Compare commits

..

4 Commits

Author SHA1 Message Date
df9df5b216 updating system_tools 2025-05-17 14:46:05 -04:00
55726b54cf got unifi connected 2025-05-14 19:26:12 -04:00
d441f065c6 deleted duckdns.nix 2025-05-13 19:10:14 -04:00
ceb3bf4efd adding samba services 2025-05-13 19:06:12 -04:00
29 changed files with 107 additions and 309 deletions

View File

@@ -274,6 +274,7 @@
"ublock",
"uiprotect",
"uitour",
"unifi",
"unrar",
"unsubmitted",
"uptimekuma",

View File

@@ -56,14 +56,7 @@
programs.zsh.enable = true;
security = {
auditd.enable = lib.mkDefault true;
sudo-rs = {
enable = true;
execWheelOnly = true;
};
sudo.enable = false;
};
security.auditd.enable = lib.mkDefault true;
users.mutableUsers = lib.mkDefault false;

View File

@@ -4,7 +4,8 @@
console.keyMap = lib.mkDefault "us";
i18n = {
defaultLocale = lib.mkDefault "en_US.UTF-8";
defaultLocale = lib.mkDefault "en_US.utf8";
supportedLocales = lib.mkDefault [ "en_US.UTF-8/UTF-8" ];
extraLocaleSettings = lib.mkDefault {
LC_ADDRESS = "en_US.UTF-8";
LC_IDENTIFICATION = "en_US.UTF-8";

View File

@@ -15,14 +15,17 @@ in
];
trusted-substituters = [
"https://cache.nixos.org"
"https://cache.tmmworkshop.com"
"https://nix-community.cachix.org"
];
substituters = [
"https://cache.nixos.org/?priority=2&want-mass-query=true"
"https://cache.tmmworkshop.com/?priority=2&want-mass-query=true"
"https://nix-community.cachix.org/?priority=10&want-mass-query=true"
];
trusted-public-keys = [
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
"cache.tmmworkshop.com:jHffkpgbmEdstQPoihJPYW9TQe6jnQbWR2LqkNGV3iA="
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
];
auto-optimise-store = lib.mkDefault true;

View File

@@ -1,7 +1,7 @@
{ pkgs, ... }:
{
boot = {
kernelPackages = pkgs.linuxPackages_6_15;
kernelPackages = pkgs.linuxPackages_6_13;
zfs.package = pkgs.zfs_2_3;
};

View File

@@ -1,7 +0,0 @@
{
nix.settings = {
trusted-substituters = [ "http://cache.tmmworkshop.com" ];
substituters = [ "http://cache.tmmworkshop.com/?priority=1&want-mass-query=true" ];
trusted-public-keys = [ "cache.tmmworkshop.com:jHffkpgbmEdstQPoihJPYW9TQe6jnQbWR2LqkNGV3iA=" ];
};
}

36
flake.lock generated
View File

@@ -8,11 +8,11 @@
},
"locked": {
"dir": "pkgs/firefox-addons",
"lastModified": 1750219402,
"narHash": "sha256-b3y7V7db0VwLGtpcLRmT1Aa9dpAKoHQdem55UhgB/fw=",
"lastModified": 1747022610,
"narHash": "sha256-d6SvA0gTHDrOqt4tZRVD0Gm5G4w6jAFJ6lis79PjSPw=",
"owner": "rycee",
"repo": "nur-expressions",
"rev": "a00ce73b626ed274fbfe9f51627861e140b08f6d",
"rev": "d4b3ffe3e719e42b175ccdef13598516f0a8025d",
"type": "gitlab"
},
"original": {
@@ -29,11 +29,11 @@
]
},
"locked": {
"lastModified": 1750275572,
"narHash": "sha256-upC/GIlsIgtdtWRGd1obzdXWYQptNkfzZeyAFWgsgf0=",
"lastModified": 1747081732,
"narHash": "sha256-VnR33UmH0KzvTuVg+6oYkDVpnPuHanQisNUXytCRBPQ=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "0f355844e54e4c70906b1ef5cc35a0047d666c04",
"rev": "f0a7db5ec1d369721e770a45e4d19f8e48186a69",
"type": "github"
},
"original": {
@@ -44,11 +44,11 @@
},
"nixos-hardware": {
"locked": {
"lastModified": 1750083401,
"narHash": "sha256-ynqbgIYrg7P1fAKYqe8I/PMiLABBcNDYG9YaAP/d/C4=",
"lastModified": 1747083103,
"narHash": "sha256-dMx20S2molwqJxbmMB4pGjNfgp5H1IOHNa1Eby6xL+0=",
"owner": "nixos",
"repo": "nixos-hardware",
"rev": "61837d2a33ccc1582c5fabb7bf9130d39fee59ad",
"rev": "d1d68fe8b00248caaa5b3bbe4984c12b47e0867d",
"type": "github"
},
"original": {
@@ -60,11 +60,11 @@
},
"nixpkgs": {
"locked": {
"lastModified": 1750134718,
"narHash": "sha256-v263g4GbxXv87hMXMCpjkIxd/viIF7p3JpJrwgKdNiI=",
"lastModified": 1746904237,
"narHash": "sha256-3e+AVBczosP5dCLQmMoMEogM57gmZ2qrVSrmq9aResQ=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "9e83b64f727c88a7711a2c463a7b16eedb69a84c",
"rev": "d89fc19e405cb2d55ce7cc114356846a0ee5e956",
"type": "github"
},
"original": {
@@ -76,11 +76,11 @@
},
"nixpkgs-master": {
"locked": {
"lastModified": 1750291913,
"narHash": "sha256-JW40+zIiDS+rZavb9IYdIN40/GmErO2+0+A66rM6/b8=",
"lastModified": 1747094543,
"narHash": "sha256-WJ55VutSzEjVjq9jYpUvJp6fRB8ncgVzFpWoAwfvppg=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "ba92ab5dc0759a8740003ca34b5c1b888f4766d4",
"rev": "bee20293bce36bd20f2ed6627a60db76eaa7e9b4",
"type": "github"
},
"original": {
@@ -176,11 +176,11 @@
]
},
"locked": {
"lastModified": 1750119275,
"narHash": "sha256-Rr7Pooz9zQbhdVxux16h7URa6mA80Pb/G07T4lHvh0M=",
"lastModified": 1746485181,
"narHash": "sha256-PxrrSFLaC7YuItShxmYbMgSuFFuwxBB+qsl9BZUnRvg=",
"owner": "Mic92",
"repo": "sops-nix",
"rev": "77c423a03b9b2b79709ea2cb63336312e78b72e2",
"rev": "e93ee1d900ad264d65e9701a5c6f895683433386",
"type": "github"
},
"original": {

View File

@@ -4,10 +4,12 @@
nixConfig = {
extra-substituters = [
"https://cache.nixos.org/?priority=2&want-mass-query=true"
"https://cache.tmmworkshop.com/?priority=2&want-mass-query=true"
"https://nix-community.cachix.org/?priority=10&want-mass-query=true"
];
extra-trusted-public-keys = [
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" # cspell:disable-line
"cache.tmmworkshop.com:jHffkpgbmEdstQPoihJPYW9TQe6jnQbWR2LqkNGV3iA=" # cspell:disable-line
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" # cspell:disable-line
"cache-nix-dot:Od9KN34LXc6Lu7y1ozzV1kIXZa8coClozgth/SYE7dU=" # cspell:disable-line
];

View File

@@ -7,12 +7,13 @@
../../common/optional/syncthing_base.nix
../../common/optional/zerotier.nix
./docker
./services
./hardware.nix
./networking.nix
./nvidia.nix
./programs.nix
./runners
./services
./services_accounts.nix
./syncthing.nix
];

View File

@@ -1,61 +0,0 @@
{
config,
pkgs,
lib,
...
}:
let
vars = import ../vars.nix;
in
{
# environment.systemPackages = with pkgs; [ php.withExtensions ({ all, ... }: [ all.pdo_pgsql ]) ];
services.httpd = {
enable = true;
adminAddr = "webmaster@localhost";
enablePHP = true;
phpPackage = pkgs.php.withExtensions (
{ enabled, all }:
enabled
++ [
all.pdo
all.pdo_pgsql
]
);
extraModules = [ "rewrite" ];
virtualHosts.great_cloud_of_witnesses = {
hostName = "localhost";
listen = [
{
ip = "*";
port = 8092;
}
];
documentRoot = "${vars.services}/great_cloud_of_witnesses";
extraConfig = ''
<Directory "${vars.services}/great_cloud_of_witnesses">
AllowOverride All
Require all granted
</Directory>
'';
};
};
sops.secrets.gcw_password = {
sopsFile = ../../../users/secrets.yaml;
neededForUsers = true;
};
users = {
users.gcw = {
isSystemUser = true;
hashedPasswordFile = config.sops.secrets.gcw_password.path;
group = "gcw";
};
groups.gcw = { };
};
}

View File

@@ -11,8 +11,8 @@
networks = {
"10-1GB_Primary" = {
matchConfig.Name = "enp98s0f0";
address = [ "192.168.99.14/24" ];
routes = [ { Gateway = "192.168.99.1"; } ];
address = [ "192.168.95.14/24" ];
routes = [ { Gateway = "192.168.95.1"; } ];
linkConfig.RequiredForOnline = "routable";
};
"10-1GB_Secondary" = {

View File

@@ -64,7 +64,7 @@ in
Host jeeves
Port 629
User github-runners
HostName 192.168.99.14
HostName 192.168.95.14
IdentityFile ${vars.secrets}/services/github-runners/id_ed25519_github-runners
StrictHostKeyChecking no
UserKnownHostsFile /dev/null

View File

@@ -31,7 +31,7 @@ frontend ContentSwitching
acl host_homeassistant hdr(host) -i homeassistant.tmmworkshop.com
acl host_jellyfin hdr(host) -i jellyfin.tmmworkshop.com
acl host_share hdr(host) -i share.tmmworkshop.com
acl host_gcw hdr(host) -i gcw.tmmworkshop.com
acl host_uptime_kuma hdr(host) -i uptimekuma-jeeves.tmmworkshop.com
use_backend audiobookshelf_nodes if host_audiobookshelf
use_backend cache_nodes if host_cache
@@ -39,7 +39,7 @@ frontend ContentSwitching
use_backend homeassistant_nodes if host_homeassistant
use_backend jellyfin if host_jellyfin
use_backend share_nodes if host_share
use_backend gcw_nodes if host_gcw
use_backend uptime_kuma_nodes if host_uptime_kuma
backend audiobookshelf_nodes
mode http
@@ -68,6 +68,6 @@ backend share_nodes
mode http
server server 127.0.0.1:8091
backend gcw_nodes
backend uptime_kuma_nodes
mode http
server server 127.0.0.1:8092
server server 127.0.0.1:3001

View File

@@ -19,7 +19,7 @@ in
http = {
server_port = 8123;
server_host = [
"192.168.99.14"
"192.168.95.14"
"192.168.90.40"
"127.0.0.1"
];

View File

@@ -23,7 +23,7 @@ in
host all richie 127.0.0.1/32 trust
host all richie ::1/128 trust
host all richie 192.168.90.1/24 trust
host all richie 192.168.99.1/24 trust
host all richie 192.168.95.1/24 trust
#type database DBuser origin-address auth-method
@@ -35,19 +35,6 @@ in
# ipv6
host hass hass ::1/128 trust
# megan
host megan megan 192.168.90.1/24 trust
host megan megan 127.0.0.1/32 trust
host gcw megan 192.168.90.1/24 trust
host gcw megan 127.0.0.1/32 trust
# gcw
local gcw gcw trust
host gcw gcw 192.168.90.1/24 trust
host gcw gcw 127.0.0.1/32 trust
'';
identMap = ''
@@ -90,31 +77,9 @@ in
replication = true;
};
}
{
name = "megan";
ensureDBOwnership = true;
ensureClauses = {
login = true;
createrole = true;
createdb = true;
replication = true;
};
}
{
name = "gcw";
ensureDBOwnership = true;
ensureClauses = {
login = true;
createrole = true;
createdb = true;
replication = true;
};
}
];
ensureDatabases = [
"gcw"
"hass"
"megan"
"mxr_dev"
"mxr_prod"
"richie"

View File

@@ -0,0 +1,34 @@
{
services = {
samba = {
enable = true;
openFirewall = true;
settings = {
global = {
"workgroup" = "WORKGROUP";
"server string" = "smbnix";
"netbios name" = "smbnix";
"security" = "user";
"hosts allow" = "192.168.95. 127.0.0.1 localhost";
"hosts deny" = "0.0.0.0/0";
"guest account" = "nobody";
"map to guest" = "bad user";
};
"unifi" = {
"path" = "/zfs/storage/main/unifi";
"browseable" = "yes";
"read only" = "no";
"guest ok" = "no";
"create mask" = "0644";
"directory mask" = "0755";
"force user" = "unifi";
"force group" = "unifi";
};
};
};
samba-wsdd = {
enable = true;
openFirewall = true;
};
};
}

View File

@@ -12,7 +12,7 @@ in
openRPCPort = true;
downloadDirPermissions = "770";
settings = {
bind-address-ipv4 = "192.168.99.14";
bind-address-ipv4 = "192.168.95.14";
cache-size-mb = 0;
download-dir = "${vars.transmission}/complete";
download-queue-enabled = false;

View File

@@ -0,0 +1,22 @@
{
config,
...
}:
{
sops.secrets.unifi_password = {
sopsFile = ../../users/secrets.yaml;
neededForUsers = true;
};
users = {
users.unifi = {
isSystemUser = true;
group = "unifi";
extraGroups = [ "samba" ];
hashedPasswordFile = "${config.sops.secrets.unifi_password.path}";
};
groups.unifi = { };
};
}

View File

@@ -1,30 +0,0 @@
{
pkgs,
config,
...
}:
{
sops.secrets.megan_password = {
sopsFile = ../secrets.yaml;
neededForUsers = true;
};
users = {
users.megan = {
isNormalUser = true;
hashedPasswordFile = "${config.sops.secrets.megan_password.path}";
shell = pkgs.zsh;
group = "megan";
extraGroups = [
"audio"
"video"
"users"
];
uid = 1101;
};
groups.megan.gid = 1101;
};
home-manager.users.megan = import ./systems/${config.networking.hostName}.nix;
}

View File

@@ -1,9 +0,0 @@
{
imports = [
./direnv.nix
./git.nix
./zsh.nix
];
programs.starship.enable = true;
}

View File

@@ -1,8 +0,0 @@
{
programs.direnv = {
enable = true;
enableZshIntegration = true;
nix-direnv.enable = true;
};
}

View File

@@ -1,12 +0,0 @@
{
programs.git = {
enable = true;
userEmail = "mousikos112@gmail.com";
userName = "megan";
extraConfig = {
pull.rebase = true;
color.ui = true;
};
lfs.enable = true;
};
}

View File

@@ -1,31 +0,0 @@
{
programs.zsh = {
enable = true;
syntaxHighlighting.enable = true;
history.size = 10000;
oh-my-zsh = {
enable = true;
plugins = [
"git"
"docker"
"docker-compose"
"colored-man-pages"
"rust"
"systemd"
"tmux"
"ufw"
"z"
];
};
shellAliases = {
"lrt" = "eza --icons -lsnew";
"ls" = "eza";
"ll" = "eza --long --group";
"la" = "eza --all";
"rspace" = "'for f in *\ *; do mv \"$f\" \"\${f// /_}\"; done'";
"rebuild" = "sudo nixos-rebuild switch --flake /home/richie/dotfiles#$HOST";
"nix-test" = "nixos-rebuild test --flake /home/richie/dotfiles";
};
};
}

View File

@@ -1,18 +0,0 @@
{ config, ... }:
{
imports = [
./cli
./programs.nix
];
programs = {
home-manager.enable = true;
git.enable = true;
};
home = {
username = "megan";
homeDirectory = "/home/${config.home.username}";
stateVersion = "24.05";
};
}

View File

@@ -1,42 +0,0 @@
{ pkgs, ... }:
{
home.packages = with pkgs; [
# cli
bat
btop
eza
fd
ffmpegthumbnailer
fzf
git
gnupg
imagemagick
jq
ncdu
neofetch
ouch
p7zip
poppler
rar
ripgrep
starship
tmux
unzip
yazi
zoxide
# system info
hwloc
lynis
pciutils
smartmontools
usbutils
# networking
iperf3
nmap
wget
# python
poetry
python313
ruff
];
}

View File

@@ -1,5 +0,0 @@
{
imports = [
../home/global.nix
];
}

View File

@@ -23,9 +23,9 @@
"ll" = "eza --long --group";
"la" = "eza --all";
"rebuild" = "sudo nixos-rebuild switch --flake $HOME/dotfiles#$HOST";
"rebuild_backup" =
"sudo nixos-rebuild switch --flake $HOME/dotfiles#$HOST --option substituters 'https://nix-community.cachix.org' --option trusted-public-keys 'cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY='";
"rspace" = "'for f in *\ *; do mv \"$f\" \"\${f// /_}\"; done'";
"rebuild" = "sudo nixos-rebuild switch --flake /home/richie/dotfiles#$HOST";
"nix-test" = "nixos-rebuild test --flake /home/richie/dotfiles";
};
};
}

View File

@@ -11,7 +11,7 @@
dynamicForwards = [ { port = 9050; } ];
};
unlock-jeeves = {
hostname = "192.168.99.14";
hostname = "192.168.95.14";
user = "root";
identityFile = "~/.ssh/id_ed25519";
port = 2222;

View File

@@ -1,7 +1,6 @@
richie_password: ENC[AES256_GCM,data:DMi3M8aqrQ60APIofr8wJMh+VZ14hLRxz6jWZgzswr0pV/QVSX53ShBFr90ruO3mucOLYv0l+bI31covfqMAhXWBJp9wUgtC2Q==,iv:qgtn30hZfIL4dBnQSLkjbo7zPJA4m9TR0f52sTFc0v4=,tag:ydLbcGyXjv0fE+4b5ECX5w==,type:str]
gaming_password: ENC[AES256_GCM,data:i692UsQaCOjE4V1y9d8yYDlK+TRMIprCHJkhl1UBZRMqe9a2LTUtmbbn/xlCYQd2tADJvn+dkx1jLfV4CqaqWOj5YSUFfpgsEw==,iv:3Y7hXQcmpzNN7hF+BDvO52uFB4o5D0dHvxemJ0ZoSIM=,tag:zzLGNDVAMCs2GPMqXp2BtQ==,type:str]
megan_password: ENC[AES256_GCM,data:Udrs9OWFI2TDM1yxRwfy7uiONh1G3Mr9HabwpmRykp1Xw9KK+q245nxN7QQbR0AiTCyyyivhn6GB2+DvBBY/6UrN5iGs+LaXgg==,iv:n02HzE8jvWM5xDfaPB9BHxtfoAZQ/Tk80XuySY2NyoU=,tag:L9wPVy7zt6mp09qWhzdLpg==,type:str]
gcw_password: ENC[AES256_GCM,data:T5CliWyyw4igunGRokOW7dNTOQ7DbOhM4gLa8YN4gbVLEVU7n3jxAVF9Uy9zM7LBBqdLvyXnqGzC1HBSBmE+pKBV7YIN3aQkng==,iv:SLq4aeLHdwfq0+A4N6UO4Dz7oBoC0ZDKBr74hheHQFw=,tag:4a71PZcyzoWjOmYEPx07ag==,type:str]
unifi_password: ENC[AES256_GCM,data:mFEaXMiVoZtHn3R9fBSpdqUC1DJ1g5jkdQVeQVrCZ+KtFOSGlZRIGI7SiItVZnaQBKFhOecJoXbu0ZQHCyCK0dUImUkBnqZ+4g==,iv:Gzyx5OAKTpXuOCmZnj/lA/o9rl6XDyHdL8YL7x8sGCk=,tag:zwwQgNXEoJUPv7XkRB07gA==,type:str]
sops:
age:
- recipient: age1u8zj599elqqvcmhxn8zuwrufsz8w8w366d3ayrljjejljt2q45kq8mxw9c
@@ -49,7 +48,7 @@ sops:
UzQzWEFtSDJwR201cmZoeXh5T0RmSk0KWLOpw5cWbtnfVP/ISa7n1vZchoD+nxmn
7yr7igpEIro0Sd238KinOQYswVaT0NHB9p1dSW/mN+aGQliSNLzkDQ==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2025-06-05T00:52:15Z"
mac: ENC[AES256_GCM,data:FVj9SmI6uq5ujIX3NwFSLcappRIX0K1U/GXks4Wj0gJH//Tqo5Ur07+WdE5JNmHdS1gXW34RhzFmEbQ9KR2OoP8cfTG+a7qCftzEQbV5aBBEMxstsl48TLtRTwRuSrEnVOHh/0EfFOkXTUO/rVS4jDmd57eAB6OBJQePQk+P+0Q=,iv:P1aeFC+6xG4Koph0Dynwek/861OsH1asui3qtpu1JUI=,tag:1RYayU758c+yAULOgQuWgw==,type:str]
lastmodified: "2025-05-13T23:15:05Z"
mac: ENC[AES256_GCM,data:MRYYpSCaSkZhF1ew6hmzTfwWNSzaRrhrcaUiXSvfftzTjbHD+k7P1/jpcwA7iK8haXlqiH4YtanQmzY0t/Ygmh1T2GQebvotzLIF0pJ7Bi8yLfWpt0vYrR15oHBIiyM4/ito8dkff+abjMYQuARxAfr6Iq9JyJWQbvM9coehYkE=,iv:0pX2+jBKh14Bm3L4PgtA8H+P1mPyW9u3PAYe8m4wpHk=,tag:EtY1EckmbtPje9BiAO6BoQ==,type:str]
unencrypted_suffix: _unencrypted
version: 3.10.2