jasmine/dotfiles.nix
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

refactor nixos

Browse source
This commit is contained in:
♥ Minnie ♥ 2024-01-21 21:03:57 +08:00
parent 064c099b16
commit 186ace4edd
14 changed files with 175 additions and 290 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
nixos/common/global/age.nix Normal file
View file

@ -0,0 +1,24 @@
{ config, pkgs, ... }:
let
hostname = config.networking.hostName;
in
{
environment.systemPackages = with pkgs; [
agenix-rekey
];
age = {
# Master identity used for decryption
rekey.masterIdentities = [ ../users/sajenim/agenix-rekey.pub ];
# Pubkey for rekeying
rekey.hostPubkey = ../../${hostname}/ssh_host_ed25519_key.pub;
# As user not a trusted-users in our nix.conf
# we must add age.rekey.cacheDir as a global extra sandbox path
rekey.cacheDir = "/var/tmp/agenix-rekey/\"$UID\"";
};
# Required to persist `/var/tmp/agenix-rekey`
environment.persistence."/persist".directories = [
{ directory = "/var/tmp/agenix-rekey"; mode = "1777"; }
];
}

11
nixos/common/global/default.nix
View file

@ -1,14 +1,21 @@
{ outputs, ... }:
{ inputs, outputs, ... }:
{
imports = [
inputs.home-manager.nixosModules.home-manager
inputs.agenix.nixosModules.default
inputs.agenix-rekey.nixosModules.default
./age.nix
./env.nix
./nix.nix
./ssh.nix
./system-tools.nix
];
nixpkgs = {
overlays = [
# Overlays exported from other flakes
inputs.agenix-rekey.overlays.default
# Overlays our own flake exports
outputs.overlays.additions
outputs.overlays.modifications
outputs.overlays.unstable-packages

3
nixos/common/global/system-tools.nix → nixos/common/global/env.nix
View file

@ -2,6 +2,8 @@
{
environment = {
binsh = "${pkgs.bash}/bin/bash";
shells = with pkgs; [ zsh ];
systemPackages = with pkgs; [
# Ensure home-manager is on all systems
home-manager
@ -25,5 +27,6 @@
unrar # extract roshal archive
unzip # extract zip archive
];
pathsToLink = [ "/share/zsh" ];
};
}

1
nixos/common/global/ssh.nix
View file

@ -7,7 +7,6 @@
PermitRootLogin = "no";
PasswordAuthentication = false;
};
ports = [ 48654 ];
openFirewall = true;
};
}

24
nixos/common/optional/key.nix Normal file
View file

@ -0,0 +1,24 @@
{ pkgs, ... }:
{
environment.systemPackages = with pkgs; [
# Configure your YubiKey via the command line
yubikey-manager
# Enables files to be encrypted to age identities stored on YubiKeys
age-plugin-yubikey
];
# GPG and SSH support
services.udev.packages = [ pkgs.yubikey-personalization ];
programs.gnupg.agent = {
enable = true;
enableSSHSupport = true;
};
# Use our yubikey as a user login or for sudo access
security.pam.services = {
login.u2fAuth = true;
sudo.u2fAuth = true;
};
}

7
nixos/common/optional/persist.nix
View file

@ -1,6 +1,10 @@
{ ... }:
{ inputs, ... }:
{
imports = [
inputs.impermanence.nixosModules.impermanence
];
# Files and directories we with to keep between reboots
environment.persistence."/persist" = {
hideMounts = true;
@ -19,4 +23,5 @@
"/etc/ssh/ssh_host_ed25519_key.pub"
];
};
programs.fuse.userAllowOther = true;
}

44
nixos/common/optional/wireguard/default.nix Normal file
View file

@ -0,0 +1,44 @@
{ pkgs, config, ... }:
{
age.secrets.wireguard = {
rekeyFile = ./private.age;
owner = "root";
group = "root";
};
networking = {
nat = {
enable = true;
externalInterface = "wlp2s0";
internalInterfaces = [ "wg0" ];
};
wireguard.interfaces = {
wg0 = {
# IP address and subnet of the server's end of the tunnel interface
ips = [ "10.100.0.1/24" ];
listenPort = 51820;
# This allows the wireguard server to route your traffic to the internet and hence be like a VPN
# For this to work you have to set the dnsserver IP of your router (or dnsserver of choice) in your clients
postSetup = ''
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o wlp2s0 -j MASQUERADE
'';
# This undoes the above command
postShutdown = ''
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o wlp2s0 -j MASQUERADE
'';
# Path to the private key file.
privateKeyFile = config.age.secrets.wireguard.path;
peers = [
{ # Pixel 6 Pro
publicKey = "VaXMnFAXdbJCllNY5sIjPp9AcSM7ap2oA0tU9SIMK3E=";
allowedIPs = [ "10.100.0.2/32" ];
}
{ # Samsung S23 Ultra
publicKey = "dL91i7+VDWfeLCOr53JlzQ32WJ3lRJGqdecoqUpEnlQ=";
allowedIPs = [ "10.100.0.3/32" ];
}
];
};
};
};
}

8
nixos/common/optional/wireguard/private.age Normal file
View file

@ -0,0 +1,8 @@
age-encryption.org/v1
-> piv-p256 hdSnGw A/NcMAzxWqwfIj8WgcgfTBJvEnL5WgdKHwUnYfXN68pi
P6/BFTnqTakpTcVNayWomuXrE8E8dSHftODD+3E8aps
-> ]@Y:GoO$-grease 6
v+HE7AkcnlS/pBdhL19CdYHTJGL7EZrvPfRs8j54LnxzJ9hjaBtydX4N/sIo6mjI
444BncysktRop1LB7A
--- 0sHzYGeQ0FGC5gJFdFNs5PZfVuR5cleMoPz7ry29fXU
qZçöóQ3Â’DF;žõ±þCÊ6%Æ«âspïgSRmP¾4»Œ8]:ÌMZåPƒ»G>òd«Å—g?ß(¢Œ93öM¯7÷,

1
nixos/common/users/sajenim/agenix-rekey.pub Normal file
View file

@ -0,0 +1 @@
AGE-PLUGIN-YUBIKEY-1S6XLYQYZSH22WXCHDCFRJ

10
nixos/common/users/sajenim/default.nix
View file

@ -1,16 +1,12 @@
{ inputs, outputs, pkgs, ... }:
{ inputs, outputs, pkgs, config, ... }:
{
imports = [
"${inputs.self}/nixos/common/optional/steam.nix"
];
users.users.sajenim = {
isNormalUser = true;
extraGroups = [ "audio" "docker" "networkmanager" "wheel" ];
shell = pkgs.zsh;
openssh.authorizedKeys.keyFiles = [
"${inputs.self}/home-manager/sabrina/id_ed25519.pub"
"${inputs.self}/home-manager/sajenim/sajenim_sk.pub"
];
hashedPassword = "$y$j9T$qIhW5qL9J9w.w6JWa.bGo/$oddG3HJyOZ1mwHzYnYPJ/MzN38oHEBEvPDc0sB3rAf9";
};
@ -19,7 +15,7 @@
home-manager = {
extraSpecialArgs = { inherit inputs outputs; };
users = {
sajenim = import "${inputs.self}/home-manager/sajenim/home.nix";
sajenim = import "${inputs.self}/home-manager/sajenim/${config.networking.hostName}.nix";
};
};
}

55
nixos/fuchsia/configuration.nix
View file

@ -1,12 +1,11 @@
{ inputs, pkgs, ... }:
{ pkgs, ... }:
{
imports = [
inputs.impermanence.nixosModules.impermanence
inputs.home-manager.nixosModules.home-manager
../common/global
../common/users/sajenim
../common/optional/key.nix
../common/optional/steam.nix
./hardware-configuration.nix
];
@ -48,55 +47,13 @@
networkmanager.enable = true;
};
fonts = {
packages = with pkgs; [
fantasque-sans-mono
fira-code
ibm-plex
inconsolata
iosevka
jetbrains-mono
];
};
environment = {
# Symlink /bin/sh to POSIX-Complient shell
binsh = "${pkgs.bash}/bin/bash";
shells = with pkgs; [ zsh ];
# Install packages, prefix with 'unstable.' to use overlay
systemPackages = with pkgs; [
# Audio
pulsemixer
# Code editors
emacs vscode
# Browsers
firefox
# Graphics
gimp inkscape krita
# Printing
blender freecad openscad prusa-slicer
# Misc
openrgb protonup-ng
# Hardware
libratbag piper
];
# Completions for system packages
pathsToLink = [ "/share/zsh" ];
};
programs = {
zsh.enable = true;
gnupg.agent = {
enable = true;
enableSSHSupport = true;
};
fuse.userAllowOther = true;
direnv.enable = true;
};
services = {
udev.packages = with pkgs; [
yubikey-personalization
openrgb
qmk-udev-rules
];
@ -113,6 +70,7 @@
displayManager.startx.enable = true;
};
ratbagd.enable = true;
pcscd.enable = true;
};
virtualisation.docker = {
@ -120,11 +78,6 @@
liveRestore = false;
};
security.pam.services = {
login.u2fAuth = true;
sudo.u2fAuth = true;
};
# https://nixos.wiki/wiki/FAQ/When_do_I_update_stateVersion
system.stateVersion = "22.11";
}

1
nixos/fuchsia/hardware-configuration.nix
View file

@ -31,7 +31,6 @@
];
networking.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}

201
nixos/viridian/configuration.nix
View file

@ -1,121 +1,21 @@
# This is your system's configuration file.
# Use this to configure your system environment (it replaces /etc/nixos/configuration.nix)
{ outputs, pkgs, ... }:
{
inputs,
outputs,
lib,
config,
pkgs,
...
}: {
# You can import other NixOS modules here
imports = [
# If you want to use modules your own flake exports (from modules/nixos):
# outputs.nixosModules.example
outputs.nixosModules.qbittorrent
../common/global
../common/users/sajenim
../common/optional/wireguard
# Or modules from other flakes (such as nixos-hardware):
# You can also split up your configuration and import pieces of it here:
# ./users.nix
# Import common configurations
../common/system-tools.nix
# Import containers
./containers/dashboard
./containers/microbin
./containers/multimedia
# Import services
./services/adguardhome
./services/borgbackup
./services/home-assistant
./services/minecraft-server
./services/traefik
# Import your generated (nixos-generate-config) hardware configuration
./services
./containers
./hardware-configuration.nix
outputs.nixosModules.qbittorrent
];
age.secrets.wireguard = {
# Private key for wireguard
file = inputs.self + /secrets/wireguard.age;
owner = "root";
group = "root";
};
nixpkgs = {
# You can add overlays here
overlays = [
# Add overlays your own flake exports (from overlays and pkgs dir):
outputs.overlays.additions
outputs.overlays.modifications
outputs.overlays.unstable-packages
# You can also add overlays exported from other flakes:
# neovim-nightly-overlay.overlays.default
# Or define it inline, for example:
# (final: prev: {
# hi = final.hello.overrideAttrs (oldAttrs: {
# patches = [ ./change-hello-to-hi.patch ];
# });
# })
];
# Configure your nixpkgs instance
config = {
# Disable if you don't want unfree packages
allowUnfree = true;
packageOverrides = pkgs: {
# enable vaapi on OS-level
vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; };
};
};
};
nix = {
gc = {
# Automatically run the garbage collector an a specified time.
automatic = true;
dates = "weekly";
options = "--delete-older-than 30d";
};
# This will add each flake input as a registry
# To make nix3 commands consistent with your flake
registry = lib.mapAttrs (_: value: {flake = value;}) inputs;
# This will additionally add your inputs to the system's legacy channels
# Making legacy nix commands consistent as well, awesome!
nixPath = lib.mapAttrsToList (key: value: "${key}=${value.to.path}") config.nix.registry;
settings = {
# Enable flakes and new 'nix' command
experimental-features = "nix-command flakes";
# Deduplicate and optimize nix store
auto-optimise-store = true;
};
};
# Select internationalisation properties
i18n.defaultLocale = "en_AU.UTF-8";
# Set timezone
time.timeZone = "Australia/Perth";
boot = {
loader = {
systemd-boot.enable = true;
efi = {
canTouchEfiVariables = true;
efiSysMountPoint = "/boot/efi";
};
};
kernel.sysctl = {
# Allow listening on TCP & UDP ports below 1024
boot.kernel.sysctl = {
"net.ipv4.ip_unprivileged_port_start" = 0;
};
};
hardware.opengl = {
enable = true;
@ -124,21 +24,13 @@
vaapiIntel
vaapiVdpau
libvdpau-va-gl
intel-compute-runtime # OpenCL filter support (hardware tonemapping and subtitle burn-in)
intel-compute-runtime
];
};
networking = {
hostName = "viridian";
domain = "kanto.dev";
networkmanager.enable = true;
# Required for wireguard
nat = {
enable = true;
externalInterface = "wlp2s0";
internalInterfaces = [ "wg0" ];
};
# Setup our firewall
firewall = {
enable = true;
allowedTCPPorts = [
@ -155,82 +47,15 @@
51820 # Wireguard
];
};
# Setup our Home network VPN
wireguard.interfaces = {
wg0 = {
# IP address and subnet of the server's end of the tunnel interface
ips = [ "10.100.0.1/24" ];
listenPort = 51820;
# This allows the wireguard server to route your traffic to the internet and hence be like a VPN
# For this to work you have to set the dnsserver IP of your router (or dnsserver of choice) in your clients
postSetup = ''
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o wlp2s0 -j MASQUERADE
'';
# This undoes the above command
postShutdown = ''
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o wlp2s0 -j MASQUERADE
'';
# Path to the private key file.
privateKeyFile = config.age.secrets.wireguard.path;
peers = [
{ # Pixel 6 Pro
publicKey = "VaXMnFAXdbJCllNY5sIjPp9AcSM7ap2oA0tU9SIMK3E=";
# List of IPs assigned to this peer within the tunnel subnet.
allowedIPs = [ "10.100.0.2/32" ];
}
{ # Samsung S23 Ultra
publicKey = "dL91i7+VDWfeLCOr53JlzQ32WJ3lRJGqdecoqUpEnlQ=";
allowedIPs = [ "10.100.0.3/32" ];
}
];
};
};
};
# Setup environment
environment = {
# Symlink /bin/sh to POSIX-Complient shell
binsh = "${pkgs.bash}/bin/bash";
shells = with pkgs; [ zsh ];
# Install packages, prefix with 'unstable.' to use overlay
systemPackages = with pkgs; [
agenix.packages."${system}".default
];
};
programs = {
zsh.enable = true;
};
services = {
# This setups a SSH server. Very important if you're setting up a headless system.
# Feel free to remove if you don't need it.
openssh = {
virtualisation.docker = {
enable = true;
# Forbid root login through SSH.
settings.PermitRootLogin = "no";
# Use keys only. Remove if you want to SSH using password (not recommended)
settings.PasswordAuthentication = false;
};
};
# Virtualisation
virtualisation.docker.enable = true;
# Configure your system-wide user settings (groups, etc), add more users as needed.
users = {
users = {
# System administator
sabrina = {
isNormalUser = true;
extraGroups = [ "networkmanager" "wheel" "media" "docker" ];
openssh.authorizedKeys.keyFiles = [
../../home-manager/sajenim/id_ed25519_sk.pub
];
shell = pkgs.zsh;
};
};
liveRestore = false;
};
# https://nixos.wiki/wiki/FAQ/When_do_I_update_stateVersion

55
nixos/viridian/hardware-configuration.nix
View file

@ -1,49 +1,46 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{ config, lib, ... }:
{
imports =
[ (modulesPath + "/installer/scan/not-detected.nix")
imports = [
../common/optional/ephemeral-btrfs.nix
];
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/d9639ca2-617b-4b9f-9b6f-cc103a666b7e";
fsType = "ext4";
boot = {
initrd = {
availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
kernelModules = [ "kvm-intel" ];
};
loader = {
systemd-boot.enable = true;
efi = {
canTouchEfiVariables = true;
efiSysMountPoint = "/boot";
};
};
};
fileSystems."/boot/efi" =
{ device = "/dev/disk/by-uuid/93DA-2CCC";
fileSystems."/boot" = {
device = "/dev/disk/by-label/ESP";
fsType = "vfat";
};
fileSystems."/mnt/data" =
{ device = "/dev/disk/by-uuid/3548fbc6-6efd-4ed1-acc1-bd3ffed9d7a7";
fileSystems."/mnt/data" = {
device = "/dev/disk/by-label/data";
fsType = "ext4";
};
fileSystems."/mnt/backup" =
{ device = "/dev/disk/by-uuid/443fcb5a-b814-4d33-8cfb-93f6ff4aca11";
fileSystems."/mnt/backup" = {
device = "/dev/disk/by-label/backup";
fsType = "ext4";
};
swapDevices = [
{ device = "/swap/swapfile";
size = 16*1024;
}
];
swapDevices = [ ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.eno1.useDHCP = lib.mkDefault true;
# networking.interfaces.wlp2s0.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;