Richie/dotfiles
1
0
Fork 0
mirror of https://github.com/RichieCahill/dotfiles.git synced 2026-04-21 14:49:10 -04:00
Code Issues Packages Projects Releases Wiki Activity

Compare commits

base: Richie:feature/decreasing-cloud-flair-usage
Branches Tags
Richie:main Richie:feature/removing-brain_substituter.nix-from-bob Richie:feature/creating-prompt_bench Richie:claude/add-line-counter-tool-zaW28 Richie:feature/setting-up-bluesky-firehose Richie:claude/sheet-music-ocr-mxml-4OGMU Richie:feature/adding-congress-data-to-database Richie:claude/improve-code-coverage-aW1aD Richie:claude/implement-todo-item-w2KGe Richie:feature/adding-open_webui-to-jeeves Richie:feature/testing-unshare Richie:bugfix/fixed-energy-out-integrations Richie:feature/adding-fix_eval_warnings.yml Richie:feature/building-safe_reboot Richie:feature/fixing-jeeves-locked-linux-firmware-and-6.12.52 Richie:feature/adding-cool-tools Richie:feature/adding-xf86_input_wacom Richie:feature/adding-making-esphome-battery-more-stable Richie:feature/linux-6.17 Richie:bugfix/added-math-the-jeeves Richie:feature/improving-treefmt-action-debugging Richie:feature/added-merge_group Richie:feature/testing-merge_group Richie:feature/removing-auto-update Richie:feature/linux-6.15 Richie:feature/setting-up-unifi-video-archiving Richie:feature/updating-system_tools Richie:feature/decreasing-cloud-flair-usage Richie:feature/creating-a-custom-installer-iso Richie:feature/setting-up-mxr-deploment Richie:feature/adding-system-for-brendan Richie:feature/testing-microvm Richie:feature/testing-cosmic Richie:feature/building-nixos-based-router Richie:feature/setting-up-transmission Richie:feature/improving-muninns-bluetooth Richie:intresting-error Richie:feature/setting-up-keyFile-for-muninn Richie:feature/setting-up-cleves-for-muninn Richie:feature/testing-tang-and-clevis Richie:feature/testing-nixos-router Richie:updating-bobs-zfs-settings
..
compare: Richie:feature/testing-nixos-router
Branches Tags
Richie:main Richie:feature/removing-brain_substituter.nix-from-bob Richie:feature/creating-prompt_bench Richie:claude/add-line-counter-tool-zaW28 Richie:feature/setting-up-bluesky-firehose Richie:claude/sheet-music-ocr-mxml-4OGMU Richie:feature/adding-congress-data-to-database Richie:claude/improve-code-coverage-aW1aD Richie:claude/implement-todo-item-w2KGe Richie:feature/adding-open_webui-to-jeeves Richie:feature/testing-unshare Richie:bugfix/fixed-energy-out-integrations Richie:feature/adding-fix_eval_warnings.yml Richie:feature/building-safe_reboot Richie:feature/fixing-jeeves-locked-linux-firmware-and-6.12.52 Richie:feature/adding-cool-tools Richie:feature/adding-xf86_input_wacom Richie:feature/adding-making-esphome-battery-more-stable Richie:feature/linux-6.17 Richie:bugfix/added-math-the-jeeves Richie:feature/improving-treefmt-action-debugging Richie:feature/added-merge_group Richie:feature/testing-merge_group Richie:feature/removing-auto-update Richie:feature/linux-6.15 Richie:feature/setting-up-unifi-video-archiving Richie:feature/updating-system_tools Richie:feature/decreasing-cloud-flair-usage Richie:feature/creating-a-custom-installer-iso Richie:feature/setting-up-mxr-deploment Richie:feature/adding-system-for-brendan Richie:feature/testing-microvm Richie:feature/testing-cosmic Richie:feature/building-nixos-based-router Richie:feature/setting-up-transmission Richie:feature/improving-muninns-bluetooth Richie:intresting-error Richie:feature/setting-up-keyFile-for-muninn Richie:feature/setting-up-cleves-for-muninn Richie:feature/testing-tang-and-clevis Richie:feature/testing-nixos-router Richie:updating-bobs-zfs-settings

5 Commits
feature/de ... feature/te

Author SHA1 Message Date
Richie Cahill
4a456c5a06 bootstrapping 2024-10-25 16:54:01 -04:00
Richie Cahill
8d78862326 sorted haproxy.cfg 2024-10-25 16:50:34 -04:00
Richie Cahill
090c14ed47 enabled firewall on jeeves 2024-10-25 16:50:34 -04:00
Richie Cahill
cc7c44203c enabled firewall on rhapsody-in-green 2024-10-25 16:50:34 -04:00
Richie Cahill
e5239304e7 enabled firewall on bob 2024-10-25 16:50:34 -04:00
97 changed files with 1516 additions and 2431 deletions
Expand all files Collapse all files

26
.github/workflows/build_systems.yml vendored
View File

@@ -1,26 +0,0 @@
name: build_systems
on:
workflow_dispatch:
pull_request:
push:
branches: [main]
schedule:
- cron: "0 22 * * *"
jobs:
build:
name: build-${{ matrix.system }}
runs-on: self-hosted
strategy:
matrix:
system:
- "bob"
- "jeeves"
- "rhapsody-in-green"
steps:
- uses: actions/checkout@v4
- name: Build default package
run: "nixos-rebuild build --flake ./#${{ matrix.system }}"
- name: copy to nix-cache
run: nix copy --to ssh://jeeves .#nixosConfigurations.${{ matrix.system }}.config.system.build.toplevel

24
.github/workflows/kernel_packages_update.sh vendored Normal file
View File

@@ -0,0 +1,24 @@
#!/bin/bash
# Update ZFS package to match the latest supported Linux kernel version
echo "geting latest ZFS version"
raw_zfs_max_kernel_version=$(curl -s https://raw.githubusercontent.com/openzfs/zfs/master/META | grep Linux-Maximum | cut -d" " -f2)
zfs_max_kernel_version="${raw_zfs_max_kernel_version//./_}"
echo "geting latest ZFS version"
if grep "linuxPackages_$zfs_max_kernel_version" systems/common/global/default.nix; then
echo "No changes needed"
exit 0
fi
sed -i "s/linuxPackages_6_[0-9]\+/linuxPackages_$zfs_max_kernel_version/" systems/common/global/default.nix
# Commit the changes
git config user.name "GitHub Actions Bot"
git config user.email "<>"
git add systems/common/global/default.nix
git commit -m "Update Linux kernel and ZFS packages"

27
.github/workflows/kernel_packages_update.yml vendored Normal file
View File

@@ -0,0 +1,27 @@
name: Kernel Packages Update
on:
schedule:
- cron: "0 0 * * *"
workflow_dispatch:
jobs:
create-pull-request:
runs-on: ubuntu-latest
steps:
- name: Check out repository
uses: actions/checkout@v4
- name: Make changes
run: bash ${GITHUB_WORKSPACE}/.github/workflows/kernel_packages_update.sh
- name: Create Pull Request
uses: peter-evans/create-pull-request@v7
with:
token: ${{ secrets.GITHUB_TOKEN }}
commit-message: Base linuxPackages update
title: Base linuxPackages update
body: |
Update linuxPackages
branch: daily-update
delete-branch: true

15
.github/workflows/treefmt.yml vendored
View File

@@ -1,15 +0,0 @@
name: treefmt
on:
workflow_dispatch:
pull_request:
push:
branches: [main]
jobs:
treefmt:
name: nix fmt
runs-on: self-hosted
steps:
- uses: actions/checkout@v4
- name: runs treefmt
run: "treefmt --ci"

22
.github/workflows/update-flake-lock.yml vendored
View File

@@ -1,22 +0,0 @@
name: update-flake-lock
on:
workflow_dispatch:
schedule:
- cron: "0 0 * * *"
jobs:
lockfile:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Install Nix
uses: DeterminateSystems/nix-installer-action@main
- name: Update flake.lock
uses: DeterminateSystems/update-flake-lock@main
with:
token: ${{ secrets.GH_TOKEN_FOR_UPDATES }}
pr-title: "Update flake.lock"
pr-labels: |
dependencies
automated

4
.gitignore vendored
View File

@@ -162,6 +162,4 @@ cython_debug/
#.idea/
test.*
# syncthing
.stfolder
secrets.*

17
.sops.yaml
View File

@@ -1,17 +0,0 @@
keys:
- &admin_richie age1u8zj599elqqvcmhxn8zuwrufsz8w8w366d3ayrljjejljt2q45kq8mxw9c # cspell:disable-line
- &system_bob age1q47vup0tjhulkg7d6xwmdsgrw64h4ax3la3evzqpxyy4adsmk9fs56qz3y # cspell:disable-line
- &system_jeeves age13lmqgc3jvkyah5e3vcwmj4s5wsc2akctcga0lpc0x8v8du3fxprqp4ldkv # cspell:disable-line
- &system_router age1xzxryqq63x65yuza9lmmkud7crjjxpnkdew070yhx6xn7xe4tdws5twxsv # cspell:disable-line
- &system_rhapsody age1ufnewppysaq2wwcl4ugngjz8pfzc5a35yg7luq0qmuqvctajcycs5lf6k4 # cspell:disable-line
creation_rules:
- path_regex: users/secrets\.yaml$
key_groups:
- age:
- *admin_richie
- *system_bob
- *system_jeeves
- *system_router
- *system_rhapsody

61
.vscode/settings.json vendored
View File

@@ -6,9 +6,7 @@
"advplyr",
"ahci",
"aioesphomeapi",
"aiounifi",
"alsa",
"apiclient",
"archlinux",
"ashift",
"asrouter",
@@ -18,15 +16,11 @@
"audiobookshelf",
"auditd",
"autofetch",
"autologin",
"automations",
"autopull",
"autotrim",
"autoupdate",
"azuretools",
"bantime",
"bazarr",
"bgwriter",
"binhex",
"bitwarden",
"blkdiscard",
@@ -37,27 +31,20 @@
"captivedetect",
"cgroupdriver",
"charliermarsh",
"Checkpointing",
"cloudflared",
"codellama",
"codezombiech",
"compactmode",
"Compat",
"contentblocking",
"cookiebanners",
"createdb",
"createrole",
"crlite",
"cryptsetup",
"cuda",
"darkreader",
"datagrip",
"datareporting",
"davidanson",
"dconf",
"dearrow",
"debugpy",
"deepseek",
"dialout",
"diffie",
"direnv",
@@ -65,19 +52,14 @@
"dnodesize",
"dotfiles",
"drawio",
"duckdns",
"eamodio",
"ehci",
"emerg",
"endlessh",
"errorlens",
"esbenp",
"esphome",
"extest",
"fadvise",
"fastforwardteam",
"FASTFOX",
"ffmpegthumbnailer",
"filebot",
"filebrowser",
"fileroller",
@@ -86,10 +68,8 @@
"fmask",
"fontconfig",
"formfill",
"forwardfor",
"foxundermoon",
"FULLSCREEN",
"fwupd",
"fxaccounts",
"gamemode",
"gamescope",
@@ -99,8 +79,6 @@
"globalprivacycontrol",
"gparted",
"gtts",
"gutenprint",
"hass",
"healthreport",
"Heatsink",
"hediet",
@@ -109,9 +87,7 @@
"hmac",
"homeassistant",
"HPKP",
"hplip",
"htmlaboutaddons",
"httpchk",
"hurlenko",
"hwloc",
"INITDB",
@@ -119,19 +95,15 @@
"ioit",
"iperf",
"isal",
"jellyfin",
"jnoortheen",
"jsbc",
"kagi",
"kuma",
"lazer",
"levelname",
"libglvnd",
"libmysqlclient",
"libsodium",
"libssh",
"libvirtd",
"llms",
"localtime",
"louislam",
"lsnew",
@@ -139,13 +111,10 @@
"lynis",
"mangohud",
"markdownlint",
"maxconn",
"maxpages",
"maxretry",
"maxtime",
"mechatroner",
"mediainfo",
"mixtral",
"mklabel",
"mkpart",
"modesetting",
@@ -162,29 +131,22 @@
"Networkd",
"networkmanager",
"newtabpage",
"nixfmt",
"nixos",
"nixpkgs",
"nmap",
"noauto",
"nodev",
"noecho",
"nonsponsored",
"Noto",
"nprt",
"nvme",
"OCSP",
"oderwat",
"ollama",
"ondemand",
"oneshot",
"openwakeword",
"optimise",
"optoutstudies",
"overalljails",
"overscroll",
"overseerr",
"partitionwise",
"pbmode",
"pciutils",
"pcscd",
@@ -192,17 +154,14 @@
"peerconnection",
"PESKYFOX",
"PGID",
"photoprism",
"pipewire",
"pkgs",
"plugdev",
"poppler",
"posixacl",
"powertop",
"primarycache",
"prismlauncher",
"privatebrowsing",
"PRIVOXY",
"protontricks",
"prowlarr",
"proxychains",
"prusa",
@@ -210,10 +169,8 @@
"PUID",
"pulseaudio",
"punycode",
"pychromecast",
"pylance",
"pymetno",
"pyownet",
"qbit",
"qbittorrent",
"qbittorrentvpn",
@@ -221,16 +178,12 @@
"quicksuggest",
"radarr",
"readahead",
"receiveencrypted",
"recordsize",
"Redistributable",
"referer",
"REFERERS",
"relatime",
"Rhosts",
"ripgrep",
"roboto",
"rokuecp",
"routable",
"rspace",
"rtkit",
@@ -252,7 +205,6 @@
"sponsorblock",
"sqltools",
"ssdp",
"SSHOPTS",
"stdenv",
"subresource",
"substituters",
@@ -260,44 +212,35 @@
"sysstat",
"tabmanager",
"tamasfe",
"TCPIP",
"tiktok",
"timonwong",
"titlebar",
"tmmworkshop",
"Tmpfs",
"topsites",
"topstories",
"treefmt",
"torrenting",
"twimg",
"uaccess",
"ublock",
"uiprotect",
"uitour",
"unrar",
"unsubmitted",
"uptimekuma",
"urlbar",
"urlclassifier",
"usbhid",
"usbutils",
"useragent",
"usernamehw",
"userprefs",
"vfat",
"virt",
"virtualisation",
"vpnpromourl",
"wakeonlan",
"webchannel",
"WEBRTC",
"WEBUI",
"wireplumber",
"wireshark",
"Workqueues",
"xattr",
"xhci",
"yazi",
"yubikey",
"yubioath",
"yzhang",

35
common/global/default.nix
View File

@@ -8,9 +8,8 @@
{
imports = [
inputs.home-manager.nixosModules.home-manager
inputs.sops-nix.nixosModules.sops
./docker.nix
./fail2ban.nix
./fonts.nix
./libs.nix
./locale.nix
./nh.nix
@@ -21,9 +20,8 @@
];
boot = {
kernelPackages = lib.mkDefault pkgs.linuxPackages_6_10;
tmp.useTmpfs = true;
kernelPackages = lib.mkDefault pkgs.linuxPackages_6_12;
zfs.package = lib.mkDefault pkgs.zfs_2_3;
};
hardware.enableRedistributableFirmware = true;
@@ -31,34 +29,19 @@
home-manager = {
useGlobalPkgs = true;
useUserPackages = true;
extraSpecialArgs = { inherit inputs outputs; };
backupFileExtension = "backup";
extraSpecialArgs = {inherit inputs outputs;};
};
nixpkgs = {
overlays = builtins.attrValues outputs.overlays;
config.allowUnfree = true;
nixpkgs.config.allowUnfree = true;
programs = {
zsh.enable = true;
fish.enable = true;
};
services = {
# firmware update
fwupd.enable = true;
snapshot_manager.enable = lib.mkDefault true;
zfs = {
trim.enable = lib.mkDefault true;
autoScrub.enable = lib.mkDefault true;
};
};
powerManagement.powertop.enable = lib.mkDefault true;
programs.zsh.enable = true;
security.auditd.enable = lib.mkDefault true;
users.mutableUsers = lib.mkDefault false;
users.mutableUsers = lib.mkDefault true;
zramSwap = {
enable = lib.mkDefault true;

0
common/optional/docker.nix → common/global/docker.nix
View File

12
common/global/fonts.nix
View File

@@ -1,12 +0,0 @@
{ pkgs, ... }:
{
fonts = {
fontconfig.enable = true;
enableDefaultPackages = true;
packages = with pkgs; [
nerd-fonts.roboto-mono
nerd-fonts.intone-mono
nerd-fonts.symbols-only
];
};
}

23
common/global/nix.nix
View File

@@ -2,32 +2,15 @@
inputs,
lib,
...
}:
let
}: let
flakeInputs = lib.filterAttrs (_: lib.isType "flake") inputs;
in
{
in {
nix = {
settings = {
trusted-users = [
"root"
"@wheel"
];
trusted-substituters = [
"https://cache.nixos.org"
"https://cache.tmmworkshop.com"
"https://nix-community.cachix.org"
];
substituters = [
"https://cache.nixos.org/?priority=2&want-mass-query=true"
"https://cache.tmmworkshop.com/?priority=2&want-mass-query=true"
"https://nix-community.cachix.org/?priority=10&want-mass-query=true"
];
trusted-public-keys = [
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
"cache.tmmworkshop.com:jHffkpgbmEdstQPoihJPYW9TQe6jnQbWR2LqkNGV3iA="
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
];
auto-optimise-store = lib.mkDefault true;
experimental-features = [
"nix-command"
@@ -39,7 +22,7 @@ in
};
# Add each flake input as a registry and nix_path
registry = lib.mapAttrs (_: flake: { inherit flake; }) flakeInputs;
registry = lib.mapAttrs (_: flake: {inherit flake;}) flakeInputs;
nixPath = lib.mapAttrsToList (n: _: "${n}=flake:${n}") flakeInputs;
};
}

2
common/global/programs.nix
View File

@@ -2,6 +2,6 @@
{
environment.systemPackages = with pkgs; [
git
python313
python312
];
}

4
common/global/snapshot_config.toml
View File

@@ -6,8 +6,8 @@ monthly = 0
["root_pool/home"]
15_min = 8
hourly = 12
daily = 1
hourly = 24
daily = 14
monthly = 0
["root_pool/root"]

10
common/global/snapshot_manager.nix
View File

@@ -1,10 +1,4 @@
{
inputs,
pkgs,
lib,
config,
...
}:
{ inputs, pkgs, lib, config, ... }:
let
cfg = config.services.snapshot_manager;
in
@@ -47,4 +41,4 @@ in
};
};
};
}
}

2
common/global/ssh.nix
View File

@@ -67,5 +67,5 @@
};
};
networking.firewall.allowedTCPPorts = [ 22 ];
networking.firewall.allowedTCPPorts = [ 22 ];
}

30
common/optional/desktop.nix
View File

@@ -1,26 +1,6 @@
{ pkgs, ... }:
{
boot = {
kernelPackages = pkgs.linuxPackages_6_13;
zfs.package = pkgs.zfs_2_3;
};
hardware.bluetooth = {
enable = true;
powerOnBoot = true;
};
# rtkit is optional but recommended for pipewire
security.rtkit.enable = true;
services = {
displayManager.sddm = {
enable = true;
wayland.enable = true;
};
desktopManager.plasma6.enable = true;
xserver = {
enable = true;
xkb = {
@@ -28,15 +8,5 @@
variant = "";
};
};
pulseaudio.enable = false;
pipewire = {
enable = true;
alsa.enable = true;
alsa.support32Bit = true;
pulse.enable = true;
wireplumber.enable = true;
};
};
}

10
common/optional/printing.nix
View File

@@ -1,10 +0,0 @@
{ pkgs, ... }:
{
services.printing = {
enable = true;
drivers = with pkgs; [
gutenprint
hplip
];
};
}

12
common/optional/steam.nix
View File

@@ -1,9 +1,6 @@
{ pkgs, ... }:
{
environment.systemPackages = with pkgs; [
mangohud
steam-run
];
environment.systemPackages = with pkgs; [mangohud steam-run];
hardware.steam-hardware.enable = true;
programs = {
@@ -13,13 +10,8 @@
gamescopeSession.enable = true;
remotePlay.openFirewall = true;
localNetworkGameTransfers.openFirewall = true;
protontricks.enable = true;
extraCompatPackages = with pkgs; [ proton-ge-bin ];
extraCompatPackages = with pkgs; [proton-ge-bin];
extest.enable = true;
};
gamescope = {
enable = true;
capSysNice = true;
};
};
}

17
common/optional/syncthing_base.nix
View File

@@ -1,18 +1,19 @@
{ lib, ... }:
{
services.syncthing = {
enable = true;
user = "richie";
overrideDevices = true;
overrideFolders = lib.mkDefault true;
overrideFolders = true;
dataDir = "/home/richie/Syncthing";
configDir = "/home/richie/.config/syncthing";
settings.devices = {
phone.id = "TBRULKD-7DZPGGZ-F6LLB7J-MSO54AY-7KLPBIN-QOFK6PX-W2HBEWI-PHM2CQI"; # cspell:disable-line
jeeves.id = "ICRHXZW-ECYJCUZ-I4CZ64R-3XRK7CG-LL2HAAK-FGOHD22-BQA4AI6-5OAL6AG"; # cspell:disable-line
ipad.id = "KI76T3X-SFUGV2L-VSNYTKR-TSIUV5L-SHWD3HE-GQRGRCN-GY4UFMD-CW6Z6AX"; # cspell:disable-line
bob.id = "CJIAPEJ-VO74RR4-F75VU6M-QNZAMYG-FYUJG7Y-6AT62HJ-355PRPL-PJFETAZ"; # cspell:disable-line
rhapsody-in-green.id = "ASL3KC4-3XEN6PA-7BQBRKE-A7JXLI6-DJT43BY-Q4WPOER-7UALUAZ-VTPQ6Q4"; # cspell:disable-line
settings = {
devices = {
phone.id = "LTGPLAE-M4ZDJTM-TZ3DJGY-SLLAVWF-CQDVEVS-RGCS75T-GAPZYK3-KUM6LA5"; # cspell:disable-line
jeeves.id = "ICRHXZW-ECYJCUZ-I4CZ64R-3XRK7CG-LL2HAAK-FGOHD22-BQA4AI6-5OAL6AG"; # cspell:disable-line
ipad.id = "KI76T3X-SFUGV2L-VSNYTKR-TSIUV5L-SHWD3HE-GQRGRCN-GY4UFMD-CW6Z6AX"; # cspell:disable-line
bob.id = "CJIAPEJ-VO74RR4-F75VU6M-QNZAMYG-FYUJG7Y-6AT62HJ-355PRPL-PJFETAZ"; # cspell:disable-line
rhapsody-in-green.id = "ASL3KC4-3XEN6PA-7BQBRKE-A7JXLI6-DJT43BY-Q4WPOER-7UALUAZ-VTPQ6Q4"; # cspell:disable-line
};
};
};
}

14
common/optional/update.nix
View File

@@ -1,9 +1,19 @@
{ lib, ... }:
{
services.autopull = {
enable = lib.mkDefault true;
repo.dotfiles = {
enable = lib.mkDefault true;
ssh-key = lib.mkDefault "/root/.ssh/id_ed25519_ghdeploy";
path = lib.mkDefault /root/dotfiles;
};
};
system.autoUpgrade = {
enable = true;
enable = lib.mkDefault true;
flags = [ "--accept-flake-config" ];
randomizedDelaySec = "1h";
persistent = true;
flake = "github:RichieCahill/dotfiles";
flake = "github:RAD-Development/nix-dotfiles";
};
}

5
common/optional/zerotier.nix
View File

@@ -3,9 +3,4 @@
enable = true;
joinNetworks = [ "e4da7455b2ae64ca" ];
};
nix.settings = {
trusted-substituters = [ "http://192.168.90.40:5000" ];
substituters = [ "http://192.168.90.40:5000/?priority=1&want-mass-query=true" ];
trusted-public-keys = [ "cache.tmmworkshop.com:jHffkpgbmEdstQPoihJPYW9TQe6jnQbWR2LqkNGV3iA=" ];
};
}

142
flake.lock generated
View File

@@ -9,11 +9,11 @@
},
"locked": {
"dir": "pkgs/firefox-addons",
"lastModified": 1743119709,
"narHash": "sha256-tlJY7MfAena/yi3lmd7y7vQGpLma4Q1BLtO4dvzF/Vs=",
"lastModified": 1729414746,
"narHash": "sha256-B7wGWFjIL6/BllPaTXyp31srxG7+4I0hlsBkL6S8pIM=",
"owner": "rycee",
"repo": "nur-expressions",
"rev": "f8861a4b09a181dd88f6626d0202d9225ae85d65",
"rev": "7bd3068e495e1f430e1a640b5f9ee683e4e5e616",
"type": "gitlab"
},
"original": {
@@ -23,6 +23,22 @@
"type": "gitlab"
}
},
"flake-compat": {
"flake": false,
"locked": {
"lastModified": 1717312683,
"narHash": "sha256-FrlieJH50AuvagamEvWMIE6D2OAnERuDboFDYAED/dE=",
"owner": "nix-community",
"repo": "flake-compat",
"rev": "38fd3954cf65ce6faf3d0d45cd26059e059f07ea",
"type": "github"
},
"original": {
"owner": "nix-community",
"repo": "flake-compat",
"type": "github"
}
},
"flake-utils": {
"locked": {
"lastModified": 1629284811,
@@ -43,11 +59,11 @@
"systems": "systems"
},
"locked": {
"lastModified": 1731533236,
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
"lastModified": 1710146030,
"narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
"rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
"type": "github"
},
"original": {
@@ -63,11 +79,11 @@
]
},
"locked": {
"lastModified": 1743267068,
"narHash": "sha256-G7866vbO5jgqMcYJzgbxej40O6mBGQMGt6gM0himjoA=",
"lastModified": 1729414726,
"narHash": "sha256-Dtmm1OU8Ymiy9hVWn/a2B8DhRYo9Eoyx9veERdOBR4o=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "b431496538b0e294fbe44a1441b24ae8195c63f0",
"rev": "fe56302339bb28e3471632379d733547caec8103",
"type": "github"
},
"original": {
@@ -85,11 +101,11 @@
]
},
"locked": {
"lastModified": 1729742964,
"narHash": "sha256-B4mzTcQ0FZHdpeWcpDYPERtyjJd/NIuaQ9+BV1h+MpA=",
"lastModified": 1703863825,
"narHash": "sha256-rXwqjtwiGKJheXB43ybM8NwWB8rO2dSRrEqes0S7F5Y=",
"owner": "nix-community",
"repo": "nix-github-actions",
"rev": "e04df33f62cdcf93d73e9a04142464753a16db67",
"rev": "5163432afc817cf8bd1f031418d1869e4c9d5547",
"type": "github"
},
"original": {
@@ -98,13 +114,36 @@
"type": "github"
}
},
"nixos-cosmic": {
"inputs": {
"flake-compat": "flake-compat",
"nixpkgs": [
"nixpkgs"
],
"nixpkgs-stable": "nixpkgs-stable",
"rust-overlay": "rust-overlay"
},
"locked": {
"lastModified": 1729388162,
"narHash": "sha256-ARCVRKnANfAb1iwGVpNOujXTXsTdyHz80ocFxjpswv8=",
"owner": "lilyinstarlight",
"repo": "nixos-cosmic",
"rev": "1bfff37ff0178721ff4c0a7ed2fb39689b8db796",
"type": "github"
},
"original": {
"owner": "lilyinstarlight",
"repo": "nixos-cosmic",
"type": "github"
}
},
"nixos-hardware": {
"locked": {
"lastModified": 1743167577,
"narHash": "sha256-I09SrXIO0UdyBFfh0fxDq5WnCDg8XKmZ1HQbaXzMA1k=",
"lastModified": 1729417461,
"narHash": "sha256-p0j/sUs7noqZw0W+SEuZXskzOfgOH7yY80ksIM0fCi4=",
"owner": "nixos",
"repo": "nixos-hardware",
"rev": "0ed819e708af17bfc4bbc63ee080ef308a24aa42",
"rev": "8f38d8a4754cf673c2609c4ed399630db87e678b",
"type": "github"
},
"original": {
@@ -116,11 +155,11 @@
},
"nixpkgs": {
"locked": {
"lastModified": 1743095683,
"narHash": "sha256-gWd4urRoLRe8GLVC/3rYRae1h+xfQzt09xOfb0PaHSk=",
"lastModified": 1729256560,
"narHash": "sha256-/uilDXvCIEs3C9l73JTACm4quuHUsIHcns1c+cHUJwA=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "5e5402ecbcb27af32284d4a62553c019a3a49ea6",
"rev": "4c2fcb090b1f3e5b47eaa7bd33913b574a11e0a0",
"type": "github"
},
"original": {
@@ -130,29 +169,29 @@
"type": "github"
}
},
"nixpkgs-master": {
"nixpkgs-stable": {
"locked": {
"lastModified": 1743293199,
"narHash": "sha256-UTEKMh3sbRHVr6ZYIoM7NWQjfrjIGTVOoV2Q4LkLvSk=",
"owner": "nixos",
"lastModified": 1729181673,
"narHash": "sha256-LDiPhQ3l+fBjRATNtnuDZsBS7hqoBtPkKBkhpoBHv3I=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "a2cd41ef5ba904d58f230740f06567ff9506e368",
"rev": "4eb33fe664af7b41a4c446f87d20c9a0a6321fa3",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "master",
"owner": "NixOS",
"ref": "nixos-24.05",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs-stable": {
"nixpkgs-stable_2": {
"locked": {
"lastModified": 1735563628,
"narHash": "sha256-OnSAY7XDSx7CtDoqNh8jwVwh4xNL/2HaJxGjryLWzX8=",
"lastModified": 1729181673,
"narHash": "sha256-LDiPhQ3l+fBjRATNtnuDZsBS7hqoBtPkKBkhpoBHv3I=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "b134951a4c9f3c995fd7be05f3243f8ecd65d798",
"rev": "4eb33fe664af7b41a4c446f87d20c9a0a6321fa3",
"type": "github"
},
"original": {
@@ -177,11 +216,11 @@
"treefmt-nix": "treefmt-nix"
},
"locked": {
"lastModified": 1736884309,
"narHash": "sha256-eiCqmKl0BIRiYk5/ZhZozwn4/7Km9CWTbc15Cv+VX5k=",
"lastModified": 1723343306,
"narHash": "sha256-/6sRkPq7/5weX2y0V8sQ29Sz35nt8kyj+BsFtkhgbJE=",
"owner": "nix-community",
"repo": "poetry2nix",
"rev": "75d0515332b7ca269f6d7abfd2c44c47a7cbca7b",
"rev": "4a1c112ff0c67f496573dc345bd0b2247818fc29",
"type": "github"
},
"original": {
@@ -194,32 +233,32 @@
"inputs": {
"firefox-addons": "firefox-addons",
"home-manager": "home-manager",
"nixos-cosmic": "nixos-cosmic",
"nixos-hardware": "nixos-hardware",
"nixpkgs": "nixpkgs",
"nixpkgs-master": "nixpkgs-master",
"nixpkgs-stable": "nixpkgs-stable",
"sops-nix": "sops-nix",
"nixpkgs-stable": "nixpkgs-stable_2",
"system_tools": "system_tools",
"systems": "systems_3"
}
},
"sops-nix": {
"rust-overlay": {
"inputs": {
"nixpkgs": [
"nixos-cosmic",
"nixpkgs"
]
},
"locked": {
"lastModified": 1742700801,
"narHash": "sha256-ZGlpUDsuBdeZeTNgoMv+aw0ByXT2J3wkYw9kJwkAS4M=",
"owner": "Mic92",
"repo": "sops-nix",
"rev": "67566fe68a8bed2a7b1175fdfb0697ed22ae8852",
"lastModified": 1729304879,
"narHash": "sha256-H7KGGJUU9BcDNnfXiATBGgs6FJKWQdfftNJS+/v2aMU=",
"owner": "oxalica",
"repo": "rust-overlay",
"rev": "b259ef799b5ac014604da71ecd92d4a52603ed2d",
"type": "github"
},
"original": {
"owner": "Mic92",
"repo": "sops-nix",
"owner": "oxalica",
"repo": "rust-overlay",
"type": "github"
}
},
@@ -232,11 +271,11 @@
"poetry2nix": "poetry2nix"
},
"locked": {
"lastModified": 1741571944,
"narHash": "sha256-PM7dz99nb6dDiw/3naRGB/dUl5U7dJVspR9uevhW3xo=",
"lastModified": 1729435836,
"narHash": "sha256-wDhbznFihvVh8sm93HUAeFDw0t8hoe9RGEyWBMkB4yw=",
"owner": "RichieCahill",
"repo": "system_tools",
"rev": "c9979e045bca52ec85a0dc560b238f3e5ae2f01c",
"rev": "84f9ef479e6561fe1daac304cddf195303d855dc",
"type": "github"
},
"original": {
@@ -270,9 +309,8 @@
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
"id": "systems",
"type": "indirect"
}
},
"systems_3": {
@@ -299,11 +337,11 @@
]
},
"locked": {
"lastModified": 1730120726,
"narHash": "sha256-LqHYIxMrl/1p3/kvm2ir925tZ8DkI0KA10djk8wecSk=",
"lastModified": 1719749022,
"narHash": "sha256-ddPKHcqaKCIFSFc/cvxS14goUhCOAwsM1PbMr0ZtHMg=",
"owner": "numtide",
"repo": "treefmt-nix",
"rev": "9ef337e492a5555d8e17a51c911ff1f02635be15",
"rev": "8df5ff62195d4e67e2264df0b7f5e8c9995fd0bd",
"type": "github"
},
"original": {

90
flake.nix
View File

@@ -3,22 +3,21 @@
nixConfig = {
extra-substituters = [
"https://cache.nixos.org/?priority=2&want-mass-query=true"
"https://cache.tmmworkshop.com/?priority=2&want-mass-query=true"
"https://cache.nixos.org/?priority=1&want-mass-query=true"
"https://cache.tmmworkshop.com/?priority=1&want-mass-query=true"
"https://nix-community.cachix.org/?priority=10&want-mass-query=true"
];
extra-trusted-public-keys = [
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" # cspell:disable-line
"cache.tmmworkshop.com:jHffkpgbmEdstQPoihJPYW9TQe6jnQbWR2LqkNGV3iA=" # cspell:disable-line
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" # cspell:disable-line
"cache-nix-dot:Od9KN34LXc6Lu7y1ozzV1kIXZa8coClozgth/SYE7dU=" # cspell:disable-line
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
"cache.tmmworkshop.com:jHffkpgbmEdstQPoihJPYW9TQe6jnQbWR2LqkNGV3iA="
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
"cache-nix-dot:Od9KN34LXc6Lu7y1ozzV1kIXZa8coClozgth/SYE7dU="
];
};
inputs = {
nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-24.05";
nixpkgs-master.url = "github:nixos/nixpkgs/master";
systems.url = "github:nix-systems/default-linux";
nixos-hardware.url = "github:nixos/nixos-hardware/master";
@@ -38,59 +37,50 @@
inputs.nixpkgs.follows = "nixpkgs";
};
sops-nix = {
url = "github:Mic92/sops-nix";
nixos-cosmic = {
url = "github:lilyinstarlight/nixos-cosmic";
inputs.nixpkgs.follows = "nixpkgs";
};
};
outputs =
{
self,
nixpkgs,
home-manager,
systems,
sops-nix,
...
}@inputs:
let
inherit (self) outputs;
lib = nixpkgs.lib // home-manager.lib;
forEachSystem = f: lib.genAttrs (import systems) (system: f pkgsFor.${system});
pkgsFor = lib.genAttrs (import systems) (
system:
outputs = {
self,
nixpkgs,
home-manager,
systems,
nixos-cosmic,
...
} @ inputs: let
inherit (self) outputs;
lib = nixpkgs.lib // home-manager.lib;
forEachSystem = f: lib.genAttrs (import systems) (system: f pkgsFor.${system});
pkgsFor = lib.genAttrs (import systems) (
system:
import nixpkgs {
inherit system;
config.allowUnfree = true;
}
);
in
{
inherit lib;
overlays = import ./overlays { inherit inputs outputs; };
);
in {
inherit lib;
overlays = import ./overlays {inherit inputs outputs;};
devShells = forEachSystem (pkgs: import ./shell.nix { inherit pkgs; });
formatter = forEachSystem (pkgs: pkgs.treefmt);
devShells = forEachSystem (pkgs: import ./shell.nix {inherit pkgs;});
formatter = forEachSystem (pkgs: pkgs.alejandra);
nixosConfigurations = {
bob = lib.nixosSystem {
modules = [
./systems/bob
];
specialArgs = { inherit inputs outputs; };
};
jeeves = lib.nixosSystem {
modules = [
./systems/jeeves
];
specialArgs = { inherit inputs outputs; };
};
rhapsody-in-green = lib.nixosSystem {
modules = [
./systems/rhapsody-in-green
];
specialArgs = { inherit inputs outputs; };
};
nixosConfigurations = {
bob = lib.nixosSystem {
modules = [./systems/bob];
specialArgs = {inherit inputs outputs;};
};
jeeves = lib.nixosSystem {
modules = [./systems/jeeves];
specialArgs = {inherit inputs outputs;};
};
rhapsody-in-green = lib.nixosSystem {
modules = [./systems/rhapsody-in-green];
specialArgs = {inherit inputs outputs;};
};
};
};
}

10
overlays/default.nix
View File

@@ -1,5 +1,4 @@
{ inputs, ... }:
{
{inputs, ...}: {
# When applied, the stable nixpkgs set (declared in the flake inputs) will be accessible through 'pkgs.stable'
stable = final: _prev: {
stable = import inputs.nixpkgs-stable {
@@ -7,11 +6,4 @@
config.allowUnfree = true;
};
};
# When applied, the master nixpkgs set (declared in the flake inputs) will be accessible through 'pkgs.master'
master = final: _prev: {
master = import inputs.nixpkgs-master {
system = final.system;
config.allowUnfree = true;
};
};
}

6
shell.nix
View File

@@ -1,8 +1,4 @@
{
pkgs ? import <nixpkgs> { },
...
}:
{
{pkgs ? import <nixpkgs> {}, ...}: {
default = pkgs.mkShell {
NIX_CONFIG = "extra-experimental-features = nix-command flakes ca-derivations";
nativeBuildInputs = with pkgs; [

43
systems/bob/default.nix
View File

@@ -1,22 +1,17 @@
{
imports = [
../../users/richie
../../users/gaming
../../common/global
../../common/optional/desktop.nix
../../common/optional/docker.nix
../../common/optional/scanner.nix
../../common/optional/steam.nix
../../common/optional/syncthing_base.nix
../../common/optional/systemd-boot.nix
../../common/optional/update.nix
../../common/optional/yubikey.nix
../../common/optional/zerotier.nix
../../common/optional/nvidia.nix
../../common/optional/yubikey.nix
./hardware.nix
./nvidia.nix
./syncthing.nix
./games.nix
./llms.nix
];
networking = {
@@ -26,19 +21,37 @@
networkmanager.enable = true;
};
services = {
displayManager = {
hardware = {
pulseaudio.enable = false;
bluetooth = {
enable = true;
autoLogin = {
user = "gaming";
enable = true;
};
defaultSession = "plasma";
powerOnBoot = true;
};
};
security.rtkit.enable = true;
services = {
displayManager.sddm.enable = true;
openssh.ports = [ 262 ];
snapshot_manager.path = ./snapshot_config.toml;
printing.enable = true;
pipewire = {
enable = true;
alsa.enable = true;
alsa.support32Bit = true;
pulse.enable = true;
};
snapshot_manager.enable = true;
zfs = {
trim.enable = true;
autoScrub.enable = true;
};
};
system.stateVersion = "24.05";

7
systems/bob/games.nix
View File

@@ -1,7 +0,0 @@
{ pkgs, ... }:
{
environment.systemPackages = with pkgs; [
osu-lazer-bin
jellyfin-media-player
];
}

10
systems/bob/hardware.nix
View File

@@ -26,9 +26,6 @@
device = "/dev/disk/by-id/nvme-Samsung_SSD_990_PRO_with_Heatsink_1TB_S73JNJ0X114418B-part2";
bypassWorkqueues = true;
allowDiscards = true;
keyFileSize = 4096;
keyFile = "/dev/disk/by-id/usb-Samsung_Flash_Drive_FIT_0374620080067131-0:0";
fallbackToPassword = true;
};
};
kernelModules = [ "kvm-amd" ];
@@ -51,11 +48,6 @@
fsType = "zfs";
};
"/zfs/models" = {
device = "root_pool/models";
fsType = "zfs";
};
"/boot" = {
device = "/dev/disk/by-uuid/609D-FF29";
fsType = "vfat";
@@ -72,4 +64,4 @@
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}
}

28
systems/bob/llms.nix
View File

@@ -1,28 +0,0 @@
{
services = {
ollama = {
user = "ollama";
enable = true;
loadModels = [
"codellama:7b"
"deepseek-r1:8b"
"deepseek-r1:14b"
"deepseek-r1:32b"
"llama3.2:3b"
"llama2-uncensored:7b"
"mistral-nemo:12b"
"dolphin-mixtral:8x7b"
"qwq:32b"
"Qihoo360-Light-R1-32B"
];
models = "/zfs/models";
acceleration = "cuda";
openFirewall = true;
};
# open-webui = {
# enable = true;
# openFirewall = true;
# host = "0.0.0.0";
# };
};
}

5
common/optional/nvidia.nix → systems/bob/nvidia.nix
View File

@@ -1,15 +1,12 @@
{ config, ... }:
{
nixpkgs.config.cudaSupport = true;
services.xserver.videoDrivers = [ "nvidia" ];
hardware = {
nvidia = {
modesetting.enable = true;
powerManagement.enable = true;
package = config.boot.kernelPackages.nvidiaPackages.beta;
package = config.boot.kernelPackages.nvidiaPackages.production;
nvidiaSettings = true;
open = true;
};
nvidia-container-toolkit.enable = true;
};

29
systems/bob/snapshot_config.toml
View File

@@ -1,29 +0,0 @@
["default"]
15_min = 8
hourly = 24
daily = 0
monthly = 0
["root_pool/home"]
15_min = 8
hourly = 12
daily = 1
monthly = 0
["root_pool/root"]
15_min = 8
hourly = 24
daily = 0
monthly = 0
["root_pool/nix"]
15_min = 4
hourly = 0
daily = 0
monthly = 0
["root_pool/models"]
15_min = 4
hourly = 24
daily = 0
monthly = 0

31
systems/bob/syncthing.nix
View File

@@ -1,7 +1,8 @@
{
{
services.syncthing.settings.folders = {
"dotfiles" = {
path = "/home/richie/dotfiles";
"notes" = {
id = "l62ul-lpweo"; # cspell:disable-line
path = "/home/richie/notes";
devices = [
"jeeves"
"rhapsody-in-green"
@@ -29,5 +30,29 @@
];
fsWatcherEnabled = true;
};
"projects" = {
id = "vyma6-lqqrz"; # cspell:disable-line
path = "/home/richie/projects";
devices = [
"jeeves"
"rhapsody-in-green"
];
fsWatcherEnabled = true;
};
"temp" = {
id = "bob_temp";
path = "/home/richie/temp";
devices = [
"jeeves"
];
fsWatcherEnabled = true;
};
"vault" = {
path = "/home/richie/vault";
devices = [
"rhapsody-in-green"
];
fsWatcherEnabled = true;
};
};
}

39
systems/jeeves/arch_mirror.nix Normal file
View File

@@ -0,0 +1,39 @@
{ inputs, pkgs, ... }:
let
vars = import ./vars.nix;
in
{
users = {
users.arch-mirror = {
isSystemUser = true;
group = "arch-mirror";
};
groups.arch-mirror = {};
};
virtualisation.oci-containers.containers.arch_mirror = {
image = "ubuntu/apache2:latest";
volumes = [
"${../../common/docker_templates}/file_server/sites/:/etc/apache2/sites-enabled/"
"${vars.media_mirror}:/data"
];
ports = [ "800:80" ];
extraOptions = [ "--network=web" ];
autoStart = true;
};
systemd.services.sync_mirror = {
requires = [ "network-online.target" ];
after = [ "network-online.target" ];
wantedBy = [ "multi-user.target" ];
description = "validates startup";
path = [ pkgs.rsync ];
serviceConfig = {
Environment = "MIRROR_DIR=${vars.media_mirror}/archlinux/";
Type = "simple";
User = "arch-mirror";
Group = "arch-mirror";
ExecStart = "${inputs.system_tools.packages.x86_64-linux.default}/bin/sync_mirror";
};
};
}

39
systems/jeeves/default.nix
View File

@@ -1,27 +1,56 @@
let
vars = import ./vars.nix;
in
{
imports = [
../../users/richie
../../common/global
../../common/optional/docker.nix
../../common/optional/ssh_decrypt.nix
../../common/optional/syncthing_base.nix
../../common/optional/zerotier.nix
./arch_mirror.nix
./docker
./services
./hardware.nix
./home_assistant.nix
./networking.nix
./nvidia.nix
./programs.nix
./runners
./services.nix
./syncthing.nix
];
boot.zfs.extraPools = [
"media"
"storage"
"torrenting"
];
services = {
openssh.ports = [ 629 ];
nix-serve = {
enable = true;
secretKeyFile = "${vars.storage_secrets}/services/nix-cache/cache-priv-key.pem";
};
plex = {
enable = true;
dataDir = vars.media_plex;
openFirewall = true;
};
smartd.enable = true;
snapshot_manager.path = ./snapshot_config.toml;
snapshot_manager = {
enable = true;
path = ./snapshot_config.toml;
};
sysstat.enable = true;
zfs = {
trim.enable = true;
autoScrub.enable = true;
};
};
system.stateVersion = "24.05";

15
systems/jeeves/docker/filebrowser.nix Normal file
View File

@@ -0,0 +1,15 @@
let
vars = import ../vars.nix;
in
{
virtualisation.oci-containers.containers.filebrowser = {
image = "hurlenko/filebrowser:latest";
extraOptions = [ "--network=web" ];
volumes = [
"/zfs:/data"
"${vars.media_docker_configs}/filebrowser:/config"
];
autoStart = true;
user = "1000:users";
};
}

71
systems/jeeves/docker/haproxy.cfg Normal file
View File

@@ -0,0 +1,71 @@
global
log stdout format raw local0
# stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
stats timeout 30s
defaults
log global
mode http
retries 3
maxconn 2000
timeout connect 5s
timeout client 50s
timeout server 50s
timeout http-request 10s
timeout http-keep-alive 2s
timeout queue 5s
timeout tunnel 2m
timeout client-fin 1s
timeout server-fin 1s
#Application Setup
frontend ContentSwitching
bind *:80
bind *:443 ssl crt /etc/ssl/certs/cloudflare.pem
mode http
# tmmworkshop.com
acl host_audiobookshelf hdr(host) -i audiobookshelf.tmmworkshop.com
acl host_cache hdr(host) -i cache.tmmworkshop.com
acl host_filebrowser hdr(host) -i filebrowser.tmmworkshop.com
acl host_grafana hdr(host) -i grafana.tmmworkshop.com
acl host_mirror hdr(host) -i mirror.tmmworkshop.com
acl host_photoprism hdr(host) -i photoprism.tmmworkshop.com
acl host_uptime_kuma hdr(host) -i uptimekuma-jeeves.tmmworkshop.com
use_backend audiobookshelf_nodes if host_audiobookshelf
use_backend cache_nodes if host_cache
use_backend filebrowser_nodes if host_filebrowser
use_backend grafana_nodes if host_grafana
use_backend mirror_nodes if host_mirror
use_backend photoprism_nodes if host_photoprism
use_backend uptime_kuma_nodes if host_uptime_kuma
backend audiobookshelf_nodes
mode http
server server audiobookshelf:80
backend cache_nodes
mode http
server server 192.168.90.40:5000
backend grafana_nodes
mode http
server server grafana:3000
backend filebrowser_nodes
mode http
server server filebrowser:8080
backend mirror_nodes
mode http
server server arch_mirror:80
backend photoprism_nodes
mode http
server server photoprism:2342
backend uptime_kuma_nodes
mode http
server server uptime_kuma:3001

54
systems/jeeves/docker/photoprism.nix Normal file
View File

@@ -0,0 +1,54 @@
let
vars = import ../vars.nix;
in
{
virtualisation.oci-containers.containers.photoprism = {
image = "photoprism/photoprism:latest";
volumes = [
"${vars.media_docker_configs}/photoprism:/photoprism/storage"
"${vars.storage_photos}/originals:/photoprism/originals"
"${vars.storage_photos}/import:/photoprism/import"
];
environment = {
PHOTOPRISM_ADMIN_USER="admin";
PHOTOPRISM_AUTH_MODE="password";
PHOTOPRISM_DISABLE_TLS="false";
PHOTOPRISM_DEFAULT_TLS="true";
PHOTOPRISM_ORIGINALS_LIMIT="30000";
PHOTOPRISM_HTTP_COMPRESSION="gzip";
PHOTOPRISM_LOG_LEVEL="info";
PHOTOPRISM_READONLY="false";
PHOTOPRISM_EXPERIMENTAL="false";
PHOTOPRISM_DISABLE_CHOWN="false";
PHOTOPRISM_DISABLE_WEBDAV="false";
PHOTOPRISM_DISABLE_SETTINGS="false";
PHOTOPRISM_DISABLE_TENSORFLOW="false";
PHOTOPRISM_DISABLE_FACES="false";
PHOTOPRISM_DISABLE_CLASSIFICATION="false";
PHOTOPRISM_DISABLE_VECTORS="false";
PHOTOPRISM_DISABLE_RAW="false";
PHOTOPRISM_RAW_PRESETS="false";
PHOTOPRISM_SIDECAR_YAML="true";
PHOTOPRISM_BACKUP_ALBUMS="true";
PHOTOPRISM_BACKUP_DATABASE="true";
PHOTOPRISM_BACKUP_SCHEDULE="daily";
PHOTOPRISM_INDEX_SCHEDULE="";
PHOTOPRISM_AUTO_INDEX="300";
PHOTOPRISM_AUTO_IMPORT= "-1";
PHOTOPRISM_DETECT_NSFW="false";
PHOTOPRISM_UPLOAD_NSFW="true";
PHOTOPRISM_DATABASE_DRIVER="sqlite";
PHOTOPRISM_SITE_CAPTION="AI-Powered Photos App";
PHOTOPRISM_SITE_DESCRIPTION="";
PHOTOPRISM_SITE_AUTHOR="";
PHOTOPRISM_UID="600";
PHOTOPRISM_GID="600";
# PHOTOPRISM_UMASK: 0000
};
environmentFiles = ["${vars.storage_secrets}/docker/photoprism"];
autoStart = true;
dependsOn = [ "photoprism_mariadb" ];
extraOptions = [ "--network=web" ];
};
}

32
systems/jeeves/docker/postgresql.nix Normal file
View File

@@ -0,0 +1,32 @@
let
vars = import ../vars.nix;
in
{
users = {
users.postgres = {
isSystemUser = true;
group = "postgres";
uid = 999;
};
groups.postgres = {
gid = 999;
};
};
# virtualisation.oci-containers.containers = {
# postgres = {
# image = "postgres:16";
# ports = [ "5432:5432" ];
# volumes = [ "${vars.media_database}/postgres:/var/lib/postgresql/data" ];
# environment = {
# POSTGRES_USER = "admin";
# POSTGRES_DB = "archive";
# POSTGRES_INITDB_ARGS = "--auth-host=scram-sha-256";
# };
# environmentFiles = [/root/secrets/docker/postgres];
# autoStart = true;
# user = "postgres:postgres";
# };
# };
}

19
systems/jeeves/docker/prowlarr.nix Normal file
View File

@@ -0,0 +1,19 @@
let
vars = import ../vars.nix;
in
{
networking.firewall = {
allowedTCPPorts = [ 9696 ];
};
virtualisation.oci-containers.containers.prowlarr = {
image = "ghcr.io/linuxserver/prowlarr:latest";
ports = [ "9696:9696" ];
environment = {
PUID = "600";
PGID = "100";
TZ = "America/New_York";
};
volumes = [ "${vars.media_docker_configs}/prowlarr:/config" ];
autoStart = true;
};
}

29
systems/jeeves/docker/qbit.nix Normal file
View File

@@ -0,0 +1,29 @@
let
vars = import ../vars.nix;
in
{
networking.firewall = {
allowedTCPPorts = [ 6881 8082 29432 ];
allowedUDPPorts = [ 6881 ];
};
virtualisation.oci-containers.containers.qbit = {
image = "ghcr.io/linuxserver/qbittorrent:latest";
ports = [
"6881:6881"
"6881:6881/udp"
"8082:8082"
"29432:29432"
];
volumes = [
"${vars.media_docker_configs}/qbit:/config"
"${vars.torrenting_qbit}:/data"
];
environment = {
PUID = "600";
PGID = "100";
TZ = "America/New_York";
WEBUI_PORT = "8082";
};
autoStart = true;
};
}

16
systems/jeeves/docker/qbitvpn.nix
View File

@@ -3,16 +3,11 @@ let
in
{
networking.firewall = {
allowedTCPPorts = [
6882
8081
8118
];
allowedTCPPorts = [ 6882 8081 8118 ];
allowedUDPPorts = [ 6882 ];
};
virtualisation.oci-containers.containers.qbitvpn = {
image = "binhex/arch-qbittorrentvpn:5.0.3-1-01";
devices = [ "/dev/net/tun:/dev/net/tun" ];
image = "binhex/arch-qbittorrentvpn:latest";
extraOptions = [ "--cap-add=NET_ADMIN" ];
ports = [
"6882:6881"
@@ -21,9 +16,8 @@ in
"8118:8118"
];
volumes = [
"${vars.docker_configs}/qbitvpn:/config"
"${vars.qbitvpn}:/data"
"${vars.qbitvpn_scratch}:/data/incomplete"
"${vars.media_docker_configs}/qbitvpn:/config"
"${vars.torrenting_qbitvpn}:/data"
"/etc/localtime:/etc/localtime:ro"
];
environment = {
@@ -41,7 +35,7 @@ in
DELUGE_DAEMON_LOG_LEVEL = "debug";
DELUGE_WEB_LOG_LEVEL = "debug";
};
environmentFiles = [ "${vars.secrets}/docker/qbitvpn" ];
environmentFiles = ["${vars.storage_secrets}/docker/qbitvpn"];
autoStart = true;
};
}

15
systems/jeeves/docker/share.nix
View File

@@ -1,15 +0,0 @@
let
vars = import ../vars.nix;
in
{
virtualisation.oci-containers.containers.share = {
image = "ubuntu/apache2:2.4-22.04_beta";
ports = [ "8091:80" ];
volumes = [
"${../../../common/docker_templates}/file_server/sites/:/etc/apache2/sites-enabled/"
"${vars.share}:/data"
];
extraOptions = [ "--network=web" ];
autoStart = true;
};
}

21
systems/jeeves/docker/sonarr.nix Normal file
View File

@@ -0,0 +1,21 @@
let
vars = import ../vars.nix;
in
{
networking.firewall.allowedTCPPorts = [ 9696 8989 ];
virtualisation.oci-containers.containers.sonarr = {
image = "ghcr.io/linuxserver/sonarr:latest";
ports = [ "8989:8989" ];
environment = {
PUID = "600";
PGID = "100";
TZ = "America/New_York";
};
volumes = [
"${vars.media_docker_configs}/sonarr:/config"
"${vars.storage_plex}/tv:/tv"
"${vars.torrenting_qbitvpn}:/data"
];
autoStart = true;
};
}

16
systems/jeeves/docker/uptime_kuma.nix Normal file
View File

@@ -0,0 +1,16 @@
let
vars = import ../vars.nix;
in
{
virtualisation.oci-containers.containers = {
uptime_kuma = {
image = "louislam/uptime-kuma:latest";
volumes = [
"${vars.media_docker_configs}/uptime_kuma:/app/data"
"/var/run/docker.sock:/var/run/docker.sock"
];
extraOptions = [ "--network=web" ];
autoStart = true;
};
};
}

60
systems/jeeves/docker/web.nix Normal file
View File

@@ -0,0 +1,60 @@
let
vars = import ../vars.nix;
in
{
virtualisation.oci-containers.containers = {
audiobookshelf = {
image = "ghcr.io/advplyr/audiobookshelf:latest";
volumes = [
"${vars.media_docker_configs}/audiobookshelf:/config"
"${vars.media_docker_configs}/audiobookshelf:/metadata"
"${vars.storage_library}/audiobooks:/audiobooks"
"${vars.storage_library}/books:/books"
];
environment = {
TZ = "America/New_York";
};
extraOptions = [ "--network=web" ];
autoStart = true;
};
grafana = {
image = "grafana/grafana-enterprise:latest";
volumes = [ "${vars.media_docker_configs}/grafana:/var/lib/grafana" ];
user = "600:600";
extraOptions = [ "--network=web" ];
autoStart = true;
};
haproxy = {
image = "haproxy:latest";
user = "600:600";
environment = {
TZ = "Etc/EST";
};
volumes = [
"${vars.storage_secrets}/docker/cloudflare.pem:/etc/ssl/certs/cloudflare.pem"
"${./haproxy.cfg}:/usr/local/etc/haproxy/haproxy.cfg"
];
dependsOn = [
"arch_mirror"
"audiobookshelf"
"filebrowser"
"grafana"
"uptime_kuma"
];
extraOptions = [ "--network=web" ];
autoStart = true;
};
cloud_flare_tunnel = {
image = "cloudflare/cloudflared:latest";
user = "600:600";
cmd = [
"tunnel"
"run"
];
environmentFiles = ["${vars.storage_secrets}/docker/cloud_flare_tunnel"];
dependsOn = [ "haproxy" ];
extraOptions = [ "--network=web" ];
autoStart = true;
};
};
}

138
systems/jeeves/hardware.nix
View File

@@ -1,26 +1,6 @@
{ config, lib, modulesPath, ... }:
{
config,
lib,
modulesPath,
...
}:
let
makeLuksDevice = device: {
inherit device;
keyFileSize = 4096;
keyFile = "/dev/disk/by-id/usb-XIAO_USB_Drive_24587CE29074-0:0";
fallbackToPassword = true;
};
makeLuksSSD =
device:
(makeLuksDevice device)
// {
bypassWorkqueues = true;
allowDiscards = true;
};
in
{
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
imports =[ (modulesPath + "/installer/scan/not-detected.nix") ];
boot = {
loader = {
@@ -56,51 +36,77 @@ in
luks.devices = {
# cspell:disable
# Root pool
"luks-root-pool-wwn-0x55cd2e4150f01519-part2" =
makeLuksSSD "/dev/disk/by-id/wwn-0x55cd2e4150f01519-part2";
"luks-root-pool-wwn-0x55cd2e4150f01556-part2" =
makeLuksSSD "/dev/disk/by-id/wwn-0x55cd2e4150f01556-part2";
"luks-root-pool-wwn-0x55cd2e4150f01519-part2" = {
device = "/dev/disk/by-id/wwn-0x55cd2e4150f01519-part2";
bypassWorkqueues = true;
allowDiscards = true;
};
"luks-root-pool-wwn-0x55cd2e4150f01556-part2" = {
device = "/dev/disk/by-id/wwn-0x55cd2e4150f01556-part2";
bypassWorkqueues = true;
allowDiscards = true;
};
# Media pool
"luks-media_pool-nvme-INTEL_SSDPEK1A118GA_BTOC14120V2J118B-part1" =
makeLuksSSD "/dev/disk/by-id/nvme-INTEL_SSDPEK1A118GA_BTOC14120V2J118B-part1";
"luks-media_pool-nvme-INTEL_SSDPEK1A118GA_BTOC14120WAG118B-part1" =
makeLuksSSD "/dev/disk/by-id/nvme-INTEL_SSDPEK1A118GA_BTOC14120WAG118B-part1";
"luks-media_pool-nvme-INTEL_SSDPE2ME012T4_CVMD5130000G1P2HGN-part1" =
makeLuksSSD "/dev/disk/by-id/nvme-INTEL_SSDPE2ME012T4_CVMD5130000G1P2HGN-part1";
"luks-media_pool-nvme-INTEL_SSDPE2ME012T4_CVMD5130000U1P2HGN-part1" =
makeLuksSSD "/dev/disk/by-id/nvme-INTEL_SSDPE2ME012T4_CVMD5130000U1P2HGN-part1";
# Scratch pool
"luks-scratch-pool-ata-CT480BX500SSD1_2314E6C3C01C-part1" =
makeLuksSSD "/dev/disk/by-id/ata-CT480BX500SSD1_2314E6C3C01C-part1";
"luks-scratch-pool-ata-CT480BX500SSD1_2314E6C3C01E-part1" =
makeLuksSSD "/dev/disk/by-id/ata-CT480BX500SSD1_2314E6C3C01E-part1";
"luks-media_pool-nvme-INTEL_SSDPEK1A118GA_BTOC14120V2J118B-part1" = {
device = "/dev/disk/by-id/nvme-INTEL_SSDPEK1A118GA_BTOC14120V2J118B-part1";
bypassWorkqueues = true;
allowDiscards = true;
};
"luks-media_pool-nvme-INTEL_SSDPEK1A118GA_BTOC14120WAG118B-part1" = {
device = "/dev/disk/by-id/nvme-INTEL_SSDPEK1A118GA_BTOC14120WAG118B-part1";
bypassWorkqueues = true;
allowDiscards = true;
};
"luks-media_pool-nvme-INTEL_SSDPE2ME012T4_CVMD5130000G1P2HGN-part1" = {
device = "/dev/disk/by-id/nvme-INTEL_SSDPE2ME012T4_CVMD5130000G1P2HGN-part1";
bypassWorkqueues = true;
allowDiscards = true;
};
"luks-media_pool-nvme-INTEL_SSDPE2ME012T4_CVMD5130000U1P2HGN-part1" = {
device = "/dev/disk/by-id/nvme-INTEL_SSDPE2ME012T4_CVMD5130000U1P2HGN-part1";
bypassWorkqueues = true;
allowDiscards = true;
};
# Storage pool
"luks-storage_pool-nvme-Samsung_SSD_970_EVO_Plus_2TB_S6S2NS0T834822N-part1" =
makeLuksSSD "/dev/disk/by-id/nvme-Samsung_SSD_970_EVO_Plus_2TB_S6S2NS0T834822N-part1";
"luks-storage_pool-nvme-Samsung_SSD_970_EVO_Plus_2TB_S6S2NS0T834817F-part1" =
makeLuksSSD "/dev/disk/by-id/nvme-Samsung_SSD_970_EVO_Plus_2TB_S6S2NS0T834817F-part1";
"luks-storage_pool-nvme-INTEL_MEMPEK1W016GA_PHBT828104DF016D-part1" =
makeLuksSSD "/dev/disk/by-id/nvme-INTEL_MEMPEK1W016GA_PHBT828104DF016D-part1";
"luks-storage_pool-nvme-INTEL_MEMPEK1W016GA_PHBT828105A8016D-part1" =
makeLuksSSD "/dev/disk/by-id/nvme-INTEL_MEMPEK1W016GA_PHBT828105A8016D-part1";
"luks-storage_pool-wwn-0x5000cca23bc438dd-part1" =
makeLuksDevice "/dev/disk/by-id/wwn-0x5000cca23bc438dd-part1";
"luks-storage_pool-wwn-0x5000cca23bd035f5-part1" =
makeLuksDevice "/dev/disk/by-id/wwn-0x5000cca23bd035f5-part1";
"luks-storage_pool-wwn-0x5000cca23bd00ad6-part1" =
makeLuksDevice "/dev/disk/by-id/wwn-0x5000cca23bd00ad6-part1";
"luks-storage_pool-nvme-Samsung_SSD_970_EVO_Plus_2TB_S6S2NS0T834822N-part1" = {
device = "/dev/disk/by-id/nvme-Samsung_SSD_970_EVO_Plus_2TB_S6S2NS0T834822N-part1";
bypassWorkqueues = true;
allowDiscards = true;
};
"luks-storage_pool-nvme-Samsung_SSD_970_EVO_Plus_2TB_S6S2NS0T834817F-part1" = {
device = "/dev/disk/by-id/nvme-Samsung_SSD_970_EVO_Plus_2TB_S6S2NS0T834817F-part1";
bypassWorkqueues = true;
allowDiscards = true;
};
"luks-storage_pool-nvme-INTEL_MEMPEK1W016GA_PHBT828104DF016D-part1" = {
device = "/dev/disk/by-id/nvme-INTEL_MEMPEK1W016GA_PHBT828104DF016D-part1";
bypassWorkqueues = true;
allowDiscards = true;
};
"luks-storage_pool-nvme-INTEL_MEMPEK1W016GA_PHBT828105A8016D-part1" = {
device = "/dev/disk/by-id/nvme-INTEL_MEMPEK1W016GA_PHBT828105A8016D-part1";
bypassWorkqueues = true;
allowDiscards = true;
};
"luks-storage_pool-wwn-0x5000cca23bc438dd-part1".device = "/dev/disk/by-id/wwn-0x5000cca23bc438dd-part1";
"luks-storage_pool-wwn-0x5000cca23bd035f5-part1".device = "/dev/disk/by-id/wwn-0x5000cca23bd035f5-part1";
"luks-storage_pool-wwn-0x5000cca23bd00ad6-part1".device = "/dev/disk/by-id/wwn-0x5000cca23bd00ad6-part1";
"luks-storage_pool-wwn-0x5000cca23bcf313e-part1".device = "/dev/disk/by-id/wwn-0x5000cca23bcf313e-part1";
"luks-storage_pool-wwn-0x5000cca23bcdf3b8-part1".device = "/dev/disk/by-id/wwn-0x5000cca23bcdf3b8-part1";
"luks-storage_pool-wwn-0x5000cca23bd02746-part1".device = "/dev/disk/by-id/wwn-0x5000cca23bd02746-part1";
"luks-storage_pool-wwn-0x5000cca23bcf9f89-part1".device = "/dev/disk/by-id/wwn-0x5000cca23bcf9f89-part1";
"luks-storage_pool-wwn-0x5000cca23bd00ae9-part1".device = "/dev/disk/by-id/wwn-0x5000cca23bd00ae9-part1";
# Torrenting pool
"luks-torrenting_pool-wwn-0x500a0751e6c3c01e-part1" = {
device = "/dev/disk/by-id/wwn-0x500a0751e6c3c01e-part1";
bypassWorkqueues = true;
allowDiscards = true;
};
"luks-torrenting_pool-wwn-0x5000cca264f080a3-part1".device = "/dev/disk/by-id/wwn-0x5000cca264f080a3-part1";
"luks-torrenting_pool-wwn-0x5000cca298c33ae5-part1".device = "/dev/disk/by-id/wwn-0x5000cca298c33ae5-part1";
# cspell:enable
};
};
zfs.extraPools = [
"media"
"scratch"
"storage"
];
kernelModules = [ "kvm-amd" ];
extraModulePackages = [ ];
};
@@ -116,8 +122,8 @@ in
fsType = "zfs";
};
"/nix" = {
device = "root_pool/nix";
"/nix" =
{ device = "root_pool/nix";
fsType = "zfs";
};
@@ -140,7 +146,7 @@ in
options = [
"fmask=0077"
"dmask=0077"
];
];
};
};

49
systems/jeeves/home_assistant.nix Normal file
View File

@@ -0,0 +1,49 @@
{
services.home-assistant = {
enable = true;
openFirewall = true;
config = {
http = {
server_port = 8123;
server_host = [
"192.168.95.14"
"192.168.90.40"
"192.168.98.4"
];
use_x_forwarded_for = true;
trusted_proxies = "172.100.0.4";
};
homeassistant = {
time_zone = "America/New_York";
unit_system = "imperial";
temperature_unit = "F";
};
assist_pipeline = { };
backup = { };
bluetooth = { };
config = { };
dhcp = { };
energy = { };
history = { };
homeassistant_alerts = { };
image_upload = { };
logbook = { };
media_source = { };
mobile_app = { };
ssdp = { };
sun = { };
webhook = { };
zeroconf = { };
};
extraPackages =
python3Packages: with python3Packages; [
psycopg2
gtts
aioesphomeapi
esphome-dashboard-api
bleak-esphome
pymetno
];
extraComponents = [ "isal" ];
};
}

25
systems/jeeves/networking.nix
View File

@@ -7,12 +7,24 @@
};
systemd.network = {
enable = true;
netdevs = {
"20-ioit-vlan" = {
netdevConfig = {
Kind = "vlan";
Name = "ioit-vlan";
};
vlanConfig.Id = 20;
};
};
networks = {
"10-1GB_Primary" = {
matchConfig.Name = "enp98s0f0";
address = [ "192.168.95.14/24" ];
routes = [ { Gateway = "192.168.95.1"; } ];
DHCP = "yes";
vlan = [ "ioit-vlan" ];
linkConfig.RequiredForOnline = "routable";
};
"10-1GB_Secondary" = {
@@ -28,6 +40,15 @@
matchConfig.Name = "enp97s0f1np1";
DHCP = "yes";
};
"40-ioit-vlan" = {
matchConfig.Name = "ioit-vlan";
DHCP = "yes";
};
};
};
services.zerotierone = {
enable = true;
joinNetworks = [ "e4da7455b2ae64ca" ];
};
}

16
systems/jeeves/nvidia.nix
View File

@@ -1,16 +0,0 @@
{ config, ... }:
{
nixpkgs.config.cudaSupport = true;
services.xserver.videoDrivers = [ "nvidia" ];
hardware = {
nvidia = {
modesetting.enable = true;
powerManagement.enable = true;
package = config.boot.kernelPackages.nvidiaPackages.beta;
nvidiaSettings = true;
open = false;
};
nvidia-container-toolkit.enable = true;
};
}

26
systems/jeeves/runners/default.nix
View File

@@ -1,26 +0,0 @@
{ pkgs, ... }:
{
imports = [ ./nix_builder.nix ];
users = {
users.github-runners = {
shell = pkgs.bash;
isSystemUser = true;
group = "github-runners";
uid = 601;
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA/S8i+BNX/12JNKg+5EKGX7Aqimt5KM+ve3wt/SyWuO github-runners" # cspell:disable-line
];
};
groups.github-runners.gid = 601;
};
services.nix_builder.containers = {
nix-builder-0.enable = true;
nix-builder-1.enable = true;
nix-builder-2.enable = true;
nix-builder-3.enable = true;
nix-builder-4.enable = true;
nix-builder-5.enable = true;
};
}

101
systems/jeeves/runners/nix_builder.nix
View File

@@ -1,101 +0,0 @@
{ config, lib, ... }:
with lib;
let
vars = import ../vars.nix;
in
{
options.services.nix_builder.containers = mkOption {
type = types.attrsOf (
types.submodule (
{ name, ... }:
{
options.enable = mkEnableOption "GitHub runner container";
}
)
);
default = { };
description = "GitHub runner container configurations";
};
config.containers = mapAttrs (
name: cfg:
mkIf cfg.enable {
autoStart = true;
bindMounts = {
"/storage" = {
mountPoint = "/zfs/media/github-runners/${name}";
isReadOnly = false;
};
"/secrets".mountPoint = "${vars.secrets}/services/github-runners/${name}";
"ssh-keys".mountPoint = "${vars.secrets}/services/github-runners/id_ed25519_github-runners";
};
config =
{
config,
pkgs,
lib,
...
}:
{
nix.settings = {
trusted-substituters = [
"https://cache.nixos.org"
"https://cache.tmmworkshop.com"
"https://nix-community.cachix.org"
];
substituters = [
"https://cache.nixos.org/?priority=2&want-mass-query=true"
"https://cache.tmmworkshop.com/?priority=2&want-mass-query=true"
"https://nix-community.cachix.org/?priority=10&want-mass-query=true"
];
trusted-public-keys = [
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
"cache.tmmworkshop.com:jHffkpgbmEdstQPoihJPYW9TQe6jnQbWR2LqkNGV3iA="
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
];
experimental-features = [
"flakes"
"nix-command"
];
};
programs.ssh.extraConfig = ''
Host jeeves
Port 629
User github-runners
HostName 192.168.95.14
IdentityFile ${vars.secrets}/services/github-runners/id_ed25519_github-runners
StrictHostKeyChecking no
UserKnownHostsFile /dev/null
'';
services.github-runners.${name} = {
enable = true;
replace = true;
workDir = "/zfs/media/github-runners/${name}";
url = "https://github.com/RichieCahill/dotfiles";
extraLabels = [ "nixos" ];
tokenFile = "${vars.secrets}/services/github-runners/${name}";
user = "github-runners";
group = "github-runners";
extraPackages = with pkgs; [
nixfmt-rfc-style
nixos-rebuild
openssh
treefmt
];
};
users = {
users.github-runners = {
shell = pkgs.bash;
isSystemUser = true;
group = "github-runners";
uid = 601;
};
groups.github-runners.gid = 601;
};
system.stateVersion = "24.11";
};
}
) config.services.nix_builder.containers;
}

28
systems/jeeves/scripts/zfs.sh → systems/jeeves/scripts/datasets.sh
View File

@@ -3,31 +3,28 @@
# zpools
# media
sudo zpool create -o ashift=12 -O acltype=posixacl -O atime=off -O dnodesize=auto -O xattr=sa -O compression=zstd -m /zfs/media media mirror
sudo zpool create -o ashift=12 -O acltype=posixacl -O atime=off -O dnodesize=auto -O xattr=sa -O zstd -m /zfs/media media mirror
sudo zpool add media -o ashift=12 special mirror
# storage
sudo zpool create -o ashift=12 -O acltype=posixacl -O atime=off -O dnodesize=auto -O xattr=sa -O compression=zstd -m /zfs/storage storage
sudo zpool create -o ashift=12 -O acltype=posixacl -O atime=off -O dnodesize=auto -O xattr=sa -O zstd -m /zfs/storage storage
sudo zpool add storage -o ashift=12 special mirror
sudo zpool add storage -o ashift=12 logs mirror
# scratch
sudo zpool create -o ashift=12 -O acltype=posixacl -O atime=off -O dnodesize=auto -O xattr=sa -O compression=zstd -m /zfs/scratch scratch
# torrenting
sudo zpool create -o ashift=12 -O acltype=posixacl -O atime=off -O dnodesize=auto -O xattr=sa -O zstd -m /zfs/torrenting torrenting
sudo zpool add torrenting -o ashift=12 special
# media datasets
sudo zfs create -o compression=zstd-9 media/docker
sudo zfs create -o compression=zstd-9 -o sync=disabled media/github-runners
sudo zfs create -o recordsize=1M -o compression=zstd-19 media/library
sudo zfs create -o exec=off media/minio
sudo zfs create -o exec=off media/mirror
sudo zfs create -o copies=3 media/notes
sudo zfs create -o recordsize=16k -o primarycache=metadata -o mountpoint=/zfs/media/database/photoprism_mariadb media/photoprism_mariadb
sudo zfs create -o compression=zstd-9 media/plex
sudo zfs create -o compression=zstd-9 media/services
sudo zfs create -o compression=zstd-19 media/home_assistant
sudo zfs create -o exec=off media/share
sudo zfs create -o recordsize=16k -o primarycache=metadata -o mountpoint=/zfs/media/database/postgres media/postgres
# scratch datasets
sudo zfs create -o recordsize=16k -o sync=disabled scratch/qbitvpn
sudo zfs create -o recordsize=16k -o sync=disabled scratch/transmission
# storage datasets
sudo zfs create -o recordsize=1M -o compression=zstd-19 storage/archive
sudo zfs create -o compression=zstd-19 storage/main
@@ -35,6 +32,7 @@ sudo zfs create -o recordsize=16K -o compression=zstd-19 -o copies=2 storage/pho
sudo zfs create -o recordsize=1M -o compression=zstd-19 storage/plex
sudo zfs create -o compression=zstd-19 -o copies=3 storage/secrets
sudo zfs create -o compression=zstd-19 storage/syncthing
sudo zfs create -o recordsize=1M -o compression=zstd-9 -o exec=off -o sync=disabled storage/qbitvpn
sudo zfs create -o recordsize=1M -o compression=zstd-9 -o exec=off -o sync=disabled storage/transmission
sudo zfs create -o recordsize=1M -o compression=zstd-19 storage/library
# torrenting datasets
sudo zfs create -o recordsize=16K -o exec=off -o sync=disabled torrenting/qbit
sudo zfs create -o recordsize=16K -o exec=off -o sync=disabled torrenting/qbitvpn

8
systems/jeeves/services/systemd.nix → systems/jeeves/services.nix
View File

@@ -4,7 +4,7 @@
...
}:
let
vars = import ../vars.nix;
vars = import ./vars.nix;
in
{
systemd = {
@@ -13,7 +13,7 @@ in
description = "maintains /zfs/storage/plex permissions";
serviceConfig = {
Type = "oneshot";
ExecStart = "${pkgs.bash}/bin/bash ${../scripts/plex_permission.sh}";
ExecStart = "${pkgs.bash}/bin/bash ${./scripts/plex_permission.sh}";
};
};
startup_validation = {
@@ -23,9 +23,9 @@ in
description = "validates startup";
path = [ pkgs.zfs ];
serviceConfig = {
EnvironmentFile = "${vars.secrets}/services/server-validation";
EnvironmentFile = "${vars.storage_secrets}/services/server-validation";
Type = "oneshot";
ExecStart = "${inputs.system_tools.packages.x86_64-linux.default}/bin/validate_system --config-file='${./validate_system.toml}'";
ExecStart = "${inputs.system_tools.packages.x86_64-linux.default}/bin/validate_jeeves";
};
};
};

22
systems/jeeves/services/acme.nix
View File

@@ -1,22 +0,0 @@
{ config, ... }:
let
vars = import ../vars.nix;
in
{
security.acme = {
acceptTerms = true;
defaults = {
email = "themadmaker2@protonmail.com";
dnsResolver = "1.1.1.1:53";
extraLegoFlags = [
"--dns-timeout=300"
];
};
certs."tmmworkshop.com" = {
dnsProvider = "cloudflare";
environmentFile = "${vars.secrets}/services/acme/cloudflare.txt";
email = "themadmaker2@protonmail.com";
group = config.services.haproxy.group;
};
};
}

10
systems/jeeves/services/audiobookshelf.nix
View File

@@ -1,10 +0,0 @@
{ lib, ... }:
let
vars = import ../vars.nix;
in
{
services.audiobookshelf.enable = true;
systemd.services.audiobookshelf.serviceConfig.WorkingDirectory =
lib.mkForce "${vars.docker_configs}/audiobookshelf";
users.users.audiobookshelf.home = lib.mkForce "${vars.docker_configs}/audiobookshelf";
}

17
systems/jeeves/services/cloud_flare_tunnel.nix
View File

@@ -1,17 +0,0 @@
{ pkgs, ... }:
let
vars = import ../vars.nix;
in
{
systemd.services.cloud_flare_tunnel = {
description = "cloud_flare_tunnel proxy's traffic through cloudflare";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "simple";
EnvironmentFile = "${vars.secrets}/docker/cloud_flare_tunnel";
ExecStart = "${pkgs.cloudflared}/bin/cloudflared --no-autoupdate tunnel run";
Restart = "on-failure";
};
};
}

9
systems/jeeves/services/default.nix
View File

@@ -1,9 +0,0 @@
{ lib, ... }:
{
imports =
let
files = builtins.attrNames (builtins.readDir ./.);
nixFiles = builtins.filter (name: lib.hasSuffix ".nix" name && name != "default.nix") files;
in
map (file: ./. + "/${file}") nixFiles;
}

21
systems/jeeves/services/filebrowser.nix
View File

@@ -1,21 +0,0 @@
{
pkgs,
...
}:
let
vars = import ../vars.nix;
in
{
systemd.services.filebrowser = {
description = "filebrowser";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "simple";
User = "richie";
Group = "users";
ExecStart = "${pkgs.filebrowser}/bin/filebrowser --root=/zfs --address=0.0.0.0 --database=${vars.docker_configs}/filebrowser/filebrowser.db";
Restart = "on-failure";
};
};
}

74
systems/jeeves/services/haproxy.cfg
View File

@@ -1,74 +0,0 @@
global
log stdout format raw local0
# stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
stats timeout 30s
defaults
log global
mode http
retries 3
maxconn 2000
timeout connect 5s
timeout client 50s
timeout server 50s
timeout http-request 10s
timeout http-keep-alive 2s
timeout queue 5s
timeout tunnel 2m
timeout client-fin 1s
timeout server-fin 1s
#Application Setup
frontend ContentSwitching
bind *:80 v4v6
bind *:443 v4v6 ssl crt /var/lib/acme/tmmworkshop.com/full.pem
mode http
# tmmworkshop.com
acl host_tmmworkshop hdr(host) -i tmmworkshop.com
acl host_tmmworkshop hdr(host) -i www.tmmworkshop.com
acl host_audiobookshelf hdr(host) -i audiobookshelf.tmmworkshop.com
acl host_cache hdr(host) -i cache.tmmworkshop.com
acl host_filebrowser hdr(host) -i filebrowser.tmmworkshop.com
acl host_homeassistant hdr(host) -i homeassistant.tmmworkshop.com
acl host_jellyfin hdr(host) -i jellyfin.tmmworkshop.com
acl host_share hdr(host) -i share.tmmworkshop.com
use_backend tmmworkshop_nodes if host_tmmworkshop
use_backend audiobookshelf_nodes if host_audiobookshelf
use_backend cache_nodes if host_cache
use_backend filebrowser_nodes if host_filebrowser
use_backend homeassistant_nodes if host_homeassistant
use_backend jellyfin if host_jellyfin
use_backend share_nodes if host_share
backend audiobookshelf_nodes
mode http
server server 127.0.0.1:8000
backend cache_nodes
mode http
server server 127.0.0.1:5000
backend filebrowser_nodes
mode http
server server 127.0.0.1:8080
backend homeassistant_nodes
mode http
server server 127.0.0.1:8123
backend jellyfin
option httpchk
option forwardfor
http-check send meth GET uri /health
http-check expect string Healthy
server jellyfin 127.0.0.1:8096
backend share_nodes
mode http
server server 127.0.0.1:8091
backend tmmworkshop_nodes
mode http
server server 127.0.0.1:8080

11
systems/jeeves/services/haproxy.nix
View File

@@ -1,11 +0,0 @@
{
networking.firewall.allowedTCPPorts = [
80
443
];
services.haproxy = {
enable = true;
config = builtins.readFile ./haproxy.cfg;
};
}

103
systems/jeeves/services/home_assistant.nix
View File

@@ -1,103 +0,0 @@
let
vars = import ../vars.nix;
in
{
users = {
users.hass = {
isSystemUser = true;
group = "hass";
};
groups.hass = { };
};
services = {
home-assistant = {
enable = true;
openFirewall = true;
configDir = vars.home_assistant;
config = {
http = {
server_port = 8123;
server_host = [
"192.168.95.14"
"192.168.90.40"
"127.0.0.1"
];
use_x_forwarded_for = true;
trusted_proxies = "127.0.0.1";
};
homeassistant = {
time_zone = "America/New_York";
unit_system = "us_customary";
temperature_unit = "F";
};
recorder = {
db_url = "postgresql://@/hass";
auto_purge = true;
purge_keep_days = 3650;
db_retry_wait = 15;
};
assist_pipeline = { };
backup = { };
bluetooth = { };
config = { };
dhcp = { };
energy = { };
history = { };
homeassistant_alerts = { };
image_upload = { };
logbook = { };
media_source = { };
mobile_app = { };
ssdp = { };
sun = { };
webhook = { };
zeroconf = { };
automation = "!include automations.yaml";
script = "!include scripts.yaml";
scene = "!include scenes.yaml";
group = "!include groups.yaml";
};
extraPackages =
python3Packages: with python3Packages; [
aioesphomeapi
aiounifi
bleak-esphome
esphome-dashboard-api
gtts
jellyfin-apiclient-python
psycopg2
pymetno
pyownet
rokuecp
uiprotect
wakeonlan
wyoming
];
extraComponents = [ "isal" ];
};
esphome = {
enable = true;
openFirewall = true;
address = "192.168.90.40";
};
wyoming = {
faster-whisper.servers.main = {
enable = true;
uri = "tcp://0.0.0.0:10300";
model = "medium.en";
language = "en";
device = "cuda";
};
piper.servers.main = {
enable = true;
uri = "tcp://0.0.0.0:10200";
voice = "en_GB-alba-medium";
};
openwakeword = {
enable = true;
uri = "tcp://0.0.0.0:10400";
};
};
};
}

10
systems/jeeves/services/jellyfin.nix
View File

@@ -1,10 +0,0 @@
let
vars = import ../vars.nix;
in
{
services.jellyfin = {
enable = true;
openFirewall = true;
dataDir = "${vars.services}/jellyfin";
};
}

10
systems/jeeves/services/nix_serve.nix
View File

@@ -1,10 +0,0 @@
let
vars = import ../vars.nix;
in
{
services.nix-serve = {
enable = true;
secretKeyFile = "${vars.secrets}/services/nix-cache/cache-priv-key.pem";
openFirewall = true;
};
}

157
systems/jeeves/services/postgress.nix
View File

@@ -1,157 +0,0 @@
{ pkgs, ... }:
let
vars = import ../vars.nix;
in
{
networking.firewall.allowedTCPPorts = [ 5432 ];
services.postgresql = {
enable = true;
package = pkgs.postgresql_17_jit;
enableTCPIP = true;
enableJIT = true;
dataDir = "${vars.database}/postgres";
authentication = pkgs.lib.mkOverride 10 ''
# admins
local all postgres trust
host all postgres 127.0.0.1/32 trust
host all postgres ::1/128 trust
local all richie trust
host all richie 127.0.0.1/32 trust
host all richie ::1/128 trust
host all richie 192.168.90.1/24 trust
host all richie 192.168.95.1/24 trust
#type database DBuser origin-address auth-method
local hass hass trust
# ipv4
host hass hass 192.168.90.1/24 trust
host hass hass 127.0.0.1/32 trust
# ipv6
host hass hass ::1/128 trust
'';
identMap = ''
# ArbitraryMapName systemUser DBUser
superuser_map root postgres
superuser_map postgres postgres
# Let other names login as themselves
superuser_map richie postgres
superuser_map hass hass
'';
ensureUsers = [
{
name = "postgres";
ensureClauses = {
superuser = true;
login = true;
createrole = true;
createdb = true;
replication = true;
};
}
{
name = "richie";
ensureDBOwnership = true;
ensureClauses = {
superuser = true;
login = true;
createrole = true;
createdb = true;
replication = true;
};
}
{
name = "hass";
ensureDBOwnership = true;
ensureClauses = {
login = true;
createrole = true;
createdb = true;
replication = true;
};
}
];
ensureDatabases = [
"hass"
"mxr_dev"
"mxr_prod"
"richie"
];
# Thank you NotAShelf
# https://github.com/NotAShelf/nyx/blob/d407b4d6e5ab7f60350af61a3d73a62a5e9ac660/modules/core/roles/server/system/services/databases/postgresql.nix#L74
settings = {
# Connectivity;
max_connections = 100;
superuser_reserved_connections = 3;
# Memory Settings;
shared_buffers = "1024 MB";
work_mem = "32 MB";
maintenance_work_mem = "320 MB";
huge_pages = "off";
effective_cache_size = "2 GB";
effective_io_concurrency = 100; # concurrent IO only really activated if OS supports posix_fadvise function;
random_page_cost = 1.25; # speed of random disk access relative to sequential access (1.0);
# Monitoring;
shared_preload_libraries = "pg_stat_statements,auto_explain"; # per statement resource usage stats & log explain statements for slow queries
track_io_timing = "on"; # measure exact block IO times;
track_functions = "pl"; # track execution times of pl-language procedures if any;
# Replication;
wal_level = "replica"; # consider using at least "replica";
max_wal_senders = 0;
synchronous_commit = "on";
# Checkpointing: ;
checkpoint_timeout = "15 min";
checkpoint_completion_target = 0.9;
max_wal_size = "1024 MB";
min_wal_size = "512 MB";
# WAL writing;
wal_compression = "on";
wal_buffers = -1; # auto-tuned by Postgres till maximum of segment size (16MB by default);
wal_writer_delay = "200ms";
wal_writer_flush_after = "1MB";
# Background writer;
bgwriter_delay = "200ms";
bgwriter_lru_maxpages = 100;
bgwriter_lru_multiplier = 2.0;
bgwriter_flush_after = 0;
# Parallel queries: ;
max_worker_processes = 6;
max_parallel_workers_per_gather = 3;
max_parallel_maintenance_workers = 3;
max_parallel_workers = 6;
parallel_leader_participation = "on";
# Advanced features ;
enable_partitionwise_join = "on";
enable_partitionwise_aggregate = "on";
jit = "on";
jit_above_cost = 100000;
jit_inline_above_cost = 150000;
jit_optimize_above_cost = 500000;
# log slow queries
log_min_duration_statement = 100;
"auto_explain.log_min_duration" = 100;
# logging configuration
log_connections = true;
log_statement = "all";
logging_collector = true;
log_disconnections = true;
};
};
}

32
systems/jeeves/services/transmission.nix
View File

@@ -1,32 +0,0 @@
{ pkgs, ... }:
let
vars = import ../vars.nix;
in
{
services.transmission = {
enable = true;
package = pkgs.transmission_4;
webHome = pkgs.flood-for-transmission;
home = "${vars.services}/transmission";
openPeerPorts = true;
openRPCPort = true;
downloadDirPermissions = "770";
settings = {
bind-address-ipv4 = "192.168.95.14";
cache-size-mb = 0;
download-dir = "${vars.transmission}/complete";
download-queue-enabled = false;
incomplete-dir = "${vars.transmission_scratch}/incomplete";
incomplete-dir-enabled = true;
message-level = 3;
peer-port = 51413;
rpc-bind-address = "0.0.0.0";
rpc-host-whitelist = "127.0.0.1,192.168.90.40";
rpc-host-whitelist-enabled = true;
rpc-port = 9091;
rpc-whitelist-enabled = true;
rpc-whitelist = "127.0.0.1,192.168.90.49";
seed-queue-enabled = false;
};
};
}

11
systems/jeeves/services/validate_system.toml
View File

@@ -1,11 +0,0 @@
zpool = ["root_pool", "storage", "media"]
services = [
"audiobookshelf",
"cloud_flare_tunnel",
"haproxy",
"docker-qbitvpn",
"docker",
"filebrowser",
"home-assistant",
"jellyfin",
]

173
systems/jeeves/syncthing.nix
View File

@@ -2,128 +2,61 @@ let
vars = import ./vars.nix;
in
{
networking.firewall.allowedTCPPorts = [ 8384 ];
services.syncthing = {
overrideFolders = false;
guiAddress = "192.168.90.40:8384";
settings = {
devices.davids-server.id = "7GXTDGR-AOXFW2O-K6J7NM3-XYZNRRW-AKHAFWM-GBOWUPQ-OA6JIWD-ER7RDQL"; # cspell:disable-line
folders = {
"dotfiles" = {
path = "/home/richie/dotfiles";
devices = [
"bob"
"rhapsody-in-green"
];
fsWatcherEnabled = true;
};
"notes" = {
id = "l62ul-lpweo"; # cspell:disable-line
path = vars.notes;
devices = [
"rhapsody-in-green"
"davids-server"
];
fsWatcherEnabled = true;
};
"important" = {
id = "4ckma-gtshs"; # cspell:disable-line
path = "${vars.syncthing}/important";
devices = [
"bob"
"rhapsody-in-green"
"phone"
];
fsWatcherEnabled = true;
};
"music" = {
id = "vprc5-3azqc"; # cspell:disable-line
path = "${vars.syncthing}/music";
devices = [
"bob"
"rhapsody-in-green"
"ipad"
"phone"
];
fsWatcherEnabled = true;
};
"projects" = {
id = "vyma6-lqqrz"; # cspell:disable-line
path = "${vars.syncthing}/projects";
devices = [
"rhapsody-in-green"
];
fsWatcherEnabled = true;
};
"rhapsody-in-green_temp" = {
path = "${vars.syncthing}/rhapsody-in-green_temp";
devices = [
"rhapsody-in-green"
];
fsWatcherEnabled = true;
};
"vault" = {
path = "/home/richie/vault";
devices = [
"rhapsody-in-green"
"davids-server"
];
fsWatcherEnabled = true;
};
"backup" = {
path = "${vars.syncthing}/backup";
devices = [
"davids-server"
];
fsWatcherEnabled = true;
};
#
"davids-backup1" = {
id = "8229p-8z3tm"; # cspell:disable-line
path = "${vars.syncthing}/davids_backups/1";
devices = [
"davids-server"
];
fsWatcherEnabled = true;
type = "receiveencrypted";
};
"davids-backup2" = {
id = "iciw3-dp6ao"; # cspell:disable-line
path = "${vars.syncthing}/davids_backups/2";
devices = [
"davids-server"
];
fsWatcherEnabled = true;
type = "receiveencrypted";
};
"davids-backup3" = {
id = "9si6m-bnkjb"; # cspell:disable-line
path = "${vars.syncthing}/davids_backups/3";
devices = [
"davids-server"
];
fsWatcherEnabled = true;
type = "receiveencrypted";
};
"davids-backup4" = {
id = "qjyfy-uupj4"; # cspell:disable-line
path = "${vars.syncthing}/davids_backups/4";
devices = [
"davids-server"
];
fsWatcherEnabled = true;
type = "receiveencrypted";
};
"davids-backup5" = {
id = "fm4h5-emsu2"; # cspell:disable-line
path = "${vars.syncthing}/davids_backups/5";
devices = [
"davids-server"
];
fsWatcherEnabled = true;
type = "receiveencrypted";
};
settings.folders = {
"bob_temp" = {
path = "${vars.storage_syncthing}/bob_temp";
devices = [
"jeeves"
];
fsWatcherEnabled = true;
};
"notes" = {
id = "l62ul-lpweo"; # cspell:disable-line
path = vars.media_notes;
devices = [
"bob"
"rhapsody-in-green"
];
fsWatcherEnabled = true;
};
"important" = {
id = "4ckma-gtshs"; # cspell:disable-line
path = "${vars.storage_syncthing}/important";
devices = [
"bob"
"rhapsody-in-green"
"phone"
];
fsWatcherEnabled = true;
};
"music" = {
id = "vprc5-3azqc"; # cspell:disable-line
path = "${vars.storage_syncthing}/music";
devices = [
"bob"
"rhapsody-in-green"
"ipad"
"phone"
];
fsWatcherEnabled = true;
};
"projects" = {
id = "vyma6-lqqrz"; # cspell:disable-line
path = "${vars.storage_syncthing}/projects";
devices = [
"bob"
"rhapsody-in-green"
];
fsWatcherEnabled = true;
};
"rhapsody-in-green_temp" = {
path = "${vars.storage_syncthing}/rhapsody-in-green_temp";
devices = [
"rhapsody-in-green"
];
fsWatcherEnabled = true;
};
};
};

34
systems/jeeves/vars.nix
View File

@@ -1,21 +1,25 @@
let
zfs_media = "/zfs/media";
zfs_storage = "/zfs/storage";
zfs_scratch = "/zfs/scratch";
zfs_torrenting = "/zfs/torrenting";
in
{
inherit zfs_media zfs_storage zfs_scratch;
database = "${zfs_media}/database";
docker = "${zfs_media}/docker";
docker_configs = "${zfs_media}/docker/configs";
home_assistant = "${zfs_media}/home_assistant";
notes = "${zfs_media}/notes";
qbitvpn = "${zfs_storage}/qbitvpn";
qbitvpn_scratch = "${zfs_scratch}/qbitvpn";
secrets = "${zfs_storage}/secrets";
services = "${zfs_media}/services";
share = "${zfs_media}/share";
syncthing = "${zfs_storage}/syncthing";
transmission = "${zfs_storage}/transmission";
transmission_scratch = "${zfs_scratch}/transmission";
inherit zfs_media zfs_storage zfs_torrenting;
# media
media_database = "${zfs_media}/database";
media_docker = "${zfs_media}/docker";
media_docker_configs = "${zfs_media}/docker/configs";
media_mirror = "${zfs_media}/mirror";
media_notes = "${zfs_media}/notes";
media_plex = "${zfs_media}/plex";
# storage
storage_main = "${zfs_storage}/main";
storage_photos = "${zfs_storage}/photos";
storage_plex = "${zfs_storage}/plex";
storage_secrets = "${zfs_storage}/secrets";
storage_syncthing = "${zfs_storage}/syncthing";
storage_library = "${zfs_storage}/library";
# torrenting
torrenting_qbit = "${zfs_torrenting}/qbit";
torrenting_qbitvpn = "${zfs_torrenting}/qbitvpn";
}

31
systems/rhapsody-in-green/default.nix
View File

@@ -4,8 +4,6 @@
../../users/richie
../../common/global
../../common/optional/desktop.nix
../../common/optional/docker.nix
../../common/optional/steam.nix
../../common/optional/syncthing_base.nix
../../common/optional/systemd-boot.nix
../../common/optional/yubikey.nix
@@ -22,8 +20,37 @@
networkmanager.enable = true;
};
hardware = {
pulseaudio.enable = false;
bluetooth = {
enable = true;
powerOnBoot = true;
};
};
security.rtkit.enable = true;
services = {
displayManager.sddm.enable = true;
openssh.ports = [ 922 ];
printing.enable = true;
pipewire = {
enable = true;
alsa.enable = true;
alsa.support32Bit = true;
pulse.enable = true;
};
snapshot_manager.enable = true;
zfs = {
trim.enable = true;
autoScrub.enable = true;
};
};
system.stateVersion = "24.05";

7
systems/rhapsody-in-green/hardware.nix
View File

@@ -1,9 +1,4 @@
{
config,
lib,
modulesPath,
...
}:
{ config, lib, modulesPath, ... }:
{
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];

14
systems/rhapsody-in-green/syncthing.nix
View File

@@ -1,17 +1,10 @@
{
{
services.syncthing.settings.folders = {
"dotfiles" = {
path = "/home/richie/dotfiles";
devices = [
"jeeves"
"bob"
];
fsWatcherEnabled = true;
};
"notes" = {
id = "l62ul-lpweo"; # cspell:disable-line
path = "/home/richie/notes";
devices = [
"bob"
"jeeves"
];
fsWatcherEnabled = true;
@@ -41,6 +34,7 @@
id = "vyma6-lqqrz"; # cspell:disable-line
path = "/home/richie/projects";
devices = [
"bob"
"jeeves"
];
fsWatcherEnabled = true;
@@ -56,7 +50,7 @@
"vault" = {
path = "/home/richie/vault";
devices = [
"jeeves"
"bob"
];
fsWatcherEnabled = true;
};

147
systems/router/default.nix Normal file
View File

@@ -0,0 +1,147 @@
# https://github.com/ghostbuster91/blogposts/blob/a2374f0039f8cdf4faddeaaa0347661ffc2ec7cf/router2023-part2/main.md
# https://francis.begyn.be/blog/nixos-home-router
{
imports = [
../../users/richie
../../common/global
../../common/optional/zerotier.nix
./docker
./hardware.nix
];
boot.kernel = {
sysctl = {
"net.ipv4.conf.all.forwarding" = true;
"net.ipv6.conf.all.forwarding" = false;
};
};
systemd.network = {
wait-online.anyInterface = true;
networks = {
"30-lan0" = {
matchConfig.Name = "lan0";
linkConfig.RequiredForOnline = "enslaved";
networkConfig = {
ConfigureWithoutCarrier = true;
};
};
# lan1 and lan2 look analogical
"30-lan3" = {
matchConfig.Name = "lan3";
linkConfig.RequiredForOnline = "enslaved";
networkConfig = {
ConfigureWithoutCarrier = true;
};
};
"10-wan" = {
matchConfig.Name = "wan";
networkConfig = {
# start a DHCP Client for IPv4 Addressing/Routing
DHCP = "ipv4";
DNSOverTLS = true;
DNSSEC = true;
IPv6PrivacyExtensions = false;
IPForward = true;
};
# make routing on this interface a dependency for network-online.target
linkConfig.RequiredForOnline = "routable";
};
};
};
networking = {
hostName = "surfer";
useNetworkd = true;
useDHCP = false;
# No local firewall.
nat.enable = false;
firewall.enable = false;
nftables = {
enable = true;
ruleset = ''
table inet filter {
chain input {
type filter hook input priority 0; policy drop;
iifname { "br-lan" } accept comment "Allow local network to access the router"
iifname "wan" ct state { established, related } accept comment "Allow established traffic"
iifname "wan" icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment "Allow select ICMP"
iifname "wan" counter drop comment "Drop all other unsolicited traffic from wan"
iifname "lo" accept comment "Accept everything from loopback interface"
}
chain forward {
type filter hook forward priority filter; policy drop;
iifname { "br-lan" } oifname { "wan" } accept comment "Allow trusted LAN to WAN"
iifname { "wan" } oifname { "br-lan" } ct state { established, related } accept comment "Allow established back to LANs"
}
}
table ip nat {
chain postrouting {
type nat hook postrouting priority 100; policy accept;
oifname "wan" masquerade
}
}
'';
};
};
services.dnsmasq = {
enable = true;
settings = {
# upstream DNS servers
server = [ "9.9.9.9" "8.8.8.8" "1.1.1.1" ];
# sensible behaviours
domain-needed = true;
bogus-priv = true;
no-resolv = true;
# Cache dns queries.
cache-size = 1000;
dhcp-range = [ "br-lan,192.168.10.50,192.168.10.254,24h" ];
interface = "br-lan";
dhcp-host = "192.168.10.1";
# local domains
local = "/lan/";
domain = "lan";
expand-hosts = true;
# don't use /etc/hosts as this would advertise surfer as localhost
no-hosts = true;
address = "/surfer.lan/192.168.10.1";
};
};
boot.kernel = {
sysctl = {
"net.ipv4.conf.default.rp_filter" = 1;
"net.ipv4.conf.wan.rp_filter" = 1;
"net.ipv4.conf.br-lan.rp_filter" = 0;
};
};
services = {
openssh.ports = [ 629 ];
smartd.enable = true;
snapshot_manager = {
enable = true;
path = ./snapshot_config.toml;
};
sysstat.enable = true;
zfs = {
trim.enable = true;
autoScrub.enable = true;
};
};
system.stateVersion = "24.05";
}

67
systems/router/hardware.nix Normal file
View File

@@ -0,0 +1,67 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{
config,
lib,
modulesPath,
...
}:
{
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
boot = {
initrd = {
availableKernelModules = [
"nvme"
"xhci_pci"
"ahci"
"usbhid"
"usb_storage"
"sd_mod"
];
kernelModules = [ ];
luks.devices."luks-root-pool-nvme-Samsung_SSD_990_PRO_with_Heatsink_1TB_S73JNJ0X114418B-part2" = {
device = "/dev/disk/by-id/nvme-Samsung_SSD_990_PRO_with_Heatsink_1TB_S73JNJ0X114418B-part2";
bypassWorkqueues = true;
allowDiscards = true;
};
};
kernelModules = [ "kvm-amd" ];
extraModulePackages = [ ];
};
fileSystems = {
"/" = lib.mkDefault {
device = "root_pool/root";
fsType = "zfs";
};
"/home" = {
device = "root_pool/home";
fsType = "zfs";
};
"/var" = {
device = "root_pool/var";
fsType = "zfs";
};
"/boot" = {
device = "/dev/disk/by-uuid/609D-FF29";
fsType = "vfat";
options = [
"fmask=0077"
"dmask=0077"
];
};
};
swapDevices = [ ];
networking.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}

682
tools/installer.py
View File

@@ -1,682 +0,0 @@
"""Install NixOS on a ZFS pool."""
from __future__ import annotations
import curses
import logging
import sys
from collections import defaultdict
from os import getenv
from pathlib import Path
from random import getrandbits
from subprocess import PIPE, Popen, run
from time import sleep
from typing import TYPE_CHECKING
if TYPE_CHECKING:
from collections.abc import Sequence
def configure_logger(level: str = "INFO") -> None:
"""Configure the logger.
Args:
level (str, optional): The logging level. Defaults to "INFO".
"""
logging.basicConfig(
level=level,
datefmt="%Y-%m-%dT%H:%M:%S%z",
format="%(asctime)s %(levelname)s %(filename)s:%(lineno)d - %(message)s",
handlers=[logging.StreamHandler(sys.stdout)],
)
def bash_wrapper(command: str) -> str:
"""Execute a bash command and capture the output.
Args:
command (str): The bash command to be executed.
Returns:
Tuple[str, int]: A tuple containing the output of the command (stdout) as a string,
the error output (stderr) as a string (optional), and the return code as an integer.
"""
logging.debug(f"running {command=}")
# This is a acceptable risk
process = Popen(command.split(), stdout=PIPE, stderr=PIPE) # noqa: S603
output, _ = process.communicate()
if process.returncode != 0:
error = f"Failed to run command {command=} return code {process.returncode=}"
raise RuntimeError(error)
return output.decode()
def partition_disk(disk: str, swap_size: int, reserve: int = 0) -> None:
"""Partition a disk.
Args:
disk (str): The disk to partition.
swap_size (int): The size of the swap partition in GB.
minimum value is 1.
reserve (int, optional): The size of the reserve partition in GB. Defaults to 0.
minimum value is 0.
"""
logging.info(f"partitioning {disk=}")
swap_size = max(swap_size, 1)
reserve = max(reserve, 0)
bash_wrapper(f"blkdiscard -f {disk}")
if reserve > 0:
msg = f"Creating swap partition on {disk=} with size {swap_size=}GiB and reserve {reserve=}GiB"
logging.info(msg)
swap_start = swap_size + reserve
swap_partition = f"mkpart swap -{swap_start}GiB -{reserve}GiB "
else:
logging.info(f"Creating swap partition on {disk=} with size {swap_size=}GiB")
swap_start = swap_size
swap_partition = f"mkpart swap -{swap_start}GiB 100% "
logging.debug(f"{swap_partition=}")
create_partitions = (
f"parted --script --align=optimal {disk} -- "
"mklabel gpt "
"mkpart EFI 1MiB 4GiB "
f"mkpart root_pool 4GiB -{swap_start}GiB "
f"{swap_partition}"
"set 1 esp on"
)
bash_wrapper(create_partitions)
logging.info(f"{disk=} successfully partitioned")
def create_zfs_pool(pool_disks: Sequence[str], mnt_dir: str) -> None:
"""Create a ZFS pool.
Args:
disks (Sequence[str]): A tuple of disks to use for the pool.
mnt_dir (str): The mount directory.
"""
if len(pool_disks) <= 0:
error = "disks must be a tuple of at least length 1"
raise ValueError(error)
zpool_create = (
"zpool create "
"-o ashift=12 "
"-o autotrim=on "
f"-R {mnt_dir} "
"-O acltype=posixacl "
"-O canmount=off "
"-O dnodesize=auto "
"-O normalization=formD "
"-O relatime=on "
"-O xattr=sa "
"-O mountpoint=legacy "
"-O compression=zstd "
"-O atime=off "
"root_pool "
)
if len(pool_disks) == 1:
zpool_create += pool_disks[0]
else:
zpool_create += "mirror "
zpool_create += " ".join(pool_disks)
bash_wrapper(zpool_create)
zpools = bash_wrapper("zpool list -o name")
if "root_pool" not in zpools.splitlines():
logging.critical("Failed to create root_pool")
sys.exit(1)
def create_zfs_datasets() -> None:
"""Create ZFS datasets."""
bash_wrapper("zfs create -o canmount=noauto -o reservation=10G root_pool/root")
bash_wrapper("zfs create root_pool/home")
bash_wrapper("zfs create root_pool/var -o reservation=1G")
bash_wrapper("zfs create -o compression=zstd-9 -o reservation=10G root_pool/nix")
datasets = bash_wrapper("zfs list -o name")
expected_datasets = {
"root_pool/root",
"root_pool/home",
"root_pool/var",
"root_pool/nix",
}
missing_datasets = expected_datasets.difference(datasets.splitlines())
if missing_datasets:
logging.critical(f"Failed to create pools {missing_datasets}")
sys.exit(1)
def get_cpu_manufacturer() -> str:
"""Get the CPU manufacturer."""
output = bash_wrapper("cat /proc/cpuinfo")
id_vendor = {"AuthenticAMD": "amd", "GenuineIntel": "intel"}
for line in output.splitlines():
if "vendor_id" in line:
return id_vendor[line.split(": ")[1].strip()]
def get_boot_drive_id(disk: str) -> str:
"""Get the boot drive ID."""
output = bash_wrapper(f"lsblk -o UUID {disk}-part1")
return output.splitlines()[1]
def create_nix_hardware_file(mnt_dir: str, disks: Sequence[str], encrypt: bool) -> None:
"""Create a NixOS hardware file."""
cpu_manufacturer = get_cpu_manufacturer()
devices = ""
if encrypt:
disk = disks[0]
devices = (
f' luks.devices."luks-root-pool-{disk.split("/")[-1]}-part2"'
"= {\n"
f' device = "{disk}-part2";\n'
" bypassWorkqueues = true;\n"
" allowDiscards = true;\n"
" };\n"
)
host_id = format(getrandbits(32), "08x")
nix_hardware = (
"{ config, lib, modulesPath, ... }:\n"
"{\n"
' imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];\n\n'
" boot = {\n"
" initrd = {\n"
' availableKernelModules = [ \n "ahci"\n "ehci_pci"\n "nvme"\n "sd_mod"\n "usb_storage"\n "usbhid"\n "xhci_pci"\n ];\n'
" kernelModules = [ ];\n"
f" {devices}"
" };\n"
f' kernelModules = [ "kvm-{cpu_manufacturer}" ];\n'
" extraModulePackages = [ ];\n"
" };\n\n"
" fileSystems = {\n"
' "/" = lib.mkDefault {\n device = "root_pool/root";\n fsType = "zfs";\n };\n\n'
' "/home" = {\n device = "root_pool/home";\n fsType = "zfs";\n };\n\n'
' "/var" = {\n device = "root_pool/var";\n fsType = "zfs";\n };\n\n'
' "/nix" = {\n device = "root_pool/nix";\n fsType = "zfs";\n };\n\n'
' "/boot" = {\n'
f' device = "/dev/disk/by-uuid/{get_boot_drive_id(disks[0])}";\n'
' fsType = "vfat";\n options = [\n "fmask=0077"\n "dmask=0077"\n ];\n };\n };\n\n'
" swapDevices = [ ];\n\n"
" networking.useDHCP = lib.mkDefault true;\n\n"
' nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";\n'
f" hardware.cpu.{cpu_manufacturer}.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;\n"
f' networking.hostId = "{host_id}";\n'
"}\n"
)
Path(f"{mnt_dir}/etc/nixos/hardware-configuration.nix").write_text(nix_hardware)
def install_nixos(mnt_dir: str, disks: Sequence[str], encrypt: bool) -> None:
"""Install NixOS."""
bash_wrapper(f"mount -o X-mount.mkdir -t zfs root_pool/root {mnt_dir}")
bash_wrapper(f"mount -o X-mount.mkdir -t zfs root_pool/home {mnt_dir}/home")
bash_wrapper(f"mount -o X-mount.mkdir -t zfs root_pool/var {mnt_dir}/var")
bash_wrapper(f"mount -o X-mount.mkdir -t zfs root_pool/nix {mnt_dir}/nix")
for disk in disks:
bash_wrapper(f"mkfs.vfat -n EFI {disk}-part1")
# set up mirroring afterwards if more than one disk
boot_partition = f"mount -t vfat -o fmask=0077,dmask=0077,iocharset=iso8859-1,X-mount.mkdir {disks[0]}-part1 {mnt_dir}/boot"
bash_wrapper(boot_partition)
bash_wrapper(f"nixos-generate-config --root {mnt_dir}")
create_nix_hardware_file(mnt_dir, disks, encrypt)
run(("nixos-install", "--root", mnt_dir), check=True) # noqa: S603
def installer(
disks: set[str],
swap_size: int,
reserve: int,
encrypt_key: str | None,
) -> None:
"""Main."""
logging.info("Starting installation")
for disk in disks:
partition_disk(disk, swap_size, reserve)
if encrypt_key:
sleep(1)
for command in (
f'printf "{encrypt_key}" | cryptsetup luksFormat --type luks2 {disk}-part2 -',
f'printf "{encrypt_key}" | cryptsetup luksOpen {disk}-part2 luks-root-pool-{disk.split("/")[-1]}-part2 -',
):
run(command, shell=True, check=True)
mnt_dir = "/tmp/nix_install" # noqa: S108
Path(mnt_dir).mkdir(parents=True, exist_ok=True)
if encrypt_key:
pool_disks = [
f"/dev/mapper/luks-root-pool-{disk.split('/')[-1]}-part2" for disk in disks
]
else:
pool_disks = [f"{disk}-part2" for disk in disks]
create_zfs_pool(pool_disks, mnt_dir)
create_zfs_datasets()
install_nixos(mnt_dir, disks, encrypt_key)
logging.info("Installation complete")
class Cursor:
def __init__(self):
self.x_position = 0
self.y_position = 0
self.height = 0
self.width = 0
def set_height(self, height: int):
self.height = height
def set_width(self, width: int):
self.width = width
def x_bounce_check(self, cursor: int) -> int:
cursor = max(0, cursor)
return min(self.width - 1, cursor)
def y_bounce_check(self, cursor: int) -> int:
cursor = max(0, cursor)
return min(self.height - 1, cursor)
def set_x(self, x: int):
self.x_position = self.x_bounce_check(x)
def set_y(self, y: int):
self.y_position = self.y_bounce_check(y)
def get_x(self) -> int:
return self.x_position
def get_y(self) -> int:
return self.y_position
def move_up(self):
self.set_y(self.y_position - 1)
def move_down(self):
self.set_y(self.y_position + 1)
def move_left(self):
self.set_x(self.x_position - 1)
def move_right(self):
self.set_x(self.x_position + 1)
def navigation(self, key: int) -> None:
action = {
curses.KEY_DOWN: self.move_down,
curses.KEY_UP: self.move_up,
curses.KEY_RIGHT: self.move_right,
curses.KEY_LEFT: self.move_left,
}
action.get(key, lambda: None)()
class State:
"""State class to store the state of the program."""
def __init__(self):
self.key = 0
self.cursor = Cursor()
self.swap_size = 0
self.show_swap_input = False
self.reserve_size = 0
self.show_reserve_input = False
self.selected_device_ids = set()
def get_selected_devices(self) -> tuple[str]:
"""Get selected devices."""
return tuple(self.selected_device_ids)
def get_device(raw_device: str) -> dict[str, str]:
raw_device_components = raw_device.split(" ")
return {
thing.split("=")[0].lower(): thing.split("=")[1].strip('"')
for thing in raw_device_components
}
def get_devices() -> list[dict[str, str]]:
"""Get a list of devices."""
# --bytes
raw_devices = bash_wrapper("lsblk --paths --pairs").splitlines()
return [get_device(raw_device) for raw_device in raw_devices]
def get_device_id_mapping() -> dict[str, set[str]]:
"""Get a list of device ids.
Returns:
list[str]: the list of device ids
"""
device_ids = bash_wrapper("find /dev/disk/by-id -type l").splitlines()
device_id_mapping: dict[str, set[str]] = defaultdict(set)
for device_id in device_ids:
device = bash_wrapper(f"readlink -f {device_id}").strip()
device_id_mapping[device].add(device_id)
return device_id_mapping
def calculate_device_menu_padding(
devices: list[dict[str, str]], column: str, padding: int = 0
) -> int:
return max(len(device[column]) for device in devices) + padding
def draw_device_ids(
state: State,
row_number: int,
menu_start_x: int,
std_screen: curses.window,
menu_width: list[int],
device_ids: set[str],
) -> tuple[State, int]:
for device_id in sorted(device_ids):
row_number = row_number + 1
if row_number == state.cursor.get_y() and state.cursor.get_x() in menu_width:
std_screen.attron(curses.A_BOLD)
if state.key == ord(" "):
if device_id not in state.selected_device_ids:
state.selected_device_ids.add(device_id)
else:
state.selected_device_ids.remove(device_id)
if device_id in state.selected_device_ids:
std_screen.attron(curses.color_pair(7))
std_screen.addstr(row_number, menu_start_x, f" {device_id}")
std_screen.attroff(curses.color_pair(7))
std_screen.attroff(curses.A_BOLD)
return state, row_number
def draw_device_menu(
std_screen: curses.window,
devices: list[dict[str, str]],
device_id_mapping: dict[str, set[str]],
state: State,
menu_start_y: int = 0,
menu_start_x: int = 0,
) -> State:
"""draw the device menu and handle user input
Args:
std_screen (curses.window): the curses window to draw on
devices (list[dict[str, str]]): the list of devices to draw
device_id_mapping (dict[str, set[str]]): the list of device ids to draw
state (State): the state object to update
menu_start_y (int, optional): the y position to start drawing the menu. Defaults to 0.
menu_start_x (int, optional): the x position to start drawing the menu. Defaults to 0.
Returns:
State: the updated state object
"""
padding = 2
name_padding = calculate_device_menu_padding(devices, "name", padding)
size_padding = calculate_device_menu_padding(devices, "size", padding)
type_padding = calculate_device_menu_padding(devices, "type", padding)
mountpoints_padding = calculate_device_menu_padding(devices, "mountpoints", padding)
device_header = f"{'Name':{name_padding}}{'Size':{size_padding}}{'Type':{type_padding}}{'Mountpoints':{mountpoints_padding}}"
menu_width = range(menu_start_x, len(device_header) + menu_start_x)
std_screen.addstr(menu_start_y, menu_start_x, device_header, curses.color_pair(5))
devises_list_start = menu_start_y + 1
row_number = devises_list_start
for device in devices:
row_number = row_number + 1
device_name = device["name"]
device_row = (
f"{device_name:{name_padding}}"
f"{device['size']:{size_padding}}"
f"{device['type']:{type_padding}}"
f"{device['mountpoints']:{mountpoints_padding}}"
)
std_screen.addstr(row_number, menu_start_x, device_row)
state, row_number = draw_device_ids(
state=state,
row_number=row_number,
menu_start_x=menu_start_x,
std_screen=std_screen,
menu_width=menu_width,
device_ids=device_id_mapping[device_name],
)
return state, row_number
def debug_menu(std_screen: curses.window, key: int) -> None:
height, width = std_screen.getmaxyx()
width_height = "Width: {}, Height: {}".format(width, height)
std_screen.addstr(height - 4, 0, width_height, curses.color_pair(5))
key_pressed = f"Last key pressed: {key}"[: width - 1]
if key == 0:
key_pressed = "No key press detected..."[: width - 1]
std_screen.addstr(height - 3, 0, key_pressed)
for i in range(0, 8):
std_screen.addstr(height - 2, i * 3, f"{i}██", curses.color_pair(i))
def status_bar(
std_screen: curses.window,
cursor: Cursor,
width: int,
height: int,
) -> None:
std_screen.attron(curses.A_REVERSE)
std_screen.attron(curses.color_pair(3))
status_bar = (
f"Press 'q' to exit | STATUS BAR | Pos: {cursor.get_x()}, {cursor.get_y()}"
)
std_screen.addstr(height - 1, 0, status_bar)
std_screen.addstr(height - 1, len(status_bar), " " * (width - len(status_bar) - 1))
std_screen.attroff(curses.color_pair(3))
std_screen.attroff(curses.A_REVERSE)
def set_color() -> None:
curses.start_color()
curses.use_default_colors()
for i in range(0, curses.COLORS):
curses.init_pair(i + 1, i, -1)
def get_text_input(std_screen: curses.window, prompt: str, y: int, x: int) -> str:
curses.echo()
std_screen.addstr(y, x, prompt)
input_str = ""
while True:
key = std_screen.getch()
if key == ord("\n"):
break
elif key == 27: # ESC key
input_str = ""
break
elif key in (curses.KEY_BACKSPACE, ord("\b"), 127):
input_str = input_str[:-1]
std_screen.addstr(y, x + len(prompt), input_str + " ")
else:
input_str += chr(key)
std_screen.refresh()
curses.noecho()
return input_str
def swap_size_input(
std_screen: curses.window,
state: State,
swap_offset: int,
) -> State:
swap_size_text = "Swap size (GB): "
std_screen.addstr(swap_offset, 0, f"{swap_size_text}{state.swap_size}")
if state.key == ord("\n") and state.cursor.get_y() == swap_offset:
state.show_swap_input = True
if state.show_swap_input:
swap_size_str = get_text_input(std_screen, swap_size_text, swap_offset, 0)
try:
state.swap_size = int(swap_size_str)
state.show_swap_input = False
except ValueError:
std_screen.addstr(
swap_offset, 0, "Invalid input. Press any key to continue."
)
std_screen.getch()
state.show_swap_input = False
return state
def reserve_size_input(
std_screen: curses.window,
state: State,
reserve_offset: int,
) -> State:
reserve_size_text = "reserve size (GB): "
std_screen.addstr(reserve_offset, 0, f"{reserve_size_text}{state.reserve_size}")
if state.key == ord("\n") and state.cursor.get_y() == reserve_offset:
state.show_reserve_input = True
if state.show_reserve_input:
reserve_size_str = get_text_input(
std_screen, reserve_size_text, reserve_offset, 0
)
try:
state.reserve_size = int(reserve_size_str)
state.show_reserve_input = False
except ValueError:
std_screen.addstr(
reserve_offset, 0, "Invalid input. Press any key to continue."
)
std_screen.getch()
state.show_reserve_input = False
return state
def draw_menu(std_screen: curses.window) -> State:
"""draw the menu and handle user input
Args:
std_screen (curses.window): the curses window to draw on
Returns:
State: the state object
"""
# Clear and refresh the screen for a blank canvas
std_screen.clear()
std_screen.refresh()
set_color()
state = State()
devices = get_devices()
device_id_mapping = get_device_id_mapping()
# Loop where k is the last character pressed
while state.key != ord("q"):
std_screen.clear()
height, width = std_screen.getmaxyx()
state.cursor.set_height(height)
state.cursor.set_width(width)
state.cursor.navigation(state.key)
state, device_menu_size = draw_device_menu(
std_screen=std_screen,
state=state,
devices=devices,
device_id_mapping=device_id_mapping,
)
swap_offset = device_menu_size + 2
swap_size_input(
std_screen=std_screen,
state=state,
swap_offset=swap_offset,
)
reserve_size_input(
std_screen=std_screen,
state=state,
reserve_offset=swap_offset + 1,
)
status_bar(std_screen, state.cursor, width, height)
debug_menu(std_screen, state.key)
std_screen.move(state.cursor.get_y(), state.cursor.get_x())
std_screen.refresh()
state.key = std_screen.getch()
return state
def main() -> None:
configure_logger("DEBUG")
state = curses.wrapper(draw_menu)
encrypt_key = getenv("ENCRYPT_KEY")
logging.info("installing_nixos")
logging.info(f"disks: {state.selected_device_ids}")
logging.info(f"swap_size: {state.swap_size}")
logging.info(f"reserve: {state.reserve_size}")
logging.info(f"encrypted: {bool(encrypt_key)}")
sleep(3)
installer(
disks=state.get_selected_devices(),
swap_size=state.swap_size,
reserve=state.reserve_size,
encrypt_key=encrypt_key,
)
if __name__ == "__main__":
main()

230
tools/intaller.py Normal file
View File

@@ -0,0 +1,230 @@
"""Install NixOS on a ZFS pool."""
from __future__ import annotations
import logging
import sys
from os import getenv
from pathlib import Path
from random import getrandbits
from subprocess import PIPE, Popen, run
from time import sleep
from typing import TYPE_CHECKING
if TYPE_CHECKING:
from collections.abc import Sequence
def configure_logger(level: str = "INFO") -> None:
"""Configure the logger.
Args:
level (str, optional): The logging level. Defaults to "INFO".
"""
logging.basicConfig(
level=level,
datefmt="%Y-%m-%dT%H:%M:%S%z",
format="%(asctime)s %(levelname)s %(filename)s:%(lineno)d - %(message)s",
handlers=[logging.StreamHandler(sys.stdout)],
)
def bash_wrapper(command: str) -> str:
"""Execute a bash command and capture the output.
Args:
command (str): The bash command to be executed.
Returns:
Tuple[str, int]: A tuple containing the output of the command (stdout) as a string,
the error output (stderr) as a string (optional), and the return code as an integer.
"""
logging.debug(f"running {command=}")
# This is a acceptable risk
process = Popen(command.split(), stdout=PIPE, stderr=PIPE) # noqa: S603
output, _ = process.communicate()
if process.returncode != 0:
error = f"Failed to run command {command=} return code {process.returncode=}"
raise RuntimeError(error)
return output.decode()
def partition_disk(disk: str, swap_size: int, reserve: int = 0) -> None:
"""Partition a disk.
Args:
disk (str): The disk to partition.
swap_size (int): The size of the swap partition in GB.
minimum value is 1.
reserve (int, optional): The size of the reserve partition in GB. Defaults to 0.
minimum value is 0.
"""
logging.info(f"partitioning {disk=}")
swap_size = max(swap_size, 1)
reserve = max(reserve, 0)
bash_wrapper(f"blkdiscard -f {disk}")
if reserve > 0:
msg = f"Creating swap partition on {disk=} with size {swap_size=}GiB and reserve {reserve=}GiB"
logging.info(msg)
swap_start = swap_size + reserve
swap_partition = f"mkpart swap -{swap_start}GiB -{reserve}GiB "
else:
logging.info(f"Creating swap partition on {disk=} with size {swap_size=}GiB")
swap_start = swap_size
swap_partition = f"mkpart swap -{swap_start}GiB 100% "
logging.debug(f"{swap_partition=}")
create_partitions = (
f"parted --script --align=optimal {disk} -- "
"mklabel gpt "
"mkpart EFI 1MiB 4GiB "
f"mkpart root_pool 4GiB -{swap_start}GiB "
f"{swap_partition}"
"set 1 esp on"
)
bash_wrapper(create_partitions)
logging.info(f"{disk=} successfully partitioned")
def create_zfs_pool(pool_disks: Sequence[str], mnt_dir: str) -> None:
"""Create a ZFS pool.
Args:
disks (Sequence[str]): A tuple of disks to use for the pool.
mnt_dir (str): The mount directory.
"""
if len(pool_disks) <= 0:
error = "disks must be a tuple of at least length 1"
raise ValueError(error)
zpool_create = (
"zpool create "
"-o ashift=12 "
"-o autotrim=on "
f"-R {mnt_dir} "
"-O acltype=posixacl "
"-O canmount=off "
"-O dnodesize=auto "
"-O normalization=formD "
"-O relatime=on "
"-O xattr=sa "
"-O mountpoint=none "
"-O primarycache=metadata "
"root_pool "
)
if len(pool_disks) == 1:
zpool_create += pool_disks[0]
else:
zpool_create += "mirror "
zpool_create += " ".join(pool_disks)
bash_wrapper(zpool_create)
zpools = bash_wrapper("zpool list -o name")
if "root_pool" not in zpools.splitlines():
logging.critical("Failed to create root_pool")
sys.exit(1)
def create_zfs_datasets() -> None:
"""Create ZFS datasets."""
default_options = "-o compression=zstd -o atime=off -o mountpoint=legacy"
bash_wrapper(f"zfs create {default_options} -o canmount=noauto root_pool/root")
for dataset in ("home", "var"):
bash_wrapper(f"zfs create {default_options} root_pool/{dataset}")
datasets = bash_wrapper("zfs list -o name")
expected_datasets = {"root_pool/root", "root_pool/home", "root_pool/var"}
missing_datasets = expected_datasets.difference(datasets.splitlines())
if missing_datasets:
logging.critical(f"Failed to create pools {missing_datasets}")
sys.exit(1)
def install_nixos(mnt_dir: str, disks: Sequence[str], encrypt: bool) -> None:
"""Install NixOS."""
bash_wrapper(f"mount -o X-mount.mkdir -t zfs root_pool/root {mnt_dir}")
bash_wrapper(f"mount -o X-mount.mkdir -t zfs root_pool/home {mnt_dir}/home")
bash_wrapper(f"mount -o X-mount.mkdir -t zfs root_pool/var {mnt_dir}/var")
for disk in disks:
bash_wrapper(f"mkfs.vfat -n EFI {disk}-part1")
# set up mirroring afterwards if more than one disk
boot_partition = f"mount -t vfat -o fmask=0077,dmask=0077,iocharset=iso8859-1,X-mount.mkdir {disks[0]}-part1 {mnt_dir}/boot"
bash_wrapper(boot_partition)
bash_wrapper(f"nixos-generate-config --root {mnt_dir}")
host_id = format(getrandbits(32), "08x")
nix_hardware = Path(f"{mnt_dir}/etc/nixos/hardware-configuration.nix").read_text()
nix_hardware = nix_hardware.replace(
";\n}", f';\n networking.hostId = "{host_id}";' "\n}"
)
if encrypt:
test = [
f' "luks-root-pool-{disk.split("/")[-1]}-part2".device = "{disk}-part2";\n'
for disk in disks
]
encrypted_disks = (
";\n boot.initrd.luks.devices = {\n" f"{''.join(test)}" " };\n" "}"
)
nix_hardware = nix_hardware.replace(";\n}", encrypted_disks)
Path(f"{mnt_dir}/etc/nixos/hardware-configuration.nix").write_text(nix_hardware)
run(("nixos-install", "--root", mnt_dir), check=True) # noqa: S603
def main() -> None:
"""Main."""
configure_logger("DEBUG")
logging.info("Starting installation")
disks = ("/dev/disk/by-id/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",)
# Set swap size in GB, set to 1 if you don't want swap to take up too much space
swap_size = 1
reserve = 0
encrypt_key = getenv("ENCRYPT_KEY")
for disk in disks:
partition_disk(disk, swap_size, reserve)
if encrypt_key:
sleep(1)
for command in (
f'printf "{encrypt_key}" | cryptsetup luksFormat --type luks2 {disk}-part2 -',
f'printf "{encrypt_key}" | cryptsetup luksOpen {disk}-part2 luks-root-pool-{disk.split("/")[-1]}-part2 -',
):
run(command, shell=True, check=True)
mnt_dir = "/tmp/nix_install" # noqa: S108
Path(mnt_dir).mkdir(parents=True, exist_ok=True)
if encrypt_key:
pool_disks = [
f'/dev/mapper/luks-root-pool-{disk.split("/")[-1]}-part2' for disk in disks
]
else:
pool_disks = [f"{disk}-part2" for disk in disks]
create_zfs_pool(pool_disks, mnt_dir)
create_zfs_datasets()
install_nixos(mnt_dir, disks, encrypt_key)
logging.info("Installation complete")
if __name__ == "__main__":
main()

14
treefmt.toml
View File

@@ -1,14 +0,0 @@
# One CLI to format the code tree - https://github.com/numtide/treefmt
[global]
# Glob patterns of files to exclude
excludes = [".git/"]
[formatter.nixfmt]
# Formatter to run
command = "nixfmt"
# Command-line arguments for the command
#options = []
# Glob pattern of files to include
includes = ["*.nix"]

30
users/gaming/default.nix
View File

@@ -1,30 +0,0 @@
{
pkgs,
config,
...
}:
{
sops.secrets.gaming_password = {
sopsFile = ../secrets.yaml;
neededForUsers = true;
};
users = {
users.gaming = {
isNormalUser = true;
hashedPasswordFile = "${config.sops.secrets.gaming_password.path}";
shell = pkgs.zsh;
group = "gaming";
extraGroups = [
"audio"
"video"
"users"
];
uid = 1100;
};
groups.gaming.gid = 1100;
};
home-manager.users.gaming = import ./systems/${config.networking.hostName}.nix;
}

17
users/gaming/home/global.nix
View File

@@ -1,17 +0,0 @@
{ config, ... }:
{
imports = [
./programs.nix
];
programs = {
home-manager.enable = true;
git.enable = true;
};
home = {
username = "gaming";
homeDirectory = "/home/${config.home.username}";
stateVersion = "24.05";
};
}

8
users/gaming/home/programs.nix
View File

@@ -1,8 +0,0 @@
{ pkgs, ... }:
{
home.packages = with pkgs; [
chromium
vscode
firefox
];
}

5
users/gaming/systems/bob.nix
View File

@@ -1,5 +0,0 @@
{
imports = [
../home/global.nix
];
}

74
users/richie/default.nix
View File

@@ -2,52 +2,40 @@
pkgs,
config,
...
}:
let
}: let
ifTheyExist = groups: builtins.filter (group: builtins.hasAttr group config.users.groups) groups;
in
{
sops.secrets.richie_password = {
sopsFile = ../secrets.yaml;
neededForUsers = true;
in {
users.users.richie = {
isNormalUser = true;
shell = pkgs.zsh;
group = "richie";
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIPtuYhiJHRTYhNaDmTcJOqJASk7D8mIn6u3F1IN5AFJ bob" # cspell:disable-line
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJYZFsc9CSH03ZUP7y81AHwSyjLwFmcshVFCyxDcYhBT rhapsody-in-green" # cspell:disable-line
];
extraGroups =
[
"audio"
"video"
"wheel"
"users"
]
++ ifTheyExist [
"dialout"
"docker"
"libvirtd"
"networkmanager"
"plugdev"
"scanner"
"uaccess"
"wireshark"
];
uid = 1000;
};
users = {
users.richie = {
isNormalUser = true;
hashedPasswordFile = "${config.sops.secrets.richie_password.path}";
shell = pkgs.zsh;
group = "richie";
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJYZFsc9CSH03ZUP7y81AHwSyjLwFmcshVFCyxDcYhBT rhapsody-in-green" # cspell:disable-line
];
extraGroups =
[
"audio"
"video"
"wheel"
"users"
]
++ ifTheyExist [
"dialout"
"docker"
"hass"
"libvirtd"
"networkmanager"
"plugdev"
"scanner"
"transmission"
"uaccess"
"wireshark"
];
uid = 1000;
};
groups.richie.gid = 1000;
users.groups.richie = {
gid = 1000;
};
home-manager.users.richie = import ./systems/${config.networking.hostName}.nix;
home-manager.users.richie = import ./systems/${config.networking.hostName}.nix;
}

2
users/richie/home/cli/default.nix
View File

@@ -1,8 +1,8 @@
{
imports = [
./direnv.nix
./git.nix
./zsh.nix
./direnv.nix
];
programs.starship.enable = true;

5
users/richie/home/cli/git.nix
View File

@@ -3,10 +3,5 @@
enable = true;
userEmail = "Richie@tmmworkshop.com";
userName = "Richie Cahill";
extraConfig = {
pull.rebase = true;
color.ui = true;
};
lfs.enable = true;
};
}

7
users/richie/home/cli/zsh.nix
View File

@@ -18,14 +18,17 @@
];
};
shellAliases = {
"sgc" = "sudo git -C /root/dotfiles";
## Utilities
"lrt" = "eza --icons -lsnew";
"ls" = "eza";
"ll" = "eza --long --group";
"la" = "eza --all";
"rspace" = "'for f in *\ *; do mv \"$f\" \"\${f// /_}\"; done'";
"rebuild" = "sudo nixos-rebuild switch --flake /home/richie/dotfiles#$HOST";
"nix-test" = "nixos-rebuild test --flake /home/richie/dotfiles";
"rebuild" = "sudo nixos-rebuild switch --flake /home/richie/projects/dotfiles#$HOST";
"nix-test" = "nixos-rebuild test --flake /home/richie/projects/dotfiles";
};
};
}

25
users/richie/home/global.nix
View File

@@ -1,22 +1,37 @@
{ config, ... }:
{
lib,
pkgs,
config,
...
}: {
imports = [
./cli
./programs.nix
./ssh_config.nix
];
nix = {
package = lib.mkDefault pkgs.nix;
settings = {
experimental-features = [
"nix-command"
"flakes"
"ca-derivations"
];
};
};
programs = {
home-manager.enable = true;
git.enable = true;
};
home = {
username = "richie";
homeDirectory = "/home/${config.home.username}";
stateVersion = "24.05";
username = lib.mkDefault "richie";
homeDirectory = lib.mkDefault "/home/${config.home.username}";
stateVersion = lib.mkDefault "24.05";
sessionVariables = {
FLAKE = "$HOME/dotfiles";
FLAKE = "$HOME/Projects/dotfiles";
};
};
}

7
users/richie/home/gui/default.nix
View File

@@ -1,25 +1,20 @@
{ pkgs, ... }:
{
imports = [
./firefox
./firefox.nix
./vscode
./kitty.nix
];
home.packages = with pkgs; [
candy-icons
chromium
discord-canary
gimp
gparted
jetbrains.datagrip
ladybird
mediainfo
nemo
nemo-fileroller
obs-studio
obsidian
prismlauncher
proxychains
prusa-slicer
signal-desktop

69
users/richie/home/gui/firefox/default.nix → users/richie/home/gui/firefox.nix
View File

@@ -1,11 +1,13 @@
{ inputs, ... }:
{
imports = [ ./search_engines.nix ];
pkgs,
inputs,
...
}:
{
programs.firefox = {
enable = true;
profiles.richie = {
extensions.packages = with inputs.firefox-addons.packages.x86_64-linux; [
extensions = with inputs.firefox-addons.packages.x86_64-linux; [
bitwarden
darkreader
dearrow
@@ -14,15 +16,55 @@
sponsorblock
ublock-origin
];
search = {
force = true;
default = "kagi";
order = [
"kagi"
"ddg"
"google"
];
search.engines = {
"Nix Options" = {
urls = [
{
template = "https://search.nixos.org/options";
params = [
{
name = "type";
value = "packages";
}
{
name = "channel";
value = "unstable";
}
{
name = "query";
value = "{searchTerms}";
}
];
}
];
icon = "${pkgs.nixos-icons}/share/icons/hicolor/scalable/apps/nix-snowflake.svg";
definedAliases = [ "@o" ];
};
"Nix Packages" = {
urls = [
{
template = "https://search.nixos.org/packages";
params = [
{
name = "type";
value = "packages";
}
{
name = "channel";
value = "unstable";
}
{
name = "query";
value = "{searchTerms}";
}
];
}
];
icon = "${pkgs.nixos-icons}/share/icons/hicolor/scalable/apps/nix-snowflake.svg";
definedAliases = [ "@n" ];
};
};
search.force = true;
settings = {
# SECTION: FASTFOX
# GENERAL
@@ -142,8 +184,7 @@
"permissions.default.desktop-notification" = 0; # allow websites to ask
# PREF: allow websites to ask you for your location
"permissions.default.geo" = 0;
"geo.provider.network.url" =
"https://location.services.mozilla.com/v1/geolocate?key=%MOZILLA_API_KEY%";
"geo.provider.network.url" = "https://location.services.mozilla.com/v1/geolocate?key=%MOZILLA_API_KEY%";
"permissions.manager.defaultsUrl" = "";
"webchannel.allowObject.urlWhitelist" = "";

3
users/richie/home/gui/firefox/github.svg
View File

@@ -1,3 +0,0 @@
<svg width="32" height="32" viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg">
<path fill-rule="evenodd" clip-rule="evenodd" d="M16 0C7.16 0 0 7.16 0 16C0 23.08 4.58 29.06 10.94 31.18C11.74 31.32 12.04 30.84 12.04 30.42C12.04 30.04 12.02 28.78 12.02 27.44C8 28.18 6.96 26.46 6.64 25.56C6.46 25.1 5.68 23.68 5 23.3C4.44 23 3.64 22.26 4.98 22.24C6.24 22.22 7.14 23.4 7.44 23.88C8.88 26.3 11.18 25.62 12.1 25.2C12.24 24.16 12.66 23.46 13.12 23.06C9.56 22.66 5.84 21.28 5.84 15.16C5.84 13.42 6.46 11.98 7.48 10.86C7.32 10.46 6.76 8.82 7.64 6.62C7.64 6.62 8.98 6.2 12.04 8.26C13.32 7.9 14.68 7.72 16.04 7.72C17.4 7.72 18.76 7.9 20.04 8.26C23.1 6.18 24.44 6.62 24.44 6.62C25.32 8.82 24.76 10.46 24.6 10.86C25.62 11.98 26.24 13.4 26.24 15.16C26.24 21.3 22.5 22.66 18.94 23.06C19.52 23.56 20.02 24.52 20.02 26.02C20.02 28.16 20 29.88 20 30.42C20 30.84 20.3 31.34 21.1 31.18C27.42 29.06 32 23.06 32 16C32 7.16 24.84 0 16 0V0Z" fill="white"/>
</svg>
Side by Side

Before

Width:  |  Height:  |  Size: 957 B

BIN
users/richie/home/gui/firefox/kagi.png
View File

Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 924 B

99
users/richie/home/gui/firefox/search_engines.nix
View File

@@ -1,99 +0,0 @@
{ pkgs, ... }:
{
programs.firefox.profiles.richie.search.engines = {
"Nix Options" = {
urls = [
{
template = "https://search.nixos.org/options";
params = [
{
name = "type";
value = "packages";
}
{
name = "channel";
value = "unstable";
}
{
name = "query";
value = "{searchTerms}";
}
];
}
];
icon = "${pkgs.nixos-icons}/share/icons/hicolor/scalable/apps/nix-snowflake.svg";
definedAliases = [ "@o" ];
};
"Nix Packages" = {
urls = [
{
template = "https://search.nixos.org/packages";
params = [
{
name = "type";
value = "packages";
}
{
name = "channel";
value = "unstable";
}
{
name = "query";
value = "{searchTerms}";
}
];
}
];
icon = "${pkgs.nixos-icons}/share/icons/hicolor/scalable/apps/nix-snowflake.svg";
definedAliases = [ "@n" ];
};
"Nix Packages pr-tracker" = {
urls = [
{
template = "https://nixpk.gs/pr-tracker.html?";
params = [
{
name = "pr";
value = "{searchTerms}";
}
];
}
];
icon = "${pkgs.nixos-icons}/share/icons/hicolor/scalable/apps/nix-snowflake.svg";
definedAliases = [ "@nprt" ];
};
"kagi" = {
urls = [
{
template = "https://kagi.com/search?";
params = [
{
name = "q";
value = "{searchTerms}";
}
];
}
];
icon = ./kagi.png;
};
github = {
urls = [
{
template = "https://github.com/search?";
params = [
{
name = "q";
value = "{searchTerms}";
}
{
name = "type";
value = "code";
}
];
}
];
icon = ./github.svg;
definedAliases = [ "@g" ];
};
};
}

13
users/richie/home/gui/kitty.nix
View File

@@ -1,13 +0,0 @@
{ pkgs, ... }:
{
programs.kitty = {
enable = true;
font.name = "IntoneMono Nerd Font";
settings = {
allow_remote_control = "no";
shell = "${pkgs.zsh}/bin/zsh";
wayland_titlebar_color = "background";
};
themeFile = "VSCode_Dark";
};
}

8
users/richie/home/gui/vscode/default.nix
View File

@@ -1,13 +1,11 @@
{ config, pkgs, ... }:
let
vscode_dir = "/home/richie/dotfiles/users/richie/home/gui/vscode";
vscode_dir = "/home/richie/projects/nix-dotfiles/users/richie/home/gui/vscode";
in
{
# mutable symlinks to key binds and settings
xdg.configFile."Code/User/settings.json".source =
config.lib.file.mkOutOfStoreSymlink "${vscode_dir}/settings.json";
xdg.configFile."Code/User/keybindings.json".source =
config.lib.file.mkOutOfStoreSymlink "${vscode_dir}/keybindings.json";
xdg.configFile."Code/User/settings.json".source = config.lib.file.mkOutOfStoreSymlink "${vscode_dir}/settings.json";
xdg.configFile."Code/User/keybindings.json".source = config.lib.file.mkOutOfStoreSymlink "${vscode_dir}/keybindings.json";
home.packages = with pkgs; [ nil ];

19
users/richie/home/gui/vscode/settings.json
View File

@@ -15,7 +15,6 @@
"terminal.integrated.scrollback": 10000,
"update.mode": "none",
"workbench.colorTheme": "Default Dark+",
"workbench.secondarySideBar.showLabels": false,
// turns off all sounds and announcements
"accessibility.signals.terminalCommandFailed": {
@@ -31,24 +30,9 @@
"announcement": "off"
},
// database settings
"sqltools.connections": [
{
"previewLimit": 50,
"server": "192.168.90.40",
"port": 5432,
"askForPassword": true,
"driver": "PostgreSQL",
"name": "main",
"database": "postgres",
"username": "richie"
}
],
// formatters
"[html]": { "editor.defaultFormatter": "esbenp.prettier-vscode" },
"[jsonc]": { "editor.defaultFormatter": "esbenp.prettier-vscode" },
"[json]": { "editor.defaultFormatter": "esbenp.prettier-vscode" },
"[markdown]": { "editor.defaultFormatter": "esbenp.prettier-vscode" },
"[nix]": { "editor.defaultFormatter": "jnoortheen.nix-ide" },
"[python]": { "editor.defaultFormatter": "charliermarsh.ruff" },
@@ -64,9 +48,6 @@
"nix.enableLanguageServer": true,
"nix.serverPath": "nil",
// python tools
"mypy.runUsingActiveInterpreter": true,
// force the use of rust-analyzer from dev shell
"rust-analyzer.server.path": "rust-analyzer",
"redhat.telemetry.enabled": true,

15
users/richie/home/programs.nix
View File

@@ -5,24 +5,14 @@
bat
btop
eza
fd
ffmpegthumbnailer
fzf
git
gnupg
imagemagick
jq
ncdu
neofetch
ouch
p7zip
poppler
rar
ripgrep
starship
tmux
unzip
yazi
zoxide
# system info
hwloc
@@ -36,7 +26,7 @@
wget
# python
poetry
python313
python312
ruff
# Rust packages
trunk
@@ -50,8 +40,7 @@
nix-output-monitor
nix-prefetch
nix-tree
nixfmt-rfc-style
treefmt
nixpkgs-fmt
inputs.system_tools.packages.x86_64-linux.default
];
}

7
users/richie/home/ssh_config.nix
View File

@@ -16,6 +16,13 @@
identityFile = "~/.ssh/id_ed25519";
port = 2222;
};
jeevesjr = {
hostname = "192.168.90.35";
user = "richie";
identityFile = "~/.ssh/id_ed25519";
port = 352;
dynamicForwards = [ { port = 9050; } ];
};
bob = {
hostname = "192.168.90.25";
user = "richie";

58
users/secrets.yaml
View File

@@ -1,58 +0,0 @@
richie_password: ENC[AES256_GCM,data:DMi3M8aqrQ60APIofr8wJMh+VZ14hLRxz6jWZgzswr0pV/QVSX53ShBFr90ruO3mucOLYv0l+bI31covfqMAhXWBJp9wUgtC2Q==,iv:qgtn30hZfIL4dBnQSLkjbo7zPJA4m9TR0f52sTFc0v4=,tag:ydLbcGyXjv0fE+4b5ECX5w==,type:str]
gaming_password: ENC[AES256_GCM,data:i692UsQaCOjE4V1y9d8yYDlK+TRMIprCHJkhl1UBZRMqe9a2LTUtmbbn/xlCYQd2tADJvn+dkx1jLfV4CqaqWOj5YSUFfpgsEw==,iv:3Y7hXQcmpzNN7hF+BDvO52uFB4o5D0dHvxemJ0ZoSIM=,tag:zzLGNDVAMCs2GPMqXp2BtQ==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age1u8zj599elqqvcmhxn8zuwrufsz8w8w366d3ayrljjejljt2q45kq8mxw9c
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqR1lUREVMR3hyTTFNZ3U0
NkFkY202RGtMS0taTjRnOEd4OGlsZ1VORUhFCnIxUlV1eS81N0U1NXpOcWYxSUU0
WER1cFY3a2lWU01tTUQ2Vk5VK2JmSDAKLS0tIHUxL3F5UWZ2aUwxd2JXZG5ybE9w
d29oZ1poZU5ZTlgxMmlsVWpoMUtFYjAKdRoXdqxfxyOL++pP0izdUuZngMcF24ne
OJ6kVJexJF9Hu9InwPeDtRboMhMi01gt6L5a47hOX5FUsi+4HbeVLQ==
-----END AGE ENCRYPTED FILE-----
- recipient: age1q47vup0tjhulkg7d6xwmdsgrw64h4ax3la3evzqpxyy4adsmk9fs56qz3y
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBWmJZWDZtWFJaTCtmdVNG
QkNiK1hFdWlnVFp0ZG01V1A3cFdtU2xGN1NBCm1oeXlLT3NYMC9lZDlHSnJGQUc1
RnppNjc0QnBqSW5XTWUxZExBMHhORDQKLS0tIHpJNDJBU25COGR2dlg5em5YcGZB
VTBqRjhZWkdmdVdoa0V0VmIzdm5hbTgKEa9hW6jU538meU2Sm//b7OUBqqjAHHL5
rluVCSMcrcoVtui0mB8vMoKeh6/n/qRLe38a/puvAj0q/PolN9ZEhA==
-----END AGE ENCRYPTED FILE-----
- recipient: age13lmqgc3jvkyah5e3vcwmj4s5wsc2akctcga0lpc0x8v8du3fxprqp4ldkv
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBVlp4clVEb3Y4d0hzSEtW
dUMyb3V1aHlMS0Fvc0lGU3doRjE3SVFrNVdFCkpTQ1k2RTBIb2tzQ3UxajlPSWhY
ZzkwUWlDYWROZXpHMlFVaTM0MFlpMXcKLS0tIFNUN1QyRk41WkhPblZMbVFXNkZi
N1RkUVc0N0hIaUs3RXpXTWpDZTBOUXcKgOW6IV1mh3q8NT2Ky9EKlywWBaaCn5ML
bhfmmvt1Fndh2ys3poxODjNDiow34VxwhS+Ou0HsxsJ7zu7VvmPh0w==
-----END AGE ENCRYPTED FILE-----
- recipient: age1xzxryqq63x65yuza9lmmkud7crjjxpnkdew070yhx6xn7xe4tdws5twxsv
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnOXR6SWh2SlBWdjZVL3F1
ckd4N3JKNkkzYWtlRWN2QUFob3FJRkxQU1RNClllMDFMRE80ODROZDR3Y2g0Z2xs
aXJORTI1azEzbnhJMkZiNmNKZDBsOVUKLS0tIHZjV3BXaG9WVzNzVDZHYVdmOFdM
S3hZMkgvYkl5Ky9uYmpjVHpFUlMwYTgKIHxHRPMgEAgQNXg5lK2QkdBjMcamlxSp
HEoT/APYI/NN3V2l7mgfiH/fn2FXGdd3Ct5mqwp25GUYIp45zN3pqA==
-----END AGE ENCRYPTED FILE-----
- recipient: age1ufnewppysaq2wwcl4ugngjz8pfzc5a35yg7luq0qmuqvctajcycs5lf6k4
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXSnNxaDVSbUJ2Y1NSc0hV
TWhzNzNRWTNhV1BBMFhPeVQ5eHkzb3Bkams4Ck1YdDExcU1WdExEQ0M1VXZpUzBV
L0xSTENrOEZlOU1XUHNUbEtHbURSK1UKLS0tIEJkaE9QOUdzN1VDbWFTSWd6RkY4
UzQzWEFtSDJwR201cmZoeXh5T0RmSk0KWLOpw5cWbtnfVP/ISa7n1vZchoD+nxmn
7yr7igpEIro0Sd238KinOQYswVaT0NHB9p1dSW/mN+aGQliSNLzkDQ==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2025-01-07T20:13:43Z"
mac: ENC[AES256_GCM,data:Q5fmv+MRVYGUQ4j+28CcGWHmgT1178N+haVS9xa0c99OKuPZdfSndAG0QVDhh/jYq+7zXs6zzLtBjB+egkoDfxJXfJOmg3E46UMO3vDHaEcIZD16ZbWJaz4Z/+yabqhDURKtgfGiu4xPv3OtGbwcP5kud17WcHNfY/LT+Y+LSD8=,iv:y3K3kCroIh+RTplUe4tM8B9rbLgIHCbE6FJawngam8Q=,tag:2VTIWlLp4cOwm18BfIlz5g==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.9.2