blake/nix
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: blake/nix:trunk
Branches Tags
blake/nix:trunk
..
compare: blake/nix:ae5c5959bb6aa765efe32e05065ff848a1fdf247
Branches Tags
blake/nix:trunk
1 Commits
trunk .. ae5c5959bb
Author SHA1 Message Date
blake ae5c5959bb add directions for darwin bootstrap 2026-04-23 16:23:28 -05:00
116 changed files with 1742 additions and 4813 deletions
Expand all files Collapse all files
bin/bootstrap
-136
View File
@@ -1,136 +0,0 @@
#!/usr/bin/env bash
# this will one day be an interactive install bootstrap script for my nix config!
# right now this shall be treated as psudocode but also just a list of steps for installing
# without further adoo:
#
# 1. boot target device into nixos installer iso
# 2. `sudo -i``
# 3. `git clone https://git.blakedheld.xyz/blake/nix.git bootstrap_nix`
# 4. if new host use `ls -l /dev/disk/by-id/` to get the id of the target disk and update the related line in the disko config for that host (or partition the target disk manually however you wish)
# 5. run the disko install command `nix run github:nix-community/disko -- --mode destroy,format,mount --flake bootstrap_nix#hostname` to just format the disk(s)
# 6. generate hardware config `nixos-generate-config --root /mnt`
# 7. create directories for keys `mkdir -p /mnt/etc/sops` `mkdir -p /mnt/home/blake/.config/sops/age`
# 8. move nix config to home dir `mv /bootstrap_nix /mnt/home/blake/.nix`
# 9. copy age keys.txt to previously made dirs `echo "<key>" | tee /mnt/etc/sops/keys.txt /mnt/home/blake/.config/sops/age/keys.txt > dev/null`
# 10. install the os (let it fail, fix it, repeat, etc) `nixos-install --flake /mnt/home/blake/.nix#hostname`
# 11. set the root password
# 12. reboot and dont forget to `sudo chown -R blake:blake /home/blake`
# 13. change nix repo upstream to ssh `cd ~/.nix && git remote remove origin && git remote add origin ssh://gitea@git.blakedheld.xyz:7567/blake/nix.git`
#!/usr/bin/env bash
set -euo pipefail
AGE_KEY_FILE="/keys.txt"
echo "nixos bootstrap installer =="
# --- input ---
read -rp "hostname: " HOSTNAME
#read -rp "age key (will not be echoed): " AGE_KEY
if [[ ! -f "$AGE_KEY_FILE" ]]; then
echo "cannot find age keyfile"
exit 1
fi
AGE_KEY="$(cat "$AGE_KEY_FILE")"
echo
echo
echo "install mode:"
echo " 1) disko (auto partition/format/mount)"
echo " 2) manual (you already mounted disks)"
read -rp "choice [1/2]: " MODE
echo
if [[ -d /bootstrap_nix ]]; then
echo "repo already exists, skipping clone"
else
echo "cloning nix config..."
git clone https://git.blakedheld.xyz/blake/nix.git /bootstrap_nix
fi
cd /bootstrap_nix
# fix origin
git remote remove origin
git remote add origin ssh://gitea@git.blakedheld.xyz:7567/blake/nix.git
# --- disk setup ---
if [[ "$MODE" == "1" ]]; then
echo
echo "running disko (THIS WILL DESTROY DISKS)..."
echo "make sure /dev/disk/by-id is correct in your host config!"
# nix run github:nix-community/disko --extra-experimental-features "nix-command flakes" -- \
# --mode destroy,format,mount \
# --flake .#"${HOSTNAME}"
nix run github:nix-community/disko --extra-experimental-features "nix-command flakes" -- \
--mode destroy,format,mount \
--yes-wipe-all-disks \
/bootstrap_nix/hosts/nixos/$HOSTNAME/disko.nix
elif [[ "$MODE" == "2" ]]; then
echo
echo "MANUAL MODE SELECTED"
echo "WARNING: you must have already partitioned + mounted disks to /mnt"
read -rp "press ENTER to continue once disks are mounted..."
else
echo "invalid selection"
exit 1
fi
# --- generate hardware config ---
echo
echo "generating hardware config..."
nixos-generate-config --root /mnt
# --- setup directories ---
echo "creating sops/age directories..."
mkdir -p /mnt/etc/sops
mkdir -p /mnt/home/blake/.config/sops/age
# --- move config ---
echo "moving nix config into /mnt/home/blake/.nix ..."
cp -r /bootstrap_nix /mnt/home/blake/.nix
echo "moving hardware into /mnt/home/blake/.nix/hosts/nixos/$HOSTNAME ..."
cp /mnt/etc/nixos/hardware-configuration.nix /mnt/home/blake/.nix/hosts/nixos/$HOSTNAME
cd /mnt/home/blake/.nix
git add /mnt/home/blake/.nix/hosts/nixos/$HOSTNAME
# --- write age key ---
echo "writing age key..."
echo "$AGE_KEY" | tee \
/mnt/etc/sops/keys.txt \
/mnt/home/blake/.config/sops/age/keys.txt \
> /dev/null
# --- install ---
echo
echo "running nixos-install..."
set +e
nixos-install --root /mnt --flake /mnt/home/blake/.nix#"${HOSTNAME}"
INSTALL_EXIT=$?
set -e
if [[ $INSTALL_EXIT -ne 0 ]]; then
echo
echo "install failed. fix issues and re-run nixos-install manually if needed."
exit $INSTALL_EXIT
fi
# --- post install ---
echo
echo "installation complete!"
echo "set root password if needed, then reboot."
echo "after reboot: sudo chown -R blake:blake /home/blake"
nixos-enter --root /mnt -- run --login bash <<'EOF'
set -e
chown -R blake:blake /home/blake
nixos-rebuild switch --flake /home/blake/.nix
systemd-cryptenroll --tpm2-device=auto /dev/nvme0n1p2
EOF
echo "fin."
bin/git_upstream
-7
View File
@@ -1,7 +0,0 @@
#!/usr/bin/env bash
cd /home/blake/.nix
git remote remove origin
git remote add origin ssh://gitea@git.holocron.blue:7567/blake/nix.git
git fetch
git branch --set-upstream-to=origin/trunk trunk
flake.lock
Generated
+159 -206
View File
@@ -58,11 +58,11 @@
"base16-helix": {
"flake": false,
"locked": {
"lastModified": 1776754714,
"narHash": "sha256-E3OAK27smtATTmX45uoTSRsVD+Y+ZiVVfgM/tjpbtYg=",
"lastModified": 1760703920,
"narHash": "sha256-m82fGUYns4uHd+ZTdoLX2vlHikzwzdu2s2rYM2bNwzw=",
"owner": "tinted-theming",
"repo": "base16-helix",
"rev": "4d508123037e7851ad36ebf7d9c48b0e9e1eb581",
"rev": "d646af9b7d14bff08824538164af99d0c521b185",
"type": "github"
},
"original": {
@@ -106,16 +106,16 @@
"brew-src": {
"flake": false,
"locked": {
"lastModified": 1788591592,
"narHash": "sha256-NbwVKwKLFl0oXub7oPjvmDaOygCtV2oboeKTu4xXFTk=",
"lastModified": 1774235677,
"narHash": "sha256-0ryNYmzDAeRlrzPTAgmzGH/Cgc8iv/LBN6jWGUANvIk=",
"owner": "Homebrew",
"repo": "brew",
"rev": "08e85c4e42f5d8f1ea17c36cb59cf61c2ccb26c3",
"rev": "894a3d23ac0c8aaf561b9874b528b9cb2e839201",
"type": "github"
},
"original": {
"owner": "Homebrew",
"ref": "6.0.22",
"ref": "5.1.1",
"repo": "brew",
"type": "github"
}
@@ -126,11 +126,11 @@
"nixpkgs": "nixpkgs"
},
"locked": {
"lastModified": 1789598303,
"narHash": "sha256-hyAB8PqtE+2NPbXqFWFOVessao4ccpsQq6hKBfZPN0w=",
"lastModified": 1775334496,
"narHash": "sha256-dUopEMj5KhH1vnv43o29kMsayp0Ki+9EfIn4UAE9sAU=",
"owner": "9001",
"repo": "copyparty",
"rev": "6867ccc51181e7965445c3d158ddddf9a8fd817e",
"rev": "ede692925edfc6fca7a52f483414d543e9303237",
"type": "github"
},
"original": {
@@ -156,7 +156,7 @@
},
"crane_2": {
"inputs": {
"flake-compat": "flake-compat_5",
"flake-compat": "flake-compat_4",
"flake-utils": "flake-utils_3",
"nixpkgs": [
"watershot",
@@ -277,11 +277,11 @@
"firefox-gnome-theme": {
"flake": false,
"locked": {
"lastModified": 1783570805,
"narHash": "sha256-ptl5aRlCv9/uRSv2u8Hq8UFVFeZ6Q/bT049bpqNgc3w=",
"lastModified": 1775176642,
"narHash": "sha256-2veEED0Fg7Fsh81tvVDNYR6SzjqQxa7hbi18Jv4LWpM=",
"owner": "rafaelmardojai",
"repo": "firefox-gnome-theme",
"rev": "5602ed62d638142c1ab31dccd01dfbfb28841225",
"rev": "179704030c5286c729b5b0522037d1d51341022c",
"type": "github"
},
"original": {
@@ -309,36 +309,20 @@
"flake-compat_2": {
"flake": false,
"locked": {
"lastModified": 1767039857,
"narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
"owner": "edolstra",
"repo": "flake-compat",
"rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
"type": "github"
"lastModified": 1751685974,
"narHash": "sha256-NKw96t+BgHIYzHUjkTK95FqYRVKB8DHpVhefWSz/kTw=",
"ref": "refs/heads/main",
"rev": "549f2762aebeff29a2e5ece7a7dc0f955281a1d1",
"revCount": 92,
"type": "git",
"url": "https://git.lix.systems/lix-project/flake-compat.git"
},
"original": {
"owner": "edolstra",
"repo": "flake-compat",
"type": "github"
"type": "git",
"url": "https://git.lix.systems/lix-project/flake-compat.git"
}
},
"flake-compat_3": {
"flake": false,
"locked": {
"lastModified": 1777699697,
"narHash": "sha256-Eg9b/rq/ECYwNwEXs5i9wHyhxNI0JrYx2srdI2uZMaQ=",
"ref": "refs/heads/main",
"rev": "382052b74656a369c5408822af3f2501e9b1af81",
"revCount": 94,
"type": "git",
"url": "https://git.lix.systems/lix-project/flake-compat.git"
},
"original": {
"type": "git",
"url": "https://git.lix.systems/lix-project/flake-compat.git"
}
},
"flake-compat_4": {
"flake": false,
"locked": {
"lastModified": 1696426674,
@@ -354,7 +338,7 @@
"type": "github"
}
},
"flake-compat_5": {
"flake-compat_4": {
"flake": false,
"locked": {
"lastModified": 1673956053,
@@ -392,6 +376,27 @@
}
},
"flake-parts_2": {
"inputs": {
"nixpkgs-lib": [
"nvf",
"nixpkgs"
]
},
"locked": {
"lastModified": 1760948891,
"narHash": "sha256-TmWcdiUUaWk8J4lpjzu4gCGxWY6/Ok7mOK4fIFfBuU4=",
"owner": "hercules-ci",
"repo": "flake-parts",
"rev": "864599284fc7c0ba6357ed89ed5e2cd5040f0c04",
"type": "github"
},
"original": {
"owner": "hercules-ci",
"repo": "flake-parts",
"type": "github"
}
},
"flake-parts_3": {
"inputs": {
"nixpkgs-lib": [
"stylix",
@@ -399,11 +404,11 @@
]
},
"locked": {
"lastModified": 1782949081,
"narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
"lastModified": 1775087534,
"narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
"owner": "hercules-ci",
"repo": "flake-parts",
"rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
"rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
"type": "github"
},
"original": {
@@ -475,7 +480,7 @@
},
"git-hooks": {
"inputs": {
"flake-compat": "flake-compat_4",
"flake-compat": "flake-compat_3",
"gitignore": "gitignore_2",
"nixpkgs": [
"slippi",
@@ -543,20 +548,18 @@
"gnome-shell": {
"flake": false,
"locked": {
"host": "gitlab.gnome.org",
"lastModified": 1776175984,
"narHash": "sha256-RJFlFW8GiMei6oqUGrMkGEvVqOH8U7Q8abc1yK4VKD8=",
"lastModified": 1767737596,
"narHash": "sha256-eFujfIUQDgWnSJBablOuG+32hCai192yRdrNHTv0a+s=",
"owner": "GNOME",
"repo": "gnome-shell",
"rev": "e0fdc4c13250e9a9b8ea9594c83925274f4a5dca",
"type": "gitlab"
"rev": "ef02db02bf0ff342734d525b5767814770d85b49",
"type": "github"
},
"original": {
"host": "gitlab.gnome.org",
"owner": "GNOME",
"ref": "50.1",
"repo": "gnome-shell",
"type": "gitlab"
"rev": "ef02db02bf0ff342734d525b5767814770d85b49",
"type": "github"
}
},
"home-manager": {
@@ -566,16 +569,16 @@
]
},
"locked": {
"lastModified": 1789267039,
"narHash": "sha256-LWiBv9yAYFi2LPbUhDGHPGKYskJQjj2fw12OlyO1uQo=",
"lastModified": 1775425411,
"narHash": "sha256-KY6HsebJHEe5nHOWP7ur09mb0drGxYSzE3rQxy62rJo=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "ec172013fa62135f58fb58dd17ae9651e8f39727",
"rev": "0d02ec1d0a05f88ef9e74b516842900c41f0f2fe",
"type": "github"
},
"original": {
"owner": "nix-community",
"ref": "release-26.05",
"ref": "release-25.11",
"repo": "home-manager",
"type": "github"
}
@@ -587,11 +590,11 @@
]
},
"locked": {
"lastModified": 1789676441,
"narHash": "sha256-mOvO5VvycuBtOUe5EYI54vrLsWe+2KF/82fmwKooe48=",
"lastModified": 1775457580,
"narHash": "sha256-ikws/ssAmG20AGrEwBuwspwPlkubJu34mB+Uz2fJBJs=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "9d485f74cd27d17126ee34cb31005c39d20f741f",
"rev": "5de7dbd151b0bd65d45785553d4a22d832733ffc",
"type": "github"
},
"original": {
@@ -671,11 +674,11 @@
},
"mnw": {
"locked": {
"lastModified": 1780772958,
"narHash": "sha256-VKKe8r4pwCGWZ3Yr9CPN129R4S3CKLSrlYqdYz3vKpM=",
"lastModified": 1758834834,
"narHash": "sha256-Y7IvY4F8vajZyp3WGf+KaiIVwondEkMFkt92Cr9NZmg=",
"owner": "Gerg-L",
"repo": "mnw",
"rev": "0871dbf63a53610c95db04439ed8ea4d6ec9c160",
"rev": "cfbc7d1cc832e318d0863a5fc91d940a96034001",
"type": "github"
},
"original": {
@@ -711,6 +714,24 @@
"type": "github"
}
},
"ndg": {
"inputs": {
"nixpkgs": "nixpkgs_3"
},
"locked": {
"lastModified": 1765435293,
"narHash": "sha256-HRp4g6qBCb8vpJ17s2FacMRXRszM73uBiR56aILMELA=",
"owner": "feel-co",
"repo": "ndg",
"rev": "65bf834b332d5f8b28d95ea14c7974be7c272971",
"type": "github"
},
"original": {
"owner": "feel-co",
"repo": "ndg",
"type": "github"
}
},
"nix-darwin": {
"inputs": {
"nixpkgs": [
@@ -718,11 +739,11 @@
]
},
"locked": {
"lastModified": 1786845137,
"narHash": "sha256-oQFip+v0luP8NIxJzmiW4Wu8bILsbFWom5l0zonl8hQ=",
"lastModified": 1775037210,
"narHash": "sha256-KM2WYj6EA7M/FVZVCl3rqWY+TFV5QzSyyGE2gQxeODU=",
"owner": "nix-darwin",
"repo": "nix-darwin",
"rev": "4cff07de74b50e64bdd68cd4e722ab5b6b35ee48",
"rev": "06648f4902343228ce2de79f291dd5a58ee12146",
"type": "github"
},
"original": {
@@ -753,11 +774,11 @@
"brew-src": "brew-src"
},
"locked": {
"lastModified": 1788981439,
"narHash": "sha256-fEaFq0XgpgWFPLfpq1UK4/8ylHd2T0+fo6O3hKz1LUM=",
"lastModified": 1774720267,
"narHash": "sha256-YYftFe8jyfpQI649yfr0E+dqEXE2jznZNcYvy/lKV1U=",
"owner": "zhaofengli",
"repo": "nix-homebrew",
"rev": "09a921d0181146cf6163ec2cc1db7b6fd539a885",
"rev": "a7760a3a83f7609f742861afb5732210fdc437ed",
"type": "github"
},
"original": {
@@ -798,28 +819,6 @@
"type": "github"
}
},
"nixos-wsl": {
"inputs": {
"flake-compat": "flake-compat_2",
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1789164534,
"narHash": "sha256-DoYGPM6QpnYBLWj9gGw6ZwAzIX+HrAVov1BoT+8Jixo=",
"owner": "nix-community",
"repo": "NixOS-WSL",
"rev": "72c92b11bb8289e6651c7fef29cc0a885fd6a255",
"type": "github"
},
"original": {
"owner": "nix-community",
"ref": "main",
"repo": "NixOS-WSL",
"type": "github"
}
},
"nixpkgs": {
"locked": {
"lastModified": 1748162331,
@@ -837,11 +836,12 @@
},
"nixpkgs-unstable": {
"locked": {
"lastModified": 1789546076,
"narHash": "sha256-vWkSk5bbfTqdtMoSgD9FshACO8JCvXTFi+3cqEp0mH0=",
"rev": "b1b875982b17dabde9b4a37f3e229e74913e6db3",
"type": "tarball",
"url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1074753.b1b875982b17/nixexprs.tar.zst"
"lastModified": 1775036866,
"narHash": "sha256-ZojAnPuCdy657PbTq5V0Y+AHKhZAIwSIT2cb8UgAz/U=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "6201e203d09599479a3b3450ed24fa81537ebc4e",
"type": "github"
},
"original": {
"id": "nixpkgs",
@@ -851,30 +851,31 @@
},
"nixpkgs_2": {
"locked": {
"lastModified": 1789542786,
"narHash": "sha256-BGtBoaZNpOPDEBLTiWNFdYppnDjGhwrUq5/P15QwrrM=",
"rev": "4c7870105e7f1fdf9c48688c8d7efc21abf0688a",
"type": "tarball",
"url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.9904.4c7870105e7f/nixexprs.tar.zst"
"lastModified": 1775305101,
"narHash": "sha256-/74n1oQPtKG52Yw41cbToxspxHbYz6O3vi+XEw16Qe8=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "36a601196c4ebf49e035270e10b2d103fe39076b",
"type": "github"
},
"original": {
"id": "nixpkgs",
"ref": "nixos-26.05",
"ref": "nixos-25.11",
"type": "indirect"
}
},
"nixpkgs_3": {
"locked": {
"lastModified": 1739419412,
"narHash": "sha256-NCWZQg4DbYVFWg+MOFrxWRaVsLA7yvRWAf6o0xPR1hI=",
"lastModified": 1764242076,
"narHash": "sha256-sKoIWfnijJ0+9e4wRvIgm/HgE27bzwQxcEmo2J/gNpI=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "2d55b4c1531187926c2a423f6940b3b1301399b5",
"rev": "2fad6eac6077f03fe109c4d4eb171cf96791faa4",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixpkgs-unstable",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
@@ -922,11 +923,11 @@
]
},
"locked": {
"lastModified": 1785549842,
"narHash": "sha256-DCwBZmGsySF7oKGTRgEv2HvpxVXkHT+38VhTM76k0B4=",
"lastModified": 1775228139,
"narHash": "sha256-ebbeHmg+V7w8050bwQOuhmQHoLOEOfqKzM1KgCTexK4=",
"owner": "nix-community",
"repo": "NUR",
"rev": "a9f987b57594e845e3e5cdd423b9a70846d70308",
"rev": "601971b9c89e0304561977f2c28fa25e73aa7132",
"type": "github"
},
"original": {
@@ -937,22 +938,26 @@
},
"nvf": {
"inputs": {
"flake-compat": "flake-compat_3",
"flake-compat": "flake-compat_2",
"flake-parts": "flake-parts_2",
"mnw": "mnw",
"ndg": "ndg",
"nixpkgs": [
"nixpkgs"
]
],
"systems": "systems"
},
"locked": {
"lastModified": 1789510188,
"narHash": "sha256-umec9LKkWjK89Yx4XpvQStkgfKvhK7GjVf5m21bjzKU=",
"lastModified": 1765537745,
"narHash": "sha256-EaFYxx2aSuM2xx+l+E55YNMCJOoQBl2tJybxyF0pPqw=",
"owner": "notashelf",
"repo": "nvf",
"rev": "cdc7e7aaa7eb521bba1b38f54c3228d52cc31703",
"rev": "8e031476d0d7f326b63c9c5522f840e2f8b724c0",
"type": "github"
},
"original": {
"owner": "notashelf",
"ref": "v0.8",
"repo": "nvf",
"type": "github"
}
@@ -1064,29 +1069,6 @@
"type": "github"
}
},
"plasma-manager": {
"inputs": {
"home-manager": [
"home-manager-unstable"
],
"nixpkgs": [
"nixpkgs-unstable"
]
},
"locked": {
"lastModified": 1785762349,
"narHash": "sha256-jZhZkzAwc7f3exzcTDJWP2WCAchCv0iNC3UF/QsahdQ=",
"owner": "nix-community",
"repo": "plasma-manager",
"rev": "a19a2a029fa180911bd89c554dca1616e10f4c1d",
"type": "github"
},
"original": {
"owner": "nix-community",
"repo": "plasma-manager",
"type": "github"
}
},
"pre-commit-hooks-nix": {
"inputs": {
"flake-compat": [
@@ -1124,14 +1106,11 @@
"nix-darwin": "nix-darwin",
"nix-flatpak": "nix-flatpak",
"nix-homebrew": "nix-homebrew",
"nixos-wsl": "nixos-wsl",
"nixpkgs": "nixpkgs_2",
"nixpkgs-unstable": "nixpkgs-unstable",
"nvf": "nvf",
"plasma-manager": "plasma-manager",
"slippi": "slippi",
"sops-nix": "sops-nix",
"srcds-nix": "srcds-nix",
"stylix": "stylix",
"vpn-confinement": "vpn-confinement",
"watershot": "watershot"
@@ -1215,11 +1194,11 @@
]
},
"locked": {
"lastModified": 1784166278,
"narHash": "sha256-TSvk8AK8ACGTSeC2v/tyWX3UiiaEQ5O4nX5jqVtEEEI=",
"lastModified": 1774370155,
"narHash": "sha256-emNcbleHPyUszpRFV5mHnU3q4E0aq7FNJxPtIAvsJqE=",
"owner": "lytedev",
"repo": "slippi-nix",
"rev": "d87fef3580e6afc19bc3fffbba61069df2452cbf",
"rev": "c1f16cb34f7e09e8a9c7fe49744305c2f65a5b5f",
"type": "github"
},
"original": {
@@ -1235,11 +1214,11 @@
]
},
"locked": {
"lastModified": 1789623319,
"narHash": "sha256-kmlp8rPrvrXn58YiaANHKSWUijtUc7pwgerIywosOIM=",
"lastModified": 1775365543,
"narHash": "sha256-f50qrK0WwZ9z5EdaMGWOTtALgSF7yb7XwuE7LjCuDmw=",
"owner": "Mic92",
"repo": "sops-nix",
"rev": "16954c1c360c3dc4d4b3b3e64df59f7e89452cb1",
"rev": "a4ee2de76efb759fe8d4868c33dec9937897916f",
"type": "github"
},
"original": {
@@ -1248,25 +1227,6 @@
"type": "github"
}
},
"srcds-nix": {
"inputs": {
"nixpkgs": "nixpkgs_3",
"treefmt-nix": "treefmt-nix"
},
"locked": {
"lastModified": 1739576881,
"narHash": "sha256-zudD0ycB1cOwvqFBlAwSKwjO9cZir2qzA4f43ixNYCQ=",
"owner": "ihaveamac",
"repo": "srcds-nix",
"rev": "ad8a719fa97b26dfc0b3b6f0ba0f468036c549e1",
"type": "github"
},
"original": {
"owner": "ihaveamac",
"repo": "srcds-nix",
"type": "github"
}
},
"std": {
"inputs": {
"arion": [
@@ -1321,24 +1281,24 @@
"base16-helix": "base16-helix",
"base16-vim": "base16-vim",
"firefox-gnome-theme": "firefox-gnome-theme",
"flake-parts": "flake-parts_2",
"flake-parts": "flake-parts_3",
"gnome-shell": "gnome-shell",
"nixpkgs": [
"nixpkgs-unstable"
],
"nur": "nur",
"systems": "systems",
"systems": "systems_2",
"tinted-kitty": "tinted-kitty",
"tinted-schemes": "tinted-schemes",
"tinted-tmux": "tinted-tmux",
"tinted-zed": "tinted-zed"
},
"locked": {
"lastModified": 1787771653,
"narHash": "sha256-DkkJSBOXWV/mja5Vy8az5g1KpZlsbUwlmH0BsQhowaQ=",
"lastModified": 1775429060,
"narHash": "sha256-wbFF5cRxQOCzL/wHOKYm21t5AHPH2Lfp0mVPCOAvEoc=",
"owner": "nix-community",
"repo": "stylix",
"rev": "5e3809851f486e7fc7e84b40f174c74b60ecc784",
"rev": "d27951a6539951d87f75cf0a7cda8a3a24016019",
"type": "github"
},
"original": {
@@ -1349,16 +1309,30 @@
},
"systems": {
"locked": {
"lastModified": 1774449309,
"narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "c29398b59d2048c4ab79345812849c9bd15e9150",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
},
"systems_2": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"ref": "future-26.11",
"repo": "default",
"type": "github"
}
@@ -1382,11 +1356,11 @@
"tinted-schemes": {
"flake": false,
"locked": {
"lastModified": 1785153830,
"narHash": "sha256-fNdfCTeCXU3tZG3TMincd+u68qBHQgCr2Ljr/M1mWP0=",
"lastModified": 1772661346,
"narHash": "sha256-4eu3LqB9tPqe0Vaqxd4wkZiBbthLbpb7llcoE/p5HT0=",
"owner": "tinted-theming",
"repo": "schemes",
"rev": "9bd28ed313560db3c5b605c63bc4e309e78e3fc8",
"rev": "13b5b0c299982bb361039601e2d72587d6846294",
"type": "github"
},
"original": {
@@ -1398,11 +1372,11 @@
"tinted-tmux": {
"flake": false,
"locked": {
"lastModified": 1785031658,
"narHash": "sha256-mZp9O2LjzdMzlqQF3l3fjqsuPBzXy+1qTfBEUGjTlpk=",
"lastModified": 1772934010,
"narHash": "sha256-x+6+4UvaG+RBRQ6UaX+o6DjEg28u4eqhVRM9kpgJGjQ=",
"owner": "tinted-theming",
"repo": "tinted-tmux",
"rev": "5d2c67f61ea7af36f16865ab6d541cdba41dc257",
"rev": "c3529673a5ab6e1b6830f618c45d9ce1bcdd829d",
"type": "github"
},
"original": {
@@ -1414,11 +1388,11 @@
"tinted-zed": {
"flake": false,
"locked": {
"lastModified": 1785030526,
"narHash": "sha256-klZf8UviewRkxuu74Bhbq6tqy7oxebQC7UVRWbbtQxU=",
"lastModified": 1772909925,
"narHash": "sha256-jx/5+pgYR0noHa3hk2esin18VMbnPSvWPL5bBjfTIAU=",
"owner": "tinted-theming",
"repo": "base16-zed",
"rev": "16f5a8adf4a6b1310d0a61ab172de963e8f76a02",
"rev": "b4d3a1b3bcbd090937ef609a0a3b37237af974df",
"type": "github"
},
"original": {
@@ -1427,34 +1401,13 @@
"type": "github"
}
},
"treefmt-nix": {
"inputs": {
"nixpkgs": [
"srcds-nix",
"nixpkgs"
]
},
"locked": {
"lastModified": 1738953846,
"narHash": "sha256-yrK3Hjcr8F7qS/j2F+r7C7o010eVWWlm4T1PrbKBOxQ=",
"owner": "numtide",
"repo": "treefmt-nix",
"rev": "4f09b473c936d41582dd744e19f34ec27592c5fd",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "treefmt-nix",
"type": "github"
}
},
"vpn-confinement": {
"locked": {
"lastModified": 1789394839,
"narHash": "sha256-trdjVJKmDBbzgbP8pd+R7iKbGkdRu0nmXgQlBR/hEiU=",
"lastModified": 1767604552,
"narHash": "sha256-FddhMxnc99KYOZ/S3YNqtDSoxisIhVtJ7L4s8XD2u0A=",
"owner": "Maroka-chan",
"repo": "VPN-Confinement",
"rev": "a21f66ccd9f644c3770ccdf287cb380c00192628",
"rev": "a6b2da727853886876fd1081d6bb2880752937f3",
"type": "github"
},
"original": {
flake.nix
+12 -58
View File
@@ -4,26 +4,20 @@
{
description = "blakes nix config";
inputs = {
nixpkgs.url = "nixpkgs/nixos-26.05";
nixpkgs.url = "nixpkgs/nixos-25.11";
nixpkgs-unstable.url = "nixpkgs/nixos-unstable";
nix-darwin = {
url = "github:nix-darwin/nix-darwin/master";
inputs.nixpkgs.follows = "nixpkgs-unstable";
};
home-manager = {
#url = "github:nix-community/home-manager";
url = "github:nix-community/home-manager/release-26.05";
url = "github:nix-community/home-manager/release-25.11";
inputs.nixpkgs.follows = "nixpkgs";
};
home-manager-unstable = {
url = "github:nix-community/home-manager";
inputs.nixpkgs.follows = "nixpkgs-unstable";
};
plasma-manager = {
url = "github:nix-community/plasma-manager";
inputs.nixpkgs.follows = "nixpkgs-unstable";
inputs.home-manager.follows = "home-manager-unstable";
};
nix-homebrew.url = "github:zhaofengli/nix-homebrew";
nix-flatpak.url = "github:gmodena/nix-flatpak/?ref=latest";
sops-nix = {
@@ -34,10 +28,6 @@
url = "github:nix-community/disko/latest";
inputs.nixpkgs.follows = "nixpkgs";
};
nixos-wsl = {
url = "github:nix-community/NixOS-WSL/main";
inputs.nixpkgs.follows = "nixpkgs";
};
lanzaboote = {
url = "github:nix-community/lanzaboote/v0.4.3";
inputs.nixpkgs.follows = "nixpkgs";
@@ -50,7 +40,7 @@
url = "github:Maroka-chan/VPN-Confinement";
};
nvf = {
url = "github:notashelf/nvf";
url = "github:notashelf/nvf/v0.8";
inputs.nixpkgs.follows = "nixpkgs";
};
autoaspm = {
@@ -66,7 +56,6 @@
url = "github:lytedev/slippi-nix";
inputs.nixpkgs.follows = "nixpkgs-unstable";
};
srcds-nix.url = "github:ihaveamac/srcds-nix";
};
outputs = {
self,
@@ -74,41 +63,29 @@
nixpkgs-unstable,
nix-darwin,
nix-homebrew,
nixos-wsl,
plasma-manager,
...
} @ inputs: let
systems = {
x86_64-linux = "x86_64-linux";
aarch64-linux = "aarch64-linux";
aarch64-darwin = "aarch64-darwin";
x86_64 = "x86_64-linux";
arm64 = "aarch64-linux";
darwin = "aarch64-darwin";
};
unstableOverlay = final: prev: {
unstable = import nixpkgs-unstable {
#system = prev.system;
system = prev.stdenv.hostPlatform.system;
config.allowUnfree = true;
};
};
# legacy
stable_pkgs = builtins.mapAttrs (k: v: import nixpkgs {system = v;}) systems;
unstable_pkgs = builtins.mapAttrs (k: v: import nixpkgs-unstable {system = v;}) systems;
in {
nixosConfigurations = {
snowbelle = nixpkgs.lib.nixosSystem {
system = systems.x86_64-linux;
system = systems.x86_64;
specialArgs = {inherit inputs stable_pkgs unstable_pkgs;};
modules = [
{nixpkgs.overlays = [unstableOverlay];}
./hosts/nixos/snowbelle/configuration.nix
inputs.home-manager.nixosModules.default
];
};
yveltal = nixpkgs-unstable.lib.nixosSystem {
system = systems.x86_64-linux;
system = systems.x86_64;
specialArgs = {inherit inputs stable_pkgs unstable_pkgs;};
modules = [
{nixpkgs.overlays = [unstableOverlay];}
./hosts/nixos/yveltal/configuration.nix
./hosts/nixos/yveltal/disko.nix
inputs.home-manager-unstable.nixosModules.default
@@ -116,10 +93,9 @@
];
};
mew = nixpkgs-unstable.lib.nixosSystem {
system = systems.x86_64-linux;
system = systems.x86_64;
specialArgs = {inherit inputs stable_pkgs unstable_pkgs;};
modules = [
{nixpkgs.overlays = [unstableOverlay];}
./hosts/nixos/mew/configuration.nix
./hosts/nixos/mew/disko.nix
inputs.home-manager-unstable.nixosModules.default
@@ -127,41 +103,19 @@
];
};
vaniville = nixpkgs.lib.nixosSystem {
system = systems.x86_64-linux;
system = systems.x86_64;
specialArgs = {inherit inputs stable_pkgs unstable_pkgs;};
modules = [
{nixpkgs.overlays = [unstableOverlay];}
./hosts/nixos/vaniville/configuration.nix
inputs.home-manager.nixosModules.default
];
};
lumiose = nixpkgs.lib.nixosSystem {
system = systems.x86_64-linux;
specialArgs = {inherit inputs stable_pkgs unstable_pkgs;};
modules = [
{nixpkgs.overlays = [unstableOverlay];}
./hosts/nixos/lumiose/configuration.nix
inputs.home-manager.nixosModules.default
inputs.disko.nixosModules.disko
];
};
wsl = nixpkgs.lib.nixosSystem {
system = systems.x86_64-linux;
specialArgs = {inherit inputs stable_pkgs unstable_pkgs;};
modules = [
{nixpkgs.overlays = [unstableOverlay];}
./hosts/nixos/wsl/configuration.nix
nixos-wsl.nixosModules.default
inputs.home-manager.nixosModules.default
];
};
};
darwinConfigurations = {
cen-it-07 = nix-darwin.lib.darwinSystem {
system = systems.aarch64-darwin;
CEN-IT-07 = nix-darwin.lib.darwinSystem {
system = systems.darwin;
specialArgs = {inherit inputs stable_pkgs unstable_pkgs nix-homebrew;};
modules = [
{nixpkgs.overlays = [unstableOverlay];}
./hosts/darwin/cen-it-07/configuration.nix
inputs.home-manager.darwinModules.default
];
hosts/darwin/cen-it-07/app_list.md
+79
View File
@@ -0,0 +1,79 @@
casks:
battery-toolkit
fuse-t
linearmouse
ollama
rustdesk
texstudio
betterdisplay
gnucash
mactex-no-gui
ollama-app
syncthing-app
utm
command-x
kitty
makemkv
prismlauncher
tailscale
veracrypt-fuse-t
firefox
libreoffice
minecraft
rectangle
tailscale-app
vivaldi
brews:
coreutils
cowsay
ctpv
displayplacer
gawk
gnupg
imagemagick
iperf3
lf
lolcat
media-info
mpv
nmap
openvpn
p7zip
pandoc
pinentry-mac
pipx
qemu
rage
sl
speedtest-cli
xdg-ninja
yubico-piv-tool
mas:
1168254295 AmorphousDiskMark (4.0.1)
1037126344 Apple Configurator (2.18)
1352778147 Bitwarden (2025.9.0)
425264550 Blackmagic Disk Speed Test (3.4.2)
6454431289 CrystalFetch (2.2.0)
1438243180 Dark Reader for Safari (2.1.8)
975937182 Fantastical (4.1.2)
682658836 GarageBand (10.4.11)
6504861501 Ghostery Privacy Ad Blocker (10.5.38)
1616683087 GT Uptime (2.2.0)
1452453066 Hidden Bar (1.8)
1487860882 iMazing Profile Editor (2.1.0)
408981434 iMovie (10.4.3)
409183694 Keynote (14.5)
634148309 Logic Pro (11.2.2)
1621800675 Mercury (2.11.4)
409203825 Numbers (14.4)
409201541 Pages (14.4)
6449850851 Privacy.com for Safari (2.4.15)
899247664 TestFlight (4.1.0)
1614659226 virtualOS (2.1)
1295203466 Windows App (11.2.4)
hosts/darwin/cen-it-07/configuration.nix
+23 -38
View File
@@ -5,22 +5,33 @@
inputs,
...
}: {
imports = [
inputs.nix-homebrew.darwinModules.nix-homebrew
../default.nix
../../../modules/darwin
../../../modules/darwin
];
# home grown nixos modules
darwin = {
# ssh.enable = true;
syncthing.enable = true;
tailscale.enable = true;
nextdns.enable = true;
yubikey.enable = true;
work.enable = true;
apps.enable = true;
cyber.enable = true;
gaming.enable = true;
};
# since darwin needs root now (will be removed in future)
system.primaryUser = "bhelderman"
power = {
sleep = {
computer = 30;
display = 5;
allowSleepByPowerButton = true;
};
};
# import home grown host specific home-manager modules
@@ -42,37 +53,22 @@
};
};
# base system package install list
environment.systemPackages = with pkgs; [
neovide
];
nix-homebrew = {
enable = true; # install homebrew
enableRosetta = true; # install homebrew for rosetta as well
#autoMigrate = true;
user = "bhelderman"; # user owning homebrew prefix
trust = {
formulae = [];
casks = [];
commands = [];
taps = ["rogeriopradoj/cask-peazip"];
};
enable = true; # install homebrew
enableRosetta = true; # install homebrew for rosetta as well
autoMigrate = true;
user = "bhelderman"; # user owning homebrew prefix
};
homebrew = {
enable = true;
# removes anything in homebrew not explicitly specified
onActivation = {
cleanup = "zap";
autoUpdate = false;
upgrade = true;
};
taps = [
"rogeriopradoj/cask-peazip"
];
#onActivation.cleanup = "uninstall";
brews = [
"mas"
@@ -82,10 +78,8 @@
];
casks = [
"kitty"
"battery-toolkit"
"linearmouse"
"betterdisplay"
"rectangle"
"peazip"
];
masApps = {
# "name" = app_id_number;
@@ -93,16 +87,7 @@
"testflight" = 899247664;
};
};
# for mas to not throw rebuild fit
# since darwin needs root now (will be removed in future)
system.primaryUser = "bhelderman";
system.stateVersion = 6;
power = {
sleep = {
computer = 30;
display = 5;
allowSleepByPowerButton = true;
};
};
}
hosts/darwin/default.nix
+58 -56
View File
@@ -5,69 +5,23 @@
inputs,
...
}: {
/*
instructions for first time setup for macos here
1. install the nix package manager with: `sh <(curl --proto '=https' --tlsv1.2 -L https://nixos.org/nix/install)`
2. install xcode tools with `xcode-select --install`
3. allow full disk access to terminal
4. xfer or git clone flake to ~/.nix
5. sign into icloud and by extension app store for mas
6. rename some shell rc files with `sudo mv /etc/bashrc /etc/bashrc.before-nix-darwin && sudo mv /etc/zshrc /etc/zshrc.before-nix-darwin`
7. install nix-darwin with: `nix run --extra-experimental-features "nix-command flakes" nix-darwin -- switch --flake ~/.nix#host`
8. nh should be installed now so enjoy and use `nh darwin switch`
*/
/*
instructions for first time setup for macos here
1. install the nix package manager with: `sh <(curl --proto '=https' --tlsv1.2 -L https://nixos.org/nix/install)`
2. xfer or git clone flake to ~/.nix
3. install nix-darwin with: `nix run nix-darwin -- switch --flake ~/.nix#host`
4. nh should be installed now so enjoy and use `nh darwin switch`
*/
imports = [
];
# general macos system settings
# base system package install list
environment.systemPackages = with pkgs; [
wget
sl
curl
rsync
git
age
fzf
usbutils
pciutils
python3
lf
btop
pinentry_mac
];
users.users.bhelderman = {
home = "/Users/bhelderman";
# optional extras, e.g. shell, uid, etc.
};
# define home-manager user
home-manager = {
extraSpecialArgs = {inherit inputs;};
backupFileExtension = "bak";
useUserPackages = true;
useGlobalPkgs = false;
users = {
"bhelderman" = import ../../users/blake/home_darwin.nix;
};
};
# set timezone
time.timeZone = "America/Chicago";
# allow proprietary packages
nixpkgs.config.allowUnfree = true;
# enable flakes
nix.settings.experimental-features = ["nix-command" "flakes"];
system = {
stateVersion = 6;
defaults = {
trackpad = {
Clicking = true;
Clicking = true;
TrackpadThreeFingerDrag = true;
TrackpadFourFingerVertSwipeGesture = 2;
TrackpadRightClick = true;
@@ -76,15 +30,18 @@
TrackpadRotate = true;
TrackpadTwoFingerDoubleTapGesture = true;
TrackpadTwoFingerFromRightEdgeSwipeGesture = 3;
};
universalaccess = {
mouseDriverCursorSize = 3.0;
};
NSGlobalDomain = {
AppleICUForce24HourTime = true;
AppleInterfaceStyle = "Dark";
NSAutomaticCapitalizationEnabled = false;
NSDocumentSaveNewDocumentsToCloud = false;
};
WindowManager = {
EnableStandardClickToShowDesktop = false;
@@ -112,7 +69,6 @@
orientation = "bottom";
scroll-to-open = true;
show-recents = false;
showAppExposeGestureEnabled = true;
};
finder = {
AppleShowAllExtensions = true;
@@ -133,6 +89,52 @@
askForPassword = true;
askForPasswordDelay = 15;
};
};
};
# base system package install list
environment.systemPackages = with pkgs; [
wget
curl
rsync
git
age
fzf
usbutils
pciutils
python3
vim
lf
btop
rectangle
pinentry_mac
];
users.users.bhelderman = {
home = "/Users/bhelderman";
# optional extras, e.g. shell, uid, etc.
};
# define home-manager user
home-manager = {
extraSpecialArgs = {inherit inputs;};
backupFileExtension = "bak";
useUserPackages = true;
useGlobalPkgs = false;
users = {
"bhelderman" = import ../../users/blake/home_darwin.nix;
};
};
# set timezone
time.timeZone = "America/Chicago";
# allow proprietary packages
nixpkgs.config.allowUnfree = true;
# enable flakes
nix.settings.experimental-features = ["nix-command" "flakes"];
}
hosts/nixos/default.nix
+2 -21
View File
@@ -3,7 +3,6 @@
config,
lib,
inputs,
unstable_pkgs,
...
}: {
imports = [
@@ -24,7 +23,7 @@
# optimise nix store, dedupe and such
optimise = {
automatic = true;
dates = ["daily"];
dates = [ "daily" ];
};
# the goats
settings = {
@@ -53,15 +52,7 @@
powerManagement.powertop.enable = true;
# things are better this way
users = {
defaultUserShell = pkgs.zsh;
users.root = {
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO06en1r4+zg8JMGPq7WiZeh/DBUvfhDJX3e+J5Z5Ttk blake@snowbelle"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP0FLKK9yEPYpGuCjoX0e7Ky/zTPfzDk7IkrR3tOmELP blake@vaniville"
];
};
};
users.defaultUserShell = pkgs.zsh;
# base system package install list
environment.systemPackages = with pkgs; [
@@ -83,8 +74,6 @@
usbutils
pciutils
lm_sensors
smartmontools
unstable.siomon
];
# nice to have passwordless sudo
@@ -121,14 +110,6 @@
command = "/etc/profiles/per-user/blake/bin/nom-shell";
options = ["NOPASSWD"];
}
{
command = "/run/current-system/sw/bin/rsync";
options = ["NOPASSWD"];
}
{
command = "/etc/profiles/per-user/blake/bin/lf";
options = ["NOPASSWD"];
}
];
}
];
hosts/nixos/lumiose/disko.nix → hosts/nixos/froakie/disko.nix
+1 -1
View File
@@ -3,7 +3,7 @@
disk = {
main = {
type = "disk";
device = "/dev/disk/by-id/nvme-SAMSUNG_MZVLB256HAHQ-000H2_S499NX0M112943"; # disk id here
device = ""; # disk id here
content = {
type = "gpt";
partitions = {
hosts/nixos/lumiose/configuration.nix
-177
View File
@@ -1,177 +0,0 @@
{
config,
lib,
inputs,
modulesPath,
stable_pkgs,
unstable_pkgs,
...
}: {
imports = [
# Include the results of the hardware scan.
(modulesPath + "/installer/scan/not-detected.nix")
#./hardware-configuration.nix
./disko.nix
../../nixos
../../../users/blake
../../../modules/system
../../../modules/fileshares/holocron
../../../modules/homelab
#../../../modules/gameservers/srcds
../../../modules/gameservers/minecraft_recpro
../../../modules/gameservers/minecraft_modded
../../../modules/gameservers/valheim
];
home-manager.users.blake.imports = [
../../../users/blake/hosts/lumiose.nix
];
system = {
ssh.enable = true;
sops.enable = true;
podman.enable = true;
yubikey.enable = true;
graphics = {
enable = true;
vendor = "amd";
};
keepalive = {
enable = true;
url = "https://up.holocron.blue/api/push/7DAcvsedwB?status=up&msg=fuckingvibing&ping=";
};
};
homelab = {
enable = true;
base_domain = "lumiose.holocron.blue";
host_ip = "10.10.0.11";
gitea.enable = false;
glance.enable = true;
immich = {
enable = true;
data_dir = "/holocron/srv/immich";
backup = false;
};
vaultwarden.enable = false;
#searx.enable = true;
# home assistant
home.enable = true;
homebox.enable = true;
# network
tailscale.enable = true;
caddy = {
enable = true;
keys = false;
};
dnsmasq.enable = true;
# mediastack
mediastack.enable = true;
qbittorrent.vpn_inf = "enp34s0.69";
# system
backups.enable = true;
motd.enable = true;
msmtp.enable = true;
uptime-kuma.enable = true;
# # ai
# ollama.enable = false;
# open-webui.enable = false;
wyoming.enable = true;
};
holocron = {
# copyparty.enable = false;
syncthing.enable = true;
ensure_perms.enable = false;
offsite.enable = true;
zfs.enable = true;
smb.enable = true;
nfs.enable = true;
};
gameservers = {
minecraft_recpro.enable = true;
minecraft_modded.enable = false;
valheim.enable = true;
};
# boot (systemd is going on me)
boot.loader.systemd-boot.enable = true; # systemd your pretty cool ya know
boot.loader.efi.canTouchEfiVariables = true;
boot.initrd.systemd.enable = true; # better logging
# setup hostname and networking stack
services.resolved = {
enable = true;
settings = {
Resolve = {
FallbackDNS = ["1.1.1.1" "9.9.9.9"];
DNSOverTLS = "opportunistic";
};
};
};
networking = {
hostName = "lumiose"; # hostname
hostId = "007f0200";
getaddrinfo = {
enable = true;
precedence = {
"::ffff:0:0/96" = 100;
};
};
networkmanager = {
enable = true; # the goat
dns = "systemd-resolved"; # the backup dancer!
ensureProfiles.profiles = {
vpn = {
ipv4 = {
method = "manual";
addresses = "10.69.0.11/24";
gateway = "10.69.0.1";
};
ethernet.mac-address = "02:ea:6c:3c:9f:cd";
connection.type = "vlan";
connection.id = "vpn";
connection.interface-name = "enp34s0.69"; # or just "vpn-vlan"
vlan.interface-name = "enp34s0.69"; # or just "vpn-vlan"
vlan.parent = "enp34s0";
vlan.id = 69;
#ipv4.dns = "9.9.9.9";
};
};
};
};
hardware.bluetooth.enable = true;
# Open ports in the firewall.
networking.firewall.allowedTCPPorts = [
80 # set - http
111 # set - portmapper for nfs
443 # set - https
137 # set - smb
138 # set - smb
139 # set - smb
445 # set - smb
1198
1883 # set - mqtt
2049 # set - nfs
2222 # srv - syncthing
5201 # iperf3
];
networking.firewall.allowedUDPPorts = [51820];
# Or disable the firewall altogether.
networking.firewall.enable = true;
# hardware stuff
boot.initrd.availableKernelModules = ["nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod"];
boot.initrd.kernelModules = [];
boot.kernelModules = ["kvm-amd"];
boot.kernelParams = ["ipv6.disable=1"];
boot.extraModulePackages = [];
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
system.stateVersion = "25.05"; # stays here : )
}
hosts/nixos/snowbelle/configuration.nix
+97 -100
View File
@@ -1,25 +1,24 @@
{ config, lib, inputs, stable_pkgs, unstable_pkgs, ... }:
let
pkgs = stable_pkgs.x86_64;
unstable = unstable_pkgs.x86_64;
in
{
config,
lib,
inputs,
stable_pkgs,
unstable_pkgs,
...
}: {
imports = [
# Include the results of the hardware scan.
./hardware-configuration.nix
../../nixos
../../../users/blake
../../../modules/system
../../../modules/homelab
#../../../modules/fileshares/holocron
#../../../modules/gameservers/minecraft_recpro
../../../modules/gameservers/minecraft_modded
];
imports =
[ # Include the results of the hardware scan.
./hardware-configuration.nix
../../nixos
../../../users/blake
../../../modules/system
../../../modules/holocron
../../../modules/homelab
../../../modules/gameservers/minecraft_recpro
../../../modules/gameservers/minecraft_modded
];
home-manager.users.blake.imports = [
../../../users/blake/hosts/snowbelle.nix
../../../users/blake/hosts/snowbelle.nix
];
system = {
@@ -31,77 +30,70 @@
enable = true;
vendor = "nvidia";
};
keepalive = {
enable = true;
url = "https://up.holocron.blue/api/push/kMoYviAuCL?status=up&msg=bigchilling&ping=";
};
};
# holocron = {
# ensure_perms.enable = true;
# zfs.enable = true;
# smb.enable = true;
# nfs.enable = true;
# };
holocron = {
syncthing.enable = true;
copyparty.enable = false;
ensure_perms.enable = false;
zfs.enable = true;
smb.enable = true;
nfs.enable = true;
};
homelab = {
enable = true;
base_domain = "snowbelle.holocron.blue";
# services
gitea.enable = false;
glance.enable = false;
immich.enable = false;
vaultwarden.enable = false;
#searx.enable = true;
# home assistant
home.enable = false;
# network
tailscale.enable = true;
caddy.enable = false;
dnsmasq.enable = false;
# mediastack
mediastack.enable = false;
# system
backups.enable = false;
motd.enable = false;
uptime-kuma.enable = false;
# ai
#ollama.enable = false;
#open-webui.enable = false;
wyoming.enable = false;
dnsmasq.enable = true;
backups.enable = true;
motd.enable = true;
postfix.enable = true;
gitea.enable = true;
glance.enable = true;
immich.enable = true;
hass.enable = true;
jellyfin.enable = true;
audiobookshelf.enable = true;
yacreader.enable = true;
qbittorrent.enable = true;
sonarr.enable = true;
radarr.enable = true;
bazarr.enable = true;
prowlarr.enable = true;
flaresolverr.enable = true;
zigbee2mqtt.enable = true;
mosquitto.enable = true;
caddy.enable = true;
uptime-kuma.enable = true;
vaultwarden.enable = true;
};
gameservers = {
# minecraft_recpro.enable = true;
minecraft_modded = {
enable = true;
url = "raceraskedforthisenjoyyall.recoil.pro";
};
minecraft_recpro.enable = true;
minecraft_modded.enable = true;
};
# boot (systemd is going on me)
boot.loader.systemd-boot.enable = true; # systemd your pretty cool ya know
boot.loader.systemd-boot.enable = true; # systemd your pretty cool ya know
boot.loader.efi.canTouchEfiVariables = true;
boot.initrd.systemd.enable = true; # better logging
boot.initrd.systemd.enable = true; # better logging
# setup hostname and networking stack
services.resolved = {
enable = true;
#fallbackDns = ["1.1.1.1" "9.9.9.9"];
settings.Resolve.DNSOverTLS = "opportunistic";
fallbackDns = [ "1.1.1.1" "9.9.9.9" ];
dnsovertls = "opportunistic";
};
networking = {
hostName = "snowbelle"; # hostname
hostId = "3e6e7055"; # zfs wants this
hostId = "3e6e7055"; # zfs wants this
networkmanager = {
enable = true; # the goat
enable = true; # the goat
dns = "systemd-resolved"; # the backup dancer!
ensureProfiles.profiles = {
vpn = {
ethernet.mac-address = "7a:e4:07:8d:22:76";
connection.type = "vlan";
connection.id = "vpn";
connection.interface-name = "enp89s0.69"; # or just "vpn-vlan"
vlan.interface-name = "enp89s0.69"; # or just "vpn-vlan"
connection.interface-name = "enp89s0.69"; # or just "vpn-vlan"
vlan.interface-name = "enp89s0.69"; # or just "vpn-vlan"
vlan.parent = "enp89s0";
vlan.id = 69;
#ipv4.dns = "9.9.9.9";
@@ -110,49 +102,54 @@
};
};
hardware.bluetooth.enable = true;
# Open ports in the firewall.
networking.firewall.allowedTCPPorts = [
80 # set - http
111 # set - portmapper for nfs
139 # set - smb
443 # set - https
445 # set - cifs
5201
80 # set - http
111 # set - portmapper for nfs
139 # set - smb
443 # set - https
445 # set - cifs
1198
1883 # set - mqtt
2049 # set - nfs
2222 # srv - syncthing
7100 # srv - jellyfin
7101 # srv - audiobookshelf
7102 # srv - yacreader
7103 # srv - qbittorrent
7104 # srv - prowlarr
7105 # srv - bazarr
7106 # srv - sonarr
7107 # srv - radarr
7120 # srv - flaresolverr
5701 # srv - archivebox
7502 # srv - kiwix
7567 # srv - gitea ssh
7700 # srv - glance
7701 # srv - vaultwarden
7702 # srv - immich
7703 # srv - gitea
7704 # srv - hass
7705 # srv - zigbee2mqtt
7901 # srv - uptime kuma
7902 # srv - copyparty
25777 # srv - minecraft
25565 # ^ ^ ^
25566 # | | |
25567 # | | |
1883 # set - mqtt
2049 # set - nfs
2222 # srv - syncthing
7100 # srv - jellyfin
7101 # srv - audiobookshelf
7102 # srv - yacreader
7103 # srv - qbittorrent
7104 # srv - prowlarr
7105 # srv - bazarr
7106 # srv - sonarr
7107 # srv - radarr
7120 # srv - flaresolverr
5701 # srv - archivebox
7502 # srv - kiwix
7567 # srv - gitea ssh
7700 # srv - glance
7701 # srv - vaultwarden
7702 # srv - immich
7703 # srv - gitea
7704 # srv - hass
7705 # srv - zigbee2mqtt
7901 # srv - uptime kuma
7902 # srv - copyparty
25777 # srv - minecraft
25565 # ^ ^ ^
25566 # | | |
25567 # | | |
];
networking.firewall.allowedUDPPorts = [51820];
networking.firewall.allowedUDPPorts = [ 51820 ];
# Or disable the firewall altogether.
networking.firewall.enable = true;
system.stateVersion = "25.05"; # stays here : )
}
hosts/nixos/vaniville/configuration.nix
+156 -184
View File
@@ -1,210 +1,182 @@
{
config,
lib,
pkgs,
inputs,
stable_pkgs,
unstable_pkgs,
...
}: let
vpsip4 = "100.100.1.10";
snowbelle_ip = "10.10.0.10";
lumiose_ip = "10.10.0.11";
{ config, lib, stable_pkgs, unstable_pkgs, ... }:
homelab = config.homelab;
in {
imports = [
./hardware-configuration.nix
../../nixos
../../../users/blake
../../../modules/system
../../../modules/homelab
#../../../modules/holocron
];
let
pkgs = stable_pkgs.x86_64;
unstable = unstable_pkgs.x86_64;
in
{
imports =
[ # Include the results of the hardware scan.
./hardware-configuration.nix
../../nixos
../../../users/blake
../../../modules/system
../../../modules/holocron
../../../modules/homelab
];
home-manager.users.blake.imports = [
../../../users/blake/hosts/vaniville.nix
../../../users/blake/hosts/vaniville.nix
];
system = {
tailscale.enable = false;
};
homelab = {
enable = true;
base_domain = "vaniville.holocron.blue";
host_ip = "100.100.1.10";
ddns.enable = true;
uptime-kuma = {
enable = true;
url = "up.holocron.blue";
modules = {
system = {
tailscale.enable = true;
};
caddy = {
enable = true;
keys = true;
};
backups = {
enable = true;
databases = false;
homelab = true;
backup_repo = "/var/lib/backups/homelab";
offsite_dir = "lifeboat/vaniville/homelab";
};
gitea.enable = true;
vaultwarden.enable = true;
home.enable = false;
};
boot = {
loader = {
efi.canTouchEfiVariables = true;
grub = {
enable = true;
forceInstall = true;
};
};
kernel.sysctl = {
"net.ipv4.ip_forward" = 1;
};
};
# use the systemd-boot EFI boot loader.
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
# setup hostname and networking stack
networking.hostName = "vaniville"; # Define your hostname.
networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
# define shell
programs.zsh.enable = true;
users.defaultUserShell = pkgs.zsh;
# packages reccomended by linode
# package install list
environment.systemPackages = with pkgs; [
inetutils
mtr
sysstat
];
# services.resolved = {
# enable = true;
# settings = {
# Resolve = {
# FallbackDNS = ["1.1.1.1" "9.9.9.9"];
# DNSOverTLS = "opportunistic";
# };
# };
# };
# allow proprietary packages
nixpkgs.config.allowUnfree = true;
# setup the network forwarding this host is designed for
# general networking config
networking = {
hostName = "vaniville"; # Define your hostname.
usePredictableInterfaceNames = false;
useDHCP = false;
interfaces.eth0.useDHCP = true; # public ipv4 interface
# enable flakes
nix.settings.experimental-features = [ "nix-command" "flakes" ];
# the proper way to forward ports on nixos, need to figure it out locally then try to get it working over vps
nat = {
enable = true;
externalInterface = "eth0"; # your PUBLIC_IF
internalInterfaces = ["tailscale0"];
# maybe one day i will figure out the forward ports proper
forwardPorts = [
# { sourcePort = 80; destination = "10.10.0.10:80"; proto = "tcp"; } # http
# { sourcePort = 443; destination = "10.10.0.10:443"; proto = "tcp"; } # https
# { sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "tcp"; } # minecraft
# { sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "udp"; } # minecraft
# { sourcePort = 7567; destination = "10.10.0.10:7567"; proto = "tcp"; } # git
# Rustdesk ports
# { sourcePort = 21115; destination = "10.10.0.10:21115"; proto = "tcp"; }
# { sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "tcp"; }
# { sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "udp"; }
# { sourcePort = 21118; destination = "10.10.0.10:21118"; proto = "tcp"; }
# { sourcePort = 21117; destination = "10.10.0.10:21117"; proto = "tcp"; }
# { sourcePort = 21119; destination = "10.10.0.10:21119"; proto = "tcp"; }
];
};
# what actually does the forwarding
firewall = {
enable = true;
allowedTCPPorts = [22 80 443 25777 25579 7567 21115 21116 21117 21118 21119];
# tailscale will also need its UDP port open:
allowedUDPPorts = [config.services.tailscale.port 2456 2457 25777 21116 25580];
trustedInterfaces = ["tailscale0"];
/*
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination ${snowbelle_ip}:80 # http
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination ${snowbelle_ip}:443 # https
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 80 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4} # http
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 443 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4} # https
*/
# iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 7567 -j DNAT --to-destination ${lumiose_ip}:7567 # gitea ssh
# iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 7567 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4} # gitea ssh
extraCommands = ''
# Clear any previous rules if you are iterating
iptables -t nat -F
# DNAT: internet -> homelab over tailscale
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25777 -j DNAT --to-destination ${lumiose_ip}:25777 # recpro mc
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 25777 -j DNAT --to-destination ${lumiose_ip}:25777 # recpro mc
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25579 -j DNAT --to-destination ${snowbelle_ip}:25579 # craftoria mc
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 25580 -j DNAT --to-destination ${snowbelle_ip}:25580 # craftoria mc voice chat
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 2456 -j DNAT --to-destination ${lumiose_ip}:2456 # valheim server
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 2457 -j DNAT --to-destination ${lumiose_ip}:2457 # valheim server
# SNAT: ensure replies go back through VPS tailscale IP
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25777 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4} # recpro mc
iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 25777 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4} # recpro mc
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25579 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4} # craftoria mc
iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 25580 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4} # craftoria mc voicechat
iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 2456 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4} # valheim server
iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 2457 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4} # valheim server
'';
};
};
# enable tailscale for to forward over!
services.tailscale = {
nat = {
enable = true;
useRoutingFeatures = "server";
extraSetFlags = [
"--advertise-exit-node"
externalInterface = "eth0"; # your PUBLIC_IF
internalInterfaces = [ "tailscale0" ];
forwardPorts = [
{ sourcePort = 80; destination = "10.10.0.10:80"; proto = "tcp"; } # http
{ sourcePort = 443; destination = "10.10.0.10:443"; proto = "tcp"; } # https
{ sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "tcp"; } # minecraft
{ sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "udp"; } # minecraft
{ sourcePort = 7567; destination = "10.10.0.10:7567"; proto = "tcp"; } # git
# Rustdesk ports
{ sourcePort = 21115; destination = "10.10.0.10:21115"; proto = "tcp"; }
{ sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "tcp"; }
{ sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "udp"; }
{ sourcePort = 21118; destination = "10.10.0.10:21118"; proto = "tcp"; }
{ sourcePort = 21117; destination = "10.10.0.10:21117"; proto = "tcp"; }
{ sourcePort = 21119; destination = "10.10.0.10:21119"; proto = "tcp"; }
];
};
# forwarding for caddy
services.caddy = {
globalConfig = ''
auto_https ignore_loaded_certs
'';
virtualHosts = {
# for central uptime monitoring
"up.${homelab.public_domain}".extraConfig = ''
reverse_proxy 127.0.0.1:7901
'';
# below is basically just manually reverse proxying everything in the homelab
# this is instead of forwarding all 80 & 443 traffic to have more explicit
# publishing things to the open web
"media.${homelab.public_domain}".extraConfig = ''
reverse_proxy ${lumiose_ip}:7100
'';
"photos.${homelab.public_domain}".extraConfig = ''
reverse_proxy ${lumiose_ip}:7702
'';
"hass.${homelab.public_domain}".extraConfig = ''
reverse_proxy ${lumiose_ip}:7704 {
header_up Host {host}
header_up X-Real-IP {remote_host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto https
}
'';
# now hosted on vaniville!
# "pass.${homelab.public_domain}".extraConfig = ''
# reverse_proxy 127.0.0.1:7701
# '';
# "git.${homelab.public_domain}".extraConfig = ''
# reverse_proxy localhost:7703
# '';
};
firewall = {
enable = true;
allowedTCPPorts = [ 22 80 443 25777 7567 21115 21116 21117 21118 21119 ];
allowedUDPPorts = [ 25777 21116 ];
# tailscale will also need its UDP port open:
allowedUDPPorts = [ config.services.tailscale.port 25777 21116 ];
trustedInterfaces = [ "tailscale0" ];
};
# Open ports in the firewall, the wrong way
# networking.firewall.enable = true;
# networking.firewall.extraCommands = ''
# HOMELAB_IP="10.10.0.10" # destination address
# PUBLIC_IF="eth0" # vps public interface
# TAILSCALE_IF="tailscale0" # tailscale interface
#
# # flush rules (avoid dupes)
# iptables -F
# iptables -t nat -F
# iptables -t mangle -F
# iptables -X
#
# # set defualt policies
# iptables -P INPUT DROP
# iptables -P FORWARD DROP
# iptables -P OUTPUT ACCEPT
#
# # allow loopback
# iptables -A INPUT -i lo -j ACCEPT
# iptables -A OUTPUT -o lo -j ACCEPT
#
# # allow replys
# iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
# iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
#
# # allow vps outbound
# iptables -A OUTPUT -o eth0 -j ACCEPT
#
# # general settings
# sysctl -w net.ipv4.ip_forward=1 # enable ip forwarding
# iptables -t nat -A POSTROUTING -o $TAILSCALE_IF -j MASQUERADE # postrouting masquerade (outgoing packets appear to come from vps tailscale ip)
# iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT # allows pings
# iptables -A INPUT -p tcp --dport 22 -j ACCEPT # allows ssh
#
#
# # --- minecraft ---
# # port: 25777 tcp & udp
# # prerouting:
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 25777 -j DNAT --to-destination $HOMELAB_IP:25777 # tcp packets on port 25777
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p udp --dport 25777 -j DNAT --to-destination $HOMELAB_IP:25777 # udp packets on port 25777
# # forwards:
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 25777 -j ACCEPT # vps -> homelab: tcp on port 25777
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p udp --dport 25777 -j ACCEPT # vps -> homelab: udp on port 25777
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 25777 -j ACCEPT # homelab -> vps: tcp on port 25777
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p udp --sport 25777 -j ACCEPT # homelab -> vps: udp on port 25777
#
# # --- reverse proxy ---
# # ports: 80 & 443 tcp
# # prerouting:
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 80 -j DNAT --to-destination $HOMELAB_IP:80 # tcp packets on port 80
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 443 -j DNAT --to-destination $HOMELAB_IP:443 # tcp packets on port 443
# # forwards:
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 80 -j ACCEPT # vps -> homelab: tcp on port 80
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 80 -j ACCEPT # homelab -> vps: tcp on port 80
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 443 -j ACCEPT # vps -> homelab: tcp on port 443
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 443 -j ACCEPT # homelab -> vps: tcp on port 443
#
# # --- gitea ssh ---
# # port: 7567 tcp
# # prerouting:
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 7567 -j DNAT --to-destination $HOMELAB_IP:7567 # tcp packets on port 7567
# # forwards:
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 7567 -j ACCEPT # vps -> homelab: tcp on port 7567
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 7567 -j ACCEPT # homelab -> vps: tcp on port 7567
#
# # --- rustdesk ---
# # ports 2114-2119
# # hbbs ports
# # 21115 tcp (nat type test)
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21115 -j DNAT --to-destination $HOMELAB_IP:21115 # tcp packets on port 21115
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21115 -j ACCEPT # vps -> homelab: tcp on port 21115
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21115 -j ACCEPT # homelab -> vps: tcp on port 21115
# # 21116 tcp&udp (id registration, heartbeat, TCP hole punching)
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21116 -j DNAT --to-destination $HOMELAB_IP:21116 # tcp packets on port 21116
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21116 -j ACCEPT # vps -> homelab: tcp on port 21116
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21116 -j ACCEPT # homelab -> vps: tcp on port 21116
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p udp --dport 21116 -j DNAT --to-destination $HOMELAB_IP:21116 # udp packets on port 21116
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p udp --dport 21116 -j ACCEPT # vps -> homelab: tcp on port 21116
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p udp --sport 21116 -j ACCEPT # homelab -> vps: tcp on port 21116
# # 21118 tcp (web client support)
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21118 -j DNAT --to-destination $HOMELAB_IP:21118 # tcp packets on port 21118
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21118 -j ACCEPT # vps -> homelab: tcp on port 21118
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21118 -j ACCEPT # homelab -> vps: tcp on port 21118
# # hbbr ports
# # 21117 tcp (relay services)
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21117 -j DNAT --to-destination $HOMELAB_IP:21117 # tcp packets on port 21117
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21117 -j ACCEPT # vps -> homelab: tcp on port 21117
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21117 -j ACCEPT # homelab -> vps: tcp on port 21117
# # 21119 tcp (web client support)
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21119 -j DNAT --to-destination $HOMELAB_IP:21119 # tcp packets on port 21119
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21119 -j ACCEPT # vps -> homelab: tcp on port 21119
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21119 -j ACCEPT
# '';
#
system.stateVersion = "25.05"; # Did you read the comment?
}
hosts/nixos/vaniville/hardware-configuration.nix
-34
View File
@@ -1,34 +0,0 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/profiles/qemu-guest.nix")
];
boot.initrd.availableKernelModules = [ "virtio_pci" "virtio_scsi" "ahci" "sd_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
boot.kernelParams = [ "console=ttyS0,19200n8" ];
boot.loader.grub.device = "nodev";
boot.loader.timeout = 10;
boot.loader.grub.extraConfig = ''
serial --speed=19200 --unit=0 --word=8 --parity=no --stop=1;
terminal_input serial;
terminal_output serial
'';
fileSystems."/" =
{ device = "/dev/sda";
fsType = "ext4";
};
swapDevices =
[ { device = "/dev/sdb"; }
];
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
}
hosts/nixos/wsl/configuration.nix
-58
View File
@@ -1,58 +0,0 @@
{ config, lib, stable_pkgs, unstable_pkgs, ... }:
let
pkgs = stable_pkgs.x86_64;
unstable = unstable_pkgs.x86_64;
in
{
imports =
[
./hardware-configuration.nix
../../nixos
../../../users/blake
../../../modules/system
#../../../modules/homelab
];
home-manager.users.blake.imports = [
../../../users/blake/hosts/wsl.nix
];
wsl = {
enable = true;
defaultUser = "blake";
};
system = {
ssh.enable = true;
sops.enable = true;
};
boot = {
loader = {
efi.canTouchEfiVariables = true;
grub = {
enable = true;
forceInstall = true;
};
};
};
# define shell
programs.zsh.enable = true;
users.defaultUserShell = pkgs.zsh;
# packages reccomended by linode
environment.systemPackages = with pkgs; [
];
# setup the network forwarding this host is designed for
# general networking config
networking = {
hostName = "zygarde"; # Define your hostname.
};
system.stateVersion = "25.05"; # Did you read the comment?
}
hosts/nixos/yveltal/configuration.nix
+6 -11
View File
@@ -26,7 +26,7 @@
ssh.enable = true;
sops.enable = true;
yubikey.enable = true;
yubikey.lock_on_remove = false;
yubikey.lock_on_remove = true;
tailscale.enable = true;
syncthing.enable = true;
flatpak.enable = true;
@@ -37,13 +37,12 @@
};
desktop = {
pipewire.enable = true;
hypr.enable = false;
hypr.enable = true;
greetd.enable = true;
kde.enable = true;
};
gaming = {
steam.enable = true;
lutris.enable = false;
lutris.enable = true;
proton_ge.enable = true;
gamemode.enable = true;
mangohud.enable = true;
@@ -63,7 +62,7 @@
# sets the delay before hibernation for ^
systemd.sleep.settings.Sleep = {
HibernateDelaySec = "30m";
};
};
# boot (systemd is growing on me)
boot = {
@@ -99,12 +98,8 @@
};
services.resolved = {
enable = true;
settings = {
Resolve = {
FallbackDNS = ["1.1.1.1" "9.9.9.9"];
DNSOverTLS = "opportunistic";
};
};
fallbackDns = ["1.1.1.1" "9.9.9.9"];
dnsovertls = "opportunistic";
};
hardware.bluetooth.enable = true;
modules/darwin/apps/default.nix
+14 -32
View File
@@ -3,7 +3,8 @@
config,
lib,
...
}: let
}:
let
service = "apps";
cfg = config.darwin.${service};
in {
@@ -12,51 +13,32 @@ in {
};
config = lib.mkIf cfg.enable {
# environment.systemPackages = with pkgs; [
# open-webui
# ];
# environment.systemPackages = with pkgs; [
# uhhh
# ];
homebrew = {
brews = [
"iperf3"
"p7zip"
"sl"
"cowsay"
"apfel"
"yt-dlp"
"ffmpeg"
"ffmpeg-full"
];
casks = [
"gnucash"
"utm"
"libreoffice"
"firefox"
"zen"
"grandperspective"
"spotify"
"obs"
"gimp"
"audacity"
"anki"
"rustdesk"
"mullvad-vpn"
"transmission"
"finetune"
"yacreader"
"keepassxc"
"thunderbird"
"musicbrainz-picard"
"iperf3"
"nmap"
"p7zip"
"sl"
"cowsay"
];
masApps = {
"pages" = 361309726;
"numbers" = 361304891;
"keynote" = 361285480;
"pages" = 409201541;
"numbers" = 409203825;
"keynote" = 409183694;
"bitwarden" = 1352778147;
"darkreader" = 1438243180;
"ghostery" = 6504861501;
"privacy" = 6449850851;
"flo" = 6529533140;
};
};
};
modules/darwin/cyber/default.nix
-40
View File
@@ -1,40 +0,0 @@
{
pkgs,
config,
lib,
...
}:
let
service = "cyber";
cfg = config.darwin.${service};
in {
options.darwin.${service} = {
enable = lib.mkEnableOption "install cyber sec apps";
};
config = lib.mkIf cfg.enable {
environment.systemPackages = with pkgs; [
metasploit
];
homebrew = {
brews = [
"nmap"
"rustscan"
"masscan"
"nikto"
"aircrack-ng"
"hashcat"
"john"
"sqlmap"
"gobuster"
"ffuf"
];
casks = [
"wireshark-app"
];
};
};
}
modules/darwin/default.nix
+3 -4
View File
@@ -5,13 +5,12 @@
...
}: {
imports = [
# ./ssh
./tailscale
./nextdns
./syncthing
./yubikey
./work
./apps
./cyber
./gaming
# ./sops
];
}
modules/darwin/gaming/default.nix
-33
View File
@@ -1,33 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
service = "gaming";
cfg = config.darwin.${service};
in {
options.darwin.${service} = {
enable = lib.mkEnableOption "installs generally wanted apps";
};
config = lib.mkIf cfg.enable {
# environment.systemPackages = with pkgs; [
# uhhh
# ];
homebrew = {
brews = [
];
casks = [
"steam"
"prismlauncher"
"discord"
# "runelite"
# "jagex"
];
masApps = {
};
};
};
}
modules/darwin/nextdns/default.nix
-23
View File
@@ -1,23 +0,0 @@
{
pkgs,
config,
lib,
inputs,
...
}: let
service = "nextdns";
cfg = config.darwin.${service};
in {
options.darwin.${service} = {
enable = lib.mkEnableOption "enables ${service}";
};
config = lib.mkIf cfg.enable {
services.${service} = {
enable = true;
arguments = [
"-profile 527db2"
];
};
};
}
modules/darwin/sops/default.nix
+1 -2
View File
@@ -5,8 +5,7 @@
inputs,
...
}: let
service = "sops";
cfg = config.darwin.${service};
cfg = config.darwin.sops;
in {
imports = [inputs.sops-nix.nixosModules.sops];
modules/darwin/tailscale/default.nix
+12 -15
View File
@@ -5,28 +5,25 @@
inputs,
...
}: let
service = "tailscale";
cfg = config.darwin.${service};
cfg = config.darwin.tailscale;
in {
options.darwin.tailscale = {
enable = lib.mkEnableOption "enables tailscale";
};
config = lib.mkIf cfg.enable {
# services.tailscale = {
# enable = true;
# #overrideLocalDns = true;
# #authKeyFile = authkey_file;
# };
services.tailscale = {
enable = true;
#overrideLocalDns = true;
#authKeyFile = authkey_file;
};
# environment.systemPackages = with pkgs; [
# tailscale-gui
# ];
homebrew = {
casks = [
"tailscale-app"
];
};
# homebrew = {
# casks = [
# "tailscale-app"
# ];
# };
};
}
modules/darwin/work/default.nix
+10 -12
View File
@@ -5,32 +5,30 @@
inputs,
...
}: let
service = "work";
cfg = config.darwin.${service};
cfg = config.darwin.work;
in {
options.darwin.work = {
enable = lib.mkEnableOption "installs apps for work";
};
config = lib.mkIf cfg.enable {
# services.tailscale = {
# enable = true;
# #overrideLocalDns = true;
# #authKeyFile = authkey_file;
# };
services.tailscale = {
enable = true;
#overrideLocalDns = true;
#authKeyFile = authkey_file;
};
homebrew = {
casks = [
"asana"
"microsoft-teams"
#"microsoft-teams"
"microsoft-office"
"jump-desktop"
"wifiman"
"adobe-acrobat-pro"
];
masApps = {
"configurator" = 1037126344;
"configurator" = 1168254295;
};
};
};
}
modules/desktop/default.nix
-1
View File
@@ -9,6 +9,5 @@
./hypr
./greetd
./gaming
./kde
];
}
modules/desktop/kde/default.nix
-53
View File
@@ -1,53 +0,0 @@
{
pkgs,
lib,
config,
...
}: let
cfg = config.desktop.kde;
in {
options.desktop.kde = {
enable = lib.mkEnableOption "enable kde on nixos side";
};
config = lib.mkIf cfg.enable {
# enable kde plasma
services = {
desktopManager.plasma6.enable = true;
#displayManager.sddm.enable = true;
#displayManager.sddm.wayland.enable = true;
};
environment.systemPackages = with pkgs; [
# KDE Utilities
kdePackages.discover # Optional: Software center for Flatpaks/firmware updates
kdePackages.kcalc # Calculator
kdePackages.kcharselect # Character map
kdePackages.kclock # Clock app
kdePackages.kcolorchooser # Color picker
kdePackages.kolourpaint # Simple paint program
kdePackages.ksystemlog # System log viewer
kdePackages.sddm-kcm # SDDM configuration module
kdiff3 # File/directory comparison tool
# Hardware/System Utilities (Optional)
kdePackages.isoimagewriter # Write hybrid ISOs to USB
kdePackages.partitionmanager # Disk and partition management
hardinfo2 # System benchmarks and hardware info
wayland-utils # Wayland diagnostic tools
wl-clipboard # Wayland copy/paste support
vlc # Media player
];
environment.plasma6.excludePackages = with pkgs; [
kdePackages.elisa # Music player
kdePackages.kdepim-runtime # Akonadi agents
kdePackages.kmahjongg
#kdePackages.kmines
kdePackages.konversation # IRC client
kdePackages.kpat # Solitaire
kdePackages.ksudoku
kdePackages.ktorrent
];
};
}
modules/fileshares/holocron/default.nix
-26
View File
@@ -1,26 +0,0 @@
{
pkgs,
config,
lib,
inputs,
...
}: {
# services show up in glance in reverse import order lmao
imports = [
./nfs
./smb
./zfs
./syncthing
./offsite
# ./copyparty
./perms
];
# # define the groups used for backups and archives
# users.users.archives = {
# isSystemUser = true;
# group = "archives";
# };
#
# users.groups.archives = {gid = 727;};
}
modules/fileshares/holocron/offsite/default.nix
-68
View File
@@ -1,68 +0,0 @@
{
config,
pkgs,
lib,
...
}: let
service = "offsite";
cfg = config.holocron.${service};
sec = config.sops.secrets;
in {
options.holocron.offsite = {
enable = lib.mkEnableOption "enables backup script for holocron fileshare";
paths = lib.mkOption {
type = with lib.types; listOf str;
default = [
"/holocron/srv"
"/holocron/users"
];
description = "list of paths to backup";
};
offsite_user = lib.mkOption {
type = lib.types.str;
default = "lifeboat";
description = "user to connect to offsite host with";
};
offsite_target = lib.mkOption {
type = lib.types.str;
default = "lifeboat.holocron.blue";
description = "ip or domain for offsite backups";
};
offsite_dir = lib.mkOption {
type = lib.types.str;
default = "lifeboat/holocron";
description = "path to rsync offsite backups to";
};
};
config = lib.mkIf cfg.enable {
systemd.services.${service} = {
description = "holocron daily sync";
serviceConfig = {
Type = "oneshot";
User = "root";
Group = "archives";
};
script = ''
${pkgs.sshpass}/bin/sshpass -f ${sec."lifeboat_rsync".path} \
${pkgs.rsync}/bin/rsync -aHAX --partial --numeric-ids --info=progress2,name1,stats2 --delete \
-e "${pkgs.openssh}/bin/ssh -o StrictHostKeyChecking=no" \
${builtins.concatStringsSep " " cfg.paths} \
${cfg.offsite_user}@${cfg.offsite_target}::${cfg.offsite_dir}
'';
};
systemd.timers.${service} = {
description = "timer for ${service}";
wantedBy = ["timers.target"];
timerConfig = {
OnCalendar = "*-*-* 05:00:00";
Persistent = true;
};
};
};
}
modules/fileshares/holocron/smb/default.nix
-130
View File
@@ -1,130 +0,0 @@
{
pkgs,
config,
lib,
...
}:
# define smb shares
let
cfg = config.holocron.smb;
smb_shares = {
global = {
# time machine specifc config, must be global
"fruit:aapl" = "yes";
"fruit:nfs_aces" = "no";
"fruit:metadata" = "stream";
"fruit:model" = "TimeCapsule";
"fruit:posix_rename" = "yes";
"fruit:veto_appledouble" = "no";
"fruit:wipe_intentionally_left_blank_rfork" = "yes";
"fruit:delete_empty_adfiles" = "yes";
"vfs objects" = "catia fruit streams_xattr";
"ea support" = "yes";
"spotlight" = "no";
"multicast dns register" = "no";
"min protocol" = "SMB2";
};
archives = {
path = "/holocron/archives";
browseable = true;
writable = true;
guestOk = false;
"create mask" = "0775";
"directory mask" = "0775";
};
timemachine = {
browseable = true;
"path" = "/holocron/archives/timemachine";
"valid users" = "blake";
"public" = "no";
"writeable" = "yes";
"force user" = "blake";
# time machine specifc config
"fruit:time machine" = "yes";
"fruit:time machine max size" = "5T";
"case sensitive" = "yes";
"default case" = "lower";
"preserve case" = "no";
"short preserve case" = "no";
"create mask" = "0660";
"directory mask" = "0770";
"force group" = "blake";
};
users = {
path = "/holocron/users";
browseable = true;
writable = true;
guestOk = false;
"create mask" = "0660";
"directory mask" = "0770";
};
media = {
path = "/holocron/media";
browseable = true;
writable = true;
guestOk = false;
"create mask" = "0775";
"directory mask" = "0775";
};
nvr = {
path = "/holocron/nvr";
writable = true;
guestOk = false;
browseable = true;
"valid users" = "archives";
"public" = "no";
"writeable" = "yes";
"force user" = "archives";
# time machine specifc config
"create mask" = "0660";
"directory mask" = "0770";
"force group" = "archives";
};
};
in {
options.holocron.smb = {
enable = lib.mkEnableOption "enables smb";
};
config = lib.mkIf cfg.enable {
# enable smb with all shares
services.samba = {
enable = true;
package = pkgs.sambaFull;
settings = smb_shares;
};
# ensure time machine can discover the share without `tmutil`
services.avahi = {
enable = true;
openFirewall = true;
nssmdns4 = true;
publish.enable = true;
publish.userServices = true;
extraServiceFiles = {
timemachine = ''
<?xml version="1.0" standalone='no'?>
<!DOCTYPE service-group SYSTEM "avahi-service.dtd">
<service-group>
<name replace-wildcards="yes">%h</name>
<service>
<type>_smb._tcp</type>
<port>445</port>
</service>
<service>
<type>_device-info._tcp</type>
<port>0</port>
<txt-record>model=TimeCapsule8,119</txt-record>
</service>
<service>
<type>_adisk._tcp</type>
<port>0</port>
<txt-record>dk0=adVN=timemachine,adVF=0x82</txt-record>
<txt-record>sys=waMa=0,adVF=0x100</txt-record>
</service>
</service-group>
'';
};
};
};
}
modules/fileshares/holocron/zfs/default.nix
-72
View File
@@ -1,72 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
cfg = config.holocron.zfs;
sec = config.sops.secrets;
in {
options.holocron.zfs = {
enable = lib.mkEnableOption "enables zfs";
};
config = lib.mkIf cfg.enable {
# set network host id
# enable zfs support
boot.kernelModules = ["zfs"];
boot.supportedFilesystems = ["zfs"];
boot.zfs.forceImportRoot = false;
# boot.initrd.services.zfs.enable = true;
# boot.zfs.requestEncryptionCredentials = true;
# arc cache size
boot.kernelParams = ["zfs.zfs_arc_max=12884901888"];
# pools to import
boot.zfs.extraPools = ["holocron"];
# enable smart monitoring
services.smartd = {
enable = true;
autodetect = true;
defaults.monitored = "-a -o on -s (S/../.././05|L/../01/./05)";
notifications = {
test = false;
mail = {
enable = true;
recipient = "blake";
sender = "alerts@blakedheld.xyz";
};
};
};
# enable zfs
services.zfs = {
autoScrub.enable = true;
autoScrub.interval = "weekly";
autoSnapshot = {
enable = true;
frequent = 4; # 15 min snapshots
hourly = 24; # hourly snapshots
daily = 7; # daily snapshots
weekly = 4; # weekly snapshots
monthly = 12; # monthly snapshots
};
# email notifs
zed = {
enableMail = true;
settings = {
ZED_EMAIL_ADDR = ["root" "blake"];
# send notification if scrub succeeds
ZED_NOTIFY_VERBOSE = true;
};
};
};
# install userspace tools for smart
environment.systemPackages = with pkgs; [smartmontools];
};
}
modules/gameservers/cs2/default.nix
-162
View File
@@ -1,162 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
service = "cs2";
cfg = config.gameservers.${service};
in {
options.gameservers.${service} = {
enable = lib.mkEnableOption "Counter Strike 2 server";
data_dir = lib.mkOption {
type = lib.types.str;
default = "/var/lib/gameservers/cs2";
};
port = lib.mkOption {
type = lib.types.int;
default = 27015;
};
tv_port = lib.mkOption {
type = lib.types.int;
default = 27016;
};
hostname = lib.mkOption {
type = lib.types.str;
default = "recoil.pro CS2";
};
map = lib.mkOption {
type = lib.types.str;
default = "de_dust2";
};
max_players = lib.mkOption {
type = lib.types.int;
default = 10;
};
backup = lib.mkOption {
type = lib.types.bool;
default = true;
};
backup_repo = lib.mkOption {
type = lib.types.path;
default = "/holocron/archives/gameservers/cs2";
};
};
config = lib.mkIf cfg.enable {
users.users.cs2 = {
isSystemUser = true;
group = "cs2";
home = cfg.data_dir;
createHome = true;
};
users.groups.cs2 = {};
environment.systemPackages = with pkgs; [
steamcmd
steam-run
rcon
];
systemd.tmpfiles.rules = [
"d ${cfg.data_dir} 0770 cs2 cs2 -"
"d ${cfg.data_dir}/server 0770 cs2 cs2 -"
];
environment.etc."cs2/server.cfg".text = ''
hostname "${cfg.hostname}"
sv_lan 0
rcon_password "$(<${config.sops.secrets."cs2/rcon".path})"
mp_autoteambalance 1
mp_limitteams 2
'';
systemd.services.cs2-update = {
description = "Update CS2 server";
serviceConfig = {
Type = "oneshot";
User = "cs2";
};
script = ''
${pkgs.steamcmd}/bin/steamcmd \
+force_install_dir ${cfg.data_dir}/server \
+login anonymous \
+app_update 730 validate \
+quit
'';
};
systemd.services.cs2-server = {
description = "Counter Strike 2 Dedicated Server";
after = [
"network.target"
"cs2-update.service"
];
requires = [
"cs2-update.service"
];
wantedBy = ["multi-user.target"];
serviceConfig = {
User = "cs2";
Group = "cs2";
WorkingDirectory = "${cfg.data_dir}";
Restart = "always";
ExecStart = pkgs.writeShellScript "cs2-start" ''
export GSLT=$(cat ${config.sops.secrets."cs2/gslt".path})
exec ${pkgs.steam-run}/bin/steam-run -- \
${cfg.data_dir}/server/game/bin/linuxsteamrt64/cs2 \
-dedicated \
-usercon \
-console \
-port ${toString cfg.port} \
-tv_port ${toString cfg.tv_port} \
-maxplayers_override ${toString cfg.max_players} \
+game_type 0 \
+game_mode 1 \
+mapgroup mg_active \
+map ${cfg.map} \
+sv_setsteamaccount "$GSLT" \
+exec /etc/gameserver/cs2/server.cfg
'';
};
};
networking.firewall.allowedTCPPorts = [cfg.port cfg.tv_port];
networking.firewall.allowedUDPPorts = [cfg.port cfg.tv_port];
# backups cs2 server with borg!
services.borgbackup.jobs.${service} = {
archiveBaseName = service;
repo = cfg.backup_repo;
paths = cfg.data_dir;
compression = "auto,zstd";
#preHook = "systemctl start mysql-backup.service";
startAt = "*-*-* *:00:00";
group = "archives";
encryption.mode = "repokey-blake2";
encryption.passCommand = "cat ${config.sops.secrets."borg_passwd".path}";
extraArgs = ["--verbose" "--show-rc" "--umask" "0007"];
extraCreateArgs = ["--list" "--stats" "--filter" "AME"];
prune.keep = {
within = "1d"; # Keep all archives from the last day
hourly = 24;
daily = 7;
weekly = 12;
monthly = -1; # Keep at least one archive for each month
};
};
# manage secrets with sops
sops.secrets = {
"${service}/gslt" = {
owner = service;
group = service;
};
"${service}/rcon" = {
owner = service;
group = service;
};
};
};
}
modules/gameservers/cs2/default.nix.test
-162
View File
@@ -1,162 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
service = "cs2";
cfg = config.gameservers.${service};
in {
options.gameservers.${service} = {
enable = lib.mkEnableOption "Counter Strike 2 server";
data_dir = lib.mkOption {
type = lib.types.str;
default = "/var/lib/gameservers/cs2";
};
port = lib.mkOption {
type = lib.types.int;
default = 27015;
};
tv_port = lib.mkOption {
type = lib.types.int;
default = 27016;
};
hostname = lib.mkOption {
type = lib.types.str;
default = "recoil.pro CS2";
};
map = lib.mkOption {
type = lib.types.str;
default = "de_dust2";
};
max_players = lib.mkOption {
type = lib.types.int;
default = 10;
};
backup = lib.mkOption {
type = lib.types.bool;
default = true;
};
backup_repo = lib.mkOption {
type = lib.types.path;
default = "/holocron/archives/gameservers/cs2";
};
};
config = lib.mkIf cfg.enable {
users.users.cs2 = {
isSystemUser = true;
group = "cs2";
home = cfg.data_dir;
createHome = true;
};
users.groups.cs2 = {};
environment.systemPackages = with pkgs; [
steamcmd
steam-run
rcon
];
systemd.tmpfiles.rules = [
"d ${cfg.data_dir} 0770 cs2 cs2 -"
"d ${cfg.data_dir}/server 0770 cs2 cs2 -"
];
environment.etc."cs2/server.cfg".text = ''
hostname "${cfg.hostname}"
sv_lan 0
rcon_password "$(<${config.sops.secrets."cs2/rcon".path})"
mp_autoteambalance 1
mp_limitteams 2
'';
systemd.services.cs2-update = {
description = "Update CS2 server";
serviceConfig = {
Type = "oneshot";
User = "cs2";
};
script = ''
${pkgs.steamcmd}/bin/steamcmd \
+force_install_dir ${cfg.data_dir}/server \
+login anonymous \
+app_update 730 validate \
+quit
'';
};
systemd.services.cs2-server = {
description = "Counter Strike 2 Dedicated Server";
after = [
"network.target"
"cs2-update.service"
];
requires = [
"cs2-update.service"
];
wantedBy = ["multi-user.target"];
serviceConfig = {
User = "cs2";
Group = "cs2";
WorkingDirectory = "${cfg.data_dir}/server";
Restart = "always";
ExecStart = pkgs.writeShellScript "cs2-start" ''
export GSLT=$(cat ${config.sops.secrets."cs2/gslt".path})
exec ${pkgs.steam-run}/bin/steam-run -- \
${cfg.data_dir}/server/game/cs2.sh \
-dedicated \
-usercon \
-console \
-port ${toString cfg.port} \
-tv_port ${toString cfg.tv_port} \
-maxplayers_override ${toString cfg.max_players} \
+game_type 0 \
+game_mode 1 \
+mapgroup mg_active \
+map ${cfg.map} \
+sv_setsteamaccount "$GSLT" \
+exec /etc/gameserver/cs2/server.cfg
'';
};
};
networking.firewall.allowedTCPPorts = [cfg.port cfg.tv_port];
networking.firewall.allowedUDPPorts = [cfg.port cfg.tv_port];
# backups cs2 server with borg!
services.borgbackup.jobs.${service} = {
archiveBaseName = service;
repo = cfg.backup_repo;
paths = cfg.data_dir;
compression = "auto,zstd";
#preHook = "systemctl start mysql-backup.service";
startAt = "*-*-* *:00:00";
group = "archives";
encryption.mode = "repokey-blake2";
encryption.passCommand = "cat ${config.sops.secrets."borg_passwd".path}";
extraArgs = ["--verbose" "--show-rc" "--umask" "0007"];
extraCreateArgs = ["--list" "--stats" "--filter" "AME"];
prune.keep = {
within = "1d"; # Keep all archives from the last day
hourly = 24;
daily = 7;
weekly = 12;
monthly = -1; # Keep at least one archive for each month
};
};
# manage secrets with sops
sops.secrets = {
"${service}/gslt" = {
owner = service;
group = service;
};
"${service}/rcon" = {
owner = service;
group = service;
};
};
};
}
modules/gameservers/minecraft_modded/default.nix
+22 -54
View File
@@ -8,12 +8,8 @@
cfg = config.gameservers.${service};
sec = config.sops.secrets;
servers = {
# cobblemon = {
# data_dir = "/var/lib/gameservers/minecraft_modded/cobblemon";
# start_file = "start.sh";
# };
linggango = {
data_dir = "/var/lib/gameservers/minecraft_modded/linggango";
cobblemon = {
data_dir = "/var/lib/gameservers/minecraft_modded/cobblemon";
start_file = "start.sh";
};
};
@@ -22,7 +18,7 @@ in {
enable = lib.mkEnableOption "enables ${service}";
url = lib.mkOption {
type = lib.types.str;
default = "modded.recoil.pro";
default = "mc.recoil.pro";
description = "set domain for ${service}";
};
data_dir = lib.mkOption {
@@ -40,34 +36,18 @@ in {
default = false;
description = "enable backups for ${service}";
};
motd_gs = lib.mkOption {
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = ["craftoria"];
default = "velocity";
};
backup_repo = lib.mkOption {
type = lib.types.path;
default = "/var/backup/gameservers/minecraft/modded";
default = "/holocron/archives/gameservers/minecraft/modded";
description = "path to take hourly backups to with borg!";
};
offsite_user = lib.mkOption {
type = lib.types.str;
default = "lifeboat";
description = "user to connect to offsite host with";
};
offsite_target = lib.mkOption {
type = lib.types.str;
default = "lifeboat.holocron.blue";
description = "ip or domain for offsite backups";
};
offsite_dir = lib.mkOption {
type = lib.types.str;
default = "lifeboat/holocron/archives/gameservers";
description = "path to rsync offsite backups to";
};
};
config = lib.mkIf cfg.enable {
users.groups.minecraft = {gid = lib.mkForce cfg.ids;};
# declare ${service} user
users.users.minecraft = lib.mkDefault {
@@ -91,15 +71,13 @@ in {
description = "minecraft_recpro: ${name}";
after = ["network.target"];
wants = ["network.target"];
path = [pkgs.openjdk21];
serviceConfig = {
User = "minecraft";
Group = "minecraft";
WorkingDirectory = srv.data_dir;
UMask = "0007";
#ExecStart = "${pkgs.openjdk21}/bin/java -Xms4G -Xmx12G -XX:+UseG1GC -XX:+ParallelRefProcEnabled -XX:MaxGCPauseMillis=200 -XX:+UnlockExperimentalVMOptions -XX:+AlwaysPreTouch -XX:G1NewSizePercent=30 -XX:G1MaxNewSizePercent=40 -XX:G1HeapRegionSize=8M -XX:G1ReservePercent=20 -XX:G1HeapWastePercent=5 -XX:G1MixedGCCountTarget=4 -XX:InitiatingHeapOccupancyPercent=15 -XX:G1MixedGCLiveThresholdPercent=90 -XX:G1RSetUpdatingPauseTimePercent=5 -XX:SurvivorRatio=32 -XX:+PerfDisableSharedMem -XX:MaxTenuringThreshold=1 -Dusing.aikars.flags=https://mcflags.emc.gs -Daikars.new.flags=true @libraries/net/neoforged/neoforge/21.1.211/unix_args.txt";
ExecStart = "${pkgs.openjdk21}/bin/java -Xms4G -Xmx12G -XX:+UseG1GC -XX:+ParallelRefProcEnabled -XX:MaxGCPauseMillis=200 -XX:+UnlockExperimentalVMOptions -XX:+AlwaysPreTouch -XX:G1NewSizePercent=30 -XX:G1MaxNewSizePercent=40 -XX:G1HeapRegionSize=8M -XX:G1ReservePercent=20 -XX:G1HeapWastePercent=5 -XX:G1MixedGCCountTarget=4 -XX:InitiatingHeapOccupancyPercent=15 -XX:G1MixedGCLiveThresholdPercent=90 -XX:G1RSetUpdatingPauseTimePercent=5 -XX:SurvivorRatio=32 -XX:+PerfDisableSharedMem -XX:MaxTenuringThreshold=1 -Dusing.aikars.flags=https://mcflags.emc.gs -Daikars.new.flags=true @libraries/net/neoforged/neoforge/21.1.211/unix_args.txt";
#ExecStart = "${srv.data_dir}/${srv.start_file}";
ExecStart = "${pkgs.openjdk21}/bin/java -Xms4G -Xmx24G @libraries/net/minecraftforge/forge/1.20.1-47.4.20/unix_args.txt \"$@\"";
Restart = "on-failure";
KillMode = "process";
};
@@ -107,7 +85,7 @@ in {
})
servers;
environment.systemPackages = with pkgs; [openjdk21 mcrcon borgbackup sshpass tree rsync];
environment.systemPackages = with pkgs; [openjdk21 mcrcon];
# services.mysql = {
# enable = true;
@@ -127,25 +105,22 @@ in {
# };
# open firewall
networking.firewall.allowedTCPPorts = [25579];
networking.firewall.allowedUDPPorts = [25580]; #voicechat
networking.firewall.allowedTCPPorts = [25778];
sops.secrets = {
"borg_passwd" = {
owner = "root";
group = "root";
};
"lifeboat_rsync" = {
owner = "root";
group = "archives";
mode = "0440";
};
};
# sops.secrets = {
# "velocity_forwarding" = {
# owner = "minecraft";
# group = "minecraft";
# path = "/var/lib/gameservers/minecraft_recpro/velocity/forwarding.secret";
# mode = "0400";
# };
# "minecraft_recpro_db_passwd" = {
# owner = "mysql";
# group = "mysql";
# };
# };
# helpful and for scripts
users.groups.archives = {gid = 727;};
# backups minecraft_modded with borg!
# backups minecraft_recpro with borg!
services.borgbackup.jobs.${service} = {
archiveBaseName = service;
repo = cfg.backup_repo;
@@ -163,13 +138,6 @@ in {
);
compression = "auto,zstd";
#preHook = "systemctl start mysql-backup.service";
postHook = ''
${pkgs.sshpass}/bin/sshpass -f ${sec."lifeboat_rsync".path} \
${pkgs.rsync}/bin/rsync -aHAX --partial --numeric-ids --info=progress2,name1,stats2 --delete \
-e "ssh -o StrictHostKeyChecking=no" \
${toString cfg.backup_repo} \
${cfg.offsite_user}@${cfg.offsite_target}::${cfg.offsite_dir}
'';
startAt = "*-*-* *:00:00";
group = "archives";
encryption.mode = "repokey-blake2";
modules/gameservers/minecraft_recpro/default.nix
+4 -26
View File
@@ -49,30 +49,15 @@ in {
default = false;
description = "enable backups for ${service}";
};
motd_gs = lib.mkOption {
type = lib.types.nullOr (lib.types.listOf lib.types.str);
default = ["velocity" "smp" "superflat" "bento"];
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = "velocity";
};
backup_repo = lib.mkOption {
type = lib.types.path;
default = "/holocron/archives/gameservers/minecraft/recpro_stack";
description = "path to take hourly backups to with borg!";
};
offsite_user = lib.mkOption {
type = lib.types.str;
default = "lifeboat";
description = "user to connect to offsite host with";
};
offsite_target = lib.mkOption {
type = lib.types.str;
default = "lifeboat.holocron.blue";
description = "ip or domain for offsite backups";
};
offsite_dir = lib.mkOption {
type = lib.types.str;
default = "lifeboat/holocron/archives/gameservers";
description = "path to rsync offsite backups to";
};
};
config = lib.mkIf cfg.enable {
@@ -106,7 +91,7 @@ in {
Group = "minecraft";
WorkingDirectory = srv.data_dir;
UMask = "0007";
ExecStart = "${pkgs.openjdk25}/bin/java -Xmx${srv.ram} -jar server.jar nogui";
ExecStart = "${pkgs.openjdk21}/bin/java -Xmx${srv.ram} -jar server.jar nogui";
Restart = "on-failure";
KillMode = "process";
};
@@ -167,13 +152,6 @@ in {
);
compression = "auto,zstd";
preHook = "systemctl start mysql-backup.service";
postHook = ''
${pkgs.sshpass}/bin/sshpass -f ${sec."lifeboat_rsync".path} \
${pkgs.rsync}/bin/rsync -aHAX --partial --numeric-ids --info=progress2,name1,stats2 --delete \
-e "ssh -o StrictHostKeyChecking=no" \
${toString cfg.backup_repo} \
${cfg.offsite_user}@${cfg.offsite_target}::${cfg.offsite_dir}
'';
startAt = "*-*-* *:00:00";
group = "archives";
encryption.mode = "repokey-blake2";
modules/gameservers/valheim/default.nix
-149
View File
@@ -1,149 +0,0 @@
{
pkgs,
config,
lib,
inputs,
...
}: let
nixservice = "podman-valheim";
service = "valheim";
cfg = config.gameservers.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
options.gameservers.${service} = {
enable = lib.mkEnableOption "enables ${service}";
# set port options
port = lib.mkOption {
type = lib.types.int;
default = 2456;
description = "set port for ${service} (default: ${toString cfg.port}";
};
url = lib.mkOption {
type = lib.types.str;
default = "${service}.${homelab.base_domain}";
description = "set domain for ${service}";
};
data_dir = lib.mkOption {
type = lib.types.str;
default = "/var/lib/gameservers/${service}";
description = "set data directory for ${service}";
};
ids = lib.mkOption {
type = lib.types.int;
default = cfg.port;
description = "set uid and pid of ${service} user (matches port by default)";
};
motd_gs = lib.mkOption {
type = lib.types.nullOr (lib.types.listOf lib.types.str);
default = ["podman-valheim"];
};
backup = lib.mkOption {
type = lib.types.bool;
default = false;
description = "enable backups for ${service}";
};
backup_repo = lib.mkOption {
type = lib.types.path;
default = "/var/backup/gameservers/valheim";
description = "path to take hourly backups to with borg!";
};
offsite_user = lib.mkOption {
type = lib.types.str;
default = "lifeboat";
description = "user to connect to offsite host with";
};
offsite_target = lib.mkOption {
type = lib.types.str;
default = "lifeboat.holocron.blue";
description = "ip or domain for offsite backups";
};
offsite_dir = lib.mkOption {
type = lib.types.str;
default = "lifeboat/holocron/archives/gameservers";
description = "path to rsync offsite backups to";
};
};
config = lib.mkIf cfg.enable {
# declare ${service} group
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
# declare ${service} user
users.users.${service} = {
description = "${service} server user";
uid = lib.mkForce cfg.ids;
isSystemUser = true;
home = cfg.data_dir;
createHome = true;
group = service;
extraGroups = [];
};
virtualisation.oci-containers.containers = {
${service} = {
image = "ghcr.io/community-valheim-tools/valheim-server";
autoStart = true;
extraOptions = [
"--cap-add=sys_nice"
"--stop-timeout=120"
];
ports = [
"2456-2457:2456-2457/udp"
"2456:80/tcp"
];
volumes = [
"${cfg.data_dir}/config:/config"
"${cfg.data_dir}/data:/opt/valheim"
];
environment = {
SERVER_NAME = "recpro";
SERVER_PASS = "recoil727pro";
#WORLD_NAME = "";
STATUS_HTTP = "true";
TZ = homelab.tz;
PUID = toString config.users.users.${service}.uid;
PGID = toString config.users.groups.${service}.gid;
};
};
};
# override umask to make permissions work out
systemd.services.${service}.serviceConfig = {
UMask = lib.mkForce "0007";
};
# open firewall
networking.firewall.allowedTCPPorts = [cfg.port];
networking.firewall.allowedUDPPorts = [2456 2457];
# backups valhiem with borg!
services.borgbackup.jobs.${service} = {
archiveBaseName = service;
repo = cfg.backup_repo;
paths = cfg.data_dir;
compression = "auto,zstd";
#preHook = "systemctl start mysql-backup.service";
postHook = ''
${pkgs.sshpass}/bin/sshpass -f ${sec."lifeboat_rsync".path} \
${pkgs.rsync}/bin/rsync -aHAX --partial --numeric-ids --info=progress2,name1,stats2 --delete \
-e "ssh -o StrictHostKeyChecking=no" \
${toString cfg.backup_repo} \
${cfg.offsite_user}@${cfg.offsite_target}::${cfg.offsite_dir}
'';
startAt = "*-*-* *:00:00";
group = "archives";
encryption.mode = "repokey-blake2";
encryption.passCommand = "cat ${config.sops.secrets."borg_passwd".path}";
extraArgs = ["--verbose" "--show-rc" "--umask" "0007"];
extraCreateArgs = ["--list" "--stats" "--filter" "AME"];
prune.keep = {
within = "1d"; # Keep all archives from the last day
hourly = 24;
daily = 7;
weekly = 12;
monthly = -1; # Keep at least one archive for each month
};
};
};
}
modules/homelab/services/homebox/default.nix → modules/holocron/copyparty/default.nix
+70 -36
View File
@@ -2,20 +2,23 @@
pkgs,
config,
lib,
inputs,
...
}: let
service = "homebox";
cfg = config.homelab.${service};
service = "copyparty";
cfg = config.holocron.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
options.homelab.${service} = {
imports = [inputs.copyparty.nixosModules.default];
options.holocron.${service} = {
enable = lib.mkEnableOption "enables ${service}";
# set port options
port = lib.mkOption {
type = lib.types.int;
default = 7709;
default = 7902;
description = "set port for ${service} (default: ${toString cfg.port}";
};
url = lib.mkOption {
@@ -38,13 +41,10 @@ in {
default = true;
description = "enable backups for ${service}";
};
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = service;
};
};
config = lib.mkIf cfg.enable {
nixpkgs.overlays = [inputs.copyparty.overlays.default];
# declare ${service} group
users.groups.${service} = {
gid = lib.mkForce cfg.ids;
@@ -58,6 +58,7 @@ in {
home = cfg.data_dir;
createHome = true;
group = service;
extraGroups = [ "media" "blake" "archives" ];
};
# enable the ${service} service
@@ -66,24 +67,56 @@ in {
user = service;
group = service;
settings = {
HBOX_WEB_PORT = toString cfg.port;
HBOX_STORAGE_CONN_STRING = "file://${cfg.data_dir}";
HBOX_STORAGE_PREFIX_PATH = "data";
HBOX_DATABASE_DRIVER = "sqlite3";
HBOX_DATABASE_SQLITE_PATH = "${cfg.data_dir}/data/homebox.db?_pragma=busy_timeout=999&_pragma=journal_mode=WAL&_fk=1";
HBOX_OPTIONS_ALLOW_REGISTRATION = "false";
HBOX_OPTIONS_GITHUB_RELEASE_CHECK = "false";
HBOX_MODE = "production";
HOME = cfg.data_dir;
TMPDIR = "${cfg.data_dir}/tmp";
i = "0.0.0.0";
p = [7902];
rproxy = 1;
};
accounts = {
blake = {
passwordFile = sec."copyparty_passwd".path;
};
};
groups = {
media = ["blake"];
};
volumes = {
"/archives" = {
path = "/holocron/archives";
access = {
r = "*";
A = "blake";
};
flags = {
chmod_f = 660;
chmod_d = 770;
#gid = ?;
};
};
"/media" = {
path = "/holocron/media";
access = {
r = "*";
w = "@media";
A = "blake";
};
flags = {
chmod_f = 660;
chmod_d = 770;
gid = "700";
};
};
"/users/blake" = {
path = "/holocron/users/blake";
access = {
A = "blake";
};
flags = {
chmod_f = 660;
chmod_d = 770;
gid = "1000";
};
};
};
};
# override umask to make permissions work out
systemd.services.${service}.serviceConfig = {
UMask = lib.mkForce "0007";
User = service;
Group = service;
};
# open firewall
@@ -91,14 +124,16 @@ in {
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
serverAliases = ["${service}.${homelab.public_domain}"];
extraConfig = ''
tls internal
reverse_proxy 127.0.0.1:${toString cfg.port}
tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
reverse_proxy 127.0.0.1:${toString cfg.port} {
}
'';
};
# add to glance (local service)
homelab.glance.links.services = [
homelab.glance.links.system = [
{
title = service;
url = "https://${cfg.url}";
@@ -107,14 +142,13 @@ in {
icon = "di:${service}";
}
];
#---------------------------------------------------------------------------
#
# sops.secrets = {
# "${service}_" = {
# owner = ;
# group = ;
# };
# };
sops.secrets = {
"${service}_passwd" = {
owner = service;
group = service;
};
};
# add to backups
homelab.backups.baks = {
modules/holocron/default.nix
+21
View File
@@ -0,0 +1,21 @@
{
pkgs,
config,
lib,
inputs,
...
}: {
# services show up in glance in reverse import order lmao
imports = [
./nfs
./smb
./zfs
./syncthing
./copyparty
./perms
];
# define the groups used for backups and archives
users.groups.archives = {gid = 727;};
}
modules/fileshares/holocron/nfs/default.nix → modules/holocron/nfs/default.nix
View File
modules/fileshares/holocron/perms/default.nix → modules/holocron/perms/default.nix
View File
modules/holocron/smb/default.nix
+59
View File
@@ -0,0 +1,59 @@
{
pkgs,
config,
lib,
...
}:
# define smb shares
let
cfg = config.holocron.smb;
smb_shares = {
archives = {
path = "/holocron/archives";
browseable = true;
writable = true;
guestOk = false;
"create mask" = "0775";
"directory mask" = "0775";
};
timemachine = {
browseable = true;
"path" = "/holocron/archives/timemachine";
#"valid users" = "blake";
"public" = "no";
"writeable" = "yes";
#"force user" = "blake";
"fruit:aapl" = "yes";
"fruit:time machine" = "yes";
"vfs objects" = "catia fruit streams_xattr";
};
users = {
path = "/holocron/users";
browseable = true;
writable = true;
guestOk = false;
"create mask" = "0660";
"directory mask" = "0770";
};
media = {
path = "/holocron/media";
browseable = true;
writable = true;
guestOk = false;
"create mask" = "0775";
"directory mask" = "0775";
};
};
in {
options.holocron.smb = {
enable = lib.mkEnableOption "enables smb";
};
config = lib.mkIf cfg.enable {
# enable smb with all shares
services.samba = {
enable = true;
settings = smb_shares;
};
};
}
modules/fileshares/holocron/syncthing/default.nix → modules/holocron/syncthing/default.nix
+25 -27
View File
@@ -7,7 +7,7 @@
service = "syncthing";
cfg = config.holocron.${service};
sec = config.sops.secrets;
url = "syncthing.${config.networking.hostName}.holocron.blue";
url = "syncthing.snowbelle.lan";
homelab = config.homelab;
in {
options.holocron.${service} = {
@@ -23,29 +23,30 @@ in {
guiAddress = "0.0.0.0:2222";
openDefaultPorts = true;
#extraFlags = ["--no-default-folder"];
key = sec."${service}/lumiose/key".path;
cert = sec."${service}/lumiose/cert".path;
key = sec."${service}/snowbelle/key".path;
cert = sec."${service}/snowbelle/cert".path;
settings = {
devices = {
"piplup" = {id = "OV4NUQK-3YHRL5R-SIZGTNL-7VZFFUX-FOJ6NTS-C7ROXR7-I2Q2W7G-QERO7AO";};
"mudkip" = {id = "OV4NUQK-3YHRL5R-SIZGTNL-7VZFFUX-FOJ6NTS-C7ROXR7-I2Q2W7G-QERO7AO";};
"zygarde" = {id = "UYLTF52-VVKUR7F-JN33HQZ-RFNWGL3-JER52LA-GZD2LPJ-QIFEE7K-MNMZRQ5";};
"yveltal" = {id = "ZVSQ4WJ-7OICYOZ-3ECES4X-KH37IPB-TKHKUJG-BSEGXVM-AHYY5C3-VKG44AX";};
"CEN-IT-07" = {id = "DPYKA4Z-3PX7JB2-FBEOXXX-SC7TLT2-QC5P2IR-SXOPJGX-QO3DMII-5B7UCA4";};
"CEN-IT-00007" = {id = "UEWNSUZ-AX75M5Y-OA4FURY-ORMEXFA-XUXU4LU-LEUYKVW-IDM2GQC-4UR4YAL";};
"CEN-IT-00007" = {id = "XBPXGYU-DUJSLDH-6BDNF4D-CO2COC3-N3FM6W5-IHZOJBM-Z2N77RI-IVAV5AH";};
};
folders = {
"holocron" = {
path = "/holocron/users/blake/holocron";
devices = ["piplup" "zygarde" "CEN-IT-07" "CEN-IT-00007" "yveltal"];
devices = ["mudkip" "zygarde" "CEN-IT-07" "CEN-IT-00007" "yveltal"];
id = "5voxg-c3he2";
# versioning = {
# type = "staggered";
# fsPath = "/holocron/users/blake/holocron/.stversions";
# params = {
# cleanInterval = "3600";
# maxAge = "0";
# };
# };
versioning = {
type = "staggered";
fsPath = "/holocron/users/blake/holocron/.stversions";
params = {
cleanInterval = "3600";
maxAge = "0";
};
};
};
};
options = {
@@ -55,35 +56,32 @@ in {
};
sops.secrets = {
"${service}/lumiose/key" = {
"${service}/snowbelle/key" = {
owner = "blake";
group = "blake";
};
"${service}/lumiose/cert" = {
"${service}/snowbelle/cert" = {
owner = "blake";
group = "blake";
};
};
homelab.backups.baks = {
${service} = {paths = [config.services.syncthing.dataDir];};
${service} = { paths = [ config.services.syncthing.dataDir ]; };
};
services.caddy.virtualHosts."${url}" = {
extraConfig = ''
tls internal
tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
reverse_proxy 127.0.0.1:2222
'';
};
# add to glance (local service)
homelab.glance.links.system = [
{
title = service;
url = "https://${url}";
error-url = "http://${homelab.host_ip}:2222";
check-url = "http://${homelab.host_ip}:2222";
icon = "di:${service}";
}
];
homelab.glance.links.system = [{
title = service;
url = "https://${url}";
error-url = "http://${homelab.host_ip}:2222";
check-url = "http://${homelab.host_ip}:2222";
icon = "di:${service}"; }];
};
}
modules/holocron/zfs/default.nix
+78
View File
@@ -0,0 +1,78 @@
{
pkgs,
config,
lib,
...
}: let
cfg = config.holocron.zfs;
in {
options.holocron.zfs = {
enable = lib.mkEnableOption "enables zfs";
};
config = lib.mkIf cfg.enable {
# set network host id
networking.hostId = "3e6e7055";
# enable zfs support
boot.kernelModules = ["zfs"];
boot.supportedFilesystems = ["zfs"];
# arc cache size
boot.kernelParams = [ "zfs.zfs_arc_max=12884901888" ];
# pools to import
#boot.zfs.extraPools = [ "holocron" "holocron/archives" "/holocron/media" "/holocron/users" ];
#boot.zfs.extraPools = [ "holocron" ];
# enable smart monitoring
services.smartd = {
enable = true;
autodetect = true;
defaults.monitored = "-a -o on -s (S/../.././05|L/../01/./05)";
notifications.mail = {
enable = true;
sender = "zfs@snowbelle.lan";
};
};
# enable zfs
services.zfs = {
autoScrub.enable = true;
autoScrub.interval = "weekly";
# email notifs
zed = {
enableMail = true;
settings = {
ZED_EMAIL_ADDR = ["root"];
# send notification if scrub succeeds
ZED_NOTIFY_VERBOSE = true;
};
};
};
# install userspace tools for acl's
environment.systemPackages = with pkgs; [smartmontools];
fileSystems."/holocron" = {
device = "holocron";
fsType = "zfs";
options = ["nofail"];
};
fileSystems."/holocron/archives" = {
device = "holocron/archives";
fsType = "zfs";
options = ["nofail"];
};
fileSystems."/holocron/users" = {
device = "holocron/users";
fsType = "zfs";
options = ["nofail"];
};
fileSystems."/holocron/media" = {
device = "holocron/media";
fsType = "zfs";
options = ["nofail"];
};
};
}
modules/homelab/.ai/default.nix
-9
View File
@@ -1,9 +0,0 @@
{ pkgs, config, lib, ... }:
{
# the order determines the order in glance :3
imports = [
./ollama
./open-webui
];
}
modules/homelab/.ai/ollama/default.nix
-98
View File
@@ -1,98 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
service = "ollama";
cfg = config.homelab.${service};
homelab = config.homelab;
in {
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
# set port options
port = lib.mkOption {
type = lib.types.int;
default = 7710;
description = "set port for ${service} (default: ${toString cfg.port}";
};
url = lib.mkOption {
type = lib.types.str;
default = "ollama.${homelab.base_domain}";
description = "set domain for ${service}";
};
data_dir = lib.mkOption {
type = lib.types.str;
default = "/var/lib/${service}";
description = "set data directory for ${service}";
};
ids = lib.mkOption {
type = lib.types.int;
default = cfg.port;
description = "set uid and pid of ${service} user (matches port by default)";
};
backup = lib.mkOption {
type = lib.types.bool;
default = true;
description = "enable backups for ${service}";
};
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = service;
};
};
config = lib.mkIf cfg.enable {
# declare ${service} group
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
# declare ${service} user
users.users.${service} = {
description = lib.mkForce "${service} server user";
uid = lib.mkForce cfg.ids;
isSystemUser = true;
shell = pkgs.bash;
home = cfg.data_dir;
createHome = true;
group = service;
extraGroups = [];
};
# declare the gitea service
services.${service} = {
enable = true;
host = "0.0.0.0";
port = cfg.port;
openFirewall = true;
syncModels = true;
loadModels = [
"deepseek-r1:7b"
"deepseek-r1:14b"
];
};
# override umask to make permissions work out
systemd.services.${service}.serviceConfig = {
UMask = lib.mkForce "0007";
};
# open firewall
networking.firewall.allowedTCPPorts = [cfg.port];
services.caddy.virtualHosts."${cfg.url}" = {
extraConfig = ''
tls internal
reverse_proxy localhost:${toString cfg.port} {
}
'';
};
# add to backups
homelab.backups.baks = {
${service} = {
paths = [cfg.data_dir "/var/lib/private"];
};
};
};
}
modules/homelab/.ai/open-webui/default.nix
-104
View File
@@ -1,104 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
service = "open-webui";
cfg = config.homelab.${service};
homelab = config.homelab;
in {
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
# set port options
port = lib.mkOption {
type = lib.types.int;
default = 7711;
description = "set port for ${service} (default: ${toString cfg.port}";
};
url = lib.mkOption {
type = lib.types.str;
default = "ai.${homelab.base_domain}";
description = "set domain for ${service}";
};
data_dir = lib.mkOption {
type = lib.types.str;
default = "/var/lib/${service}";
description = "set data directory for ${service}";
};
ids = lib.mkOption {
type = lib.types.int;
default = cfg.port;
description = "set uid and pid of ${service} user (matches port by default)";
};
backup = lib.mkOption {
type = lib.types.bool;
default = true;
description = "enable backups for ${service}";
};
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = service;
};
};
config = lib.mkIf cfg.enable {
# declare ${service} group
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
# declare ${service} user
users.users.${service} = {
description = lib.mkForce "${service} server user";
uid = lib.mkForce cfg.ids;
isSystemUser = true;
shell = pkgs.bash;
home = cfg.data_dir;
createHome = true;
group = service;
extraGroups = [];
};
# declare the gitea service
services.${service} = {
enable = true;
host = "0.0.0.0";
port = cfg.port;
openFirewall = true;
};
# override umask to make permissions work out
systemd.services.${service}.serviceConfig = {
UMask = lib.mkForce "0007";
};
# open firewall
networking.firewall.allowedTCPPorts = [cfg.port];
services.caddy.virtualHosts."${cfg.url}" = {
extraConfig = ''
tls internal
reverse_proxy localhost:${toString cfg.port} {
}
'';
};
# add to glance
homelab.glance.links.services = [
{
title = service;
url = "https://ai.${homelab.base_domain}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
# add to backups
homelab.backups.baks = {
${service} = {
paths = [cfg.data_dir "/var/lib/private"];
};
};
};
}
modules/homelab/.default.nix.template.nix
+1 -7
View File
@@ -38,10 +38,6 @@ in {
default = true;
description = "enable backups for ${service}";
};
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = service;
};
};
config = lib.mkIf cfg.enable {
@@ -86,10 +82,8 @@ in {
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
serverAliases = ["${service}.${homelab.public_domain}"];
# use explicitly defined tls cert
# tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
extraConfig = ''
tls internal
tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
reverse_proxy 127.0.0.1:${toString cfg.port}
'';
};
modules/homelab/.nomad/default.nix
-29
View File
@@ -1,29 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
cfg = config.homelab.nomad;
in {
options.homelab.nomad = {
enable = lib.mkEnableOption "enable in house project nomad";
tz = lib.mkOption {
default = "America/Chicago";
type = lib.types.str;
description = "set timezone";
};
};
config = lib.mkIf cfg.enable {
# the order determines the order in glance :3
imports = [
./kiwix
./maps
./kolibri
];
homelab.kiwix.enable = lib.mkDefault true;
homelab.maps.enable = lib.mkDefault true;
homelab.kolibri.enable = lib.mkDefault true;
};
}
modules/homelab/.nomad/kiwix/default.nix
-121
View File
@@ -1,121 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
service = "kiwix";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
# set port options
port = lib.mkOption {
type = lib.types.int;
default = 7730;
description = "set port for ${service} (default: ${toString cfg.port}";
};
url = lib.mkOption {
type = lib.types.str;
default = "${service}.${homelab.base_domain}";
description = "set domain for ${service}";
};
data_dir = lib.mkOption {
type = lib.types.str;
default = "/var/lib/${service}";
description = "set data directory for ${service}";
};
ids = lib.mkOption {
type = lib.types.int;
default = cfg.port;
description = "set uid and pid of ${service} user (matches port by default)";
};
backup = lib.mkOption {
type = lib.types.bool;
default = true;
description = "enable backups for ${service}";
};
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = "kiwix-serve";
};
};
config = lib.mkIf cfg.enable {
# declare ${service} group
users.groups.${service} = {
gid = lib.mkForce cfg.ids;
};
# declare ${service} user
users.users.${service} = {
description = "${service} server user";
uid = lib.mkForce cfg.ids;
isSystemUser = true;
home = cfg.data_dir;
createHome = true;
group = service;
extraGroups = ["media"];
};
# helpful and for scripts
environment.systemPackages = with pkgs; [kiwix-tools];
# enable the ${service} service
services.kiwix-serve = {
enable = true;
openFirewall = true;
port = cfg.port;
user = service;
group = service;
libraryPath = "${cfg.data_dir}/library.xml";
extraArgs = {
};
};
# override umask to make permissions work out
systemd.services.${service}.serviceConfig = {
UMask = lib.mkForce "0007";
User = service;
Group = service;
};
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
serverAliases = ["${service}.${homelab.public_domain}"];
# use explicitly defined tls cert
# tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
extraConfig = ''
tls internal
reverse_proxy 127.0.0.1:${toString cfg.port}
'';
};
# add to glance (local service)
homelab.glance.links.nomad = [
{
title = service;
url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
# sops.secrets = {
# "${service}_" = {
# owner = ;
# group = ;
# };
# };
# add to backups
homelab.backups.baks = {
${service} = {
paths = [cfg.data_dir];
};
};
};
}
modules/homelab/mediastack/bazarr/default.nix → modules/homelab/arr/bazarr/default.nix
+19 -19
View File
@@ -1,13 +1,12 @@
{
pkgs,
config,
lib,
...
}: let
{ pkgs, config, lib, ... }:
let
service = "bazarr";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
in
{
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
@@ -44,8 +43,9 @@ in {
};
config = lib.mkIf cfg.enable {
# declare ${service} group
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
# declare ${service} user
users.users.${service} = {
@@ -55,7 +55,7 @@ in {
home = cfg.data_dir;
createHome = true;
group = service;
extraGroups = ["media"];
extraGroups = [ "media" ];
};
# enable the ${service} service
@@ -72,6 +72,9 @@ in {
UMask = lib.mkForce "0007";
};
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
extraConfig = ''
@@ -81,19 +84,16 @@ in {
};
# add to glance
homelab.glance.links.mediastack = [
{
title = service;
url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
homelab.glance.links.mediastack = [{
title = service;
url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; }];
# add to backups
homelab.backups.baks = {
${service} = {paths = [cfg.data_dir];};
${service} = { paths = [ cfg.data_dir ]; };
};
};
}
modules/homelab/mediastack/flaresolverr/default.nix → modules/homelab/arr/flaresolverr/default.nix
+11 -8
View File
@@ -1,13 +1,12 @@
{
pkgs,
config,
lib,
...
}: let
{ pkgs, config, lib, ... }:
let
service = "flaresolverr";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
in
{
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
@@ -44,8 +43,9 @@ in {
};
config = lib.mkIf cfg.enable {
# declare ${service} group
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
# declare ${service} user
users.users.${service} = {
@@ -68,6 +68,9 @@ in {
Group = service;
};
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
extraConfig = ''
modules/homelab/mediastack/prowlarr/default.nix → modules/homelab/arr/prowlarr/default.nix
+19 -21
View File
@@ -1,13 +1,12 @@
{
pkgs,
config,
lib,
...
}: let
{ pkgs, config, lib, ... }:
let
service = "prowlarr";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
in
{
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
@@ -44,8 +43,9 @@ in {
};
config = lib.mkIf cfg.enable {
# declare ${service} group
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
# declare ${service} user
users.users.${service} = {
@@ -55,7 +55,7 @@ in {
home = cfg.data_dir;
createHome = true;
group = service;
extraGroups = ["media"];
extraGroups = [ "media" ];
};
# enable the ${service} service
@@ -74,6 +74,9 @@ in {
Group = service;
};
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
extraConfig = ''
@@ -83,21 +86,16 @@ in {
};
# add to glance
homelab.glance.links.mediastack = [
{
title = service;
url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
homelab.glance.links.mediastack = [{
title = service;
url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; }];
# add to backups
homelab.backups.baks = {
${service} = {
paths = [cfg.data_dir "/var/lib/private"];
};
${service} = { paths = [ cfg.data_dir ]; };
};
};
}
modules/homelab/mediastack/radarr/default.nix → modules/homelab/arr/radarr/default.nix
+21 -22
View File
@@ -1,14 +1,12 @@
{
pkgs,
config,
lib,
...
}: let
{ pkgs, config, lib, ... }:
let
service = "radarr";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
in
{
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
@@ -45,11 +43,12 @@ in {
};
config = lib.mkIf cfg.enable {
# required
environment.systemPackages = with pkgs; [ffmpeg_6-headless];
# declare ${service} group
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
# declare ${service} user
users.users.${service} = {
@@ -59,7 +58,7 @@ in {
home = cfg.data_dir;
createHome = true;
group = service;
extraGroups = ["media"];
extraGroups = [ "media" ];
};
# enable the ${service} service
@@ -77,10 +76,13 @@ in {
# override umask to make permissions work out
systemd.services.${service}.serviceConfig = {
UMask = lib.mkForce "0007";
# User = service;
# Group = service;
# User = service;
# Group = service;
};
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
extraConfig = ''
@@ -90,19 +92,16 @@ in {
};
# add to glance
homelab.glance.links.mediastack = [
{
title = service;
url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
homelab.glance.links.mediastack = [{
title = service;
url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; }];
# add to backups
homelab.backups.baks = {
${service} = {paths = [cfg.data_dir];};
${service} = { paths = [ cfg.data_dir ]; };
};
};
}
modules/homelab/mediastack/sonarr/default.nix → modules/homelab/arr/sonarr/default.nix
+20 -19
View File
@@ -1,13 +1,12 @@
{
pkgs,
config,
lib,
...
}: let
{ pkgs, config, lib, ... }:
let
service = "sonarr";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
in
{
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
@@ -44,11 +43,12 @@ in {
};
config = lib.mkIf cfg.enable {
# required
environment.systemPackages = with pkgs; [ffmpeg_6-headless];
# declare ${service} group
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
# declare ${service} user
users.users.${service} = {
@@ -58,7 +58,7 @@ in {
home = cfg.data_dir;
createHome = true;
group = service;
extraGroups = ["media"];
extraGroups = [ "media" ];
};
# enable the ${service} service
@@ -78,8 +78,12 @@ in {
UMask = lib.mkForce "0007";
};
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
# tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
extraConfig = ''
tls internal
reverse_proxy 127.0.0.1:${toString cfg.port}
@@ -87,19 +91,16 @@ in {
};
# add to glance
homelab.glance.links.mediastack = [
{
title = service;
url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
homelab.glance.links.mediastack = [{
title = service;
url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; }];
# add to backups
homelab.backups.baks = {
${service} = {paths = [cfg.data_dir];};
${service} = { paths = [ cfg.data_dir ]; };
};
};
}
modules/homelab/mediastack/audiobookshelf/default.nix → modules/homelab/audiobookshelf/default.nix
+25 -23
View File
@@ -1,13 +1,12 @@
{
pkgs,
config,
lib,
...
}: let
{ pkgs, config, lib, ... }:
let
service = "audiobookshelf";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
in
{
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
@@ -44,18 +43,19 @@ in {
};
config = lib.mkIf cfg.enable {
# declare ${service} group
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
# declare ${service} user
users.users.${service} = {
description = "${service} server user";
uid = lib.mkForce cfg.ids;
isSystemUser = true;
# home = cfg.data_dir;
# home = cfg.data_dir;
createHome = true;
group = service;
extraGroups = ["media"];
extraGroups = [ "media" ];
};
# enable the ${service} service
@@ -64,7 +64,7 @@ in {
openFirewall = true;
user = service;
group = service;
# dataDir = cfg.data_dir;
# dataDir = cfg.data_dir;
host = "0.0.0.0";
port = cfg.port;
};
@@ -72,32 +72,34 @@ in {
# override umask to make permissions work out
systemd.services.${service}.serviceConfig = {
UMask = lib.mkForce "0007";
# User = service;
# Group = service;
};
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
#serverAliases = ["abs.${homelab.public_domain}"];
serverAliases = [ "abs.${homelab.public_domain}" ];
extraConfig = ''
tls internal
tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
reverse_proxy 127.0.0.1:${toString cfg.port} {
}
'';
};
# add to glance public service
homelab.glance.links.mediastack = [
{
title = service;
url = "https://abs.${homelab.base_domain}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
homelab.glance.links.mediastack = [{
title = service;
url = "https://abs.${homelab.public_domain}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; }];
# add to backups
homelab.backups.baks = {
${service} = {paths = [cfg.data_dir];};
${service} = { paths = [ cfg.data_dir ]; };
};
};
}
modules/homelab/backups/default.nix
+89
View File
@@ -0,0 +1,89 @@
{
config,
lib,
pkgs,
...
}:
/*
to restore mysql/marinadb database:
mysql -u root -p -e "DROP DATABASE IF EXISTS <database_name>;" # delete old db if still lingering
mysql -u root -p -e "CREATE DATABASE IF NOT EXISTS <database_name>;" # create empty db w/ correct name
zstd -dc <path_to_backup> | mysql -u root -p <database_name>
to restore a postgres database:
sudo -u postgres psql -c "DROP DATABASE IF EXISTS <database_name>;" # delete old db if lingering (prolly wont work)
sudo -u postgres psql -c "CREATE DATABASE <database_name>;" # create empty db w/ correct name
zstd -dc <path_to_backup> | sudo -u postgres psql -d immich # restore from the dump
*/
let
cfg = config.homelab.backups;
sec = config.sops.secrets;
in {
options.homelab.backups = {
enable = lib.mkEnableOption "enables borg backups for state files and db backup services";
baks = lib.mkOption {
type = lib.types.attrsOf (lib.types.attrsOf (lib.types.listOf lib.types.path));
default = {};
description = "backup jobs, nested attribute sets should be <bak_name> = paths [<list_of_paths>]";
};
backup_repo = lib.mkOption {
type = lib.types.path;
default = "/holocron/archives/homelab";
description = "path to take daily backups to with borg!";
};
};
config = lib.mkIf cfg.enable {
# backups homelab with borg
services.borgbackup.jobs.homelab = lib.mkIf (cfg.baks != {}) {
archiveBaseName = "homelab";
repo = cfg.backup_repo;
paths = lib.flatten (lib.attrsets.mapAttrsToList (_: arg: arg.paths) cfg.baks);
compression = "auto,zstd";
startAt = "03:30";
group = "archives";
encryption.mode = "repokey-blake2";
encryption.passCommand = "cat ${sec."borg_passwd".path}";
preHook = ''
systemctl start mysql-backup.service
systemctl start $(systemctl list-unit-files 'postgresqlBackup-*.service' --no-legend --no-pager | cut -d' ' -f1)
'';
extraArgs = ["--verbose" "--show-rc" "--umask" "0007"];
extraCreateArgs = ["--list" "--stats" "--filter" "AME"];
prune.keep = {
within = "1d"; # Keep all archives from the last day
daily = 7;
weekly = 12;
monthly = -1; # Keep at least one archive for each month
};
};
# mysql backups currently minecraft_recpro is the only thing using this
services.mysqlBackup = lib.mkIf (config.services.mysql.ensureDatabases != []) {
enable = true;
location = "/var/backup/mysql";
user = "root";
calendar = "daily"; # goes fast, included in back up with server dirs at **:00
compressionAlg = "zstd";
databases = config.services.mysql.ensureDatabases; # set to all databases defined in esure databases
};
# postgresql backups currently immich is the only user
services.postgresqlBackup = lib.mkIf (config.services.postgresql.ensureDatabases != []) {
enable = true;
location = "/var/backup/postgresql";
compression = "zstd"; # optional: "xz", "zstd", "none"
startAt = "daily"; # the dump is included in a backup taken at 4:00
databases = config.services.postgresql.ensureDatabases; # set to all databases defined in esure databases
};
# helpful and for scripts
environment.systemPackages = with pkgs; [borgbackup tree];
sops.secrets = {
"borg_passwd" = {
owner = "root";
group = "root";
};
};
};
}
modules/homelab/network/caddy/default.nix → modules/homelab/caddy/default.nix
+16 -63
View File
@@ -1,14 +1,12 @@
{
pkgs,
config,
lib,
...
}: let
{ pkgs, config, lib, ... }:
let
service = "caddy";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
in
{
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
@@ -18,11 +16,6 @@ in {
default = "/var/lib/${service}";
description = "set data directory for ${service}";
};
keys = lib.mkOption {
type = lib.types.bool;
default = false;
description = "host keys directory";
};
backup = lib.mkOption {
type = lib.types.bool;
default = true;
@@ -35,6 +28,7 @@ in {
};
config = lib.mkIf cfg.enable {
# declare ${service} group
users.groups.${service} = {};
@@ -54,30 +48,16 @@ in {
user = service;
group = service;
dataDir = cfg.data_dir;
package = pkgs.caddy.withPlugins {
plugins = [
"github.com/caddy-dns/cloudflare@v0.2.4"
];
hash = "sha256-dQvk6ezY6TQ1J7PjhCXnThF/SqVgPwBO8/RXzHCY+js=";
# Replace with the hash from the build error the first time you build.
};
email = "me@blakedheld.xyz";
globalConfig = ''
auto_https ignore_loaded_certs
acme_dns cloudflare {env.CLOUDFLARE_API_TOKEN}
'';
# static page for hosting key files
virtualHosts = {
"keys.${homelab.base_domain}" = lib.mkIf cfg.keys {
serverAliases = ["keys.${homelab.public_domain}"];
extraConfig = ''
tls internal
root /var/www/keys
file_server browse
'';
};
virtualHosts."key.${homelab.public_domain}" = {
extraConfig = ''
root * /var/www/keys
file_server
'';
};
};
@@ -90,13 +70,10 @@ in {
# override umask to make permissions work out
systemd.services.${service}.serviceConfig = {
UMask = lib.mkForce "0007";
# make cloudflare token readable
EnvironmentFile = sec."cloudflare/api_token_caddy".path;
#LoadCredential = "CLOUDFLARE_API_TOKEN:${sec."cloudflare/api_token_caddy".path}";
};
# open firewall
networking.firewall.allowedTCPPorts = [80 443];
networking.firewall.allowedTCPPorts = [ 80 443 ];
sops.secrets = {
"ssl_blakedheld_crt" = {
@@ -109,41 +86,17 @@ in {
group = "caddy";
path = "/etc/ssl/blakedheld.xyz.key";
};
"cloudflare/api_token_caddy" = {
owner = "caddy";
group = "caddy";
};
"klefki_pub.asc" = {
owner = "caddy";
group = "caddy";
path = "/var/www/keys/klefki_pub.asc";
};
"caddy_root.crt" = {
owner = "caddy";
group = "caddy";
path = "/var/www/keys/caddy_root.crt";
};
};
environment.etc."caddy/browse.html".text = ''
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>keyring</title>
<style>
footer { display: none !important; }
</style>
</head>
<body>
{{template "listing" .}}
</body>
</html>
'';
# add to backups
homelab.backups.baks = {
${service} = {paths = [cfg.data_dir];};
homelab.backups.baks = {
${service} = { paths = [ cfg.data_dir ]; };
};
};
}
modules/homelab/default.nix
+53 -24
View File
@@ -1,53 +1,82 @@
{
pkgs,
config,
lib,
inputs,
...
}: let
{ pkgs, config, lib, ... }:
let
cfg = config.homelab;
in {
in
{
options.homelab = {
enable = lib.mkEnableOption "enable homelab services and configuration";
media_user = lib.mkOption {
default = "media";
type = lib.types.str;
description = "user for media file permissions";
};
media_group = lib.mkOption {
default = "media";
type = lib.types.str;
description = "group for media file permissions";
};
tz = lib.mkOption {
default = "America/Chicago";
type = lib.types.str;
description = "set timezone";
};
base_domain = lib.mkOption {
default = "lumiose.holocron.blue";
default = "snowbelle.lan";
type = lib.types.str;
description = "base domain used for reverse proxy";
};
public_domain = lib.mkOption {
default = "holocron.blue";
default = "blakedheld.xyz";
type = lib.types.str;
description = "public domain used for reverse proxy";
description = "base domain used for reverse proxy";
};
host_ip = lib.mkOption {
default = "10.10.0.11";
default = "10.10.0.10";
type = lib.types.str;
description = "base ip used for reverse proxy";
description = "base domain used for reverse proxy";
};
};
# the order determines the order in glance :3
imports = [
#./ai
./mediastack
./services
./system
#./nomad
./network
./motd
./dnsmasq
./backups
./glance
./postfix
./caddy
./home/zigbee2mqtt
./vaultwarden
./gitea
./home/homeassistant
./immich
./arr/bazarr
./arr/prowlarr
./arr/radarr
./qbittorrent
./arr/sonarr
./yacreader
./audiobookshelf
./jellyfin
./arr/flaresolverr
./home/mosquitto
./uptime-kuma
./tailscale
];
config = lib.mkIf cfg.enable {
# define the groups used for backups and archives
users.users.archives = {
isSystemUser = true;
group = "archives";
users = {
groups.${cfg.media_group} = {
gid = 700;
};
users.${cfg.media_user} = {
uid = 700;
isSystemUser = true;
group = cfg.media_group;
};
};
users.groups.archives = {gid = 727;};
};
}
modules/homelab/dnsmasq/default.nix
+42
View File
@@ -0,0 +1,42 @@
{
pkgs,
config,
lib,
...
}: let
service = "dnsmasq";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
port = lib.mkOption {
type = lib.types.int;
default = 53;
description = "set port for ${service} (default: ${toString cfg.port}";
};
};
config = lib.mkIf cfg.enable {
# enable the ${service} service
services.${service} = {
enable = true;
settings = {
listen-address = "10.10.0.10"; # your LAN IP
#interface = "enp89s0";
bind-interfaces = true;
address = "/snowbelle.lan/10.10.0.10";
server = [ # upstream dns
"9.9.9.9"
"1.1.1.1"
];
};
};
# open firewall
networking.firewall.allowedTCPPorts = [ cfg.port ];
networking.firewall.allowedUDPPorts = [ cfg.port ];
};
}
modules/homelab/services/gitea/default.nix → modules/homelab/gitea/default.nix
+23 -26
View File
@@ -1,14 +1,12 @@
{
pkgs,
config,
lib,
...
}: let
{ pkgs, nixpkgs-unstable, config, lib, ... }:
let
service = "gitea";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
in
{
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
@@ -50,15 +48,16 @@ in {
};
config = lib.mkIf cfg.enable {
# declare ${service} group
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
# declare ${service} user
users.users.${service} = {
description = lib.mkForce "${service} server user";
uid = lib.mkForce cfg.ids;
isSystemUser = true;
shell = pkgs.bash;
shell = pkgs.bash;
home = cfg.data_dir;
createHome = true;
group = service;
@@ -75,17 +74,17 @@ in {
user = "gitea";
group = "gitea";
stateDir = cfg.data_dir;
appName = "gitea";
appName = "gitea";
settings = {
server = {
# http config
ROOT_URL = "https://git.${homelab.public_domain}";
DOMAIN = "git.${homelab.public_domain}";
ROOT_URL = "https://git.blakedheld.xyz";
DOMAIN = "git.blakedheld.xyz";
HTTP_PORT = cfg.port;
# local network config
#LOCAL_ROOT_URL = "https://git.snowbelle.lan";
ALLOW_LOCALNETWORKS = true;
ALLOWED_DOMAINS = homelab.host_ip;
ALLOWED_DOMAINS = "10.10.0.10";
SKIP_TLS_VERIFY = true;
# configure for system ssh (trying to use the systms on nix sucks)
SSH_PORT = cfg.ssh_port;
@@ -101,7 +100,7 @@ in {
};
};
database = {
passwordFile = "${toString sec."gitea_database_password".path}";
passwordFile = "${toString config.sops.secrets."gitea_database_password".path}";
};
};
@@ -111,7 +110,7 @@ in {
};
# open firewall
networking.firewall.allowedTCPPorts = [cfg.port cfg.ssh_port];
networking.firewall.allowedTCPPorts = [ cfg.port cfg.ssh_port ];
# add to caddy for reverse proxy
services.caddy.virtualHosts."git.${homelab.public_domain}" = {
@@ -122,22 +121,20 @@ in {
};
services.caddy.virtualHosts."${cfg.url}" = {
extraConfig = ''
tls internal
tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
reverse_proxy localhost:${toString cfg.port} {
}
'';
};
# add to glance
homelab.glance.links.services = [
{
title = service;
url = "https://git.${homelab.public_domain}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
homelab.glance.links.services = [{
title = service;
url = "https://git.${homelab.public_domain}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; }];
# manage secrets with sops
sops.secrets = {
@@ -149,7 +146,7 @@ in {
# add to backups
homelab.backups.baks = {
${service} = {paths = [cfg.data_dir];};
${service} = { paths = [ cfg.data_dir ]; };
};
};
}
modules/homelab/services/glance/default.nix → modules/homelab/glance/default.nix
+47 -138
View File
@@ -4,21 +4,23 @@
lib,
...
}:
/*
this is a wrapper module for glance that allows you to
to pass monitor entries in with nix, all declaratively!
| <8yy> |
V V
# add to glance
homelab.glance.links.mediastack = [{
title = service;
url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
allow-insecure = true; }];
/*
this is a wrapper module for glance that allows you to
to pass monitor entries in with nix, all declaratively!
| <8yy> |
V V
# add to glance
homelab.glance.links.mediastack = [{
title = service;
url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
allow-insecure = true; }];
*/
let
service = "glance";
cfg = config.homelab.${service};
@@ -27,7 +29,8 @@ let
uptimekuma_url = "localhost:7901";
uptimekuma_page = "glance";
in {
in
{
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
@@ -64,28 +67,24 @@ in {
links = {
services = lib.mkOption {
type = lib.types.listOf lib.types.attrs;
default = [];
default = [ ];
description = "list of links for ${service}";
};
mediastack = lib.mkOption {
type = lib.types.listOf lib.types.attrs;
default = [];
default = [ ];
description = "list of links for ${service}";
};
system = lib.mkOption {
type = lib.types.listOf lib.types.attrs;
default = [];
description = "list of links for ${service}";
};
network = lib.mkOption {
type = lib.types.listOf lib.types.attrs;
default = [];
default = [ ];
description = "list of links for ${service}";
};
};
};
config = lib.mkIf cfg.enable {
# declare ${service} group
users.groups.${service} = {
gid = lib.mkForce cfg.ids;
@@ -99,7 +98,7 @@ in {
home = cfg.data_dir;
createHome = true;
group = service;
extraGroups = [];
extraGroups = [ ];
};
services.${service} = {
@@ -121,13 +120,12 @@ in {
};
};
branding = {
#logo-url = "/assets/icons/${config.networking.hostName}.png";
logo-url = "/assets/icons/snowbelle.png";
favicon-url = "/assets/icons/favicon.ico";
};
pages = [
{
name = config.networking.hostName;
name = "snowbelle";
hide-desktop-navigation = true;
columns = [
{
@@ -142,25 +140,13 @@ in {
servers = [
{
type = "local";
name = config.networking.hostName;
name = "snowbelle";
hide-mountpoints-by-default = true;
mountpoints = {
"/" = {
name = "root";
hide = false;
};
"/holocron" = {
name = "holocron";
hide = false;
};
"/holocron/media" = {
name = "media";
hide = false;
};
"/holocron/vault" = {
name = "vault";
hide = false;
};
"/" = {name = "root"; hide = false;};
"/holocron" = {name = "holocron"; hide = false;};
"/holocron/media" = {name = "media"; hide = false;};
"/holocron/vault" = {name = "vault"; hide = false;};
};
}
];
@@ -217,17 +203,17 @@ in {
{
title = "nixos options";
shortcut = "!no";
url = "https://search.nixos.org/options?channel=26.05&query={QUERY}";
url = "https://search.nixos.org/options?channel=25.05&query={QUERY}";
}
{
title = "nixos packages";
shortcut = "!np";
url = "https://search.nixos.org/packages?channel=26.05&query={QUERY}";
url = "https://search.nixos.org/packages?channel=25.05&query={QUERY}";
}
{
title = "home-manager options";
shortcut = "!hm";
url = "https://home-manager-options.extranix.com/?query={QUERY}&release=release-26.05";
url = "https://home-manager-options.extranix.com/?query={QUERY}&release=release-25.05";
}
];
}
@@ -249,12 +235,6 @@ in {
title = "system";
sites = cfg.links.system;
}
{
type = "monitor";
cache = "1m";
title = "network";
sites = cfg.links.network;
}
{
type = "custom-api";
title = "recpro";
@@ -262,13 +242,13 @@ in {
cache = "5s";
template = "<div style=\"display:flex; align-items:center; gap:12px;\">\n <div style=\"width:40px; height:40px; flex-shrink:0; border-radius:4px; display:flex; justify-content:center; align-items:center; overflow:hidden;\">\n {{ if .JSON.Bool \"online\" }}\n <img src=\"{{ .JSON.String \"icon\" | safeURL }}\" width=\"64\" height=\"64\" style=\"object-fit:contain;\">\n {{ else }}\n <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 20 20\" fill=\"currentColor\" style=\"width:32px; height:32px; opacity:0.5;\">\n <path fill-rule=\"evenodd\" d=\"M1 5.25A2.25 2.25 0 0 1 3.25 3h13.5A2.25 2.25 0 0 1 19 5.25v9.5A2.25 2.25 0 0 1 16.75 17H3.25A2.25 2.25 0 0 1 1 14.75v-9.5Zm1.5 5.81v3.69c0 .414.336.75.75.75h13.5a.75.75 0 0 0 .75-.75v-2.69l-2.22-2.219a.75.75 0 0 0-1.06 0l-1.91 1.909.47.47a.75.75 0 1 1-1.06 1.06L6.53 8.091a.75.75 0 0 0-1.06 0l-2.97 2.97ZM12 7a1 1 0 1 1-2 0 1 1 0 0 1 2 0Z\" clip-rule=\"evenodd\" />\n </svg>\n {{ end }}\n </div>\n\n <div style=\"flex-grow:1; min-width:0;\">\n <a class=\"size-h4 block text-truncate color-highlight\">\n {{ .JSON.String \"host\" }}\n {{ if .JSON.Bool \"online\" }}\n <span\n style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-positive); display: inline-block; vertical-align: middle;\"\n data-popover-type=\"text\"\n data-popover-text=\"Online\"\n ></span>\n {{ else }}\n <span\n style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-negative); display: inline-block; vertical-align: middle;\"\n data-popover-type=\"text\"\n data-popover-text=\"Offline\"\n ></span>\n {{ end }}\n </a>\n\n <ul class=\"list-horizontal-text\">\n <li>\n {{ if .JSON.Bool \"online\" }}\n <span>{{ .JSON.String \"version.name_clean\" }}</span>\n {{ else }}\n <span>Offline</span>\n {{ end }}\n </li>\n {{ if .JSON.Bool \"online\" }}\n <li data-popover-type=\"html\">\n <div data-popover-html>\n {{ range .JSON.Array \"players.list\" }}{{ .String \"name_clean\" }}<br>{{ end }}\n </div>\n <p style=\"display:inline-flex;align-items:center;\">\n <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;\">\n <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n </svg>\n {{ .JSON.Int \"players.online\" | formatNumber }}/{{ .JSON.Int \"players.max\" | formatNumber }} players\n </p>\n </li>\n {{ else }}\n <li>\n <p style=\"display:inline-flex;align-items:center;\">\n <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;opacity:0.5;\">\n <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n </svg>\n 0 players\n </p>\n </li>\n {{ end }}\n </ul>\n </div>\n</div>";
}
# {
# type = "custom-api";
# title = "linggango";
# url = "https://api.mcstatus.io/v2/status/java/raceraskedforthisenjoyyall.recoil.pro";
# cache = "5s";
# template = "<div style=\"display:flex; align-items:center; gap:12px;\">\n <div style=\"width:40px; height:40px; flex-shrink:0; border-radius:4px; display:flex; justify-content:center; align-items:center; overflow:hidden;\">\n {{ if .JSON.Bool \"online\" }}\n <img src=\"{{ .JSON.String \"icon\" | safeURL }}\" width=\"64\" height=\"64\" style=\"object-fit:contain;\">\n {{ else }}\n <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 20 20\" fill=\"currentColor\" style=\"width:32px; height:32px; opacity:0.5;\">\n <path fill-rule=\"evenodd\" d=\"M1 5.25A2.25 2.25 0 0 1 3.25 3h13.5A2.25 2.25 0 0 1 19 5.25v9.5A2.25 2.25 0 0 1 16.75 17H3.25A2.25 2.25 0 0 1 1 14.75v-9.5Zm1.5 5.81v3.69c0 .414.336.75.75.75h13.5a.75.75 0 0 0 .75-.75v-2.69l-2.22-2.219a.75.75 0 0 0-1.06 0l-1.91 1.909.47.47a.75.75 0 1 1-1.06 1.06L6.53 8.091a.75.75 0 0 0-1.06 0l-2.97 2.97ZM12 7a1 1 0 1 1-2 0 1 1 0 0 1 2 0Z\" clip-rule=\"evenodd\" />\n </svg>\n {{ end }}\n </div>\n\n <div style=\"flex-grow:1; min-width:0;\">\n <a class=\"size-h4 block text-truncate color-highlight\">\n {{ .JSON.String \"host\" }}\n {{ if .JSON.Bool \"online\" }}\n <span\n style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-positive); display: inline-block; vertical-align: middle;\"\n data-popover-type=\"text\"\n data-popover-text=\"Online\"\n ></span>\n {{ else }}\n <span\n style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-negative); display: inline-block; vertical-align: middle;\"\n data-popover-type=\"text\"\n data-popover-text=\"Offline\"\n ></span>\n {{ end }}\n </a>\n\n <ul class=\"list-horizontal-text\">\n <li>\n {{ if .JSON.Bool \"online\" }}\n <span>{{ .JSON.String \"version.name_clean\" }}</span>\n {{ else }}\n <span>Offline</span>\n {{ end }}\n </li>\n {{ if .JSON.Bool \"online\" }}\n <li data-popover-type=\"html\">\n <div data-popover-html>\n {{ range .JSON.Array \"players.list\" }}{{ .String \"name_clean\" }}<br>{{ end }}\n </div>\n <p style=\"display:inline-flex;align-items:center;\">\n <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;\">\n <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n </svg>\n {{ .JSON.Int \"players.online\" | formatNumber }}/{{ .JSON.Int \"players.max\" | formatNumber }} players\n </p>\n </li>\n {{ else }}\n <li>\n <p style=\"display:inline-flex;align-items:center;\">\n <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;opacity:0.5;\">\n <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n </svg>\n 0 players\n </p>\n </li>\n {{ end }}\n </ul>\n </div>\n</div>";
# }
{
type = "custom-api";
title = "cobblemon";
url = "https://api.mcstatus.io/v2/status/java/cobblemon.recoil.pro";
cache = "5s";
template = "<div style=\"display:flex; align-items:center; gap:12px;\">\n <div style=\"width:40px; height:40px; flex-shrink:0; border-radius:4px; display:flex; justify-content:center; align-items:center; overflow:hidden;\">\n {{ if .JSON.Bool \"online\" }}\n <img src=\"{{ .JSON.String \"icon\" | safeURL }}\" width=\"64\" height=\"64\" style=\"object-fit:contain;\">\n {{ else }}\n <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 20 20\" fill=\"currentColor\" style=\"width:32px; height:32px; opacity:0.5;\">\n <path fill-rule=\"evenodd\" d=\"M1 5.25A2.25 2.25 0 0 1 3.25 3h13.5A2.25 2.25 0 0 1 19 5.25v9.5A2.25 2.25 0 0 1 16.75 17H3.25A2.25 2.25 0 0 1 1 14.75v-9.5Zm1.5 5.81v3.69c0 .414.336.75.75.75h13.5a.75.75 0 0 0 .75-.75v-2.69l-2.22-2.219a.75.75 0 0 0-1.06 0l-1.91 1.909.47.47a.75.75 0 1 1-1.06 1.06L6.53 8.091a.75.75 0 0 0-1.06 0l-2.97 2.97ZM12 7a1 1 0 1 1-2 0 1 1 0 0 1 2 0Z\" clip-rule=\"evenodd\" />\n </svg>\n {{ end }}\n </div>\n\n <div style=\"flex-grow:1; min-width:0;\">\n <a class=\"size-h4 block text-truncate color-highlight\">\n {{ .JSON.String \"host\" }}\n {{ if .JSON.Bool \"online\" }}\n <span\n style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-positive); display: inline-block; vertical-align: middle;\"\n data-popover-type=\"text\"\n data-popover-text=\"Online\"\n ></span>\n {{ else }}\n <span\n style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-negative); display: inline-block; vertical-align: middle;\"\n data-popover-type=\"text\"\n data-popover-text=\"Offline\"\n ></span>\n {{ end }}\n </a>\n\n <ul class=\"list-horizontal-text\">\n <li>\n {{ if .JSON.Bool \"online\" }}\n <span>{{ .JSON.String \"version.name_clean\" }}</span>\n {{ else }}\n <span>Offline</span>\n {{ end }}\n </li>\n {{ if .JSON.Bool \"online\" }}\n <li data-popover-type=\"html\">\n <div data-popover-html>\n {{ range .JSON.Array \"players.list\" }}{{ .String \"name_clean\" }}<br>{{ end }}\n </div>\n <p style=\"display:inline-flex;align-items:center;\">\n <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;\">\n <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n </svg>\n {{ .JSON.Int \"players.online\" | formatNumber }}/{{ .JSON.Int \"players.max\" | formatNumber }} players\n </p>\n </li>\n {{ else }}\n <li>\n <p style=\"display:inline-flex;align-items:center;\">\n <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;opacity:0.5;\">\n <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n </svg>\n 0 players\n </p>\n </li>\n {{ end }}\n </ul>\n </div>\n</div>";
}
];
}
{
@@ -334,7 +314,7 @@ in {
services.caddy.virtualHosts."${cfg.url}" = {
# serverAliases = [ "${homelab.public_domain}" ];
extraConfig = ''
tls internal
tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
reverse_proxy 127.0.0.1:${toString cfg.port}
'';
};
@@ -342,88 +322,17 @@ in {
# add to backups
homelab.backups.baks = {
${service} = {
paths = [cfg.data_dir "/var/lib/private"];
paths = [ cfg.data_dir ];
};
};
# add to vaniville services to glance
homelab.glance.links.services = [
{
title = "vaultwarden";
url = "https://pass.${homelab.public_domain}";
error-url = "https://pass.vaniville.${homelab.public_domain}";
check-url = "https://pass.${homelab.public_domain}";
icon = "di:vaultwarden";
}
{
title = "gitea";
url = "https://git.${homelab.public_domain}";
error-url = "https://git.vaniville.${homelab.public_domain}";
check-url = "https://git.${homelab.public_domain}";
icon = "di:gitea";
}
];
homelab.glance.links.system = [
{
title = "vaniville uptime";
url = "https://up.${homelab.public_domain}";
error-url = "https://up.vaniville.${homelab.public_domain}";
check-url = "https://up.${homelab.public_domain}";
icon = "di:uptime-kuma";
}
];
# add to udr to glance
homelab.glance.links.network = [
{
title = "shauna";
url = "https://shauna.holocron.blue";
error-url = "https://10.0.0.1";
check-url = "https://10.0.0.1";
icon = "di:unifi";
allow-insecure = true;
}
{
title = "lifeboat";
url = "https://lifeboat.holocron.blue";
error-url = "https://100.101.11.5";
check-url = "https://100.101.11.5";
icon = "di:unifi";
allow-insecure = true;
}
{
title = "korrina";
url = "https://korrina.holocron.blue";
error-url = "https://100.101.11.1";
check-url = "https://100.101.11.1";
icon = "di:unifi";
allow-insecure = true;
}
{
title = "linode";
url = "https://cloud.linode.com/linodes";
error-url = "https://status.linode.com";
check-url = "https://cloud.linode.com/linodes";
icon = "di:linode";
allow-insecure = true;
}
{
title = "tailscale";
url = "https://console.tailscale.com/admin/machines";
error-url = "https://status.tailscale.com/";
check-url = "https://console.tailscale.com/admin/machines";
icon = "di:tailscale";
allow-insecure = true;
}
{
title = "nextdns";
url = "https://my.nextdns.io";
error-url = "https://test.nextdns.io";
check-url = "https://my.nextdns.io/527db2/setup";
icon = "di:nextdns";
allow-insecure = true;
}
];
homelab.glance.links.system = [{
title = "bebe";
url = "https://bebe.lan";
error-url = "https://10.10.0.1";
check-url = "https://10.10.0.1";
icon = "di:unifi";
allow-insecure = true; }];
};
}
modules/homelab/services/home/homeassistant/default.nix → modules/homelab/home/homeassistant/default.nix
+26 -31
View File
@@ -1,16 +1,13 @@
{
pkgs,
config,
lib,
inputs,
...
}: let
{ pkgs, config, lib, inputs, ... }:
let
nixservice = "home-assistant";
service = "hass";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
in
{
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
@@ -47,8 +44,9 @@ in {
};
config = lib.mkIf cfg.enable {
# declare ${service} group
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
# declare ${service} user
users.users.${service} = {
@@ -73,6 +71,10 @@ in {
volumes = [
"${cfg.data_dir}:/config"
];
# ports = [
# "0.0.0.0:7704:8123"
# "0.0.0.0:4141:4141"
# ];
environment = {
TZ = homelab.tz;
PUID = toString config.users.users.${service}.uid;
@@ -87,42 +89,34 @@ in {
};
# open firewall
networking.firewall.allowedTCPPorts = [cfg.port 8123 21063 21064];
networking.firewall.allowedUDPPorts = [5353];
networking.firewall.allowedTCPPorts = [ cfg.port 8123 ];
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
serverAliases = ["${service}.${homelab.public_domain}"];
serverAliases = [ "${service}.${homelab.public_domain}" ];
extraConfig = ''
tls internal
reverse_proxy 127.0.0.1:${toString cfg.port} {
header_up Host {host}
header_up X-Real-IP {remote_host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto https
}
tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
reverse_proxy 127.0.0.1:${toString cfg.port}
'';
};
# add to glance
homelab.glance.links.services = [
{
title = "home assistant";
url = "https://hass.${homelab.public_domain}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${nixservice}";
}
];
homelab.glance.links.services = [{
title = "home assistant";
url = "https://hass.${homelab.public_domain}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${nixservice}"; }];
# add to backups
homelab.backups.baks = {
${service} = {paths = [cfg.data_dir];};
${service} = { paths = [ cfg.data_dir ]; };
};
};
}
# here lies my tough, and I mean fucking tough, swing at
# getting this to work bare metal, ggs ill see you again
# - didnt take long
@@ -164,3 +158,4 @@ in {
## };
# };
modules/homelab/services/home/mosquitto/default.nix → modules/homelab/home/mosquitto/default.nix
+13 -15
View File
@@ -1,14 +1,12 @@
{
pkgs,
config,
lib,
...
}: let
{ pkgs, config, lib, ... }:
let
service = "mosquitto";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
in
{
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
@@ -45,8 +43,9 @@ in {
};
config = lib.mkIf cfg.enable {
# declare ${service} group
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
# declare ${service} user
users.users.${service} = {
@@ -66,16 +65,15 @@ in {
port = 1883;
address = "0.0.0.0";
users.zigbee = {
acl = ["readwrite #"];
acl = [ "readwrite #" ];
hashedPassword = "$7$101$140powz2MtsRawFT$ydndjal9wCAywIWtUEAh/IusdfDFvnHMupTFjdS7Ad/EjsEIbJgHrLY9waCe4Z3142XieuxMrXUDjMTp2qwyiw==";
};
# use with no auth
# settings.allow_anonymous = true;
# acl = [ "pattern readwrite #" ];
# omitPasswordAuth = true;
# settings.allow_anonymous = true;
# acl = [ "pattern readwrite #" ];
# omitPasswordAuth = true;
}
];
# override umask to make permissions work out
systemd.services.${service}.serviceConfig = {
UMask = lib.mkForce "0007";
@@ -84,7 +82,7 @@ in {
};
# open firewall
networking.firewall.allowedTCPPorts = [cfg.port];
networking.firewall.allowedTCPPorts = [ cfg.port ];
sops.secrets = {
"${service}_hashed_passwd" = {
@@ -95,7 +93,7 @@ in {
# add to backups
homelab.backups.baks = {
${service} = {paths = [cfg.data_dir];};
${service} = { paths = [ cfg.data_dir ]; };
};
};
}
modules/homelab/services/home/zigbee2mqtt/default.nix → modules/homelab/home/zigbee2mqtt/default.nix
+40 -45
View File
@@ -1,14 +1,12 @@
{
pkgs,
config,
lib,
...
}: let
{ pkgs, config, lib, ... }:
let
service = "zigbee2mqtt";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
in
{
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
@@ -45,8 +43,9 @@ in {
};
config = lib.mkIf cfg.enable {
# declare ${service} group
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
# declare ${service} user
users.users.${service} = {
@@ -64,29 +63,28 @@ in {
enable = true;
dataDir = cfg.data_dir;
settings = {
mqtt = {
base_topic = "zigbee2mqtt";
client_id = "zigbee2mqtt";
server = "mqtt://localhost:1883";
user = "!/run/secrets/mosquitto_passwd.yaml user";
password = "!/run/secrets/mosquitto_passwd.yaml password";
keepalive = 20;
};
serial = {
port = "/dev/serial/by-id/usb-Itead_Sonoff_Zigbee_3.0_USB_Dongle_Plus_V2_4a4e75d63653ef1198d728e0174bec31-if00-port0";
adapter = "ember";
};
advanced = {
channel = 11;
};
frontend = {
enabled = true;
port = cfg.port;
};
homeassistant = {
enabled = true;
experimental_event_entities = true;
};
mqtt = {
base_topic = "zigbee2mqtt";
client_id = "zigbee2mqtt";
server = "mqtt://localhost:1883";
user = "!/run/secrets/mosquitto_passwd.yaml user";
password = "!/run/secrets/mosquitto_passwd.yaml password";
keepalive = 20;
};
serial = {
port = "/dev/serial/by-id/usb-Itead_Sonoff_Zigbee_3.0_USB_Dongle_Plus_V2_4a4e75d63653ef1198d728e0174bec31-if00-port0";
adapter = "ember";
};
advanced = {
channel = 11;
};
frontend = {
enabled = true;
port = cfg.port;
};
homeassistant = {
enabled = true;
};
};
};
@@ -97,28 +95,25 @@ in {
Group = service;
};
# # open firewall
networking.firewall.allowedTCPPorts = [cfg.port];
# # open firewall
networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
serverAliases = ["z2m.${homelab.public_domain}"];
serverAliases = [ "z2m.${homelab.public_domain}" ];
extraConfig = ''
tls internal
tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
reverse_proxy 127.0.0.1:${toString cfg.port}
'';
};
# add to glance
homelab.glance.links.services = [
{
title = service;
url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
homelab.glance.links.services = [{
title = service;
url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; }];
sops.secrets = {
"mosquitto_passwd.yaml" = {
@@ -129,7 +124,7 @@ in {
# add to backups
homelab.backups.baks = {
${service} = {paths = [cfg.data_dir];};
${service} = { paths = [ cfg.data_dir ]; };
};
};
}
modules/homelab/services/immich/default.nix → modules/homelab/immich/default.nix
+6 -34
View File
@@ -44,11 +44,6 @@ in {
type = lib.types.nullOr lib.types.str;
default = "immich-server";
};
library_sync_dir = lib.mkOption {
type = lib.types.str;
default = "/holocron/users/blake/pictures/library";
description = "set directory to automatically rsync library to storage pool";
};
};
config = lib.mkIf cfg.enable {
@@ -70,7 +65,7 @@ in {
services.${service} = {
enable = true;
#package = inputs.nixpkgs-unstable.legacyPackages.${pkgs.system}.immich;
package = pkgs.unstable.immich;
package = unstable_pkgs.x86_64.immich;
openFirewall = true;
user = service;
group = service;
@@ -78,33 +73,9 @@ in {
host = "0.0.0.0";
port = cfg.port;
settings = null;
#settings.server.externalDomain = "https://photos.blakedheld.xyz";
};
# too lazy to add an option, this is on the storage pool now anyway
# systemd.services.immich_library_sync = {
# description = "twice daily sync immich library to holocron";
# serviceConfig = {
# Type = "oneshot";
# User = "root";
# };
#
# script = ''
# ${pkgs.rsync}/bin/rsync -avh --info=progress2 --delete \
# --chown=blake:blake \
# /var/lib/immich/library/blake/ \
# /holocron/users/blake/pictures/library/
# '';
# };
#
# systemd.timers.immich_library_sync = {
# wantedBy = ["timers.target"];
# timerConfig = {
# OnBootSec = "5m";
# OnUnitActiveSec = "12h";
# Persistent = true;
# };
# };
# override umask to make permissions work out
# systemd.services."${toString service}-server".serviceConfig = {
# UMask = lib.mkForce "0007";
@@ -120,7 +91,7 @@ in {
services.caddy.virtualHosts."${cfg.url}" = {
serverAliases = ["photos.${homelab.public_domain}"];
extraConfig = ''
tls internal
tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
reverse_proxy 127.0.0.1:${toString cfg.port}
'';
};
@@ -137,12 +108,13 @@ in {
];
# add postgresql database that is automatically created to the backup list
#services.postgresqlBackup.databases = ["immich"]; # set to all databases defined in esure databases
services.postgresql.ensureDatabases = [service]; # set to all databases defined in esure databases
# add to backups
homelab.backups.baks = {
${service} = {paths = ["/var/lib/redis-immich" "/var/backup/postgresql/immich.sql.zstd"];};
#${service} = {paths = [cfg.data_dir "/var/lib/redis-immich" "/var/backup/postgresql/immich.sql.zstd"];};
${service} = {paths = [cfg.data_dir "/var/lib/redis-immich" "/var/backup/postgresql/immich.sql.zstd"];};
};
};
}
modules/homelab/mediastack/jellyfin/default.nix → modules/homelab/jellyfin/default.nix
+21 -23
View File
@@ -1,14 +1,12 @@
{
pkgs,
config,
lib,
...
}: let
{ pkgs, config, lib, ... }:
let
service = "jellyfin";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
host = config.networking.hostName;
in {
in
{
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
@@ -45,8 +43,9 @@ in {
};
config = lib.mkIf cfg.enable {
# declare ${service} group
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
# declare ${service} user
users.users.${service} = {
@@ -56,13 +55,12 @@ in {
home = cfg.data_dir;
createHome = true;
group = service;
extraGroups = ["media" "video" "render"];
extraGroups = [ "media" "video" "render" ];
};
# enable the ${service} service
services.${service} = {
enable = true;
package = pkgs.unstable.jellyfin;
openFirewall = true;
user = service;
group = service;
@@ -74,29 +72,29 @@ in {
UMask = lib.mkForce "0007";
};
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
serverAliases = ["media.${homelab.public_domain}"];
serverAliases = [ "media.${homelab.public_domain}" ];
extraConfig = ''
tls internal
tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
reverse_proxy 127.0.0.1:${toString cfg.port}
'';
};
# add to glance
homelab.glance.links.mediastack = [
{
title = service;
url = "https://media.${host}.${homelab.public_domain}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
homelab.glance.links.mediastack = [{
title = service;
url = "https://media.${homelab.public_domain}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; }];
# add to backups
homelab.backups.baks = {
${service} = {paths = [cfg.data_dir];};
${service} = { paths = [ cfg.data_dir ]; };
};
};
}
modules/homelab/mediastack/default.nix
-66
View File
@@ -1,66 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
cfg = config.homelab.mediastack;
in {
options.homelab.mediastack = {
enable = lib.mkEnableOption "enable the mediastack";
media_user = lib.mkOption {
default = "media";
type = lib.types.str;
description = "user for media file permissions";
};
media_group = lib.mkOption {
default = "media";
type = lib.types.str;
description = "group for media file permissions";
};
tz = lib.mkOption {
default = "America/Chicago";
type = lib.types.str;
description = "set timezone";
};
};
# the order determines the order in glance :3
imports = [
./yacreader
./bazarr
./qbittorrent
./prowlarr
./lidarr
./radarr
./sonarr
./audiobookshelf
./navidrome
./jellyfin
./flaresolverr
];
config = lib.mkIf cfg.enable {
users = {
groups.${cfg.media_group} = {
gid = 700;
};
users.${cfg.media_user} = {
uid = 700;
isSystemUser = true;
group = cfg.media_group;
};
};
homelab.jellyfin.enable = lib.mkDefault true;
homelab.yacreader.enable = lib.mkDefault true;
homelab.qbittorrent.enable = lib.mkDefault true;
homelab.bazarr.enable = lib.mkDefault true;
homelab.prowlarr.enable = lib.mkDefault true;
homelab.radarr.enable = lib.mkDefault true;
homelab.sonarr.enable = lib.mkDefault true;
homelab.lidarr.enable = lib.mkDefault true;
homelab.audiobookshelf.enable = lib.mkDefault true;
homelab.navidrome.enable = lib.mkDefault true;
homelab.flaresolverr.enable = lib.mkDefault true;
};
}
modules/homelab/mediastack/lidarr/default.nix
-108
View File
@@ -1,108 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
service = "lidarr";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
# set port options
port = lib.mkOption {
type = lib.types.int;
default = 7109;
description = "set port for ${service} (default: ${toString cfg.port}";
};
url = lib.mkOption {
type = lib.types.str;
default = "${service}.${homelab.base_domain}";
description = "set domain for ${service}";
};
data_dir = lib.mkOption {
type = lib.types.str;
default = "/var/lib/${service}";
description = "set data directory for ${service}";
};
ids = lib.mkOption {
type = lib.types.int;
default = cfg.port;
description = "set uid and pid of ${service} user (matches port by default)";
};
backup = lib.mkOption {
type = lib.types.bool;
default = true;
description = "enable backups for ${service}";
};
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = service;
};
};
config = lib.mkIf cfg.enable {
# required
environment.systemPackages = with pkgs; [ffmpeg_6-headless yt-dlp];
# declare ${service} group
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
# declare ${service} user
users.users.${service} = {
description = "${service} server user";
uid = lib.mkForce cfg.ids;
isSystemUser = true;
home = cfg.data_dir;
createHome = true;
group = service;
extraGroups = ["media"];
};
# enable the ${service} service
services.${service} = {
enable = true;
openFirewall = true;
user = service;
group = service;
dataDir = cfg.data_dir;
settings = {
server.port = cfg.port;
};
};
# override umask to make permissions work out
systemd.services.${service}.serviceConfig = {
UMask = lib.mkForce "0007";
# User = service;
# Group = service;
};
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
extraConfig = ''
tls internal
reverse_proxy 127.0.0.1:${toString cfg.port}
'';
};
# add to glance
homelab.glance.links.mediastack = [
{
title = service;
url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
# add to backups
homelab.backups.baks = {
${service} = {paths = [cfg.data_dir];};
};
};
}
modules/homelab/mediastack/navidrome/default.nix
-115
View File
@@ -1,115 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
service = "navidrome";
cfg = config.homelab.${service};
homelab = config.homelab;
in {
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
# set port options
port = lib.mkOption {
type = lib.types.int;
default = 7108;
description = "set port for ${service} (default: ${toString cfg.port}";
};
url = lib.mkOption {
type = lib.types.str;
default = "music.${homelab.base_domain}";
description = "set domain for ${service}";
};
data_dir = lib.mkOption {
type = lib.types.str;
default = "/var/lib/${service}";
description = "set data directory for ${service}";
};
ids = lib.mkOption {
type = lib.types.int;
default = cfg.port;
description = "set uid and pid of ${service} user (matches port by default)";
};
backup = lib.mkOption {
type = lib.types.bool;
default = true;
description = "enable backups for ${service}";
};
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = service;
};
};
config = lib.mkIf cfg.enable {
# declare ${service} group
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
# declare ${service} user
users.users.${service} = {
description = "${service} server user";
uid = lib.mkForce cfg.ids;
isSystemUser = true;
# home = cfg.data_dir;
createHome = true;
group = service;
extraGroups = ["media"];
};
# enable the ${service} service
services.${service} = {
enable = true;
openFirewall = true;
user = service;
group = service;
# plugins = [
# ];
environmentFile = "${cfg.data_dir}/navidrome.env";
settings = {
Address = "0.0.0.0";
Port = cfg.port;
MusicFolder = "/holocron/media/music";
EnableInsightsCollector = false;
LyricsPriority = "nd-lyrics";
Plugins = {
Enabled = true;
#Folder = lib.mkForce "${cfg.data_dir}/plugins";
};
};
};
# override umask to make permissions work out
systemd.services.${service}.serviceConfig = {
UMask = lib.mkForce "0007";
EnvironmentFile = "${cfg.data_dir}/navidrome.env";
};
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
#serverAliases = ["abs.${homelab.public_domain}"];
extraConfig = ''
tls internal
reverse_proxy 127.0.0.1:${toString cfg.port} {
}
'';
};
# add to glance public service
homelab.glance.links.mediastack = [
{
title = service;
url = "https://music.${homelab.base_domain}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
# add to backups
homelab.backups.baks = {
${service} = {paths = [cfg.data_dir];};
};
};
}
modules/homelab/system/motd/default.nix → modules/homelab/motd/default.nix
+13 -33
View File
@@ -6,29 +6,11 @@
}: let
inherit (lib) mkIf mkOption types filterAttrs mapAttrsToList;
cfg = config.homelab.motd;
homelab = lib.attrByPath ["homelab"] {} config;
gameservers = lib.attrByPath ["gameservers"] {} config;
# collect services to display
motd_list =
mapAttrsToList (_: v: v.motd)
(filterAttrs (
_: v:
(v.enable or false)
&& v ? motd
&& v.motd != null
)
homelab);
motd_gs_list = lib.concatLists (
mapAttrsToList (_: v: v.motd_gs)
(filterAttrs (
_: v:
(v.enable or false)
&& v ? motd_gs
&& v.motd_gs != null
)
gameservers)
);
(filterAttrs (_: v: v ? motd && v.motd != null) config.homelab);
in {
options.homelab.motd = {
enable = mkOption {
@@ -93,20 +75,18 @@ in {
motd_list)}
echo
${lib.optionalString (motd_gs_list != []) ''
# --- gameservers ---
echo -e "''${headings}gameservers:''${reset}"
${lib.concatStringsSep "\n" (map (service: ''
status=$(systemctl is-active ${service} 2>/dev/null)
if [ "$status" = "active" ]; then
printf "%-32s%s\n" " ''${active}[${service}]''${reset}" "running"
else
printf "%-32s%s\n" " ''${active}[${service}]''${reset}" "not running"
fi
'')
motd_gs_list)}
''}
# --- gameservers ---
echo -e "''${headings}gameservers:''${reset}"
for service in velocity smp superflat bento cobblemon; do
status=$(systemctl is-active $service 2>/dev/null)
if [ "$status" = "active" ]; then
printf "%-32s%s\n" " ''${active}[$service]''${reset}" "running"
else
printf "%-32s%s\n" " ''${active}[$service]''${reset}" "not running"
fi
done
echo
'';
environment.etc."motd".mode = "0755";
modules/homelab/network/ddns/default.nix
-64
View File
@@ -1,64 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
service = "cloudflare-ddns";
cfg = config.homelab.ddns;
sec = config.sops.secrets;
in {
options.homelab.ddns = {
enable = lib.mkEnableOption "enables ddns with cloudflare";
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = service;
};
};
config = lib.mkIf cfg.enable {
services.${service} = {
enable = true;
credentialsFile = sec."cloudflare/api_token".path;
domains = [
# recoil.pro
"recoil.pro"
"*.recoil.pro"
"mc.recoil.pro"
"smp.recoil.pro"
"superflat.recoil.pro"
"skyblock.recoil.pro"
"cobblemon.recoil.pro"
"valheim.recoil.pro"
# blakedheld.xyz
#"blakedheld.xyz"
#"*.blakedheld.xyz"
#"git.blakedheld.xyz"
#"up.blakedheld.xyz"
# holocron.blue
#"holocron.blue"
#"*.holocron.blue"
"git.holocron.blue"
"pass.holocron.blue"
"photos.holocron.blue"
"media.holocron.blue"
"up.holocron.blue"
# mc servers
"mine.holocron.blue"
"smp.holocron.blue"
"skyblock.holocron.blue"
"superflat.holocron.blue"
];
};
# declare authkey secrets
sops.secrets = {
"cloudflare/api_token" = {
owner = "cloudflare-ddns";
group = "cloudflare-ddns";
};
};
};
}
modules/homelab/network/default.nix
-11
View File
@@ -1,11 +0,0 @@
{ pkgs, config, lib, ... }:
{
# the order determines the order in glance :3
imports = [
./dnsmasq
./caddy
./tailscale
./ddns
];
}
modules/homelab/network/dnsmasq/default.nix
-59
View File
@@ -1,59 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
service = "dnsmasq";
cfg = config.homelab.${service};
in {
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
port = lib.mkOption {
type = lib.types.int;
default = 53;
description = "set port for ${service} (default: ${toString cfg.port}";
};
upstream = lib.mkOption {
type = lib.types.str;
default = "10.10.0.1";
description = "set upstream dns server for ${service} (default: $cfg.upstream}";
};
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = service;
};
};
config = lib.mkIf cfg.enable {
# enable the ${service} service
services.${service} = {
enable = true;
alwaysKeepRunning = true;
settings = {
no-resolv = true;
listen-address = config.homelab.host_ip; # your LAN IP
#interface = "enp89s0";
bind-interfaces = true;
# address = [
# "/snowbelle.blakedheld.xyz/10.10.0.10"
# "/lumiose.blakedheld.xyz/10.10.0.10"
# "/bebe.blakedheld.xyz/10.10.0.1"
# ];
server = [
# upstream dns
cfg.upstream
];
};
};
systemd.services.dnsmasq.serviceConfig = {
RestartSec = "5s";
StartLimitBurst = 10;
};
# open firewall
networking.firewall.allowedTCPPorts = [cfg.port];
networking.firewall.allowedUDPPorts = [cfg.port];
};
}
modules/homelab/system/postfix/default.nix → modules/homelab/postfix/default.nix
View File
modules/homelab/system/postfix/default.nix.icloud_attempt → modules/homelab/postfix/default.nix.icloud_attempt
View File
modules/homelab/mediastack/qbittorrent/default.nix → modules/homelab/qbittorrent/default.nix
+34 -25
View File
@@ -1,13 +1,12 @@
{
pkgs,
config,
lib,
...
}: let
{ pkgs, config, lib, ... }:
let
service = "qbittorrent";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
in
{
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
@@ -17,11 +16,11 @@ in {
default = 7103;
description = "set port for ${service} (default: ${toString cfg.port}";
};
# torrenting_port = lib.mkOption {
# type = lib.types.int;
# default = ;
# description = "set port for ${service} (default: ${toString cfg.port}";
# };
# torrenting_port = lib.mkOption {
# type = lib.types.int;
# default = ;
# description = "set port for ${service} (default: ${toString cfg.port}";
# };
url = lib.mkOption {
type = lib.types.str;
default = "qbit.${homelab.base_domain}";
@@ -54,10 +53,11 @@ in {
};
config = lib.mkIf cfg.enable {
# ensure media dirs existence
systemd.tmpfiles.rules = [
"d /holocron/media/downloads 2775 qbittorrent media -"
];
];
# declare ${service} user
users.users.${service} = {
@@ -74,10 +74,10 @@ in {
enable = true;
openFirewall = true;
user = service;
group = lib.mkForce "media"; # override for permissions
group = lib.mkForce "media"; # override for permissions
profileDir = cfg.data_dir;
webuiPort = cfg.port;
# torrentingPort = cfg.torrenting_port;
# torrentingPort = cfg.torrenting_port;
};
# override umask to make permissions work out
@@ -102,6 +102,18 @@ in {
iptables -A QBIT -j DROP
'';
# boilerplate for if you ever want to try to get this working again
# ------------------------------------------------------------------------------
# # add systemd service to VPN network namespace
# vpnConfinement = {
# enable = true;
# vpnNamespace = "wgmex";
# };
# ------------------------------------------------------------------------------
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
extraConfig = ''
@@ -111,19 +123,16 @@ in {
};
# add to glance
homelab.glance.links.mediastack = [
{
title = service;
url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
homelab.glance.links.mediastack = [{
title = service;
url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; }];
# add to backups
homelab.backups.baks = {
${service} = {paths = [cfg.data_dir];};
${service} = { paths = [ cfg.data_dir ]; };
};
};
}
modules/homelab/services/default.nix
-17
View File
@@ -1,17 +0,0 @@
{
pkgs,
config,
lib,
...
}: {
# the order determines the order in glance :3
imports = [
./home
./glance
./vaultwarden
./gitea
./immich
./homebox
#./searxng
];
}
modules/homelab/services/home/default.nix
-27
View File
@@ -1,27 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
cfg = config.homelab.home;
in {
options.homelab.home = {
enable = lib.mkEnableOption "enable the smarthome stack";
};
# the order determines the order in glance :3
imports = [
./zigbee2mqtt
./mosquitto
./homeassistant
./wyoming
];
config = lib.mkIf cfg.enable {
homelab.hass.enable = lib.mkDefault true;
homelab.mosquitto.enable = lib.mkDefault true;
homelab.zigbee2mqtt.enable = lib.mkDefault true;
homelab.wyoming.enable = lib.mkDefault true;
};
}
modules/homelab/services/home/wyoming/default.nix
-56
View File
@@ -1,56 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
service = "wyoming";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
# set port options
faster_whisper_port = lib.mkOption {
type = lib.types.int;
default = 7706;
description = "set port for ${service} (default: ${toString cfg.port}";
};
piper_port = lib.mkOption {
type = lib.types.int;
default = 7707;
description = "set port for ${service} (default: ${toString cfg.port}";
};
};
config = lib.mkIf cfg.enable {
# enable the ${service} service
services.${service} = {
faster-whisper = {
servers = {
vanessa = {
enable = true;
language = "en";
uri = "tcp://0.0.0.0:${toString cfg.faster_whisper_port}";
model = "medium";
device = "auto";
};
};
};
piper = {
servers = {
vanessa = {
enable = true;
uri = "tcp://0.0.0.0:${toString cfg.piper_port}";
voice = "en_US-amy-medium";
};
};
};
};
# open firewall
networking.firewall.allowedTCPPorts = [cfg.faster_whisper_port cfg.piper_port];
};
}
modules/homelab/services/radicale/default.nix
-122
View File
@@ -1,122 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
service = "radicale";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
# set port options
port = lib.mkOption {
type = lib.types.int;
default = 7705;
description = "set port for ${service} (default: ${toString cfg.port}";
};
url = lib.mkOption {
type = lib.types.str;
default = "cal.${homelab.base_domain}";
description = "set domain for ${service}";
};
data_dir = lib.mkOption {
type = lib.types.str;
default = "/var/lib/${service}";
description = "set data directory for ${service}";
};
ids = lib.mkOption {
type = lib.types.int;
default = cfg.port;
description = "set uid and pid of ${service} user (matches port by default)";
};
backup = lib.mkOption {
type = lib.types.bool;
default = true;
description = "enable backups for ${service}";
};
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = service;
};
};
config = lib.mkIf cfg.enable {
# declare ${service} group
users.groups.${service} = {
gid = lib.mkForce cfg.ids;
};
# declare ${service} user
users.users.${service} = {
description = "${service} server user";
uid = lib.mkForce cfg.ids;
isSystemUser = true;
home = cfg.data_dir;
createHome = true;
group = service;
extraGroups = ["media"];
};
# enable the ${service} service
services.${service} = {
enable = true;
};
# override umask to make permissions work out
systemd.services.${service}.serviceConfig = {
UMask = lib.mkForce "0007";
# User = service;
# Group = service;
};
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
serverAliases = ["${service}.${homelab.public_domain}"];
# use explicitly defined tls cert
# tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
extraConfig = ''
tls internal
reverse_proxy 127.0.0.1:${toString cfg.port}
'';
};
#---------------------------------------------------------------------------
# # add to glance (public service)
# homelab.glance.links.<category> = [{
# title = service;
# url = "https://${service}.${homelab.public_domain}";
# error-url = "http://${homelab.host_ip}:${toString cfg.port}";
# check-url = "http://${homelab.host_ip}:${toString cfg.port}";
# icon = "di:${service}"; }];
#---------------------------------------------------------------------------
# # add to glance (local service)
# homelab.glance.links.<category> = [{
# title = service;
# url = "https://${cfg.url}";
# error-url = "http://${homelab.host_ip}:${toString cfg.port}";
# check-url = "http://${homelab.host_ip}:${toString cfg.port}";
# icon = "di:${service}"; }];
#---------------------------------------------------------------------------
#
# sops.secrets = {
# "${service}_" = {
# owner = ;
# group = ;
# };
# };
# add to backups
homelab.backups.baks = {
${service} = {
paths = [cfg.data_dir];
};
};
};
}
modules/homelab/services/searxng/default.nix
-115
View File
@@ -1,115 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
service = "searx";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
# set port options
port = lib.mkOption {
type = lib.types.int;
default = 7709;
description = "set port for ${service} (default: ${toString cfg.port}";
};
url = lib.mkOption {
type = lib.types.str;
default = "search.${homelab.base_domain}";
description = "set domain for ${service}";
};
data_dir = lib.mkOption {
type = lib.types.str;
default = "/var/lib/${service}";
description = "set data directory for ${service}";
};
ids = lib.mkOption {
type = lib.types.int;
default = cfg.port;
description = "set uid and pid of ${service} user (matches port by default)";
};
backup = lib.mkOption {
type = lib.types.bool;
default = true;
description = "enable backups for ${service}";
};
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = service;
};
};
config = lib.mkIf cfg.enable {
# declare ${service} group
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
# declare ${service} user
users.users.${service} = {
description = lib.mkForce "${service} server user";
uid = lib.mkForce cfg.ids;
isSystemUser = true;
shell = pkgs.bash;
home = cfg.data_dir;
createHome = true;
group = service;
extraGroups = [];
};
# declare the gitea service
services.${service} = {
enable = true;
settings = {
server.port = cfg.port;
server.bind_address = "0.0.0.0";
#server.secret_key = "$SEARX_SECRET_KEY";
engines = [
];
};
};
# override umask to make permissions work out
systemd.services.${service}.serviceConfig = {
UMask = lib.mkForce "0007";
};
# open firewall
networking.firewall.allowedTCPPorts = [cfg.port];
services.caddy.virtualHosts."${cfg.url}" = {
extraConfig = ''
tls internal
reverse_proxy localhost:${toString cfg.port} {
}
'';
};
# add to glance
homelab.glance.links.services = [
{
title = service;
url = "https://search.${homelab.public_domain}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
# manage secrets with sops
sops.secrets = {
"${service}_database_password" = {
owner = service;
group = service;
};
};
# add to backups
homelab.backups.baks = {
${service} = {paths = [cfg.data_dir];};
};
};
}
modules/homelab/services/wger/default.nix
-125
View File
@@ -1,125 +0,0 @@
{
pkgs,
config,
lib,
inputs,
...
}: let
nixservice = "wger";
service = "wger";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
# set port options
port = lib.mkOption {
type = lib.types.int;
default = 7707;
description = "set port for ${service} (default: ${toString cfg.port}";
};
url = lib.mkOption {
type = lib.types.str;
default = "${service}.${homelab.base_domain}";
description = "set domain for ${service}";
};
data_dir = lib.mkOption {
type = lib.types.str;
default = "/var/lib/${service}";
description = "set data directory for ${service}";
};
ids = lib.mkOption {
type = lib.types.int;
default = cfg.port;
description = "set uid and pid of ${service} user (matches port by default)";
};
backup = lib.mkOption {
type = lib.types.bool;
default = true;
description = "enable backups for ${service}";
};
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = "podman-wger";
};
};
config = lib.mkIf cfg.enable {
# declare ${service} group
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
# declare ${service} user
users.users.${service} = {
description = "${service} server user";
uid = lib.mkForce cfg.ids;
isSystemUser = true;
home = cfg.data_dir;
createHome = true;
group = service;
extraGroups = [];
};
# still suss as fuck bro man fuck
virtualisation.oci-containers.containers = {
hass = {
image = "homeassistant/home-assistant:stable";
autoStart = true;
extraOptions = [
"--pull=newer"
"--network=host"
];
volumes = [
"${cfg.data_dir}:/config"
];
environment = {
TZ = homelab.tz;
PUID = toString config.users.users.${service}.uid;
PGID = toString config.users.groups.${service}.gid;
};
};
};
# override umask to make permissions work out
systemd.services.${service}.serviceConfig = {
UMask = lib.mkForce "0007";
};
# open firewall
networking.firewall.allowedTCPPorts = [cfg.port 8123 21063 21064];
networking.firewall.allowedUDPPorts = [5353];
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
serverAliases = ["${service}.${homelab.public_domain}"];
extraConfig = ''
tls internal
reverse_proxy 127.0.0.1:${toString cfg.port} {
header_up Host {host}
header_up X-Real-IP {remote_host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto https
}
'';
};
# add to glance
homelab.glance.links.services = [
{
title = "wger";
url = "https://hass.${homelab.public_domain}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${nixservice}";
}
];
# add to backups
homelab.backups.baks = {
${service} = {paths = [cfg.data_dir];};
};
};
}
modules/homelab/system/backups/default.nix
-141
View File
@@ -1,141 +0,0 @@
{
config,
lib,
pkgs,
...
}:
/*
to restore mysql/marinadb database:
mysql -u root -p -e "DROP DATABASE IF EXISTS <database_name>;" # delete old db if still lingering
mysql -u root -p -e "CREATE DATABASE IF NOT EXISTS <database_name>;" # create empty db w/ correct name
zstd -dc <path_to_backup> | mysql -u root -p <database_name>
to restore a postgres database:
sudo -u postgres psql -c "DROP DATABASE IF EXISTS <database_name>;" # delete old db if lingering (prolly wont work)
sudo -u postgres psql -c "CREATE DATABASE <database_name>;" # create empty db w/ correct name
zstd -dc <path_to_backup> | sudo -u postgres psql -d <database_name> # restore from the dump
*/
let
cfg = config.homelab.backups;
sec = config.sops.secrets;
host = config.networking.hostName;
in {
options.homelab.backups = {
enable = lib.mkEnableOption "enables borg backups for state files and db backup services";
baks = lib.mkOption {
type = lib.types.attrsOf (lib.types.attrsOf (lib.types.listOf lib.types.path));
default = {};
description = "backup jobs, nested attribute sets should be <bak_name> = paths [<list_of_paths>]";
};
databases = lib.mkOption {
type = lib.types.bool;
default = true;
description = "if databases are present, runs dumps";
};
backup_repo = lib.mkOption {
type = lib.types.path;
default = "/holocron/archives/servers/${host}/homelab";
description = "path to take daily backups to with borg!";
};
offsite = lib.mkOption {
type = lib.types.bool;
default = true;
description = "bool to control weather or not the repo is backed up offsite";
};
homelab = lib.mkOption {
type = lib.types.bool;
default = false;
description = "bool to control weather or not the repo is backed up to homelab";
};
offsite_user = lib.mkOption {
type = lib.types.str;
default = "lifeboat";
description = "user to connect to offsite host with";
};
offsite_target = lib.mkOption {
type = lib.types.str;
default = "lifeboat.holocron.blue";
description = "ip or domain for offsite backups";
};
offsite_dir = lib.mkOption {
type = lib.types.str;
default = "lifeboat/holocron/archives";
description = "path to rsync offsite backups to";
};
};
config = lib.mkIf cfg.enable {
# backups homelab with borg
services.borgbackup.jobs.homelab = lib.mkIf (cfg.baks != {}) {
archiveBaseName = "homelab";
repo = cfg.backup_repo;
paths = lib.flatten (lib.attrsets.mapAttrsToList (_: arg: arg.paths) cfg.baks);
compression = "auto,zstd";
startAt = "03:30";
group = "archives";
encryption.mode = "repokey-blake2";
encryption.passCommand = "cat ${sec."borg_passwd".path}";
preHook = lib.mkIf cfg.databases ''
systemctl start mysql-backup.service
systemctl start $(systemctl list-unit-files 'postgresqlBackup-*.service' --no-legend --no-pager | cut -d' ' -f1)
'';
postHook = lib.mkIf (cfg.offsite || cfg.homelab) ''
${lib.optionalString cfg.offsite ''
${pkgs.sshpass}/bin/sshpass -f ${sec."lifeboat_rsync".path} \
${pkgs.rsync}/bin/rsync -aHAX --partial --numeric-ids --info=progress2,name1,stats2 --delete \
-e "ssh -o StrictHostKeyChecking=no" \
${toString cfg.backup_repo} \
${cfg.offsite_user}@${cfg.offsite_target}::${cfg.offsite_dir}
''}
${lib.optionalString cfg.homelab ''
${pkgs.rsync}/bin/rsync -aHAX --partial --numeric-ids --info=progress2,name1,stats2 --delete \
-e "ssh -i /home/blake/.ssh/id_vaniville -o StrictHostKeyChecking=no" \
${toString cfg.backup_repo} \
blake@lumiose:/holocron/archives/servers/vaniville
''}
'';
extraArgs = ["--verbose" "--show-rc" "--umask" "0007"];
extraCreateArgs = ["--list" "--stats" "--filter" "AME"];
prune.keep = {
within = "1d"; # Keep all archives from the last day
daily = 7;
weekly = 12;
monthly = -1; # Keep at least one archive for each month
};
};
# mysql backups currently minecraft_recpro is the only thing using this
services.mysqlBackup = lib.mkIf (config.services.mysql.ensureDatabases != []) {
enable = true;
location = "/var/backup/mysql";
user = "root";
calendar = "daily"; # goes fast, included in back up with server dirs at **:00
compressionAlg = "zstd";
databases = config.services.mysql.ensureDatabases; # set to all databases defined in esure databases
};
# postgresql backups currently immich is the only user
services.postgresqlBackup = lib.mkIf (config.services.postgresql.ensureDatabases != []) {
enable = true;
location = "/var/backup/postgresql";
compression = "zstd"; # optional: "xz", "zstd", "none"
startAt = "daily"; # the dump is included in a backup taken at 4:00
databases = config.services.postgresql.ensureDatabases; # set to all databases defined in esure databases
};
# helpful and for scripts
environment.systemPackages = with pkgs; [borgbackup sshpass tree rsync];
sops.secrets = {
"borg_passwd" = {
owner = "root";
group = "root";
};
"lifeboat_rsync" = {
owner = "root";
group = "archives";
mode = "0440";
};
};
};
}
modules/homelab/system/default.nix
-15
View File
@@ -1,15 +0,0 @@
{
pkgs,
config,
lib,
...
}: {
# the order determines the order in glance :3
imports = [
./motd
./backups
./uptime-kuma
./msmtp
#./postfix
];
}
modules/homelab/system/msmtp/default.nix
-50
View File
@@ -1,50 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
service = "msmtp";
cfg = config.homelab.${service};
sec = config.sops.secrets;
in {
options.homelab.${service} = {
enable = lib.mkEnableOption "enables zfs";
};
config = lib.mkIf cfg.enable {
services.mail.sendmailSetuidWrapper.enable = true;
programs.${service} = {
enable = true;
setSendmail = true;
defaults = {
aliases = "/etc/aliases";
port = 587;
auth = "plain";
tls = "on";
tls_starttls = "on";
};
accounts.default = {
host = "smtp.mail.me.com";
user = "bdhelderman@icloud.com";
from = "alerts@blakedheld.xyz";
passwordeval = "/run/current-system/sw/bin/cat ${sec."email_pass".path}";
};
};
environment.etc.aliases.text = ''
root: me@blakedheld.xyz
blake: me@blakedheld.xyz
'';
sops.secrets = {
"email_pass" = {
owner = "blake";
group = "blake";
};
};
};
}
modules/homelab/network/tailscale/default.nix → modules/homelab/tailscale/default.nix
+4 -9
View File
@@ -4,26 +4,21 @@
lib,
...
}: let
service = "tailscale";
cfg = config.homelab.tailscale;
sec = config.sops.secrets;
authkey_file = config.sops.secrets."tailscale_authkey".path;
in {
options.homelab.tailscale = {
enable = lib.mkEnableOption "enables tailscale";
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = "tailscaled";
};
};
config = lib.mkIf cfg.enable {
services.${service} = {
services.tailscale = {
enable = true;
openFirewall = true;
useRoutingFeatures = "both";
authKeyFile = sec."tailscale_authkey".path;
authKeyFile = authkey_file;
extraSetFlags = [
"--advertise-routes=${config.homelab.host_ip}/32,10.10.0.1/32,10.10.0.5/32,10.10.0.10/32" # advertise self
"--advertise-routes=10.10.0.10/32" # advertise self
"--accept-routes=false" # true is equilivant to useRoutingFeatures = "client" (breaks shit)
"--accept-dns=true" # explicitly allow resolved
];
modules/homelab/system/uptime-kuma/default.nix → modules/homelab/uptime-kuma/default.nix
+21 -23
View File
@@ -1,14 +1,12 @@
{
pkgs,
config,
lib,
...
}: let
{ pkgs, config, lib, ... }:
let
service = "uptime-kuma";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
in
{
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
@@ -45,8 +43,9 @@ in {
};
config = lib.mkIf cfg.enable {
# declare ${service} group
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
# declare ${service} user
users.users.${service} = {
@@ -62,7 +61,8 @@ in {
# enable the ${service} service
services.${service} = {
enable = true;
settings = {
settings =
{
PORT = toString cfg.port;
HOST = "0.0.0.0";
};
@@ -73,30 +73,28 @@ in {
UMask = lib.mkForce "0007";
};
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
#serverAliases = ["up.${homelab.public_domain}"];
extraConfig = ''
tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
reverse_proxy 127.0.0.1:${toString cfg.port}
'';
};
# add to glance
homelab.glance.links.system = [
{
title = service;
url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
homelab.glance.links.system = [{
title = service;
url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; }];
# add to backups
# add to backups
homelab.backups.baks = {
${service} = {
paths = [cfg.data_dir "/var/lib/private"];
};
${service} = { paths = [ cfg.data_dir ]; };
};
};
}
modules/homelab/services/vaultwarden/default.nix → modules/homelab/vaultwarden/default.nix
+34 -29
View File
@@ -1,15 +1,13 @@
{
pkgs,
config,
lib,
...
}: let
{ pkgs, config, lib, unstable_pkgs, ... }:
let
service = "vaultwarden";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
domain = "https://pass.holocron.blue";
in {
domain = "https://pass.blakedheld.xyz";
in
{
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
@@ -46,8 +44,9 @@ in {
};
config = lib.mkIf cfg.enable {
# declare ${service} group
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
# declare ${service} user
users.users.${service} = {
@@ -63,43 +62,49 @@ in {
# enable the vaultwarden service
services.${service} = {
enable = true;
package = pkgs.unstable.vaultwarden;
package = unstable_pkgs.x86_64.vaultwarden;
config = {
DOMAIN = "pass.${homelab.public_domain}";
IP_HEADER = "X-Forwarded-For";
DOMAIN = domain;
ROCKET_ADDRESS = "0.0.0.0";
ROCKET_PORT = cfg.port;
SIGNUPS_ALLOWED = true;
ADMIN_TOKEN = "$argon2id$v=19$m=19456,t=2,p=1$YXJKa0ZubE9OZkp5c0NlMC95TFhBcFh3K1VsUkk1bElTSFJkbmdYdmp4az0$bsLT8/18BmexUbzqlHp0S4aoIxi6bYxl0IY0EweF5N4";
EXPERIMENTAL_CLIENT_FEATURE_FLAGS = "ssh-key-vault-item";
# ADMIN_TOKEN = "yuh";
ADMIN_TOKEN = "${toString config.sops.secrets."vaultwarden_admin_token".path}";
EXPERIMENTAL_CLIENT_FEATURE_FLAGS = "fido2-vault-credentials,autofill-overlay,autofill-v2,inline-menu-positioning-improvements,ssh-key-vault-item";
# The following flags are available:
# - "autofill-overlay": Add an overlay menu to form fields for quick access to credentials.
# - "autofill-v2": Use the new autofill implementation.
# - "browser-fileless-import": Directly import credentials from other providers without a file.
# - "extension-refresh": Temporarily enable the new extension design until general availability (should be used with the beta Chrome extension)
# - "fido2-vault-credentials": Enable the use of FIDO2 security keys as second factor.
# - "inline-menu-positioning-improvements": Enable the use of inline menu password generator and identity suggestions in the browser extension.
# - "ssh-key-vault-item": Enable the creation and use of SSH key vault items. (Needs clients >=2024.12.0)
# - "ssh-agent": Enable SSH agent support on Desktop. (Needs desktop >=2024.12.0)
};
};
# override umask to make permissions work out
systemd.services.${service}.serviceConfig = {UMask = lib.mkForce "0007";};
systemd.services.${service}.serviceConfig = { UMask = lib.mkForce "0007"; };
# open firewall
networking.firewall.allowedTCPPorts = [cfg.port];
networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
serverAliases = ["pass.${homelab.public_domain}"];
#tls internal
serverAliases = [ "pass.${homelab.public_domain}" ];
extraConfig = ''
tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
reverse_proxy 127.0.0.1:${toString cfg.port}
'';
};
# add to glance
homelab.glance.links.services = [
{
title = service;
url = "https://pass.${homelab.public_domain}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
homelab.glance.links.services = [{
title = service;
url = "https://pass.${homelab.public_domain}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; }];
sops.secrets = {
"${service}_admin_token" = {
@@ -108,9 +113,9 @@ in {
};
};
# add to backups
# add to backups
homelab.backups.baks = {
${service} = {paths = [cfg.data_dir];};
${service} = { paths = [ cfg.data_dir ]; };
};
};
}
modules/homelab/mediastack/yacreader/default.nix → modules/homelab/yacreader/default.nix
+24 -26
View File
@@ -1,13 +1,12 @@
{
pkgs,
config,
lib,
...
}: let
{ pkgs, config, lib, ... }:
let
service = "yacreader";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
in
{
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
@@ -44,11 +43,12 @@ in {
};
config = lib.mkIf cfg.enable {
# install the binary
environment.systemPackages = with pkgs; [yacreader];
environment.systemPackages = with pkgs; [ yacreader ];
# declare ${service} group
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
users.groups.${service} = { gid = lib.mkForce cfg.ids; };
# declare ${service} user
users.users.${service} = {
@@ -58,15 +58,15 @@ in {
home = cfg.data_dir;
createHome = true;
group = service;
extraGroups = ["media"];
extraGroups = [ "media" ];
};
# enable the ${service} service
systemd.services.${service} = {
description = "${service} library server";
wantedBy = ["multi-user.target"];
after = ["network.target"];
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
serviceConfig = {
UMask = lib.mkForce "0007";
User = service;
@@ -81,31 +81,29 @@ in {
};
# open firewall
networking.firewall.allowedTCPPorts = [cfg.port];
networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
extraConfig = ''
tls internal
tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
reverse_proxy 127.0.0.1:${toString cfg.port} {
}
'';
};
# add to glance local service
homelab.glance.links.mediastack = [
{
title = service;
url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:yac-reader";
}
];
# add to glance local service
homelab.glance.links.mediastack = [{
title = service;
url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:yac-reader"; }];
# add to backups
homelab.backups.baks = {
${service} = {paths = [cfg.data_dir];};
${service} = { paths = [ cfg.data_dir ]; };
};
};
}
modules/system/default.nix
-1
View File
@@ -20,7 +20,6 @@
./secure_boot
./cifs_mounts
./udiskie
./keepalive
];
system.ssh.enable = lib.mkDefault true;
modules/system/graphics/default.nix
-17
View File
@@ -84,23 +84,6 @@ in {
# enable docker gpu passthrough
hardware.nvidia-container-toolkit.enable = true;
# systemd.services.nvidia-mps = {
# description = "NVIDIA CUDA Multi-Process Service";
# after = [ "nvidia-persistenced.service" ];
# requires = [ "nvidia-persistenced.service" ];
# wantedBy = [ "multi-user.target" ];
# path = [ config.hardware.nvidia.package.bin ];
# serviceConfig = {
# Type = "forking";
# ExecStart = "${config.hardware.nvidia.package.bin}/bin/nvidia-cuda-mps-control -d";
# ExecStop = "${pkgs.writeShellScript "nvidia-mps-stop" ''
# echo quit | ${config.hardware.nvidia.package.bin}/bin/nvidia-cuda-mps-control
# ''}";
# Restart = "on-failure";
# RestartSec = 5;
# };
# };
})
]);
}
modules/system/keepalive/default.nix
-45
View File
@@ -1,45 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
service = "keepalive";
cfg = config.system.${service};
in {
options.system.${service} = {
enable = lib.mkEnableOption "enables ${service}";
url = lib.mkOption {
type = lib.types.str;
default = "";
description = "url to ping for uptime-kuma keepalive";
};
interval = lib.mkOption {
type = lib.types.str;
default = "45s";
};
};
config = lib.mkIf cfg.enable {
systemd.services.keepalive = {
description = "send push for uptime kuma heartbeat";
serviceConfig = {
Type = "oneshot";
};
script = ''
${pkgs.curl}/bin/curl -fsSk \
"${cfg.url}" \
>/dev/null
'';
};
systemd.timers.keepalive = {
wantedBy = ["timers.target"];
timerConfig = {
OnBootSec = "30s";
OnUnitActiveSec = cfg.interval;
Unit = "keepalive.service";
};
};
};
}
modules/system/ssh/default.nix
+7 -9
View File
@@ -1,11 +1,9 @@
{
pkgs,
config,
lib,
...
}: let
{ pkgs, config, lib, ... }:
let
cfg = config.system.ssh;
in {
in
{
options.system.ssh = {
enable = lib.mkEnableOption "enables ssh";
};
@@ -16,11 +14,11 @@ in {
enable = true;
settings = {
PasswordAuthentication = false;
PermitRootLogin = "prohibit-password";
PermitRootLogin = "no";
X11Forwarding = false;
};
};
# open firewall
networking.firewall.allowedTCPPorts = [22];
networking.firewall.allowedTCPPorts = [ 22 ];
};
}
modules/system/syncthing/default.nix
+3 -3
View File
@@ -32,17 +32,17 @@ in {
settings = {
devices = {
"snowbelle" = {id = "6WQ6ATA-5AT4RUM-NW67PAL-N62CPNV-ALRFG3P-5BDRO22-HWFC2Q4-5S5BDA5";};
"piplup" = {id = "OV4NUQK-3YHRL5R-SIZGTNL-7VZFFUX-FOJ6NTS-C7ROXR7-I2Q2W7G-QERO7AO";};
"mudkip" = {id = "OV4NUQK-3YHRL5R-SIZGTNL-7VZFFUX-FOJ6NTS-C7ROXR7-I2Q2W7G-QERO7AO";};
"zygarde" = {id = "UYLTF52-VVKUR7F-JN33HQZ-RFNWGL3-JER52LA-GZD2LPJ-QIFEE7K-MNMZRQ5";};
"mew" = {id = "7ZC2NAS-QONQKAL-Z54NPMB-7TRXM6M-K7Z6PZD-FG4AI4H-V7SMFJN-JOYBHQO";};
"yveltal" = {id = "ZVSQ4WJ-7OICYOZ-3ECES4X-KH37IPB-TKHKUJG-BSEGXVM-AHYY5C3-VKG44AX";};
"CEN-IT-07" = {id = "DPYKA4Z-3PX7JB2-FBEOXXX-SC7TLT2-QC5P2IR-SXOPJGX-QO3DMII-5B7UCA4";};
"CEN-IT-00007" = {id = "UEWNSUZ-AX75M5Y-OA4FURY-ORMEXFA-XUXU4LU-LEUYKVW-IDM2GQC-4UR4YAL";};
"CEN-IT-00007" = {id = "XBPXGYU-DUJSLDH-6BDNF4D-CO2COC3-N3FM6W5-IHZOJBM-Z2N77RI-IVAV5AH";};
};
folders = {
"holocron" = {
path = "/home/blake/holocron";
devices = ["piplup" "zygarde" "mew" "yveltal" "CEN-IT-07" "CEN-IT-00007" "snowbelle"];
devices = ["mudkip" "zygarde" "mew" "yveltal" "CEN-IT-07" "CEN-IT-00007" "snowbelle"];
id = "5voxg-c3he2";
versioning = {
type = "staggered";
secrets/secrets.yaml
+12 -30
View File
@@ -3,25 +3,17 @@ blake_passwd: ENC[AES256_GCM,data:AfFql6/ghGhCDLOb4+QuAsDznz4hC4ilxZYCIH2sgBWX9t
#ENC[AES256_GCM,data:0HBVS2AYQ2VZXY4EbMLwiSjRNyWZ57bf,iv:20SLWXpbRTLk76g5mFrhg1Z9Qasv3NoSJbK/FOiIgtk=,tag:DbUffQwrDqzy2QO64uoUeg==,type:comment]
klefki_auth_map: ENC[AES256_GCM,data:u8OBLtT/,iv:THW21BDyhyFIjcwixsAnaAODofxbuQZnpdgt9HGdDIg=,tag:zUvbOO8tLAnxdeMcWpvsdg==,type:str]
#ENC[AES256_GCM,data:ZxHtUSuOy19M0EKoT5xltFiqRg==,iv:72PJL2eG68VC4wiJFo6wL0l7AaDIsge8l/D/ZlLOWWA=,tag:Q16ztObK2AnbCCS5mRgjtA==,type:comment]
tailscale_authkey: ENC[AES256_GCM,data:SqBbzV43arnLJZX0bnCZZGqO3jAKXBPZvIe6lqtf8L8RtqVNPvhxzeHR3Nki5LoSd7f3Za01puBAwpZY2QQ=,iv:f3jNCmrQrWsD2cvB6Ji8H0Ez/kpZ+4K9NIEhGfKU/N4=,tag:ej1gW8fBhAd9j53G7g8/HA==,type:str]
tailscale_authkey: ENC[AES256_GCM,data:SU0k3asrJd+WZ86VbC4w8TDJp+MqsbyagrzCfDcgTzO5yvBjpWAKbJ7A+VxgQvdu4+S2jMYbdrONPp3YbQ==,iv:VMYmGVk5GpUQApKKQYhdOw/cYCXrXxEZJJwHfQL4MjQ=,tag:7ruaoCDxuFQ7tE/JLJ37Xw==,type:str]
#ENC[AES256_GCM,data:bEbCic+ZDAA5ieNedCbiVbJrse17,iv:UwRYlis6NPB/RUcv+YnPxrGdbIcF4hrNiZt19YvWZNQ=,tag:m6PVlzPNnahX7X7KzMUj7A==,type:comment]
borg_passwd: ENC[AES256_GCM,data:XOMJtr+DRs7xn5Iclc49iTzK9cFJyc/fSXJjhdKa9jdN,iv:YB8z7zNYjh6NpSxQb1TfPxAYUdzThdVfNZIe6tO5grA=,tag:bO6kZ3cLJDL4IQoWmGvRdg==,type:str]
#ENC[AES256_GCM,data:b75Jb5eEKZQlzC6zYJhDNhOOwA4oetNp52J7kE7eCpA=,iv:yNq/pYLtzVfqItBG9peGd0NtL7PkVkaKI8jpzAbWUo0=,tag:suibUsiuNkxrQqWumHTbXA==,type:comment]
lifeboat_rsync: ENC[AES256_GCM,data:OaijbFFpu8RM3gcWu2XbAHeuUhTIjFNO8aYcA8TJmNxMeUQkZ5QrE+ArAQ==,iv:V0MIqVclg9mg0sIPRgTAu81l9b1f6ssZPCcW+ukM/JM=,tag:5xMgBMfMgGYlHlpFoG4vDQ==,type:str]
#ENC[AES256_GCM,data:NbXyRroLF2uxHjROnBg9OLQ=,iv:W9Nse9yamov3rflDKBeISO+miQkjH7QfBUZdsDmDM4I=,tag:/RmH3JyriXFxf0hEh9/iRQ==,type:comment]
cloudflare:
api_token: ENC[AES256_GCM,data:VuRwfZe1cdnQLvxlp9GCDOt9Ijhz4fh2yOev2wLOdLV+zw91blA3Zis2BRyI/ZwN4y+IhiqlpBzXCsoFqw==,iv:6Bt11zz1/slvszh9ZGQ0ov5ts0jAZIAMx3G2AimKIs4=,tag:tyEVhsKCGrJWm6yn+GUlUQ==,type:str]
api_token_caddy: ENC[AES256_GCM,data:L1PMeI4zOCPbWuWrczM1aSYl/qk/MW8xLtxr/PL+a3zfDA+USP8Yw4liYnn1qwTxs+oLMHhpBR58kHPr8Q==,iv:NNVBPANwQ9koAKTQD4ikhtwFjCpMLMXEm9scj9jIDFo=,tag:SXt1Y+04BuSsjDhu5ykwLA==,type:str]
#ENC[AES256_GCM,data:3Nnp9ASh+BPPwSOa+Xx3YEqKnh48oW6sWCQCXy9iZ61qGv9Ubjeaccr+Bh0bD9s=,iv:LwbptKdbhO2yki2BIK+6uPMqe14FNC4EcIwO6HS5xAc=,tag:38P0kwfAFVEps6MnMU8XeA==,type:comment]
email_pass: ENC[AES256_GCM,data:T4heTFuvD3rUJUInDpJnIhwECw==,iv:uDOk6FKtfYjedE/I3zh9Tl7QuYz/OBe/3tlrTitf2DY=,tag:a80RoPPHMSETAbk5pqGfiQ==,type:str]
#ENC[AES256_GCM,data:ztRwuY0mTMDmwV5HqVR7Dmc+dCWcrVRtWZGEL1abE/WUcA==,iv:mmaWfHRiENJUGNhyUBFo1z7PdzVPH1OUZrVhkce6KV0=,tag:GKEvT0qkzTtimQXDueKPdw==,type:comment]
holocron_creds: ENC[AES256_GCM,data:2QXtXrN5w0UFn70GZOsYFPdtPwjLcuUdtkEam5aZ83N6LEDqPWJi,iv:kUS9pq5CX19vqHumc6QjY+Xpd4N+Ge7oCcQYtMFh+WM=,tag:IUA1ZVThF91EdHrwmS624g==,type:str]
#ENC[AES256_GCM,data:VdbMrwGKUKNJHw==,iv:OLwBh6KQXR/H8eRgp/hH8k3QfIkK/ydL735kx/dpc8E=,tag:N+v+ym6RMbvW4IckbiLK8Q==,type:comment]
syncthing:
gui_passwd: ENC[AES256_GCM,data:CicGIe5dT8lJVchCcE4wg3E8va3RYR8d53MISkE=,iv:8ziDDyQvU8ABaKKwYlcHmvm8Qybk4G+q5F0Ghqluu9w=,tag:YlyNPE04KD3detL1QUTrgQ==,type:str]
lumiose:
key: ENC[AES256_GCM,data:82oOep2VmxfbHpRVvmVH/qh8Lv7ZqoSauLZB7l6fwF1EVNc/LnHNxT+JQSGjDPy8Kqieql+cKjjAseBS3u1y600lvuIeOQCOhNQd6JE5wThvCbJvAIH7G5v3ixls7xNThkzNTJKz5gtEcC7bLh0/XV3tm7kXhw6dN2f3kv2aCqF47FNw57v75Sm1yI/Dn/adrMUNCTxiwM8kisn+302YjyfVZ+LC9R49YtuwnOaUnQ1XGp8xeLcRZFkY5ThAxfXtRyZ/d4fwAEkwF5iVFfSQumimmSkgfYRteJtGvq3varV/eC/6IVzzg5hw0jcKZ7u7b3Rwut0mXi6E2WVRlN+L1Y1sk3xXvbF252+Ja1yR1TKipqro1Rv/BHP7DTZ/SSGU,iv:4dDnU1h1RaleL9f/8ywwL1Kk722PQwLB5OEovBoAA8o=,tag:z0cId9BFW0icNzPTm6vDZA==,type:str]
cert: ENC[AES256_GCM,data:oALzV1PdQdsjH0TCRZ/LYbrMGROCyFRLF6S7c2Lzyf6i4mUSjp+wqh2OtWKC5GltKgwUoFE7eddLWdYR8Tfi5h4NowJTcWeIg10h6iSiztwZTho4Ob3g0KkzrQRwERcv++SwLz8yo5zeDEnZ/jqanlqcrxQQdoEneFdg7oK8lMXou4r9VZ3y2qgE8+9o4DWeiYaSJif3ad4SSc00evzswz/bN+4O1ei+47C/ABMBHe/N9H6gwZoSUgFrjv8+kcU8g29+HB6Fd9K5quUoR08BCj2d/WoGLmmJXVZm5ee7yEngJTFm1wGYjo5RXxR7fDoThtjre9Nt8L5ssewTTiQ9k4IRKPwTtMpAaSPXkxMS4CJZk7+UoZT1gg4nA3WPz2JKmtiPp2f7tKkglQpN8ckkxuEj+JHaDFSsylp3KcI/MHYrroU+jE6Jy+jVjggy0kg7N7+PqfKU02OTXizymivzRaXUzyrK6dS4/I02rsLcpvzyAqV0o0wHlYgDzZjU9BiNZNIeKXpNasN15nDwmJ4tvvk3QHMsA/sZgAXvaF+KmXeficdPc5YBAIZulvN75OtaE5MF4O+0boZpOXWsGifCvqtQtikAqJ+5DguAGxdR5IsfP3KfqqH0roLaiut2BDGdlPYMbEJkDjQmHm1zsw26TvgN1U1zkBdTZHtFm26g4XuzTqVU9LVgFJveZiOsKBHj19iODAJ3t0uJ44xid1N0udQGagRYi+u1hPVn1p64eI3x8UD/sX5Zz0xyO7+1DZ/eSam4nQYj1lFZ/hfDgZzyr9V4okJqJoMj5ZVhIMDNsiQWCNEVrFf/UG/YJFUr8yjtp4sefWA6vdORJ/sXQ9XYUahFv8Px0Yy0vmApoXMRfubo2nACZyFg55vkY/nEr1fqKXfVROLmgc0q08nG1hgjU+odeIeEbH05P/f5Xago1QO2MdsQqXH0BkDupgkxdz5Dd6HQJlL6EtuAweDUTqvNHKQ90pqqbSnVTM+VvPc8WR7wUniWvoTigG3CA1N3PRF5aGhhnKisml12KCZlUfDj9qfY2CE9Qf9HIEs=,iv:4thjc7nywpSZvj/gcdtjR4zwVopquFuCs41emhfmMPI=,tag:3CRdTk2qNO9GoDrKZZqLhQ==,type:str]
snowbelle:
key: ENC[AES256_GCM,data:MrAc4RXi6h4WOboZgBRjggPNGUrQwM1Vu5N5aPYBxeBZPi2ut8OApWcA9apWzYZNQTFF5QCtCpG9W+1CLJRG701PRK1Wf01r5SDI8aIXkgc2MjXuzS/y/WIqWoPK1nmtjxTYqaDR68II2tc/P7hgtf2EwYPV2JP6v6cCihADOKvXW1pBxi9kMjZGcbY54IyUrOdNauDvaZRgCSP7xtg8aWf1FlmJbiQgMW2lK/f+8rc/3OGS+ieFt35h29Khl4rhuYGB6rgTwvDaWa9g60rPzVcg6tKw+Unef99pA+CQnhVJJIejKlC07pCdqdjCUc+w0oQ69cVoucWeHqlq3xA7IvYIGi9K+OFCLmsoqjMe/wUSC/r2s/nnqbXsgVx9j8j0,iv:2FoZwwzKUky02Z34KRVP/jPhOMXnLZh841+4lybsbCY=,tag:ZL5qh3OcFjiWgqtmTCUFkw==,type:str]
cert: ENC[AES256_GCM,data:tvJX88ounzIzKmKcvEe0UtHrq51DMAIHGVZE2StqfNkn2QP+Er/geEh0wwmP9Q8+XBBjDT6oSAlWLjq6Tc1yYWSKju6Ig8GEJNDHL2UMVniBFzroSlO9hqZzbbNe1896WiwhhypvBoves7STTE7tJ2+Hzyss1BCYjcI+evGliJslq2nqxroMxIwBXfuDtxcTAeJ+SiKonY7W29NA05P1zYm6o6Td09VUS0cYWx2VUoP/8PMpeWLNciaHz8TjUeZ2Qob3pcNielu/VDqbunLvbFapqdV0hkl8gxgho+MmkC3+DXp/JDnG+vRm603wxqDECh6CNYc0CEXvM0/8gSXt6AkjATv6tBV98VeLknZkqVjBahtxrZuwquMuQbh1jD53RgsvnwB39FyFHZw29DGcUD0A7hIGnqSYVc2TXW+sgRxzXVFYsVrt1sWrYa2DpZT5zaFbps0dd194/j0SHOdf3p/4HF0GncWfTWLT89F/oAyJLio4X7yjES/DljgvmsrX0LdHnAYYAKDCWhZml3wSHBJ7Uvj1KiH2asxXkdiTPf8wulmwT+01hhBoX3QCkVYkdJpDbVddjLkwpLNyJATHctyuqzOdEMR4w5usTv9vKcgkMtbmxfWajb4lhjCpuaavkDUoI5h6eB8veXbZqAuX24bCvsLBWOVkg4qt1GGRqHx7+lfFanzMGyYYC/ufAXWD6eOOVsCjHJbHJoI16zq0HkfNpr30w+gO8hOyKgBP64anElzT3NB1sDi2GWxhSUKTDZ3rLsagPhZb3l3/u5SMf6lLWsY6IyFgPcVgY1snSOtd+PO9z9ipfyQZn4kKCtkNPPof8T58Qi7CP4KmVvbJsF67BH26SFclQLaJv5RO7e936vNwLrVhbyaclM0Vz6Y8wJvG4vW1Z4qPt6kP80NEATdrfwAr9nvZkb5rHqRWdxqIWSD5as+HPFzM/Mv0sBZ+B+CnsSv1btdB/iLacd032PGKXfZLxqGGOL1HIjM+QjSjaBTqrYcMke3GvnVfIujfdtcn9tOqGK+QYPS1CTYxWznmHloL2/WYwBY=,iv:qlIfrPxz7NvjkIXSkumfKvN0O1qq1S0T5j+37L8aReU=,tag:Qg8CYcDY/MaLWwNY566wBQ==,type:str]
yveltal:
key: ENC[AES256_GCM,data:unUnEeDhCqHUZCJtGCbj5rmrLx+9GiUTl75K3HdkI94YfCLNYCBACYu2v/7FbNIEsjVoQEA5/gKEcUHzVq6LaHM2w9GSo6tjkegdzTUgbHBJf4ssJ38z5rQkMc7tbzsA0NUHBPklz1eyjkW96HQPD0REcwA3CIc=,iv:PZ7vfhIpwPpMz4P04bewNhRuahmpukasgYb8fL/EJBE=,tag:G1HDyPAVSdm/fwqTXTT3PQ==,type:str]
cert: ENC[AES256_GCM,data:yLq2dNjdMiRj4reyZWsSqZ+1rw4DTwKBZoQHzeKb8YBn63ub4TZPlnOjSTt2DwOQwrJDNhsaeGscZ6J7rLxF/rtH6YnR8XxQuOu/NNIcZ4m9EqhsXyznSx4Q+0gamUXujRgGRVH5FNrfiFoqP3VuNghoX+NLxfX0BcVruEjbmLUWVVzY0yS0ufzxegM8WFAxuKhcr1NlhBU65TxKUtbj4vcByzWHkfLGIb5ICnGeF/p9/FvpFSavw3nLdybDLJ6EKEeaxy6t984fkuotAvk54kLbF4yt0q5mjDxy0U6xtn1hg3x03IRAPjKDRdpDmzYf4XxykEb74JX9q2zjUhb2l1ORWcZu/uKvEiuZWDJRmJ4ypOiyZOCqTvY6s2iDhEjmMKxlNr2mhuz9Hn6b3KoQjePIEd1eS/VEmo09pEuUlhlAEziVcdnpeRyWlN2xpv4ps90gLxJ1Mj9nAZwRqFOQl0V4N5OBHEqMBE1nQv4afMpGX5QF2UotTpNfka+LdKwc1iHHtpHZYmG1/LVwz3jDv4XnVLdDWojFA/8eJIWVq1BsUTYSy+Q27bsoTX4iL0Y/OAHRzXZTqYc4aiAWJoaNTNgmagZ9C03SA6qePlGe/5azI3f54rC2m1/JDUtYW3IABHSFUaVnTdWnD4GDNSYRJIknyUwXR4sE3pRD979prmgtepOyETOAVgEeUVKz1leJZ2HyyhjFU41TL0IN/sl+YPD9bC3Nmw7OsxMFGPC4l5vn64DVp7HHRSKyJvZ5fG8s4nSzyZAKomkocOpKHEuQPyyerZpL1lne/m2B/y7/W2ouAGxcawZOSU6f74mn5wM=,iv:Ggag5SNUFkhMWS0u1kwkD5tGjiMv4i041bCESl5XOdc=,tag:pPISz0eBWzHcPHsC8dVG3g==,type:str]
@@ -30,14 +22,10 @@ syncthing:
cert: ENC[AES256_GCM,data:uvNZYmQnexXTr/Sz7vLQIJK93MmsoiJfCAL8/rLVQH0D+1nVaM472lqR5pP0qhLKuYhFUESxhAotVtqLpOWK1MfAxuk2RHv8mvbtIJkheRmsIWw7dAAABIkmgnelI03P2Tk2129I95vMM1lybu4W6m9VslwJF8X/4rCxshdbuz9mcjwxBpUEDr1V76DO3bgQUuPwizx17ON8gNd+NtRqPPaXlGrfLCFv1Fib3YFd7+WRkERki9ZO7Q0quY75G4Jseb28QaiM2BT7jfECJo4x7rMePMV303sIrF9paaUKTuSiCUsamLsi5Hwr907y2lHB9Gocwio7tnSRSRhHHcWLI8dQktzW7Flqs8+MZGZ1oJBQO7kQDefF1q4mddADimoqD9F1NsOiOmqqZRRB37alLGmRjeYBIlA6q/FgN9BAj9h0cG3oN1MUXPRGzDfggg5TLjBM2FbG/N3xgncZ2AzTPOcLtrtc0I2PYk3FFxgzpHWnjS2t7CQo/JxqdXbdy9nTHIqbrnKIQ/FtS7/p+cgQcU815UMsJm3qP+hPLCyNuziYq3Vt/X7C3eTnrqemXjEeJ/SJxb+Oul5GS1OL14dNsJllFNuj33Zep/hyQvHnf/HW7kXAfDqIP9zn85EFriAZEuaKwbHB2pkvbWKFxrpXJFhjnPFDKxGOjAmsLmil4paFKdt5hK7rp0mmoIMN+mMFbYx333llik0qk27yYTQwOR3eeCGqHODUU+izUT8NuQBezyxsEmEYu/YBcpatcYylwKgIFcC058oltsxlbxRg5Rrdk5FOqj7Uui0qwFXvYesz6Tiq/rGmcOPlcE5xw14=,iv:LePpzWGDTV1ONwt1uHUptMW1dO1SwwUKrtCEerc/DEc=,tag:a5B/7hmIxvLXU90Stcq7zA==,type:str]
#ENC[AES256_GCM,data:A0ITyGOGMIoyVOcn5JOi1RAtqUM=,iv:+wWpmFbeLiX/Ae53pj0QmnYY3MEzOMib4cqbePUKtGI=,tag:JHXvrN4bOH+oD3Q70pUuew==,type:comment]
pia_auth: ENC[AES256_GCM,data:rwAu4f5XVS4v4FCLj2zXAegIZeRPLIzUVv6TCrdfg9RGSDJYHgVAX0aFXCBQsDQju9RDycXmc9Id8IuyYN8=,iv:kEA4ADQyUI+zlQoZOKi81dw5BLE1oesqhVf6bfiLgB4=,tag:VHT2uPNW27F3KRM7ZhWdCw==,type:str]
#ENC[AES256_GCM,data:5F5zgBhqkrxOWOwqOZN3GQ==,iv:TRWqSSGcEBq+3IY0PyYi8SIZH8wKXvNS2VHS5pxlOuY=,tag:tJQgthNyBxu9ebeaxYg/yQ==,type:comment]
cs2:
gslt: ENC[AES256_GCM,data:CJUqox7FRvXhQr4oll4Qex75CEGyUo6cRruvhw9o4wI=,iv:ZQmPd7TWrO6KjLeYbNVIEVtt2DqLMnGZ9LJyo6RWwLI=,tag:XlClJ4tieowiL/bETPMLNA==,type:str]
rcon: ENC[AES256_GCM,data:b69rgz71icGSUDXjH5G8DXcA9W2521qRrKcxcONs1NGDjcFyfulPZt8=,iv:DNlujzo4nzIZg6hOxUNDWWDU2o84wZNP6zIJ67Z+xKw=,tag:1MMhWLI8lDuildp++DXc2Q==,type:str]
#ENC[AES256_GCM,data:mbIgMJBhL8nWJzl8q2dFL8XtO1Xa1Q==,iv:caYHYp1boK9wRgCcQe40HTWT/HxAIvYe+HyaruI53Vc=,tag:S6wowhAHObEcs7z8FimZ1g==,type:comment]
wg_mex_key: ENC[AES256_GCM,data:vxDXixo6X6D33+p21L4hB0/yCH+TvMHZl991BkRsE/jdz7rzZuJF+zI7h+Q=,iv:8WR+feHXNUcat8DB2wY7wpos+P7TzgRF7rFD0fYosjY=,tag:p9b9ck0/VZjyLxtHut3n5Q==,type:str]
#ENC[AES256_GCM,data:CO5nrcDbgymnEmCvuTexOBEMncuNM5lQ,iv:6HrxqSN6e7ODuz09MIFgPbIqDCKQySRDaKk5Wdu4HoQ=,tag:JBRjZeEdOg+trohfanO6Mg==,type:comment]
vaultwarden_admin_token: ENC[AES256_GCM,data:Ow5UcBXe+36POaR099v4Sl0ObLu6/lmk4OO5F3sA6BxoSD3e0LFdlvn2QyWKAUOeBSF9ZoLLSnZwc8xd2vt4xm8WQXe7OupO4yAGeE2P0vNcyMTKXxS48scibDvdoGYEtbfbH3JH29pOF7l6LetWcX3T121mPrNz8bHknj3UXHLYdYm8+eA=,iv:iFZYixNJCpK/VB3AasFO/XdPKL4wh5B9HzSKU39LRn0=,tag:m4wC0CpZK4N6rlKoEa5OZw==,type:str]
vaultwarden_admin_token: ENC[AES256_GCM,data:G1v3N064ci0Fw5EtTzaryailWpsv6f4w6eoHp2vjXIBtIlScdQk1Q0W+eDNRk8Wr2C3ysTXQNbyYismNsls+jeS3W+YqkKL4fnh3a5UTzQrMqvaH11n3ak0X9R9vmt+ZJXBrUrAOKJ6RPHJJSWenhjDB77kwEdQ=,iv:f8X+x/AdmZ3b3dtcSFrxGgA2tCgDRpgddjlVu3mdCmM=,tag:c0MXljVvhwOdvrb/8hWlsQ==,type:str]
#ENC[AES256_GCM,data:2ESzSsQZqKdjD7OXN8ZPThj6g9acJREe,iv:aDFPB0vs8NNo8ExLcJw7qtQvWbCb1XK6TJrHSK86qss=,tag:z+dypHAGUjEXP7Y9MHYWwg==,type:comment]
gitea_database_password: ENC[AES256_GCM,data:nhFn0/G7gW5rk996OZzlcTt7T9KMbP8MNM+ReFC8w1H9ZqBSJUbs3K+n68uQVrkOVSXE0cKpOR1VbQ+i+46z3g==,iv:bT4GRZZ83v47/EmeV2KaUFo+4qTT4T2AktFUpPiZdF4=,tag:OC9TInkAr1egM+xnBDizxw==,type:str]
#ENC[AES256_GCM,data:HJ81OxRD2xtNZKv+8oDqiT8mYpv45JMvjxU5pdmEKzl64SK3lQ==,iv:wStoC6XaZlvRPfbqti2CUbPrOOTt4KktaUp2ecVrggU=,tag:isOwKfNdQZAM+E8YQXBSFA==,type:comment]
@@ -56,16 +44,10 @@ copyparty_passwd: ENC[AES256_GCM,data:I3UYy4nJ0B6RnIp661O0VVqEmxloxxcroBKmNFcgoQ
vpncon_mex_config: ENC[AES256_GCM,data:4i356X97sBoRliskmh5ewcEwZHkpo37IhPcemKVdWJgWFWtA+AhTeEo4KQ3dRA1H/n8VjVX7CKZKPDxpmHfcUlnTLT0agtOjjyjf60kWoL8noJqcbDB4wGiYT910rPToVnYMFk0H2lerYp+/n2bhg8BHxn++VlPOOZsgla4El+FNXUqhScpAawySPSF36ocdRJ3r3DuflIhnTBXxSZukMf9Ux1uaFldSG7KasCQlStKy9O2Odd2AvAuGXOHch5KecRPT3WnonQ8oDJpuxbeaosLmtJKHL9oeXHPId2Unc1GNoOpnDC3Y/xGnrPb9WFXWYOSQ/1A3mNKwnVq0FEhluVbqodES4PVIlCS0koiQJq15P15G2z0jO+OhAQrRI5vn3Fki5A==,iv:tQvTpzhl7F7niigAXl61FMHbg6QqI2R7yGD/C2lwOR4=,tag:c+CVLd6lGrAfm38pFXOXTw==,type:str]
#ENC[AES256_GCM,data:ep/Z5O6RNFwTd0I5hvtk5DP9,iv:M7sclKcTR+IfCEsvz0lZaoZBRZlQsN/FhwuzFNXgVew=,tag:Ddo3Qf8tMBX9Amt7C9m5FA==,type:comment]
klefki_pub.asc: ENC[AES256_GCM,data:lGfgwhgn2xCb1cNTo0nMP8R3KSDiEn0/k6neDE2dv1DynvXsHWmZSXED6VWBjY3uMU3YtcpXGCtxTU6EiaRKiGnhxslQlBiSypAnXHeh55DZJMJJ/JM7+BCtr33LY2lusF9/aAuKO9tbdpGmu63s5ItZ1/9zMoCJwBfpQZgY2HzZoBhjwqYu2wSkOOVAMjq+jXET7nASieOZXmpQq2uDepuEDa8MP7d6G6kV2KYJPdLYYaY4U2eppEr7ALhhJidYm3P38W47JuLyu/2raG0AY2uDtCQw9d16BcJO3au+T4B4mHzPg1/cPhQ2X4dHTTGHjRZ0sT95DrEYYmcwWVKHKyiuL8WPtQmF0QBfCOPczwJajJejB4DbxEW8U2kuhuoBWr7wZe4y/nbW2hB3pcMYYXc0EXen74IttiUrvksw+hbkLaZDCJgG91SOlWSwI12UlDrJJSzOYm+ODWqK+bKyqAafQTL9xh5heM3nQlR5G6/A/8UG+0q5ZDL+IxJwe+EffJNwrL1mn4Rc3qx068udMJC+qzmft7Ljey7mfoIiwepITpii1IA/CtuEqtpe4I5MUemQ60qAw/PoVbmD8zhOcnRHCBZtQ394I5vMo1qR2a4KeBICexx3IAjpeAQYI3+MAgo/bedqpklLYjbxpv37XwinoLj9ew4hKSjAB1wRRZlswmk+GD4XKlVo8eu88RCXYrsZ2oaOD4qxrtbc7+skGm+EqxL67nLW5n9bSC2u95bFJ1386teSFhsJL9w3EFiBlQRtm5tvee/ipmr6D2W7SyfCnSxImPC4TgTwkAXziQ3XtsUtGqj0Tv1HGayaAQpYzlJaPzf7h8oanH1VaA+AgRq+RY1OjLZGHEz37jSbqhWOiIWxwJ7qFaqGB90cHq3s07qcWrDl2wUawFLTXavZ0IF3gj9KnFSIzW3+ANvedUCXOjai+zOKmpxVFZ4Bi4W3Dcbl9B+qa0Ly0NIgldi7PmqEvL3V4FnJs6WnwdagyhXOzdlKVlrAgGluucgqBpBZZfpN6uB+tdkbrqzsdMbr+H9Hwk3RUxRzAK9k+J9WRgY7eMazH0najJ1PYh9/UZJf0DKWRi2vZTlWW+6ZruJWTohOKm+7MCgvMEttIpNQfvK6+cq7p3vwPe+pmq0DznNg4LO7Uu3cXKq3zHjl08KGE04KZyfoJuZPr+XrF91AywZ03HlT2SBBaZtFld1VapccgB5DqgE1JfFg+TS4is9a8G52Ad9yh/abUmLohsnUpGdYMaj/1FmhSLM7ldHeub8CmL2vKW4f/JTuqmOxq3X5RA+qw5f946ekUz9ZF8EyGvNwaRZ2p5m0MtXQG2IKp8Q61aBSpqbMwKzTW93VycEn7L5ZsoV5eYo0rC4PMawGkfgdNzBpq4NL5bNB82l6qHnWqU7jXh611/ZV4ueX2MLSB3cyhnaFxsH9bat1jGDtUl5umNWNtvN6rWBVsClmYfBLSUCEyftGPlxzAOy6vRHGxAdCNdoiTRGgZru3aYyW9l5XhYH1aZ+dOlTOwngaqqIb3kZoPzcc9xCeZ/I/N6iVuTUI69us8y3LVL6qKa6az5zTTgumoFB5kMugPtumS1U9hzhLtm9+hY6yZVgYredgAwVVIviMAqFFZztFkPiskcwIdrPhXzoXwfuBWDaq+dF9nykjw1F9U2gyDU0YhEOtSmdIWoIma3OmdOZ/h/JbWNrwUoAirmBmWIHQTmA5Ag==,iv:btQ5xmt/AA9vW1njJH4Inj6YmOBx6pGbHbsvCMbg7fI=,tag:DuQ4Wy9wX3mPQAVLLd6t1Q==,type:str]
#ENC[AES256_GCM,data:lP/UhYvW72t/Ql94rzxb,iv:rAoO8xytnYBTiwqGjxJTWBINaX/W0IOTBhYu8bx1dR8=,tag:RURjkKrFINdbz1RzXM6oGQ==,type:comment]
caddy_root.crt: ENC[AES256_GCM,data:8KyKvKCjRbzxTIm+OcacNt/h7jNxIApHlRF8T5G18qPg1RVC/XYHUZarichP6m7Z6GwcF9kBCCZ92UqMjskFNbekZZzXZ83FDeAMF76OzzSxW0iyL8sLOm7ApxcRxwIjLmEuR5gvneoamunftKoQevIP/QNyrpTM2oi9GfjE1TY9wwmJKeZpckEVqZcL94jimUXuPQrkvAdf/1mQ02PVQI42rKG6T8dK7bFsxoulRE+HAgwd7fqnBHhMZXvMS8B7GlrO4nfbxNzcO4/HeDWrhH8uADq4io2Gou6bSt+5Q0mqYVFpLA3SqW3FLJFTOmc0OxYyUmQWmMzQyDfI1efpdw64hQGQeZ1f47DUgoVMOMGpvJr8TiPRiEZ0+cxO/jvDTTM0ru9OcLyzSJcVy7z/KjokpF8hCYyDOTlR8tbzomGSJRZGNnsAF7IR7b0bwSfe4MVA855V+Qx10912qRid6W0thNSorL7WO7dLxptJCVvw4gt4M1k6lwRzc3DmhtST7bhgJqh66w94vah3QCRRJ+WAI+pn3wMZD9GiuRBu11dYudUCyebABR601wi6T8cSp4jUXfDwUWq0IkQUcmdPsbV3CA5EuDATQDfVJG3L938sv7oFGud+NLxziAfWBMy5tPzWNOXCh24uG8D4bG+rKtVQFIx1aVxAxLHL8858WbuFw9YQ8Jh7vBOqqSGDa18Xu9/68t5M1yPzs5oknxzTZ4Ti/TCzsOz6Y/GqlaBFWZIVzC8T12uBfUnfwe07i41XL4jNqfhv5WXBEnIaXXGcNOe5k0BocsGAWpV9iYxRKHndEk4op66rZTfOBzbMXOl7wGw6ZLsrFg==,iv:xxCwhxnxvpWJF8SAI8nctHigBa/OJrrc7KJY7VZ6aag=,tag:EIhIbi+niFLw5X4Z/xWAyQ==,type:str]
#ENC[AES256_GCM,data:ODJOtUINaKPcvckAuk0y+FqAl91xuhmfaBys2UQ7,iv:ZKMV/ma7whPAlCYY5OzOM91QgLvb3v9J92rVB72fduc=,tag:DuZxO2X8grqVbpqXglUlaA==,type:comment]
#ENC[AES256_GCM,data:7V0L0832xewUXU8/Bq469w==,iv:9bCzEpUcNx6qnCMomFweXgYmWwSMzdffDikjA22xu6E=,tag:F4S80e/EPXA0tS20KFRbXw==,type:comment]
id_snowbelle: ENC[AES256_GCM,data:MAw5R2fqVIctN7fB/d3hfCU7W3sxvuy2O3w3n0vD8FxK1DAhqoROlVv04joV1a+U1hof57TYc1cN2ng9BRWxadc8ZIpWakokZYVI0dUG05/hPMyxctWPkOiDd5909aaNUFC2G+Y/VrgAemyrB+AlQgokV0U3fiz+qjg055fzO7ypaeM8okON6rBnigfwetmSm60MxpdYrVlxVaniDVvKKUYZjpHU8SZ+TYj6Jmm/bVuKWOJ2DXZbmM0CeKeIgnA9HML1wSXojMv2IMGulxq5mmdaiiJTPoL1q17OA5zZkkVW3Dx1y6SbEeBAQTPG32RHseAxXK6qdU6lftRQZKyivuyjdCVfBBw/VzqTxbWjSXXsjDdK/Ti09051w6znA1uvRX65XsOq6zPKt4BNwR+yMDF+xR9AElBTHES/TDf7TRc5YDyovlH2PhGNg12Coy3zfb6WESLyaz3/GYZxF0IjvBnDkN65CRjstut0CgKXcWY8x+CuKVysU+U4c0A2ucDnsf3HuITrdIufhAwRNNZMka7LWVsaaR/tnvcf,iv:agf/LEjohw1XAXsOJJ78kiBVJnTT95IUmWzYUujSlJI=,tag:a55o9L85a9Z7gG9s5BEfIw==,type:str]
#ENC[AES256_GCM,data:wqoh4/WaghcWWifBKYINlE0ovUVJNepdPKnLMXI=,iv:vpTOcdoejeMffDKLVPHmTR5u1rsProi7vtttFjIyp/E=,tag:PtjKubpLJLP+Bq7GQMknEg==,type:comment]
#ENC[AES256_GCM,data:ozhgyE+IyqR10KT8vI9x,iv:+ZOTucRlCZRQ9ZbxZgySPMOJ/qU4gXbhSyLAMgt4QMs=,tag:mQ3X+dqCet1Yk1gZ5pZ5gw==,type:comment]
id_snowbelle.pub: ENC[AES256_GCM,data:rQ32bqwknbVssJDN4TW72YrusMPQJRFTfpoH2M2ELsAf3DkXtchGwOSjEbeR9ezUgHkTD96rFm5JvjDFQukAOpBHfMP5aRVy6RjTtb8j7aAD+EGUEpBSAVspZKQAWAqyDQ==,iv:8bEgvJgWpu7QwsrWhkjUw3GtRI92Pn7TT0rXCQ/i2Js=,tag:EnUehKMncN5v4dZZ/es3Qw==,type:str]
#ENC[AES256_GCM,data:7om13qUta/huBOBYv0et6mcjhBgI9DdNZTQaNXko,iv:WAedsXER0vgArZriZeijZy3oCcLJ1ElN0Xp8uk3Pou0=,tag:OII5cT3U2zW33E2J8TgqGw==,type:comment]
id_vaniville: ENC[AES256_GCM,data:j3gjSzsocXT8Y8f8zwQui4kh/wF5k2rsj1YzoCPBUufoM+W1O6cr4AzIUswdd7czGzatRrstg9dOsEHSjj6og1ZJlKcIIgeW6N7KYv5hWjP/vaDQNO/PewKT+OJS2I7iMPsOeNYRCb0Dd/L3Fc0tE+TXqTqUWz0+PXkcAtYXgjNGh3DF4RmRzBd0A5FBpFNp7Yo/NzDfduDS9SNltOia+4W7K1QlG/xNbNUH9WA4AbHv+GQuZ8mcYX/yz1poOVFUpQXZO82kj/AwlmpULiW1gbYyBF0YKd7ZHowxfN2XuJQq21Yz7lsbJYfRiGmYO79ZrU/uZLX9MLAWPwZ/ETcet2SXiuhwuKP1SsFKebhPNPzd6XkBj+riGJDE/4kVF0aCJSP0rO7rEnQ2qdNkr56HokVNHITQelsyHIGhDOdBwkqHcCzqcLh2YyaiLo52eUrjygluczZG/ZA9+qi3sLW5vhttQ5c+UQ+PRn8o/KY0/CM7Zmk7RfFQysEvelURq8adqVGCceqyGyBJgDRMurb1x1kx71tOO62l7NTo,iv:SVM6EP+4wbVuK0JSoZoTfMLYjenHHZPuo6BuTtRjrcU=,tag:Y/OjbwL2TOOIEEL/8nDDRw==,type:str]
#ENC[AES256_GCM,data:PNAQCwHAPgurYca1MtGFVWTQGU7APuATymjRHtQ=,iv:NOt49fqLAZLdpyZ8ZJyx5n30qP8GEPEhyFlMxkVyZ7E=,tag:Kw9VASFq03q6RLVsL/1FPQ==,type:comment]
id_vaniville.pub: ENC[AES256_GCM,data:JiYGJklP12BSGx0jMzfYTNn3MkJSEjCoMR3bKLPjuaD0lab6mTIsQ3vXsyR44Tu3fknCWdcJXNJ0gUX42CfUzBF4QU+MixMFaCYvaEEBv2do39LaRwpkDEYSpYn3fyQWLQ==,iv:NxL7sZnFwJfcRkkwCf4G/e+hHTCLi7/lui2Ty3VRJso=,tag:bdYZH7UywWUQYOGLPUZrLg==,type:str]
#ENC[AES256_GCM,data:lS++LQwlDVP0aYcdaaudBkKxNB3P3UBE,iv:UqGcXcX/Jvf60o409Cxj7VJCDh63uUxy45PuZbHK2l8=,tag:OXdMwuJwdN8DQaLXACpcRA==,type:comment]
ssl_blakedheld_crt: ENC[AES256_GCM,data:OPrDCh56XdRLslAcx/vw9l7gvc42no+QzB9tVSLHtcHbWWqb+hefvAE6xnfMLlt5+BRuAJRvspA6kx/WfagjFuN7q3HAHPt/FcfZPCYZNT5wXZH59wtV8JkVtLKnCxqSUXrah9a/WrHkU7njzoWql53eoAXEt58mvxyxZihqZd/uwinZt/T4QsevmikIsB3LB7AQtUHfsHd13ZFAaGiA+Mnncdl6Nt5s3U4yTuUxhfmYwr2cuyL+Li5eNzdO2ZooXBySdp4Ym03rpBERuh0U8a7NNj5ZaoHW1f0AyFRRKQ7RIHHyhQNC6hL2eGqsv+hTkJCJKxOCYKW1cF9rDt6bueKAm7zk3RTw0Sk7eXaOoqulCf8vBcMf4ckfH5mFVUpSHuwc4lfIZExjggn2i7Bu7xGIOLqC1RL4S5cuhLGUxzgvCiKMcMmaZZcT+fZa5wiHzv2vaCzXuYRb1rNi0xoiAZcL65yIV0NGtP0mOFygdY2hI4R7itbcE0MGIbwdOuWkCRs19WVFchNgcV7GnZBUVKAbhFXq+GilWLufODJr4Zxc1NpxRjG4flWQl3A3jGc4+tW5Infa1n6XPmhHz6JjyPE2mVbLq4JORPHeMcN4Wbckrmio0ruJu5rV9J95HYceXJIF2dw7AgmaWEX67JCHJPbAg5n4zRrfraeMwKB7XHTMglTLbyQsw7zkqzGDpT6ztOn/uCtErEmU0LSlIcOzz8WdGnnWbReMLiUfrQwuKvJhwOpcr9t+FVAtDyjyZhL/PTDy4/qIjQNPwBiVMKzv1CV/eA1WHcYKb6oRvP2TAlh82mA5uIE1jqY9QXg1cfMl2ncnsHnv3d1iFHy3OxvmWwvve+1zzJ2jubh+1ZwKAjP/9UEq9eldyFqC86qYKYGXec5j4Q4QGrMN4AiObVI/yDnRdeWal8jM8p5cz56rgBesDX7/ljR5wjifdQ5s4Iao2exPrHAWtiJHWE1i4R1g4rB+h8piu4feZXiPh3chdxrUrxCaQK0N0nOkN6+F7y8rbd6egk9Q5xvjNlJGzJGiSQ9xhDYmnPZtUTWXL3KioIPwy2/yh+lpkG/JrUacgc+HaHO+DsXs2NhlObrcswo4zmZ1eEckwFSpl1iP5ABHTxNVY0V6pdj1+7YyB+wav8tlVfguyxLf8JV7dqVnADCV+R5D5rBikmoJdjgdZwNxO0QBaZFVLeaCSgoCVEfvSPFtL9cMnEhLhdtw+k3U53+JJYemRfdh48DAM01Na2b9q6Ey2R6YrqtONVIauMNAaKXOeaJCxJhYVBqB8yNiAOOhyJ/Wvzq/CUM1QsXHQvwbndAxmyeFc8XSo7HZZME9m11fNvcEdWfdm63BpwkrHKPzQc7sR6tKeMy7l48f1baPTNoevEd0vFeURHoOggrnyBeO4q8YdLCderFmsSOzyDP+KjDxwTE6u+4P2xMXfnjwTpxLZInV+sNPsgaMj/bBeOJr7m6IN8N3/jxgPiBTGMObiVCIzhXL/VP352xc7Vbh5ZjMvuXQIPWCodPjWV6kcK8EvanN/l0vbDh1MxMAFiqj6tRHUfB0Px0JiC263kR0vzEDI1K6qEfPmPjA8TiDo1tK,iv:qdtzMcF1iELnhrCs3SboRcAsnw/0WgcUpWWHzKHNEYc=,tag:TkUMk8Wp2OTQd8CRtS07Wg==,type:str]
#ENC[AES256_GCM,data:3G8XqUKua1QgUxv2YJkW0fDnQPX7+v8GDC9BHg==,iv:BkESkMmMalgesy9why9eaKkOOvwSsN2EhNCRRRmZNtA=,tag:x95zt2B2M19BkzeMpAlXIg==,type:comment]
@@ -75,7 +57,8 @@ ssl_recpro_crt: ENC[AES256_GCM,data:CiD7qdfWzi+7iA7qCD+w3UJdpxZByk2kmpw8YW7K3C7O
ssl_recpro_key: ENC[AES256_GCM,data:ev/g2sKFia5xcgZQ3LsfT0H9AaShYwxglzZadBhvknzFVwWxXGmGfHgKD6GM01fCIFOpB2pPGiiOTpgBh2xoRnPmivsApWoxxXgdVfzEEVbuB5pHAJSHWX5EUEqeiTz83zfbJAC5FZFwlIEQTL3YiPhRzKRWwEpMyYigsZmUAv3970XlDTAxDRgaPc4eHFI2ZrEXGmevnBoHOQPwXi+JCHqSCyhbPnsuU1InIcp4PMlX4/K+WknDT0HaLonIVXds237E8lOCJFAo4Ow3/zHho2B/tBZeqcHHf4P49SaSEO1CSCzTrW+1N1n+EsPo3PPld7AZ3klnsiKltorO18GM+2L9KGg6LbTiWm6FCOk2bMIFg9q1b183SSzeDx9CzhoXefsweMdn9BFBF1BVUObHGgYE0dpme20S43C+NVTeVt9+gjOEYysx/II8m1ui0UzpW+kYRdMLFjepYHlIZRA/jUEfdVssqKsX492n9bX5TRPc/9LN/o6oDg4CZjZXPILjD+Cg1NOW5ZSJrKvbFGRVNVeVlC5+idUqnaKP0Jh6nG/8niEBIyV51YGy6/ukruHyjMiH//iG9oE2xfLwjQGTUKhERxYgKOnisHkH7b7feTQBq926BgtWP63zchkCYz9sQTh8LzmfitXEBYUpRvDdxlnZ7m6I1ssemY7bFCnx2rZEpHRg9LxDG+UNgiODwm8YvXQbL7z+DPSVzG5QdRbhlS+deYMjquLBvWpMfUrJ8HxurLyvcZiTRqRSBmhlc+08Y3/j0RaSfmDdtId0HGKvokSoB7daMpgfKeZs9ddpvmEVYto4bER0Y2xfumgUq/VuhSR/H6KhuR++8JSnDZxPS5WtoH3eVOXrDIRKadiwYzx1r9dhek55iVLZ7uF/YGhxS4DD7gFsJJk8/usLnu7PM2UsoPhfhg69CrigFZRa6I1qdPSon3ODYxlJt1KVLgyNkJqjG06t96i3NcJaIm5tZNsGRDKrU8Jh6EiSzCquGOy4oblpE7lCdK5mlHXL5a0WRiaWTUqo27qTGT7o5jskXHQw8X+/iTP6LO8GpDcL/YCpF/HpV3JiuHLifJoV3u6Cj5qFyCfxF6k7h1gXUZxdMtovpicbzHeJS+4pAnrdR6NmavjlBKDZFRa6cUY0011ZuA4HYm4SdEPTCyEzOLNsmx4iwNao/jH1sPb6hQxfQrI/2xbKJYLeGJBDagCjEOB+bo1sUaTepDVSHAGUVpb6ZdW98AUs+zOiKAhE19H1NRuRRQcyq+6fMFh1+qyIoIELiJNlKcTjv53r30gyvnbz+FPLWqqvskZhRnwrF5JFFqwZ8Rkt/sS8TCQVT3ZGfOHF3J6yApb9GKQVu3D45efUePaPrGHVtWdJmQRVpQNKDAYoxOWT6yMhHH96juDh17QrqSvD6M+NqydP2K4q6zQE4rfSkTz9xPR/O7SvLUIZ6jDKj7TfNqOIpqVLaq8wiSPB3MW75RZKiGqcyH4aiEDgpYJRatF3+qZPx3zyUD8Oh5teEWya/HdqqW24a8FdmuQvdwE+ksCpeMJrVslQNDWpwpmRgJe3Nal7/qhdxh92WBSSteHmRSoFLKDwZAUa/f6Np1SXR7sc9fNeIggDvv3Ctx8LrUWpYTae1iGcaa8bwMPiwYXs0tLF+wmQHSypcMdl9CH76jhBRM+8cBzshiCISzJ4xrVUi91or5eOtXHaUM9BOqVZb1uykU/mkWWGQqdzo5Ng9POWUBxLvR4JywSVo4BaDawRykevOjM8JZFGYLfyOk45+MRRuESJWYnjf6P3V3f8l5Ai3SL0g7q/BImZ09iC2jTib8qlRrLMMJ+OQqx45TeCwicBnmV2hqz77KYvikgYLpYQUGkFKcqpP17nXKajbkvEP+2pIQQp6GRptp0Q3TvbOSZSvBJCmr6/6AQ2EXxTKMS2caUsw2bH2btkk45epPKJY1Qg1QOcjRwCUzy0ametW85M+5a3TSKjYAT5lNDb84q2mdMwy5giSI3iglUemcNYFurVlgGcY2CJJw6xi6UiqaqGIEhU9Sn9ns0cHejtu5Uoy+jxyuNaHyuH/f3pB/jdkCzkyTrxT4j5Lpdu6+Le4MdRbn+FGVtopn0LuoqHG8FhourPmpkQxdwA2Yq9glf9MuqiHz1aDri5rDQs/fdCYffvTxEEkZMvYdNIL+m/9talRX7wS1CffCqUrglcfKZxsbvPY9pK9YSxhOmtyZ/vyRBAMlA8Daz0o0mV7czV35tTPPoD36pgo04JenFRaKopwgyQ,iv:682Ok4M7ptRiWBytvbbiDyBCKBdZ51AIn7VWA62GdBk=,tag:UWsWZnDZ10dMF2vAB8V8tA==,type:str]
sops:
age:
- enc: |
- recipient: age14gfh682a7m7jfp3qrulql03x5rs7yedwmxwksxrrmgjsunstyuksqx93pz
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1WkdJMnJ3Y3IvN3lkemJK
RjF0dmgzT2lDcENka3BlK1NQRTBuR1BtSmhnCmI2cnRWdVpIM2t5SWNMOWNWdG84
@@ -83,8 +66,7 @@ sops:
U0tmdFBuZnJES3piOTZNV0VKQmQ0eVUKCWRQ/flLzmpC64WyLoipklZBmrkpYiUg
PRu+itNolpPTHm96pe+P93g2iP0wgekG0cX21wkiU2xaLF3dY2FEIA==
-----END AGE ENCRYPTED FILE-----
recipient: age14gfh682a7m7jfp3qrulql03x5rs7yedwmxwksxrrmgjsunstyuksqx93pz
lastmodified: "2026-07-28T14:33:14Z"
mac: ENC[AES256_GCM,data:bEcpoMFzXbK4WCs94Y4I5CDo9JDC4/6iRMfgc41m1o8/qJhKyJUWWZcPhJSaRSituTYyPjSe8aB6k2Vwpgcd+hk41JC2Op09mnjBWfDQz6Ts0YbZAnZ/dV4IrzdxYRtM91EXmJnROeiTftGgYN/6Awa8I+ie3UFBl8u6/5UoD7o=,iv:MIhnNS9RGFWKJ0LI7Ae9gTEcGzfKwQB4bg4oSAs8/Go=,tag:W/zfVpxn+sRa+FOrR9fKyA==,type:str]
lastmodified: "2026-01-28T21:02:05Z"
mac: ENC[AES256_GCM,data:b9aX43ViObNX29DkVNHtwkQRm26PRe2rZYhDnL1ZYLLWyaO3OGP9+rM4vHT0lyuowQ6+Ur3IMPVpUSziXYLh3mtxr0hyYy5Y1miBuIxXYLBi3oLRTW1TgZdklzFDVL3c1GT4lXEh4q9KG3dP64r9/8dvjO2iRIosZ93/l0pIi3A=,iv:/gdNfVy8UiQsIRAHh2jiha5fL+wmfgp0srxt17Ry4Xs=,tag:YdVbvpBnQSaIarGIfiTzKQ==,type:str]
unencrypted_suffix: _unencrypted
version: 3.13.2
version: 3.11.0
users/blake/default.nix
+7 -10
View File
@@ -5,17 +5,16 @@
inputs,
...
}: let
platform =
if builtins.pathExists "/System/Library/CoreServices"
then "darwin"
else "nixos";
platform = if builtins.pathExists "/System/Library/CoreServices" then "darwin" else "nixos";
in {
# create blake user
users = {
users = {
blake = {
isNormalUser = true;
extraGroups = ["wheel" "networkmanager" "docker" "media" "podman" "minecraft" "archives" "immich"]; # Enable ‘sudo’ for the user.
extraGroups = ["wheel" "networkmanager" "docker" "media" "podman" "minecraft" "archives" "immich" ]; # Enable ‘sudo’ for the user.
uid = 1000;
shell = pkgs.zsh;
group = "blake";
@@ -25,9 +24,6 @@ in {
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBK0AGJfZGyqW8/krvQV+PL7axcDW/EnKyHy9M8wryQx klefki"
"ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBPdC9cCX8awvA19Ri65fvbYjZYe8X1Ef+nOZAIv92AS6u4SkJYqOvPYfqRHXORNDpbzjTV6nackyCKvV5EO4niv4MFIgdkEQwuVHcYX32/dOsWdDoeXBT/l2sFFM7JESwQ== blake@zygarde"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOVsjLEbnW/KeFXogppi0AP6ZbCZpObu7zFeRV/aLkP9 blake@lugia"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHJiskD81/2bd63sbJVSN0xPNwnbCGXheIBIKrwShDoo bhelderman@cen-it-07.local"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO06en1r4+zg8JMGPq7WiZeh/DBUvfhDJX3e+J5Z5Ttk blake@snowbelle"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP0FLKK9yEPYpGuCjoX0e7Ky/zTPfzDk7IkrR3tOmELP blake@vaniville"
];
};
};
@@ -48,13 +44,14 @@ in {
nix.settings.trusted-users = ["blake"];
programs.zsh.enable = true;
sops.secrets = {
"blake_passwd" = {
"blake_passwd" = {
owner = "root";
group = "root";
neededForUsers = true;
};
"klefki_auth_map" = {
"klefki_auth_map" = {
owner = "blake";
group = "blake";
};
users/blake/dots/core/gpg/default.nix
-1
View File
@@ -6,7 +6,6 @@
}: let
program = "gpg";
cfg = config.dots.${program};
isLinux = pkgs.stdenv.isLinux;
#sec = sops.secrets;
in {
options.dots.${program} = {
users/blake/dots/core/lf/lfrc
+1 -1
View File
@@ -23,9 +23,9 @@ set ignorecase true
# shortcuts
map gb cd /holocron
map gz cd %{{ [ -d /holocron ] && printf /holocron || printf /media/holocron }}
map gn cd ~/.nix
map gc cd ~/.config
map gv cd /var/lib
# navigation
map [ half-up
users/blake/dots/core/nvf/default.nix
+9 -33
View File
@@ -24,19 +24,18 @@ in {
enable = true;
settings = {
vim = {
clipboard =
clipboard =
# On Linux, use wl-copy as you do now
if isLinux
then {
if isLinux then {
enable = true;
providers.wl-copy.enable = true;
registers = "unnamed,unnamedplus";
registers = "unnamedplus,unnamed";
}
else {
enable = true;
registers = "unnamed,unnamedplus";
registers = "unnamedplus,unnamed";
};
globals = {
mapleader = " ";
maplocalleader = " ";
@@ -44,35 +43,12 @@ in {
vimAlias = true;
# fix indents
autocmds = [
{
enable = true;
event = ["BufEnter"];
pattern = ["*"];
command = "setlocal indentexpr=nvim_treesitter#indent()";
}
];
lsp = {
enable = true;
formatOnSave = true;
};
lsp.enable = true;
statusline.lualine.enable = true;
telescope.enable = true;
autocomplete.nvim-cmp.enable = true;
autopairs.nvim-autopairs.enable = true;
treesitter = {
enable = true;
#grammars = pkgs.vimPlugins.nvim-treesitter.allGrammars;
indent = {
enable = true;
};
};
keymaps = [
# visual line movement (insert mode)
{
@@ -177,6 +153,7 @@ in {
];
options = {
# line numbers
number = true;
numberwidth = 2;
@@ -187,6 +164,7 @@ in {
shiftwidth = 2;
softtabstop = -1;
expandtab = true;
smarttab = true;
autoindent = true;
# search
@@ -209,12 +187,10 @@ in {
};
languages = {
enableTreesitter = true;
enableTreesitter = isLinux;
nix = {
enable = true;
treesitter.enable = true;
treesitter.package = pkgs.vimPlugins.nvim-treesitter.grammarPlugins.nix;
format = {
enable = true;
type = ["alejandra"];
users/blake/dots/core/ssh/default.nix
+5 -21
View File
@@ -7,8 +7,6 @@
program = "ssh";
cfg = config.dots.${program};
home_dir = config.home.homeDirectory;
isLinux = pkgs.stdenv.isLinux;
isDarwin = pkgs.stdenv.isDarwin;
in {
options.dots.${program} = {
enable = lib.mkEnableOption "enables ${program}";
@@ -18,7 +16,7 @@ in {
programs.ssh = {
enable = true;
enableDefaultConfig = false;
settings = {
matchBlocks = {
"*" = {
identityFile = "${home_dir}/.ssh/id_blake";
forwardAgent = false;
@@ -32,38 +30,24 @@ in {
controlPath = "~/.ssh/master-%r@%n:%p";
controlPersist = "no";
};
"git.holocron.blue" = {
"git.blakedheld.xyz" = {
user = "gitea";
port = 7567;
};
"git.lumiose.holocron.blue" = {
"git.snowbelle.lan" = {
user = "gitea";
port = 7567;
};
"shauna" = {
"bebe" = {
hostname = "10.10.0.1";
user = "root";
};
"snowbelle" = {
hostname = "10.10.0.10";
user = "blake";
identityFile = "${home_dir}/.ssh/id_snowbelle";
};
"vaniville" = {
hostname = "96.126.127.102";
user = "blake";
};
"lumiose" = {
hostname = "10.10.0.11";
user = "blake";
identityFile = "${home_dir}/.ssh/id_snowbelle";
};
};
};
# manage secrets with sops
sops.secrets = {
"id_blake" = {
"id_blake" = {
mode = "0600";
path = "${home_dir}/.ssh/id_blake";
};
users/blake/dots/core/xdg/default.nix
+24 -25
View File
@@ -14,37 +14,36 @@ in {
};
config = lib.mkIf cfg.enable {
home.packages = with pkgs; [xdg-ninja];
home.packages = with pkgs; [xdg-ninja ];
xdg = {
enable = true;
configHome = "${home_dir}/.config";
cacheHome = "${home_dir}/.cache";
dataHome = "${home_dir}/.local/share";
stateHome = "${home_dir}/.local/state";
userDirs = lib.mkIf isLinux {
enable = true;
setSessionVariables = true;
# writes ~/.config/user-dirs.dirs
desktop = "${home_dir}/desktop";
download = "${home_dir}/downloads";
documents = "${home_dir}/documents";
pictures = "${home_dir}/pictures";
videos = "${home_dir}/videos";
music = "${home_dir}/music";
publicShare = "${home_dir}/public";
templates = "${home_dir}/templates";
};
mimeApps = lib.mkIf isLinux {
enable = true;
defaultApplications = {
"application/pdf" = ["org.pwmt.zathura.desktop"];
configHome = "${home_dir}/.config";
cacheHome = "${home_dir}/.cache";
dataHome = "${home_dir}/.local/share";
stateHome = "${home_dir}/.local/state";
userDirs = lib.mkIf isLinux {
enable = true;
# writes ~/.config/user-dirs.dirs
desktop = "${home_dir}/desktop";
download = "${home_dir}/downloads";
documents = "${home_dir}/documents";
pictures = "${home_dir}/pictures";
videos = "${home_dir}/videos";
music = "${home_dir}/music";
publicShare = "${home_dir}/public";
templates = "${home_dir}/templates";
};
mimeApps = lib.mkIf isLinux {
enable = true;
defaultApplications = {
"application/pdf" = ["org.pwmt.zathura.desktop"];
};
};
};
};
# misc env variables to get things out of ~ (<3 xdg-ninja)
home.sessionVariables = {
users/blake/dots/core/zsh/default.nix
+58 -86
View File
@@ -7,7 +7,6 @@
program = "zsh";
cfg = config.dots.${program};
home_dir = config.home.homeDirectory;
isDarwin = pkgs.stdenv.isDarwin;
#sec = sops.secrets;
in {
options.dots.${program} = {
@@ -24,6 +23,7 @@ in {
programs.${program} = {
enable = true;
dotDir = "${config.xdg.configHome}/zsh";
#dotDir = ".config/zsh";
autocd = true;
enableCompletion = true;
@@ -41,99 +41,72 @@ in {
path = "$XDG_STATE_HOME/zsh/history";
};
shellAliases =
{
# --- zsh ---
src = "source ${home_dir}/.config/zsh/.zshrc";
shellAliases = {
# --- zsh ---
cfz = "nvim ${home_dir}/.config/zsh/.zshrc";
src = "source ${home_dir}/.config/zsh/.zshrc";
# --- config editing ---
cfl = "nvim /home/blake/.nix/users/blake/dots/core/lf/lfrc";
cfz = "nvim /home/blake/.nix/users/blake/dots/core/zsh/default.nix";
cfv = "sudo lf /var/lib";
# --- config editing ---
cfl = "nvim ${home_dir}/.config/lf/lfrc";
# --- navigation ---
# ls = "ls --color=auto --group-directories-first";
# ll = "ls -lh --color=auto --group-directories-first";
# la = "ls -Alh --color=auto --group-directories-first";
".." = "cd ..";
"..." = "cd ../..";
fs = "du -h | sort -h";
ds = "du -hs";
gn = "cd ${home_dir}/.nix";
woopa = "echo backwhack";
# --- navigation ---
ls = "ls --color=auto --group-directories-first";
ll = "ls -lh --color=auto --group-directories-first";
la = "ls -Alh --color=auto --group-directories-first";
".." = "cd ..";
"..." = "cd ../..";
fs = "du -h | sort -h";
ds = "du -hs";
gn = "cd ${home_dir}/.nix";
woopa = "echo backwhack";
# --- shortcuts ---
vswap = "cd ${home_dir}/.local/state/nvim/swap";
rswap = "rm ${home_dir}/.local/state/nvim/swap/*";
v = "nvim";
sv = "sudo nvim";
vim = "nvim";
mime-type = "xdg-mime query filetype";
mime-default = "xdg-mime query default";
# --- shortcuts ---
vswap = "cd ${home_dir}/.local/state/nvim/swap";
rswap = "rm ${home_dir}/.local/state/nvim/swap/*";
v = "nvim";
sv = "sudo nvim";
vim = "nvim";
mime-type = "xdg-mime query filetype";
mime-default = "xdg-mime query default";
# --- safety ---
cp = "cp -iv";
mv = "mv -iv";
rm = "rm -Iv";
# --- safety ---
cp = "cp -iv";
mv = "mv -iv";
rm = "rm -Iv";
# --- colors ---
grep = "grep --color=auto";
fgrep = "fgrep --color=auto";
egrep = "egrep --color=auto";
# --- colors ---
grep = "grep --color=auto";
fgrep = "fgrep --color=auto";
egrep = "egrep --color=auto";
# --- scripts ---
motd = "sh /etc/motd";
rebuild = "sh ${home_dir}/.nix/bin/rebuild";
perms = "sudo sh ${home_dir}/.nix/bin/fix-perms";
# --- scripts ---
motd = "sh /etc/motd";
rebuild = "sh ${home_dir}/.nix/bin/rebuild";
perms = "sudo sh ${home_dir}/.nix/bin/fix-perms";
# --- git ---
status = "git status";
add = "git add";
commit = "git commit";
push = "git push";
pull = "git pull";
dotfiles = "/usr/bin/git --git-dir=${home_dir}/.dotfiles --work-tree=$HOME";
dtf = "/usr/bin/git --git-dir=${home_dir}/.dotfiles --work-tree=$HOME";
# --- git ---
status = "git status";
add = "git add";
commit = "git commit";
push = "git push";
pull = "git pull";
dotfiles = "/usr/bin/git --git-dir=${home_dir}/.dotfiles --work-tree=$HOME";
dtf = "/usr/bin/git --git-dir=${home_dir}/.dotfiles --work-tree=$HOME";
sec = "sops ${home_dir}/.nix/secrets/secrets.yaml";
# nix shit
sec = "sops ${home_dir}/.nix/secrets/secrets.yaml";
# --- systemd ---
stat = "sudo systemctl status";
restart = "sudo systemctl restart";
start = "sudo systemctl start";
stop = "sudo systemctl stop";
jou = "sudo journalctl -xeu";
live = "sudo journalctl -o short-iso -n 50 -fu";
# zfs
dfzfs = "zfs list -r -o name,used,usedsnap,usedds";
# --- yt-dlp ---
yt-music = "noglob yt-dlp -f 'bestaudio/best' --extract-audio --audio-format opus --audio-quality 0 --embed-metadata --embed-thumbnail -o '%(playlist_index)02d - %(title)s.%(ext)s'";
# --- dumb shit ---
fix-music = "sudo find /holocron/media/music -type d -exec chmod 2770 {} + && sudo find /holocron/media/music -type f -exec chmod 660 {} +";
# --- systemd ---
stat = "sudo systemctl status";
restart = "sudo systemctl restart";
start = "sudo systemctl start";
stop = "sudo systemctl stop";
jou = "sudo journalctl -xeu";
live = "sudo journalctl -o short-iso -n 50 -fu";
# --- system ---
peace = "systemctl poweroff";
love = "systemctl reboot";
lock = "loginctl lock-session";
}
# use GNU core utils ls on macos
// (
if isDarwin
then {
ls = "gls --color=auto --group-directories-first";
ll = "gls -lh --color=auto --group-directories-first";
la = "gls -Alh --color=auto --group-directories-first";
}
else {
ls = "ls --color=auto --group-directories-first";
ll = "ls -lh --color=auto --group-directories-first";
la = "ls -Alh --color=auto --group-directories-first";
}
);
# --- system ---
peace = "systemctl poweroff";
love = "systemctl reboot";
lock = "loginctl lock-session";
};
initContent = ''
@@ -144,7 +117,6 @@ in {
alias lf='lfcd'
lfcd () {cd "$(command lf -print-last-dir "$@")"}
'';
syntaxHighlighting = {

Some files were not shown because too many files have changed in this diff Show More