x6
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHQk8xVnVxaVNPTXdWOGl4
|
||||
N2hLdFpNMDlPQUF1bXU0eXFBRDFKVEZ3bERRCkNWektSK3kzOGdIQjF3K0xUc08x
|
||||
MHRkUUx1U0hBUmhoSUprUWNsd3BNUHMKLS0tIE9scFhHcWtNM0I1M05jVEh4OE92
|
||||
R1BYdGRqemNLRHhsK1NtM3JIempuUzQKWwGrRKR3rtynmqqYgvQiyg3YZhpppfmS
|
||||
7e5YYCGTcrKgexXF1NYpsHqx3Fu4g1l2a1axmBKEmSkadxh/q+yeiQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age13j6l33g0ghk4vezn0qwfal2qmcgqwkv89ejwezpe3n47mw8yxyuslj6y7d
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByUEpaUnloOHEwaXoxMGpy
|
||||
Z0s2YUlRQUMrQ0FYREFzL2hqbWZiSFpPMUFFCk1pT2ZKczNCRjRnelpFKy9GTGgv
|
||||
MFZIdTFtbjVQdEc2QnRKZkhWMmI4TDgKLS0tIGlTWU9CM1E2aXoxOUFDSWtmQTF0
|
||||
RTFQZ3VWejFKcFZwcHo2NDh0Zlh6NTgKCVV5rjpJYzO/l3Ys0N765CIUaUMwqlv2
|
||||
7DGu9Wrn+Hlgeu3hxggau1tOBBYWIMywjn/aEM/dK6mrZGgkiddoOg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age13x0f3glnz4jvqty2v92cxrrnjcna6ed4qegrhulw9jjy08zuy3aqzvrfc6
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBya1c5ay80d1ZhRVZHc0Mw
|
||||
K25oWjFrNGVhSFFKdEJ0VW8vaEEvUG1rbW00CmUrL1FsYUdBa2lEd2liakREaE1X
|
||||
YkcrNC9OdkJEM2VLU3ZNNmdkQmlsYkEKLS0tIDNlbXJsNnhEZEw4bWticE1JTlZO
|
||||
MEhjMTRyN1BnODN2UGNnN3lhdzROSFUK7XPx0X7GDM5IHFjQ0L8gxKBRoSouwPND
|
||||
rgrz/a3Wm0dJhZ/dmGVM0SK0E2etAif/odNZdzydQphU9jfOd8DQ2A==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age10lv32k2guszr5y69sez3z5xj92wzmdxvfejd6hm8xr0pmclw2cvq0hk6pe
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4UHpKN2dMTUNBL3BVZlRC
|
||||
cUM2ZkMzK1drbTdZbUJwN3I3Vk5CdGxUQ2pJCkVCZ2hqLzN0OFBGSWIzcXMwbGdW
|
||||
OVRibnpiSkFWcWtyNlBGSnYrOW90Nk0KLS0tIDFObnRuV1NwYWVTL2xqakVISExW
|
||||
M3poNGc3TU1lQVBkWXVkUXpWMnpCZ2cKdtJQTIXfjb7KS4Twsv3+ecZdMl0uw8Bo
|
||||
IlzM681gtSJzv9ONW5dyjUb/MxqhOkaMTnh7fV0bnCOo9Q7YBNg6Gw==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2024-09-12T00:54:14Z"
|
||||
mac: ENC[AES256_GCM,data:oUKTbXa8vaQKWiySoNNRp5wbSJXRYXzrwoWSc8u9Hg8fmala6YIYj1+rb/YkS+DFzsT8/C6XqD1XYMpFgiJJLtZ4aa3LbuHqKw/pESqgKhsssT/wvnV7svgmlUXJhTtKY1wWcF5nE++nOLDMmyaIzfCkBPnX1OmbSZiveEDBDgI=,iv:S6UAXB0bNEcZv1Sb76oWQCcRMnDt5MRsFFG9/zZWf7g=,tag:2tdlnyF1SsPyQAcuD9McEg==,type:str]
|
||||
pgp: []
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.8.1
|
207
tests/liam.nix
207
tests/liam.nix
@@ -1,46 +1,167 @@
|
||||
{ pkgs, nodes, ... }: {
|
||||
{
|
||||
pkgs,
|
||||
nodes,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
certs = import ../deterministic-certs.nix { nixpkgs = pkgs; };
|
||||
relayDomain = "relay.test.example.com";
|
||||
rootCA = certs.selfSigned "liam-test" {
|
||||
ca = true;
|
||||
cert_signing_key = true;
|
||||
cn = "Liam test CA";
|
||||
};
|
||||
relayCert = certs.caSigned "liam-relay" rootCA {
|
||||
ca = false;
|
||||
signing_key = true;
|
||||
encryption_key = true;
|
||||
data_encipherment = true;
|
||||
tls_www_client = true;
|
||||
tls_www_server = true;
|
||||
cn = relayDomain;
|
||||
dns_name = relayDomain;
|
||||
};
|
||||
relayUser = "foobar@shelvacu.com";
|
||||
relayPass = "asdfghjkl";
|
||||
relayPassFile = pkgs.writeText "relay-password-file" "${relayUser}:${relayPass}";
|
||||
|
||||
testAgeSecret = "AGE-SECRET-KEY-1QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQPQQ94XCHF";
|
||||
testAgeSecretFile = pkgs.writeText "test-age-key" testAgeSecret;
|
||||
|
||||
sopsTestSecrets = {
|
||||
"dovecot-passwd" =
|
||||
(lib.concatStringsSep "\n" (
|
||||
map (name: "${name}:{plain}${name}::::::") [
|
||||
"shelvacu"
|
||||
"julie"
|
||||
]
|
||||
))
|
||||
+ "\nbackup:::::::";
|
||||
dkim_key = ''
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBANn62hMdcFw4znAB
|
||||
CKth6N4JD8XrNezCYbvyrUcVpGkkMX3TC9sEyZgGV6Y2Cs/J2Q6jKakC47nXebzV
|
||||
Edk/kWsApj4J7PQl4t/G3vf1rdfICQx1pIspsmqQKsYugUG18EugEZzelai3+n4U
|
||||
wqsed4551aRtwaws8dJQePOEEq1BAgMBAAECgYEAummKgXpVkqiJ8sMPlPEgYnHB
|
||||
aXLjJNx/FGpOwVHCzp/DK2WG6ADKHhaecmgZCuYFmDz07bKo6U9arqBQqUdxpUor
|
||||
JT2SS9RFP5MTsTB6R+eRqX8oMRQhcXB/+MczoSV/087vIZsL3L//6XoGyvjuHKW/
|
||||
bvUR/F8PhB84uPU6RLkCQQDzXXj80iRhY6jHDwqoGf3BXd4O4cIAzPbBXN0W41fV
|
||||
L5ZBm0K0KAgLnyjVygbsSn6lXsZXzAa/wAbSstMeCn7PAkEA5Uv88nfZSLU99XvF
|
||||
WB9GD7lKXsAnWlf09F8hH4a1TH/zfGUCxrDdYNmdBdG6t0XuIVjay3TZcpW68Z2Q
|
||||
lLeW7wJACj7KJCKYo3z1kwPAGBmYBDb2bTv11eDLFpLZP+hsPy5UrghiQ4FX7V1S
|
||||
88Ugi3wLXtzhjrqpIhNsdhxPJPmeIwJAVpx8YE4a+hbT340v/thZS4ku6Vllw/9j
|
||||
XIcuaM0mYE4Yd81j3g9in7mzUUZmY+H7UAdTJfTuShT6t1dQDIzIawJBAIJ+azsj
|
||||
H5M2KsE3Nuxe3RODM/D4I5M5dngTkgNZQvUAywAyj9U39ZeFPEyXJyGkKNoR2CXB
|
||||
hCvgabgr0wsi1y0=
|
||||
-----END PRIVATE KEY-----
|
||||
'';
|
||||
relay_creds = "[${relayDomain}]:587 ${relayUser}:${relayPass}";
|
||||
};
|
||||
sopsTestSecretsYaml = pkgs.writeText "test-secrets-plain.json.yaml" (
|
||||
builtins.toJSON sopsTestSecrets
|
||||
);
|
||||
sopsTestSecretsFolder = pkgs.runCommand "test-secrets-encrypted" { } ''
|
||||
mkdir -p $out/liam
|
||||
SOPS_AGE_KEY="${testAgeSecret}" ${pkgs.sops}/bin/sops --verbose -e --age "$(echo "${testAgeSecret}" | ${pkgs.age}/bin/age-keygen -y)" ${sopsTestSecretsYaml} --output-type yaml > $out/liam/main.yaml
|
||||
'';
|
||||
in
|
||||
{
|
||||
name = "liam-receives-mail";
|
||||
|
||||
nodes.ns = { lib, nodes, ... }: let
|
||||
nodes.ns =
|
||||
{ lib, nodes, ... }:
|
||||
let
|
||||
liam_config = nodes.liam;
|
||||
in {
|
||||
in
|
||||
{
|
||||
networking.firewall.allowedUDPPorts = [ 53 ];
|
||||
services.bind.enable = true;
|
||||
services.bind.extraOptions = "empty-zones-enable no;";
|
||||
services.bind.zones = [{
|
||||
services.bind.zones = [
|
||||
{
|
||||
name = ".";
|
||||
master = true;
|
||||
file = pkgs.writeText "root.zone" ''
|
||||
$TTL 3600
|
||||
. IN SOA ns. ns. ( 1 8 2 4 1 )
|
||||
. IN SOA ns. fake-hostmaster.example.com. ( 1 1 1 1 1 )
|
||||
. IN NS ns.
|
||||
${lib.concatMapStringsSep "\n"
|
||||
(node: "${node.networking.hostName}. IN A ${node.networking.primaryIPAddress}")
|
||||
(builtins.attrValues nodes)
|
||||
}
|
||||
${lib.concatMapStringsSep "\n"
|
||||
(d: ''
|
||||
${relayDomain}. IN A ${nodes.relay.networking.primaryIPAddress}
|
||||
${lib.concatMapStringsSep "\n" (
|
||||
node: "${node.networking.hostName}. IN A ${node.networking.primaryIPAddress}"
|
||||
) (builtins.attrValues nodes)}
|
||||
${lib.concatMapStringsSep "\n" (d: ''
|
||||
${d}. IN A ${nodes.liam.networking.primaryIPAddress}
|
||||
${d}. IN MX ${nodes.liam.networking.primaryIPAddress} 0
|
||||
${d}. IN MX 0 ${d}.
|
||||
${d}. IN TXT ( "v=spf1 mx -all" ) ;
|
||||
${liam_config.services.opendkim.selector}._domainkey.${d}. IN TXT ( "v=DKIM1; k=rsa; "
|
||||
"p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDZ+toTHXBcOM5wAQirYejeCQ/F6zXswmG78q1HFaRpJDF90wvbBMmYBlemNgrPydkOoympAuO513m81RHZP5FrAKY+Cez
|
||||
0JeLfxt739a3XyAkMdaSLKbJqkCrGLoFBtfBLoBGc3pWot/p+FMKrHneOedWkbcGsLPHSUHjzhBKtQQIDAQAB" ) '')
|
||||
liam_config.vacu.liam.domains
|
||||
}
|
||||
"p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDZ+toTHXBcOM5wAQirYejeCQ/F6zXswmG78q1HFaRpJDF90wvbBMmYBlemNgrPydkOoympAuO513m81RHZP5FrAKY+Cez0JeLfxt739a3XyAkMdaSLKbJqkCrGLoFBtfBLoBGc3pWot/p+FMKrHneOedWkbcGsLPHSUHjzhBKtQQIDAQAB" )
|
||||
'') liam_config.vacu.liam.domains}
|
||||
'';
|
||||
}];
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
nodes.liam = { lib, ... }: {
|
||||
nodes.relay =
|
||||
{
|
||||
lib,
|
||||
pkgs,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
let
|
||||
mailpit = pkgs.mailpit;
|
||||
dir = "/var/lib/mailpit";
|
||||
in
|
||||
{
|
||||
networking.firewall.enable = false;
|
||||
users.groups.mailpit = { };
|
||||
users.users.mailpit = {
|
||||
isSystemUser = true;
|
||||
home = dir;
|
||||
createHome = true;
|
||||
group = config.users.groups.mailpit.name;
|
||||
};
|
||||
systemd.services.mailpit = {
|
||||
environment = {
|
||||
MP_DATABASE = "${dir}/mailpit.db";
|
||||
MP_SMTP_TLS_CERT = relayCert.certificatePath;
|
||||
MP_SMTP_TLS_KEY = relayCert.privateKeyPath;
|
||||
MP_SMTP_REQUIRE_STARTTLS = "true";
|
||||
MP_SMTP_BIND_ADDR = "0.0.0.0:587";
|
||||
MP_SMTP_AUTH_FILE = "${relayPassFile}";
|
||||
MP_UI_BIND_ADDR = "0.0.0.0:8025";
|
||||
};
|
||||
serviceConfig.ExecStart = "${mailpit}/bin/mailpit";
|
||||
# serviceConfig.Restart = "always";
|
||||
serviceConfig.User = config.users.users.mailpit.name;
|
||||
serviceConfig.Group = config.users.groups.mailpit.name;
|
||||
serviceConfig.AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
};
|
||||
};
|
||||
|
||||
nodes.liam =
|
||||
{ lib, ... }:
|
||||
{
|
||||
imports = [ ../liam ];
|
||||
vacu.underTest = true;
|
||||
#systemd.tmpfiles.settings."69-whatever"."/run/secretKey".L.argument = "${testAgeSecretFile}";
|
||||
systemd.services."acme-liam.dis8.net".enable = lib.mkForce false;
|
||||
systemd.timers."acme-liam.dis8.net".enable = lib.mkForce false;
|
||||
systemd.services."acme-selfsigned-liam.dis8.net".wantedBy = [ "postfix.service" "dovecot2.service" ];
|
||||
systemd.services."acme-selfsigned-liam.dis8.net".before = [ "postfix.service" "dovecot2.service" ];
|
||||
# sops = lib.mkForce {};
|
||||
vacu.secretsFolder = ./test_secrets;
|
||||
sops.age.sshKeyPaths = [ ./test_key ];
|
||||
systemd.services."acme-selfsigned-liam.dis8.net".wantedBy = [
|
||||
"postfix.service"
|
||||
"dovecot2.service"
|
||||
];
|
||||
systemd.services."acme-selfsigned-liam.dis8.net".before = [
|
||||
"postfix.service"
|
||||
"dovecot2.service"
|
||||
];
|
||||
vacu.secretsFolder = "${sopsTestSecretsFolder}";
|
||||
vacu.liam.relayhost = "[badhost.blarg]:587 [${relayDomain}]:587";
|
||||
system.activationScripts.sopsHack.text = "ln -s ${testAgeSecretFile} /run/secretKey";
|
||||
system.activationScripts.setupSecrets.deps = [ "sopsHack" ];
|
||||
sops.age.keyFile = "/run/secretKey";
|
||||
services.do-agent.enable = false;
|
||||
virtualisation.digitalOcean = {
|
||||
seedEntropy = false;
|
||||
@@ -52,21 +173,35 @@
|
||||
services.dovecot2.enableDHE = lib.mkForce false;
|
||||
security.acme.defaults.email = lib.mkForce "me@example.org";
|
||||
security.acme.defaults.server = lib.mkForce "https://example.com"; # self-signed only
|
||||
networking.nameservers = lib.mkForce (lib.singleton nodes.ns.networking.primaryIPAddress);
|
||||
networking.nameservers = lib.mkForce [ nodes.ns.networking.primaryIPAddress ];
|
||||
security.pki.certificateFiles = [ rootCA.certificatePath ];
|
||||
};
|
||||
|
||||
nodes.checker = { pkgs, lib, ... }: {
|
||||
nodes.checker =
|
||||
{ pkgs, lib, ... }:
|
||||
{
|
||||
environment.systemPackages = [
|
||||
pkgs.wget
|
||||
pkgs.python311Packages.imap-tools
|
||||
pkgs.python311
|
||||
(pkgs.writeScriptBin "mailtest" ''
|
||||
#!${pkgs.python311}/bin/python
|
||||
(pkgs.writers.writePython3Bin "mailtest"
|
||||
{
|
||||
libraries = with pkgs.python3Packages; [
|
||||
imap-tools
|
||||
requests
|
||||
];
|
||||
}
|
||||
''
|
||||
# flake8: noqa
|
||||
# #!${pkgs.python311}/bin/python
|
||||
import sys
|
||||
sys.argv.insert(1, "${nodes.liam.networking.primaryIPAddress}")
|
||||
sys.path.append("${pkgs.python311Packages.imap-tools}/lib/python3.11/site-packages")
|
||||
#sys.path.append("${pkgs.python311Packages.imap-tools}/lib/python3.11/site-packages")
|
||||
#sys.path.append("${pkgs.python311Packages.urllib3}/lib/python3.11/site-packages")
|
||||
#sys.path.append("${pkgs.python311Packages.requests}/lib/python3.11/site-packages")
|
||||
${builtins.readFile ./mailtest.py}
|
||||
'')
|
||||
''
|
||||
)
|
||||
];
|
||||
networking.nameservers = lib.mkForce (lib.singleton nodes.ns.networking.primaryIPAddress);
|
||||
};
|
||||
@@ -78,13 +213,23 @@
|
||||
liam.wait_for_unit("nginx.service")
|
||||
liam.wait_for_open_port(80)
|
||||
|
||||
liam.copy_from_host("${pkgs.writeText "acme-test" "test"}", "${nodes.liam.security.acme.defaults.webroot + "/.well-known/acme-challenge/test"}")
|
||||
liam.copy_from_host("${pkgs.writeText "acme-test" "test"}", "${
|
||||
nodes.liam.security.acme.defaults.webroot + "/.well-known/acme-challenge/test"
|
||||
}")
|
||||
checker.succeed("wget http://liam.dis8.net/.well-known/acme-challenge/test")
|
||||
|
||||
liam.wait_for_unit("postfix.service")
|
||||
liam.wait_for_unit("dovecot2.service")
|
||||
relay.wait_for_unit("mailpit.service")
|
||||
|
||||
checks = """
|
||||
--submission --mailfrom me@shelvacu.com --rcptto foo@example.com --username shelvacu --expect-mailpit-received --mailpit-url http://${nodes.relay.networking.primaryIPAddress}:8025
|
||||
--submission --mailfrom me@dis8.net --rcptto foo@example.com --username shelvacu --expect-mailpit-not-received --mailpit-url http://${nodes.relay.networking.primaryIPAddress}:8025
|
||||
|
||||
# julie's emails should NOT get sieve'd like mine
|
||||
--rcptto julie@shelvacu.com --username julie --imap-dir INBOX
|
||||
--rcptto julie+stuff@shelvacu.com --username julie --imap-dir INBOX
|
||||
|
||||
# test the sieve script is working
|
||||
--mailfrom whoever@example.com --rcptto sievetest@shelvacu.com --username shelvacu --imap-dir com.shelvacu
|
||||
|
||||
@@ -102,6 +247,7 @@
|
||||
--mailfrom julie@shelvacu.com --expect-recipient-refused
|
||||
--mailfrom @vacu.store --expect-recipient-refused
|
||||
|
||||
|
||||
--submission --expect-recipient-refused --mailfrom julie@shelvacu.com --username shelvacu
|
||||
--submission --expect-recipient-refused --mailfrom fubar@theviolincase.com --username shelvacu
|
||||
--submission --expect-recipient-refused --mailfrom fubar@vacu.store --username julie
|
||||
@@ -112,6 +258,7 @@
|
||||
--submission --mailfrom foo@vacu.store --rcptto foo@example.com --username shelvacu@shelvacu.com --password shelvacu --expect-sent
|
||||
--submission --mailfrom foo@violingifts.com --rcptto foo@example.com --username julie --password julie --expect-sent
|
||||
--submission --mailfrom foo@violingifts.com --rcptto foo@example.com --username julie@shelvacu.com --password julie --expect-sent
|
||||
|
||||
"""
|
||||
for check in checks.split("\n"):
|
||||
check = check.strip()
|
||||
|
@@ -5,6 +5,7 @@ import time
|
||||
import ssl
|
||||
import argparse
|
||||
import uuid
|
||||
import requests
|
||||
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument('host', type = str)
|
||||
@@ -24,6 +25,9 @@ parser.add_argument('--expect-recipient-refused',
|
||||
)
|
||||
parser.add_argument('--expect-sent', dest = 'expect', action = 'store_const', const = 'sent')
|
||||
parser.add_argument('--expect-imap-error', dest = 'expect', action = 'store_const', const = 'imap_error')
|
||||
parser.add_argument('--expect-mailpit-received', dest = 'expect', action = 'store_const', const = 'mailpit_received')
|
||||
parser.add_argument('--expect-mailpit-not-received', dest = 'expect', action = 'store_const', const = 'mailpit_not_received')
|
||||
parser.add_argument('--mailpit-url')
|
||||
|
||||
args = parser.parse_args()
|
||||
|
||||
@@ -41,6 +45,9 @@ if password is None:
|
||||
if (username is None or password is None) and (args.submission or args.expect == 'received'):
|
||||
assert False, "Bad args"
|
||||
|
||||
if args.expect.startswith("mailpit_") and args.mailpit_url is None:
|
||||
assert False, "Bad args"
|
||||
|
||||
msg_magic = str(uuid.uuid4())
|
||||
|
||||
def mk_ctx():
|
||||
@@ -68,6 +75,19 @@ except smtplib.SMTPRecipientsRefused:
|
||||
else:
|
||||
assert (not args.expect == 'recipient_refused'), "Server was supposed to reject this message, but it didn't"
|
||||
|
||||
if args.mailpit_url is not None:
|
||||
time.sleep(3)
|
||||
mails = requests.get(args.mailpit_url + "/api/v1/messages").json()
|
||||
found_message = False
|
||||
for message_data in mails["messages"]:
|
||||
if msg_magic in message_data["Snippet"]:
|
||||
found_message = True
|
||||
break
|
||||
if args.expect == 'mailpit_received':
|
||||
assert found_message, "Message not received by mailpit server"
|
||||
else:
|
||||
assert not found_message, "Message was received by the mailpit server when it wasn't supposed to be"
|
||||
|
||||
if args.expect == 'received' or args.expect == 'imap_error':
|
||||
time.sleep(3)
|
||||
try:
|
||||
|
@@ -1,4 +1,4 @@
|
||||
dovecot-passwd: ENC[AES256_GCM,data:OPlQGFnkklEQvFpQM3jrdHB1p1zM+n76TCCaLmM/DOYlJ6W3+8bGt4i1JJq+FbA05RiX0Yhpv5s=,iv:R47TNT306RVrAPSRpK5TjUoWJF4nXnBvpDpIhwpdxWg=,tag:iKTUIoano0Bcxjkb2VQeuA==,type:str]
|
||||
dovecot-passwd: ENC[AES256_GCM,data:Ji41+n/7D90/O/LVM+3FDNACZ6jJPT6QYVIGWLujCheIY8m6vaRmMXzPCTgbK+njDOfIv7O2Sko15U4CYqWXAi3P43Np8GKRcv5+4NE=,iv:o6+tYBHSB3reRIqvFGB39wHk3G1L5VKmkj9Fiinnvnw=,tag:wggoNMvAYyJzkh73C3bMHw==,type:str]
|
||||
dkim_key: ENC[AES256_GCM,data:nzujLrGttOL38d8mxglUcAQ9EO+sL2Gh75E4Wyt6siviFEpx5ZIpXkaC9XXmD2f6Ax4BHF8FTOB1cX0dLrRYp9gNOV007CsVUWpYf34H/J5bOUo1j+urYtbtA5Idu8FoUC3ENg5Ap4CId7jTtxQ9PlS9vTKQ2T2tIqmvXGE0t0aowUdJJdPfJLN1lMENY+/m9NxwArF06K/75BAX9LaxhNDzUHNwV9PK+htD9M1g0r7McbLtZpPut8tdkzOWGiUHIisPpXSTUk8LjrFY36DNngcXAyiRZtp6WrhINVABRKMVf92dYUQixpf6r7BkCkyRT60rAHz5UbWHI/saYHgXlH2OGK5hyZZ4JueAHU2Y7Hpvbw3UIG9jumdDcRda5W0WycJyGS4a5YZST907eDP4PuZayHOmp288Cuyc+kXOxvuCGjqiuZswokj4Ba4hIUUNJU1Ys4THYrf+j+iX0nKclGS+LXvqQI1cKUE3gBecxE2SW3BNzIOGh/ywO1kg2uZlUPpfGBr+Aupke/nULcGi2HVwX5EV47jpDyoqIEiVCy3OYSeQ2gkocIQ/y74fNMoud4kWmye8bAhprxVUHHes2TBjBb6QxQdmazjhAiCvgSI3p43QlSG2fqtQMcXMiANra1heRHHsOS8GKWk/ti9/k3/0YWycXcawYE8lpg/efpBPWkgWQ+NDUxcJBbWCKbkvA2DEfoSluwcGuxUjWGa27SKaCVX/LNAUDvXcw82F61XsTpoK2i0pme7pIZeF1bfbKyPxDnpWKoLoL2i2HchD1B5AEemr+eKh3kPGqpY3SNfqPFyUYN34Fea/gg/eM1Jw/ORWGNxMwg882a/NQLRzjjseQsPEI0r0o8Xba1KqGP1mMhursrOFVRz9xXG7l5oXhx0+GsscKDnP40CXJBMf6r2tEZobrR8NagV4/Mh4r2+zYw12KwwYZ5drmS1b0ftrLZLSugJopgLaQqYC3OAnmdW1MOkNoQSWv9Y5NaPERpMQ9BJcPcGM3W3+AyEz3zRSlFQFnjZO6kk37dFz1KVbbXkrFTXhDpGw/Z/RCMdzv6eyhPqcSSccisaOxDtlLQXy95G6tOcpJV7u7qu1LzQDehyZnBjasqMQVpCJw1Q9GRxnSBjpVKzN07dEkzXqcZHh67kPR/aoH8jzbfNq5YDQ6nxK0INcSyCzJe4w18JbY5Wq0F5U0OeYwYAwHoIV/nbMdptyyw==,iv:ol3dz4SomkwyN2s4tPWDCJEYdnMuZTvHppUA95Nz3+8=,tag:IlZBYvM8e3COjxZ/dxJT7Q==,type:str]
|
||||
dkim_pub: ENC[AES256_GCM,data:tigMKTZ5XiDViSez2WKfUPBkw9OtLKrEBrbp/I3tUk+mu7RR2YIaQEWfTH0EOzPMpDEIJ32pwlqicGQZdTf7WdpELcJZgbxKpWPWgTzjwHasgs38aJh2JIIoIuFwa1YgEuRGtSl7YT47WDhTTGbFFdvaKBlIe7vipgkFSxNX1NKGNgdkkcVczvlVgWKqbp05zzUlav1XEwBhd+3eTgPQFptYyvQbIFasiunrHBT8cbm+CQ/O8q90lUkoVrmQUu3XG6njDMa4pNULUJqsUogCyYgm/aDMdx7AN29daCbgj99g/hjnQrBFajJCzNyG36XrzQdZJGiG0AgG1oWAq98boNFxC5ux4eBDmT946FyxXFNwyZpu1p2naHkBlE01duCBS4PUuQFlw9tsCYOuL+xGR3paBafTcL6X67w=,iv:lXFMxiePwivoyQxuQu+hEHeuU0z85fJk9y7296oJNl8=,tag:0QknKaFPpNHo2v0feR+jAQ==,type:str]
|
||||
sops:
|
||||
@@ -16,8 +16,8 @@ sops:
|
||||
T3dqdEJxRmkvSStuK1NmRWJkN1psWWsKuNdc6DHXXEcn63CZv/5lE30MAagPfHO0
|
||||
GDOLTLCLDzNvKmd5i9dNuYBrD1JeyotNId6E4w/3oYxCFJ56SsH32Q==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2024-03-21T22:00:58Z"
|
||||
mac: ENC[AES256_GCM,data:147XZroz5psp5Q5zGz19FZNPFr01wPGM0ivxbNVu9IcuUPw5dhnSaFQTvdYKfZPLSW2dwMJ2sPA5NAxxW0zQTh3d4vjirJ7GVj07Fn+ipL/X+wZKM42HjNSEw9IdAD5OIArZ8XjZcC+AGu7C4wHHf43uOEu7ZbWYx9Kbq+cJGbk=,iv:V9GHCN0NPWaRZOmoWhKA5fHwfKfrdays3ODfiTBrbo8=,tag:JwiHjHEjTDc6XRqtn0Aqwg==,type:str]
|
||||
lastmodified: "2024-06-28T22:08:15Z"
|
||||
mac: ENC[AES256_GCM,data:G7ceHgkxOv1xinx2Oc5kWCDs5njnf/uUyHlOddzM8RBZTcBp4RVB6NJb3ERFpHlEBXtO5EXnXm2ggK9cfxH9BKL/4tZeFQDqT9QcwFvtynQbCcOmBi3ffrkt4uXKwOIpVZyT8bz8GYueLq/fu2fIHwjZ7Ll43Gn2Sp6gQuvFSuo=,iv:wg88Qpn5cIIr9tXUkc/WxfMDt/SHbA09CRCCv/FwUVU=,tag:QiG5ERsym5kl2g11LK0onw==,type:str]
|
||||
pgp: []
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.8.1
|
||||
|
@@ -1,18 +1,26 @@
|
||||
{ pkgs, nodes, ... }: {
|
||||
{ pkgs, nodes, ... }:
|
||||
{
|
||||
name = "trip-megatest";
|
||||
|
||||
nodes.triple-dezert = { lib, config, ... }: let
|
||||
nodes.triple-dezert =
|
||||
{ lib, config, ... }:
|
||||
let
|
||||
domains = builtins.attrNames config.security.acme.certs;
|
||||
disableAcmes = builtins.listToAttrs (
|
||||
map (d: {
|
||||
name = "acme-${d}";
|
||||
value = { enable = lib.mkForce false; };
|
||||
value = {
|
||||
enable = lib.mkForce false;
|
||||
};
|
||||
}) domains
|
||||
);
|
||||
reEnableSelfsigned = builtins.listToAttrs (
|
||||
map (d: {
|
||||
name = "acme-selfsigned-${d}";
|
||||
value = { wantedBy = [ "container@frontproxy.service" ]; before = [ "container@frontproxy.service" ]; };
|
||||
value = {
|
||||
wantedBy = [ "container@frontproxy.service" ];
|
||||
before = [ "container@frontproxy.service" ];
|
||||
};
|
||||
}) domains
|
||||
);
|
||||
unitsToDisable = [
|
||||
@@ -23,16 +31,20 @@
|
||||
disableUnits = builtins.listToAttrs (
|
||||
map (u: {
|
||||
name = u;
|
||||
value = { enable = lib.mkForce false; };
|
||||
value = {
|
||||
enable = lib.mkForce false;
|
||||
};
|
||||
}) unitsToDisable
|
||||
);
|
||||
in {
|
||||
in
|
||||
{
|
||||
imports = [ ../triple-dezert ];
|
||||
vacu.underTest = true;
|
||||
systemd.services = disableAcmes // reEnableSelfsigned;
|
||||
systemd.units = disableUnits;
|
||||
#vacu.secretsFolder = ./test_secrets;
|
||||
#sops.age.sshKeyPaths = [ ./test_key ];
|
||||
boot.zfs.extraPools = lib.mkForce [];
|
||||
boot.zfs.extraPools = lib.mkForce [ ];
|
||||
security.acme.defaults.email = lib.mkForce "me@example.org";
|
||||
security.acme.defaults.server = lib.mkForce "https://example.com"; # self-signed only
|
||||
};
|
||||
|
@@ -1,13 +1,23 @@
|
||||
{ config, pkgs, inputs, lib, ... }:
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
inputs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
prefix = "10.16.237.";
|
||||
tripAddr = prefix + "2";
|
||||
awooAddr = prefix + "1";
|
||||
devName = "at4"; # It was my fourth attempt before it worked...
|
||||
tunnelName = "awootrip";
|
||||
in {
|
||||
in
|
||||
{
|
||||
systemd.network.netdevs.${devName} = {
|
||||
netdevConfig = { Kind = "tun"; Name = devName; };
|
||||
netdevConfig = {
|
||||
Kind = "tun";
|
||||
Name = devName;
|
||||
};
|
||||
enable = true;
|
||||
};
|
||||
|
||||
|
@@ -1,24 +1,37 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
|
||||
with lib;
|
||||
let
|
||||
cfg = config.vacu;
|
||||
databases = attrValues cfg.databases;
|
||||
authText = flip (concatMapStringsSep "\n") databases
|
||||
(d:
|
||||
authText = flip (concatMapStringsSep "\n") databases (
|
||||
d:
|
||||
if d.authByIp != null then
|
||||
# host database user address auth-method [auth-options]
|
||||
''host "${d.name}" "${d.user}" ${d.authByIp}/32 trust''
|
||||
else
|
||||
# local database user auth-method [auth-options]
|
||||
''local "${d.name}" "${d.user}" peer'')
|
||||
;
|
||||
''local "${d.name}" "${d.user}" peer''
|
||||
);
|
||||
in
|
||||
{
|
||||
options.vacu.databases = mkOption {
|
||||
default = {};
|
||||
default = { };
|
||||
description = "Databases that should be created and how they should be accessed";
|
||||
type = types.attrsOf (types.submodule ({ name, config, options, ... }: {
|
||||
type = types.attrsOf (
|
||||
types.submodule (
|
||||
{
|
||||
name,
|
||||
config,
|
||||
options,
|
||||
...
|
||||
}:
|
||||
{
|
||||
options = {
|
||||
name = mkOption {
|
||||
type = types.str;
|
||||
@@ -41,7 +54,9 @@ in
|
||||
description = "If true, user is authenticated based on connecting to the unix socket from a process running as the user";
|
||||
};
|
||||
};
|
||||
}));
|
||||
}
|
||||
)
|
||||
);
|
||||
};
|
||||
|
||||
config = {
|
||||
@@ -53,11 +68,9 @@ in
|
||||
services.postgresql = rec {
|
||||
enable = true;
|
||||
package = pkgs.postgresql_16;
|
||||
dataDir = "/trip/pg/data/${package.psqlSchema}";
|
||||
dataDir = "/var/postgres/data/${package.psqlSchema}";
|
||||
enableJIT = true;
|
||||
initdbArgs = [
|
||||
"--waldir=/trip/pg/wal/${package.psqlSchema}"
|
||||
];
|
||||
initdbArgs = [ "--waldir=/var/postgres/wal/${package.psqlSchema}" ];
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "root";
|
||||
@@ -74,6 +87,11 @@ in
|
||||
'';
|
||||
};
|
||||
|
||||
systemd.services.postgresql.postStart = "\n#START stuff from database.nix\n" + (concatMapStringsSep "\n" (d: ''$PSQL -tAc 'ALTER DATABASE "${d.name}" OWNER TO "${d.user}";' '') databases) + "\n#END stuff from database.nix\n";
|
||||
systemd.services.postgresql.postStart =
|
||||
"\n#START stuff from database.nix\n"
|
||||
+ (concatMapStringsSep "\n" (
|
||||
d: ''$PSQL -tAc 'ALTER DATABASE "${d.name}" OWNER TO "${d.user}";' ''
|
||||
) databases)
|
||||
+ "\n#END stuff from database.nix\n";
|
||||
};
|
||||
}
|
@@ -1,7 +1,7 @@
|
||||
{ config, pkgs, inputs, lib, ... }: {
|
||||
imports =
|
||||
[
|
||||
../common-nixos-config.nix
|
||||
{ config, pkgs, ... }:
|
||||
{
|
||||
imports = [
|
||||
../common/nixos.nix
|
||||
./hardware-configuration.nix
|
||||
./awootrip.nix
|
||||
./frontproxy.nix
|
||||
@@ -14,13 +14,14 @@
|
||||
./static-stuff.nix
|
||||
#./vms.nix
|
||||
./networking.nix
|
||||
./devver-host.nix
|
||||
./emily.nix
|
||||
./jellyfin.nix
|
||||
];
|
||||
|
||||
system.nixos.tags = [ "host-${config.networking.hostName}" ];
|
||||
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
#todo: increase boot partition size
|
||||
boot.loader.systemd-boot.configurationLimit = 10;
|
||||
# The first thing to complain was redis in the vacustore container:
|
||||
#
|
||||
# WARNING Memory overcommit must be enabled! Without it, a background save or replication may fail under low memory condition. Being disabled, it can also cause failures without low memory condition, see https://github.com/jemalloc/jemalloc/issues/1328. To fix this issue add 'vm.overcommit_memory = 1' to /etc/sysctl.conf and then reboot or run the command 'sysctl vm.overcommit_memory=1' for this to take effect.
|
||||
@@ -30,17 +31,35 @@
|
||||
|
||||
boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
|
||||
|
||||
networking.hostName = "triple-dezert";
|
||||
vacu.hostName = "triple-dezert";
|
||||
vacu.shortHostName = "trip";
|
||||
vacu.shell.color = "yellow";
|
||||
vacu.verifySystem.expectedMac = "b8:ca:3a:68:15:c8";
|
||||
|
||||
services.xserver.enable = false;
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
vacu.packages =
|
||||
(with pkgs; [
|
||||
zfs
|
||||
smartmontools
|
||||
openvpn
|
||||
nvme-cli
|
||||
tshark
|
||||
postgresql_16
|
||||
])
|
||||
++ [
|
||||
config.services.postgresql.package
|
||||
(pkgs.writeScriptBin "into-nix-cache" ''
|
||||
if [[ $UID -ne 0 ]]; then exec sudo $0 "$@";fi
|
||||
${pkgs.nix}/bin/nix copy \
|
||||
--no-update-lock-file \
|
||||
--no-write-lock-file \
|
||||
--to 'file:///trip/nix-binary-cache?parallel-compression=true&secret-key=/root/cache-priv-key.pem&want-mass-query=true&write-nar-listing=true' \
|
||||
"$@"
|
||||
'')
|
||||
];
|
||||
hardware.opengl.extraPackages = [
|
||||
pkgs.intel-compute-runtime
|
||||
pkgs.ocl-icd
|
||||
];
|
||||
|
||||
services.openssh = {
|
||||
@@ -49,14 +68,6 @@
|
||||
ports = [ 6922 ];
|
||||
};
|
||||
|
||||
system.copySystemConfiguration = false;
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "22.05"; # Did you read the comment?
|
||||
|
||||
boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
|
||||
@@ -68,4 +79,3 @@
|
||||
networking.hostId = "c871875e";
|
||||
hardware.enableAllFirmware = true;
|
||||
}
|
||||
|
||||
|
@@ -1,140 +0,0 @@
|
||||
{ pkgs, lib, config, inputs, ... }: let
|
||||
qemu-pkg = pkgs.qemu_kvm;
|
||||
#rootPath = "/trip/devver-vm/root";
|
||||
bootPath = "/trip/devver-vm/boot";
|
||||
installer = inputs.self.nixosConfigurations.shel-installer;
|
||||
installerIsoDeriv = installer.config.system.build.isoImage;
|
||||
installerIsoPath = "${installerIsoDeriv}/iso/${installerIsoDeriv.name}";
|
||||
bootInstaller = false;
|
||||
tapdev = "qemu-devver";
|
||||
tapdev-int = "qemu-devver-int";
|
||||
commonArgs = [
|
||||
"${qemu-pkg}/bin/qemu-kvm"
|
||||
"-name" "devver"
|
||||
# https://www.qemu.org/docs/master/system/i386/microvm.html
|
||||
# "microvm" is basically no-batteries-included, and should allow including only the things we need
|
||||
"-machine" "microvm,accel=kvm,dump-guest-core=off,mem-merge=off,acpi=on,pcie=on,pic=off,pit=off,usb=off"
|
||||
"-m" "8G"
|
||||
"-smp" "12"
|
||||
"-nodefaults"
|
||||
"-no-user-config"
|
||||
"-chardev" "stdio,id=stdio,signal=off"
|
||||
"-serial" "chardev:stdio"
|
||||
"-monitor" "none"
|
||||
"-device" "virtio-rng-pci"
|
||||
"-enable-kvm"
|
||||
"-cpu" "host,-sgx"
|
||||
"-usb"
|
||||
"-device" "usb-kbd"
|
||||
"-nographic"
|
||||
# do I need/want QMP here?
|
||||
|
||||
"-device" "virtio-balloon"
|
||||
"-object" "memory-backend-memfd,id=mem,size=8G,share=off"
|
||||
"-numa" "node,memdev=mem"
|
||||
|
||||
# I don't understand, the docs for "-drive" says it's a shortcut for -blockdev and -device, but all the real-world code has -drive and -device
|
||||
#"-drive" "file=/trip/devver-vm/disk-image/root.img,discard=unmap,if=none,format=raw,cache=none,id=root-disk"
|
||||
"-blockdev" "driver=raw,node-name=root-disk,file.driver=file,file.filename=/trip/devver-vm/disk-image/root.img,discard=unmap,cache.direct=on"
|
||||
"-device" "virtio-blk-device,drive=root-disk,write-cache=off"
|
||||
|
||||
"-fsdev" "local,id=fs0,path=${bootPath},security_model=mapped-xattr,fmode=0600,dmode=0700"
|
||||
"-device" "virtio-9p-pci,fsdev=fs0,mount_tag=boot"
|
||||
|
||||
"-netdev" "tap,id=vm-devver,ifname=${tapdev},script=no,downscript=no"
|
||||
#Why 34? No idea! Best hint I could find is in the mailing list about the serial driver: https://lists.nongnu.org/archive/html/qemu-devel/2013-01/msg05952.html
|
||||
"-device" "virtio-net-pci,netdev=vm-devver,mac=02:19:07:A2:15:72,romfile=,mq=on,vectors=34"
|
||||
"-netdev" "tap,id=vm-devver2,ifname=${tapdev-int},script=no,downscript=no"
|
||||
"-device" "virtio-net-pci,netdev=vm-devver2,romfile=,mq=on,vectors=34"
|
||||
];
|
||||
installerArgs = [
|
||||
# "-boot" "once=d"
|
||||
# "-cdrom" "${installerIsoPath}"
|
||||
"-drive" "if=virtio,media=cdrom,driver=raw,node-name=disk,file.driver=file,file.filename=${installerIsoPath},file.locking=off,read-only=on"
|
||||
"-kernel" "${installer.config.system.build.kernel}/${installer.config.system.boot.loader.kernelFile}"
|
||||
"-initrd" "${installer.config.system.build.initialRamdisk}/${installer.config.system.boot.loader.initrdFile}"
|
||||
"-append" "${lib.concatStringsSep " " installer.config.boot.kernelParams} init=${installer.config.system.build.toplevel}/init earlyprintk=ttyS0 console=ttyS0 debug"
|
||||
];
|
||||
mainArgs = [
|
||||
"-kernel" "${bootPath}/kernel"
|
||||
"-initrd" "${bootPath}/initrd"
|
||||
"-append" "earlyprintk=ttyS0 console=ttyS0"
|
||||
];
|
||||
|
||||
runScript = ''
|
||||
set -ev
|
||||
declare -a args
|
||||
if [ "x$1" == "x--installer" ]; then
|
||||
args=(${lib.escapeShellArgs (commonArgs ++ installerArgs)})
|
||||
else
|
||||
args=(${lib.escapeShellArgs (commonArgs ++ mainArgs)}" $(cat ${bootPath}/kernel-params)")
|
||||
fi
|
||||
d=`mktemp -d --tmpdir qemu-devver-XXXXXXXXX`
|
||||
cd $d
|
||||
"''${args[@]}"
|
||||
'';
|
||||
in {
|
||||
users.groups.devver = {};
|
||||
users.users.devver = {
|
||||
isSystemUser = true;
|
||||
group = config.users.groups.devver.name;
|
||||
};
|
||||
environment.systemPackages = [(pkgs.writeScriptBin "run-devver" runScript) qemu-pkg];
|
||||
systemd.network.netdevs.${tapdev} = {
|
||||
netdevConfig = {
|
||||
Kind = "tap";
|
||||
Name = tapdev;
|
||||
};
|
||||
tapConfig = {
|
||||
User = config.users.users.devver.name;
|
||||
Group = config.users.groups.devver.name;
|
||||
PacketInfo = true;
|
||||
# KeepCarrier = true;
|
||||
};
|
||||
};
|
||||
systemd.network.netdevs.${tapdev-int} = {
|
||||
netdevConfig = {
|
||||
Kind = "tap";
|
||||
Name = tapdev-int;
|
||||
};
|
||||
tapConfig = {
|
||||
User = config.users.users.devver.name;
|
||||
Group = config.users.groups.devver.name;
|
||||
PacketInfo = true;
|
||||
# KeepCarrier = true;
|
||||
};
|
||||
};
|
||||
systemd.network.networks."02-vm-devver".extraConfig = ''
|
||||
Bridge = ${config.vacu.network.lan_bridge}
|
||||
|
||||
[Match]
|
||||
Name = ${tapdev}
|
||||
|
||||
[Link]
|
||||
RequiredForOnline = no
|
||||
'';
|
||||
systemd.network.networks."02-vm-devver-int".extraConfig = ''
|
||||
Address = 10.110.171.204/31
|
||||
DHCP = no
|
||||
DNS = no
|
||||
LLDP = no
|
||||
|
||||
[Match]
|
||||
Name = ${tapdev-int}
|
||||
|
||||
[Link]
|
||||
RequiredForOnline = no
|
||||
'';
|
||||
|
||||
# networking.firewall.extraCommands = ''
|
||||
# if ! (iptables -t nat -n --list devver-prerouting > /dev/null 2>&1); then
|
||||
# iptables -t nat -N devver-prerouting
|
||||
# fi
|
||||
# iptables -t nat -F devver-prerouting
|
||||
# iptables -t nat -A devver-prerouting -p tcp -m tcp --dport 5022 -j DNAT --to-destination 10.78.79.10
|
||||
# iptables -t nat -I PREROUTING 1 -j devver-prerouting
|
||||
# '';
|
||||
# networking.firewall.extraStopCommands = ''
|
||||
# iptables -t nat -D PREROUTING -j devver-prerouting || true
|
||||
# '';
|
||||
}
|
49
triple-dezert/emily.nix
Normal file
49
triple-dezert/emily.nix
Normal file
@@ -0,0 +1,49 @@
|
||||
{ config, ... }:
|
||||
let
|
||||
sshPort = 32767;
|
||||
container = config.containers.emily;
|
||||
in
|
||||
{
|
||||
networking.firewall.allowedTCPPorts = [ sshPort ];
|
||||
networking.nat.forwardPorts = [
|
||||
{
|
||||
destination = container.localAddress;
|
||||
proto = "tcp";
|
||||
sourcePort = sshPort;
|
||||
}
|
||||
];
|
||||
|
||||
containers.emily = {
|
||||
privateNetwork = true;
|
||||
hostAddress = "192.168.100.20";
|
||||
localAddress = "192.168.100.21";
|
||||
|
||||
autoStart = true;
|
||||
ephemeral = false;
|
||||
|
||||
bindMounts."/emdata" = {
|
||||
hostPath = "/trip/ncdata/data/melamona/files";
|
||||
isReadOnly = false;
|
||||
};
|
||||
|
||||
config =
|
||||
{ config, ... }:
|
||||
{
|
||||
system.stateVersion = "24.05";
|
||||
|
||||
services.openssh.enable = true;
|
||||
services.openssh.ports = [ sshPort ];
|
||||
services.openssh.openFirewall = true;
|
||||
|
||||
users.groups.emily.gid = 999;
|
||||
users.users.emily = {
|
||||
isNormalUser = true;
|
||||
isSystemUser = false;
|
||||
hashedPassword = "$y$j9T$gP2phgJ9iSH.tWROn/T2C1$dwifP4R4SY4Fyd6W4vZ7tMDFhZB7Cfji9QvporeKUXB";
|
||||
group = "emily";
|
||||
};
|
||||
users.mutableUsers = false;
|
||||
users.allowNoPasswordLogin = true;
|
||||
};
|
||||
};
|
||||
}
|
@@ -1,4 +1,10 @@
|
||||
{ config, pkgs, inputs, lib, ... }:
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
inputs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
# How to register a new domain in acme-dns before deploying the nix config:
|
||||
# From trip:
|
||||
@@ -10,8 +16,10 @@ let
|
||||
"vacu.store"
|
||||
"jean-luc.org"
|
||||
"pwrhs.win"
|
||||
"jf.finaltask.xyz"
|
||||
];
|
||||
in {
|
||||
in
|
||||
{
|
||||
security.acme.acceptTerms = true;
|
||||
security.acme.defaults = {
|
||||
email = "nix-acme@shelvacu.com";
|
||||
@@ -23,7 +31,14 @@ in {
|
||||
postRun = "${pkgs.nixos-container}/bin/nixos-container run frontproxy -- systemctl reload haproxy";
|
||||
};
|
||||
|
||||
security.acme.certs = builtins.listToAttrs (map (d: { name = d; value = { extraDomainNames = ["*.${d}"]; }; }) domains);
|
||||
security.acme.certs = builtins.listToAttrs (
|
||||
map (d: {
|
||||
name = d;
|
||||
value = {
|
||||
extraDomainNames = [ "*.${d}" ];
|
||||
};
|
||||
}) domains
|
||||
);
|
||||
|
||||
users.groups.acme.gid = 993;
|
||||
|
||||
@@ -32,25 +47,32 @@ in {
|
||||
after = [ "network-online.target" ];
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
80
|
||||
443
|
||||
];
|
||||
networking.firewall.allowedUDPPorts = [ 443 ]; # quic!
|
||||
|
||||
containers.frontproxy = let outer_config = config; in {
|
||||
containers.frontproxy =
|
||||
let
|
||||
outer_config = config;
|
||||
in
|
||||
{
|
||||
autoStart = true;
|
||||
restartIfChanged = true;
|
||||
ephemeral = true;
|
||||
bindMounts = builtins.listToAttrs (map (d: { name = "/certs/${d}"; value = {
|
||||
bindMounts = builtins.listToAttrs (
|
||||
map (d: {
|
||||
name = "/certs/${d}";
|
||||
value = {
|
||||
hostPath = outer_config.security.acme.certs.${d}.directory;
|
||||
isReadOnly = true;
|
||||
}; }) domains);
|
||||
config = { config, pkgs, ... }:
|
||||
let
|
||||
haproxySrc = pkgs.runCommand "extract-haproxy" {} ''
|
||||
cd `mktemp -d`
|
||||
tar -xf ${config.services.haproxy.package.src}
|
||||
mv * $out
|
||||
'';
|
||||
in {
|
||||
};
|
||||
}) domains
|
||||
);
|
||||
config =
|
||||
{ config, pkgs, ... }:
|
||||
{
|
||||
system.stateVersion = "23.11";
|
||||
users.groups.acme.gid = outer_config.users.groups.acme.gid;
|
||||
users.users.haproxy.extraGroups = [ config.users.groups.acme.name ];
|
||||
@@ -59,7 +81,7 @@ in {
|
||||
# # ssl keylogging
|
||||
# global
|
||||
# tune.ssl.keylog on
|
||||
# lua-load ${ pkgs.writeText "sslkeylog.lua" (builtins.readFile ./sslkeylog.lua) }
|
||||
# lua-load ${pkgs.writeText "sslkeylog.lua" (builtins.readFile ./sslkeylog.lua)}
|
||||
|
||||
# haproxy-config.cfg
|
||||
${builtins.readFile ./haproxy-config.cfg}
|
||||
@@ -71,6 +93,7 @@ in {
|
||||
"${outer_config.containers.nix-cache-nginx.localAddress}" = [ "nix-cache" ];
|
||||
"${outer_config.containers.jl-stats.localAddress}" = [ "jl_stats" ];
|
||||
"${outer_config.containers.static-stuff.localAddress}" = [ "static_stuff" ];
|
||||
"${outer_config.containers.jellyfin.localAddress}" = [ "jellyfin" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
@@ -13,8 +13,8 @@ global
|
||||
|
||||
defaults
|
||||
# https://world.hey.com/goekesmi/haproxy-chrome-tcp-preconnect-and-error-408-a-post-preserved-from-the-past-2497d1f7
|
||||
timeout server 302s
|
||||
timeout client 302s
|
||||
timeout server 3s
|
||||
timeout client 3s
|
||||
timeout connect 10s
|
||||
option http-ignore-probes
|
||||
|
||||
@@ -25,7 +25,7 @@ defaults
|
||||
|
||||
frontend main
|
||||
bind :80
|
||||
bind :443 ssl crt /certs/shelvacu.com/full.pem crt /certs/vacu.store/full.pem crt /certs/jean-luc.org/full.pem crt /certs/pwrhs.win/full.pem
|
||||
bind :443 ssl crt /certs/shelvacu.com/full.pem crt /certs/vacu.store/full.pem crt /certs/jean-luc.org/full.pem crt /certs/pwrhs.win/full.pem crt /certs/jf.finaltask.xyz/full.pem
|
||||
|
||||
mode http
|
||||
|
||||
@@ -36,12 +36,13 @@ frontend main
|
||||
# Check whether the client is attempting domain fronting.
|
||||
acl ssl_sni_http_host_match ssl_fc_sni,strcmp(req.host) eq 0
|
||||
|
||||
acl host_vacustore var(req.host) -m str "vacu.store"
|
||||
# acl host_auth var(req.host) -m str "auth.shelvacu.com"
|
||||
acl host_vacustore var(req.host) -m str "vacu.store"
|
||||
acl host_cache var(req.host) -m str "nixcache.shelvacu.com"
|
||||
acl host_stats_jl var(req.host) -m str "stats.jean-luc.org"
|
||||
acl host_tulpaudcast_jl var(req.host) -m str "tulpaudcast.jean-luc.org"
|
||||
acl host_habitat_pwrhs var(req.host) -m str "habitat.pwrhs.win"
|
||||
acl host_jellyfin var(req.host) -m str "jf.finaltask.xyz"
|
||||
|
||||
http-after-response set-header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" if { ssl_fc }
|
||||
|
||||
@@ -64,6 +65,7 @@ frontend main
|
||||
http-request allow if host_stats_jl
|
||||
http-request allow if host_tulpaudcast_jl
|
||||
http-request allow if host_habitat_pwrhs
|
||||
http-request allow if host_jellyfin
|
||||
http-request return status 404 string "not found" content-type text/plain
|
||||
|
||||
use_backend vacustore if host_vacustore
|
||||
@@ -72,6 +74,7 @@ frontend main
|
||||
use_backend jl_stats if host_stats_jl
|
||||
use_backend static_stuff if host_tulpaudcast_jl
|
||||
use_backend habitat if host_habitat_pwrhs
|
||||
use_backend jellyfin if host_jellyfin
|
||||
|
||||
backend vacustore
|
||||
mode http
|
||||
@@ -83,6 +86,11 @@ backend kani
|
||||
option forwardfor
|
||||
server main kani:8443 check maxconn 500 ssl verify none ssl-reuse
|
||||
|
||||
backend jellyfin
|
||||
mode http
|
||||
option forwardfor
|
||||
server main jellyfin:8096 check maxconn 100 proto h1
|
||||
|
||||
# backend keycloak
|
||||
# mode http
|
||||
# option forwardfor
|
||||
|
@@ -1,22 +1,34 @@
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "mpt3sas" "nvme" "usb_storage" "usbhid" "sd_mod" ];
|
||||
boot.initrd.availableKernelModules = [
|
||||
"ehci_pci"
|
||||
"ahci"
|
||||
"mpt3sas"
|
||||
"nvme"
|
||||
"usb_storage"
|
||||
"usbhid"
|
||||
"sd_mod"
|
||||
];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/a4d6a30b-a8b1-460c-9f90-554e61b112fe";
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-uuid/a4d6a30b-a8b1-460c-9f90-554e61b112fe";
|
||||
fsType = "f2fs";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/4F4C-7557";
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-uuid/4F4C-7557";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
|
44
triple-dezert/jellyfin.nix
Normal file
44
triple-dezert/jellyfin.nix
Normal file
@@ -0,0 +1,44 @@
|
||||
{ ... }:
|
||||
let
|
||||
name = "jellyfin";
|
||||
in
|
||||
{
|
||||
systemd.tmpfiles.settings.${name}."/trip/${name}".d = {
|
||||
mode = "0755";
|
||||
};
|
||||
|
||||
containers.${name} = {
|
||||
privateNetwork = true;
|
||||
hostAddress = "192.168.100.22";
|
||||
localAddress = "192.168.100.23";
|
||||
|
||||
autoStart = true;
|
||||
ephemeral = true;
|
||||
restartIfChanged = true;
|
||||
bindMounts."/${name}" = {
|
||||
hostPath = "/trip/${name}";
|
||||
isReadOnly = false;
|
||||
};
|
||||
|
||||
config =
|
||||
{ pkgs, config, ... }:
|
||||
{
|
||||
system.stateVersion = "24.05";
|
||||
|
||||
networking.useHostResolvConf = false;
|
||||
networking.nameservers = [ "10.78.79.1" ];
|
||||
networking.firewall.enable = false;
|
||||
|
||||
services.jellyfin = {
|
||||
enable = true;
|
||||
dataDir = "/${name}";
|
||||
};
|
||||
|
||||
environment.systemPackages = [
|
||||
config.services.jellyfin.package
|
||||
pkgs.jellyfin-web
|
||||
pkgs.jellyfin-ffmpeg
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
@@ -1,31 +1,19 @@
|
||||
{ config, pkgs, inputs, lib, ... }:
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
inputs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
name = "jl-stats";
|
||||
contain = config.containers.${name};
|
||||
most-winningest = pkgs.callPackage ({
|
||||
rustPlatform,
|
||||
fetchFromGitHub,
|
||||
pkg-config,
|
||||
openssl,
|
||||
postgresql,
|
||||
}: rustPlatform.buildRustPackage rec {
|
||||
pname = "most-winningest";
|
||||
version = "69.420";
|
||||
|
||||
nativeBuildInputs = [ pkg-config ];
|
||||
|
||||
buildInputs = [ openssl postgresql ];
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "captain-jean-luc";
|
||||
repo = pname;
|
||||
rev = "d203ae1b8dd450b281bc1b4bb2ae7518a5665352";
|
||||
hash = "sha256-RDVIu4zU4BvsJ1Ek7SwlpvA7H48TlPTzTCvUk+9hZ74=";
|
||||
name = "jl-stats";
|
||||
contain = config.containers.${name};
|
||||
pg = config.services.postgresql.package;
|
||||
most-winningest = inputs.most-winningest.packages."${config.nixpkgs.system}".default.override {
|
||||
postgresql = pg;
|
||||
};
|
||||
|
||||
cargoHash = "sha256-5Wbx/RBqtDmJUKdLXttryMuJfpkUJwRGTFYP3UFEPT0=";
|
||||
}) {};
|
||||
in {
|
||||
in
|
||||
{
|
||||
vacu.databases.${name}.authByIp = contain.localAddress;
|
||||
|
||||
networking.firewall.extraCommands = ''
|
||||
@@ -52,7 +40,9 @@ in {
|
||||
isReadOnly = false;
|
||||
};
|
||||
|
||||
config = { pkgs, ... }: {
|
||||
config =
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
system.stateVersion = "23.11";
|
||||
|
||||
networking.useHostResolvConf = false;
|
||||
@@ -75,7 +65,12 @@ in {
|
||||
};
|
||||
script = ''
|
||||
cd ${most-winningest.src}
|
||||
${pkgs.diesel-cli.override { sqliteSupport = false; mysqlSupport = false; }}/bin/diesel migration run --locked-schema
|
||||
${
|
||||
pkgs.diesel-cli.override {
|
||||
sqliteSupport = false;
|
||||
mysqlSupport = false;
|
||||
}
|
||||
}/bin/diesel migration run --locked-schema
|
||||
cd /${name}
|
||||
${most-winningest}/bin/${most-winningest.pname}
|
||||
'';
|
||||
@@ -86,6 +81,10 @@ in {
|
||||
timerConfig.OnBootSec = "5m";
|
||||
timerConfig.OnUnitInactiveSec = "1h";
|
||||
};
|
||||
|
||||
environment.systemPackages = [
|
||||
pg # provides psql binary, helpful for debugging
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
@@ -1,4 +1,11 @@
|
||||
{ config, pkgs, inputs, lib, ... }: {
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
inputs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
{
|
||||
networking.firewall.allowedTCPPorts = [ 636 ];
|
||||
|
||||
services.postgresql = {
|
||||
@@ -8,9 +15,7 @@
|
||||
ensureDBOwnership = true;
|
||||
}
|
||||
];
|
||||
ensureDatabases = [
|
||||
"kanidm"
|
||||
];
|
||||
ensureDatabases = [ "kanidm" ];
|
||||
};
|
||||
|
||||
environment.systemPackages = [ config.services.kanidm.package ]; # adds the binary to the PATH
|
||||
@@ -26,7 +31,11 @@
|
||||
|
||||
users.users.kanidm.extraGroups = [ "acme" ];
|
||||
|
||||
services.kanidm = let tls_dir = config.security.acme.certs."shelvacu.com".directory; in rec {
|
||||
services.kanidm =
|
||||
let
|
||||
tls_dir = config.security.acme.certs."shelvacu.com".directory;
|
||||
in
|
||||
rec {
|
||||
package = inputs.nixpkgs-unstable.legacyPackages.x86_64-linux.kanidm;
|
||||
enableServer = true;
|
||||
serverSettings = {
|
||||
|
@@ -1,5 +1,13 @@
|
||||
{ config, pkgs, inputs, lib, ... }:
|
||||
let contain = config.containers.keycloak; in
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
inputs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
contain = config.containers.keycloak;
|
||||
in
|
||||
{
|
||||
vacu.databases.keycloak.authByIp = contain.localAddress;
|
||||
|
||||
@@ -19,7 +27,17 @@ let contain = config.containers.keycloak; in
|
||||
ephemeral = false;
|
||||
restartIfChanged = true;
|
||||
|
||||
config = let outer_config = config; in { config, pkgs, lib, ... }: {
|
||||
config =
|
||||
let
|
||||
outer_config = config;
|
||||
in
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
{
|
||||
system.stateVersion = "23.11";
|
||||
networking.firewall.enable = false;
|
||||
|
||||
|
@@ -1,14 +1,21 @@
|
||||
# Partially based on https://astro.github.io/microvm.nix/simple-network.html
|
||||
{ config, lib, ... }: let
|
||||
{ config, lib, ... }:
|
||||
let
|
||||
bridge = config.vacu.network.lan_bridge;
|
||||
lan_port = "eno1";
|
||||
in {
|
||||
doof-wg = config.vacu.network.doof-wg;
|
||||
in
|
||||
{
|
||||
options = {
|
||||
vacu.network.lan_bridge = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "br-main";
|
||||
readOnly = true;
|
||||
};
|
||||
vacu.network.doof-wg = lib.mkOption {
|
||||
default = "doof-wg";
|
||||
readOnly = true;
|
||||
};
|
||||
};
|
||||
config = {
|
||||
networking.useNetworkd = true;
|
||||
@@ -28,6 +35,22 @@ in {
|
||||
};
|
||||
};
|
||||
|
||||
systemd.network.netdevs.${doof-wg} = {
|
||||
netdevConfig = {
|
||||
Name = doof-wg;
|
||||
Kind = "wireguard";
|
||||
};
|
||||
extraConfig = ''
|
||||
[WireGuard]
|
||||
PrivateKeyFile = ${config.sops.secrets.wireguard_key.path}
|
||||
|
||||
[WireGuardPeer]
|
||||
PublicKey = shel/wMBU/Ut2rhAZymW/AYG3ycGfaEN6R2LsEpkqDU=
|
||||
AllowedIPs = 0.0.0.0/0
|
||||
Endpoint = tun-sea.doof.net:53263
|
||||
'';
|
||||
};
|
||||
|
||||
systemd.network.networks."01-lan-bridge".extraConfig = ''
|
||||
DHCP = no
|
||||
Address = 172.83.159.53/32
|
||||
@@ -52,7 +75,7 @@ in {
|
||||
|
||||
networking.nat = {
|
||||
enable = true;
|
||||
internalInterfaces = ["ve-+"];
|
||||
internalInterfaces = [ "ve-+" ];
|
||||
externalInterface = bridge;
|
||||
enableIPv6 = false;
|
||||
};
|
||||
|
@@ -2,7 +2,8 @@
|
||||
#
|
||||
# to build© to binary cache:
|
||||
# nix copy --to 'file:///trip/nix-binary-cache?parallel-compression=true&secret-key=/root/cache-priv-key.pem&want-mass-query=true&write-nar-listing=true' .#nixosConfigurations."compute-deck".config.system.build.toplevel
|
||||
{ config, ... }: {
|
||||
{ config, lib, ... }:
|
||||
{
|
||||
containers.nix-cache-nginx = {
|
||||
privateNetwork = true;
|
||||
hostAddress = "192.168.100.12";
|
||||
@@ -16,7 +17,17 @@
|
||||
isReadOnly = true;
|
||||
};
|
||||
|
||||
config = let outer_config = config; in { config, pkgs, lib, ... }: {
|
||||
config =
|
||||
let
|
||||
outer_config = config;
|
||||
in
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
{
|
||||
system.stateVersion = "23.11";
|
||||
networking.firewall.enable = false;
|
||||
services.nginx.enable = true;
|
||||
@@ -27,4 +38,5 @@
|
||||
};
|
||||
};
|
||||
};
|
||||
vacu.nix.caches.nixcache-shelvacu.url = lib.mkForce "file:///trip/nix-binary-cache";
|
||||
}
|
20
triple-dezert/sops.nix
Normal file
20
triple-dezert/sops.nix
Normal file
@@ -0,0 +1,20 @@
|
||||
{
|
||||
inputs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = [ inputs.sops-nix.nixosModules.sops ];
|
||||
|
||||
options.vacu.secretsFolder = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
default = ../secrets;
|
||||
};
|
||||
|
||||
config = {
|
||||
sops.defaultSopsFile = config.vacu.secretsFolder + "/${config.vacu.hostName}/main.yaml";
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
sops.secrets.wireguard_key = {};
|
||||
};
|
||||
}
|
@@ -1,7 +1,14 @@
|
||||
{ config, pkgs, inputs, lib, ... }:
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
inputs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
contain = config.containers.keycloak;
|
||||
in {
|
||||
contain = config.containers.keycloak;
|
||||
in
|
||||
{
|
||||
systemd.tmpfiles.settings.asdf."/trip/static-stuff".d = {
|
||||
mode = "0744";
|
||||
};
|
||||
@@ -19,7 +26,9 @@ in {
|
||||
isReadOnly = true;
|
||||
};
|
||||
|
||||
config = { pkgs, ... }: {
|
||||
config =
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
system.stateVersion = "23.11";
|
||||
networking.firewall.enable = false;
|
||||
|
||||
|
@@ -1,4 +1,5 @@
|
||||
{ config, ... }: {
|
||||
{ config, ... }:
|
||||
{
|
||||
vacu.databases.nextcloud = {
|
||||
user = "ncadmin";
|
||||
authByIp = config.containers.vacustore.localAddress;
|
||||
@@ -24,15 +25,23 @@
|
||||
isReadOnly = false;
|
||||
};
|
||||
|
||||
config = let outer_config = config; in { config, pkgs, lib, ... }: {
|
||||
config =
|
||||
let
|
||||
outer_config = config;
|
||||
in
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
{
|
||||
system.stateVersion = "22.05";
|
||||
|
||||
networking.firewall.enable = false;
|
||||
networking.useHostResolvConf = lib.mkForce false;
|
||||
services.resolved.enable = true;
|
||||
|
||||
systemd.services.nextcloud-setup.after = [ "network-online.target" ];
|
||||
|
||||
services.nginx.virtualHosts."vacu.store".extraConfig = ''
|
||||
client_body_timeout 5m;
|
||||
'';
|
||||
@@ -41,69 +50,74 @@
|
||||
|
||||
services.nextcloud = {
|
||||
enable = true;
|
||||
package = pkgs.nextcloud28;
|
||||
package = pkgs.nextcloud29;
|
||||
configureRedis = true;
|
||||
hostName = "vacu.store";
|
||||
datadir = "/ncdata";
|
||||
logLevel = 1;
|
||||
https = true;
|
||||
maxUploadSize = "1000G";
|
||||
database.createLocally = false;
|
||||
|
||||
extraApps = {
|
||||
inherit (config.services.nextcloud.package.packages.apps) calendar notes tasks contacts;
|
||||
appointments = pkgs.fetchNextcloudApp {
|
||||
appName = "appointments";
|
||||
url = "https://github.com/SergeyMosin/Appointments/raw/v2.1.4/build/artifacts/appstore/appointments.tar.gz";
|
||||
sha256 = "sha256-LKxTF6yF7n6t34KzRRRqsf1doqS7DaKPmqscmNmtzAg=";
|
||||
appVersion = "2.1.4";
|
||||
license = "agpl3";
|
||||
};
|
||||
inherit (config.services.nextcloud.package.packages.apps)
|
||||
calendar
|
||||
notes
|
||||
tasks
|
||||
contacts
|
||||
;
|
||||
# appointments = pkgs.fetchNextcloudApp {
|
||||
# appName = "appointments";
|
||||
# url = "https://github.com/SergeyMosin/Appointments/raw/v2.1.4/build/artifacts/appstore/appointments.tar.gz";
|
||||
# sha256 = "sha256-LKxTF6yF7n6t34KzRRRqsf1doqS7DaKPmqscmNmtzAg=";
|
||||
# appVersion = "2.1.4";
|
||||
# license = "gpl3";
|
||||
# };
|
||||
gpoddersync = pkgs.fetchNextcloudApp {
|
||||
appName = "gpoddersync";
|
||||
url = "https://github.com/thrillfall/nextcloud-gpodder/releases/download/3.8.2/gpoddersync.tar.gz";
|
||||
sha256 = "sha256-eeBvRZUDVIaym0ngfPD2d7aY3SI/7lPWkrYPnqSh5Kw=";
|
||||
appVersion = "3.8.2";
|
||||
license = "agpl3";
|
||||
url = "https://github.com/thrillfall/nextcloud-gpodder/releases/download/3.9.0/gpoddersync.tar.gz";
|
||||
sha256 = "sha256-wLiM8kv+HinOoAebarQ9MwuxqUpVeF0zS2RVYpAoYMI=";
|
||||
appVersion = "3.9.0";
|
||||
license = "gpl3";
|
||||
};
|
||||
webapppassword = pkgs.fetchNextcloudApp {
|
||||
appName = "webapppassword";
|
||||
url = "https://github.com/digital-blueprint/webapppassword/releases/download/v23.12.0/webapppassword.tar.gz";
|
||||
sha256 = "sha256-nQUHEm+cvTmRS2ECZK4lk7YAd+2gUYTFcu44A967kY4=";
|
||||
appVersion = "23.12.0";
|
||||
license = "agpl3";
|
||||
url = "https://github.com/digital-blueprint/webapppassword/releases/download/v24.6.0/webapppassword.tar.gz";
|
||||
sha256 = "sha256-x9uARo/VtkFLabif2/GZhs4cG6qmhAJs93dzhFFmhB0=";
|
||||
appVersion = "24.6.0";
|
||||
license = "gpl3";
|
||||
};
|
||||
# oidc_login = pkgs.fetchNextcloudApp {
|
||||
# appName = "oidc_login";
|
||||
# url = "https://github.com/pulsejet/nextcloud-oidc-login/releases/download/v3.0.2/oidc_login.tar.gz";
|
||||
# sha256 = "sha256-cN5azlThKPKRVip14yfUNR85of5z+N6NVI7sg6pSGQI=";
|
||||
# appVersion = "3.0.2";
|
||||
# license = "agpl3";
|
||||
# license = "gpl3";
|
||||
# };
|
||||
# sociallogin = pkgs.fetchNextcloudApp {
|
||||
# appName = "sociallogin";
|
||||
# url = "https://github.com/zorn-v/nextcloud-social-login/releases/download/v5.6.3/release.tar.gz";
|
||||
# sha256 = "sha256-XHHD87InU9P5uq9zCJnFliHhWh5tpSpSnMMOfNgJKRw=";
|
||||
# appVersion = "5.6.3";
|
||||
# license = "gpl3";
|
||||
# };
|
||||
sociallogin = pkgs.fetchNextcloudApp {
|
||||
appName = "sociallogin";
|
||||
url = "https://github.com/zorn-v/nextcloud-social-login/releases/download/v5.6.3/release.tar.gz";
|
||||
sha256 = "sha256-XHHD87InU9P5uq9zCJnFliHhWh5tpSpSnMMOfNgJKRw=";
|
||||
appVersion = "5.6.3";
|
||||
license = "agpl3";
|
||||
};
|
||||
};
|
||||
|
||||
phpOptions."opcache.interned_strings_buffer" = "32";
|
||||
|
||||
config = {
|
||||
trustedProxies = [ outer_config.containers.vacustore.hostAddress ];
|
||||
adminpassFile = "/etc/admin_password";
|
||||
dbtype = "pgsql";
|
||||
dbuser = "ncadmin";
|
||||
dbhost = outer_config.containers.vacustore.hostAddress;
|
||||
dbname = "nextcloud";
|
||||
dbtableprefix = "oc_";
|
||||
overwriteProtocol = "https";
|
||||
defaultPhoneRegion = "US";
|
||||
};
|
||||
|
||||
extraOptions = {
|
||||
settings = {
|
||||
loglevel = 1;
|
||||
default_phone_region = "US";
|
||||
overwriteprotocol = "https";
|
||||
trusted_proxies = [ outer_config.containers.vacustore.hostAddress ];
|
||||
allow_user_to_change_display_name = false;
|
||||
lost_password_link = "disabled";
|
||||
oidc_login_provider_url = "https://id.shelvacu.com/oauth2/openid/vacustore/";
|
||||
|
@@ -1,26 +0,0 @@
|
||||
# https://astro.github.io/microvm.nix/host.html
|
||||
{ pkgs, inputs, config, self, ... }: {
|
||||
imports = [
|
||||
inputs.microvm.nixosModules.host
|
||||
];
|
||||
|
||||
microvm.host.enable = true;
|
||||
# https://gitlab.com/virtio-fs/virtiofsd/-/issues/121
|
||||
microvm.virtiofsd.inodeFileHandles = "mandatory";
|
||||
|
||||
assertions = [{
|
||||
assertion = config.networking.useNetworkd;
|
||||
message = "microvm setup requires networkd";
|
||||
}];
|
||||
|
||||
microvm.vms.devver2 = {
|
||||
autostart = true;
|
||||
flake = inputs.self;
|
||||
updateFlake = "git+file:///etc/nixos#devver";
|
||||
};
|
||||
|
||||
# systemd.network.networks."20-devver" = {
|
||||
# matchConfig.name = "vm-devver";
|
||||
# networkConfig.Bridge = config.vacu.network.lan_bridge;
|
||||
# };
|
||||
}
|
Reference in New Issue
Block a user