From 18396e3ad43455caeb857707065f12b5033e1b00 Mon Sep 17 00:00:00 2001 From: jasmine Date: Fri, 30 May 2025 15:46:35 +0800 Subject: [PATCH 01/11] remove allowlist --- nixos/viridian/services/crowdsec/default.nix | 18 ------------------ 1 file changed, 18 deletions(-) diff --git a/nixos/viridian/services/crowdsec/default.nix b/nixos/viridian/services/crowdsec/default.nix index 8a2b363..2201c29 100644 --- a/nixos/viridian/services/crowdsec/default.nix +++ b/nixos/viridian/services/crowdsec/default.nix @@ -97,24 +97,6 @@ in { ]; }; - environment.etc = { - "/crowdsec/parsers/s02-enrich/whitelist.yaml" = { - text = '' - name: "sajenim/whitelist" - description: "Whitelist events from my ipv4 addresses" - whitelist: - reason: "my ipv4 ranges" - ip: - - "127.0.0.1" - cidr: - - "192.168.0.0/16" - - "10.0.0.0/8" - - "172.16.0.0/12" - ''; - mode = "0755"; - }; - }; - environment.persistence."/persist" = { directories = [ { From 827c0e930b524416040ae312bcfc38ce8ed11638 Mon Sep 17 00:00:00 2001 From: jasmine Date: Fri, 30 May 2025 15:47:34 +0800 Subject: [PATCH 02/11] chore: update to 25.05 --- home-manager/sajenim/features/cli/zsh.nix | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/home-manager/sajenim/features/cli/zsh.nix b/home-manager/sajenim/features/cli/zsh.nix index bf3757a..db0ddea 100644 --- a/home-manager/sajenim/features/cli/zsh.nix +++ b/home-manager/sajenim/features/cli/zsh.nix @@ -16,10 +16,6 @@ enableCompletion = true; dotDir = ".config/zsh"; - # Commands that should be added to to top of '.zshrc' - initExtraFirst = '' - ''; - # Aliases shellAliases = { c = "clear"; @@ -44,7 +40,7 @@ ]; # Extra commands that should be added to '.zshrc' - initExtra = '' + initContent = '' eval "$(direnv hook zsh)" source ${pkgs.zsh-vi-mode}/share/zsh-vi-mode/zsh-vi-mode.plugin.zsh path+=('/home/sajenim/.repositories/sysadmin.sh/bin') From 0789a2eb7166140d97de8d02cc1eb09d1e1ed781 Mon Sep 17 00:00:00 2001 From: jasmine Date: Fri, 30 May 2025 15:48:02 +0800 Subject: [PATCH 03/11] fix wallpaper location --- home-manager/sajenim/features/desktop/xinitrc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/home-manager/sajenim/features/desktop/xinitrc b/home-manager/sajenim/features/desktop/xinitrc index e8738c0..c96d774 100644 --- a/home-manager/sajenim/features/desktop/xinitrc +++ b/home-manager/sajenim/features/desktop/xinitrc @@ -4,7 +4,7 @@ xrandr --output HDMI-A-0 --mode 1920x1080 --rotate left --output DisplayPort-0 --mode 2560x1440 --right-of HDMI-A-0 # Apply our wallpaper -feh --bg-center ~/.repositories/nix-config/assets/chinatown.png --bg-center ~/.repositories/nix-config/assets/chinatown-rotated.png +feh --bg-center ~/.repositories/forgejo/nix-config/assets/chinatown.png --bg-center ~/.repositories/forgejo/nix-config/assets/chinatown-rotated.png # Disable screen saver and DPMS features xset s off -dpms From c5509145e5d98234d8ffe7bd4f7d8fe251450a4f Mon Sep 17 00:00:00 2001 From: jasmine Date: Fri, 30 May 2025 15:49:10 +0800 Subject: [PATCH 04/11] install some extra tools --- home-manager/sajenim/features/cli/nvim.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/home-manager/sajenim/features/cli/nvim.nix b/home-manager/sajenim/features/cli/nvim.nix index 79c27cf..ec42d69 100644 --- a/home-manager/sajenim/features/cli/nvim.nix +++ b/home-manager/sajenim/features/cli/nvim.nix @@ -5,12 +5,12 @@ }: { home.packages = [ # Toolchain - pkgs.gcc - pkgs.python313Full - - # Setup developer environments pkgs.direnv - pkgs.unstable.devenv + pkgs.gcc + pkgs.pandoc + pkgs.python313Full + pkgs.texliveFull + # Install our nixvim configuration for neovim. inputs.nixvim.packages.${pkgs.system}.default From 3987f2fed271cb2a01e6a642e150b44a48c048ed Mon Sep 17 00:00:00 2001 From: jasmine Date: Fri, 30 May 2025 15:50:28 +0800 Subject: [PATCH 05/11] chore: bump inputs --- flake.lock | 44 ++++++++++++++++++++++---------------------- flake.nix | 4 ++-- 2 files changed, 24 insertions(+), 24 deletions(-) diff --git a/flake.lock b/flake.lock index 740ae95..decffff 100644 --- a/flake.lock +++ b/flake.lock @@ -406,16 +406,16 @@ ] }, "locked": { - "lastModified": 1747331121, - "narHash": "sha256-3MmiUN/jOHBHQUnjqzg6qKArc17j2OS6jisEppDY4g8=", + "lastModified": 1748487945, + "narHash": "sha256-e9zc/rHdoH9i+sFFhhQiKoF6IuD+T2rB/nUyPaO7CCg=", "owner": "nix-community", "repo": "home-manager", - "rev": "1eec32f0efe3b830927989767a9e6ece0d82d608", + "rev": "0d13ea58d565d3c1c1468ddae1f623316dc395d9", "type": "github" }, "original": { "owner": "nix-community", - "ref": "release-24.11", + "ref": "release-25.05", "repo": "home-manager", "type": "github" } @@ -494,11 +494,11 @@ "nixpkgs": "nixpkgs_3" }, "locked": { - "lastModified": 1747620481, - "narHash": "sha256-MiZ5Z7MHP42+ck277fzzu4C8w1K6OAxM5PhCQX22+FA=", + "lastModified": 1748570485, + "narHash": "sha256-oDnEc/rxyDf+uUXO56Z2TJtrrQoBe0Z4MCIRaY6lVZ0=", "owner": "Infinidoge", "repo": "nix-minecraft", - "rev": "b15bd5c18f94065f96b5a46e57c506e5f30c3918", + "rev": "6c961ee42ff2301ee61c75aa42cbe8c8adecf3c8", "type": "github" }, "original": { @@ -555,11 +555,11 @@ }, "nixpkgs-unstable": { "locked": { - "lastModified": 1747542820, - "narHash": "sha256-GaOZntlJ6gPPbbkTLjbd8BMWaDYafhuuYRNrxCGnPJw=", + "lastModified": 1748370509, + "narHash": "sha256-QlL8slIgc16W5UaI3w7xHQEP+Qmv/6vSNTpoZrrSlbk=", "owner": "nixos", "repo": "nixpkgs", - "rev": "292fa7d4f6519c074f0a50394dbbe69859bb6043", + "rev": "4faa5f5321320e49a78ae7848582f684d64783e9", "type": "github" }, "original": { @@ -602,16 +602,16 @@ }, "nixpkgs_4": { "locked": { - "lastModified": 1747485343, - "narHash": "sha256-YbsZyuRE1tobO9sv0PUwg81QryYo3L1F3R3rF9bcG38=", + "lastModified": 1748437600, + "narHash": "sha256-hYKMs3ilp09anGO7xzfGs3JqEgUqFMnZ8GMAqI6/k04=", "owner": "nixos", "repo": "nixpkgs", - "rev": "9b5ac7ad45298d58640540d0323ca217f32a6762", + "rev": "7282cb574e0607e65224d33be8241eae7cfe0979", "type": "github" }, "original": { "owner": "nixos", - "ref": "nixos-24.11", + "ref": "nixos-25.05", "repo": "nixpkgs", "type": "github" } @@ -703,11 +703,11 @@ "nixvim": "nixvim_2" }, "locked": { - "lastModified": 1747625133, - "narHash": "sha256-CcLAy4g4RTxetDoaEVxQ05PLnRXUj3snYQoMdpk7GEQ=", + "lastModified": 1747738086, + "narHash": "sha256-FZlSk1Jo0ofRIaA5H6hNCW6qaQUpVtpn4SF5I9VOMIw=", "ref": "refs/heads/master", - "rev": "a05b6e401c09b7d5eadd15e39dc97398bc3cf85d", - "revCount": 80, + "rev": "b8526d77c09f09847fc28e2b3352291e5771e742", + "revCount": 81, "type": "git", "url": "https://git.sajenim.dev/jasmine/nixvim-config.git" }, @@ -998,11 +998,11 @@ "nixpkgs": "nixpkgs_9" }, "locked": { - "lastModified": 1747628408, - "narHash": "sha256-529qpELpG4D7pNslmyX3FszqjzxhJvlxTWTRJ0EA9YE=", + "lastModified": 1747754433, + "narHash": "sha256-TGH+IhbDPuJ4nnWveRmXL5+R2SAgu5nUvm2M1534rRc=", "ref": "refs/heads/master", - "rev": "fa9754e0b61a1a9b586dcaa1d1b989d7861f6c68", - "revCount": 35, + "rev": "abf0c78203f7644b4cca9a72fadefd142ab89604", + "revCount": 36, "type": "git", "url": "https://git.sajenim.dev/jasmine/xmonad-config.git" }, diff --git a/flake.nix b/flake.nix index 850a726..05862bb 100644 --- a/flake.nix +++ b/flake.nix @@ -3,12 +3,12 @@ inputs = { # Nixpkgs - nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11"; + nixpkgs.url = "github:nixos/nixpkgs/nixos-25.05"; nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable"; # Home manager home-manager = { - url = "github:nix-community/home-manager/release-24.11"; + url = "github:nix-community/home-manager/release-25.05"; inputs.nixpkgs.follows = "nixpkgs"; }; From f7fcccac4a8053ba9bab4ee94d56ad5bdb7af61f Mon Sep 17 00:00:00 2001 From: jasmine Date: Wed, 4 Jun 2025 23:38:48 +0800 Subject: [PATCH 06/11] install murmur --- nixos/viridian/services/default.nix | 1 + nixos/viridian/services/murmur/default.nix | 22 ++++++++++++++++++++++ 2 files changed, 23 insertions(+) create mode 100644 nixos/viridian/services/murmur/default.nix diff --git a/nixos/viridian/services/default.nix b/nixos/viridian/services/default.nix index 888754b..1135b94 100644 --- a/nixos/viridian/services/default.nix +++ b/nixos/viridian/services/default.nix @@ -7,6 +7,7 @@ ./lighttpd ./minecraft ./mpd + ./murmur ./traefik ]; } diff --git a/nixos/viridian/services/murmur/default.nix b/nixos/viridian/services/murmur/default.nix new file mode 100644 index 0000000..cd2d80f --- /dev/null +++ b/nixos/viridian/services/murmur/default.nix @@ -0,0 +1,22 @@ +{...}: { + services.murmur = { + enable = true; + port = 64738; + openFirewall = true; + stateDir = "/var/lib/murmur"; + + # Stuff + registerName = "Kanto Network"; + welcometext = "I choose you!"; + }; + + environment.persistence."/persist" = { + directories = [ + { + directory = "/var/lib/murmur"; + user = "murmur"; + group = "murmur"; + } + ]; + }; +} From 7b981cc126dab44e137622d807d8e040a1c9155f Mon Sep 17 00:00:00 2001 From: jasmine Date: Fri, 6 Jun 2025 18:31:08 +0800 Subject: [PATCH 07/11] setup irc network --- nixos/viridian/configuration.nix | 7 +- nixos/viridian/services/default.nix | 1 + nixos/viridian/services/inspircd/default.nix | 10 + .../viridian/services/inspircd/inspircd.conf | 643 ++++++++++++++++++ .../viridian/services/inspircd/inspircd.motd | 37 + 5 files changed, 695 insertions(+), 3 deletions(-) create mode 100644 nixos/viridian/services/inspircd/default.nix create mode 100644 nixos/viridian/services/inspircd/inspircd.conf create mode 100644 nixos/viridian/services/inspircd/inspircd.motd diff --git a/nixos/viridian/configuration.nix b/nixos/viridian/configuration.nix index 078d937..a6e4b7e 100644 --- a/nixos/viridian/configuration.nix +++ b/nixos/viridian/configuration.nix @@ -24,9 +24,10 @@ enable = true; allowPing = true; allowedTCPPorts = [ - 80 - 443 - 6600 + 80 # http + 443 # https + 6600 # mpd + 6667 # inspircd ]; }; }; diff --git a/nixos/viridian/services/default.nix b/nixos/viridian/services/default.nix index 1135b94..085e7f7 100644 --- a/nixos/viridian/services/default.nix +++ b/nixos/viridian/services/default.nix @@ -3,6 +3,7 @@ ./borgbackup ./crowdsec ./forgejo + ./inspircd ./jupyterhub ./lighttpd ./minecraft diff --git a/nixos/viridian/services/inspircd/default.nix b/nixos/viridian/services/inspircd/default.nix new file mode 100644 index 0000000..4fdaaa4 --- /dev/null +++ b/nixos/viridian/services/inspircd/default.nix @@ -0,0 +1,10 @@ +{...}: { + services.inspircd = { + enable = true; + config = builtins.readFile ./inspircd.conf; + }; + + environment.etc = { + "inspircd/inspircd.motd".source = ./inspircd.motd; + }; +} diff --git a/nixos/viridian/services/inspircd/inspircd.conf b/nixos/viridian/services/inspircd/inspircd.conf new file mode 100644 index 0000000..fa9fc8c --- /dev/null +++ b/nixos/viridian/services/inspircd/inspircd.conf @@ -0,0 +1,643 @@ +#-#-#-#-#-#-#-#-#-#-#-#- SERVER DESCRIPTION -#-#-#-#-#-#-#-#-#-#-#-#- +# # +# Here is where you enter the information about your server. # +# # + + + + +#-#-#-#-#-#-#-#-#-#-#-#- ADMIN INFORMATION -#-#-#-#-#-#-#-#-#-#-#-# +# # +# Describes the Server Administrator's real name (optionally), # +# nick, and email address. # +# # + + + + +#-#-#-#-#-#-#-#-#-#-#-#- PORT CONFIGURATION -#-#-#-#-#-#-#-#-#-#-#- +# # +# Configure the port and address bindings here. # +# # + + + + +#-#-#-#-#-#-#-#-#-#- CONNECTIONS CONFIGURATION -#-#-#-#-#-#-#-#-#-#-# +# # +# This is where you can configure which connections are allowed # +# and denied access onto your server. The password is optional. # +# You may have as many of these as you require. To allow/deny all # +# connections, use a '*' or 0.0.0.0/0. # +# # +# -- It is important to note that connect tags are read from the -- # +# TOP DOWN. This means that you should have more specific deny # +# and allow tags at the top, progressively more general, followed # +# by a (should you wish to have one). # +# # +# Connect blocks are searched twice for each user - once when the TCP # +# connection is accepted, and once when the user completes their # +# registration. Most of the information (hostname, ident response, # +# password, TLS (SSL) when using STARTTLS, etc) is only available # +# during the second search. If you are trying to make a closed server # +# you will probably need a connect block just for user registration. # +# This can be done by using # + + + + + +#-#-#-#-#-#-#-#-#-#-#-#- CIDR CONFIGURATION -#-#-#-#-#-#-#-#-#-#-#- +# # +# CIDR configuration allows detection of clones and applying of # +# throttle limits across a CIDR range. (A CIDR range is a group of # +# IPs, for example, the CIDR range 192.168.1.0-192.168.1.255 may be # +# represented as 192.168.1.0/24). This means that abuse across an ISP # +# is detected and curtailed much easier. Here is a good chart that # +# shows how many IPs the different CIDRs correspond to: # +# https://en.wikipedia.org/wiki/IPv4_subnetting_reference # +# https://en.wikipedia.org/wiki/IPv6_subnetting_reference # +# # + + + + +#-#-#-#-#-#-#-#-#-#- MISCELLANEOUS CONFIGURATION -#-#-#-#-#-#-#-#-#-# +# # + +# Files block - contains files whose contents are used by the ircd +# +# motd - displayed on connect and when a user executes /MOTD +# Modules can also define their own files + + +#-#-#-#-#-#-#-#-#-#-#-#-#-#-# DNS SERVER -#-#-#-#-#-#-#-#-#-#-#-#-#-#-# +# If these values are not defined, InspIRCd uses the default DNS resolver +# of your system. + + + +#-#-#-#-#-#-#-#-#-#-#-#-#- LIST MODE LIMITS #-#-#-#-#-#-#-#-#-#-#-#-#-# +# # +# The tag is used customise the maximum number of each list # +# mode that can be set on a channel. # +# The tags are read from top to bottom and the list mode limit from # +# the first tag found which matches the channel name and mode type is # +# applied to that channel. # +# It is advisable to put an entry with the channel as '*' at the # +# bottom of the list. If none are specified or no maxlist tag is # +# matched, the banlist size defaults to 100 entries. # +# # + +# Allows all channels and list modes not previously matched to have +# up to 100 entries. + + +#-#-#-#-#-#-#-#-#-#-#-#-#- SERVER OPTIONS -#-#-#-#-#-#-#-#-#-#-#-#-# +# # +# Settings to define which features are usable on your server. # +# # + + tags without an address. Choices are + # ipv4 or ipv6; if not specified, IPv6 will be used if your system has support, + # falling back to IPv4 otherwise. + defaultbind="auto" + + # hostintopic: If enabled, channels will show the host of the topic setter + # in the topic. If set to no, it will only show the nick of the topic setter. + hostintopic="yes" + + # pingwarning: If a server does not respond to a ping within this period, + # it will send a notice to opers with snomask +l informing that the server + # is about to ping timeout. + pingwarning="15" + + # serverpingfreq: How often pings are sent between servers. + serverpingfreq="1m" + + # splitwhois: Whether to split private/secret channels from normal channels + # in WHOIS responses. Possible values for this are: + # 'no' - list all channels together in the WHOIS response regardless of type. + # 'split' - split private/secret channels to a separate WHOIS response numeric. + # 'splitmsg' - the same as split but also send a message explaining the split. + splitwhois="no" + + # defaultmodes: The modes to set on a channel when it is created. See + # https://docs.inspircd.org/3/channel-modes/ for a list of channel + # modes. If a prefix mode is included in this option it will be set on + # the user that created the channel. The example below sets channel + # modes n (noextmsg) and t (topiclock) and grants channel prefix mode + # o (op) to the channel creator. + defaultmodes="not" + + # xlinemessage: This is the text that is sent to a user when they are + # banned from the server. + xlinemessage="You're banned! Email irc@example.com with the ERROR line below for help." + + # allowzerolimit: If enabled then allow a limit of 0 to be set on channels. + # This is non-standard behaviour and should only be enabled if you need to + # link with servers running 2.0. Defaults to yes. + allowzerolimit="no" + + # modesinlist: If enabled then the current channel modes will be shown + # in the /LIST response. Defaults to yes. + modesinlist="no" + + # exemptchanops: Allows users with with a status mode to be exempt + # from various channel restrictions. Possible restrictions are: + # - anticaps Channel mode +B - blocks messages with too many capital + # letters (requires the anticaps module). + # - auditorium-see Permission required to see the full user list of + # a +u channel (requires the auditorium module). + # - auditorium-vis Permission required to be visible in a +u channel + # (requires the auditorium module). + # - blockcaps Channel mode +B - blocks messages with too many capital + # letters (requires the blockcaps module). + # - blockcolor Channel mode +c - blocks messages with formatting codes + # (requires the blockcolor module). + # - censor Channel mode +G - censors messages based on the network + # configuration (requires the censor module). + # - delaymsg Channel mode +d - blocks sending messages until specified + # seconds have passed since user join + # - filter Channel mode +g - blocks messages containing the given + # glob mask (requires the chanfilter module). + # - flood Channel mode +f - kicks (and bans) on text flood of a + # specified rate (requires the messageflood module). + # - nickflood Channel mode +F - blocks nick changes after a specified + # rate (requires the nickflood module). + # - noctcp Channel mode +C - blocks any CTCPs to the channel + # (requires the noctcp module). + # - nonick Channel mode +N - prevents users on the channel from + # changing nicks (requires the nonicks module). + # - nonotice Channel mode +T - blocks /NOTICEs to the channel + # (requires the nonotice module). + # - regmoderated Channel mode +M - blocks unregistered users from + # speaking (requires the services account module). + # - stripcolor Channel mode +S - strips formatting codes from + # messages (requires the stripcolor module). + # - topiclock Channel mode +t - limits changing the topic to (half)ops + # You can also configure this on a per-channel basis with a channel mode and + # even negate the configured exemptions below. + # See exemptchanops in modules.conf.example for more details. + exemptchanops="censor:o filter:o nickflood:o nonick:v regmoderated:o" + + # invitebypassmodes: This allows /INVITE to bypass other channel modes. + # (Such as +k, +j, +l, etc.) + invitebypassmodes="yes" + + # nosnoticestack: This prevents snotices from 'stacking' and giving you + # the message saying '(last message repeated X times)'. Defaults to no. + nosnoticestack="no"> + + +#-#-#-#-#-#-#-#-#-#-#-# PERFORMANCE CONFIGURATION #-#-#-#-#-#-#-#-#-#-# +# # + + + +#-#-#-#-#-#-#-#-#-#-#-# SECURITY CONFIGURATION #-#-#-#-#-#-#-#-#-#-#-# +# # + +