blake/nix
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: blake/nix:trunk
Branches Tags
blake/nix:trunk
..
compare: blake/nix:ae5c5959bb6aa765efe32e05065ff848a1fdf247
Branches Tags
blake/nix:trunk
1 Commits
trunk .. ae5c5959bb
Author SHA1 Message Date
blake ae5c5959bb add directions for darwin bootstrap 2026-04-23 16:23:28 -05:00
116 changed files with 1742 additions and 4813 deletions
Expand all files Collapse all files
bin/bootstrap
-136
View File
@@ -1,136 +0,0 @@
#!/usr/bin/env bash
# this will one day be an interactive install bootstrap script for my nix config!
# right now this shall be treated as psudocode but also just a list of steps for installing
# without further adoo:
#
# 1. boot target device into nixos installer iso
# 2. `sudo -i``
# 3. `git clone https://git.blakedheld.xyz/blake/nix.git bootstrap_nix`
# 4. if new host use `ls -l /dev/disk/by-id/` to get the id of the target disk and update the related line in the disko config for that host (or partition the target disk manually however you wish)
# 5. run the disko install command `nix run github:nix-community/disko -- --mode destroy,format,mount --flake bootstrap_nix#hostname` to just format the disk(s)
# 6. generate hardware config `nixos-generate-config --root /mnt`
# 7. create directories for keys `mkdir -p /mnt/etc/sops` `mkdir -p /mnt/home/blake/.config/sops/age`
# 8. move nix config to home dir `mv /bootstrap_nix /mnt/home/blake/.nix`
# 9. copy age keys.txt to previously made dirs `echo "<key>" | tee /mnt/etc/sops/keys.txt /mnt/home/blake/.config/sops/age/keys.txt > dev/null`
# 10. install the os (let it fail, fix it, repeat, etc) `nixos-install --flake /mnt/home/blake/.nix#hostname`
# 11. set the root password
# 12. reboot and dont forget to `sudo chown -R blake:blake /home/blake`
# 13. change nix repo upstream to ssh `cd ~/.nix && git remote remove origin && git remote add origin ssh://gitea@git.blakedheld.xyz:7567/blake/nix.git`
#!/usr/bin/env bash
set -euo pipefail
AGE_KEY_FILE="/keys.txt"
echo "nixos bootstrap installer =="
# --- input ---
read -rp "hostname: " HOSTNAME
#read -rp "age key (will not be echoed): " AGE_KEY
if [[ ! -f "$AGE_KEY_FILE" ]]; then
echo "cannot find age keyfile"
exit 1
fi
AGE_KEY="$(cat "$AGE_KEY_FILE")"
echo
echo
echo "install mode:"
echo " 1) disko (auto partition/format/mount)"
echo " 2) manual (you already mounted disks)"
read -rp "choice [1/2]: " MODE
echo
if [[ -d /bootstrap_nix ]]; then
echo "repo already exists, skipping clone"
else
echo "cloning nix config..."
git clone https://git.blakedheld.xyz/blake/nix.git /bootstrap_nix
fi
cd /bootstrap_nix
# fix origin
git remote remove origin
git remote add origin ssh://gitea@git.blakedheld.xyz:7567/blake/nix.git
# --- disk setup ---
if [[ "$MODE" == "1" ]]; then
echo
echo "running disko (THIS WILL DESTROY DISKS)..."
echo "make sure /dev/disk/by-id is correct in your host config!"
# nix run github:nix-community/disko --extra-experimental-features "nix-command flakes" -- \
# --mode destroy,format,mount \
# --flake .#"${HOSTNAME}"
nix run github:nix-community/disko --extra-experimental-features "nix-command flakes" -- \
--mode destroy,format,mount \
--yes-wipe-all-disks \
/bootstrap_nix/hosts/nixos/$HOSTNAME/disko.nix
elif [[ "$MODE" == "2" ]]; then
echo
echo "MANUAL MODE SELECTED"
echo "WARNING: you must have already partitioned + mounted disks to /mnt"
read -rp "press ENTER to continue once disks are mounted..."
else
echo "invalid selection"
exit 1
fi
# --- generate hardware config ---
echo
echo "generating hardware config..."
nixos-generate-config --root /mnt
# --- setup directories ---
echo "creating sops/age directories..."
mkdir -p /mnt/etc/sops
mkdir -p /mnt/home/blake/.config/sops/age
# --- move config ---
echo "moving nix config into /mnt/home/blake/.nix ..."
cp -r /bootstrap_nix /mnt/home/blake/.nix
echo "moving hardware into /mnt/home/blake/.nix/hosts/nixos/$HOSTNAME ..."
cp /mnt/etc/nixos/hardware-configuration.nix /mnt/home/blake/.nix/hosts/nixos/$HOSTNAME
cd /mnt/home/blake/.nix
git add /mnt/home/blake/.nix/hosts/nixos/$HOSTNAME
# --- write age key ---
echo "writing age key..."
echo "$AGE_KEY" | tee \
/mnt/etc/sops/keys.txt \
/mnt/home/blake/.config/sops/age/keys.txt \
> /dev/null
# --- install ---
echo
echo "running nixos-install..."
set +e
nixos-install --root /mnt --flake /mnt/home/blake/.nix#"${HOSTNAME}"
INSTALL_EXIT=$?
set -e
if [[ $INSTALL_EXIT -ne 0 ]]; then
echo
echo "install failed. fix issues and re-run nixos-install manually if needed."
exit $INSTALL_EXIT
fi
# --- post install ---
echo
echo "installation complete!"
echo "set root password if needed, then reboot."
echo "after reboot: sudo chown -R blake:blake /home/blake"
nixos-enter --root /mnt -- run --login bash <<'EOF'
set -e
chown -R blake:blake /home/blake
nixos-rebuild switch --flake /home/blake/.nix
systemd-cryptenroll --tpm2-device=auto /dev/nvme0n1p2
EOF
echo "fin."
bin/git_upstream
-7
View File
@@ -1,7 +0,0 @@
#!/usr/bin/env bash
cd /home/blake/.nix
git remote remove origin
git remote add origin ssh://gitea@git.holocron.blue:7567/blake/nix.git
git fetch
git branch --set-upstream-to=origin/trunk trunk
flake.lock
Generated
+159 -206
View File
@@ -58,11 +58,11 @@
"base16-helix": { "base16-helix": {
"flake": false, "flake": false,
"locked": { "locked": {
"lastModified": 1776754714, "lastModified": 1760703920,
"narHash": "sha256-E3OAK27smtATTmX45uoTSRsVD+Y+ZiVVfgM/tjpbtYg=", "narHash": "sha256-m82fGUYns4uHd+ZTdoLX2vlHikzwzdu2s2rYM2bNwzw=",
"owner": "tinted-theming", "owner": "tinted-theming",
"repo": "base16-helix", "repo": "base16-helix",
"rev": "4d508123037e7851ad36ebf7d9c48b0e9e1eb581", "rev": "d646af9b7d14bff08824538164af99d0c521b185",
"type": "github" "type": "github"
}, },
"original": { "original": {
@@ -106,16 +106,16 @@
"brew-src": { "brew-src": {
"flake": false, "flake": false,
"locked": { "locked": {
"lastModified": 1788591592, "lastModified": 1774235677,
"narHash": "sha256-NbwVKwKLFl0oXub7oPjvmDaOygCtV2oboeKTu4xXFTk=", "narHash": "sha256-0ryNYmzDAeRlrzPTAgmzGH/Cgc8iv/LBN6jWGUANvIk=",
"owner": "Homebrew", "owner": "Homebrew",
"repo": "brew", "repo": "brew",
"rev": "08e85c4e42f5d8f1ea17c36cb59cf61c2ccb26c3", "rev": "894a3d23ac0c8aaf561b9874b528b9cb2e839201",
"type": "github" "type": "github"
}, },
"original": { "original": {
"owner": "Homebrew", "owner": "Homebrew",
"ref": "6.0.22", "ref": "5.1.1",
"repo": "brew", "repo": "brew",
"type": "github" "type": "github"
} }
@@ -126,11 +126,11 @@
"nixpkgs": "nixpkgs" "nixpkgs": "nixpkgs"
}, },
"locked": { "locked": {
"lastModified": 1789598303, "lastModified": 1775334496,
"narHash": "sha256-hyAB8PqtE+2NPbXqFWFOVessao4ccpsQq6hKBfZPN0w=", "narHash": "sha256-dUopEMj5KhH1vnv43o29kMsayp0Ki+9EfIn4UAE9sAU=",
"owner": "9001", "owner": "9001",
"repo": "copyparty", "repo": "copyparty",
"rev": "6867ccc51181e7965445c3d158ddddf9a8fd817e", "rev": "ede692925edfc6fca7a52f483414d543e9303237",
"type": "github" "type": "github"
}, },
"original": { "original": {
@@ -156,7 +156,7 @@
}, },
"crane_2": { "crane_2": {
"inputs": { "inputs": {
"flake-compat": "flake-compat_5", "flake-compat": "flake-compat_4",
"flake-utils": "flake-utils_3", "flake-utils": "flake-utils_3",
"nixpkgs": [ "nixpkgs": [
"watershot", "watershot",
@@ -277,11 +277,11 @@
"firefox-gnome-theme": { "firefox-gnome-theme": {
"flake": false, "flake": false,
"locked": { "locked": {
"lastModified": 1783570805, "lastModified": 1775176642,
"narHash": "sha256-ptl5aRlCv9/uRSv2u8Hq8UFVFeZ6Q/bT049bpqNgc3w=", "narHash": "sha256-2veEED0Fg7Fsh81tvVDNYR6SzjqQxa7hbi18Jv4LWpM=",
"owner": "rafaelmardojai", "owner": "rafaelmardojai",
"repo": "firefox-gnome-theme", "repo": "firefox-gnome-theme",
"rev": "5602ed62d638142c1ab31dccd01dfbfb28841225", "rev": "179704030c5286c729b5b0522037d1d51341022c",
"type": "github" "type": "github"
}, },
"original": { "original": {
@@ -309,36 +309,20 @@
"flake-compat_2": { "flake-compat_2": {
"flake": false, "flake": false,
"locked": { "locked": {
"lastModified": 1767039857, "lastModified": 1751685974,
"narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=", "narHash": "sha256-NKw96t+BgHIYzHUjkTK95FqYRVKB8DHpVhefWSz/kTw=",
"owner": "edolstra", "ref": "refs/heads/main",
"repo": "flake-compat", "rev": "549f2762aebeff29a2e5ece7a7dc0f955281a1d1",
"rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab", "revCount": 92,
"type": "github" "type": "git",
"url": "https://git.lix.systems/lix-project/flake-compat.git"
}, },
"original": { "original": {
"owner": "edolstra", "type": "git",
"repo": "flake-compat", "url": "https://git.lix.systems/lix-project/flake-compat.git"
"type": "github"
} }
}, },
"flake-compat_3": { "flake-compat_3": {
"flake": false,
"locked": {
"lastModified": 1777699697,
"narHash": "sha256-Eg9b/rq/ECYwNwEXs5i9wHyhxNI0JrYx2srdI2uZMaQ=",
"ref": "refs/heads/main",
"rev": "382052b74656a369c5408822af3f2501e9b1af81",
"revCount": 94,
"type": "git",
"url": "https://git.lix.systems/lix-project/flake-compat.git"
},
"original": {
"type": "git",
"url": "https://git.lix.systems/lix-project/flake-compat.git"
}
},
"flake-compat_4": {
"flake": false, "flake": false,
"locked": { "locked": {
"lastModified": 1696426674, "lastModified": 1696426674,
@@ -354,7 +338,7 @@
"type": "github" "type": "github"
} }
}, },
"flake-compat_5": { "flake-compat_4": {
"flake": false, "flake": false,
"locked": { "locked": {
"lastModified": 1673956053, "lastModified": 1673956053,
@@ -392,6 +376,27 @@
} }
}, },
"flake-parts_2": { "flake-parts_2": {
"inputs": {
"nixpkgs-lib": [
"nvf",
"nixpkgs"
]
},
"locked": {
"lastModified": 1760948891,
"narHash": "sha256-TmWcdiUUaWk8J4lpjzu4gCGxWY6/Ok7mOK4fIFfBuU4=",
"owner": "hercules-ci",
"repo": "flake-parts",
"rev": "864599284fc7c0ba6357ed89ed5e2cd5040f0c04",
"type": "github"
},
"original": {
"owner": "hercules-ci",
"repo": "flake-parts",
"type": "github"
}
},
"flake-parts_3": {
"inputs": { "inputs": {
"nixpkgs-lib": [ "nixpkgs-lib": [
"stylix", "stylix",
@@ -399,11 +404,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1782949081, "lastModified": 1775087534,
"narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=", "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
"owner": "hercules-ci", "owner": "hercules-ci",
"repo": "flake-parts", "repo": "flake-parts",
"rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e", "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
"type": "github" "type": "github"
}, },
"original": { "original": {
@@ -475,7 +480,7 @@
}, },
"git-hooks": { "git-hooks": {
"inputs": { "inputs": {
"flake-compat": "flake-compat_4", "flake-compat": "flake-compat_3",
"gitignore": "gitignore_2", "gitignore": "gitignore_2",
"nixpkgs": [ "nixpkgs": [
"slippi", "slippi",
@@ -543,20 +548,18 @@
"gnome-shell": { "gnome-shell": {
"flake": false, "flake": false,
"locked": { "locked": {
"host": "gitlab.gnome.org", "lastModified": 1767737596,
"lastModified": 1776175984, "narHash": "sha256-eFujfIUQDgWnSJBablOuG+32hCai192yRdrNHTv0a+s=",
"narHash": "sha256-RJFlFW8GiMei6oqUGrMkGEvVqOH8U7Q8abc1yK4VKD8=",
"owner": "GNOME", "owner": "GNOME",
"repo": "gnome-shell", "repo": "gnome-shell",
"rev": "e0fdc4c13250e9a9b8ea9594c83925274f4a5dca", "rev": "ef02db02bf0ff342734d525b5767814770d85b49",
"type": "gitlab" "type": "github"
}, },
"original": { "original": {
"host": "gitlab.gnome.org",
"owner": "GNOME", "owner": "GNOME",
"ref": "50.1",
"repo": "gnome-shell", "repo": "gnome-shell",
"type": "gitlab" "rev": "ef02db02bf0ff342734d525b5767814770d85b49",
"type": "github"
} }
}, },
"home-manager": { "home-manager": {
@@ -566,16 +569,16 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1789267039, "lastModified": 1775425411,
"narHash": "sha256-LWiBv9yAYFi2LPbUhDGHPGKYskJQjj2fw12OlyO1uQo=", "narHash": "sha256-KY6HsebJHEe5nHOWP7ur09mb0drGxYSzE3rQxy62rJo=",
"owner": "nix-community", "owner": "nix-community",
"repo": "home-manager", "repo": "home-manager",
"rev": "ec172013fa62135f58fb58dd17ae9651e8f39727", "rev": "0d02ec1d0a05f88ef9e74b516842900c41f0f2fe",
"type": "github" "type": "github"
}, },
"original": { "original": {
"owner": "nix-community", "owner": "nix-community",
"ref": "release-26.05", "ref": "release-25.11",
"repo": "home-manager", "repo": "home-manager",
"type": "github" "type": "github"
} }
@@ -587,11 +590,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1789676441, "lastModified": 1775457580,
"narHash": "sha256-mOvO5VvycuBtOUe5EYI54vrLsWe+2KF/82fmwKooe48=", "narHash": "sha256-ikws/ssAmG20AGrEwBuwspwPlkubJu34mB+Uz2fJBJs=",
"owner": "nix-community", "owner": "nix-community",
"repo": "home-manager", "repo": "home-manager",
"rev": "9d485f74cd27d17126ee34cb31005c39d20f741f", "rev": "5de7dbd151b0bd65d45785553d4a22d832733ffc",
"type": "github" "type": "github"
}, },
"original": { "original": {
@@ -671,11 +674,11 @@
}, },
"mnw": { "mnw": {
"locked": { "locked": {
"lastModified": 1780772958, "lastModified": 1758834834,
"narHash": "sha256-VKKe8r4pwCGWZ3Yr9CPN129R4S3CKLSrlYqdYz3vKpM=", "narHash": "sha256-Y7IvY4F8vajZyp3WGf+KaiIVwondEkMFkt92Cr9NZmg=",
"owner": "Gerg-L", "owner": "Gerg-L",
"repo": "mnw", "repo": "mnw",
"rev": "0871dbf63a53610c95db04439ed8ea4d6ec9c160", "rev": "cfbc7d1cc832e318d0863a5fc91d940a96034001",
"type": "github" "type": "github"
}, },
"original": { "original": {
@@ -711,6 +714,24 @@
"type": "github" "type": "github"
} }
}, },
"ndg": {
"inputs": {
"nixpkgs": "nixpkgs_3"
},
"locked": {
"lastModified": 1765435293,
"narHash": "sha256-HRp4g6qBCb8vpJ17s2FacMRXRszM73uBiR56aILMELA=",
"owner": "feel-co",
"repo": "ndg",
"rev": "65bf834b332d5f8b28d95ea14c7974be7c272971",
"type": "github"
},
"original": {
"owner": "feel-co",
"repo": "ndg",
"type": "github"
}
},
"nix-darwin": { "nix-darwin": {
"inputs": { "inputs": {
"nixpkgs": [ "nixpkgs": [
@@ -718,11 +739,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1786845137, "lastModified": 1775037210,
"narHash": "sha256-oQFip+v0luP8NIxJzmiW4Wu8bILsbFWom5l0zonl8hQ=", "narHash": "sha256-KM2WYj6EA7M/FVZVCl3rqWY+TFV5QzSyyGE2gQxeODU=",
"owner": "nix-darwin", "owner": "nix-darwin",
"repo": "nix-darwin", "repo": "nix-darwin",
"rev": "4cff07de74b50e64bdd68cd4e722ab5b6b35ee48", "rev": "06648f4902343228ce2de79f291dd5a58ee12146",
"type": "github" "type": "github"
}, },
"original": { "original": {
@@ -753,11 +774,11 @@
"brew-src": "brew-src" "brew-src": "brew-src"
}, },
"locked": { "locked": {
"lastModified": 1788981439, "lastModified": 1774720267,
"narHash": "sha256-fEaFq0XgpgWFPLfpq1UK4/8ylHd2T0+fo6O3hKz1LUM=", "narHash": "sha256-YYftFe8jyfpQI649yfr0E+dqEXE2jznZNcYvy/lKV1U=",
"owner": "zhaofengli", "owner": "zhaofengli",
"repo": "nix-homebrew", "repo": "nix-homebrew",
"rev": "09a921d0181146cf6163ec2cc1db7b6fd539a885", "rev": "a7760a3a83f7609f742861afb5732210fdc437ed",
"type": "github" "type": "github"
}, },
"original": { "original": {
@@ -798,28 +819,6 @@
"type": "github" "type": "github"
} }
}, },
"nixos-wsl": {
"inputs": {
"flake-compat": "flake-compat_2",
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1789164534,
"narHash": "sha256-DoYGPM6QpnYBLWj9gGw6ZwAzIX+HrAVov1BoT+8Jixo=",
"owner": "nix-community",
"repo": "NixOS-WSL",
"rev": "72c92b11bb8289e6651c7fef29cc0a885fd6a255",
"type": "github"
},
"original": {
"owner": "nix-community",
"ref": "main",
"repo": "NixOS-WSL",
"type": "github"
}
},
"nixpkgs": { "nixpkgs": {
"locked": { "locked": {
"lastModified": 1748162331, "lastModified": 1748162331,
@@ -837,11 +836,12 @@
}, },
"nixpkgs-unstable": { "nixpkgs-unstable": {
"locked": { "locked": {
"lastModified": 1789546076, "lastModified": 1775036866,
"narHash": "sha256-vWkSk5bbfTqdtMoSgD9FshACO8JCvXTFi+3cqEp0mH0=", "narHash": "sha256-ZojAnPuCdy657PbTq5V0Y+AHKhZAIwSIT2cb8UgAz/U=",
"rev": "b1b875982b17dabde9b4a37f3e229e74913e6db3", "owner": "NixOS",
"type": "tarball", "repo": "nixpkgs",
"url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1074753.b1b875982b17/nixexprs.tar.zst" "rev": "6201e203d09599479a3b3450ed24fa81537ebc4e",
"type": "github"
}, },
"original": { "original": {
"id": "nixpkgs", "id": "nixpkgs",
@@ -851,30 +851,31 @@
}, },
"nixpkgs_2": { "nixpkgs_2": {
"locked": { "locked": {
"lastModified": 1789542786, "lastModified": 1775305101,
"narHash": "sha256-BGtBoaZNpOPDEBLTiWNFdYppnDjGhwrUq5/P15QwrrM=", "narHash": "sha256-/74n1oQPtKG52Yw41cbToxspxHbYz6O3vi+XEw16Qe8=",
"rev": "4c7870105e7f1fdf9c48688c8d7efc21abf0688a", "owner": "NixOS",
"type": "tarball", "repo": "nixpkgs",
"url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.9904.4c7870105e7f/nixexprs.tar.zst" "rev": "36a601196c4ebf49e035270e10b2d103fe39076b",
"type": "github"
}, },
"original": { "original": {
"id": "nixpkgs", "id": "nixpkgs",
"ref": "nixos-26.05", "ref": "nixos-25.11",
"type": "indirect" "type": "indirect"
} }
}, },
"nixpkgs_3": { "nixpkgs_3": {
"locked": { "locked": {
"lastModified": 1739419412, "lastModified": 1764242076,
"narHash": "sha256-NCWZQg4DbYVFWg+MOFrxWRaVsLA7yvRWAf6o0xPR1hI=", "narHash": "sha256-sKoIWfnijJ0+9e4wRvIgm/HgE27bzwQxcEmo2J/gNpI=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "2d55b4c1531187926c2a423f6940b3b1301399b5", "rev": "2fad6eac6077f03fe109c4d4eb171cf96791faa4",
"type": "github" "type": "github"
}, },
"original": { "original": {
"owner": "NixOS", "owner": "NixOS",
"ref": "nixpkgs-unstable", "ref": "nixos-unstable",
"repo": "nixpkgs", "repo": "nixpkgs",
"type": "github" "type": "github"
} }
@@ -922,11 +923,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1785549842, "lastModified": 1775228139,
"narHash": "sha256-DCwBZmGsySF7oKGTRgEv2HvpxVXkHT+38VhTM76k0B4=", "narHash": "sha256-ebbeHmg+V7w8050bwQOuhmQHoLOEOfqKzM1KgCTexK4=",
"owner": "nix-community", "owner": "nix-community",
"repo": "NUR", "repo": "NUR",
"rev": "a9f987b57594e845e3e5cdd423b9a70846d70308", "rev": "601971b9c89e0304561977f2c28fa25e73aa7132",
"type": "github" "type": "github"
}, },
"original": { "original": {
@@ -937,22 +938,26 @@
}, },
"nvf": { "nvf": {
"inputs": { "inputs": {
"flake-compat": "flake-compat_3", "flake-compat": "flake-compat_2",
"flake-parts": "flake-parts_2",
"mnw": "mnw", "mnw": "mnw",
"ndg": "ndg",
"nixpkgs": [ "nixpkgs": [
"nixpkgs" "nixpkgs"
] ],
"systems": "systems"
}, },
"locked": { "locked": {
"lastModified": 1789510188, "lastModified": 1765537745,
"narHash": "sha256-umec9LKkWjK89Yx4XpvQStkgfKvhK7GjVf5m21bjzKU=", "narHash": "sha256-EaFYxx2aSuM2xx+l+E55YNMCJOoQBl2tJybxyF0pPqw=",
"owner": "notashelf", "owner": "notashelf",
"repo": "nvf", "repo": "nvf",
"rev": "cdc7e7aaa7eb521bba1b38f54c3228d52cc31703", "rev": "8e031476d0d7f326b63c9c5522f840e2f8b724c0",
"type": "github" "type": "github"
}, },
"original": { "original": {
"owner": "notashelf", "owner": "notashelf",
"ref": "v0.8",
"repo": "nvf", "repo": "nvf",
"type": "github" "type": "github"
} }
@@ -1064,29 +1069,6 @@
"type": "github" "type": "github"
} }
}, },
"plasma-manager": {
"inputs": {
"home-manager": [
"home-manager-unstable"
],
"nixpkgs": [
"nixpkgs-unstable"
]
},
"locked": {
"lastModified": 1785762349,
"narHash": "sha256-jZhZkzAwc7f3exzcTDJWP2WCAchCv0iNC3UF/QsahdQ=",
"owner": "nix-community",
"repo": "plasma-manager",
"rev": "a19a2a029fa180911bd89c554dca1616e10f4c1d",
"type": "github"
},
"original": {
"owner": "nix-community",
"repo": "plasma-manager",
"type": "github"
}
},
"pre-commit-hooks-nix": { "pre-commit-hooks-nix": {
"inputs": { "inputs": {
"flake-compat": [ "flake-compat": [
@@ -1124,14 +1106,11 @@
"nix-darwin": "nix-darwin", "nix-darwin": "nix-darwin",
"nix-flatpak": "nix-flatpak", "nix-flatpak": "nix-flatpak",
"nix-homebrew": "nix-homebrew", "nix-homebrew": "nix-homebrew",
"nixos-wsl": "nixos-wsl",
"nixpkgs": "nixpkgs_2", "nixpkgs": "nixpkgs_2",
"nixpkgs-unstable": "nixpkgs-unstable", "nixpkgs-unstable": "nixpkgs-unstable",
"nvf": "nvf", "nvf": "nvf",
"plasma-manager": "plasma-manager",
"slippi": "slippi", "slippi": "slippi",
"sops-nix": "sops-nix", "sops-nix": "sops-nix",
"srcds-nix": "srcds-nix",
"stylix": "stylix", "stylix": "stylix",
"vpn-confinement": "vpn-confinement", "vpn-confinement": "vpn-confinement",
"watershot": "watershot" "watershot": "watershot"
@@ -1215,11 +1194,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1784166278, "lastModified": 1774370155,
"narHash": "sha256-TSvk8AK8ACGTSeC2v/tyWX3UiiaEQ5O4nX5jqVtEEEI=", "narHash": "sha256-emNcbleHPyUszpRFV5mHnU3q4E0aq7FNJxPtIAvsJqE=",
"owner": "lytedev", "owner": "lytedev",
"repo": "slippi-nix", "repo": "slippi-nix",
"rev": "d87fef3580e6afc19bc3fffbba61069df2452cbf", "rev": "c1f16cb34f7e09e8a9c7fe49744305c2f65a5b5f",
"type": "github" "type": "github"
}, },
"original": { "original": {
@@ -1235,11 +1214,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1789623319, "lastModified": 1775365543,
"narHash": "sha256-kmlp8rPrvrXn58YiaANHKSWUijtUc7pwgerIywosOIM=", "narHash": "sha256-f50qrK0WwZ9z5EdaMGWOTtALgSF7yb7XwuE7LjCuDmw=",
"owner": "Mic92", "owner": "Mic92",
"repo": "sops-nix", "repo": "sops-nix",
"rev": "16954c1c360c3dc4d4b3b3e64df59f7e89452cb1", "rev": "a4ee2de76efb759fe8d4868c33dec9937897916f",
"type": "github" "type": "github"
}, },
"original": { "original": {
@@ -1248,25 +1227,6 @@
"type": "github" "type": "github"
} }
}, },
"srcds-nix": {
"inputs": {
"nixpkgs": "nixpkgs_3",
"treefmt-nix": "treefmt-nix"
},
"locked": {
"lastModified": 1739576881,
"narHash": "sha256-zudD0ycB1cOwvqFBlAwSKwjO9cZir2qzA4f43ixNYCQ=",
"owner": "ihaveamac",
"repo": "srcds-nix",
"rev": "ad8a719fa97b26dfc0b3b6f0ba0f468036c549e1",
"type": "github"
},
"original": {
"owner": "ihaveamac",
"repo": "srcds-nix",
"type": "github"
}
},
"std": { "std": {
"inputs": { "inputs": {
"arion": [ "arion": [
@@ -1321,24 +1281,24 @@
"base16-helix": "base16-helix", "base16-helix": "base16-helix",
"base16-vim": "base16-vim", "base16-vim": "base16-vim",
"firefox-gnome-theme": "firefox-gnome-theme", "firefox-gnome-theme": "firefox-gnome-theme",
"flake-parts": "flake-parts_2", "flake-parts": "flake-parts_3",
"gnome-shell": "gnome-shell", "gnome-shell": "gnome-shell",
"nixpkgs": [ "nixpkgs": [
"nixpkgs-unstable" "nixpkgs-unstable"
], ],
"nur": "nur", "nur": "nur",
"systems": "systems", "systems": "systems_2",
"tinted-kitty": "tinted-kitty", "tinted-kitty": "tinted-kitty",
"tinted-schemes": "tinted-schemes", "tinted-schemes": "tinted-schemes",
"tinted-tmux": "tinted-tmux", "tinted-tmux": "tinted-tmux",
"tinted-zed": "tinted-zed" "tinted-zed": "tinted-zed"
}, },
"locked": { "locked": {
"lastModified": 1787771653, "lastModified": 1775429060,
"narHash": "sha256-DkkJSBOXWV/mja5Vy8az5g1KpZlsbUwlmH0BsQhowaQ=", "narHash": "sha256-wbFF5cRxQOCzL/wHOKYm21t5AHPH2Lfp0mVPCOAvEoc=",
"owner": "nix-community", "owner": "nix-community",
"repo": "stylix", "repo": "stylix",
"rev": "5e3809851f486e7fc7e84b40f174c74b60ecc784", "rev": "d27951a6539951d87f75cf0a7cda8a3a24016019",
"type": "github" "type": "github"
}, },
"original": { "original": {
@@ -1349,16 +1309,30 @@
}, },
"systems": { "systems": {
"locked": { "locked": {
"lastModified": 1774449309, "lastModified": 1681028828,
"narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=", "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems", "owner": "nix-systems",
"repo": "default", "repo": "default",
"rev": "c29398b59d2048c4ab79345812849c9bd15e9150", "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
},
"systems_2": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github" "type": "github"
}, },
"original": { "original": {
"owner": "nix-systems", "owner": "nix-systems",
"ref": "future-26.11",
"repo": "default", "repo": "default",
"type": "github" "type": "github"
} }
@@ -1382,11 +1356,11 @@
"tinted-schemes": { "tinted-schemes": {
"flake": false, "flake": false,
"locked": { "locked": {
"lastModified": 1785153830, "lastModified": 1772661346,
"narHash": "sha256-fNdfCTeCXU3tZG3TMincd+u68qBHQgCr2Ljr/M1mWP0=", "narHash": "sha256-4eu3LqB9tPqe0Vaqxd4wkZiBbthLbpb7llcoE/p5HT0=",
"owner": "tinted-theming", "owner": "tinted-theming",
"repo": "schemes", "repo": "schemes",
"rev": "9bd28ed313560db3c5b605c63bc4e309e78e3fc8", "rev": "13b5b0c299982bb361039601e2d72587d6846294",
"type": "github" "type": "github"
}, },
"original": { "original": {
@@ -1398,11 +1372,11 @@
"tinted-tmux": { "tinted-tmux": {
"flake": false, "flake": false,
"locked": { "locked": {
"lastModified": 1785031658, "lastModified": 1772934010,
"narHash": "sha256-mZp9O2LjzdMzlqQF3l3fjqsuPBzXy+1qTfBEUGjTlpk=", "narHash": "sha256-x+6+4UvaG+RBRQ6UaX+o6DjEg28u4eqhVRM9kpgJGjQ=",
"owner": "tinted-theming", "owner": "tinted-theming",
"repo": "tinted-tmux", "repo": "tinted-tmux",
"rev": "5d2c67f61ea7af36f16865ab6d541cdba41dc257", "rev": "c3529673a5ab6e1b6830f618c45d9ce1bcdd829d",
"type": "github" "type": "github"
}, },
"original": { "original": {
@@ -1414,11 +1388,11 @@
"tinted-zed": { "tinted-zed": {
"flake": false, "flake": false,
"locked": { "locked": {
"lastModified": 1785030526, "lastModified": 1772909925,
"narHash": "sha256-klZf8UviewRkxuu74Bhbq6tqy7oxebQC7UVRWbbtQxU=", "narHash": "sha256-jx/5+pgYR0noHa3hk2esin18VMbnPSvWPL5bBjfTIAU=",
"owner": "tinted-theming", "owner": "tinted-theming",
"repo": "base16-zed", "repo": "base16-zed",
"rev": "16f5a8adf4a6b1310d0a61ab172de963e8f76a02", "rev": "b4d3a1b3bcbd090937ef609a0a3b37237af974df",
"type": "github" "type": "github"
}, },
"original": { "original": {
@@ -1427,34 +1401,13 @@
"type": "github" "type": "github"
} }
}, },
"treefmt-nix": {
"inputs": {
"nixpkgs": [
"srcds-nix",
"nixpkgs"
]
},
"locked": {
"lastModified": 1738953846,
"narHash": "sha256-yrK3Hjcr8F7qS/j2F+r7C7o010eVWWlm4T1PrbKBOxQ=",
"owner": "numtide",
"repo": "treefmt-nix",
"rev": "4f09b473c936d41582dd744e19f34ec27592c5fd",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "treefmt-nix",
"type": "github"
}
},
"vpn-confinement": { "vpn-confinement": {
"locked": { "locked": {
"lastModified": 1789394839, "lastModified": 1767604552,
"narHash": "sha256-trdjVJKmDBbzgbP8pd+R7iKbGkdRu0nmXgQlBR/hEiU=", "narHash": "sha256-FddhMxnc99KYOZ/S3YNqtDSoxisIhVtJ7L4s8XD2u0A=",
"owner": "Maroka-chan", "owner": "Maroka-chan",
"repo": "VPN-Confinement", "repo": "VPN-Confinement",
"rev": "a21f66ccd9f644c3770ccdf287cb380c00192628", "rev": "a6b2da727853886876fd1081d6bb2880752937f3",
"type": "github" "type": "github"
}, },
"original": { "original": {
flake.nix
+12 -58
View File
@@ -4,26 +4,20 @@
{ {
description = "blakes nix config"; description = "blakes nix config";
inputs = { inputs = {
nixpkgs.url = "nixpkgs/nixos-26.05"; nixpkgs.url = "nixpkgs/nixos-25.11";
nixpkgs-unstable.url = "nixpkgs/nixos-unstable"; nixpkgs-unstable.url = "nixpkgs/nixos-unstable";
nix-darwin = { nix-darwin = {
url = "github:nix-darwin/nix-darwin/master"; url = "github:nix-darwin/nix-darwin/master";
inputs.nixpkgs.follows = "nixpkgs-unstable"; inputs.nixpkgs.follows = "nixpkgs-unstable";
}; };
home-manager = { home-manager = {
#url = "github:nix-community/home-manager"; url = "github:nix-community/home-manager/release-25.11";
url = "github:nix-community/home-manager/release-26.05";
inputs.nixpkgs.follows = "nixpkgs"; inputs.nixpkgs.follows = "nixpkgs";
}; };
home-manager-unstable = { home-manager-unstable = {
url = "github:nix-community/home-manager"; url = "github:nix-community/home-manager";
inputs.nixpkgs.follows = "nixpkgs-unstable"; inputs.nixpkgs.follows = "nixpkgs-unstable";
}; };
plasma-manager = {
url = "github:nix-community/plasma-manager";
inputs.nixpkgs.follows = "nixpkgs-unstable";
inputs.home-manager.follows = "home-manager-unstable";
};
nix-homebrew.url = "github:zhaofengli/nix-homebrew"; nix-homebrew.url = "github:zhaofengli/nix-homebrew";
nix-flatpak.url = "github:gmodena/nix-flatpak/?ref=latest"; nix-flatpak.url = "github:gmodena/nix-flatpak/?ref=latest";
sops-nix = { sops-nix = {
@@ -34,10 +28,6 @@
url = "github:nix-community/disko/latest"; url = "github:nix-community/disko/latest";
inputs.nixpkgs.follows = "nixpkgs"; inputs.nixpkgs.follows = "nixpkgs";
}; };
nixos-wsl = {
url = "github:nix-community/NixOS-WSL/main";
inputs.nixpkgs.follows = "nixpkgs";
};
lanzaboote = { lanzaboote = {
url = "github:nix-community/lanzaboote/v0.4.3"; url = "github:nix-community/lanzaboote/v0.4.3";
inputs.nixpkgs.follows = "nixpkgs"; inputs.nixpkgs.follows = "nixpkgs";
@@ -50,7 +40,7 @@
url = "github:Maroka-chan/VPN-Confinement"; url = "github:Maroka-chan/VPN-Confinement";
}; };
nvf = { nvf = {
url = "github:notashelf/nvf"; url = "github:notashelf/nvf/v0.8";
inputs.nixpkgs.follows = "nixpkgs"; inputs.nixpkgs.follows = "nixpkgs";
}; };
autoaspm = { autoaspm = {
@@ -66,7 +56,6 @@
url = "github:lytedev/slippi-nix"; url = "github:lytedev/slippi-nix";
inputs.nixpkgs.follows = "nixpkgs-unstable"; inputs.nixpkgs.follows = "nixpkgs-unstable";
}; };
srcds-nix.url = "github:ihaveamac/srcds-nix";
}; };
outputs = { outputs = {
self, self,
@@ -74,41 +63,29 @@
nixpkgs-unstable, nixpkgs-unstable,
nix-darwin, nix-darwin,
nix-homebrew, nix-homebrew,
nixos-wsl,
plasma-manager,
... ...
} @ inputs: let } @ inputs: let
systems = { systems = {
x86_64-linux = "x86_64-linux"; x86_64 = "x86_64-linux";
aarch64-linux = "aarch64-linux"; arm64 = "aarch64-linux";
aarch64-darwin = "aarch64-darwin"; darwin = "aarch64-darwin";
}; };
unstableOverlay = final: prev: {
unstable = import nixpkgs-unstable {
#system = prev.system;
system = prev.stdenv.hostPlatform.system;
config.allowUnfree = true;
};
};
# legacy
stable_pkgs = builtins.mapAttrs (k: v: import nixpkgs {system = v;}) systems; stable_pkgs = builtins.mapAttrs (k: v: import nixpkgs {system = v;}) systems;
unstable_pkgs = builtins.mapAttrs (k: v: import nixpkgs-unstable {system = v;}) systems; unstable_pkgs = builtins.mapAttrs (k: v: import nixpkgs-unstable {system = v;}) systems;
in { in {
nixosConfigurations = { nixosConfigurations = {
snowbelle = nixpkgs.lib.nixosSystem { snowbelle = nixpkgs.lib.nixosSystem {
system = systems.x86_64-linux; system = systems.x86_64;
specialArgs = {inherit inputs stable_pkgs unstable_pkgs;}; specialArgs = {inherit inputs stable_pkgs unstable_pkgs;};
modules = [ modules = [
{nixpkgs.overlays = [unstableOverlay];}
./hosts/nixos/snowbelle/configuration.nix ./hosts/nixos/snowbelle/configuration.nix
inputs.home-manager.nixosModules.default inputs.home-manager.nixosModules.default
]; ];
}; };
yveltal = nixpkgs-unstable.lib.nixosSystem { yveltal = nixpkgs-unstable.lib.nixosSystem {
system = systems.x86_64-linux; system = systems.x86_64;
specialArgs = {inherit inputs stable_pkgs unstable_pkgs;}; specialArgs = {inherit inputs stable_pkgs unstable_pkgs;};
modules = [ modules = [
{nixpkgs.overlays = [unstableOverlay];}
./hosts/nixos/yveltal/configuration.nix ./hosts/nixos/yveltal/configuration.nix
./hosts/nixos/yveltal/disko.nix ./hosts/nixos/yveltal/disko.nix
inputs.home-manager-unstable.nixosModules.default inputs.home-manager-unstable.nixosModules.default
@@ -116,10 +93,9 @@
]; ];
}; };
mew = nixpkgs-unstable.lib.nixosSystem { mew = nixpkgs-unstable.lib.nixosSystem {
system = systems.x86_64-linux; system = systems.x86_64;
specialArgs = {inherit inputs stable_pkgs unstable_pkgs;}; specialArgs = {inherit inputs stable_pkgs unstable_pkgs;};
modules = [ modules = [
{nixpkgs.overlays = [unstableOverlay];}
./hosts/nixos/mew/configuration.nix ./hosts/nixos/mew/configuration.nix
./hosts/nixos/mew/disko.nix ./hosts/nixos/mew/disko.nix
inputs.home-manager-unstable.nixosModules.default inputs.home-manager-unstable.nixosModules.default
@@ -127,41 +103,19 @@
]; ];
}; };
vaniville = nixpkgs.lib.nixosSystem { vaniville = nixpkgs.lib.nixosSystem {
system = systems.x86_64-linux; system = systems.x86_64;
specialArgs = {inherit inputs stable_pkgs unstable_pkgs;}; specialArgs = {inherit inputs stable_pkgs unstable_pkgs;};
modules = [ modules = [
{nixpkgs.overlays = [unstableOverlay];}
./hosts/nixos/vaniville/configuration.nix ./hosts/nixos/vaniville/configuration.nix
inputs.home-manager.nixosModules.default inputs.home-manager.nixosModules.default
]; ];
}; };
lumiose = nixpkgs.lib.nixosSystem {
system = systems.x86_64-linux;
specialArgs = {inherit inputs stable_pkgs unstable_pkgs;};
modules = [
{nixpkgs.overlays = [unstableOverlay];}
./hosts/nixos/lumiose/configuration.nix
inputs.home-manager.nixosModules.default
inputs.disko.nixosModules.disko
];
};
wsl = nixpkgs.lib.nixosSystem {
system = systems.x86_64-linux;
specialArgs = {inherit inputs stable_pkgs unstable_pkgs;};
modules = [
{nixpkgs.overlays = [unstableOverlay];}
./hosts/nixos/wsl/configuration.nix
nixos-wsl.nixosModules.default
inputs.home-manager.nixosModules.default
];
};
}; };
darwinConfigurations = { darwinConfigurations = {
cen-it-07 = nix-darwin.lib.darwinSystem { CEN-IT-07 = nix-darwin.lib.darwinSystem {
system = systems.aarch64-darwin; system = systems.darwin;
specialArgs = {inherit inputs stable_pkgs unstable_pkgs nix-homebrew;}; specialArgs = {inherit inputs stable_pkgs unstable_pkgs nix-homebrew;};
modules = [ modules = [
{nixpkgs.overlays = [unstableOverlay];}
./hosts/darwin/cen-it-07/configuration.nix ./hosts/darwin/cen-it-07/configuration.nix
inputs.home-manager.darwinModules.default inputs.home-manager.darwinModules.default
]; ];
hosts/darwin/cen-it-07/app_list.md
+79
View File
@@ -0,0 +1,79 @@
casks:
battery-toolkit
fuse-t
linearmouse
ollama
rustdesk
texstudio
betterdisplay
gnucash
mactex-no-gui
ollama-app
syncthing-app
utm
command-x
kitty
makemkv
prismlauncher
tailscale
veracrypt-fuse-t
firefox
libreoffice
minecraft
rectangle
tailscale-app
vivaldi
brews:
coreutils
cowsay
ctpv
displayplacer
gawk
gnupg
imagemagick
iperf3
lf
lolcat
media-info
mpv
nmap
openvpn
p7zip
pandoc
pinentry-mac
pipx
qemu
rage
sl
speedtest-cli
xdg-ninja
yubico-piv-tool
mas:
1168254295 AmorphousDiskMark (4.0.1)
1037126344 Apple Configurator (2.18)
1352778147 Bitwarden (2025.9.0)
425264550 Blackmagic Disk Speed Test (3.4.2)
6454431289 CrystalFetch (2.2.0)
1438243180 Dark Reader for Safari (2.1.8)
975937182 Fantastical (4.1.2)
682658836 GarageBand (10.4.11)
6504861501 Ghostery Privacy Ad Blocker (10.5.38)
1616683087 GT Uptime (2.2.0)
1452453066 Hidden Bar (1.8)
1487860882 iMazing Profile Editor (2.1.0)
408981434 iMovie (10.4.3)
409183694 Keynote (14.5)
634148309 Logic Pro (11.2.2)
1621800675 Mercury (2.11.4)
409203825 Numbers (14.4)
409201541 Pages (14.4)
6449850851 Privacy.com for Safari (2.4.15)
899247664 TestFlight (4.1.0)
1614659226 virtualOS (2.1)
1295203466 Windows App (11.2.4)
hosts/darwin/cen-it-07/configuration.nix
+19 -34
View File
@@ -5,6 +5,7 @@
inputs, inputs,
... ...
}: { }: {
imports = [ imports = [
inputs.nix-homebrew.darwinModules.nix-homebrew inputs.nix-homebrew.darwinModules.nix-homebrew
../default.nix ../default.nix
@@ -13,14 +14,24 @@
# home grown nixos modules # home grown nixos modules
darwin = { darwin = {
# ssh.enable = true;
syncthing.enable = true; syncthing.enable = true;
tailscale.enable = true; tailscale.enable = true;
nextdns.enable = true;
yubikey.enable = true; yubikey.enable = true;
work.enable = true; work.enable = true;
apps.enable = true; apps.enable = true;
cyber.enable = true; };
gaming.enable = true;
# since darwin needs root now (will be removed in future)
system.primaryUser = "bhelderman"
power = {
sleep = {
computer = 30;
display = 5;
allowSleepByPowerButton = true;
};
}; };
# import home grown host specific home-manager modules # import home grown host specific home-manager modules
@@ -42,37 +53,22 @@
}; };
}; };
# base system package install list # base system package install list
environment.systemPackages = with pkgs; [ environment.systemPackages = with pkgs; [
neovide
]; ];
nix-homebrew = { nix-homebrew = {
enable = true; # install homebrew enable = true; # install homebrew
enableRosetta = true; # install homebrew for rosetta as well enableRosetta = true; # install homebrew for rosetta as well
#autoMigrate = true; autoMigrate = true;
user = "bhelderman"; # user owning homebrew prefix user = "bhelderman"; # user owning homebrew prefix
trust = {
formulae = [];
casks = [];
commands = [];
taps = ["rogeriopradoj/cask-peazip"];
};
}; };
homebrew = { homebrew = {
enable = true; enable = true;
# removes anything in homebrew not explicitly specified # removes anything in homebrew not explicitly specified
onActivation = { #onActivation.cleanup = "uninstall";
cleanup = "zap";
autoUpdate = false;
upgrade = true;
};
taps = [
"rogeriopradoj/cask-peazip"
];
brews = [ brews = [
"mas" "mas"
@@ -82,10 +78,8 @@
]; ];
casks = [ casks = [
"kitty" "kitty"
"battery-toolkit"
"linearmouse" "linearmouse"
"betterdisplay"
"rectangle"
"peazip"
]; ];
masApps = { masApps = {
# "name" = app_id_number; # "name" = app_id_number;
@@ -93,16 +87,7 @@
"testflight" = 899247664; "testflight" = 899247664;
}; };
}; };
# for mas to not throw rebuild fit
# since darwin needs root now (will be removed in future) system.stateVersion = 6;
system.primaryUser = "bhelderman";
power = {
sleep = {
computer = 30;
display = 5;
allowSleepByPowerButton = true;
};
};
} }
hosts/darwin/default.nix
+53 -51
View File
@@ -5,66 +5,20 @@
inputs, inputs,
... ...
}: { }: {
/* /*
instructions for first time setup for macos here instructions for first time setup for macos here
1. install the nix package manager with: `sh <(curl --proto '=https' --tlsv1.2 -L https://nixos.org/nix/install)` 1. install the nix package manager with: `sh <(curl --proto '=https' --tlsv1.2 -L https://nixos.org/nix/install)`
2. install xcode tools with `xcode-select --install` 2. xfer or git clone flake to ~/.nix
3. allow full disk access to terminal 3. install nix-darwin with: `nix run nix-darwin -- switch --flake ~/.nix#host`
4. xfer or git clone flake to ~/.nix 4. nh should be installed now so enjoy and use `nh darwin switch`
5. sign into icloud and by extension app store for mas
6. rename some shell rc files with `sudo mv /etc/bashrc /etc/bashrc.before-nix-darwin && sudo mv /etc/zshrc /etc/zshrc.before-nix-darwin`
7. install nix-darwin with: `nix run --extra-experimental-features "nix-command flakes" nix-darwin -- switch --flake ~/.nix#host`
8. nh should be installed now so enjoy and use `nh darwin switch`
*/ */
imports = [ imports = [
]; ];
# general macos system settings # general macos system settings
# base system package install list
environment.systemPackages = with pkgs; [
wget
sl
curl
rsync
git
age
fzf
usbutils
pciutils
python3
lf
btop
pinentry_mac
];
users.users.bhelderman = {
home = "/Users/bhelderman";
# optional extras, e.g. shell, uid, etc.
};
# define home-manager user
home-manager = {
extraSpecialArgs = {inherit inputs;};
backupFileExtension = "bak";
useUserPackages = true;
useGlobalPkgs = false;
users = {
"bhelderman" = import ../../users/blake/home_darwin.nix;
};
};
# set timezone
time.timeZone = "America/Chicago";
# allow proprietary packages
nixpkgs.config.allowUnfree = true;
# enable flakes
nix.settings.experimental-features = ["nix-command" "flakes"];
system = { system = {
stateVersion = 6;
defaults = { defaults = {
trackpad = { trackpad = {
Clicking = true; Clicking = true;
@@ -76,15 +30,18 @@
TrackpadRotate = true; TrackpadRotate = true;
TrackpadTwoFingerDoubleTapGesture = true; TrackpadTwoFingerDoubleTapGesture = true;
TrackpadTwoFingerFromRightEdgeSwipeGesture = 3; TrackpadTwoFingerFromRightEdgeSwipeGesture = 3;
}; };
universalaccess = { universalaccess = {
mouseDriverCursorSize = 3.0; mouseDriverCursorSize = 3.0;
}; };
NSGlobalDomain = { NSGlobalDomain = {
AppleICUForce24HourTime = true; AppleICUForce24HourTime = true;
AppleInterfaceStyle = "Dark"; AppleInterfaceStyle = "Dark";
NSAutomaticCapitalizationEnabled = false; NSAutomaticCapitalizationEnabled = false;
NSDocumentSaveNewDocumentsToCloud = false; NSDocumentSaveNewDocumentsToCloud = false;
}; };
WindowManager = { WindowManager = {
EnableStandardClickToShowDesktop = false; EnableStandardClickToShowDesktop = false;
@@ -112,7 +69,6 @@
orientation = "bottom"; orientation = "bottom";
scroll-to-open = true; scroll-to-open = true;
show-recents = false; show-recents = false;
showAppExposeGestureEnabled = true;
}; };
finder = { finder = {
AppleShowAllExtensions = true; AppleShowAllExtensions = true;
@@ -133,6 +89,52 @@
askForPassword = true; askForPassword = true;
askForPasswordDelay = 15; askForPasswordDelay = 15;
}; };
}; };
}; };
# base system package install list
environment.systemPackages = with pkgs; [
wget
curl
rsync
git
age
fzf
usbutils
pciutils
python3
vim
lf
btop
rectangle
pinentry_mac
];
users.users.bhelderman = {
home = "/Users/bhelderman";
# optional extras, e.g. shell, uid, etc.
};
# define home-manager user
home-manager = {
extraSpecialArgs = {inherit inputs;};
backupFileExtension = "bak";
useUserPackages = true;
useGlobalPkgs = false;
users = {
"bhelderman" = import ../../users/blake/home_darwin.nix;
};
};
# set timezone
time.timeZone = "America/Chicago";
# allow proprietary packages
nixpkgs.config.allowUnfree = true;
# enable flakes
nix.settings.experimental-features = ["nix-command" "flakes"];
} }
hosts/nixos/default.nix
+1 -20
View File
@@ -3,7 +3,6 @@
config, config,
lib, lib,
inputs, inputs,
unstable_pkgs,
... ...
}: { }: {
imports = [ imports = [
@@ -53,15 +52,7 @@
powerManagement.powertop.enable = true; powerManagement.powertop.enable = true;
# things are better this way # things are better this way
users = { users.defaultUserShell = pkgs.zsh;
defaultUserShell = pkgs.zsh;
users.root = {
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO06en1r4+zg8JMGPq7WiZeh/DBUvfhDJX3e+J5Z5Ttk blake@snowbelle"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP0FLKK9yEPYpGuCjoX0e7Ky/zTPfzDk7IkrR3tOmELP blake@vaniville"
];
};
};
# base system package install list # base system package install list
environment.systemPackages = with pkgs; [ environment.systemPackages = with pkgs; [
@@ -83,8 +74,6 @@
usbutils usbutils
pciutils pciutils
lm_sensors lm_sensors
smartmontools
unstable.siomon
]; ];
# nice to have passwordless sudo # nice to have passwordless sudo
@@ -121,14 +110,6 @@
command = "/etc/profiles/per-user/blake/bin/nom-shell"; command = "/etc/profiles/per-user/blake/bin/nom-shell";
options = ["NOPASSWD"]; options = ["NOPASSWD"];
} }
{
command = "/run/current-system/sw/bin/rsync";
options = ["NOPASSWD"];
}
{
command = "/etc/profiles/per-user/blake/bin/lf";
options = ["NOPASSWD"];
}
]; ];
} }
]; ];
hosts/nixos/lumiose/disko.nix → hosts/nixos/froakie/disko.nix
+1 -1
View File
@@ -3,7 +3,7 @@
disk = { disk = {
main = { main = {
type = "disk"; type = "disk";
device = "/dev/disk/by-id/nvme-SAMSUNG_MZVLB256HAHQ-000H2_S499NX0M112943"; # disk id here device = ""; # disk id here
content = { content = {
type = "gpt"; type = "gpt";
partitions = { partitions = {
hosts/nixos/lumiose/configuration.nix
-177
View File
@@ -1,177 +0,0 @@
{
config,
lib,
inputs,
modulesPath,
stable_pkgs,
unstable_pkgs,
...
}: {
imports = [
# Include the results of the hardware scan.
(modulesPath + "/installer/scan/not-detected.nix")
#./hardware-configuration.nix
./disko.nix
../../nixos
../../../users/blake
../../../modules/system
../../../modules/fileshares/holocron
../../../modules/homelab
#../../../modules/gameservers/srcds
../../../modules/gameservers/minecraft_recpro
../../../modules/gameservers/minecraft_modded
../../../modules/gameservers/valheim
];
home-manager.users.blake.imports = [
../../../users/blake/hosts/lumiose.nix
];
system = {
ssh.enable = true;
sops.enable = true;
podman.enable = true;
yubikey.enable = true;
graphics = {
enable = true;
vendor = "amd";
};
keepalive = {
enable = true;
url = "https://up.holocron.blue/api/push/7DAcvsedwB?status=up&msg=fuckingvibing&ping=";
};
};
homelab = {
enable = true;
base_domain = "lumiose.holocron.blue";
host_ip = "10.10.0.11";
gitea.enable = false;
glance.enable = true;
immich = {
enable = true;
data_dir = "/holocron/srv/immich";
backup = false;
};
vaultwarden.enable = false;
#searx.enable = true;
# home assistant
home.enable = true;
homebox.enable = true;
# network
tailscale.enable = true;
caddy = {
enable = true;
keys = false;
};
dnsmasq.enable = true;
# mediastack
mediastack.enable = true;
qbittorrent.vpn_inf = "enp34s0.69";
# system
backups.enable = true;
motd.enable = true;
msmtp.enable = true;
uptime-kuma.enable = true;
# # ai
# ollama.enable = false;
# open-webui.enable = false;
wyoming.enable = true;
};
holocron = {
# copyparty.enable = false;
syncthing.enable = true;
ensure_perms.enable = false;
offsite.enable = true;
zfs.enable = true;
smb.enable = true;
nfs.enable = true;
};
gameservers = {
minecraft_recpro.enable = true;
minecraft_modded.enable = false;
valheim.enable = true;
};
# boot (systemd is going on me)
boot.loader.systemd-boot.enable = true; # systemd your pretty cool ya know
boot.loader.efi.canTouchEfiVariables = true;
boot.initrd.systemd.enable = true; # better logging
# setup hostname and networking stack
services.resolved = {
enable = true;
settings = {
Resolve = {
FallbackDNS = ["1.1.1.1" "9.9.9.9"];
DNSOverTLS = "opportunistic";
};
};
};
networking = {
hostName = "lumiose"; # hostname
hostId = "007f0200";
getaddrinfo = {
enable = true;
precedence = {
"::ffff:0:0/96" = 100;
};
};
networkmanager = {
enable = true; # the goat
dns = "systemd-resolved"; # the backup dancer!
ensureProfiles.profiles = {
vpn = {
ipv4 = {
method = "manual";
addresses = "10.69.0.11/24";
gateway = "10.69.0.1";
};
ethernet.mac-address = "02:ea:6c:3c:9f:cd";
connection.type = "vlan";
connection.id = "vpn";
connection.interface-name = "enp34s0.69"; # or just "vpn-vlan"
vlan.interface-name = "enp34s0.69"; # or just "vpn-vlan"
vlan.parent = "enp34s0";
vlan.id = 69;
#ipv4.dns = "9.9.9.9";
};
};
};
};
hardware.bluetooth.enable = true;
# Open ports in the firewall.
networking.firewall.allowedTCPPorts = [
80 # set - http
111 # set - portmapper for nfs
443 # set - https
137 # set - smb
138 # set - smb
139 # set - smb
445 # set - smb
1198
1883 # set - mqtt
2049 # set - nfs
2222 # srv - syncthing
5201 # iperf3
];
networking.firewall.allowedUDPPorts = [51820];
# Or disable the firewall altogether.
networking.firewall.enable = true;
# hardware stuff
boot.initrd.availableKernelModules = ["nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod"];
boot.initrd.kernelModules = [];
boot.kernelModules = ["kvm-amd"];
boot.kernelParams = ["ipv6.disable=1"];
boot.extraModulePackages = [];
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
system.stateVersion = "25.05"; # stays here : )
}
hosts/nixos/snowbelle/configuration.nix
+49 -52
View File
@@ -1,20 +1,19 @@
{ config, lib, inputs, stable_pkgs, unstable_pkgs, ... }:
let
pkgs = stable_pkgs.x86_64;
unstable = unstable_pkgs.x86_64;
in
{ {
config, imports =
lib, [ # Include the results of the hardware scan.
inputs,
stable_pkgs,
unstable_pkgs,
...
}: {
imports = [
# Include the results of the hardware scan.
./hardware-configuration.nix ./hardware-configuration.nix
../../nixos ../../nixos
../../../users/blake ../../../users/blake
../../../modules/system ../../../modules/system
../../../modules/holocron
../../../modules/homelab ../../../modules/homelab
#../../../modules/fileshares/holocron ../../../modules/gameservers/minecraft_recpro
#../../../modules/gameservers/minecraft_recpro
../../../modules/gameservers/minecraft_modded ../../../modules/gameservers/minecraft_modded
]; ];
@@ -31,51 +30,44 @@
enable = true; enable = true;
vendor = "nvidia"; vendor = "nvidia";
}; };
keepalive = {
enable = true;
url = "https://up.holocron.blue/api/push/kMoYviAuCL?status=up&msg=bigchilling&ping=";
}; };
holocron = {
syncthing.enable = true;
copyparty.enable = false;
ensure_perms.enable = false;
zfs.enable = true;
smb.enable = true;
nfs.enable = true;
}; };
# holocron = {
# ensure_perms.enable = true;
# zfs.enable = true;
# smb.enable = true;
# nfs.enable = true;
# };
homelab = { homelab = {
enable = true; enable = true;
base_domain = "snowbelle.holocron.blue";
# services
gitea.enable = false;
glance.enable = false;
immich.enable = false;
vaultwarden.enable = false;
#searx.enable = true;
# home assistant
home.enable = false;
# network
tailscale.enable = true; tailscale.enable = true;
caddy.enable = false; dnsmasq.enable = true;
dnsmasq.enable = false; backups.enable = true;
# mediastack motd.enable = true;
mediastack.enable = false; postfix.enable = true;
# system gitea.enable = true;
backups.enable = false; glance.enable = true;
motd.enable = false; immich.enable = true;
uptime-kuma.enable = false; hass.enable = true;
# ai jellyfin.enable = true;
#ollama.enable = false; audiobookshelf.enable = true;
#open-webui.enable = false; yacreader.enable = true;
wyoming.enable = false; qbittorrent.enable = true;
sonarr.enable = true;
radarr.enable = true;
bazarr.enable = true;
prowlarr.enable = true;
flaresolverr.enable = true;
zigbee2mqtt.enable = true;
mosquitto.enable = true;
caddy.enable = true;
uptime-kuma.enable = true;
vaultwarden.enable = true;
}; };
gameservers = { gameservers = {
# minecraft_recpro.enable = true; minecraft_recpro.enable = true;
minecraft_modded = { minecraft_modded.enable = true;
enable = true;
url = "raceraskedforthisenjoyyall.recoil.pro";
};
}; };
# boot (systemd is going on me) # boot (systemd is going on me)
@@ -86,8 +78,8 @@
# setup hostname and networking stack # setup hostname and networking stack
services.resolved = { services.resolved = {
enable = true; enable = true;
#fallbackDns = ["1.1.1.1" "9.9.9.9"]; fallbackDns = [ "1.1.1.1" "9.9.9.9" ];
settings.Resolve.DNSOverTLS = "opportunistic"; dnsovertls = "opportunistic";
}; };
networking = { networking = {
hostName = "snowbelle"; # hostname hostName = "snowbelle"; # hostname
@@ -110,8 +102,12 @@
}; };
}; };
hardware.bluetooth.enable = true; hardware.bluetooth.enable = true;
# Open ports in the firewall. # Open ports in the firewall.
networking.firewall.allowedTCPPorts = [ networking.firewall.allowedTCPPorts = [
80 # set - http 80 # set - http
@@ -119,7 +115,6 @@
139 # set - smb 139 # set - smb
443 # set - https 443 # set - https
445 # set - cifs 445 # set - cifs
5201
1198 1198
1883 # set - mqtt 1883 # set - mqtt
2049 # set - nfs 2049 # set - nfs
@@ -155,4 +150,6 @@
networking.firewall.enable = true; networking.firewall.enable = true;
system.stateVersion = "25.05"; # stays here : ) system.stateVersion = "25.05"; # stays here : )
} }
hosts/nixos/vaniville/configuration.nix
+135 -163
View File
@@ -1,210 +1,182 @@
{ { config, lib, stable_pkgs, unstable_pkgs, ... }:
config,
lib,
pkgs,
inputs,
stable_pkgs,
unstable_pkgs,
...
}: let
vpsip4 = "100.100.1.10";
snowbelle_ip = "10.10.0.10";
lumiose_ip = "10.10.0.11";
homelab = config.homelab; let
in { pkgs = stable_pkgs.x86_64;
imports = [ unstable = unstable_pkgs.x86_64;
in
{
imports =
[ # Include the results of the hardware scan.
./hardware-configuration.nix ./hardware-configuration.nix
../../nixos ../../nixos
../../../users/blake ../../../users/blake
../../../modules/system ../../../modules/system
../../../modules/holocron
../../../modules/homelab ../../../modules/homelab
#../../../modules/holocron
]; ];
home-manager.users.blake.imports = [ home-manager.users.blake.imports = [
../../../users/blake/hosts/vaniville.nix ../../../users/blake/hosts/vaniville.nix
]; ];
modules = {
system = { system = {
tailscale.enable = false; tailscale.enable = true;
}; };
homelab = {
enable = true;
base_domain = "vaniville.holocron.blue";
host_ip = "100.100.1.10";
ddns.enable = true;
uptime-kuma = {
enable = true;
url = "up.holocron.blue";
};
caddy = {
enable = true;
keys = true;
};
backups = {
enable = true;
databases = false;
homelab = true;
backup_repo = "/var/lib/backups/homelab";
offsite_dir = "lifeboat/vaniville/homelab";
};
gitea.enable = true;
vaultwarden.enable = true;
home.enable = false;
}; };
boot = {
loader = { # use the systemd-boot EFI boot loader.
efi.canTouchEfiVariables = true; boot.loader.systemd-boot.enable = true;
grub = { boot.loader.efi.canTouchEfiVariables = true;
enable = true;
forceInstall = true; # setup hostname and networking stack
}; networking.hostName = "vaniville"; # Define your hostname.
}; networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
kernel.sysctl = {
"net.ipv4.ip_forward" = 1;
};
};
# define shell # define shell
programs.zsh.enable = true; programs.zsh.enable = true;
users.defaultUserShell = pkgs.zsh; users.defaultUserShell = pkgs.zsh;
# packages reccomended by linode # package install list
environment.systemPackages = with pkgs; [ environment.systemPackages = with pkgs; [
inetutils
mtr
sysstat
]; ];
# services.resolved = { # allow proprietary packages
# enable = true; nixpkgs.config.allowUnfree = true;
# settings = {
# Resolve = {
# FallbackDNS = ["1.1.1.1" "9.9.9.9"];
# DNSOverTLS = "opportunistic";
# };
# };
# };
# setup the network forwarding this host is designed for # enable flakes
# general networking config nix.settings.experimental-features = [ "nix-command" "flakes" ];
networking = {
hostName = "vaniville"; # Define your hostname.
usePredictableInterfaceNames = false;
useDHCP = false;
interfaces.eth0.useDHCP = true; # public ipv4 interface
# the proper way to forward ports on nixos, need to figure it out locally then try to get it working over vps
nat = { nat = {
enable = true; enable = true;
externalInterface = "eth0"; # your PUBLIC_IF externalInterface = "eth0"; # your PUBLIC_IF
internalInterfaces = [ "tailscale0" ]; internalInterfaces = [ "tailscale0" ];
# maybe one day i will figure out the forward ports proper
forwardPorts = [ forwardPorts = [
# { sourcePort = 80; destination = "10.10.0.10:80"; proto = "tcp"; } # http { sourcePort = 80; destination = "10.10.0.10:80"; proto = "tcp"; } # http
# { sourcePort = 443; destination = "10.10.0.10:443"; proto = "tcp"; } # https { sourcePort = 443; destination = "10.10.0.10:443"; proto = "tcp"; } # https
# { sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "tcp"; } # minecraft { sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "tcp"; } # minecraft
# { sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "udp"; } # minecraft { sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "udp"; } # minecraft
# { sourcePort = 7567; destination = "10.10.0.10:7567"; proto = "tcp"; } # git { sourcePort = 7567; destination = "10.10.0.10:7567"; proto = "tcp"; } # git
# Rustdesk ports # Rustdesk ports
# { sourcePort = 21115; destination = "10.10.0.10:21115"; proto = "tcp"; } { sourcePort = 21115; destination = "10.10.0.10:21115"; proto = "tcp"; }
# { sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "tcp"; } { sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "tcp"; }
# { sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "udp"; } { sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "udp"; }
# { sourcePort = 21118; destination = "10.10.0.10:21118"; proto = "tcp"; } { sourcePort = 21118; destination = "10.10.0.10:21118"; proto = "tcp"; }
# { sourcePort = 21117; destination = "10.10.0.10:21117"; proto = "tcp"; } { sourcePort = 21117; destination = "10.10.0.10:21117"; proto = "tcp"; }
# { sourcePort = 21119; destination = "10.10.0.10:21119"; proto = "tcp"; } { sourcePort = 21119; destination = "10.10.0.10:21119"; proto = "tcp"; }
]; ];
}; };
# what actually does the forwarding
firewall = { firewall = {
enable = true; enable = true;
allowedTCPPorts = [22 80 443 25777 25579 7567 21115 21116 21117 21118 21119]; allowedTCPPorts = [ 22 80 443 25777 7567 21115 21116 21117 21118 21119 ];
allowedUDPPorts = [ 25777 21116 ];
# tailscale will also need its UDP port open: # tailscale will also need its UDP port open:
allowedUDPPorts = [config.services.tailscale.port 2456 2457 25777 21116 25580]; allowedUDPPorts = [ config.services.tailscale.port 25777 21116 ];
trustedInterfaces = [ "tailscale0" ]; trustedInterfaces = [ "tailscale0" ];
/*
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination ${snowbelle_ip}:80 # http
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination ${snowbelle_ip}:443 # https
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 80 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4} # http
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 443 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4} # https
*/
# iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 7567 -j DNAT --to-destination ${lumiose_ip}:7567 # gitea ssh
# iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 7567 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4} # gitea ssh
extraCommands = ''
# Clear any previous rules if you are iterating
iptables -t nat -F
# DNAT: internet -> homelab over tailscale
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25777 -j DNAT --to-destination ${lumiose_ip}:25777 # recpro mc
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 25777 -j DNAT --to-destination ${lumiose_ip}:25777 # recpro mc
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25579 -j DNAT --to-destination ${snowbelle_ip}:25579 # craftoria mc
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 25580 -j DNAT --to-destination ${snowbelle_ip}:25580 # craftoria mc voice chat
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 2456 -j DNAT --to-destination ${lumiose_ip}:2456 # valheim server
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 2457 -j DNAT --to-destination ${lumiose_ip}:2457 # valheim server
# SNAT: ensure replies go back through VPS tailscale IP
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25777 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4} # recpro mc
iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 25777 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4} # recpro mc
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25579 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4} # craftoria mc
iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 25580 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4} # craftoria mc voicechat
iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 2456 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4} # valheim server
iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 2457 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4} # valheim server
'';
};
}; };
# enable tailscale for to forward over!
services.tailscale = {
enable = true;
useRoutingFeatures = "server";
extraSetFlags = [
"--advertise-exit-node"
];
};
# forwarding for caddy # Open ports in the firewall, the wrong way
services.caddy = { # networking.firewall.enable = true;
globalConfig = '' # networking.firewall.extraCommands = ''
auto_https ignore_loaded_certs # HOMELAB_IP="10.10.0.10" # destination address
''; # PUBLIC_IF="eth0" # vps public interface
virtualHosts = { # TAILSCALE_IF="tailscale0" # tailscale interface
# for central uptime monitoring #
"up.${homelab.public_domain}".extraConfig = '' # # flush rules (avoid dupes)
reverse_proxy 127.0.0.1:7901 # iptables -F
''; # iptables -t nat -F
# below is basically just manually reverse proxying everything in the homelab # iptables -t mangle -F
# this is instead of forwarding all 80 & 443 traffic to have more explicit # iptables -X
# publishing things to the open web #
"media.${homelab.public_domain}".extraConfig = '' # # set defualt policies
reverse_proxy ${lumiose_ip}:7100 # iptables -P INPUT DROP
''; # iptables -P FORWARD DROP
"photos.${homelab.public_domain}".extraConfig = '' # iptables -P OUTPUT ACCEPT
reverse_proxy ${lumiose_ip}:7702 #
''; # # allow loopback
"hass.${homelab.public_domain}".extraConfig = '' # iptables -A INPUT -i lo -j ACCEPT
reverse_proxy ${lumiose_ip}:7704 { # iptables -A OUTPUT -o lo -j ACCEPT
header_up Host {host} #
header_up X-Real-IP {remote_host} # # allow replys
header_up X-Forwarded-For {remote_host} # iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
header_up X-Forwarded-Proto https # iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
} #
''; # # allow vps outbound
# now hosted on vaniville! # iptables -A OUTPUT -o eth0 -j ACCEPT
# "pass.${homelab.public_domain}".extraConfig = '' #
# reverse_proxy 127.0.0.1:7701 # # general settings
# sysctl -w net.ipv4.ip_forward=1 # enable ip forwarding
# iptables -t nat -A POSTROUTING -o $TAILSCALE_IF -j MASQUERADE # postrouting masquerade (outgoing packets appear to come from vps tailscale ip)
# iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT # allows pings
# iptables -A INPUT -p tcp --dport 22 -j ACCEPT # allows ssh
#
#
# # --- minecraft ---
# # port: 25777 tcp & udp
# # prerouting:
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 25777 -j DNAT --to-destination $HOMELAB_IP:25777 # tcp packets on port 25777
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p udp --dport 25777 -j DNAT --to-destination $HOMELAB_IP:25777 # udp packets on port 25777
# # forwards:
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 25777 -j ACCEPT # vps -> homelab: tcp on port 25777
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p udp --dport 25777 -j ACCEPT # vps -> homelab: udp on port 25777
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 25777 -j ACCEPT # homelab -> vps: tcp on port 25777
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p udp --sport 25777 -j ACCEPT # homelab -> vps: udp on port 25777
#
# # --- reverse proxy ---
# # ports: 80 & 443 tcp
# # prerouting:
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 80 -j DNAT --to-destination $HOMELAB_IP:80 # tcp packets on port 80
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 443 -j DNAT --to-destination $HOMELAB_IP:443 # tcp packets on port 443
# # forwards:
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 80 -j ACCEPT # vps -> homelab: tcp on port 80
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 80 -j ACCEPT # homelab -> vps: tcp on port 80
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 443 -j ACCEPT # vps -> homelab: tcp on port 443
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 443 -j ACCEPT # homelab -> vps: tcp on port 443
#
# # --- gitea ssh ---
# # port: 7567 tcp
# # prerouting:
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 7567 -j DNAT --to-destination $HOMELAB_IP:7567 # tcp packets on port 7567
# # forwards:
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 7567 -j ACCEPT # vps -> homelab: tcp on port 7567
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 7567 -j ACCEPT # homelab -> vps: tcp on port 7567
#
# # --- rustdesk ---
# # ports 2114-2119
# # hbbs ports
# # 21115 tcp (nat type test)
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21115 -j DNAT --to-destination $HOMELAB_IP:21115 # tcp packets on port 21115
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21115 -j ACCEPT # vps -> homelab: tcp on port 21115
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21115 -j ACCEPT # homelab -> vps: tcp on port 21115
# # 21116 tcp&udp (id registration, heartbeat, TCP hole punching)
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21116 -j DNAT --to-destination $HOMELAB_IP:21116 # tcp packets on port 21116
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21116 -j ACCEPT # vps -> homelab: tcp on port 21116
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21116 -j ACCEPT # homelab -> vps: tcp on port 21116
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p udp --dport 21116 -j DNAT --to-destination $HOMELAB_IP:21116 # udp packets on port 21116
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p udp --dport 21116 -j ACCEPT # vps -> homelab: tcp on port 21116
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p udp --sport 21116 -j ACCEPT # homelab -> vps: tcp on port 21116
# # 21118 tcp (web client support)
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21118 -j DNAT --to-destination $HOMELAB_IP:21118 # tcp packets on port 21118
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21118 -j ACCEPT # vps -> homelab: tcp on port 21118
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21118 -j ACCEPT # homelab -> vps: tcp on port 21118
# # hbbr ports
# # 21117 tcp (relay services)
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21117 -j DNAT --to-destination $HOMELAB_IP:21117 # tcp packets on port 21117
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21117 -j ACCEPT # vps -> homelab: tcp on port 21117
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21117 -j ACCEPT # homelab -> vps: tcp on port 21117
# # 21119 tcp (web client support)
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21119 -j DNAT --to-destination $HOMELAB_IP:21119 # tcp packets on port 21119
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21119 -j ACCEPT # vps -> homelab: tcp on port 21119
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21119 -j ACCEPT
# ''; # '';
# "git.${homelab.public_domain}".extraConfig = '' #
# reverse_proxy localhost:7703
# '';
};
};
system.stateVersion = "25.05"; # Did you read the comment? system.stateVersion = "25.05"; # Did you read the comment?
} }
hosts/nixos/vaniville/hardware-configuration.nix
-34
View File
@@ -1,34 +0,0 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/profiles/qemu-guest.nix")
];
boot.initrd.availableKernelModules = [ "virtio_pci" "virtio_scsi" "ahci" "sd_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
boot.kernelParams = [ "console=ttyS0,19200n8" ];
boot.loader.grub.device = "nodev";
boot.loader.timeout = 10;
boot.loader.grub.extraConfig = ''
serial --speed=19200 --unit=0 --word=8 --parity=no --stop=1;
terminal_input serial;
terminal_output serial
'';
fileSystems."/" =
{ device = "/dev/sda";
fsType = "ext4";
};
swapDevices =
[ { device = "/dev/sdb"; }
];
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
}
hosts/nixos/wsl/configuration.nix
-58
View File
@@ -1,58 +0,0 @@
{ config, lib, stable_pkgs, unstable_pkgs, ... }:
let
pkgs = stable_pkgs.x86_64;
unstable = unstable_pkgs.x86_64;
in
{
imports =
[
./hardware-configuration.nix
../../nixos
../../../users/blake
../../../modules/system
#../../../modules/homelab
];
home-manager.users.blake.imports = [
../../../users/blake/hosts/wsl.nix
];
wsl = {
enable = true;
defaultUser = "blake";
};
system = {
ssh.enable = true;
sops.enable = true;
};
boot = {
loader = {
efi.canTouchEfiVariables = true;
grub = {
enable = true;
forceInstall = true;
};
};
};
# define shell
programs.zsh.enable = true;
users.defaultUserShell = pkgs.zsh;
# packages reccomended by linode
environment.systemPackages = with pkgs; [
];
# setup the network forwarding this host is designed for
# general networking config
networking = {
hostName = "zygarde"; # Define your hostname.
};
system.stateVersion = "25.05"; # Did you read the comment?
}
hosts/nixos/yveltal/configuration.nix
+5 -10
View File
@@ -26,7 +26,7 @@
ssh.enable = true; ssh.enable = true;
sops.enable = true; sops.enable = true;
yubikey.enable = true; yubikey.enable = true;
yubikey.lock_on_remove = false; yubikey.lock_on_remove = true;
tailscale.enable = true; tailscale.enable = true;
syncthing.enable = true; syncthing.enable = true;
flatpak.enable = true; flatpak.enable = true;
@@ -37,13 +37,12 @@
}; };
desktop = { desktop = {
pipewire.enable = true; pipewire.enable = true;
hypr.enable = false; hypr.enable = true;
greetd.enable = true; greetd.enable = true;
kde.enable = true;
}; };
gaming = { gaming = {
steam.enable = true; steam.enable = true;
lutris.enable = false; lutris.enable = true;
proton_ge.enable = true; proton_ge.enable = true;
gamemode.enable = true; gamemode.enable = true;
mangohud.enable = true; mangohud.enable = true;
@@ -99,12 +98,8 @@
}; };
services.resolved = { services.resolved = {
enable = true; enable = true;
settings = { fallbackDns = ["1.1.1.1" "9.9.9.9"];
Resolve = { dnsovertls = "opportunistic";
FallbackDNS = ["1.1.1.1" "9.9.9.9"];
DNSOverTLS = "opportunistic";
};
};
}; };
hardware.bluetooth.enable = true; hardware.bluetooth.enable = true;
modules/darwin/apps/default.nix
+12 -30
View File
@@ -3,7 +3,8 @@
config, config,
lib, lib,
... ...
}: let }:
let
service = "apps"; service = "apps";
cfg = config.darwin.${service}; cfg = config.darwin.${service};
in { in {
@@ -12,51 +13,32 @@ in {
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# environment.systemPackages = with pkgs; [ # environment.systemPackages = with pkgs; [
# open-webui # uhhh
# ]; # ];
homebrew = { homebrew = {
brews = [ brews = [
"iperf3"
"p7zip"
"sl"
"cowsay"
"apfel"
"yt-dlp"
"ffmpeg"
"ffmpeg-full"
]; ];
casks = [ casks = [
"gnucash" "gnucash"
"utm" "utm"
"libreoffice" "libreoffice"
"firefox" "iperf3"
"zen" "nmap"
"grandperspective" "p7zip"
"spotify" "sl"
"obs" "cowsay"
"gimp"
"audacity"
"anki"
"rustdesk"
"mullvad-vpn"
"transmission"
"finetune"
"yacreader"
"keepassxc"
"thunderbird"
"musicbrainz-picard"
]; ];
masApps = { masApps = {
"pages" = 361309726; "pages" = 409201541;
"numbers" = 361304891; "numbers" = 409203825;
"keynote" = 361285480; "keynote" = 409183694;
"bitwarden" = 1352778147; "bitwarden" = 1352778147;
"darkreader" = 1438243180; "darkreader" = 1438243180;
"ghostery" = 6504861501; "ghostery" = 6504861501;
"privacy" = 6449850851; "privacy" = 6449850851;
"flo" = 6529533140;
}; };
}; };
}; };
modules/darwin/cyber/default.nix
-40
View File
@@ -1,40 +0,0 @@
{
pkgs,
config,
lib,
...
}:
let
service = "cyber";
cfg = config.darwin.${service};
in {
options.darwin.${service} = {
enable = lib.mkEnableOption "install cyber sec apps";
};
config = lib.mkIf cfg.enable {
environment.systemPackages = with pkgs; [
metasploit
];
homebrew = {
brews = [
"nmap"
"rustscan"
"masscan"
"nikto"
"aircrack-ng"
"hashcat"
"john"
"sqlmap"
"gobuster"
"ffuf"
];
casks = [
"wireshark-app"
];
};
};
}
modules/darwin/default.nix
+3 -4
View File
@@ -5,13 +5,12 @@
... ...
}: { }: {
imports = [ imports = [
# ./ssh
./tailscale ./tailscale
./nextdns
./syncthing ./syncthing
./yubikey ./yubikey
./work ./work
./apps # ./sops
./cyber
./gaming
]; ];
} }
modules/darwin/gaming/default.nix
-33
View File
@@ -1,33 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
service = "gaming";
cfg = config.darwin.${service};
in {
options.darwin.${service} = {
enable = lib.mkEnableOption "installs generally wanted apps";
};
config = lib.mkIf cfg.enable {
# environment.systemPackages = with pkgs; [
# uhhh
# ];
homebrew = {
brews = [
];
casks = [
"steam"
"prismlauncher"
"discord"
# "runelite"
# "jagex"
];
masApps = {
};
};
};
}
modules/darwin/nextdns/default.nix
-23
View File
@@ -1,23 +0,0 @@
{
pkgs,
config,
lib,
inputs,
...
}: let
service = "nextdns";
cfg = config.darwin.${service};
in {
options.darwin.${service} = {
enable = lib.mkEnableOption "enables ${service}";
};
config = lib.mkIf cfg.enable {
services.${service} = {
enable = true;
arguments = [
"-profile 527db2"
];
};
};
}
modules/darwin/sops/default.nix
+1 -2
View File
@@ -5,8 +5,7 @@
inputs, inputs,
... ...
}: let }: let
service = "sops"; cfg = config.darwin.sops;
cfg = config.darwin.${service};
in { in {
imports = [inputs.sops-nix.nixosModules.sops]; imports = [inputs.sops-nix.nixosModules.sops];
modules/darwin/tailscale/default.nix
+12 -15
View File
@@ -5,28 +5,25 @@
inputs, inputs,
... ...
}: let }: let
service = "tailscale"; cfg = config.darwin.tailscale;
cfg = config.darwin.${service};
in { in {
options.darwin.tailscale = { options.darwin.tailscale = {
enable = lib.mkEnableOption "enables tailscale"; enable = lib.mkEnableOption "enables tailscale";
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# services.tailscale = { services.tailscale = {
# enable = true; enable = true;
# #overrideLocalDns = true; #overrideLocalDns = true;
# #authKeyFile = authkey_file; #authKeyFile = authkey_file;
# }; };
# environment.systemPackages = with pkgs; [ homebrew = {
# tailscale-gui casks = [
# ]; "tailscale-app"
];
};
# homebrew = {
# casks = [
# "tailscale-app"
# ];
# };
}; };
} }
modules/darwin/work/default.nix
+10 -12
View File
@@ -5,32 +5,30 @@
inputs, inputs,
... ...
}: let }: let
service = "work"; cfg = config.darwin.work;
cfg = config.darwin.${service};
in { in {
options.darwin.work = { options.darwin.work = {
enable = lib.mkEnableOption "installs apps for work"; enable = lib.mkEnableOption "installs apps for work";
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# services.tailscale = { services.tailscale = {
# enable = true; enable = true;
# #overrideLocalDns = true; #overrideLocalDns = true;
# #authKeyFile = authkey_file; #authKeyFile = authkey_file;
# }; };
homebrew = { homebrew = {
casks = [ casks = [
"asana" "asana"
"microsoft-teams" #"microsoft-teams"
"microsoft-office" "microsoft-office"
"jump-desktop"
"wifiman"
"adobe-acrobat-pro"
]; ];
masApps = { masApps = {
"configurator" = 1037126344; "configurator" = 1168254295;
}; };
}; };
}; };
} }
modules/desktop/default.nix
-1
View File
@@ -9,6 +9,5 @@
./hypr ./hypr
./greetd ./greetd
./gaming ./gaming
./kde
]; ];
} }
modules/desktop/kde/default.nix
-53
View File
@@ -1,53 +0,0 @@
{
pkgs,
lib,
config,
...
}: let
cfg = config.desktop.kde;
in {
options.desktop.kde = {
enable = lib.mkEnableOption "enable kde on nixos side";
};
config = lib.mkIf cfg.enable {
# enable kde plasma
services = {
desktopManager.plasma6.enable = true;
#displayManager.sddm.enable = true;
#displayManager.sddm.wayland.enable = true;
};
environment.systemPackages = with pkgs; [
# KDE Utilities
kdePackages.discover # Optional: Software center for Flatpaks/firmware updates
kdePackages.kcalc # Calculator
kdePackages.kcharselect # Character map
kdePackages.kclock # Clock app
kdePackages.kcolorchooser # Color picker
kdePackages.kolourpaint # Simple paint program
kdePackages.ksystemlog # System log viewer
kdePackages.sddm-kcm # SDDM configuration module
kdiff3 # File/directory comparison tool
# Hardware/System Utilities (Optional)
kdePackages.isoimagewriter # Write hybrid ISOs to USB
kdePackages.partitionmanager # Disk and partition management
hardinfo2 # System benchmarks and hardware info
wayland-utils # Wayland diagnostic tools
wl-clipboard # Wayland copy/paste support
vlc # Media player
];
environment.plasma6.excludePackages = with pkgs; [
kdePackages.elisa # Music player
kdePackages.kdepim-runtime # Akonadi agents
kdePackages.kmahjongg
#kdePackages.kmines
kdePackages.konversation # IRC client
kdePackages.kpat # Solitaire
kdePackages.ksudoku
kdePackages.ktorrent
];
};
}
modules/fileshares/holocron/default.nix
-26
View File
@@ -1,26 +0,0 @@
{
pkgs,
config,
lib,
inputs,
...
}: {
# services show up in glance in reverse import order lmao
imports = [
./nfs
./smb
./zfs
./syncthing
./offsite
# ./copyparty
./perms
];
# # define the groups used for backups and archives
# users.users.archives = {
# isSystemUser = true;
# group = "archives";
# };
#
# users.groups.archives = {gid = 727;};
}
modules/fileshares/holocron/offsite/default.nix
-68
View File
@@ -1,68 +0,0 @@
{
config,
pkgs,
lib,
...
}: let
service = "offsite";
cfg = config.holocron.${service};
sec = config.sops.secrets;
in {
options.holocron.offsite = {
enable = lib.mkEnableOption "enables backup script for holocron fileshare";
paths = lib.mkOption {
type = with lib.types; listOf str;
default = [
"/holocron/srv"
"/holocron/users"
];
description = "list of paths to backup";
};
offsite_user = lib.mkOption {
type = lib.types.str;
default = "lifeboat";
description = "user to connect to offsite host with";
};
offsite_target = lib.mkOption {
type = lib.types.str;
default = "lifeboat.holocron.blue";
description = "ip or domain for offsite backups";
};
offsite_dir = lib.mkOption {
type = lib.types.str;
default = "lifeboat/holocron";
description = "path to rsync offsite backups to";
};
};
config = lib.mkIf cfg.enable {
systemd.services.${service} = {
description = "holocron daily sync";
serviceConfig = {
Type = "oneshot";
User = "root";
Group = "archives";
};
script = ''
${pkgs.sshpass}/bin/sshpass -f ${sec."lifeboat_rsync".path} \
${pkgs.rsync}/bin/rsync -aHAX --partial --numeric-ids --info=progress2,name1,stats2 --delete \
-e "${pkgs.openssh}/bin/ssh -o StrictHostKeyChecking=no" \
${builtins.concatStringsSep " " cfg.paths} \
${cfg.offsite_user}@${cfg.offsite_target}::${cfg.offsite_dir}
'';
};
systemd.timers.${service} = {
description = "timer for ${service}";
wantedBy = ["timers.target"];
timerConfig = {
OnCalendar = "*-*-* 05:00:00";
Persistent = true;
};
};
};
}
modules/fileshares/holocron/smb/default.nix
-130
View File
@@ -1,130 +0,0 @@
{
pkgs,
config,
lib,
...
}:
# define smb shares
let
cfg = config.holocron.smb;
smb_shares = {
global = {
# time machine specifc config, must be global
"fruit:aapl" = "yes";
"fruit:nfs_aces" = "no";
"fruit:metadata" = "stream";
"fruit:model" = "TimeCapsule";
"fruit:posix_rename" = "yes";
"fruit:veto_appledouble" = "no";
"fruit:wipe_intentionally_left_blank_rfork" = "yes";
"fruit:delete_empty_adfiles" = "yes";
"vfs objects" = "catia fruit streams_xattr";
"ea support" = "yes";
"spotlight" = "no";
"multicast dns register" = "no";
"min protocol" = "SMB2";
};
archives = {
path = "/holocron/archives";
browseable = true;
writable = true;
guestOk = false;
"create mask" = "0775";
"directory mask" = "0775";
};
timemachine = {
browseable = true;
"path" = "/holocron/archives/timemachine";
"valid users" = "blake";
"public" = "no";
"writeable" = "yes";
"force user" = "blake";
# time machine specifc config
"fruit:time machine" = "yes";
"fruit:time machine max size" = "5T";
"case sensitive" = "yes";
"default case" = "lower";
"preserve case" = "no";
"short preserve case" = "no";
"create mask" = "0660";
"directory mask" = "0770";
"force group" = "blake";
};
users = {
path = "/holocron/users";
browseable = true;
writable = true;
guestOk = false;
"create mask" = "0660";
"directory mask" = "0770";
};
media = {
path = "/holocron/media";
browseable = true;
writable = true;
guestOk = false;
"create mask" = "0775";
"directory mask" = "0775";
};
nvr = {
path = "/holocron/nvr";
writable = true;
guestOk = false;
browseable = true;
"valid users" = "archives";
"public" = "no";
"writeable" = "yes";
"force user" = "archives";
# time machine specifc config
"create mask" = "0660";
"directory mask" = "0770";
"force group" = "archives";
};
};
in {
options.holocron.smb = {
enable = lib.mkEnableOption "enables smb";
};
config = lib.mkIf cfg.enable {
# enable smb with all shares
services.samba = {
enable = true;
package = pkgs.sambaFull;
settings = smb_shares;
};
# ensure time machine can discover the share without `tmutil`
services.avahi = {
enable = true;
openFirewall = true;
nssmdns4 = true;
publish.enable = true;
publish.userServices = true;
extraServiceFiles = {
timemachine = ''
<?xml version="1.0" standalone='no'?>
<!DOCTYPE service-group SYSTEM "avahi-service.dtd">
<service-group>
<name replace-wildcards="yes">%h</name>
<service>
<type>_smb._tcp</type>
<port>445</port>
</service>
<service>
<type>_device-info._tcp</type>
<port>0</port>
<txt-record>model=TimeCapsule8,119</txt-record>
</service>
<service>
<type>_adisk._tcp</type>
<port>0</port>
<txt-record>dk0=adVN=timemachine,adVF=0x82</txt-record>
<txt-record>sys=waMa=0,adVF=0x100</txt-record>
</service>
</service-group>
'';
};
};
};
}
modules/fileshares/holocron/zfs/default.nix
-72
View File
@@ -1,72 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
cfg = config.holocron.zfs;
sec = config.sops.secrets;
in {
options.holocron.zfs = {
enable = lib.mkEnableOption "enables zfs";
};
config = lib.mkIf cfg.enable {
# set network host id
# enable zfs support
boot.kernelModules = ["zfs"];
boot.supportedFilesystems = ["zfs"];
boot.zfs.forceImportRoot = false;
# boot.initrd.services.zfs.enable = true;
# boot.zfs.requestEncryptionCredentials = true;
# arc cache size
boot.kernelParams = ["zfs.zfs_arc_max=12884901888"];
# pools to import
boot.zfs.extraPools = ["holocron"];
# enable smart monitoring
services.smartd = {
enable = true;
autodetect = true;
defaults.monitored = "-a -o on -s (S/../.././05|L/../01/./05)";
notifications = {
test = false;
mail = {
enable = true;
recipient = "blake";
sender = "alerts@blakedheld.xyz";
};
};
};
# enable zfs
services.zfs = {
autoScrub.enable = true;
autoScrub.interval = "weekly";
autoSnapshot = {
enable = true;
frequent = 4; # 15 min snapshots
hourly = 24; # hourly snapshots
daily = 7; # daily snapshots
weekly = 4; # weekly snapshots
monthly = 12; # monthly snapshots
};
# email notifs
zed = {
enableMail = true;
settings = {
ZED_EMAIL_ADDR = ["root" "blake"];
# send notification if scrub succeeds
ZED_NOTIFY_VERBOSE = true;
};
};
};
# install userspace tools for smart
environment.systemPackages = with pkgs; [smartmontools];
};
}
modules/gameservers/cs2/default.nix
-162
View File
@@ -1,162 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
service = "cs2";
cfg = config.gameservers.${service};
in {
options.gameservers.${service} = {
enable = lib.mkEnableOption "Counter Strike 2 server";
data_dir = lib.mkOption {
type = lib.types.str;
default = "/var/lib/gameservers/cs2";
};
port = lib.mkOption {
type = lib.types.int;
default = 27015;
};
tv_port = lib.mkOption {
type = lib.types.int;
default = 27016;
};
hostname = lib.mkOption {
type = lib.types.str;
default = "recoil.pro CS2";
};
map = lib.mkOption {
type = lib.types.str;
default = "de_dust2";
};
max_players = lib.mkOption {
type = lib.types.int;
default = 10;
};
backup = lib.mkOption {
type = lib.types.bool;
default = true;
};
backup_repo = lib.mkOption {
type = lib.types.path;
default = "/holocron/archives/gameservers/cs2";
};
};
config = lib.mkIf cfg.enable {
users.users.cs2 = {
isSystemUser = true;
group = "cs2";
home = cfg.data_dir;
createHome = true;
};
users.groups.cs2 = {};
environment.systemPackages = with pkgs; [
steamcmd
steam-run
rcon
];
systemd.tmpfiles.rules = [
"d ${cfg.data_dir} 0770 cs2 cs2 -"
"d ${cfg.data_dir}/server 0770 cs2 cs2 -"
];
environment.etc."cs2/server.cfg".text = ''
hostname "${cfg.hostname}"
sv_lan 0
rcon_password "$(<${config.sops.secrets."cs2/rcon".path})"
mp_autoteambalance 1
mp_limitteams 2
'';
systemd.services.cs2-update = {
description = "Update CS2 server";
serviceConfig = {
Type = "oneshot";
User = "cs2";
};
script = ''
${pkgs.steamcmd}/bin/steamcmd \
+force_install_dir ${cfg.data_dir}/server \
+login anonymous \
+app_update 730 validate \
+quit
'';
};
systemd.services.cs2-server = {
description = "Counter Strike 2 Dedicated Server";
after = [
"network.target"
"cs2-update.service"
];
requires = [
"cs2-update.service"
];
wantedBy = ["multi-user.target"];
serviceConfig = {
User = "cs2";
Group = "cs2";
WorkingDirectory = "${cfg.data_dir}";
Restart = "always";
ExecStart = pkgs.writeShellScript "cs2-start" ''
export GSLT=$(cat ${config.sops.secrets."cs2/gslt".path})
exec ${pkgs.steam-run}/bin/steam-run -- \
${cfg.data_dir}/server/game/bin/linuxsteamrt64/cs2 \
-dedicated \
-usercon \
-console \
-port ${toString cfg.port} \
-tv_port ${toString cfg.tv_port} \
-maxplayers_override ${toString cfg.max_players} \
+game_type 0 \
+game_mode 1 \
+mapgroup mg_active \
+map ${cfg.map} \
+sv_setsteamaccount "$GSLT" \
+exec /etc/gameserver/cs2/server.cfg
'';
};
};
networking.firewall.allowedTCPPorts = [cfg.port cfg.tv_port];
networking.firewall.allowedUDPPorts = [cfg.port cfg.tv_port];
# backups cs2 server with borg!
services.borgbackup.jobs.${service} = {
archiveBaseName = service;
repo = cfg.backup_repo;
paths = cfg.data_dir;
compression = "auto,zstd";
#preHook = "systemctl start mysql-backup.service";
startAt = "*-*-* *:00:00";
group = "archives";
encryption.mode = "repokey-blake2";
encryption.passCommand = "cat ${config.sops.secrets."borg_passwd".path}";
extraArgs = ["--verbose" "--show-rc" "--umask" "0007"];
extraCreateArgs = ["--list" "--stats" "--filter" "AME"];
prune.keep = {
within = "1d"; # Keep all archives from the last day
hourly = 24;
daily = 7;
weekly = 12;
monthly = -1; # Keep at least one archive for each month
};
};
# manage secrets with sops
sops.secrets = {
"${service}/gslt" = {
owner = service;
group = service;
};
"${service}/rcon" = {
owner = service;
group = service;
};
};
};
}
modules/gameservers/cs2/default.nix.test
-162
View File
@@ -1,162 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
service = "cs2";
cfg = config.gameservers.${service};
in {
options.gameservers.${service} = {
enable = lib.mkEnableOption "Counter Strike 2 server";
data_dir = lib.mkOption {
type = lib.types.str;
default = "/var/lib/gameservers/cs2";
};
port = lib.mkOption {
type = lib.types.int;
default = 27015;
};
tv_port = lib.mkOption {
type = lib.types.int;
default = 27016;
};
hostname = lib.mkOption {
type = lib.types.str;
default = "recoil.pro CS2";
};
map = lib.mkOption {
type = lib.types.str;
default = "de_dust2";
};
max_players = lib.mkOption {
type = lib.types.int;
default = 10;
};
backup = lib.mkOption {
type = lib.types.bool;
default = true;
};
backup_repo = lib.mkOption {
type = lib.types.path;
default = "/holocron/archives/gameservers/cs2";
};
};
config = lib.mkIf cfg.enable {
users.users.cs2 = {
isSystemUser = true;
group = "cs2";
home = cfg.data_dir;
createHome = true;
};
users.groups.cs2 = {};
environment.systemPackages = with pkgs; [
steamcmd
steam-run
rcon
];
systemd.tmpfiles.rules = [
"d ${cfg.data_dir} 0770 cs2 cs2 -"
"d ${cfg.data_dir}/server 0770 cs2 cs2 -"
];
environment.etc."cs2/server.cfg".text = ''
hostname "${cfg.hostname}"
sv_lan 0
rcon_password "$(<${config.sops.secrets."cs2/rcon".path})"
mp_autoteambalance 1
mp_limitteams 2
'';
systemd.services.cs2-update = {
description = "Update CS2 server";
serviceConfig = {
Type = "oneshot";
User = "cs2";
};
script = ''
${pkgs.steamcmd}/bin/steamcmd \
+force_install_dir ${cfg.data_dir}/server \
+login anonymous \
+app_update 730 validate \
+quit
'';
};
systemd.services.cs2-server = {
description = "Counter Strike 2 Dedicated Server";
after = [
"network.target"
"cs2-update.service"
];
requires = [
"cs2-update.service"
];
wantedBy = ["multi-user.target"];
serviceConfig = {
User = "cs2";
Group = "cs2";
WorkingDirectory = "${cfg.data_dir}/server";
Restart = "always";
ExecStart = pkgs.writeShellScript "cs2-start" ''
export GSLT=$(cat ${config.sops.secrets."cs2/gslt".path})
exec ${pkgs.steam-run}/bin/steam-run -- \
${cfg.data_dir}/server/game/cs2.sh \
-dedicated \
-usercon \
-console \
-port ${toString cfg.port} \
-tv_port ${toString cfg.tv_port} \
-maxplayers_override ${toString cfg.max_players} \
+game_type 0 \
+game_mode 1 \
+mapgroup mg_active \
+map ${cfg.map} \
+sv_setsteamaccount "$GSLT" \
+exec /etc/gameserver/cs2/server.cfg
'';
};
};
networking.firewall.allowedTCPPorts = [cfg.port cfg.tv_port];
networking.firewall.allowedUDPPorts = [cfg.port cfg.tv_port];
# backups cs2 server with borg!
services.borgbackup.jobs.${service} = {
archiveBaseName = service;
repo = cfg.backup_repo;
paths = cfg.data_dir;
compression = "auto,zstd";
#preHook = "systemctl start mysql-backup.service";
startAt = "*-*-* *:00:00";
group = "archives";
encryption.mode = "repokey-blake2";
encryption.passCommand = "cat ${config.sops.secrets."borg_passwd".path}";
extraArgs = ["--verbose" "--show-rc" "--umask" "0007"];
extraCreateArgs = ["--list" "--stats" "--filter" "AME"];
prune.keep = {
within = "1d"; # Keep all archives from the last day
hourly = 24;
daily = 7;
weekly = 12;
monthly = -1; # Keep at least one archive for each month
};
};
# manage secrets with sops
sops.secrets = {
"${service}/gslt" = {
owner = service;
group = service;
};
"${service}/rcon" = {
owner = service;
group = service;
};
};
};
}
modules/gameservers/minecraft_modded/default.nix
+22 -54
View File
@@ -8,12 +8,8 @@
cfg = config.gameservers.${service}; cfg = config.gameservers.${service};
sec = config.sops.secrets; sec = config.sops.secrets;
servers = { servers = {
# cobblemon = { cobblemon = {
# data_dir = "/var/lib/gameservers/minecraft_modded/cobblemon"; data_dir = "/var/lib/gameservers/minecraft_modded/cobblemon";
# start_file = "start.sh";
# };
linggango = {
data_dir = "/var/lib/gameservers/minecraft_modded/linggango";
start_file = "start.sh"; start_file = "start.sh";
}; };
}; };
@@ -22,7 +18,7 @@ in {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
url = lib.mkOption { url = lib.mkOption {
type = lib.types.str; type = lib.types.str;
default = "modded.recoil.pro"; default = "mc.recoil.pro";
description = "set domain for ${service}"; description = "set domain for ${service}";
}; };
data_dir = lib.mkOption { data_dir = lib.mkOption {
@@ -40,34 +36,18 @@ in {
default = false; default = false;
description = "enable backups for ${service}"; description = "enable backups for ${service}";
}; };
motd_gs = lib.mkOption { motd = lib.mkOption {
type = lib.types.nullOr lib.types.str; type = lib.types.nullOr lib.types.str;
default = ["craftoria"]; default = "velocity";
}; };
backup_repo = lib.mkOption { backup_repo = lib.mkOption {
type = lib.types.path; type = lib.types.path;
default = "/var/backup/gameservers/minecraft/modded"; default = "/holocron/archives/gameservers/minecraft/modded";
description = "path to take hourly backups to with borg!"; description = "path to take hourly backups to with borg!";
}; };
offsite_user = lib.mkOption {
type = lib.types.str;
default = "lifeboat";
description = "user to connect to offsite host with";
};
offsite_target = lib.mkOption {
type = lib.types.str;
default = "lifeboat.holocron.blue";
description = "ip or domain for offsite backups";
};
offsite_dir = lib.mkOption {
type = lib.types.str;
default = "lifeboat/holocron/archives/gameservers";
description = "path to rsync offsite backups to";
};
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
users.groups.minecraft = {gid = lib.mkForce cfg.ids;};
# declare ${service} user # declare ${service} user
users.users.minecraft = lib.mkDefault { users.users.minecraft = lib.mkDefault {
@@ -91,15 +71,13 @@ in {
description = "minecraft_recpro: ${name}"; description = "minecraft_recpro: ${name}";
after = ["network.target"]; after = ["network.target"];
wants = ["network.target"]; wants = ["network.target"];
path = [pkgs.openjdk21];
serviceConfig = { serviceConfig = {
User = "minecraft"; User = "minecraft";
Group = "minecraft"; Group = "minecraft";
WorkingDirectory = srv.data_dir; WorkingDirectory = srv.data_dir;
UMask = "0007"; UMask = "0007";
#ExecStart = "${pkgs.openjdk21}/bin/java -Xms4G -Xmx12G -XX:+UseG1GC -XX:+ParallelRefProcEnabled -XX:MaxGCPauseMillis=200 -XX:+UnlockExperimentalVMOptions -XX:+AlwaysPreTouch -XX:G1NewSizePercent=30 -XX:G1MaxNewSizePercent=40 -XX:G1HeapRegionSize=8M -XX:G1ReservePercent=20 -XX:G1HeapWastePercent=5 -XX:G1MixedGCCountTarget=4 -XX:InitiatingHeapOccupancyPercent=15 -XX:G1MixedGCLiveThresholdPercent=90 -XX:G1RSetUpdatingPauseTimePercent=5 -XX:SurvivorRatio=32 -XX:+PerfDisableSharedMem -XX:MaxTenuringThreshold=1 -Dusing.aikars.flags=https://mcflags.emc.gs -Daikars.new.flags=true @libraries/net/neoforged/neoforge/21.1.211/unix_args.txt"; ExecStart = "${pkgs.openjdk21}/bin/java -Xms4G -Xmx12G -XX:+UseG1GC -XX:+ParallelRefProcEnabled -XX:MaxGCPauseMillis=200 -XX:+UnlockExperimentalVMOptions -XX:+AlwaysPreTouch -XX:G1NewSizePercent=30 -XX:G1MaxNewSizePercent=40 -XX:G1HeapRegionSize=8M -XX:G1ReservePercent=20 -XX:G1HeapWastePercent=5 -XX:G1MixedGCCountTarget=4 -XX:InitiatingHeapOccupancyPercent=15 -XX:G1MixedGCLiveThresholdPercent=90 -XX:G1RSetUpdatingPauseTimePercent=5 -XX:SurvivorRatio=32 -XX:+PerfDisableSharedMem -XX:MaxTenuringThreshold=1 -Dusing.aikars.flags=https://mcflags.emc.gs -Daikars.new.flags=true @libraries/net/neoforged/neoforge/21.1.211/unix_args.txt";
#ExecStart = "${srv.data_dir}/${srv.start_file}"; #ExecStart = "${srv.data_dir}/${srv.start_file}";
ExecStart = "${pkgs.openjdk21}/bin/java -Xms4G -Xmx24G @libraries/net/minecraftforge/forge/1.20.1-47.4.20/unix_args.txt \"$@\"";
Restart = "on-failure"; Restart = "on-failure";
KillMode = "process"; KillMode = "process";
}; };
@@ -107,7 +85,7 @@ in {
}) })
servers; servers;
environment.systemPackages = with pkgs; [openjdk21 mcrcon borgbackup sshpass tree rsync]; environment.systemPackages = with pkgs; [openjdk21 mcrcon];
# services.mysql = { # services.mysql = {
# enable = true; # enable = true;
@@ -127,25 +105,22 @@ in {
# }; # };
# open firewall # open firewall
networking.firewall.allowedTCPPorts = [25579]; networking.firewall.allowedTCPPorts = [25778];
networking.firewall.allowedUDPPorts = [25580]; #voicechat
sops.secrets = { # sops.secrets = {
"borg_passwd" = { # "velocity_forwarding" = {
owner = "root"; # owner = "minecraft";
group = "root"; # group = "minecraft";
}; # path = "/var/lib/gameservers/minecraft_recpro/velocity/forwarding.secret";
"lifeboat_rsync" = { # mode = "0400";
owner = "root"; # };
group = "archives"; # "minecraft_recpro_db_passwd" = {
mode = "0440"; # owner = "mysql";
}; # group = "mysql";
}; # };
# };
# helpful and for scripts # backups minecraft_recpro with borg!
users.groups.archives = {gid = 727;};
# backups minecraft_modded with borg!
services.borgbackup.jobs.${service} = { services.borgbackup.jobs.${service} = {
archiveBaseName = service; archiveBaseName = service;
repo = cfg.backup_repo; repo = cfg.backup_repo;
@@ -163,13 +138,6 @@ in {
); );
compression = "auto,zstd"; compression = "auto,zstd";
#preHook = "systemctl start mysql-backup.service"; #preHook = "systemctl start mysql-backup.service";
postHook = ''
${pkgs.sshpass}/bin/sshpass -f ${sec."lifeboat_rsync".path} \
${pkgs.rsync}/bin/rsync -aHAX --partial --numeric-ids --info=progress2,name1,stats2 --delete \
-e "ssh -o StrictHostKeyChecking=no" \
${toString cfg.backup_repo} \
${cfg.offsite_user}@${cfg.offsite_target}::${cfg.offsite_dir}
'';
startAt = "*-*-* *:00:00"; startAt = "*-*-* *:00:00";
group = "archives"; group = "archives";
encryption.mode = "repokey-blake2"; encryption.mode = "repokey-blake2";
modules/gameservers/minecraft_recpro/default.nix
+4 -26
View File
@@ -49,30 +49,15 @@ in {
default = false; default = false;
description = "enable backups for ${service}"; description = "enable backups for ${service}";
}; };
motd_gs = lib.mkOption { motd = lib.mkOption {
type = lib.types.nullOr (lib.types.listOf lib.types.str); type = lib.types.nullOr lib.types.str;
default = ["velocity" "smp" "superflat" "bento"]; default = "velocity";
}; };
backup_repo = lib.mkOption { backup_repo = lib.mkOption {
type = lib.types.path; type = lib.types.path;
default = "/holocron/archives/gameservers/minecraft/recpro_stack"; default = "/holocron/archives/gameservers/minecraft/recpro_stack";
description = "path to take hourly backups to with borg!"; description = "path to take hourly backups to with borg!";
}; };
offsite_user = lib.mkOption {
type = lib.types.str;
default = "lifeboat";
description = "user to connect to offsite host with";
};
offsite_target = lib.mkOption {
type = lib.types.str;
default = "lifeboat.holocron.blue";
description = "ip or domain for offsite backups";
};
offsite_dir = lib.mkOption {
type = lib.types.str;
default = "lifeboat/holocron/archives/gameservers";
description = "path to rsync offsite backups to";
};
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
@@ -106,7 +91,7 @@ in {
Group = "minecraft"; Group = "minecraft";
WorkingDirectory = srv.data_dir; WorkingDirectory = srv.data_dir;
UMask = "0007"; UMask = "0007";
ExecStart = "${pkgs.openjdk25}/bin/java -Xmx${srv.ram} -jar server.jar nogui"; ExecStart = "${pkgs.openjdk21}/bin/java -Xmx${srv.ram} -jar server.jar nogui";
Restart = "on-failure"; Restart = "on-failure";
KillMode = "process"; KillMode = "process";
}; };
@@ -167,13 +152,6 @@ in {
); );
compression = "auto,zstd"; compression = "auto,zstd";
preHook = "systemctl start mysql-backup.service"; preHook = "systemctl start mysql-backup.service";
postHook = ''
${pkgs.sshpass}/bin/sshpass -f ${sec."lifeboat_rsync".path} \
${pkgs.rsync}/bin/rsync -aHAX --partial --numeric-ids --info=progress2,name1,stats2 --delete \
-e "ssh -o StrictHostKeyChecking=no" \
${toString cfg.backup_repo} \
${cfg.offsite_user}@${cfg.offsite_target}::${cfg.offsite_dir}
'';
startAt = "*-*-* *:00:00"; startAt = "*-*-* *:00:00";
group = "archives"; group = "archives";
encryption.mode = "repokey-blake2"; encryption.mode = "repokey-blake2";
modules/gameservers/valheim/default.nix
-149
View File
@@ -1,149 +0,0 @@
{
pkgs,
config,
lib,
inputs,
...
}: let
nixservice = "podman-valheim";
service = "valheim";
cfg = config.gameservers.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
options.gameservers.${service} = {
enable = lib.mkEnableOption "enables ${service}";
# set port options
port = lib.mkOption {
type = lib.types.int;
default = 2456;
description = "set port for ${service} (default: ${toString cfg.port}";
};
url = lib.mkOption {
type = lib.types.str;
default = "${service}.${homelab.base_domain}";
description = "set domain for ${service}";
};
data_dir = lib.mkOption {
type = lib.types.str;
default = "/var/lib/gameservers/${service}";
description = "set data directory for ${service}";
};
ids = lib.mkOption {
type = lib.types.int;
default = cfg.port;
description = "set uid and pid of ${service} user (matches port by default)";
};
motd_gs = lib.mkOption {
type = lib.types.nullOr (lib.types.listOf lib.types.str);
default = ["podman-valheim"];
};
backup = lib.mkOption {
type = lib.types.bool;
default = false;
description = "enable backups for ${service}";
};
backup_repo = lib.mkOption {
type = lib.types.path;
default = "/var/backup/gameservers/valheim";
description = "path to take hourly backups to with borg!";
};
offsite_user = lib.mkOption {
type = lib.types.str;
default = "lifeboat";
description = "user to connect to offsite host with";
};
offsite_target = lib.mkOption {
type = lib.types.str;
default = "lifeboat.holocron.blue";
description = "ip or domain for offsite backups";
};
offsite_dir = lib.mkOption {
type = lib.types.str;
default = "lifeboat/holocron/archives/gameservers";
description = "path to rsync offsite backups to";
};
};
config = lib.mkIf cfg.enable {
# declare ${service} group
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
# declare ${service} user
users.users.${service} = {
description = "${service} server user";
uid = lib.mkForce cfg.ids;
isSystemUser = true;
home = cfg.data_dir;
createHome = true;
group = service;
extraGroups = [];
};
virtualisation.oci-containers.containers = {
${service} = {
image = "ghcr.io/community-valheim-tools/valheim-server";
autoStart = true;
extraOptions = [
"--cap-add=sys_nice"
"--stop-timeout=120"
];
ports = [
"2456-2457:2456-2457/udp"
"2456:80/tcp"
];
volumes = [
"${cfg.data_dir}/config:/config"
"${cfg.data_dir}/data:/opt/valheim"
];
environment = {
SERVER_NAME = "recpro";
SERVER_PASS = "recoil727pro";
#WORLD_NAME = "";
STATUS_HTTP = "true";
TZ = homelab.tz;
PUID = toString config.users.users.${service}.uid;
PGID = toString config.users.groups.${service}.gid;
};
};
};
# override umask to make permissions work out
systemd.services.${service}.serviceConfig = {
UMask = lib.mkForce "0007";
};
# open firewall
networking.firewall.allowedTCPPorts = [cfg.port];
networking.firewall.allowedUDPPorts = [2456 2457];
# backups valhiem with borg!
services.borgbackup.jobs.${service} = {
archiveBaseName = service;
repo = cfg.backup_repo;
paths = cfg.data_dir;
compression = "auto,zstd";
#preHook = "systemctl start mysql-backup.service";
postHook = ''
${pkgs.sshpass}/bin/sshpass -f ${sec."lifeboat_rsync".path} \
${pkgs.rsync}/bin/rsync -aHAX --partial --numeric-ids --info=progress2,name1,stats2 --delete \
-e "ssh -o StrictHostKeyChecking=no" \
${toString cfg.backup_repo} \
${cfg.offsite_user}@${cfg.offsite_target}::${cfg.offsite_dir}
'';
startAt = "*-*-* *:00:00";
group = "archives";
encryption.mode = "repokey-blake2";
encryption.passCommand = "cat ${config.sops.secrets."borg_passwd".path}";
extraArgs = ["--verbose" "--show-rc" "--umask" "0007"];
extraCreateArgs = ["--list" "--stats" "--filter" "AME"];
prune.keep = {
within = "1d"; # Keep all archives from the last day
hourly = 24;
daily = 7;
weekly = 12;
monthly = -1; # Keep at least one archive for each month
};
};
};
}
modules/homelab/services/homebox/default.nix → modules/holocron/copyparty/default.nix
+69 -35
View File
@@ -2,20 +2,23 @@
pkgs, pkgs,
config, config,
lib, lib,
inputs,
... ...
}: let }: let
service = "homebox"; service = "copyparty";
cfg = config.homelab.${service}; cfg = config.holocron.${service};
sec = config.sops.secrets; sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
in { in {
options.homelab.${service} = { imports = [inputs.copyparty.nixosModules.default];
options.holocron.${service} = {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
# set port options # set port options
port = lib.mkOption { port = lib.mkOption {
type = lib.types.int; type = lib.types.int;
default = 7709; default = 7902;
description = "set port for ${service} (default: ${toString cfg.port}"; description = "set port for ${service} (default: ${toString cfg.port}";
}; };
url = lib.mkOption { url = lib.mkOption {
@@ -38,13 +41,10 @@ in {
default = true; default = true;
description = "enable backups for ${service}"; description = "enable backups for ${service}";
}; };
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = service;
};
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
nixpkgs.overlays = [inputs.copyparty.overlays.default];
# declare ${service} group # declare ${service} group
users.groups.${service} = { users.groups.${service} = {
gid = lib.mkForce cfg.ids; gid = lib.mkForce cfg.ids;
@@ -58,6 +58,7 @@ in {
home = cfg.data_dir; home = cfg.data_dir;
createHome = true; createHome = true;
group = service; group = service;
extraGroups = [ "media" "blake" "archives" ];
}; };
# enable the ${service} service # enable the ${service} service
@@ -66,24 +67,56 @@ in {
user = service; user = service;
group = service; group = service;
settings = { settings = {
HBOX_WEB_PORT = toString cfg.port; i = "0.0.0.0";
HBOX_STORAGE_CONN_STRING = "file://${cfg.data_dir}"; p = [7902];
HBOX_STORAGE_PREFIX_PATH = "data"; rproxy = 1;
HBOX_DATABASE_DRIVER = "sqlite3"; };
HBOX_DATABASE_SQLITE_PATH = "${cfg.data_dir}/data/homebox.db?_pragma=busy_timeout=999&_pragma=journal_mode=WAL&_fk=1"; accounts = {
HBOX_OPTIONS_ALLOW_REGISTRATION = "false"; blake = {
HBOX_OPTIONS_GITHUB_RELEASE_CHECK = "false"; passwordFile = sec."copyparty_passwd".path;
HBOX_MODE = "production"; };
HOME = cfg.data_dir; };
TMPDIR = "${cfg.data_dir}/tmp"; groups = {
media = ["blake"];
};
volumes = {
"/archives" = {
path = "/holocron/archives";
access = {
r = "*";
A = "blake";
};
flags = {
chmod_f = 660;
chmod_d = 770;
#gid = ?;
};
};
"/media" = {
path = "/holocron/media";
access = {
r = "*";
w = "@media";
A = "blake";
};
flags = {
chmod_f = 660;
chmod_d = 770;
gid = "700";
};
};
"/users/blake" = {
path = "/holocron/users/blake";
access = {
A = "blake";
};
flags = {
chmod_f = 660;
chmod_d = 770;
gid = "1000";
};
}; };
}; };
# override umask to make permissions work out
systemd.services.${service}.serviceConfig = {
UMask = lib.mkForce "0007";
User = service;
Group = service;
}; };
# open firewall # open firewall
@@ -91,14 +124,16 @@ in {
# add to caddy for reverse proxy # add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = { services.caddy.virtualHosts."${cfg.url}" = {
serverAliases = ["${service}.${homelab.public_domain}"];
extraConfig = '' extraConfig = ''
tls internal tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
reverse_proxy 127.0.0.1:${toString cfg.port} reverse_proxy 127.0.0.1:${toString cfg.port} {
}
''; '';
}; };
# add to glance (local service) # add to glance (local service)
homelab.glance.links.services = [ homelab.glance.links.system = [
{ {
title = service; title = service;
url = "https://${cfg.url}"; url = "https://${cfg.url}";
@@ -107,14 +142,13 @@ in {
icon = "di:${service}"; icon = "di:${service}";
} }
]; ];
#---------------------------------------------------------------------------
# sops.secrets = {
# sops.secrets = { "${service}_passwd" = {
# "${service}_" = { owner = service;
# owner = ; group = service;
# group = ; };
# }; };
# };
# add to backups # add to backups
homelab.backups.baks = { homelab.backups.baks = {
modules/holocron/default.nix
+21
View File
@@ -0,0 +1,21 @@
{
pkgs,
config,
lib,
inputs,
...
}: {
# services show up in glance in reverse import order lmao
imports = [
./nfs
./smb
./zfs
./syncthing
./copyparty
./perms
];
# define the groups used for backups and archives
users.groups.archives = {gid = 727;};
}
modules/fileshares/holocron/nfs/default.nix → modules/holocron/nfs/default.nix
View File
modules/fileshares/holocron/perms/default.nix → modules/holocron/perms/default.nix
View File
modules/holocron/smb/default.nix
+59
View File
@@ -0,0 +1,59 @@
{
pkgs,
config,
lib,
...
}:
# define smb shares
let
cfg = config.holocron.smb;
smb_shares = {
archives = {
path = "/holocron/archives";
browseable = true;
writable = true;
guestOk = false;
"create mask" = "0775";
"directory mask" = "0775";
};
timemachine = {
browseable = true;
"path" = "/holocron/archives/timemachine";
#"valid users" = "blake";
"public" = "no";
"writeable" = "yes";
#"force user" = "blake";
"fruit:aapl" = "yes";
"fruit:time machine" = "yes";
"vfs objects" = "catia fruit streams_xattr";
};
users = {
path = "/holocron/users";
browseable = true;
writable = true;
guestOk = false;
"create mask" = "0660";
"directory mask" = "0770";
};
media = {
path = "/holocron/media";
browseable = true;
writable = true;
guestOk = false;
"create mask" = "0775";
"directory mask" = "0775";
};
};
in {
options.holocron.smb = {
enable = lib.mkEnableOption "enables smb";
};
config = lib.mkIf cfg.enable {
# enable smb with all shares
services.samba = {
enable = true;
settings = smb_shares;
};
};
}
modules/fileshares/holocron/syncthing/default.nix → modules/holocron/syncthing/default.nix
+20 -22
View File
@@ -7,7 +7,7 @@
service = "syncthing"; service = "syncthing";
cfg = config.holocron.${service}; cfg = config.holocron.${service};
sec = config.sops.secrets; sec = config.sops.secrets;
url = "syncthing.${config.networking.hostName}.holocron.blue"; url = "syncthing.snowbelle.lan";
homelab = config.homelab; homelab = config.homelab;
in { in {
options.holocron.${service} = { options.holocron.${service} = {
@@ -23,29 +23,30 @@ in {
guiAddress = "0.0.0.0:2222"; guiAddress = "0.0.0.0:2222";
openDefaultPorts = true; openDefaultPorts = true;
#extraFlags = ["--no-default-folder"]; #extraFlags = ["--no-default-folder"];
key = sec."${service}/lumiose/key".path; key = sec."${service}/snowbelle/key".path;
cert = sec."${service}/lumiose/cert".path; cert = sec."${service}/snowbelle/cert".path;
settings = { settings = {
devices = { devices = {
"piplup" = {id = "OV4NUQK-3YHRL5R-SIZGTNL-7VZFFUX-FOJ6NTS-C7ROXR7-I2Q2W7G-QERO7AO";}; "mudkip" = {id = "OV4NUQK-3YHRL5R-SIZGTNL-7VZFFUX-FOJ6NTS-C7ROXR7-I2Q2W7G-QERO7AO";};
"zygarde" = {id = "UYLTF52-VVKUR7F-JN33HQZ-RFNWGL3-JER52LA-GZD2LPJ-QIFEE7K-MNMZRQ5";}; "zygarde" = {id = "UYLTF52-VVKUR7F-JN33HQZ-RFNWGL3-JER52LA-GZD2LPJ-QIFEE7K-MNMZRQ5";};
"yveltal" = {id = "ZVSQ4WJ-7OICYOZ-3ECES4X-KH37IPB-TKHKUJG-BSEGXVM-AHYY5C3-VKG44AX";}; "yveltal" = {id = "ZVSQ4WJ-7OICYOZ-3ECES4X-KH37IPB-TKHKUJG-BSEGXVM-AHYY5C3-VKG44AX";};
"CEN-IT-07" = {id = "DPYKA4Z-3PX7JB2-FBEOXXX-SC7TLT2-QC5P2IR-SXOPJGX-QO3DMII-5B7UCA4";}; "CEN-IT-07" = {id = "DPYKA4Z-3PX7JB2-FBEOXXX-SC7TLT2-QC5P2IR-SXOPJGX-QO3DMII-5B7UCA4";};
"CEN-IT-00007" = {id = "UEWNSUZ-AX75M5Y-OA4FURY-ORMEXFA-XUXU4LU-LEUYKVW-IDM2GQC-4UR4YAL";}; "CEN-IT-00007" = {id = "XBPXGYU-DUJSLDH-6BDNF4D-CO2COC3-N3FM6W5-IHZOJBM-Z2N77RI-IVAV5AH";};
}; };
folders = { folders = {
"holocron" = { "holocron" = {
path = "/holocron/users/blake/holocron"; path = "/holocron/users/blake/holocron";
devices = ["piplup" "zygarde" "CEN-IT-07" "CEN-IT-00007" "yveltal"]; devices = ["mudkip" "zygarde" "CEN-IT-07" "CEN-IT-00007" "yveltal"];
id = "5voxg-c3he2"; id = "5voxg-c3he2";
# versioning = { versioning = {
# type = "staggered"; type = "staggered";
# fsPath = "/holocron/users/blake/holocron/.stversions"; fsPath = "/holocron/users/blake/holocron/.stversions";
# params = { params = {
# cleanInterval = "3600"; cleanInterval = "3600";
# maxAge = "0"; maxAge = "0";
# }; };
# }; };
}; };
}; };
options = { options = {
@@ -55,11 +56,11 @@ in {
}; };
sops.secrets = { sops.secrets = {
"${service}/lumiose/key" = { "${service}/snowbelle/key" = {
owner = "blake"; owner = "blake";
group = "blake"; group = "blake";
}; };
"${service}/lumiose/cert" = { "${service}/snowbelle/cert" = {
owner = "blake"; owner = "blake";
group = "blake"; group = "blake";
}; };
@@ -70,20 +71,17 @@ in {
services.caddy.virtualHosts."${url}" = { services.caddy.virtualHosts."${url}" = {
extraConfig = '' extraConfig = ''
tls internal tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
reverse_proxy 127.0.0.1:2222 reverse_proxy 127.0.0.1:2222
''; '';
}; };
# add to glance (local service) # add to glance (local service)
homelab.glance.links.system = [ homelab.glance.links.system = [{
{
title = service; title = service;
url = "https://${url}"; url = "https://${url}";
error-url = "http://${homelab.host_ip}:2222"; error-url = "http://${homelab.host_ip}:2222";
check-url = "http://${homelab.host_ip}:2222"; check-url = "http://${homelab.host_ip}:2222";
icon = "di:${service}"; icon = "di:${service}"; }];
}
];
}; };
} }
modules/holocron/zfs/default.nix
+78
View File
@@ -0,0 +1,78 @@
{
pkgs,
config,
lib,
...
}: let
cfg = config.holocron.zfs;
in {
options.holocron.zfs = {
enable = lib.mkEnableOption "enables zfs";
};
config = lib.mkIf cfg.enable {
# set network host id
networking.hostId = "3e6e7055";
# enable zfs support
boot.kernelModules = ["zfs"];
boot.supportedFilesystems = ["zfs"];
# arc cache size
boot.kernelParams = [ "zfs.zfs_arc_max=12884901888" ];
# pools to import
#boot.zfs.extraPools = [ "holocron" "holocron/archives" "/holocron/media" "/holocron/users" ];
#boot.zfs.extraPools = [ "holocron" ];
# enable smart monitoring
services.smartd = {
enable = true;
autodetect = true;
defaults.monitored = "-a -o on -s (S/../.././05|L/../01/./05)";
notifications.mail = {
enable = true;
sender = "zfs@snowbelle.lan";
};
};
# enable zfs
services.zfs = {
autoScrub.enable = true;
autoScrub.interval = "weekly";
# email notifs
zed = {
enableMail = true;
settings = {
ZED_EMAIL_ADDR = ["root"];
# send notification if scrub succeeds
ZED_NOTIFY_VERBOSE = true;
};
};
};
# install userspace tools for acl's
environment.systemPackages = with pkgs; [smartmontools];
fileSystems."/holocron" = {
device = "holocron";
fsType = "zfs";
options = ["nofail"];
};
fileSystems."/holocron/archives" = {
device = "holocron/archives";
fsType = "zfs";
options = ["nofail"];
};
fileSystems."/holocron/users" = {
device = "holocron/users";
fsType = "zfs";
options = ["nofail"];
};
fileSystems."/holocron/media" = {
device = "holocron/media";
fsType = "zfs";
options = ["nofail"];
};
};
}
modules/homelab/.ai/default.nix
-9
View File
@@ -1,9 +0,0 @@
{ pkgs, config, lib, ... }:
{
# the order determines the order in glance :3
imports = [
./ollama
./open-webui
];
}
modules/homelab/.ai/ollama/default.nix
-98
View File
@@ -1,98 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
service = "ollama";
cfg = config.homelab.${service};
homelab = config.homelab;
in {
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
# set port options
port = lib.mkOption {
type = lib.types.int;
default = 7710;
description = "set port for ${service} (default: ${toString cfg.port}";
};
url = lib.mkOption {
type = lib.types.str;
default = "ollama.${homelab.base_domain}";
description = "set domain for ${service}";
};
data_dir = lib.mkOption {
type = lib.types.str;
default = "/var/lib/${service}";
description = "set data directory for ${service}";
};
ids = lib.mkOption {
type = lib.types.int;
default = cfg.port;
description = "set uid and pid of ${service} user (matches port by default)";
};
backup = lib.mkOption {
type = lib.types.bool;
default = true;
description = "enable backups for ${service}";
};
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = service;
};
};
config = lib.mkIf cfg.enable {
# declare ${service} group
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
# declare ${service} user
users.users.${service} = {
description = lib.mkForce "${service} server user";
uid = lib.mkForce cfg.ids;
isSystemUser = true;
shell = pkgs.bash;
home = cfg.data_dir;
createHome = true;
group = service;
extraGroups = [];
};
# declare the gitea service
services.${service} = {
enable = true;
host = "0.0.0.0";
port = cfg.port;
openFirewall = true;
syncModels = true;
loadModels = [
"deepseek-r1:7b"
"deepseek-r1:14b"
];
};
# override umask to make permissions work out
systemd.services.${service}.serviceConfig = {
UMask = lib.mkForce "0007";
};
# open firewall
networking.firewall.allowedTCPPorts = [cfg.port];
services.caddy.virtualHosts."${cfg.url}" = {
extraConfig = ''
tls internal
reverse_proxy localhost:${toString cfg.port} {
}
'';
};
# add to backups
homelab.backups.baks = {
${service} = {
paths = [cfg.data_dir "/var/lib/private"];
};
};
};
}
modules/homelab/.ai/open-webui/default.nix
-104
View File
@@ -1,104 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
service = "open-webui";
cfg = config.homelab.${service};
homelab = config.homelab;
in {
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
# set port options
port = lib.mkOption {
type = lib.types.int;
default = 7711;
description = "set port for ${service} (default: ${toString cfg.port}";
};
url = lib.mkOption {
type = lib.types.str;
default = "ai.${homelab.base_domain}";
description = "set domain for ${service}";
};
data_dir = lib.mkOption {
type = lib.types.str;
default = "/var/lib/${service}";
description = "set data directory for ${service}";
};
ids = lib.mkOption {
type = lib.types.int;
default = cfg.port;
description = "set uid and pid of ${service} user (matches port by default)";
};
backup = lib.mkOption {
type = lib.types.bool;
default = true;
description = "enable backups for ${service}";
};
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = service;
};
};
config = lib.mkIf cfg.enable {
# declare ${service} group
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
# declare ${service} user
users.users.${service} = {
description = lib.mkForce "${service} server user";
uid = lib.mkForce cfg.ids;
isSystemUser = true;
shell = pkgs.bash;
home = cfg.data_dir;
createHome = true;
group = service;
extraGroups = [];
};
# declare the gitea service
services.${service} = {
enable = true;
host = "0.0.0.0";
port = cfg.port;
openFirewall = true;
};
# override umask to make permissions work out
systemd.services.${service}.serviceConfig = {
UMask = lib.mkForce "0007";
};
# open firewall
networking.firewall.allowedTCPPorts = [cfg.port];
services.caddy.virtualHosts."${cfg.url}" = {
extraConfig = ''
tls internal
reverse_proxy localhost:${toString cfg.port} {
}
'';
};
# add to glance
homelab.glance.links.services = [
{
title = service;
url = "https://ai.${homelab.base_domain}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
# add to backups
homelab.backups.baks = {
${service} = {
paths = [cfg.data_dir "/var/lib/private"];
};
};
};
}
modules/homelab/.default.nix.template.nix
+1 -7
View File
@@ -38,10 +38,6 @@ in {
default = true; default = true;
description = "enable backups for ${service}"; description = "enable backups for ${service}";
}; };
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = service;
};
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
@@ -86,10 +82,8 @@ in {
# add to caddy for reverse proxy # add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = { services.caddy.virtualHosts."${cfg.url}" = {
serverAliases = ["${service}.${homelab.public_domain}"]; serverAliases = ["${service}.${homelab.public_domain}"];
# use explicitly defined tls cert
# tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
extraConfig = '' extraConfig = ''
tls internal tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
reverse_proxy 127.0.0.1:${toString cfg.port} reverse_proxy 127.0.0.1:${toString cfg.port}
''; '';
}; };
modules/homelab/.nomad/default.nix
-29
View File
@@ -1,29 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
cfg = config.homelab.nomad;
in {
options.homelab.nomad = {
enable = lib.mkEnableOption "enable in house project nomad";
tz = lib.mkOption {
default = "America/Chicago";
type = lib.types.str;
description = "set timezone";
};
};
config = lib.mkIf cfg.enable {
# the order determines the order in glance :3
imports = [
./kiwix
./maps
./kolibri
];
homelab.kiwix.enable = lib.mkDefault true;
homelab.maps.enable = lib.mkDefault true;
homelab.kolibri.enable = lib.mkDefault true;
};
}
modules/homelab/.nomad/kiwix/default.nix
-121
View File
@@ -1,121 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
service = "kiwix";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
# set port options
port = lib.mkOption {
type = lib.types.int;
default = 7730;
description = "set port for ${service} (default: ${toString cfg.port}";
};
url = lib.mkOption {
type = lib.types.str;
default = "${service}.${homelab.base_domain}";
description = "set domain for ${service}";
};
data_dir = lib.mkOption {
type = lib.types.str;
default = "/var/lib/${service}";
description = "set data directory for ${service}";
};
ids = lib.mkOption {
type = lib.types.int;
default = cfg.port;
description = "set uid and pid of ${service} user (matches port by default)";
};
backup = lib.mkOption {
type = lib.types.bool;
default = true;
description = "enable backups for ${service}";
};
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = "kiwix-serve";
};
};
config = lib.mkIf cfg.enable {
# declare ${service} group
users.groups.${service} = {
gid = lib.mkForce cfg.ids;
};
# declare ${service} user
users.users.${service} = {
description = "${service} server user";
uid = lib.mkForce cfg.ids;
isSystemUser = true;
home = cfg.data_dir;
createHome = true;
group = service;
extraGroups = ["media"];
};
# helpful and for scripts
environment.systemPackages = with pkgs; [kiwix-tools];
# enable the ${service} service
services.kiwix-serve = {
enable = true;
openFirewall = true;
port = cfg.port;
user = service;
group = service;
libraryPath = "${cfg.data_dir}/library.xml";
extraArgs = {
};
};
# override umask to make permissions work out
systemd.services.${service}.serviceConfig = {
UMask = lib.mkForce "0007";
User = service;
Group = service;
};
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
serverAliases = ["${service}.${homelab.public_domain}"];
# use explicitly defined tls cert
# tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
extraConfig = ''
tls internal
reverse_proxy 127.0.0.1:${toString cfg.port}
'';
};
# add to glance (local service)
homelab.glance.links.nomad = [
{
title = service;
url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
# sops.secrets = {
# "${service}_" = {
# owner = ;
# group = ;
# };
# };
# add to backups
homelab.backups.baks = {
${service} = {
paths = [cfg.data_dir];
};
};
};
}
modules/homelab/mediastack/bazarr/default.nix → modules/homelab/arr/bazarr/default.nix
+12 -12
View File
@@ -1,13 +1,12 @@
{ { pkgs, config, lib, ... }:
pkgs,
config, let
lib,
...
}: let
service = "bazarr"; service = "bazarr";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
in { in
{
options.homelab.${service} = { options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
@@ -44,6 +43,7 @@ in {
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# declare ${service} group # declare ${service} group
users.groups.${service} = { gid = lib.mkForce cfg.ids; }; users.groups.${service} = { gid = lib.mkForce cfg.ids; };
@@ -72,6 +72,9 @@ in {
UMask = lib.mkForce "0007"; UMask = lib.mkForce "0007";
}; };
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy # add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = { services.caddy.virtualHosts."${cfg.url}" = {
extraConfig = '' extraConfig = ''
@@ -81,15 +84,12 @@ in {
}; };
# add to glance # add to glance
homelab.glance.links.mediastack = [ homelab.glance.links.mediastack = [{
{
title = service; title = service;
url = "https://${cfg.url}"; url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}"; error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}"; check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; icon = "di:${service}"; }];
}
];
# add to backups # add to backups
homelab.backups.baks = { homelab.backups.baks = {
modules/homelab/mediastack/flaresolverr/default.nix → modules/homelab/arr/flaresolverr/default.nix
+10 -7
View File
@@ -1,13 +1,12 @@
{ { pkgs, config, lib, ... }:
pkgs,
config, let
lib,
...
}: let
service = "flaresolverr"; service = "flaresolverr";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
in { in
{
options.homelab.${service} = { options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
@@ -44,6 +43,7 @@ in {
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# declare ${service} group # declare ${service} group
users.groups.${service} = { gid = lib.mkForce cfg.ids; }; users.groups.${service} = { gid = lib.mkForce cfg.ids; };
@@ -68,6 +68,9 @@ in {
Group = service; Group = service;
}; };
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy # add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = { services.caddy.virtualHosts."${cfg.url}" = {
extraConfig = '' extraConfig = ''
modules/homelab/mediastack/prowlarr/default.nix → modules/homelab/arr/prowlarr/default.nix
+13 -15
View File
@@ -1,13 +1,12 @@
{ { pkgs, config, lib, ... }:
pkgs,
config, let
lib,
...
}: let
service = "prowlarr"; service = "prowlarr";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
in { in
{
options.homelab.${service} = { options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
@@ -44,6 +43,7 @@ in {
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# declare ${service} group # declare ${service} group
users.groups.${service} = { gid = lib.mkForce cfg.ids; }; users.groups.${service} = { gid = lib.mkForce cfg.ids; };
@@ -74,6 +74,9 @@ in {
Group = service; Group = service;
}; };
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy # add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = { services.caddy.virtualHosts."${cfg.url}" = {
extraConfig = '' extraConfig = ''
@@ -83,21 +86,16 @@ in {
}; };
# add to glance # add to glance
homelab.glance.links.mediastack = [ homelab.glance.links.mediastack = [{
{
title = service; title = service;
url = "https://${cfg.url}"; url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}"; error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}"; check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; icon = "di:${service}"; }];
}
];
# add to backups # add to backups
homelab.backups.baks = { homelab.backups.baks = {
${service} = { ${service} = { paths = [ cfg.data_dir ]; };
paths = [cfg.data_dir "/var/lib/private"];
};
}; };
}; };
} }
modules/homelab/mediastack/radarr/default.nix → modules/homelab/arr/radarr/default.nix
+11 -12
View File
@@ -1,14 +1,12 @@
{ { pkgs, config, lib, ... }:
pkgs,
config, let
lib,
...
}: let
service = "radarr"; service = "radarr";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets; sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
in { in
{
options.homelab.${service} = { options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
@@ -45,6 +43,7 @@ in {
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# required # required
environment.systemPackages = with pkgs; [ffmpeg_6-headless]; environment.systemPackages = with pkgs; [ffmpeg_6-headless];
@@ -81,6 +80,9 @@ in {
# Group = service; # Group = service;
}; };
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy # add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = { services.caddy.virtualHosts."${cfg.url}" = {
extraConfig = '' extraConfig = ''
@@ -90,15 +92,12 @@ in {
}; };
# add to glance # add to glance
homelab.glance.links.mediastack = [ homelab.glance.links.mediastack = [{
{
title = service; title = service;
url = "https://${cfg.url}"; url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}"; error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}"; check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; icon = "di:${service}"; }];
}
];
# add to backups # add to backups
homelab.backups.baks = { homelab.backups.baks = {
modules/homelab/mediastack/sonarr/default.nix → modules/homelab/arr/sonarr/default.nix
+13 -12
View File
@@ -1,13 +1,12 @@
{ { pkgs, config, lib, ... }:
pkgs,
config, let
lib,
...
}: let
service = "sonarr"; service = "sonarr";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
in { in
{
options.homelab.${service} = { options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
@@ -44,6 +43,7 @@ in {
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# required # required
environment.systemPackages = with pkgs; [ffmpeg_6-headless]; environment.systemPackages = with pkgs; [ffmpeg_6-headless];
@@ -78,8 +78,12 @@ in {
UMask = lib.mkForce "0007"; UMask = lib.mkForce "0007";
}; };
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy # add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = { services.caddy.virtualHosts."${cfg.url}" = {
# tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
extraConfig = '' extraConfig = ''
tls internal tls internal
reverse_proxy 127.0.0.1:${toString cfg.port} reverse_proxy 127.0.0.1:${toString cfg.port}
@@ -87,15 +91,12 @@ in {
}; };
# add to glance # add to glance
homelab.glance.links.mediastack = [ homelab.glance.links.mediastack = [{
{
title = service; title = service;
url = "https://${cfg.url}"; url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}"; error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}"; check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; icon = "di:${service}"; }];
}
];
# add to backups # add to backups
homelab.backups.baks = { homelab.backups.baks = {
modules/homelab/mediastack/audiobookshelf/default.nix → modules/homelab/audiobookshelf/default.nix
+17 -15
View File
@@ -1,13 +1,12 @@
{ { pkgs, config, lib, ... }:
pkgs,
config, let
lib,
...
}: let
service = "audiobookshelf"; service = "audiobookshelf";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
in { in
{
options.homelab.${service} = { options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
@@ -44,6 +43,7 @@ in {
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# declare ${service} group # declare ${service} group
users.groups.${service} = { gid = lib.mkForce cfg.ids; }; users.groups.${service} = { gid = lib.mkForce cfg.ids; };
@@ -72,28 +72,30 @@ in {
# override umask to make permissions work out # override umask to make permissions work out
systemd.services.${service}.serviceConfig = { systemd.services.${service}.serviceConfig = {
UMask = lib.mkForce "0007"; UMask = lib.mkForce "0007";
# User = service;
# Group = service;
}; };
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy # add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = { services.caddy.virtualHosts."${cfg.url}" = {
#serverAliases = ["abs.${homelab.public_domain}"]; serverAliases = [ "abs.${homelab.public_domain}" ];
extraConfig = '' extraConfig = ''
tls internal tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
reverse_proxy 127.0.0.1:${toString cfg.port} { reverse_proxy 127.0.0.1:${toString cfg.port} {
} }
''; '';
}; };
# add to glance public service # add to glance public service
homelab.glance.links.mediastack = [ homelab.glance.links.mediastack = [{
{
title = service; title = service;
url = "https://abs.${homelab.base_domain}"; url = "https://abs.${homelab.public_domain}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}"; error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}"; check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; icon = "di:${service}"; }];
}
];
# add to backups # add to backups
homelab.backups.baks = { homelab.backups.baks = {
modules/homelab/backups/default.nix
+89
View File
@@ -0,0 +1,89 @@
{
config,
lib,
pkgs,
...
}:
/*
to restore mysql/marinadb database:
mysql -u root -p -e "DROP DATABASE IF EXISTS <database_name>;" # delete old db if still lingering
mysql -u root -p -e "CREATE DATABASE IF NOT EXISTS <database_name>;" # create empty db w/ correct name
zstd -dc <path_to_backup> | mysql -u root -p <database_name>
to restore a postgres database:
sudo -u postgres psql -c "DROP DATABASE IF EXISTS <database_name>;" # delete old db if lingering (prolly wont work)
sudo -u postgres psql -c "CREATE DATABASE <database_name>;" # create empty db w/ correct name
zstd -dc <path_to_backup> | sudo -u postgres psql -d immich # restore from the dump
*/
let
cfg = config.homelab.backups;
sec = config.sops.secrets;
in {
options.homelab.backups = {
enable = lib.mkEnableOption "enables borg backups for state files and db backup services";
baks = lib.mkOption {
type = lib.types.attrsOf (lib.types.attrsOf (lib.types.listOf lib.types.path));
default = {};
description = "backup jobs, nested attribute sets should be <bak_name> = paths [<list_of_paths>]";
};
backup_repo = lib.mkOption {
type = lib.types.path;
default = "/holocron/archives/homelab";
description = "path to take daily backups to with borg!";
};
};
config = lib.mkIf cfg.enable {
# backups homelab with borg
services.borgbackup.jobs.homelab = lib.mkIf (cfg.baks != {}) {
archiveBaseName = "homelab";
repo = cfg.backup_repo;
paths = lib.flatten (lib.attrsets.mapAttrsToList (_: arg: arg.paths) cfg.baks);
compression = "auto,zstd";
startAt = "03:30";
group = "archives";
encryption.mode = "repokey-blake2";
encryption.passCommand = "cat ${sec."borg_passwd".path}";
preHook = ''
systemctl start mysql-backup.service
systemctl start $(systemctl list-unit-files 'postgresqlBackup-*.service' --no-legend --no-pager | cut -d' ' -f1)
'';
extraArgs = ["--verbose" "--show-rc" "--umask" "0007"];
extraCreateArgs = ["--list" "--stats" "--filter" "AME"];
prune.keep = {
within = "1d"; # Keep all archives from the last day
daily = 7;
weekly = 12;
monthly = -1; # Keep at least one archive for each month
};
};
# mysql backups currently minecraft_recpro is the only thing using this
services.mysqlBackup = lib.mkIf (config.services.mysql.ensureDatabases != []) {
enable = true;
location = "/var/backup/mysql";
user = "root";
calendar = "daily"; # goes fast, included in back up with server dirs at **:00
compressionAlg = "zstd";
databases = config.services.mysql.ensureDatabases; # set to all databases defined in esure databases
};
# postgresql backups currently immich is the only user
services.postgresqlBackup = lib.mkIf (config.services.postgresql.ensureDatabases != []) {
enable = true;
location = "/var/backup/postgresql";
compression = "zstd"; # optional: "xz", "zstd", "none"
startAt = "daily"; # the dump is included in a backup taken at 4:00
databases = config.services.postgresql.ensureDatabases; # set to all databases defined in esure databases
};
# helpful and for scripts
environment.systemPackages = with pkgs; [borgbackup tree];
sops.secrets = {
"borg_passwd" = {
owner = "root";
group = "root";
};
};
};
}
modules/homelab/network/caddy/default.nix → modules/homelab/caddy/default.nix
+9 -56
View File
@@ -1,14 +1,12 @@
{ { pkgs, config, lib, ... }:
pkgs,
config, let
lib,
...
}: let
service = "caddy"; service = "caddy";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets; sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
in { in
{
options.homelab.${service} = { options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
@@ -18,11 +16,6 @@ in {
default = "/var/lib/${service}"; default = "/var/lib/${service}";
description = "set data directory for ${service}"; description = "set data directory for ${service}";
}; };
keys = lib.mkOption {
type = lib.types.bool;
default = false;
description = "host keys directory";
};
backup = lib.mkOption { backup = lib.mkOption {
type = lib.types.bool; type = lib.types.bool;
default = true; default = true;
@@ -35,6 +28,7 @@ in {
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# declare ${service} group # declare ${service} group
users.groups.${service} = {}; users.groups.${service} = {};
@@ -54,32 +48,18 @@ in {
user = service; user = service;
group = service; group = service;
dataDir = cfg.data_dir; dataDir = cfg.data_dir;
package = pkgs.caddy.withPlugins {
plugins = [
"github.com/caddy-dns/cloudflare@v0.2.4"
];
hash = "sha256-dQvk6ezY6TQ1J7PjhCXnThF/SqVgPwBO8/RXzHCY+js=";
# Replace with the hash from the build error the first time you build.
};
email = "me@blakedheld.xyz"; email = "me@blakedheld.xyz";
globalConfig = '' globalConfig = ''
auto_https ignore_loaded_certs auto_https ignore_loaded_certs
acme_dns cloudflare {env.CLOUDFLARE_API_TOKEN}
''; '';
# static page for hosting key files virtualHosts."key.${homelab.public_domain}" = {
virtualHosts = {
"keys.${homelab.base_domain}" = lib.mkIf cfg.keys {
serverAliases = ["keys.${homelab.public_domain}"];
extraConfig = '' extraConfig = ''
tls internal root * /var/www/keys
root /var/www/keys file_server
file_server browse
''; '';
}; };
}; };
};
# enable acme for auto ssl certs with lets encrypt # enable acme for auto ssl certs with lets encrypt
security.acme = { security.acme = {
@@ -90,9 +70,6 @@ in {
# override umask to make permissions work out # override umask to make permissions work out
systemd.services.${service}.serviceConfig = { systemd.services.${service}.serviceConfig = {
UMask = lib.mkForce "0007"; UMask = lib.mkForce "0007";
# make cloudflare token readable
EnvironmentFile = sec."cloudflare/api_token_caddy".path;
#LoadCredential = "CLOUDFLARE_API_TOKEN:${sec."cloudflare/api_token_caddy".path}";
}; };
# open firewall # open firewall
@@ -109,37 +86,13 @@ in {
group = "caddy"; group = "caddy";
path = "/etc/ssl/blakedheld.xyz.key"; path = "/etc/ssl/blakedheld.xyz.key";
}; };
"cloudflare/api_token_caddy" = {
owner = "caddy";
group = "caddy";
};
"klefki_pub.asc" = { "klefki_pub.asc" = {
owner = "caddy"; owner = "caddy";
group = "caddy"; group = "caddy";
path = "/var/www/keys/klefki_pub.asc"; path = "/var/www/keys/klefki_pub.asc";
}; };
"caddy_root.crt" = {
owner = "caddy";
group = "caddy";
path = "/var/www/keys/caddy_root.crt";
};
}; };
environment.etc."caddy/browse.html".text = ''
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>keyring</title>
<style>
footer { display: none !important; }
</style>
</head>
<body>
{{template "listing" .}}
</body>
</html>
'';
# add to backups # add to backups
homelab.backups.baks = { homelab.backups.baks = {
modules/homelab/default.nix
+52 -23
View File
@@ -1,53 +1,82 @@
{ { pkgs, config, lib, ... }:
pkgs,
config,
lib, let
inputs,
...
}: let
cfg = config.homelab; cfg = config.homelab;
in { in
{
options.homelab = { options.homelab = {
enable = lib.mkEnableOption "enable homelab services and configuration"; enable = lib.mkEnableOption "enable homelab services and configuration";
media_user = lib.mkOption {
default = "media";
type = lib.types.str;
description = "user for media file permissions";
};
media_group = lib.mkOption {
default = "media";
type = lib.types.str;
description = "group for media file permissions";
};
tz = lib.mkOption { tz = lib.mkOption {
default = "America/Chicago"; default = "America/Chicago";
type = lib.types.str; type = lib.types.str;
description = "set timezone"; description = "set timezone";
}; };
base_domain = lib.mkOption { base_domain = lib.mkOption {
default = "lumiose.holocron.blue"; default = "snowbelle.lan";
type = lib.types.str; type = lib.types.str;
description = "base domain used for reverse proxy"; description = "base domain used for reverse proxy";
}; };
public_domain = lib.mkOption { public_domain = lib.mkOption {
default = "holocron.blue"; default = "blakedheld.xyz";
type = lib.types.str; type = lib.types.str;
description = "public domain used for reverse proxy"; description = "base domain used for reverse proxy";
}; };
host_ip = lib.mkOption { host_ip = lib.mkOption {
default = "10.10.0.11"; default = "10.10.0.10";
type = lib.types.str; type = lib.types.str;
description = "base ip used for reverse proxy"; description = "base domain used for reverse proxy";
}; };
}; };
# the order determines the order in glance :3 # the order determines the order in glance :3
imports = [ imports = [
#./ai ./motd
./mediastack ./dnsmasq
./services ./backups
./system ./glance
#./nomad ./postfix
./network ./caddy
./home/zigbee2mqtt
./vaultwarden
./gitea
./home/homeassistant
./immich
./arr/bazarr
./arr/prowlarr
./arr/radarr
./qbittorrent
./arr/sonarr
./yacreader
./audiobookshelf
./jellyfin
./arr/flaresolverr
./home/mosquitto
./uptime-kuma
./tailscale
]; ];
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# define the groups used for backups and archives users = {
users.users.archives = { groups.${cfg.media_group} = {
gid = 700;
};
users.${cfg.media_user} = {
uid = 700;
isSystemUser = true; isSystemUser = true;
group = "archives"; group = cfg.media_group;
};
}; };
users.groups.archives = {gid = 727;};
}; };
} }
modules/homelab/dnsmasq/default.nix
+42
View File
@@ -0,0 +1,42 @@
{
pkgs,
config,
lib,
...
}: let
service = "dnsmasq";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
port = lib.mkOption {
type = lib.types.int;
default = 53;
description = "set port for ${service} (default: ${toString cfg.port}";
};
};
config = lib.mkIf cfg.enable {
# enable the ${service} service
services.${service} = {
enable = true;
settings = {
listen-address = "10.10.0.10"; # your LAN IP
#interface = "enp89s0";
bind-interfaces = true;
address = "/snowbelle.lan/10.10.0.10";
server = [ # upstream dns
"9.9.9.9"
"1.1.1.1"
];
};
};
# open firewall
networking.firewall.allowedTCPPorts = [ cfg.port ];
networking.firewall.allowedUDPPorts = [ cfg.port ];
};
}
modules/homelab/services/gitea/default.nix → modules/homelab/gitea/default.nix
+14 -17
View File
@@ -1,14 +1,12 @@
{ { pkgs, nixpkgs-unstable, config, lib, ... }:
pkgs,
config, let
lib,
...
}: let
service = "gitea"; service = "gitea";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets; sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
in { in
{
options.homelab.${service} = { options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
@@ -50,6 +48,7 @@ in {
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# declare ${service} group # declare ${service} group
users.groups.${service} = { gid = lib.mkForce cfg.ids; }; users.groups.${service} = { gid = lib.mkForce cfg.ids; };
@@ -79,13 +78,13 @@ in {
settings = { settings = {
server = { server = {
# http config # http config
ROOT_URL = "https://git.${homelab.public_domain}"; ROOT_URL = "https://git.blakedheld.xyz";
DOMAIN = "git.${homelab.public_domain}"; DOMAIN = "git.blakedheld.xyz";
HTTP_PORT = cfg.port; HTTP_PORT = cfg.port;
# local network config # local network config
#LOCAL_ROOT_URL = "https://git.snowbelle.lan"; #LOCAL_ROOT_URL = "https://git.snowbelle.lan";
ALLOW_LOCALNETWORKS = true; ALLOW_LOCALNETWORKS = true;
ALLOWED_DOMAINS = homelab.host_ip; ALLOWED_DOMAINS = "10.10.0.10";
SKIP_TLS_VERIFY = true; SKIP_TLS_VERIFY = true;
# configure for system ssh (trying to use the systms on nix sucks) # configure for system ssh (trying to use the systms on nix sucks)
SSH_PORT = cfg.ssh_port; SSH_PORT = cfg.ssh_port;
@@ -101,7 +100,7 @@ in {
}; };
}; };
database = { database = {
passwordFile = "${toString sec."gitea_database_password".path}"; passwordFile = "${toString config.sops.secrets."gitea_database_password".path}";
}; };
}; };
@@ -122,22 +121,20 @@ in {
}; };
services.caddy.virtualHosts."${cfg.url}" = { services.caddy.virtualHosts."${cfg.url}" = {
extraConfig = '' extraConfig = ''
tls internal tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
reverse_proxy localhost:${toString cfg.port} { reverse_proxy localhost:${toString cfg.port} {
} }
''; '';
}; };
# add to glance # add to glance
homelab.glance.links.services = [ homelab.glance.links.services = [{
{
title = service; title = service;
url = "https://git.${homelab.public_domain}"; url = "https://git.${homelab.public_domain}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}"; error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}"; check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; icon = "di:${service}"; }];
}
];
# manage secrets with sops # manage secrets with sops
sops.secrets = { sops.secrets = {
modules/homelab/services/glance/default.nix → modules/homelab/glance/default.nix
+29 -120
View File
@@ -4,6 +4,7 @@
lib, lib,
... ...
}: }:
/* /*
this is a wrapper module for glance that allows you to this is a wrapper module for glance that allows you to
to pass monitor entries in with nix, all declaratively! to pass monitor entries in with nix, all declaratively!
@@ -19,6 +20,7 @@ to pass monitor entries in with nix, all declaratively!
icon = "di:${service}"; icon = "di:${service}";
allow-insecure = true; }]; allow-insecure = true; }];
*/ */
let let
service = "glance"; service = "glance";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
@@ -27,7 +29,8 @@ let
uptimekuma_url = "localhost:7901"; uptimekuma_url = "localhost:7901";
uptimekuma_page = "glance"; uptimekuma_page = "glance";
in { in
{
options.homelab.${service} = { options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
@@ -77,15 +80,11 @@ in {
default = [ ]; default = [ ];
description = "list of links for ${service}"; description = "list of links for ${service}";
}; };
network = lib.mkOption {
type = lib.types.listOf lib.types.attrs;
default = [];
description = "list of links for ${service}";
};
}; };
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# declare ${service} group # declare ${service} group
users.groups.${service} = { users.groups.${service} = {
gid = lib.mkForce cfg.ids; gid = lib.mkForce cfg.ids;
@@ -121,13 +120,12 @@ in {
}; };
}; };
branding = { branding = {
#logo-url = "/assets/icons/${config.networking.hostName}.png";
logo-url = "/assets/icons/snowbelle.png"; logo-url = "/assets/icons/snowbelle.png";
favicon-url = "/assets/icons/favicon.ico"; favicon-url = "/assets/icons/favicon.ico";
}; };
pages = [ pages = [
{ {
name = config.networking.hostName; name = "snowbelle";
hide-desktop-navigation = true; hide-desktop-navigation = true;
columns = [ columns = [
{ {
@@ -142,25 +140,13 @@ in {
servers = [ servers = [
{ {
type = "local"; type = "local";
name = config.networking.hostName; name = "snowbelle";
hide-mountpoints-by-default = true; hide-mountpoints-by-default = true;
mountpoints = { mountpoints = {
"/" = { "/" = {name = "root"; hide = false;};
name = "root"; "/holocron" = {name = "holocron"; hide = false;};
hide = false; "/holocron/media" = {name = "media"; hide = false;};
}; "/holocron/vault" = {name = "vault"; hide = false;};
"/holocron" = {
name = "holocron";
hide = false;
};
"/holocron/media" = {
name = "media";
hide = false;
};
"/holocron/vault" = {
name = "vault";
hide = false;
};
}; };
} }
]; ];
@@ -217,17 +203,17 @@ in {
{ {
title = "nixos options"; title = "nixos options";
shortcut = "!no"; shortcut = "!no";
url = "https://search.nixos.org/options?channel=26.05&query={QUERY}"; url = "https://search.nixos.org/options?channel=25.05&query={QUERY}";
} }
{ {
title = "nixos packages"; title = "nixos packages";
shortcut = "!np"; shortcut = "!np";
url = "https://search.nixos.org/packages?channel=26.05&query={QUERY}"; url = "https://search.nixos.org/packages?channel=25.05&query={QUERY}";
} }
{ {
title = "home-manager options"; title = "home-manager options";
shortcut = "!hm"; shortcut = "!hm";
url = "https://home-manager-options.extranix.com/?query={QUERY}&release=release-26.05"; url = "https://home-manager-options.extranix.com/?query={QUERY}&release=release-25.05";
} }
]; ];
} }
@@ -249,12 +235,6 @@ in {
title = "system"; title = "system";
sites = cfg.links.system; sites = cfg.links.system;
} }
{
type = "monitor";
cache = "1m";
title = "network";
sites = cfg.links.network;
}
{ {
type = "custom-api"; type = "custom-api";
title = "recpro"; title = "recpro";
@@ -262,13 +242,13 @@ in {
cache = "5s"; cache = "5s";
template = "<div style=\"display:flex; align-items:center; gap:12px;\">\n <div style=\"width:40px; height:40px; flex-shrink:0; border-radius:4px; display:flex; justify-content:center; align-items:center; overflow:hidden;\">\n {{ if .JSON.Bool \"online\" }}\n <img src=\"{{ .JSON.String \"icon\" | safeURL }}\" width=\"64\" height=\"64\" style=\"object-fit:contain;\">\n {{ else }}\n <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 20 20\" fill=\"currentColor\" style=\"width:32px; height:32px; opacity:0.5;\">\n <path fill-rule=\"evenodd\" d=\"M1 5.25A2.25 2.25 0 0 1 3.25 3h13.5A2.25 2.25 0 0 1 19 5.25v9.5A2.25 2.25 0 0 1 16.75 17H3.25A2.25 2.25 0 0 1 1 14.75v-9.5Zm1.5 5.81v3.69c0 .414.336.75.75.75h13.5a.75.75 0 0 0 .75-.75v-2.69l-2.22-2.219a.75.75 0 0 0-1.06 0l-1.91 1.909.47.47a.75.75 0 1 1-1.06 1.06L6.53 8.091a.75.75 0 0 0-1.06 0l-2.97 2.97ZM12 7a1 1 0 1 1-2 0 1 1 0 0 1 2 0Z\" clip-rule=\"evenodd\" />\n </svg>\n {{ end }}\n </div>\n\n <div style=\"flex-grow:1; min-width:0;\">\n <a class=\"size-h4 block text-truncate color-highlight\">\n {{ .JSON.String \"host\" }}\n {{ if .JSON.Bool \"online\" }}\n <span\n style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-positive); display: inline-block; vertical-align: middle;\"\n data-popover-type=\"text\"\n data-popover-text=\"Online\"\n ></span>\n {{ else }}\n <span\n style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-negative); display: inline-block; vertical-align: middle;\"\n data-popover-type=\"text\"\n data-popover-text=\"Offline\"\n ></span>\n {{ end }}\n </a>\n\n <ul class=\"list-horizontal-text\">\n <li>\n {{ if .JSON.Bool \"online\" }}\n <span>{{ .JSON.String \"version.name_clean\" }}</span>\n {{ else }}\n <span>Offline</span>\n {{ end }}\n </li>\n {{ if .JSON.Bool \"online\" }}\n <li data-popover-type=\"html\">\n <div data-popover-html>\n {{ range .JSON.Array \"players.list\" }}{{ .String \"name_clean\" }}<br>{{ end }}\n </div>\n <p style=\"display:inline-flex;align-items:center;\">\n <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;\">\n <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n </svg>\n {{ .JSON.Int \"players.online\" | formatNumber }}/{{ .JSON.Int \"players.max\" | formatNumber }} players\n </p>\n </li>\n {{ else }}\n <li>\n <p style=\"display:inline-flex;align-items:center;\">\n <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;opacity:0.5;\">\n <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n </svg>\n 0 players\n </p>\n </li>\n {{ end }}\n </ul>\n </div>\n</div>"; template = "<div style=\"display:flex; align-items:center; gap:12px;\">\n <div style=\"width:40px; height:40px; flex-shrink:0; border-radius:4px; display:flex; justify-content:center; align-items:center; overflow:hidden;\">\n {{ if .JSON.Bool \"online\" }}\n <img src=\"{{ .JSON.String \"icon\" | safeURL }}\" width=\"64\" height=\"64\" style=\"object-fit:contain;\">\n {{ else }}\n <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 20 20\" fill=\"currentColor\" style=\"width:32px; height:32px; opacity:0.5;\">\n <path fill-rule=\"evenodd\" d=\"M1 5.25A2.25 2.25 0 0 1 3.25 3h13.5A2.25 2.25 0 0 1 19 5.25v9.5A2.25 2.25 0 0 1 16.75 17H3.25A2.25 2.25 0 0 1 1 14.75v-9.5Zm1.5 5.81v3.69c0 .414.336.75.75.75h13.5a.75.75 0 0 0 .75-.75v-2.69l-2.22-2.219a.75.75 0 0 0-1.06 0l-1.91 1.909.47.47a.75.75 0 1 1-1.06 1.06L6.53 8.091a.75.75 0 0 0-1.06 0l-2.97 2.97ZM12 7a1 1 0 1 1-2 0 1 1 0 0 1 2 0Z\" clip-rule=\"evenodd\" />\n </svg>\n {{ end }}\n </div>\n\n <div style=\"flex-grow:1; min-width:0;\">\n <a class=\"size-h4 block text-truncate color-highlight\">\n {{ .JSON.String \"host\" }}\n {{ if .JSON.Bool \"online\" }}\n <span\n style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-positive); display: inline-block; vertical-align: middle;\"\n data-popover-type=\"text\"\n data-popover-text=\"Online\"\n ></span>\n {{ else }}\n <span\n style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-negative); display: inline-block; vertical-align: middle;\"\n data-popover-type=\"text\"\n data-popover-text=\"Offline\"\n ></span>\n {{ end }}\n </a>\n\n <ul class=\"list-horizontal-text\">\n <li>\n {{ if .JSON.Bool \"online\" }}\n <span>{{ .JSON.String \"version.name_clean\" }}</span>\n {{ else }}\n <span>Offline</span>\n {{ end }}\n </li>\n {{ if .JSON.Bool \"online\" }}\n <li data-popover-type=\"html\">\n <div data-popover-html>\n {{ range .JSON.Array \"players.list\" }}{{ .String \"name_clean\" }}<br>{{ end }}\n </div>\n <p style=\"display:inline-flex;align-items:center;\">\n <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;\">\n <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n </svg>\n {{ .JSON.Int \"players.online\" | formatNumber }}/{{ .JSON.Int \"players.max\" | formatNumber }} players\n </p>\n </li>\n {{ else }}\n <li>\n <p style=\"display:inline-flex;align-items:center;\">\n <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;opacity:0.5;\">\n <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n </svg>\n 0 players\n </p>\n </li>\n {{ end }}\n </ul>\n </div>\n</div>";
} }
# { {
# type = "custom-api"; type = "custom-api";
# title = "linggango"; title = "cobblemon";
# url = "https://api.mcstatus.io/v2/status/java/raceraskedforthisenjoyyall.recoil.pro"; url = "https://api.mcstatus.io/v2/status/java/cobblemon.recoil.pro";
# cache = "5s"; cache = "5s";
# template = "<div style=\"display:flex; align-items:center; gap:12px;\">\n <div style=\"width:40px; height:40px; flex-shrink:0; border-radius:4px; display:flex; justify-content:center; align-items:center; overflow:hidden;\">\n {{ if .JSON.Bool \"online\" }}\n <img src=\"{{ .JSON.String \"icon\" | safeURL }}\" width=\"64\" height=\"64\" style=\"object-fit:contain;\">\n {{ else }}\n <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 20 20\" fill=\"currentColor\" style=\"width:32px; height:32px; opacity:0.5;\">\n <path fill-rule=\"evenodd\" d=\"M1 5.25A2.25 2.25 0 0 1 3.25 3h13.5A2.25 2.25 0 0 1 19 5.25v9.5A2.25 2.25 0 0 1 16.75 17H3.25A2.25 2.25 0 0 1 1 14.75v-9.5Zm1.5 5.81v3.69c0 .414.336.75.75.75h13.5a.75.75 0 0 0 .75-.75v-2.69l-2.22-2.219a.75.75 0 0 0-1.06 0l-1.91 1.909.47.47a.75.75 0 1 1-1.06 1.06L6.53 8.091a.75.75 0 0 0-1.06 0l-2.97 2.97ZM12 7a1 1 0 1 1-2 0 1 1 0 0 1 2 0Z\" clip-rule=\"evenodd\" />\n </svg>\n {{ end }}\n </div>\n\n <div style=\"flex-grow:1; min-width:0;\">\n <a class=\"size-h4 block text-truncate color-highlight\">\n {{ .JSON.String \"host\" }}\n {{ if .JSON.Bool \"online\" }}\n <span\n style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-positive); display: inline-block; vertical-align: middle;\"\n data-popover-type=\"text\"\n data-popover-text=\"Online\"\n ></span>\n {{ else }}\n <span\n style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-negative); display: inline-block; vertical-align: middle;\"\n data-popover-type=\"text\"\n data-popover-text=\"Offline\"\n ></span>\n {{ end }}\n </a>\n\n <ul class=\"list-horizontal-text\">\n <li>\n {{ if .JSON.Bool \"online\" }}\n <span>{{ .JSON.String \"version.name_clean\" }}</span>\n {{ else }}\n <span>Offline</span>\n {{ end }}\n </li>\n {{ if .JSON.Bool \"online\" }}\n <li data-popover-type=\"html\">\n <div data-popover-html>\n {{ range .JSON.Array \"players.list\" }}{{ .String \"name_clean\" }}<br>{{ end }}\n </div>\n <p style=\"display:inline-flex;align-items:center;\">\n <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;\">\n <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n </svg>\n {{ .JSON.Int \"players.online\" | formatNumber }}/{{ .JSON.Int \"players.max\" | formatNumber }} players\n </p>\n </li>\n {{ else }}\n <li>\n <p style=\"display:inline-flex;align-items:center;\">\n <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;opacity:0.5;\">\n <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n </svg>\n 0 players\n </p>\n </li>\n {{ end }}\n </ul>\n </div>\n</div>"; template = "<div style=\"display:flex; align-items:center; gap:12px;\">\n <div style=\"width:40px; height:40px; flex-shrink:0; border-radius:4px; display:flex; justify-content:center; align-items:center; overflow:hidden;\">\n {{ if .JSON.Bool \"online\" }}\n <img src=\"{{ .JSON.String \"icon\" | safeURL }}\" width=\"64\" height=\"64\" style=\"object-fit:contain;\">\n {{ else }}\n <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 20 20\" fill=\"currentColor\" style=\"width:32px; height:32px; opacity:0.5;\">\n <path fill-rule=\"evenodd\" d=\"M1 5.25A2.25 2.25 0 0 1 3.25 3h13.5A2.25 2.25 0 0 1 19 5.25v9.5A2.25 2.25 0 0 1 16.75 17H3.25A2.25 2.25 0 0 1 1 14.75v-9.5Zm1.5 5.81v3.69c0 .414.336.75.75.75h13.5a.75.75 0 0 0 .75-.75v-2.69l-2.22-2.219a.75.75 0 0 0-1.06 0l-1.91 1.909.47.47a.75.75 0 1 1-1.06 1.06L6.53 8.091a.75.75 0 0 0-1.06 0l-2.97 2.97ZM12 7a1 1 0 1 1-2 0 1 1 0 0 1 2 0Z\" clip-rule=\"evenodd\" />\n </svg>\n {{ end }}\n </div>\n\n <div style=\"flex-grow:1; min-width:0;\">\n <a class=\"size-h4 block text-truncate color-highlight\">\n {{ .JSON.String \"host\" }}\n {{ if .JSON.Bool \"online\" }}\n <span\n style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-positive); display: inline-block; vertical-align: middle;\"\n data-popover-type=\"text\"\n data-popover-text=\"Online\"\n ></span>\n {{ else }}\n <span\n style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-negative); display: inline-block; vertical-align: middle;\"\n data-popover-type=\"text\"\n data-popover-text=\"Offline\"\n ></span>\n {{ end }}\n </a>\n\n <ul class=\"list-horizontal-text\">\n <li>\n {{ if .JSON.Bool \"online\" }}\n <span>{{ .JSON.String \"version.name_clean\" }}</span>\n {{ else }}\n <span>Offline</span>\n {{ end }}\n </li>\n {{ if .JSON.Bool \"online\" }}\n <li data-popover-type=\"html\">\n <div data-popover-html>\n {{ range .JSON.Array \"players.list\" }}{{ .String \"name_clean\" }}<br>{{ end }}\n </div>\n <p style=\"display:inline-flex;align-items:center;\">\n <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;\">\n <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n </svg>\n {{ .JSON.Int \"players.online\" | formatNumber }}/{{ .JSON.Int \"players.max\" | formatNumber }} players\n </p>\n </li>\n {{ else }}\n <li>\n <p style=\"display:inline-flex;align-items:center;\">\n <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;opacity:0.5;\">\n <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n </svg>\n 0 players\n </p>\n </li>\n {{ end }}\n </ul>\n </div>\n</div>";
# } }
]; ];
} }
{ {
@@ -334,7 +314,7 @@ in {
services.caddy.virtualHosts."${cfg.url}" = { services.caddy.virtualHosts."${cfg.url}" = {
# serverAliases = [ "${homelab.public_domain}" ]; # serverAliases = [ "${homelab.public_domain}" ];
extraConfig = '' extraConfig = ''
tls internal tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
reverse_proxy 127.0.0.1:${toString cfg.port} reverse_proxy 127.0.0.1:${toString cfg.port}
''; '';
}; };
@@ -342,88 +322,17 @@ in {
# add to backups # add to backups
homelab.backups.baks = { homelab.backups.baks = {
${service} = { ${service} = {
paths = [cfg.data_dir "/var/lib/private"]; paths = [ cfg.data_dir ];
}; };
}; };
# add to vaniville services to glance
homelab.glance.links.services = [
{
title = "vaultwarden";
url = "https://pass.${homelab.public_domain}";
error-url = "https://pass.vaniville.${homelab.public_domain}";
check-url = "https://pass.${homelab.public_domain}";
icon = "di:vaultwarden";
}
{
title = "gitea";
url = "https://git.${homelab.public_domain}";
error-url = "https://git.vaniville.${homelab.public_domain}";
check-url = "https://git.${homelab.public_domain}";
icon = "di:gitea";
}
];
homelab.glance.links.system = [
{
title = "vaniville uptime";
url = "https://up.${homelab.public_domain}";
error-url = "https://up.vaniville.${homelab.public_domain}";
check-url = "https://up.${homelab.public_domain}";
icon = "di:uptime-kuma";
}
];
# add to udr to glance # add to udr to glance
homelab.glance.links.network = [ homelab.glance.links.system = [{
{ title = "bebe";
title = "shauna"; url = "https://bebe.lan";
url = "https://shauna.holocron.blue"; error-url = "https://10.10.0.1";
error-url = "https://10.0.0.1"; check-url = "https://10.10.0.1";
check-url = "https://10.0.0.1";
icon = "di:unifi"; icon = "di:unifi";
allow-insecure = true; allow-insecure = true; }];
}
{
title = "lifeboat";
url = "https://lifeboat.holocron.blue";
error-url = "https://100.101.11.5";
check-url = "https://100.101.11.5";
icon = "di:unifi";
allow-insecure = true;
}
{
title = "korrina";
url = "https://korrina.holocron.blue";
error-url = "https://100.101.11.1";
check-url = "https://100.101.11.1";
icon = "di:unifi";
allow-insecure = true;
}
{
title = "linode";
url = "https://cloud.linode.com/linodes";
error-url = "https://status.linode.com";
check-url = "https://cloud.linode.com/linodes";
icon = "di:linode";
allow-insecure = true;
}
{
title = "tailscale";
url = "https://console.tailscale.com/admin/machines";
error-url = "https://status.tailscale.com/";
check-url = "https://console.tailscale.com/admin/machines";
icon = "di:tailscale";
allow-insecure = true;
}
{
title = "nextdns";
url = "https://my.nextdns.io";
error-url = "https://test.nextdns.io";
check-url = "https://my.nextdns.io/527db2/setup";
icon = "di:nextdns";
allow-insecure = true;
}
];
}; };
} }
modules/homelab/services/home/homeassistant/default.nix → modules/homelab/home/homeassistant/default.nix
+19 -24
View File
@@ -1,16 +1,13 @@
{ { pkgs, config, lib, inputs, ... }:
pkgs,
config, let
lib,
inputs,
...
}: let
nixservice = "home-assistant"; nixservice = "home-assistant";
service = "hass"; service = "hass";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets; sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
in { in
{
options.homelab.${service} = { options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
@@ -47,6 +44,7 @@ in {
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# declare ${service} group # declare ${service} group
users.groups.${service} = { gid = lib.mkForce cfg.ids; }; users.groups.${service} = { gid = lib.mkForce cfg.ids; };
@@ -73,6 +71,10 @@ in {
volumes = [ volumes = [
"${cfg.data_dir}:/config" "${cfg.data_dir}:/config"
]; ];
# ports = [
# "0.0.0.0:7704:8123"
# "0.0.0.0:4141:4141"
# ];
environment = { environment = {
TZ = homelab.tz; TZ = homelab.tz;
PUID = toString config.users.users.${service}.uid; PUID = toString config.users.users.${service}.uid;
@@ -87,35 +89,24 @@ in {
}; };
# open firewall # open firewall
networking.firewall.allowedTCPPorts = [cfg.port 8123 21063 21064]; networking.firewall.allowedTCPPorts = [ cfg.port 8123 ];
networking.firewall.allowedUDPPorts = [5353];
# add to caddy for reverse proxy # add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = { services.caddy.virtualHosts."${cfg.url}" = {
serverAliases = [ "${service}.${homelab.public_domain}" ]; serverAliases = [ "${service}.${homelab.public_domain}" ];
extraConfig = '' extraConfig = ''
tls internal tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
reverse_proxy 127.0.0.1:${toString cfg.port} { reverse_proxy 127.0.0.1:${toString cfg.port}
header_up Host {host}
header_up X-Real-IP {remote_host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto https
}
''; '';
}; };
# add to glance # add to glance
homelab.glance.links.services = [ homelab.glance.links.services = [{
{
title = "home assistant"; title = "home assistant";
url = "https://hass.${homelab.public_domain}"; url = "https://hass.${homelab.public_domain}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}"; error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}"; check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${nixservice}"; icon = "di:${nixservice}"; }];
}
];
# add to backups # add to backups
homelab.backups.baks = { homelab.backups.baks = {
@@ -123,6 +114,9 @@ in {
}; };
}; };
} }
# here lies my tough, and I mean fucking tough, swing at # here lies my tough, and I mean fucking tough, swing at
# getting this to work bare metal, ggs ill see you again # getting this to work bare metal, ggs ill see you again
# - didnt take long # - didnt take long
@@ -164,3 +158,4 @@ in {
## }; ## };
# }; # };
modules/homelab/services/home/mosquitto/default.nix → modules/homelab/home/mosquitto/default.nix
+6 -8
View File
@@ -1,14 +1,12 @@
{ { pkgs, config, lib, ... }:
pkgs,
config, let
lib,
...
}: let
service = "mosquitto"; service = "mosquitto";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets; sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
in { in
{
options.homelab.${service} = { options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
@@ -45,6 +43,7 @@ in {
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# declare ${service} group # declare ${service} group
users.groups.${service} = { gid = lib.mkForce cfg.ids; }; users.groups.${service} = { gid = lib.mkForce cfg.ids; };
@@ -75,7 +74,6 @@ in {
# omitPasswordAuth = true; # omitPasswordAuth = true;
} }
]; ];
# override umask to make permissions work out # override umask to make permissions work out
systemd.services.${service}.serviceConfig = { systemd.services.${service}.serviceConfig = {
UMask = lib.mkForce "0007"; UMask = lib.mkForce "0007";
modules/homelab/services/home/zigbee2mqtt/default.nix → modules/homelab/home/zigbee2mqtt/default.nix
+9 -14
View File
@@ -1,14 +1,12 @@
{ { pkgs, config, lib, ... }:
pkgs,
config, let
lib,
...
}: let
service = "zigbee2mqtt"; service = "zigbee2mqtt";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets; sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
in { in
{
options.homelab.${service} = { options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
@@ -45,6 +43,7 @@ in {
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# declare ${service} group # declare ${service} group
users.groups.${service} = { gid = lib.mkForce cfg.ids; }; users.groups.${service} = { gid = lib.mkForce cfg.ids; };
@@ -85,7 +84,6 @@ in {
}; };
homeassistant = { homeassistant = {
enabled = true; enabled = true;
experimental_event_entities = true;
}; };
}; };
}; };
@@ -104,21 +102,18 @@ in {
services.caddy.virtualHosts."${cfg.url}" = { services.caddy.virtualHosts."${cfg.url}" = {
serverAliases = [ "z2m.${homelab.public_domain}" ]; serverAliases = [ "z2m.${homelab.public_domain}" ];
extraConfig = '' extraConfig = ''
tls internal tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
reverse_proxy 127.0.0.1:${toString cfg.port} reverse_proxy 127.0.0.1:${toString cfg.port}
''; '';
}; };
# add to glance # add to glance
homelab.glance.links.services = [ homelab.glance.links.services = [{
{
title = service; title = service;
url = "https://${cfg.url}"; url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}"; error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}"; check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; icon = "di:${service}"; }];
}
];
sops.secrets = { sops.secrets = {
"mosquitto_passwd.yaml" = { "mosquitto_passwd.yaml" = {
modules/homelab/services/immich/default.nix → modules/homelab/immich/default.nix
+6 -34
View File
@@ -44,11 +44,6 @@ in {
type = lib.types.nullOr lib.types.str; type = lib.types.nullOr lib.types.str;
default = "immich-server"; default = "immich-server";
}; };
library_sync_dir = lib.mkOption {
type = lib.types.str;
default = "/holocron/users/blake/pictures/library";
description = "set directory to automatically rsync library to storage pool";
};
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
@@ -70,7 +65,7 @@ in {
services.${service} = { services.${service} = {
enable = true; enable = true;
#package = inputs.nixpkgs-unstable.legacyPackages.${pkgs.system}.immich; #package = inputs.nixpkgs-unstable.legacyPackages.${pkgs.system}.immich;
package = pkgs.unstable.immich; package = unstable_pkgs.x86_64.immich;
openFirewall = true; openFirewall = true;
user = service; user = service;
group = service; group = service;
@@ -78,33 +73,9 @@ in {
host = "0.0.0.0"; host = "0.0.0.0";
port = cfg.port; port = cfg.port;
settings = null; settings = null;
#settings.server.externalDomain = "https://photos.blakedheld.xyz";
}; };
# too lazy to add an option, this is on the storage pool now anyway
# systemd.services.immich_library_sync = {
# description = "twice daily sync immich library to holocron";
# serviceConfig = {
# Type = "oneshot";
# User = "root";
# };
#
# script = ''
# ${pkgs.rsync}/bin/rsync -avh --info=progress2 --delete \
# --chown=blake:blake \
# /var/lib/immich/library/blake/ \
# /holocron/users/blake/pictures/library/
# '';
# };
#
# systemd.timers.immich_library_sync = {
# wantedBy = ["timers.target"];
# timerConfig = {
# OnBootSec = "5m";
# OnUnitActiveSec = "12h";
# Persistent = true;
# };
# };
# override umask to make permissions work out # override umask to make permissions work out
# systemd.services."${toString service}-server".serviceConfig = { # systemd.services."${toString service}-server".serviceConfig = {
# UMask = lib.mkForce "0007"; # UMask = lib.mkForce "0007";
@@ -120,7 +91,7 @@ in {
services.caddy.virtualHosts."${cfg.url}" = { services.caddy.virtualHosts."${cfg.url}" = {
serverAliases = ["photos.${homelab.public_domain}"]; serverAliases = ["photos.${homelab.public_domain}"];
extraConfig = '' extraConfig = ''
tls internal tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
reverse_proxy 127.0.0.1:${toString cfg.port} reverse_proxy 127.0.0.1:${toString cfg.port}
''; '';
}; };
@@ -137,12 +108,13 @@ in {
]; ];
# add postgresql database that is automatically created to the backup list # add postgresql database that is automatically created to the backup list
#services.postgresqlBackup.databases = ["immich"]; # set to all databases defined in esure databases
services.postgresql.ensureDatabases = [service]; # set to all databases defined in esure databases services.postgresql.ensureDatabases = [service]; # set to all databases defined in esure databases
# add to backups # add to backups
homelab.backups.baks = { homelab.backups.baks = {
${service} = {paths = ["/var/lib/redis-immich" "/var/backup/postgresql/immich.sql.zstd"];}; ${service} = {paths = [cfg.data_dir "/var/lib/redis-immich" "/var/backup/postgresql/immich.sql.zstd"];};
#${service} = {paths = [cfg.data_dir "/var/lib/redis-immich" "/var/backup/postgresql/immich.sql.zstd"];};
}; };
}; };
} }
modules/homelab/mediastack/jellyfin/default.nix → modules/homelab/jellyfin/default.nix
+14 -16
View File
@@ -1,14 +1,12 @@
{ { pkgs, config, lib, ... }:
pkgs,
config, let
lib,
...
}: let
service = "jellyfin"; service = "jellyfin";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
host = config.networking.hostName; in
in { {
options.homelab.${service} = { options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
@@ -45,6 +43,7 @@ in {
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# declare ${service} group # declare ${service} group
users.groups.${service} = { gid = lib.mkForce cfg.ids; }; users.groups.${service} = { gid = lib.mkForce cfg.ids; };
@@ -62,7 +61,6 @@ in {
# enable the ${service} service # enable the ${service} service
services.${service} = { services.${service} = {
enable = true; enable = true;
package = pkgs.unstable.jellyfin;
openFirewall = true; openFirewall = true;
user = service; user = service;
group = service; group = service;
@@ -74,25 +72,25 @@ in {
UMask = lib.mkForce "0007"; UMask = lib.mkForce "0007";
}; };
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy # add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = { services.caddy.virtualHosts."${cfg.url}" = {
serverAliases = [ "media.${homelab.public_domain}" ]; serverAliases = [ "media.${homelab.public_domain}" ];
extraConfig = '' extraConfig = ''
tls internal tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
reverse_proxy 127.0.0.1:${toString cfg.port} reverse_proxy 127.0.0.1:${toString cfg.port}
''; '';
}; };
# add to glance # add to glance
homelab.glance.links.mediastack = [ homelab.glance.links.mediastack = [{
{
title = service; title = service;
url = "https://media.${host}.${homelab.public_domain}"; url = "https://media.${homelab.public_domain}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}"; error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}"; check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; icon = "di:${service}"; }];
}
];
# add to backups # add to backups
homelab.backups.baks = { homelab.backups.baks = {
modules/homelab/mediastack/default.nix
-66
View File
@@ -1,66 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
cfg = config.homelab.mediastack;
in {
options.homelab.mediastack = {
enable = lib.mkEnableOption "enable the mediastack";
media_user = lib.mkOption {
default = "media";
type = lib.types.str;
description = "user for media file permissions";
};
media_group = lib.mkOption {
default = "media";
type = lib.types.str;
description = "group for media file permissions";
};
tz = lib.mkOption {
default = "America/Chicago";
type = lib.types.str;
description = "set timezone";
};
};
# the order determines the order in glance :3
imports = [
./yacreader
./bazarr
./qbittorrent
./prowlarr
./lidarr
./radarr
./sonarr
./audiobookshelf
./navidrome
./jellyfin
./flaresolverr
];
config = lib.mkIf cfg.enable {
users = {
groups.${cfg.media_group} = {
gid = 700;
};
users.${cfg.media_user} = {
uid = 700;
isSystemUser = true;
group = cfg.media_group;
};
};
homelab.jellyfin.enable = lib.mkDefault true;
homelab.yacreader.enable = lib.mkDefault true;
homelab.qbittorrent.enable = lib.mkDefault true;
homelab.bazarr.enable = lib.mkDefault true;
homelab.prowlarr.enable = lib.mkDefault true;
homelab.radarr.enable = lib.mkDefault true;
homelab.sonarr.enable = lib.mkDefault true;
homelab.lidarr.enable = lib.mkDefault true;
homelab.audiobookshelf.enable = lib.mkDefault true;
homelab.navidrome.enable = lib.mkDefault true;
homelab.flaresolverr.enable = lib.mkDefault true;
};
}
modules/homelab/mediastack/lidarr/default.nix
-108
View File
@@ -1,108 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
service = "lidarr";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
# set port options
port = lib.mkOption {
type = lib.types.int;
default = 7109;
description = "set port for ${service} (default: ${toString cfg.port}";
};
url = lib.mkOption {
type = lib.types.str;
default = "${service}.${homelab.base_domain}";
description = "set domain for ${service}";
};
data_dir = lib.mkOption {
type = lib.types.str;
default = "/var/lib/${service}";
description = "set data directory for ${service}";
};
ids = lib.mkOption {
type = lib.types.int;
default = cfg.port;
description = "set uid and pid of ${service} user (matches port by default)";
};
backup = lib.mkOption {
type = lib.types.bool;
default = true;
description = "enable backups for ${service}";
};
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = service;
};
};
config = lib.mkIf cfg.enable {
# required
environment.systemPackages = with pkgs; [ffmpeg_6-headless yt-dlp];
# declare ${service} group
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
# declare ${service} user
users.users.${service} = {
description = "${service} server user";
uid = lib.mkForce cfg.ids;
isSystemUser = true;
home = cfg.data_dir;
createHome = true;
group = service;
extraGroups = ["media"];
};
# enable the ${service} service
services.${service} = {
enable = true;
openFirewall = true;
user = service;
group = service;
dataDir = cfg.data_dir;
settings = {
server.port = cfg.port;
};
};
# override umask to make permissions work out
systemd.services.${service}.serviceConfig = {
UMask = lib.mkForce "0007";
# User = service;
# Group = service;
};
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
extraConfig = ''
tls internal
reverse_proxy 127.0.0.1:${toString cfg.port}
'';
};
# add to glance
homelab.glance.links.mediastack = [
{
title = service;
url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
# add to backups
homelab.backups.baks = {
${service} = {paths = [cfg.data_dir];};
};
};
}
modules/homelab/mediastack/navidrome/default.nix
-115
View File
@@ -1,115 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
service = "navidrome";
cfg = config.homelab.${service};
homelab = config.homelab;
in {
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
# set port options
port = lib.mkOption {
type = lib.types.int;
default = 7108;
description = "set port for ${service} (default: ${toString cfg.port}";
};
url = lib.mkOption {
type = lib.types.str;
default = "music.${homelab.base_domain}";
description = "set domain for ${service}";
};
data_dir = lib.mkOption {
type = lib.types.str;
default = "/var/lib/${service}";
description = "set data directory for ${service}";
};
ids = lib.mkOption {
type = lib.types.int;
default = cfg.port;
description = "set uid and pid of ${service} user (matches port by default)";
};
backup = lib.mkOption {
type = lib.types.bool;
default = true;
description = "enable backups for ${service}";
};
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = service;
};
};
config = lib.mkIf cfg.enable {
# declare ${service} group
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
# declare ${service} user
users.users.${service} = {
description = "${service} server user";
uid = lib.mkForce cfg.ids;
isSystemUser = true;
# home = cfg.data_dir;
createHome = true;
group = service;
extraGroups = ["media"];
};
# enable the ${service} service
services.${service} = {
enable = true;
openFirewall = true;
user = service;
group = service;
# plugins = [
# ];
environmentFile = "${cfg.data_dir}/navidrome.env";
settings = {
Address = "0.0.0.0";
Port = cfg.port;
MusicFolder = "/holocron/media/music";
EnableInsightsCollector = false;
LyricsPriority = "nd-lyrics";
Plugins = {
Enabled = true;
#Folder = lib.mkForce "${cfg.data_dir}/plugins";
};
};
};
# override umask to make permissions work out
systemd.services.${service}.serviceConfig = {
UMask = lib.mkForce "0007";
EnvironmentFile = "${cfg.data_dir}/navidrome.env";
};
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
#serverAliases = ["abs.${homelab.public_domain}"];
extraConfig = ''
tls internal
reverse_proxy 127.0.0.1:${toString cfg.port} {
}
'';
};
# add to glance public service
homelab.glance.links.mediastack = [
{
title = service;
url = "https://music.${homelab.base_domain}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
# add to backups
homelab.backups.baks = {
${service} = {paths = [cfg.data_dir];};
};
};
}
modules/homelab/system/motd/default.nix → modules/homelab/motd/default.nix
+9 -29
View File
@@ -6,29 +6,11 @@
}: let }: let
inherit (lib) mkIf mkOption types filterAttrs mapAttrsToList; inherit (lib) mkIf mkOption types filterAttrs mapAttrsToList;
cfg = config.homelab.motd; cfg = config.homelab.motd;
homelab = lib.attrByPath ["homelab"] {} config;
gameservers = lib.attrByPath ["gameservers"] {} config;
# collect services to display # collect services to display
motd_list = motd_list =
mapAttrsToList (_: v: v.motd) mapAttrsToList (_: v: v.motd)
(filterAttrs ( (filterAttrs (_: v: v ? motd && v.motd != null) config.homelab);
_: v:
(v.enable or false)
&& v ? motd
&& v.motd != null
)
homelab);
motd_gs_list = lib.concatLists (
mapAttrsToList (_: v: v.motd_gs)
(filterAttrs (
_: v:
(v.enable or false)
&& v ? motd_gs
&& v.motd_gs != null
)
gameservers)
);
in { in {
options.homelab.motd = { options.homelab.motd = {
enable = mkOption { enable = mkOption {
@@ -93,20 +75,18 @@ in {
motd_list)} motd_list)}
echo echo
${lib.optionalString (motd_gs_list != []) ''
# --- gameservers --- # --- gameservers ---
echo -e "''${headings}gameservers:''${reset}" echo -e "''${headings}gameservers:''${reset}"
${lib.concatStringsSep "\n" (map (service: '' for service in velocity smp superflat bento cobblemon; do
status=$(systemctl is-active ${service} 2>/dev/null) status=$(systemctl is-active $service 2>/dev/null)
if [ "$status" = "active" ]; then if [ "$status" = "active" ]; then
printf "%-32s%s\n" " ''${active}[${service}]''${reset}" "running" printf "%-32s%s\n" " ''${active}[$service]''${reset}" "running"
else else
printf "%-32s%s\n" " ''${active}[${service}]''${reset}" "not running" printf "%-32s%s\n" " ''${active}[$service]''${reset}" "not running"
fi fi
'') done
motd_gs_list)} echo
''}
''; '';
environment.etc."motd".mode = "0755"; environment.etc."motd".mode = "0755";
modules/homelab/network/ddns/default.nix
-64
View File
@@ -1,64 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
service = "cloudflare-ddns";
cfg = config.homelab.ddns;
sec = config.sops.secrets;
in {
options.homelab.ddns = {
enable = lib.mkEnableOption "enables ddns with cloudflare";
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = service;
};
};
config = lib.mkIf cfg.enable {
services.${service} = {
enable = true;
credentialsFile = sec."cloudflare/api_token".path;
domains = [
# recoil.pro
"recoil.pro"
"*.recoil.pro"
"mc.recoil.pro"
"smp.recoil.pro"
"superflat.recoil.pro"
"skyblock.recoil.pro"
"cobblemon.recoil.pro"
"valheim.recoil.pro"
# blakedheld.xyz
#"blakedheld.xyz"
#"*.blakedheld.xyz"
#"git.blakedheld.xyz"
#"up.blakedheld.xyz"
# holocron.blue
#"holocron.blue"
#"*.holocron.blue"
"git.holocron.blue"
"pass.holocron.blue"
"photos.holocron.blue"
"media.holocron.blue"
"up.holocron.blue"
# mc servers
"mine.holocron.blue"
"smp.holocron.blue"
"skyblock.holocron.blue"
"superflat.holocron.blue"
];
};
# declare authkey secrets
sops.secrets = {
"cloudflare/api_token" = {
owner = "cloudflare-ddns";
group = "cloudflare-ddns";
};
};
};
}
modules/homelab/network/default.nix
-11
View File
@@ -1,11 +0,0 @@
{ pkgs, config, lib, ... }:
{
# the order determines the order in glance :3
imports = [
./dnsmasq
./caddy
./tailscale
./ddns
];
}
modules/homelab/network/dnsmasq/default.nix
-59
View File
@@ -1,59 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
service = "dnsmasq";
cfg = config.homelab.${service};
in {
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
port = lib.mkOption {
type = lib.types.int;
default = 53;
description = "set port for ${service} (default: ${toString cfg.port}";
};
upstream = lib.mkOption {
type = lib.types.str;
default = "10.10.0.1";
description = "set upstream dns server for ${service} (default: $cfg.upstream}";
};
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = service;
};
};
config = lib.mkIf cfg.enable {
# enable the ${service} service
services.${service} = {
enable = true;
alwaysKeepRunning = true;
settings = {
no-resolv = true;
listen-address = config.homelab.host_ip; # your LAN IP
#interface = "enp89s0";
bind-interfaces = true;
# address = [
# "/snowbelle.blakedheld.xyz/10.10.0.10"
# "/lumiose.blakedheld.xyz/10.10.0.10"
# "/bebe.blakedheld.xyz/10.10.0.1"
# ];
server = [
# upstream dns
cfg.upstream
];
};
};
systemd.services.dnsmasq.serviceConfig = {
RestartSec = "5s";
StartLimitBurst = 10;
};
# open firewall
networking.firewall.allowedTCPPorts = [cfg.port];
networking.firewall.allowedUDPPorts = [cfg.port];
};
}
modules/homelab/system/postfix/default.nix → modules/homelab/postfix/default.nix
View File
modules/homelab/system/postfix/default.nix.icloud_attempt → modules/homelab/postfix/default.nix.icloud_attempt
View File
modules/homelab/mediastack/qbittorrent/default.nix → modules/homelab/qbittorrent/default.nix
+21 -12
View File
@@ -1,13 +1,12 @@
{ { pkgs, config, lib, ... }:
pkgs,
config, let
lib,
...
}: let
service = "qbittorrent"; service = "qbittorrent";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
in { in
{
options.homelab.${service} = { options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
@@ -54,6 +53,7 @@ in {
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# ensure media dirs existence # ensure media dirs existence
systemd.tmpfiles.rules = [ systemd.tmpfiles.rules = [
"d /holocron/media/downloads 2775 qbittorrent media -" "d /holocron/media/downloads 2775 qbittorrent media -"
@@ -102,6 +102,18 @@ in {
iptables -A QBIT -j DROP iptables -A QBIT -j DROP
''; '';
# boilerplate for if you ever want to try to get this working again
# ------------------------------------------------------------------------------
# # add systemd service to VPN network namespace
# vpnConfinement = {
# enable = true;
# vpnNamespace = "wgmex";
# };
# ------------------------------------------------------------------------------
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy # add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = { services.caddy.virtualHosts."${cfg.url}" = {
extraConfig = '' extraConfig = ''
@@ -111,15 +123,12 @@ in {
}; };
# add to glance # add to glance
homelab.glance.links.mediastack = [ homelab.glance.links.mediastack = [{
{
title = service; title = service;
url = "https://${cfg.url}"; url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}"; error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}"; check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; icon = "di:${service}"; }];
}
];
# add to backups # add to backups
homelab.backups.baks = { homelab.backups.baks = {
modules/homelab/services/default.nix
-17
View File
@@ -1,17 +0,0 @@
{
pkgs,
config,
lib,
...
}: {
# the order determines the order in glance :3
imports = [
./home
./glance
./vaultwarden
./gitea
./immich
./homebox
#./searxng
];
}
modules/homelab/services/home/default.nix
-27
View File
@@ -1,27 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
cfg = config.homelab.home;
in {
options.homelab.home = {
enable = lib.mkEnableOption "enable the smarthome stack";
};
# the order determines the order in glance :3
imports = [
./zigbee2mqtt
./mosquitto
./homeassistant
./wyoming
];
config = lib.mkIf cfg.enable {
homelab.hass.enable = lib.mkDefault true;
homelab.mosquitto.enable = lib.mkDefault true;
homelab.zigbee2mqtt.enable = lib.mkDefault true;
homelab.wyoming.enable = lib.mkDefault true;
};
}
modules/homelab/services/home/wyoming/default.nix
-56
View File
@@ -1,56 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
service = "wyoming";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
# set port options
faster_whisper_port = lib.mkOption {
type = lib.types.int;
default = 7706;
description = "set port for ${service} (default: ${toString cfg.port}";
};
piper_port = lib.mkOption {
type = lib.types.int;
default = 7707;
description = "set port for ${service} (default: ${toString cfg.port}";
};
};
config = lib.mkIf cfg.enable {
# enable the ${service} service
services.${service} = {
faster-whisper = {
servers = {
vanessa = {
enable = true;
language = "en";
uri = "tcp://0.0.0.0:${toString cfg.faster_whisper_port}";
model = "medium";
device = "auto";
};
};
};
piper = {
servers = {
vanessa = {
enable = true;
uri = "tcp://0.0.0.0:${toString cfg.piper_port}";
voice = "en_US-amy-medium";
};
};
};
};
# open firewall
networking.firewall.allowedTCPPorts = [cfg.faster_whisper_port cfg.piper_port];
};
}
modules/homelab/services/radicale/default.nix
-122
View File
@@ -1,122 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
service = "radicale";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
# set port options
port = lib.mkOption {
type = lib.types.int;
default = 7705;
description = "set port for ${service} (default: ${toString cfg.port}";
};
url = lib.mkOption {
type = lib.types.str;
default = "cal.${homelab.base_domain}";
description = "set domain for ${service}";
};
data_dir = lib.mkOption {
type = lib.types.str;
default = "/var/lib/${service}";
description = "set data directory for ${service}";
};
ids = lib.mkOption {
type = lib.types.int;
default = cfg.port;
description = "set uid and pid of ${service} user (matches port by default)";
};
backup = lib.mkOption {
type = lib.types.bool;
default = true;
description = "enable backups for ${service}";
};
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = service;
};
};
config = lib.mkIf cfg.enable {
# declare ${service} group
users.groups.${service} = {
gid = lib.mkForce cfg.ids;
};
# declare ${service} user
users.users.${service} = {
description = "${service} server user";
uid = lib.mkForce cfg.ids;
isSystemUser = true;
home = cfg.data_dir;
createHome = true;
group = service;
extraGroups = ["media"];
};
# enable the ${service} service
services.${service} = {
enable = true;
};
# override umask to make permissions work out
systemd.services.${service}.serviceConfig = {
UMask = lib.mkForce "0007";
# User = service;
# Group = service;
};
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
serverAliases = ["${service}.${homelab.public_domain}"];
# use explicitly defined tls cert
# tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
extraConfig = ''
tls internal
reverse_proxy 127.0.0.1:${toString cfg.port}
'';
};
#---------------------------------------------------------------------------
# # add to glance (public service)
# homelab.glance.links.<category> = [{
# title = service;
# url = "https://${service}.${homelab.public_domain}";
# error-url = "http://${homelab.host_ip}:${toString cfg.port}";
# check-url = "http://${homelab.host_ip}:${toString cfg.port}";
# icon = "di:${service}"; }];
#---------------------------------------------------------------------------
# # add to glance (local service)
# homelab.glance.links.<category> = [{
# title = service;
# url = "https://${cfg.url}";
# error-url = "http://${homelab.host_ip}:${toString cfg.port}";
# check-url = "http://${homelab.host_ip}:${toString cfg.port}";
# icon = "di:${service}"; }];
#---------------------------------------------------------------------------
#
# sops.secrets = {
# "${service}_" = {
# owner = ;
# group = ;
# };
# };
# add to backups
homelab.backups.baks = {
${service} = {
paths = [cfg.data_dir];
};
};
};
}
modules/homelab/services/searxng/default.nix
-115
View File
@@ -1,115 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
service = "searx";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
# set port options
port = lib.mkOption {
type = lib.types.int;
default = 7709;
description = "set port for ${service} (default: ${toString cfg.port}";
};
url = lib.mkOption {
type = lib.types.str;
default = "search.${homelab.base_domain}";
description = "set domain for ${service}";
};
data_dir = lib.mkOption {
type = lib.types.str;
default = "/var/lib/${service}";
description = "set data directory for ${service}";
};
ids = lib.mkOption {
type = lib.types.int;
default = cfg.port;
description = "set uid and pid of ${service} user (matches port by default)";
};
backup = lib.mkOption {
type = lib.types.bool;
default = true;
description = "enable backups for ${service}";
};
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = service;
};
};
config = lib.mkIf cfg.enable {
# declare ${service} group
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
# declare ${service} user
users.users.${service} = {
description = lib.mkForce "${service} server user";
uid = lib.mkForce cfg.ids;
isSystemUser = true;
shell = pkgs.bash;
home = cfg.data_dir;
createHome = true;
group = service;
extraGroups = [];
};
# declare the gitea service
services.${service} = {
enable = true;
settings = {
server.port = cfg.port;
server.bind_address = "0.0.0.0";
#server.secret_key = "$SEARX_SECRET_KEY";
engines = [
];
};
};
# override umask to make permissions work out
systemd.services.${service}.serviceConfig = {
UMask = lib.mkForce "0007";
};
# open firewall
networking.firewall.allowedTCPPorts = [cfg.port];
services.caddy.virtualHosts."${cfg.url}" = {
extraConfig = ''
tls internal
reverse_proxy localhost:${toString cfg.port} {
}
'';
};
# add to glance
homelab.glance.links.services = [
{
title = service;
url = "https://search.${homelab.public_domain}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
# manage secrets with sops
sops.secrets = {
"${service}_database_password" = {
owner = service;
group = service;
};
};
# add to backups
homelab.backups.baks = {
${service} = {paths = [cfg.data_dir];};
};
};
}
modules/homelab/services/wger/default.nix
-125
View File
@@ -1,125 +0,0 @@
{
pkgs,
config,
lib,
inputs,
...
}: let
nixservice = "wger";
service = "wger";
cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}";
# set port options
port = lib.mkOption {
type = lib.types.int;
default = 7707;
description = "set port for ${service} (default: ${toString cfg.port}";
};
url = lib.mkOption {
type = lib.types.str;
default = "${service}.${homelab.base_domain}";
description = "set domain for ${service}";
};
data_dir = lib.mkOption {
type = lib.types.str;
default = "/var/lib/${service}";
description = "set data directory for ${service}";
};
ids = lib.mkOption {
type = lib.types.int;
default = cfg.port;
description = "set uid and pid of ${service} user (matches port by default)";
};
backup = lib.mkOption {
type = lib.types.bool;
default = true;
description = "enable backups for ${service}";
};
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = "podman-wger";
};
};
config = lib.mkIf cfg.enable {
# declare ${service} group
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
# declare ${service} user
users.users.${service} = {
description = "${service} server user";
uid = lib.mkForce cfg.ids;
isSystemUser = true;
home = cfg.data_dir;
createHome = true;
group = service;
extraGroups = [];
};
# still suss as fuck bro man fuck
virtualisation.oci-containers.containers = {
hass = {
image = "homeassistant/home-assistant:stable";
autoStart = true;
extraOptions = [
"--pull=newer"
"--network=host"
];
volumes = [
"${cfg.data_dir}:/config"
];
environment = {
TZ = homelab.tz;
PUID = toString config.users.users.${service}.uid;
PGID = toString config.users.groups.${service}.gid;
};
};
};
# override umask to make permissions work out
systemd.services.${service}.serviceConfig = {
UMask = lib.mkForce "0007";
};
# open firewall
networking.firewall.allowedTCPPorts = [cfg.port 8123 21063 21064];
networking.firewall.allowedUDPPorts = [5353];
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
serverAliases = ["${service}.${homelab.public_domain}"];
extraConfig = ''
tls internal
reverse_proxy 127.0.0.1:${toString cfg.port} {
header_up Host {host}
header_up X-Real-IP {remote_host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto https
}
'';
};
# add to glance
homelab.glance.links.services = [
{
title = "wger";
url = "https://hass.${homelab.public_domain}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${nixservice}";
}
];
# add to backups
homelab.backups.baks = {
${service} = {paths = [cfg.data_dir];};
};
};
}
modules/homelab/system/backups/default.nix
-141
View File
@@ -1,141 +0,0 @@
{
config,
lib,
pkgs,
...
}:
/*
to restore mysql/marinadb database:
mysql -u root -p -e "DROP DATABASE IF EXISTS <database_name>;" # delete old db if still lingering
mysql -u root -p -e "CREATE DATABASE IF NOT EXISTS <database_name>;" # create empty db w/ correct name
zstd -dc <path_to_backup> | mysql -u root -p <database_name>
to restore a postgres database:
sudo -u postgres psql -c "DROP DATABASE IF EXISTS <database_name>;" # delete old db if lingering (prolly wont work)
sudo -u postgres psql -c "CREATE DATABASE <database_name>;" # create empty db w/ correct name
zstd -dc <path_to_backup> | sudo -u postgres psql -d <database_name> # restore from the dump
*/
let
cfg = config.homelab.backups;
sec = config.sops.secrets;
host = config.networking.hostName;
in {
options.homelab.backups = {
enable = lib.mkEnableOption "enables borg backups for state files and db backup services";
baks = lib.mkOption {
type = lib.types.attrsOf (lib.types.attrsOf (lib.types.listOf lib.types.path));
default = {};
description = "backup jobs, nested attribute sets should be <bak_name> = paths [<list_of_paths>]";
};
databases = lib.mkOption {
type = lib.types.bool;
default = true;
description = "if databases are present, runs dumps";
};
backup_repo = lib.mkOption {
type = lib.types.path;
default = "/holocron/archives/servers/${host}/homelab";
description = "path to take daily backups to with borg!";
};
offsite = lib.mkOption {
type = lib.types.bool;
default = true;
description = "bool to control weather or not the repo is backed up offsite";
};
homelab = lib.mkOption {
type = lib.types.bool;
default = false;
description = "bool to control weather or not the repo is backed up to homelab";
};
offsite_user = lib.mkOption {
type = lib.types.str;
default = "lifeboat";
description = "user to connect to offsite host with";
};
offsite_target = lib.mkOption {
type = lib.types.str;
default = "lifeboat.holocron.blue";
description = "ip or domain for offsite backups";
};
offsite_dir = lib.mkOption {
type = lib.types.str;
default = "lifeboat/holocron/archives";
description = "path to rsync offsite backups to";
};
};
config = lib.mkIf cfg.enable {
# backups homelab with borg
services.borgbackup.jobs.homelab = lib.mkIf (cfg.baks != {}) {
archiveBaseName = "homelab";
repo = cfg.backup_repo;
paths = lib.flatten (lib.attrsets.mapAttrsToList (_: arg: arg.paths) cfg.baks);
compression = "auto,zstd";
startAt = "03:30";
group = "archives";
encryption.mode = "repokey-blake2";
encryption.passCommand = "cat ${sec."borg_passwd".path}";
preHook = lib.mkIf cfg.databases ''
systemctl start mysql-backup.service
systemctl start $(systemctl list-unit-files 'postgresqlBackup-*.service' --no-legend --no-pager | cut -d' ' -f1)
'';
postHook = lib.mkIf (cfg.offsite || cfg.homelab) ''
${lib.optionalString cfg.offsite ''
${pkgs.sshpass}/bin/sshpass -f ${sec."lifeboat_rsync".path} \
${pkgs.rsync}/bin/rsync -aHAX --partial --numeric-ids --info=progress2,name1,stats2 --delete \
-e "ssh -o StrictHostKeyChecking=no" \
${toString cfg.backup_repo} \
${cfg.offsite_user}@${cfg.offsite_target}::${cfg.offsite_dir}
''}
${lib.optionalString cfg.homelab ''
${pkgs.rsync}/bin/rsync -aHAX --partial --numeric-ids --info=progress2,name1,stats2 --delete \
-e "ssh -i /home/blake/.ssh/id_vaniville -o StrictHostKeyChecking=no" \
${toString cfg.backup_repo} \
blake@lumiose:/holocron/archives/servers/vaniville
''}
'';
extraArgs = ["--verbose" "--show-rc" "--umask" "0007"];
extraCreateArgs = ["--list" "--stats" "--filter" "AME"];
prune.keep = {
within = "1d"; # Keep all archives from the last day
daily = 7;
weekly = 12;
monthly = -1; # Keep at least one archive for each month
};
};
# mysql backups currently minecraft_recpro is the only thing using this
services.mysqlBackup = lib.mkIf (config.services.mysql.ensureDatabases != []) {
enable = true;
location = "/var/backup/mysql";
user = "root";
calendar = "daily"; # goes fast, included in back up with server dirs at **:00
compressionAlg = "zstd";
databases = config.services.mysql.ensureDatabases; # set to all databases defined in esure databases
};
# postgresql backups currently immich is the only user
services.postgresqlBackup = lib.mkIf (config.services.postgresql.ensureDatabases != []) {
enable = true;
location = "/var/backup/postgresql";
compression = "zstd"; # optional: "xz", "zstd", "none"
startAt = "daily"; # the dump is included in a backup taken at 4:00
databases = config.services.postgresql.ensureDatabases; # set to all databases defined in esure databases
};
# helpful and for scripts
environment.systemPackages = with pkgs; [borgbackup sshpass tree rsync];
sops.secrets = {
"borg_passwd" = {
owner = "root";
group = "root";
};
"lifeboat_rsync" = {
owner = "root";
group = "archives";
mode = "0440";
};
};
};
}
modules/homelab/system/default.nix
-15
View File
@@ -1,15 +0,0 @@
{
pkgs,
config,
lib,
...
}: {
# the order determines the order in glance :3
imports = [
./motd
./backups
./uptime-kuma
./msmtp
#./postfix
];
}
modules/homelab/system/msmtp/default.nix
-50
View File
@@ -1,50 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
service = "msmtp";
cfg = config.homelab.${service};
sec = config.sops.secrets;
in {
options.homelab.${service} = {
enable = lib.mkEnableOption "enables zfs";
};
config = lib.mkIf cfg.enable {
services.mail.sendmailSetuidWrapper.enable = true;
programs.${service} = {
enable = true;
setSendmail = true;
defaults = {
aliases = "/etc/aliases";
port = 587;
auth = "plain";
tls = "on";
tls_starttls = "on";
};
accounts.default = {
host = "smtp.mail.me.com";
user = "bdhelderman@icloud.com";
from = "alerts@blakedheld.xyz";
passwordeval = "/run/current-system/sw/bin/cat ${sec."email_pass".path}";
};
};
environment.etc.aliases.text = ''
root: me@blakedheld.xyz
blake: me@blakedheld.xyz
'';
sops.secrets = {
"email_pass" = {
owner = "blake";
group = "blake";
};
};
};
}
modules/homelab/network/tailscale/default.nix → modules/homelab/tailscale/default.nix
+4 -9
View File
@@ -4,26 +4,21 @@
lib, lib,
... ...
}: let }: let
service = "tailscale";
cfg = config.homelab.tailscale; cfg = config.homelab.tailscale;
sec = config.sops.secrets; authkey_file = config.sops.secrets."tailscale_authkey".path;
in { in {
options.homelab.tailscale = { options.homelab.tailscale = {
enable = lib.mkEnableOption "enables tailscale"; enable = lib.mkEnableOption "enables tailscale";
motd = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = "tailscaled";
};
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
services.${service} = { services.tailscale = {
enable = true; enable = true;
openFirewall = true; openFirewall = true;
useRoutingFeatures = "both"; useRoutingFeatures = "both";
authKeyFile = sec."tailscale_authkey".path; authKeyFile = authkey_file;
extraSetFlags = [ extraSetFlags = [
"--advertise-routes=${config.homelab.host_ip}/32,10.10.0.1/32,10.10.0.5/32,10.10.0.10/32" # advertise self "--advertise-routes=10.10.0.10/32" # advertise self
"--accept-routes=false" # true is equilivant to useRoutingFeatures = "client" (breaks shit) "--accept-routes=false" # true is equilivant to useRoutingFeatures = "client" (breaks shit)
"--accept-dns=true" # explicitly allow resolved "--accept-dns=true" # explicitly allow resolved
]; ];
modules/homelab/system/uptime-kuma/default.nix → modules/homelab/uptime-kuma/default.nix
+15 -17
View File
@@ -1,14 +1,12 @@
{ { pkgs, config, lib, ... }:
pkgs,
config, let
lib,
...
}: let
service = "uptime-kuma"; service = "uptime-kuma";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets; sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
in { in
{
options.homelab.${service} = { options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
@@ -45,6 +43,7 @@ in {
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# declare ${service} group # declare ${service} group
users.groups.${service} = { gid = lib.mkForce cfg.ids; }; users.groups.${service} = { gid = lib.mkForce cfg.ids; };
@@ -62,7 +61,8 @@ in {
# enable the ${service} service # enable the ${service} service
services.${service} = { services.${service} = {
enable = true; enable = true;
settings = { settings =
{
PORT = toString cfg.port; PORT = toString cfg.port;
HOST = "0.0.0.0"; HOST = "0.0.0.0";
}; };
@@ -73,30 +73,28 @@ in {
UMask = lib.mkForce "0007"; UMask = lib.mkForce "0007";
}; };
# # open firewall
# networking.firewall.allowedTCPPorts = [ cfg.port ];
# add to caddy for reverse proxy # add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = { services.caddy.virtualHosts."${cfg.url}" = {
#serverAliases = ["up.${homelab.public_domain}"];
extraConfig = '' extraConfig = ''
tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
reverse_proxy 127.0.0.1:${toString cfg.port} reverse_proxy 127.0.0.1:${toString cfg.port}
''; '';
}; };
# add to glance # add to glance
homelab.glance.links.system = [ homelab.glance.links.system = [{
{
title = service; title = service;
url = "https://${cfg.url}"; url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}"; error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}"; check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; icon = "di:${service}"; }];
}
];
# add to backups # add to backups
homelab.backups.baks = { homelab.backups.baks = {
${service} = { ${service} = { paths = [ cfg.data_dir ]; };
paths = [cfg.data_dir "/var/lib/private"];
};
}; };
}; };
} }
modules/homelab/services/vaultwarden/default.nix → modules/homelab/vaultwarden/default.nix
+24 -19
View File
@@ -1,15 +1,13 @@
{ { pkgs, config, lib, unstable_pkgs, ... }:
pkgs,
config, let
lib,
...
}: let
service = "vaultwarden"; service = "vaultwarden";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets; sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
domain = "https://pass.holocron.blue"; domain = "https://pass.blakedheld.xyz";
in { in
{
options.homelab.${service} = { options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
@@ -46,6 +44,7 @@ in {
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# declare ${service} group # declare ${service} group
users.groups.${service} = { gid = lib.mkForce cfg.ids; }; users.groups.${service} = { gid = lib.mkForce cfg.ids; };
@@ -63,15 +62,24 @@ in {
# enable the vaultwarden service # enable the vaultwarden service
services.${service} = { services.${service} = {
enable = true; enable = true;
package = pkgs.unstable.vaultwarden; package = unstable_pkgs.x86_64.vaultwarden;
config = { config = {
DOMAIN = "pass.${homelab.public_domain}"; DOMAIN = domain;
IP_HEADER = "X-Forwarded-For";
ROCKET_ADDRESS = "0.0.0.0"; ROCKET_ADDRESS = "0.0.0.0";
ROCKET_PORT = cfg.port; ROCKET_PORT = cfg.port;
SIGNUPS_ALLOWED = true; SIGNUPS_ALLOWED = true;
ADMIN_TOKEN = "$argon2id$v=19$m=19456,t=2,p=1$YXJKa0ZubE9OZkp5c0NlMC95TFhBcFh3K1VsUkk1bElTSFJkbmdYdmp4az0$bsLT8/18BmexUbzqlHp0S4aoIxi6bYxl0IY0EweF5N4"; # ADMIN_TOKEN = "yuh";
EXPERIMENTAL_CLIENT_FEATURE_FLAGS = "ssh-key-vault-item"; ADMIN_TOKEN = "${toString config.sops.secrets."vaultwarden_admin_token".path}";
EXPERIMENTAL_CLIENT_FEATURE_FLAGS = "fido2-vault-credentials,autofill-overlay,autofill-v2,inline-menu-positioning-improvements,ssh-key-vault-item";
# The following flags are available:
# - "autofill-overlay": Add an overlay menu to form fields for quick access to credentials.
# - "autofill-v2": Use the new autofill implementation.
# - "browser-fileless-import": Directly import credentials from other providers without a file.
# - "extension-refresh": Temporarily enable the new extension design until general availability (should be used with the beta Chrome extension)
# - "fido2-vault-credentials": Enable the use of FIDO2 security keys as second factor.
# - "inline-menu-positioning-improvements": Enable the use of inline menu password generator and identity suggestions in the browser extension.
# - "ssh-key-vault-item": Enable the creation and use of SSH key vault items. (Needs clients >=2024.12.0)
# - "ssh-agent": Enable SSH agent support on Desktop. (Needs desktop >=2024.12.0)
}; };
}; };
@@ -84,22 +92,19 @@ in {
# add to caddy for reverse proxy # add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = { services.caddy.virtualHosts."${cfg.url}" = {
serverAliases = [ "pass.${homelab.public_domain}" ]; serverAliases = [ "pass.${homelab.public_domain}" ];
#tls internal
extraConfig = '' extraConfig = ''
tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
reverse_proxy 127.0.0.1:${toString cfg.port} reverse_proxy 127.0.0.1:${toString cfg.port}
''; '';
}; };
# add to glance # add to glance
homelab.glance.links.services = [ homelab.glance.links.services = [{
{
title = service; title = service;
url = "https://pass.${homelab.public_domain}"; url = "https://pass.${homelab.public_domain}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}"; error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}"; check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}"; icon = "di:${service}"; }];
}
];
sops.secrets = { sops.secrets = {
"${service}_admin_token" = { "${service}_admin_token" = {
modules/homelab/mediastack/yacreader/default.nix → modules/homelab/yacreader/default.nix
+11 -13
View File
@@ -1,13 +1,12 @@
{ { pkgs, config, lib, ... }:
pkgs,
config, let
lib,
...
}: let
service = "yacreader"; service = "yacreader";
cfg = config.homelab.${service}; cfg = config.homelab.${service};
sec = config.sops.secrets;
homelab = config.homelab; homelab = config.homelab;
in { in
{
options.homelab.${service} = { options.homelab.${service} = {
enable = lib.mkEnableOption "enables ${service}"; enable = lib.mkEnableOption "enables ${service}";
@@ -44,6 +43,7 @@ in {
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# install the binary # install the binary
environment.systemPackages = with pkgs; [ yacreader ]; environment.systemPackages = with pkgs; [ yacreader ];
@@ -86,22 +86,19 @@ in {
# add to caddy for reverse proxy # add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = { services.caddy.virtualHosts."${cfg.url}" = {
extraConfig = '' extraConfig = ''
tls internal tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
reverse_proxy 127.0.0.1:${toString cfg.port} { reverse_proxy 127.0.0.1:${toString cfg.port} {
} }
''; '';
}; };
# add to glance local service # add to glance local service
homelab.glance.links.mediastack = [ homelab.glance.links.mediastack = [{
{
title = service; title = service;
url = "https://${cfg.url}"; url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}"; error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}"; check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:yac-reader"; icon = "di:yac-reader"; }];
}
];
# add to backups # add to backups
homelab.backups.baks = { homelab.backups.baks = {
@@ -109,3 +106,4 @@ in {
}; };
}; };
} }
modules/system/default.nix
-1
View File
@@ -20,7 +20,6 @@
./secure_boot ./secure_boot
./cifs_mounts ./cifs_mounts
./udiskie ./udiskie
./keepalive
]; ];
system.ssh.enable = lib.mkDefault true; system.ssh.enable = lib.mkDefault true;
modules/system/graphics/default.nix
-17
View File
@@ -84,23 +84,6 @@ in {
# enable docker gpu passthrough # enable docker gpu passthrough
hardware.nvidia-container-toolkit.enable = true; hardware.nvidia-container-toolkit.enable = true;
# systemd.services.nvidia-mps = {
# description = "NVIDIA CUDA Multi-Process Service";
# after = [ "nvidia-persistenced.service" ];
# requires = [ "nvidia-persistenced.service" ];
# wantedBy = [ "multi-user.target" ];
# path = [ config.hardware.nvidia.package.bin ];
# serviceConfig = {
# Type = "forking";
# ExecStart = "${config.hardware.nvidia.package.bin}/bin/nvidia-cuda-mps-control -d";
# ExecStop = "${pkgs.writeShellScript "nvidia-mps-stop" ''
# echo quit | ${config.hardware.nvidia.package.bin}/bin/nvidia-cuda-mps-control
# ''}";
# Restart = "on-failure";
# RestartSec = 5;
# };
# };
}) })
]); ]);
} }
modules/system/keepalive/default.nix
-45
View File
@@ -1,45 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
service = "keepalive";
cfg = config.system.${service};
in {
options.system.${service} = {
enable = lib.mkEnableOption "enables ${service}";
url = lib.mkOption {
type = lib.types.str;
default = "";
description = "url to ping for uptime-kuma keepalive";
};
interval = lib.mkOption {
type = lib.types.str;
default = "45s";
};
};
config = lib.mkIf cfg.enable {
systemd.services.keepalive = {
description = "send push for uptime kuma heartbeat";
serviceConfig = {
Type = "oneshot";
};
script = ''
${pkgs.curl}/bin/curl -fsSk \
"${cfg.url}" \
>/dev/null
'';
};
systemd.timers.keepalive = {
wantedBy = ["timers.target"];
timerConfig = {
OnBootSec = "30s";
OnUnitActiveSec = cfg.interval;
Unit = "keepalive.service";
};
};
};
}
modules/system/ssh/default.nix
+6 -8
View File
@@ -1,11 +1,9 @@
{ { pkgs, config, lib, ... }:
pkgs,
config, let
lib,
...
}: let
cfg = config.system.ssh; cfg = config.system.ssh;
in { in
{
options.system.ssh = { options.system.ssh = {
enable = lib.mkEnableOption "enables ssh"; enable = lib.mkEnableOption "enables ssh";
}; };
@@ -16,7 +14,7 @@ in {
enable = true; enable = true;
settings = { settings = {
PasswordAuthentication = false; PasswordAuthentication = false;
PermitRootLogin = "prohibit-password"; PermitRootLogin = "no";
X11Forwarding = false; X11Forwarding = false;
}; };
}; };
modules/system/syncthing/default.nix
+3 -3
View File
@@ -32,17 +32,17 @@ in {
settings = { settings = {
devices = { devices = {
"snowbelle" = {id = "6WQ6ATA-5AT4RUM-NW67PAL-N62CPNV-ALRFG3P-5BDRO22-HWFC2Q4-5S5BDA5";}; "snowbelle" = {id = "6WQ6ATA-5AT4RUM-NW67PAL-N62CPNV-ALRFG3P-5BDRO22-HWFC2Q4-5S5BDA5";};
"piplup" = {id = "OV4NUQK-3YHRL5R-SIZGTNL-7VZFFUX-FOJ6NTS-C7ROXR7-I2Q2W7G-QERO7AO";}; "mudkip" = {id = "OV4NUQK-3YHRL5R-SIZGTNL-7VZFFUX-FOJ6NTS-C7ROXR7-I2Q2W7G-QERO7AO";};
"zygarde" = {id = "UYLTF52-VVKUR7F-JN33HQZ-RFNWGL3-JER52LA-GZD2LPJ-QIFEE7K-MNMZRQ5";}; "zygarde" = {id = "UYLTF52-VVKUR7F-JN33HQZ-RFNWGL3-JER52LA-GZD2LPJ-QIFEE7K-MNMZRQ5";};
"mew" = {id = "7ZC2NAS-QONQKAL-Z54NPMB-7TRXM6M-K7Z6PZD-FG4AI4H-V7SMFJN-JOYBHQO";}; "mew" = {id = "7ZC2NAS-QONQKAL-Z54NPMB-7TRXM6M-K7Z6PZD-FG4AI4H-V7SMFJN-JOYBHQO";};
"yveltal" = {id = "ZVSQ4WJ-7OICYOZ-3ECES4X-KH37IPB-TKHKUJG-BSEGXVM-AHYY5C3-VKG44AX";}; "yveltal" = {id = "ZVSQ4WJ-7OICYOZ-3ECES4X-KH37IPB-TKHKUJG-BSEGXVM-AHYY5C3-VKG44AX";};
"CEN-IT-07" = {id = "DPYKA4Z-3PX7JB2-FBEOXXX-SC7TLT2-QC5P2IR-SXOPJGX-QO3DMII-5B7UCA4";}; "CEN-IT-07" = {id = "DPYKA4Z-3PX7JB2-FBEOXXX-SC7TLT2-QC5P2IR-SXOPJGX-QO3DMII-5B7UCA4";};
"CEN-IT-00007" = {id = "UEWNSUZ-AX75M5Y-OA4FURY-ORMEXFA-XUXU4LU-LEUYKVW-IDM2GQC-4UR4YAL";}; "CEN-IT-00007" = {id = "XBPXGYU-DUJSLDH-6BDNF4D-CO2COC3-N3FM6W5-IHZOJBM-Z2N77RI-IVAV5AH";};
}; };
folders = { folders = {
"holocron" = { "holocron" = {
path = "/home/blake/holocron"; path = "/home/blake/holocron";
devices = ["piplup" "zygarde" "mew" "yveltal" "CEN-IT-07" "CEN-IT-00007" "snowbelle"]; devices = ["mudkip" "zygarde" "mew" "yveltal" "CEN-IT-07" "CEN-IT-00007" "snowbelle"];
id = "5voxg-c3he2"; id = "5voxg-c3he2";
versioning = { versioning = {
type = "staggered"; type = "staggered";
secrets/secrets.yaml
+12 -30
View File
@@ -3,25 +3,17 @@ blake_passwd: ENC[AES256_GCM,data:AfFql6/ghGhCDLOb4+QuAsDznz4hC4ilxZYCIH2sgBWX9t
#ENC[AES256_GCM,data:0HBVS2AYQ2VZXY4EbMLwiSjRNyWZ57bf,iv:20SLWXpbRTLk76g5mFrhg1Z9Qasv3NoSJbK/FOiIgtk=,tag:DbUffQwrDqzy2QO64uoUeg==,type:comment] #ENC[AES256_GCM,data:0HBVS2AYQ2VZXY4EbMLwiSjRNyWZ57bf,iv:20SLWXpbRTLk76g5mFrhg1Z9Qasv3NoSJbK/FOiIgtk=,tag:DbUffQwrDqzy2QO64uoUeg==,type:comment]
klefki_auth_map: ENC[AES256_GCM,data:u8OBLtT/,iv:THW21BDyhyFIjcwixsAnaAODofxbuQZnpdgt9HGdDIg=,tag:zUvbOO8tLAnxdeMcWpvsdg==,type:str] klefki_auth_map: ENC[AES256_GCM,data:u8OBLtT/,iv:THW21BDyhyFIjcwixsAnaAODofxbuQZnpdgt9HGdDIg=,tag:zUvbOO8tLAnxdeMcWpvsdg==,type:str]
#ENC[AES256_GCM,data:ZxHtUSuOy19M0EKoT5xltFiqRg==,iv:72PJL2eG68VC4wiJFo6wL0l7AaDIsge8l/D/ZlLOWWA=,tag:Q16ztObK2AnbCCS5mRgjtA==,type:comment] #ENC[AES256_GCM,data:ZxHtUSuOy19M0EKoT5xltFiqRg==,iv:72PJL2eG68VC4wiJFo6wL0l7AaDIsge8l/D/ZlLOWWA=,tag:Q16ztObK2AnbCCS5mRgjtA==,type:comment]
tailscale_authkey: ENC[AES256_GCM,data:SqBbzV43arnLJZX0bnCZZGqO3jAKXBPZvIe6lqtf8L8RtqVNPvhxzeHR3Nki5LoSd7f3Za01puBAwpZY2QQ=,iv:f3jNCmrQrWsD2cvB6Ji8H0Ez/kpZ+4K9NIEhGfKU/N4=,tag:ej1gW8fBhAd9j53G7g8/HA==,type:str] tailscale_authkey: ENC[AES256_GCM,data:SU0k3asrJd+WZ86VbC4w8TDJp+MqsbyagrzCfDcgTzO5yvBjpWAKbJ7A+VxgQvdu4+S2jMYbdrONPp3YbQ==,iv:VMYmGVk5GpUQApKKQYhdOw/cYCXrXxEZJJwHfQL4MjQ=,tag:7ruaoCDxuFQ7tE/JLJ37Xw==,type:str]
#ENC[AES256_GCM,data:bEbCic+ZDAA5ieNedCbiVbJrse17,iv:UwRYlis6NPB/RUcv+YnPxrGdbIcF4hrNiZt19YvWZNQ=,tag:m6PVlzPNnahX7X7KzMUj7A==,type:comment] #ENC[AES256_GCM,data:bEbCic+ZDAA5ieNedCbiVbJrse17,iv:UwRYlis6NPB/RUcv+YnPxrGdbIcF4hrNiZt19YvWZNQ=,tag:m6PVlzPNnahX7X7KzMUj7A==,type:comment]
borg_passwd: ENC[AES256_GCM,data:XOMJtr+DRs7xn5Iclc49iTzK9cFJyc/fSXJjhdKa9jdN,iv:YB8z7zNYjh6NpSxQb1TfPxAYUdzThdVfNZIe6tO5grA=,tag:bO6kZ3cLJDL4IQoWmGvRdg==,type:str] borg_passwd: ENC[AES256_GCM,data:XOMJtr+DRs7xn5Iclc49iTzK9cFJyc/fSXJjhdKa9jdN,iv:YB8z7zNYjh6NpSxQb1TfPxAYUdzThdVfNZIe6tO5grA=,tag:bO6kZ3cLJDL4IQoWmGvRdg==,type:str]
#ENC[AES256_GCM,data:b75Jb5eEKZQlzC6zYJhDNhOOwA4oetNp52J7kE7eCpA=,iv:yNq/pYLtzVfqItBG9peGd0NtL7PkVkaKI8jpzAbWUo0=,tag:suibUsiuNkxrQqWumHTbXA==,type:comment]
lifeboat_rsync: ENC[AES256_GCM,data:OaijbFFpu8RM3gcWu2XbAHeuUhTIjFNO8aYcA8TJmNxMeUQkZ5QrE+ArAQ==,iv:V0MIqVclg9mg0sIPRgTAu81l9b1f6ssZPCcW+ukM/JM=,tag:5xMgBMfMgGYlHlpFoG4vDQ==,type:str]
#ENC[AES256_GCM,data:NbXyRroLF2uxHjROnBg9OLQ=,iv:W9Nse9yamov3rflDKBeISO+miQkjH7QfBUZdsDmDM4I=,tag:/RmH3JyriXFxf0hEh9/iRQ==,type:comment]
cloudflare:
api_token: ENC[AES256_GCM,data:VuRwfZe1cdnQLvxlp9GCDOt9Ijhz4fh2yOev2wLOdLV+zw91blA3Zis2BRyI/ZwN4y+IhiqlpBzXCsoFqw==,iv:6Bt11zz1/slvszh9ZGQ0ov5ts0jAZIAMx3G2AimKIs4=,tag:tyEVhsKCGrJWm6yn+GUlUQ==,type:str]
api_token_caddy: ENC[AES256_GCM,data:L1PMeI4zOCPbWuWrczM1aSYl/qk/MW8xLtxr/PL+a3zfDA+USP8Yw4liYnn1qwTxs+oLMHhpBR58kHPr8Q==,iv:NNVBPANwQ9koAKTQD4ikhtwFjCpMLMXEm9scj9jIDFo=,tag:SXt1Y+04BuSsjDhu5ykwLA==,type:str]
#ENC[AES256_GCM,data:3Nnp9ASh+BPPwSOa+Xx3YEqKnh48oW6sWCQCXy9iZ61qGv9Ubjeaccr+Bh0bD9s=,iv:LwbptKdbhO2yki2BIK+6uPMqe14FNC4EcIwO6HS5xAc=,tag:38P0kwfAFVEps6MnMU8XeA==,type:comment]
email_pass: ENC[AES256_GCM,data:T4heTFuvD3rUJUInDpJnIhwECw==,iv:uDOk6FKtfYjedE/I3zh9Tl7QuYz/OBe/3tlrTitf2DY=,tag:a80RoPPHMSETAbk5pqGfiQ==,type:str]
#ENC[AES256_GCM,data:ztRwuY0mTMDmwV5HqVR7Dmc+dCWcrVRtWZGEL1abE/WUcA==,iv:mmaWfHRiENJUGNhyUBFo1z7PdzVPH1OUZrVhkce6KV0=,tag:GKEvT0qkzTtimQXDueKPdw==,type:comment] #ENC[AES256_GCM,data:ztRwuY0mTMDmwV5HqVR7Dmc+dCWcrVRtWZGEL1abE/WUcA==,iv:mmaWfHRiENJUGNhyUBFo1z7PdzVPH1OUZrVhkce6KV0=,tag:GKEvT0qkzTtimQXDueKPdw==,type:comment]
holocron_creds: ENC[AES256_GCM,data:2QXtXrN5w0UFn70GZOsYFPdtPwjLcuUdtkEam5aZ83N6LEDqPWJi,iv:kUS9pq5CX19vqHumc6QjY+Xpd4N+Ge7oCcQYtMFh+WM=,tag:IUA1ZVThF91EdHrwmS624g==,type:str] holocron_creds: ENC[AES256_GCM,data:2QXtXrN5w0UFn70GZOsYFPdtPwjLcuUdtkEam5aZ83N6LEDqPWJi,iv:kUS9pq5CX19vqHumc6QjY+Xpd4N+Ge7oCcQYtMFh+WM=,tag:IUA1ZVThF91EdHrwmS624g==,type:str]
#ENC[AES256_GCM,data:VdbMrwGKUKNJHw==,iv:OLwBh6KQXR/H8eRgp/hH8k3QfIkK/ydL735kx/dpc8E=,tag:N+v+ym6RMbvW4IckbiLK8Q==,type:comment] #ENC[AES256_GCM,data:VdbMrwGKUKNJHw==,iv:OLwBh6KQXR/H8eRgp/hH8k3QfIkK/ydL735kx/dpc8E=,tag:N+v+ym6RMbvW4IckbiLK8Q==,type:comment]
syncthing: syncthing:
gui_passwd: ENC[AES256_GCM,data:CicGIe5dT8lJVchCcE4wg3E8va3RYR8d53MISkE=,iv:8ziDDyQvU8ABaKKwYlcHmvm8Qybk4G+q5F0Ghqluu9w=,tag:YlyNPE04KD3detL1QUTrgQ==,type:str] gui_passwd: ENC[AES256_GCM,data:CicGIe5dT8lJVchCcE4wg3E8va3RYR8d53MISkE=,iv:8ziDDyQvU8ABaKKwYlcHmvm8Qybk4G+q5F0Ghqluu9w=,tag:YlyNPE04KD3detL1QUTrgQ==,type:str]
lumiose: snowbelle:
key: ENC[AES256_GCM,data:82oOep2VmxfbHpRVvmVH/qh8Lv7ZqoSauLZB7l6fwF1EVNc/LnHNxT+JQSGjDPy8Kqieql+cKjjAseBS3u1y600lvuIeOQCOhNQd6JE5wThvCbJvAIH7G5v3ixls7xNThkzNTJKz5gtEcC7bLh0/XV3tm7kXhw6dN2f3kv2aCqF47FNw57v75Sm1yI/Dn/adrMUNCTxiwM8kisn+302YjyfVZ+LC9R49YtuwnOaUnQ1XGp8xeLcRZFkY5ThAxfXtRyZ/d4fwAEkwF5iVFfSQumimmSkgfYRteJtGvq3varV/eC/6IVzzg5hw0jcKZ7u7b3Rwut0mXi6E2WVRlN+L1Y1sk3xXvbF252+Ja1yR1TKipqro1Rv/BHP7DTZ/SSGU,iv:4dDnU1h1RaleL9f/8ywwL1Kk722PQwLB5OEovBoAA8o=,tag:z0cId9BFW0icNzPTm6vDZA==,type:str] key: ENC[AES256_GCM,data:MrAc4RXi6h4WOboZgBRjggPNGUrQwM1Vu5N5aPYBxeBZPi2ut8OApWcA9apWzYZNQTFF5QCtCpG9W+1CLJRG701PRK1Wf01r5SDI8aIXkgc2MjXuzS/y/WIqWoPK1nmtjxTYqaDR68II2tc/P7hgtf2EwYPV2JP6v6cCihADOKvXW1pBxi9kMjZGcbY54IyUrOdNauDvaZRgCSP7xtg8aWf1FlmJbiQgMW2lK/f+8rc/3OGS+ieFt35h29Khl4rhuYGB6rgTwvDaWa9g60rPzVcg6tKw+Unef99pA+CQnhVJJIejKlC07pCdqdjCUc+w0oQ69cVoucWeHqlq3xA7IvYIGi9K+OFCLmsoqjMe/wUSC/r2s/nnqbXsgVx9j8j0,iv:2FoZwwzKUky02Z34KRVP/jPhOMXnLZh841+4lybsbCY=,tag:ZL5qh3OcFjiWgqtmTCUFkw==,type:str]
cert: ENC[AES256_GCM,data:oALzV1PdQdsjH0TCRZ/LYbrMGROCyFRLF6S7c2Lzyf6i4mUSjp+wqh2OtWKC5GltKgwUoFE7eddLWdYR8Tfi5h4NowJTcWeIg10h6iSiztwZTho4Ob3g0KkzrQRwERcv++SwLz8yo5zeDEnZ/jqanlqcrxQQdoEneFdg7oK8lMXou4r9VZ3y2qgE8+9o4DWeiYaSJif3ad4SSc00evzswz/bN+4O1ei+47C/ABMBHe/N9H6gwZoSUgFrjv8+kcU8g29+HB6Fd9K5quUoR08BCj2d/WoGLmmJXVZm5ee7yEngJTFm1wGYjo5RXxR7fDoThtjre9Nt8L5ssewTTiQ9k4IRKPwTtMpAaSPXkxMS4CJZk7+UoZT1gg4nA3WPz2JKmtiPp2f7tKkglQpN8ckkxuEj+JHaDFSsylp3KcI/MHYrroU+jE6Jy+jVjggy0kg7N7+PqfKU02OTXizymivzRaXUzyrK6dS4/I02rsLcpvzyAqV0o0wHlYgDzZjU9BiNZNIeKXpNasN15nDwmJ4tvvk3QHMsA/sZgAXvaF+KmXeficdPc5YBAIZulvN75OtaE5MF4O+0boZpOXWsGifCvqtQtikAqJ+5DguAGxdR5IsfP3KfqqH0roLaiut2BDGdlPYMbEJkDjQmHm1zsw26TvgN1U1zkBdTZHtFm26g4XuzTqVU9LVgFJveZiOsKBHj19iODAJ3t0uJ44xid1N0udQGagRYi+u1hPVn1p64eI3x8UD/sX5Zz0xyO7+1DZ/eSam4nQYj1lFZ/hfDgZzyr9V4okJqJoMj5ZVhIMDNsiQWCNEVrFf/UG/YJFUr8yjtp4sefWA6vdORJ/sXQ9XYUahFv8Px0Yy0vmApoXMRfubo2nACZyFg55vkY/nEr1fqKXfVROLmgc0q08nG1hgjU+odeIeEbH05P/f5Xago1QO2MdsQqXH0BkDupgkxdz5Dd6HQJlL6EtuAweDUTqvNHKQ90pqqbSnVTM+VvPc8WR7wUniWvoTigG3CA1N3PRF5aGhhnKisml12KCZlUfDj9qfY2CE9Qf9HIEs=,iv:4thjc7nywpSZvj/gcdtjR4zwVopquFuCs41emhfmMPI=,tag:3CRdTk2qNO9GoDrKZZqLhQ==,type:str] cert: ENC[AES256_GCM,data:tvJX88ounzIzKmKcvEe0UtHrq51DMAIHGVZE2StqfNkn2QP+Er/geEh0wwmP9Q8+XBBjDT6oSAlWLjq6Tc1yYWSKju6Ig8GEJNDHL2UMVniBFzroSlO9hqZzbbNe1896WiwhhypvBoves7STTE7tJ2+Hzyss1BCYjcI+evGliJslq2nqxroMxIwBXfuDtxcTAeJ+SiKonY7W29NA05P1zYm6o6Td09VUS0cYWx2VUoP/8PMpeWLNciaHz8TjUeZ2Qob3pcNielu/VDqbunLvbFapqdV0hkl8gxgho+MmkC3+DXp/JDnG+vRm603wxqDECh6CNYc0CEXvM0/8gSXt6AkjATv6tBV98VeLknZkqVjBahtxrZuwquMuQbh1jD53RgsvnwB39FyFHZw29DGcUD0A7hIGnqSYVc2TXW+sgRxzXVFYsVrt1sWrYa2DpZT5zaFbps0dd194/j0SHOdf3p/4HF0GncWfTWLT89F/oAyJLio4X7yjES/DljgvmsrX0LdHnAYYAKDCWhZml3wSHBJ7Uvj1KiH2asxXkdiTPf8wulmwT+01hhBoX3QCkVYkdJpDbVddjLkwpLNyJATHctyuqzOdEMR4w5usTv9vKcgkMtbmxfWajb4lhjCpuaavkDUoI5h6eB8veXbZqAuX24bCvsLBWOVkg4qt1GGRqHx7+lfFanzMGyYYC/ufAXWD6eOOVsCjHJbHJoI16zq0HkfNpr30w+gO8hOyKgBP64anElzT3NB1sDi2GWxhSUKTDZ3rLsagPhZb3l3/u5SMf6lLWsY6IyFgPcVgY1snSOtd+PO9z9ipfyQZn4kKCtkNPPof8T58Qi7CP4KmVvbJsF67BH26SFclQLaJv5RO7e936vNwLrVhbyaclM0Vz6Y8wJvG4vW1Z4qPt6kP80NEATdrfwAr9nvZkb5rHqRWdxqIWSD5as+HPFzM/Mv0sBZ+B+CnsSv1btdB/iLacd032PGKXfZLxqGGOL1HIjM+QjSjaBTqrYcMke3GvnVfIujfdtcn9tOqGK+QYPS1CTYxWznmHloL2/WYwBY=,iv:qlIfrPxz7NvjkIXSkumfKvN0O1qq1S0T5j+37L8aReU=,tag:Qg8CYcDY/MaLWwNY566wBQ==,type:str]
yveltal: yveltal:
key: ENC[AES256_GCM,data:unUnEeDhCqHUZCJtGCbj5rmrLx+9GiUTl75K3HdkI94YfCLNYCBACYu2v/7FbNIEsjVoQEA5/gKEcUHzVq6LaHM2w9GSo6tjkegdzTUgbHBJf4ssJ38z5rQkMc7tbzsA0NUHBPklz1eyjkW96HQPD0REcwA3CIc=,iv:PZ7vfhIpwPpMz4P04bewNhRuahmpukasgYb8fL/EJBE=,tag:G1HDyPAVSdm/fwqTXTT3PQ==,type:str] key: ENC[AES256_GCM,data:unUnEeDhCqHUZCJtGCbj5rmrLx+9GiUTl75K3HdkI94YfCLNYCBACYu2v/7FbNIEsjVoQEA5/gKEcUHzVq6LaHM2w9GSo6tjkegdzTUgbHBJf4ssJ38z5rQkMc7tbzsA0NUHBPklz1eyjkW96HQPD0REcwA3CIc=,iv:PZ7vfhIpwPpMz4P04bewNhRuahmpukasgYb8fL/EJBE=,tag:G1HDyPAVSdm/fwqTXTT3PQ==,type:str]
cert: ENC[AES256_GCM,data:yLq2dNjdMiRj4reyZWsSqZ+1rw4DTwKBZoQHzeKb8YBn63ub4TZPlnOjSTt2DwOQwrJDNhsaeGscZ6J7rLxF/rtH6YnR8XxQuOu/NNIcZ4m9EqhsXyznSx4Q+0gamUXujRgGRVH5FNrfiFoqP3VuNghoX+NLxfX0BcVruEjbmLUWVVzY0yS0ufzxegM8WFAxuKhcr1NlhBU65TxKUtbj4vcByzWHkfLGIb5ICnGeF/p9/FvpFSavw3nLdybDLJ6EKEeaxy6t984fkuotAvk54kLbF4yt0q5mjDxy0U6xtn1hg3x03IRAPjKDRdpDmzYf4XxykEb74JX9q2zjUhb2l1ORWcZu/uKvEiuZWDJRmJ4ypOiyZOCqTvY6s2iDhEjmMKxlNr2mhuz9Hn6b3KoQjePIEd1eS/VEmo09pEuUlhlAEziVcdnpeRyWlN2xpv4ps90gLxJ1Mj9nAZwRqFOQl0V4N5OBHEqMBE1nQv4afMpGX5QF2UotTpNfka+LdKwc1iHHtpHZYmG1/LVwz3jDv4XnVLdDWojFA/8eJIWVq1BsUTYSy+Q27bsoTX4iL0Y/OAHRzXZTqYc4aiAWJoaNTNgmagZ9C03SA6qePlGe/5azI3f54rC2m1/JDUtYW3IABHSFUaVnTdWnD4GDNSYRJIknyUwXR4sE3pRD979prmgtepOyETOAVgEeUVKz1leJZ2HyyhjFU41TL0IN/sl+YPD9bC3Nmw7OsxMFGPC4l5vn64DVp7HHRSKyJvZ5fG8s4nSzyZAKomkocOpKHEuQPyyerZpL1lne/m2B/y7/W2ouAGxcawZOSU6f74mn5wM=,iv:Ggag5SNUFkhMWS0u1kwkD5tGjiMv4i041bCESl5XOdc=,tag:pPISz0eBWzHcPHsC8dVG3g==,type:str] cert: ENC[AES256_GCM,data:yLq2dNjdMiRj4reyZWsSqZ+1rw4DTwKBZoQHzeKb8YBn63ub4TZPlnOjSTt2DwOQwrJDNhsaeGscZ6J7rLxF/rtH6YnR8XxQuOu/NNIcZ4m9EqhsXyznSx4Q+0gamUXujRgGRVH5FNrfiFoqP3VuNghoX+NLxfX0BcVruEjbmLUWVVzY0yS0ufzxegM8WFAxuKhcr1NlhBU65TxKUtbj4vcByzWHkfLGIb5ICnGeF/p9/FvpFSavw3nLdybDLJ6EKEeaxy6t984fkuotAvk54kLbF4yt0q5mjDxy0U6xtn1hg3x03IRAPjKDRdpDmzYf4XxykEb74JX9q2zjUhb2l1ORWcZu/uKvEiuZWDJRmJ4ypOiyZOCqTvY6s2iDhEjmMKxlNr2mhuz9Hn6b3KoQjePIEd1eS/VEmo09pEuUlhlAEziVcdnpeRyWlN2xpv4ps90gLxJ1Mj9nAZwRqFOQl0V4N5OBHEqMBE1nQv4afMpGX5QF2UotTpNfka+LdKwc1iHHtpHZYmG1/LVwz3jDv4XnVLdDWojFA/8eJIWVq1BsUTYSy+Q27bsoTX4iL0Y/OAHRzXZTqYc4aiAWJoaNTNgmagZ9C03SA6qePlGe/5azI3f54rC2m1/JDUtYW3IABHSFUaVnTdWnD4GDNSYRJIknyUwXR4sE3pRD979prmgtepOyETOAVgEeUVKz1leJZ2HyyhjFU41TL0IN/sl+YPD9bC3Nmw7OsxMFGPC4l5vn64DVp7HHRSKyJvZ5fG8s4nSzyZAKomkocOpKHEuQPyyerZpL1lne/m2B/y7/W2ouAGxcawZOSU6f74mn5wM=,iv:Ggag5SNUFkhMWS0u1kwkD5tGjiMv4i041bCESl5XOdc=,tag:pPISz0eBWzHcPHsC8dVG3g==,type:str]
@@ -30,14 +22,10 @@ syncthing:
cert: ENC[AES256_GCM,data:uvNZYmQnexXTr/Sz7vLQIJK93MmsoiJfCAL8/rLVQH0D+1nVaM472lqR5pP0qhLKuYhFUESxhAotVtqLpOWK1MfAxuk2RHv8mvbtIJkheRmsIWw7dAAABIkmgnelI03P2Tk2129I95vMM1lybu4W6m9VslwJF8X/4rCxshdbuz9mcjwxBpUEDr1V76DO3bgQUuPwizx17ON8gNd+NtRqPPaXlGrfLCFv1Fib3YFd7+WRkERki9ZO7Q0quY75G4Jseb28QaiM2BT7jfECJo4x7rMePMV303sIrF9paaUKTuSiCUsamLsi5Hwr907y2lHB9Gocwio7tnSRSRhHHcWLI8dQktzW7Flqs8+MZGZ1oJBQO7kQDefF1q4mddADimoqD9F1NsOiOmqqZRRB37alLGmRjeYBIlA6q/FgN9BAj9h0cG3oN1MUXPRGzDfggg5TLjBM2FbG/N3xgncZ2AzTPOcLtrtc0I2PYk3FFxgzpHWnjS2t7CQo/JxqdXbdy9nTHIqbrnKIQ/FtS7/p+cgQcU815UMsJm3qP+hPLCyNuziYq3Vt/X7C3eTnrqemXjEeJ/SJxb+Oul5GS1OL14dNsJllFNuj33Zep/hyQvHnf/HW7kXAfDqIP9zn85EFriAZEuaKwbHB2pkvbWKFxrpXJFhjnPFDKxGOjAmsLmil4paFKdt5hK7rp0mmoIMN+mMFbYx333llik0qk27yYTQwOR3eeCGqHODUU+izUT8NuQBezyxsEmEYu/YBcpatcYylwKgIFcC058oltsxlbxRg5Rrdk5FOqj7Uui0qwFXvYesz6Tiq/rGmcOPlcE5xw14=,iv:LePpzWGDTV1ONwt1uHUptMW1dO1SwwUKrtCEerc/DEc=,tag:a5B/7hmIxvLXU90Stcq7zA==,type:str] cert: ENC[AES256_GCM,data:uvNZYmQnexXTr/Sz7vLQIJK93MmsoiJfCAL8/rLVQH0D+1nVaM472lqR5pP0qhLKuYhFUESxhAotVtqLpOWK1MfAxuk2RHv8mvbtIJkheRmsIWw7dAAABIkmgnelI03P2Tk2129I95vMM1lybu4W6m9VslwJF8X/4rCxshdbuz9mcjwxBpUEDr1V76DO3bgQUuPwizx17ON8gNd+NtRqPPaXlGrfLCFv1Fib3YFd7+WRkERki9ZO7Q0quY75G4Jseb28QaiM2BT7jfECJo4x7rMePMV303sIrF9paaUKTuSiCUsamLsi5Hwr907y2lHB9Gocwio7tnSRSRhHHcWLI8dQktzW7Flqs8+MZGZ1oJBQO7kQDefF1q4mddADimoqD9F1NsOiOmqqZRRB37alLGmRjeYBIlA6q/FgN9BAj9h0cG3oN1MUXPRGzDfggg5TLjBM2FbG/N3xgncZ2AzTPOcLtrtc0I2PYk3FFxgzpHWnjS2t7CQo/JxqdXbdy9nTHIqbrnKIQ/FtS7/p+cgQcU815UMsJm3qP+hPLCyNuziYq3Vt/X7C3eTnrqemXjEeJ/SJxb+Oul5GS1OL14dNsJllFNuj33Zep/hyQvHnf/HW7kXAfDqIP9zn85EFriAZEuaKwbHB2pkvbWKFxrpXJFhjnPFDKxGOjAmsLmil4paFKdt5hK7rp0mmoIMN+mMFbYx333llik0qk27yYTQwOR3eeCGqHODUU+izUT8NuQBezyxsEmEYu/YBcpatcYylwKgIFcC058oltsxlbxRg5Rrdk5FOqj7Uui0qwFXvYesz6Tiq/rGmcOPlcE5xw14=,iv:LePpzWGDTV1ONwt1uHUptMW1dO1SwwUKrtCEerc/DEc=,tag:a5B/7hmIxvLXU90Stcq7zA==,type:str]
#ENC[AES256_GCM,data:A0ITyGOGMIoyVOcn5JOi1RAtqUM=,iv:+wWpmFbeLiX/Ae53pj0QmnYY3MEzOMib4cqbePUKtGI=,tag:JHXvrN4bOH+oD3Q70pUuew==,type:comment] #ENC[AES256_GCM,data:A0ITyGOGMIoyVOcn5JOi1RAtqUM=,iv:+wWpmFbeLiX/Ae53pj0QmnYY3MEzOMib4cqbePUKtGI=,tag:JHXvrN4bOH+oD3Q70pUuew==,type:comment]
pia_auth: ENC[AES256_GCM,data:rwAu4f5XVS4v4FCLj2zXAegIZeRPLIzUVv6TCrdfg9RGSDJYHgVAX0aFXCBQsDQju9RDycXmc9Id8IuyYN8=,iv:kEA4ADQyUI+zlQoZOKi81dw5BLE1oesqhVf6bfiLgB4=,tag:VHT2uPNW27F3KRM7ZhWdCw==,type:str] pia_auth: ENC[AES256_GCM,data:rwAu4f5XVS4v4FCLj2zXAegIZeRPLIzUVv6TCrdfg9RGSDJYHgVAX0aFXCBQsDQju9RDycXmc9Id8IuyYN8=,iv:kEA4ADQyUI+zlQoZOKi81dw5BLE1oesqhVf6bfiLgB4=,tag:VHT2uPNW27F3KRM7ZhWdCw==,type:str]
#ENC[AES256_GCM,data:5F5zgBhqkrxOWOwqOZN3GQ==,iv:TRWqSSGcEBq+3IY0PyYi8SIZH8wKXvNS2VHS5pxlOuY=,tag:tJQgthNyBxu9ebeaxYg/yQ==,type:comment]
cs2:
gslt: ENC[AES256_GCM,data:CJUqox7FRvXhQr4oll4Qex75CEGyUo6cRruvhw9o4wI=,iv:ZQmPd7TWrO6KjLeYbNVIEVtt2DqLMnGZ9LJyo6RWwLI=,tag:XlClJ4tieowiL/bETPMLNA==,type:str]
rcon: ENC[AES256_GCM,data:b69rgz71icGSUDXjH5G8DXcA9W2521qRrKcxcONs1NGDjcFyfulPZt8=,iv:DNlujzo4nzIZg6hOxUNDWWDU2o84wZNP6zIJ67Z+xKw=,tag:1MMhWLI8lDuildp++DXc2Q==,type:str]
#ENC[AES256_GCM,data:mbIgMJBhL8nWJzl8q2dFL8XtO1Xa1Q==,iv:caYHYp1boK9wRgCcQe40HTWT/HxAIvYe+HyaruI53Vc=,tag:S6wowhAHObEcs7z8FimZ1g==,type:comment] #ENC[AES256_GCM,data:mbIgMJBhL8nWJzl8q2dFL8XtO1Xa1Q==,iv:caYHYp1boK9wRgCcQe40HTWT/HxAIvYe+HyaruI53Vc=,tag:S6wowhAHObEcs7z8FimZ1g==,type:comment]
wg_mex_key: ENC[AES256_GCM,data:vxDXixo6X6D33+p21L4hB0/yCH+TvMHZl991BkRsE/jdz7rzZuJF+zI7h+Q=,iv:8WR+feHXNUcat8DB2wY7wpos+P7TzgRF7rFD0fYosjY=,tag:p9b9ck0/VZjyLxtHut3n5Q==,type:str] wg_mex_key: ENC[AES256_GCM,data:vxDXixo6X6D33+p21L4hB0/yCH+TvMHZl991BkRsE/jdz7rzZuJF+zI7h+Q=,iv:8WR+feHXNUcat8DB2wY7wpos+P7TzgRF7rFD0fYosjY=,tag:p9b9ck0/VZjyLxtHut3n5Q==,type:str]
#ENC[AES256_GCM,data:CO5nrcDbgymnEmCvuTexOBEMncuNM5lQ,iv:6HrxqSN6e7ODuz09MIFgPbIqDCKQySRDaKk5Wdu4HoQ=,tag:JBRjZeEdOg+trohfanO6Mg==,type:comment] #ENC[AES256_GCM,data:CO5nrcDbgymnEmCvuTexOBEMncuNM5lQ,iv:6HrxqSN6e7ODuz09MIFgPbIqDCKQySRDaKk5Wdu4HoQ=,tag:JBRjZeEdOg+trohfanO6Mg==,type:comment]
vaultwarden_admin_token: ENC[AES256_GCM,data:Ow5UcBXe+36POaR099v4Sl0ObLu6/lmk4OO5F3sA6BxoSD3e0LFdlvn2QyWKAUOeBSF9ZoLLSnZwc8xd2vt4xm8WQXe7OupO4yAGeE2P0vNcyMTKXxS48scibDvdoGYEtbfbH3JH29pOF7l6LetWcX3T121mPrNz8bHknj3UXHLYdYm8+eA=,iv:iFZYixNJCpK/VB3AasFO/XdPKL4wh5B9HzSKU39LRn0=,tag:m4wC0CpZK4N6rlKoEa5OZw==,type:str] vaultwarden_admin_token: ENC[AES256_GCM,data:G1v3N064ci0Fw5EtTzaryailWpsv6f4w6eoHp2vjXIBtIlScdQk1Q0W+eDNRk8Wr2C3ysTXQNbyYismNsls+jeS3W+YqkKL4fnh3a5UTzQrMqvaH11n3ak0X9R9vmt+ZJXBrUrAOKJ6RPHJJSWenhjDB77kwEdQ=,iv:f8X+x/AdmZ3b3dtcSFrxGgA2tCgDRpgddjlVu3mdCmM=,tag:c0MXljVvhwOdvrb/8hWlsQ==,type:str]
#ENC[AES256_GCM,data:2ESzSsQZqKdjD7OXN8ZPThj6g9acJREe,iv:aDFPB0vs8NNo8ExLcJw7qtQvWbCb1XK6TJrHSK86qss=,tag:z+dypHAGUjEXP7Y9MHYWwg==,type:comment] #ENC[AES256_GCM,data:2ESzSsQZqKdjD7OXN8ZPThj6g9acJREe,iv:aDFPB0vs8NNo8ExLcJw7qtQvWbCb1XK6TJrHSK86qss=,tag:z+dypHAGUjEXP7Y9MHYWwg==,type:comment]
gitea_database_password: ENC[AES256_GCM,data:nhFn0/G7gW5rk996OZzlcTt7T9KMbP8MNM+ReFC8w1H9ZqBSJUbs3K+n68uQVrkOVSXE0cKpOR1VbQ+i+46z3g==,iv:bT4GRZZ83v47/EmeV2KaUFo+4qTT4T2AktFUpPiZdF4=,tag:OC9TInkAr1egM+xnBDizxw==,type:str] gitea_database_password: ENC[AES256_GCM,data:nhFn0/G7gW5rk996OZzlcTt7T9KMbP8MNM+ReFC8w1H9ZqBSJUbs3K+n68uQVrkOVSXE0cKpOR1VbQ+i+46z3g==,iv:bT4GRZZ83v47/EmeV2KaUFo+4qTT4T2AktFUpPiZdF4=,tag:OC9TInkAr1egM+xnBDizxw==,type:str]
#ENC[AES256_GCM,data:HJ81OxRD2xtNZKv+8oDqiT8mYpv45JMvjxU5pdmEKzl64SK3lQ==,iv:wStoC6XaZlvRPfbqti2CUbPrOOTt4KktaUp2ecVrggU=,tag:isOwKfNdQZAM+E8YQXBSFA==,type:comment] #ENC[AES256_GCM,data:HJ81OxRD2xtNZKv+8oDqiT8mYpv45JMvjxU5pdmEKzl64SK3lQ==,iv:wStoC6XaZlvRPfbqti2CUbPrOOTt4KktaUp2ecVrggU=,tag:isOwKfNdQZAM+E8YQXBSFA==,type:comment]
@@ -56,16 +44,10 @@ copyparty_passwd: ENC[AES256_GCM,data:I3UYy4nJ0B6RnIp661O0VVqEmxloxxcroBKmNFcgoQ
vpncon_mex_config: ENC[AES256_GCM,data:4i356X97sBoRliskmh5ewcEwZHkpo37IhPcemKVdWJgWFWtA+AhTeEo4KQ3dRA1H/n8VjVX7CKZKPDxpmHfcUlnTLT0agtOjjyjf60kWoL8noJqcbDB4wGiYT910rPToVnYMFk0H2lerYp+/n2bhg8BHxn++VlPOOZsgla4El+FNXUqhScpAawySPSF36ocdRJ3r3DuflIhnTBXxSZukMf9Ux1uaFldSG7KasCQlStKy9O2Odd2AvAuGXOHch5KecRPT3WnonQ8oDJpuxbeaosLmtJKHL9oeXHPId2Unc1GNoOpnDC3Y/xGnrPb9WFXWYOSQ/1A3mNKwnVq0FEhluVbqodES4PVIlCS0koiQJq15P15G2z0jO+OhAQrRI5vn3Fki5A==,iv:tQvTpzhl7F7niigAXl61FMHbg6QqI2R7yGD/C2lwOR4=,tag:c+CVLd6lGrAfm38pFXOXTw==,type:str] vpncon_mex_config: ENC[AES256_GCM,data:4i356X97sBoRliskmh5ewcEwZHkpo37IhPcemKVdWJgWFWtA+AhTeEo4KQ3dRA1H/n8VjVX7CKZKPDxpmHfcUlnTLT0agtOjjyjf60kWoL8noJqcbDB4wGiYT910rPToVnYMFk0H2lerYp+/n2bhg8BHxn++VlPOOZsgla4El+FNXUqhScpAawySPSF36ocdRJ3r3DuflIhnTBXxSZukMf9Ux1uaFldSG7KasCQlStKy9O2Odd2AvAuGXOHch5KecRPT3WnonQ8oDJpuxbeaosLmtJKHL9oeXHPId2Unc1GNoOpnDC3Y/xGnrPb9WFXWYOSQ/1A3mNKwnVq0FEhluVbqodES4PVIlCS0koiQJq15P15G2z0jO+OhAQrRI5vn3Fki5A==,iv:tQvTpzhl7F7niigAXl61FMHbg6QqI2R7yGD/C2lwOR4=,tag:c+CVLd6lGrAfm38pFXOXTw==,type:str]
#ENC[AES256_GCM,data:ep/Z5O6RNFwTd0I5hvtk5DP9,iv:M7sclKcTR+IfCEsvz0lZaoZBRZlQsN/FhwuzFNXgVew=,tag:Ddo3Qf8tMBX9Amt7C9m5FA==,type:comment] #ENC[AES256_GCM,data:ep/Z5O6RNFwTd0I5hvtk5DP9,iv:M7sclKcTR+IfCEsvz0lZaoZBRZlQsN/FhwuzFNXgVew=,tag:Ddo3Qf8tMBX9Amt7C9m5FA==,type:comment]
klefki_pub.asc: ENC[AES256_GCM,data:lGfgwhgn2xCb1cNTo0nMP8R3KSDiEn0/k6neDE2dv1DynvXsHWmZSXED6VWBjY3uMU3YtcpXGCtxTU6EiaRKiGnhxslQlBiSypAnXHeh55DZJMJJ/JM7+BCtr33LY2lusF9/aAuKO9tbdpGmu63s5ItZ1/9zMoCJwBfpQZgY2HzZoBhjwqYu2wSkOOVAMjq+jXET7nASieOZXmpQq2uDepuEDa8MP7d6G6kV2KYJPdLYYaY4U2eppEr7ALhhJidYm3P38W47JuLyu/2raG0AY2uDtCQw9d16BcJO3au+T4B4mHzPg1/cPhQ2X4dHTTGHjRZ0sT95DrEYYmcwWVKHKyiuL8WPtQmF0QBfCOPczwJajJejB4DbxEW8U2kuhuoBWr7wZe4y/nbW2hB3pcMYYXc0EXen74IttiUrvksw+hbkLaZDCJgG91SOlWSwI12UlDrJJSzOYm+ODWqK+bKyqAafQTL9xh5heM3nQlR5G6/A/8UG+0q5ZDL+IxJwe+EffJNwrL1mn4Rc3qx068udMJC+qzmft7Ljey7mfoIiwepITpii1IA/CtuEqtpe4I5MUemQ60qAw/PoVbmD8zhOcnRHCBZtQ394I5vMo1qR2a4KeBICexx3IAjpeAQYI3+MAgo/bedqpklLYjbxpv37XwinoLj9ew4hKSjAB1wRRZlswmk+GD4XKlVo8eu88RCXYrsZ2oaOD4qxrtbc7+skGm+EqxL67nLW5n9bSC2u95bFJ1386teSFhsJL9w3EFiBlQRtm5tvee/ipmr6D2W7SyfCnSxImPC4TgTwkAXziQ3XtsUtGqj0Tv1HGayaAQpYzlJaPzf7h8oanH1VaA+AgRq+RY1OjLZGHEz37jSbqhWOiIWxwJ7qFaqGB90cHq3s07qcWrDl2wUawFLTXavZ0IF3gj9KnFSIzW3+ANvedUCXOjai+zOKmpxVFZ4Bi4W3Dcbl9B+qa0Ly0NIgldi7PmqEvL3V4FnJs6WnwdagyhXOzdlKVlrAgGluucgqBpBZZfpN6uB+tdkbrqzsdMbr+H9Hwk3RUxRzAK9k+J9WRgY7eMazH0najJ1PYh9/UZJf0DKWRi2vZTlWW+6ZruJWTohOKm+7MCgvMEttIpNQfvK6+cq7p3vwPe+pmq0DznNg4LO7Uu3cXKq3zHjl08KGE04KZyfoJuZPr+XrF91AywZ03HlT2SBBaZtFld1VapccgB5DqgE1JfFg+TS4is9a8G52Ad9yh/abUmLohsnUpGdYMaj/1FmhSLM7ldHeub8CmL2vKW4f/JTuqmOxq3X5RA+qw5f946ekUz9ZF8EyGvNwaRZ2p5m0MtXQG2IKp8Q61aBSpqbMwKzTW93VycEn7L5ZsoV5eYo0rC4PMawGkfgdNzBpq4NL5bNB82l6qHnWqU7jXh611/ZV4ueX2MLSB3cyhnaFxsH9bat1jGDtUl5umNWNtvN6rWBVsClmYfBLSUCEyftGPlxzAOy6vRHGxAdCNdoiTRGgZru3aYyW9l5XhYH1aZ+dOlTOwngaqqIb3kZoPzcc9xCeZ/I/N6iVuTUI69us8y3LVL6qKa6az5zTTgumoFB5kMugPtumS1U9hzhLtm9+hY6yZVgYredgAwVVIviMAqFFZztFkPiskcwIdrPhXzoXwfuBWDaq+dF9nykjw1F9U2gyDU0YhEOtSmdIWoIma3OmdOZ/h/JbWNrwUoAirmBmWIHQTmA5Ag==,iv:btQ5xmt/AA9vW1njJH4Inj6YmOBx6pGbHbsvCMbg7fI=,tag:DuQ4Wy9wX3mPQAVLLd6t1Q==,type:str] klefki_pub.asc: ENC[AES256_GCM,data:lGfgwhgn2xCb1cNTo0nMP8R3KSDiEn0/k6neDE2dv1DynvXsHWmZSXED6VWBjY3uMU3YtcpXGCtxTU6EiaRKiGnhxslQlBiSypAnXHeh55DZJMJJ/JM7+BCtr33LY2lusF9/aAuKO9tbdpGmu63s5ItZ1/9zMoCJwBfpQZgY2HzZoBhjwqYu2wSkOOVAMjq+jXET7nASieOZXmpQq2uDepuEDa8MP7d6G6kV2KYJPdLYYaY4U2eppEr7ALhhJidYm3P38W47JuLyu/2raG0AY2uDtCQw9d16BcJO3au+T4B4mHzPg1/cPhQ2X4dHTTGHjRZ0sT95DrEYYmcwWVKHKyiuL8WPtQmF0QBfCOPczwJajJejB4DbxEW8U2kuhuoBWr7wZe4y/nbW2hB3pcMYYXc0EXen74IttiUrvksw+hbkLaZDCJgG91SOlWSwI12UlDrJJSzOYm+ODWqK+bKyqAafQTL9xh5heM3nQlR5G6/A/8UG+0q5ZDL+IxJwe+EffJNwrL1mn4Rc3qx068udMJC+qzmft7Ljey7mfoIiwepITpii1IA/CtuEqtpe4I5MUemQ60qAw/PoVbmD8zhOcnRHCBZtQ394I5vMo1qR2a4KeBICexx3IAjpeAQYI3+MAgo/bedqpklLYjbxpv37XwinoLj9ew4hKSjAB1wRRZlswmk+GD4XKlVo8eu88RCXYrsZ2oaOD4qxrtbc7+skGm+EqxL67nLW5n9bSC2u95bFJ1386teSFhsJL9w3EFiBlQRtm5tvee/ipmr6D2W7SyfCnSxImPC4TgTwkAXziQ3XtsUtGqj0Tv1HGayaAQpYzlJaPzf7h8oanH1VaA+AgRq+RY1OjLZGHEz37jSbqhWOiIWxwJ7qFaqGB90cHq3s07qcWrDl2wUawFLTXavZ0IF3gj9KnFSIzW3+ANvedUCXOjai+zOKmpxVFZ4Bi4W3Dcbl9B+qa0Ly0NIgldi7PmqEvL3V4FnJs6WnwdagyhXOzdlKVlrAgGluucgqBpBZZfpN6uB+tdkbrqzsdMbr+H9Hwk3RUxRzAK9k+J9WRgY7eMazH0najJ1PYh9/UZJf0DKWRi2vZTlWW+6ZruJWTohOKm+7MCgvMEttIpNQfvK6+cq7p3vwPe+pmq0DznNg4LO7Uu3cXKq3zHjl08KGE04KZyfoJuZPr+XrF91AywZ03HlT2SBBaZtFld1VapccgB5DqgE1JfFg+TS4is9a8G52Ad9yh/abUmLohsnUpGdYMaj/1FmhSLM7ldHeub8CmL2vKW4f/JTuqmOxq3X5RA+qw5f946ekUz9ZF8EyGvNwaRZ2p5m0MtXQG2IKp8Q61aBSpqbMwKzTW93VycEn7L5ZsoV5eYo0rC4PMawGkfgdNzBpq4NL5bNB82l6qHnWqU7jXh611/ZV4ueX2MLSB3cyhnaFxsH9bat1jGDtUl5umNWNtvN6rWBVsClmYfBLSUCEyftGPlxzAOy6vRHGxAdCNdoiTRGgZru3aYyW9l5XhYH1aZ+dOlTOwngaqqIb3kZoPzcc9xCeZ/I/N6iVuTUI69us8y3LVL6qKa6az5zTTgumoFB5kMugPtumS1U9hzhLtm9+hY6yZVgYredgAwVVIviMAqFFZztFkPiskcwIdrPhXzoXwfuBWDaq+dF9nykjw1F9U2gyDU0YhEOtSmdIWoIma3OmdOZ/h/JbWNrwUoAirmBmWIHQTmA5Ag==,iv:btQ5xmt/AA9vW1njJH4Inj6YmOBx6pGbHbsvCMbg7fI=,tag:DuQ4Wy9wX3mPQAVLLd6t1Q==,type:str]
#ENC[AES256_GCM,data:lP/UhYvW72t/Ql94rzxb,iv:rAoO8xytnYBTiwqGjxJTWBINaX/W0IOTBhYu8bx1dR8=,tag:RURjkKrFINdbz1RzXM6oGQ==,type:comment] #ENC[AES256_GCM,data:7V0L0832xewUXU8/Bq469w==,iv:9bCzEpUcNx6qnCMomFweXgYmWwSMzdffDikjA22xu6E=,tag:F4S80e/EPXA0tS20KFRbXw==,type:comment]
caddy_root.crt: ENC[AES256_GCM,data:8KyKvKCjRbzxTIm+OcacNt/h7jNxIApHlRF8T5G18qPg1RVC/XYHUZarichP6m7Z6GwcF9kBCCZ92UqMjskFNbekZZzXZ83FDeAMF76OzzSxW0iyL8sLOm7ApxcRxwIjLmEuR5gvneoamunftKoQevIP/QNyrpTM2oi9GfjE1TY9wwmJKeZpckEVqZcL94jimUXuPQrkvAdf/1mQ02PVQI42rKG6T8dK7bFsxoulRE+HAgwd7fqnBHhMZXvMS8B7GlrO4nfbxNzcO4/HeDWrhH8uADq4io2Gou6bSt+5Q0mqYVFpLA3SqW3FLJFTOmc0OxYyUmQWmMzQyDfI1efpdw64hQGQeZ1f47DUgoVMOMGpvJr8TiPRiEZ0+cxO/jvDTTM0ru9OcLyzSJcVy7z/KjokpF8hCYyDOTlR8tbzomGSJRZGNnsAF7IR7b0bwSfe4MVA855V+Qx10912qRid6W0thNSorL7WO7dLxptJCVvw4gt4M1k6lwRzc3DmhtST7bhgJqh66w94vah3QCRRJ+WAI+pn3wMZD9GiuRBu11dYudUCyebABR601wi6T8cSp4jUXfDwUWq0IkQUcmdPsbV3CA5EuDATQDfVJG3L938sv7oFGud+NLxziAfWBMy5tPzWNOXCh24uG8D4bG+rKtVQFIx1aVxAxLHL8858WbuFw9YQ8Jh7vBOqqSGDa18Xu9/68t5M1yPzs5oknxzTZ4Ti/TCzsOz6Y/GqlaBFWZIVzC8T12uBfUnfwe07i41XL4jNqfhv5WXBEnIaXXGcNOe5k0BocsGAWpV9iYxRKHndEk4op66rZTfOBzbMXOl7wGw6ZLsrFg==,iv:xxCwhxnxvpWJF8SAI8nctHigBa/OJrrc7KJY7VZ6aag=,tag:EIhIbi+niFLw5X4Z/xWAyQ==,type:str]
#ENC[AES256_GCM,data:ODJOtUINaKPcvckAuk0y+FqAl91xuhmfaBys2UQ7,iv:ZKMV/ma7whPAlCYY5OzOM91QgLvb3v9J92rVB72fduc=,tag:DuZxO2X8grqVbpqXglUlaA==,type:comment]
id_snowbelle: ENC[AES256_GCM,data:MAw5R2fqVIctN7fB/d3hfCU7W3sxvuy2O3w3n0vD8FxK1DAhqoROlVv04joV1a+U1hof57TYc1cN2ng9BRWxadc8ZIpWakokZYVI0dUG05/hPMyxctWPkOiDd5909aaNUFC2G+Y/VrgAemyrB+AlQgokV0U3fiz+qjg055fzO7ypaeM8okON6rBnigfwetmSm60MxpdYrVlxVaniDVvKKUYZjpHU8SZ+TYj6Jmm/bVuKWOJ2DXZbmM0CeKeIgnA9HML1wSXojMv2IMGulxq5mmdaiiJTPoL1q17OA5zZkkVW3Dx1y6SbEeBAQTPG32RHseAxXK6qdU6lftRQZKyivuyjdCVfBBw/VzqTxbWjSXXsjDdK/Ti09051w6znA1uvRX65XsOq6zPKt4BNwR+yMDF+xR9AElBTHES/TDf7TRc5YDyovlH2PhGNg12Coy3zfb6WESLyaz3/GYZxF0IjvBnDkN65CRjstut0CgKXcWY8x+CuKVysU+U4c0A2ucDnsf3HuITrdIufhAwRNNZMka7LWVsaaR/tnvcf,iv:agf/LEjohw1XAXsOJJ78kiBVJnTT95IUmWzYUujSlJI=,tag:a55o9L85a9Z7gG9s5BEfIw==,type:str] id_snowbelle: ENC[AES256_GCM,data:MAw5R2fqVIctN7fB/d3hfCU7W3sxvuy2O3w3n0vD8FxK1DAhqoROlVv04joV1a+U1hof57TYc1cN2ng9BRWxadc8ZIpWakokZYVI0dUG05/hPMyxctWPkOiDd5909aaNUFC2G+Y/VrgAemyrB+AlQgokV0U3fiz+qjg055fzO7ypaeM8okON6rBnigfwetmSm60MxpdYrVlxVaniDVvKKUYZjpHU8SZ+TYj6Jmm/bVuKWOJ2DXZbmM0CeKeIgnA9HML1wSXojMv2IMGulxq5mmdaiiJTPoL1q17OA5zZkkVW3Dx1y6SbEeBAQTPG32RHseAxXK6qdU6lftRQZKyivuyjdCVfBBw/VzqTxbWjSXXsjDdK/Ti09051w6znA1uvRX65XsOq6zPKt4BNwR+yMDF+xR9AElBTHES/TDf7TRc5YDyovlH2PhGNg12Coy3zfb6WESLyaz3/GYZxF0IjvBnDkN65CRjstut0CgKXcWY8x+CuKVysU+U4c0A2ucDnsf3HuITrdIufhAwRNNZMka7LWVsaaR/tnvcf,iv:agf/LEjohw1XAXsOJJ78kiBVJnTT95IUmWzYUujSlJI=,tag:a55o9L85a9Z7gG9s5BEfIw==,type:str]
#ENC[AES256_GCM,data:wqoh4/WaghcWWifBKYINlE0ovUVJNepdPKnLMXI=,iv:vpTOcdoejeMffDKLVPHmTR5u1rsProi7vtttFjIyp/E=,tag:PtjKubpLJLP+Bq7GQMknEg==,type:comment] #ENC[AES256_GCM,data:ozhgyE+IyqR10KT8vI9x,iv:+ZOTucRlCZRQ9ZbxZgySPMOJ/qU4gXbhSyLAMgt4QMs=,tag:mQ3X+dqCet1Yk1gZ5pZ5gw==,type:comment]
id_snowbelle.pub: ENC[AES256_GCM,data:rQ32bqwknbVssJDN4TW72YrusMPQJRFTfpoH2M2ELsAf3DkXtchGwOSjEbeR9ezUgHkTD96rFm5JvjDFQukAOpBHfMP5aRVy6RjTtb8j7aAD+EGUEpBSAVspZKQAWAqyDQ==,iv:8bEgvJgWpu7QwsrWhkjUw3GtRI92Pn7TT0rXCQ/i2Js=,tag:EnUehKMncN5v4dZZ/es3Qw==,type:str] id_snowbelle.pub: ENC[AES256_GCM,data:rQ32bqwknbVssJDN4TW72YrusMPQJRFTfpoH2M2ELsAf3DkXtchGwOSjEbeR9ezUgHkTD96rFm5JvjDFQukAOpBHfMP5aRVy6RjTtb8j7aAD+EGUEpBSAVspZKQAWAqyDQ==,iv:8bEgvJgWpu7QwsrWhkjUw3GtRI92Pn7TT0rXCQ/i2Js=,tag:EnUehKMncN5v4dZZ/es3Qw==,type:str]
#ENC[AES256_GCM,data:7om13qUta/huBOBYv0et6mcjhBgI9DdNZTQaNXko,iv:WAedsXER0vgArZriZeijZy3oCcLJ1ElN0Xp8uk3Pou0=,tag:OII5cT3U2zW33E2J8TgqGw==,type:comment]
id_vaniville: ENC[AES256_GCM,data:j3gjSzsocXT8Y8f8zwQui4kh/wF5k2rsj1YzoCPBUufoM+W1O6cr4AzIUswdd7czGzatRrstg9dOsEHSjj6og1ZJlKcIIgeW6N7KYv5hWjP/vaDQNO/PewKT+OJS2I7iMPsOeNYRCb0Dd/L3Fc0tE+TXqTqUWz0+PXkcAtYXgjNGh3DF4RmRzBd0A5FBpFNp7Yo/NzDfduDS9SNltOia+4W7K1QlG/xNbNUH9WA4AbHv+GQuZ8mcYX/yz1poOVFUpQXZO82kj/AwlmpULiW1gbYyBF0YKd7ZHowxfN2XuJQq21Yz7lsbJYfRiGmYO79ZrU/uZLX9MLAWPwZ/ETcet2SXiuhwuKP1SsFKebhPNPzd6XkBj+riGJDE/4kVF0aCJSP0rO7rEnQ2qdNkr56HokVNHITQelsyHIGhDOdBwkqHcCzqcLh2YyaiLo52eUrjygluczZG/ZA9+qi3sLW5vhttQ5c+UQ+PRn8o/KY0/CM7Zmk7RfFQysEvelURq8adqVGCceqyGyBJgDRMurb1x1kx71tOO62l7NTo,iv:SVM6EP+4wbVuK0JSoZoTfMLYjenHHZPuo6BuTtRjrcU=,tag:Y/OjbwL2TOOIEEL/8nDDRw==,type:str]
#ENC[AES256_GCM,data:PNAQCwHAPgurYca1MtGFVWTQGU7APuATymjRHtQ=,iv:NOt49fqLAZLdpyZ8ZJyx5n30qP8GEPEhyFlMxkVyZ7E=,tag:Kw9VASFq03q6RLVsL/1FPQ==,type:comment]
id_vaniville.pub: ENC[AES256_GCM,data:JiYGJklP12BSGx0jMzfYTNn3MkJSEjCoMR3bKLPjuaD0lab6mTIsQ3vXsyR44Tu3fknCWdcJXNJ0gUX42CfUzBF4QU+MixMFaCYvaEEBv2do39LaRwpkDEYSpYn3fyQWLQ==,iv:NxL7sZnFwJfcRkkwCf4G/e+hHTCLi7/lui2Ty3VRJso=,tag:bdYZH7UywWUQYOGLPUZrLg==,type:str]
#ENC[AES256_GCM,data:lS++LQwlDVP0aYcdaaudBkKxNB3P3UBE,iv:UqGcXcX/Jvf60o409Cxj7VJCDh63uUxy45PuZbHK2l8=,tag:OXdMwuJwdN8DQaLXACpcRA==,type:comment] #ENC[AES256_GCM,data:lS++LQwlDVP0aYcdaaudBkKxNB3P3UBE,iv:UqGcXcX/Jvf60o409Cxj7VJCDh63uUxy45PuZbHK2l8=,tag:OXdMwuJwdN8DQaLXACpcRA==,type:comment]
ssl_blakedheld_crt: ENC[AES256_GCM,data:OPrDCh56XdRLslAcx/vw9l7gvc42no+QzB9tVSLHtcHbWWqb+hefvAE6xnfMLlt5+BRuAJRvspA6kx/WfagjFuN7q3HAHPt/FcfZPCYZNT5wXZH59wtV8JkVtLKnCxqSUXrah9a/WrHkU7njzoWql53eoAXEt58mvxyxZihqZd/uwinZt/T4QsevmikIsB3LB7AQtUHfsHd13ZFAaGiA+Mnncdl6Nt5s3U4yTuUxhfmYwr2cuyL+Li5eNzdO2ZooXBySdp4Ym03rpBERuh0U8a7NNj5ZaoHW1f0AyFRRKQ7RIHHyhQNC6hL2eGqsv+hTkJCJKxOCYKW1cF9rDt6bueKAm7zk3RTw0Sk7eXaOoqulCf8vBcMf4ckfH5mFVUpSHuwc4lfIZExjggn2i7Bu7xGIOLqC1RL4S5cuhLGUxzgvCiKMcMmaZZcT+fZa5wiHzv2vaCzXuYRb1rNi0xoiAZcL65yIV0NGtP0mOFygdY2hI4R7itbcE0MGIbwdOuWkCRs19WVFchNgcV7GnZBUVKAbhFXq+GilWLufODJr4Zxc1NpxRjG4flWQl3A3jGc4+tW5Infa1n6XPmhHz6JjyPE2mVbLq4JORPHeMcN4Wbckrmio0ruJu5rV9J95HYceXJIF2dw7AgmaWEX67JCHJPbAg5n4zRrfraeMwKB7XHTMglTLbyQsw7zkqzGDpT6ztOn/uCtErEmU0LSlIcOzz8WdGnnWbReMLiUfrQwuKvJhwOpcr9t+FVAtDyjyZhL/PTDy4/qIjQNPwBiVMKzv1CV/eA1WHcYKb6oRvP2TAlh82mA5uIE1jqY9QXg1cfMl2ncnsHnv3d1iFHy3OxvmWwvve+1zzJ2jubh+1ZwKAjP/9UEq9eldyFqC86qYKYGXec5j4Q4QGrMN4AiObVI/yDnRdeWal8jM8p5cz56rgBesDX7/ljR5wjifdQ5s4Iao2exPrHAWtiJHWE1i4R1g4rB+h8piu4feZXiPh3chdxrUrxCaQK0N0nOkN6+F7y8rbd6egk9Q5xvjNlJGzJGiSQ9xhDYmnPZtUTWXL3KioIPwy2/yh+lpkG/JrUacgc+HaHO+DsXs2NhlObrcswo4zmZ1eEckwFSpl1iP5ABHTxNVY0V6pdj1+7YyB+wav8tlVfguyxLf8JV7dqVnADCV+R5D5rBikmoJdjgdZwNxO0QBaZFVLeaCSgoCVEfvSPFtL9cMnEhLhdtw+k3U53+JJYemRfdh48DAM01Na2b9q6Ey2R6YrqtONVIauMNAaKXOeaJCxJhYVBqB8yNiAOOhyJ/Wvzq/CUM1QsXHQvwbndAxmyeFc8XSo7HZZME9m11fNvcEdWfdm63BpwkrHKPzQc7sR6tKeMy7l48f1baPTNoevEd0vFeURHoOggrnyBeO4q8YdLCderFmsSOzyDP+KjDxwTE6u+4P2xMXfnjwTpxLZInV+sNPsgaMj/bBeOJr7m6IN8N3/jxgPiBTGMObiVCIzhXL/VP352xc7Vbh5ZjMvuXQIPWCodPjWV6kcK8EvanN/l0vbDh1MxMAFiqj6tRHUfB0Px0JiC263kR0vzEDI1K6qEfPmPjA8TiDo1tK,iv:qdtzMcF1iELnhrCs3SboRcAsnw/0WgcUpWWHzKHNEYc=,tag:TkUMk8Wp2OTQd8CRtS07Wg==,type:str] ssl_blakedheld_crt: ENC[AES256_GCM,data:OPrDCh56XdRLslAcx/vw9l7gvc42no+QzB9tVSLHtcHbWWqb+hefvAE6xnfMLlt5+BRuAJRvspA6kx/WfagjFuN7q3HAHPt/FcfZPCYZNT5wXZH59wtV8JkVtLKnCxqSUXrah9a/WrHkU7njzoWql53eoAXEt58mvxyxZihqZd/uwinZt/T4QsevmikIsB3LB7AQtUHfsHd13ZFAaGiA+Mnncdl6Nt5s3U4yTuUxhfmYwr2cuyL+Li5eNzdO2ZooXBySdp4Ym03rpBERuh0U8a7NNj5ZaoHW1f0AyFRRKQ7RIHHyhQNC6hL2eGqsv+hTkJCJKxOCYKW1cF9rDt6bueKAm7zk3RTw0Sk7eXaOoqulCf8vBcMf4ckfH5mFVUpSHuwc4lfIZExjggn2i7Bu7xGIOLqC1RL4S5cuhLGUxzgvCiKMcMmaZZcT+fZa5wiHzv2vaCzXuYRb1rNi0xoiAZcL65yIV0NGtP0mOFygdY2hI4R7itbcE0MGIbwdOuWkCRs19WVFchNgcV7GnZBUVKAbhFXq+GilWLufODJr4Zxc1NpxRjG4flWQl3A3jGc4+tW5Infa1n6XPmhHz6JjyPE2mVbLq4JORPHeMcN4Wbckrmio0ruJu5rV9J95HYceXJIF2dw7AgmaWEX67JCHJPbAg5n4zRrfraeMwKB7XHTMglTLbyQsw7zkqzGDpT6ztOn/uCtErEmU0LSlIcOzz8WdGnnWbReMLiUfrQwuKvJhwOpcr9t+FVAtDyjyZhL/PTDy4/qIjQNPwBiVMKzv1CV/eA1WHcYKb6oRvP2TAlh82mA5uIE1jqY9QXg1cfMl2ncnsHnv3d1iFHy3OxvmWwvve+1zzJ2jubh+1ZwKAjP/9UEq9eldyFqC86qYKYGXec5j4Q4QGrMN4AiObVI/yDnRdeWal8jM8p5cz56rgBesDX7/ljR5wjifdQ5s4Iao2exPrHAWtiJHWE1i4R1g4rB+h8piu4feZXiPh3chdxrUrxCaQK0N0nOkN6+F7y8rbd6egk9Q5xvjNlJGzJGiSQ9xhDYmnPZtUTWXL3KioIPwy2/yh+lpkG/JrUacgc+HaHO+DsXs2NhlObrcswo4zmZ1eEckwFSpl1iP5ABHTxNVY0V6pdj1+7YyB+wav8tlVfguyxLf8JV7dqVnADCV+R5D5rBikmoJdjgdZwNxO0QBaZFVLeaCSgoCVEfvSPFtL9cMnEhLhdtw+k3U53+JJYemRfdh48DAM01Na2b9q6Ey2R6YrqtONVIauMNAaKXOeaJCxJhYVBqB8yNiAOOhyJ/Wvzq/CUM1QsXHQvwbndAxmyeFc8XSo7HZZME9m11fNvcEdWfdm63BpwkrHKPzQc7sR6tKeMy7l48f1baPTNoevEd0vFeURHoOggrnyBeO4q8YdLCderFmsSOzyDP+KjDxwTE6u+4P2xMXfnjwTpxLZInV+sNPsgaMj/bBeOJr7m6IN8N3/jxgPiBTGMObiVCIzhXL/VP352xc7Vbh5ZjMvuXQIPWCodPjWV6kcK8EvanN/l0vbDh1MxMAFiqj6tRHUfB0Px0JiC263kR0vzEDI1K6qEfPmPjA8TiDo1tK,iv:qdtzMcF1iELnhrCs3SboRcAsnw/0WgcUpWWHzKHNEYc=,tag:TkUMk8Wp2OTQd8CRtS07Wg==,type:str]
#ENC[AES256_GCM,data:3G8XqUKua1QgUxv2YJkW0fDnQPX7+v8GDC9BHg==,iv:BkESkMmMalgesy9why9eaKkOOvwSsN2EhNCRRRmZNtA=,tag:x95zt2B2M19BkzeMpAlXIg==,type:comment] #ENC[AES256_GCM,data:3G8XqUKua1QgUxv2YJkW0fDnQPX7+v8GDC9BHg==,iv:BkESkMmMalgesy9why9eaKkOOvwSsN2EhNCRRRmZNtA=,tag:x95zt2B2M19BkzeMpAlXIg==,type:comment]
@@ -75,7 +57,8 @@ ssl_recpro_crt: ENC[AES256_GCM,data:CiD7qdfWzi+7iA7qCD+w3UJdpxZByk2kmpw8YW7K3C7O
ssl_recpro_key: ENC[AES256_GCM,data:ev/g2sKFia5xcgZQ3LsfT0H9AaShYwxglzZadBhvknzFVwWxXGmGfHgKD6GM01fCIFOpB2pPGiiOTpgBh2xoRnPmivsApWoxxXgdVfzEEVbuB5pHAJSHWX5EUEqeiTz83zfbJAC5FZFwlIEQTL3YiPhRzKRWwEpMyYigsZmUAv3970XlDTAxDRgaPc4eHFI2ZrEXGmevnBoHOQPwXi+JCHqSCyhbPnsuU1InIcp4PMlX4/K+WknDT0HaLonIVXds237E8lOCJFAo4Ow3/zHho2B/tBZeqcHHf4P49SaSEO1CSCzTrW+1N1n+EsPo3PPld7AZ3klnsiKltorO18GM+2L9KGg6LbTiWm6FCOk2bMIFg9q1b183SSzeDx9CzhoXefsweMdn9BFBF1BVUObHGgYE0dpme20S43C+NVTeVt9+gjOEYysx/II8m1ui0UzpW+kYRdMLFjepYHlIZRA/jUEfdVssqKsX492n9bX5TRPc/9LN/o6oDg4CZjZXPILjD+Cg1NOW5ZSJrKvbFGRVNVeVlC5+idUqnaKP0Jh6nG/8niEBIyV51YGy6/ukruHyjMiH//iG9oE2xfLwjQGTUKhERxYgKOnisHkH7b7feTQBq926BgtWP63zchkCYz9sQTh8LzmfitXEBYUpRvDdxlnZ7m6I1ssemY7bFCnx2rZEpHRg9LxDG+UNgiODwm8YvXQbL7z+DPSVzG5QdRbhlS+deYMjquLBvWpMfUrJ8HxurLyvcZiTRqRSBmhlc+08Y3/j0RaSfmDdtId0HGKvokSoB7daMpgfKeZs9ddpvmEVYto4bER0Y2xfumgUq/VuhSR/H6KhuR++8JSnDZxPS5WtoH3eVOXrDIRKadiwYzx1r9dhek55iVLZ7uF/YGhxS4DD7gFsJJk8/usLnu7PM2UsoPhfhg69CrigFZRa6I1qdPSon3ODYxlJt1KVLgyNkJqjG06t96i3NcJaIm5tZNsGRDKrU8Jh6EiSzCquGOy4oblpE7lCdK5mlHXL5a0WRiaWTUqo27qTGT7o5jskXHQw8X+/iTP6LO8GpDcL/YCpF/HpV3JiuHLifJoV3u6Cj5qFyCfxF6k7h1gXUZxdMtovpicbzHeJS+4pAnrdR6NmavjlBKDZFRa6cUY0011ZuA4HYm4SdEPTCyEzOLNsmx4iwNao/jH1sPb6hQxfQrI/2xbKJYLeGJBDagCjEOB+bo1sUaTepDVSHAGUVpb6ZdW98AUs+zOiKAhE19H1NRuRRQcyq+6fMFh1+qyIoIELiJNlKcTjv53r30gyvnbz+FPLWqqvskZhRnwrF5JFFqwZ8Rkt/sS8TCQVT3ZGfOHF3J6yApb9GKQVu3D45efUePaPrGHVtWdJmQRVpQNKDAYoxOWT6yMhHH96juDh17QrqSvD6M+NqydP2K4q6zQE4rfSkTz9xPR/O7SvLUIZ6jDKj7TfNqOIpqVLaq8wiSPB3MW75RZKiGqcyH4aiEDgpYJRatF3+qZPx3zyUD8Oh5teEWya/HdqqW24a8FdmuQvdwE+ksCpeMJrVslQNDWpwpmRgJe3Nal7/qhdxh92WBSSteHmRSoFLKDwZAUa/f6Np1SXR7sc9fNeIggDvv3Ctx8LrUWpYTae1iGcaa8bwMPiwYXs0tLF+wmQHSypcMdl9CH76jhBRM+8cBzshiCISzJ4xrVUi91or5eOtXHaUM9BOqVZb1uykU/mkWWGQqdzo5Ng9POWUBxLvR4JywSVo4BaDawRykevOjM8JZFGYLfyOk45+MRRuESJWYnjf6P3V3f8l5Ai3SL0g7q/BImZ09iC2jTib8qlRrLMMJ+OQqx45TeCwicBnmV2hqz77KYvikgYLpYQUGkFKcqpP17nXKajbkvEP+2pIQQp6GRptp0Q3TvbOSZSvBJCmr6/6AQ2EXxTKMS2caUsw2bH2btkk45epPKJY1Qg1QOcjRwCUzy0ametW85M+5a3TSKjYAT5lNDb84q2mdMwy5giSI3iglUemcNYFurVlgGcY2CJJw6xi6UiqaqGIEhU9Sn9ns0cHejtu5Uoy+jxyuNaHyuH/f3pB/jdkCzkyTrxT4j5Lpdu6+Le4MdRbn+FGVtopn0LuoqHG8FhourPmpkQxdwA2Yq9glf9MuqiHz1aDri5rDQs/fdCYffvTxEEkZMvYdNIL+m/9talRX7wS1CffCqUrglcfKZxsbvPY9pK9YSxhOmtyZ/vyRBAMlA8Daz0o0mV7czV35tTPPoD36pgo04JenFRaKopwgyQ,iv:682Ok4M7ptRiWBytvbbiDyBCKBdZ51AIn7VWA62GdBk=,tag:UWsWZnDZ10dMF2vAB8V8tA==,type:str] ssl_recpro_key: ENC[AES256_GCM,data:ev/g2sKFia5xcgZQ3LsfT0H9AaShYwxglzZadBhvknzFVwWxXGmGfHgKD6GM01fCIFOpB2pPGiiOTpgBh2xoRnPmivsApWoxxXgdVfzEEVbuB5pHAJSHWX5EUEqeiTz83zfbJAC5FZFwlIEQTL3YiPhRzKRWwEpMyYigsZmUAv3970XlDTAxDRgaPc4eHFI2ZrEXGmevnBoHOQPwXi+JCHqSCyhbPnsuU1InIcp4PMlX4/K+WknDT0HaLonIVXds237E8lOCJFAo4Ow3/zHho2B/tBZeqcHHf4P49SaSEO1CSCzTrW+1N1n+EsPo3PPld7AZ3klnsiKltorO18GM+2L9KGg6LbTiWm6FCOk2bMIFg9q1b183SSzeDx9CzhoXefsweMdn9BFBF1BVUObHGgYE0dpme20S43C+NVTeVt9+gjOEYysx/II8m1ui0UzpW+kYRdMLFjepYHlIZRA/jUEfdVssqKsX492n9bX5TRPc/9LN/o6oDg4CZjZXPILjD+Cg1NOW5ZSJrKvbFGRVNVeVlC5+idUqnaKP0Jh6nG/8niEBIyV51YGy6/ukruHyjMiH//iG9oE2xfLwjQGTUKhERxYgKOnisHkH7b7feTQBq926BgtWP63zchkCYz9sQTh8LzmfitXEBYUpRvDdxlnZ7m6I1ssemY7bFCnx2rZEpHRg9LxDG+UNgiODwm8YvXQbL7z+DPSVzG5QdRbhlS+deYMjquLBvWpMfUrJ8HxurLyvcZiTRqRSBmhlc+08Y3/j0RaSfmDdtId0HGKvokSoB7daMpgfKeZs9ddpvmEVYto4bER0Y2xfumgUq/VuhSR/H6KhuR++8JSnDZxPS5WtoH3eVOXrDIRKadiwYzx1r9dhek55iVLZ7uF/YGhxS4DD7gFsJJk8/usLnu7PM2UsoPhfhg69CrigFZRa6I1qdPSon3ODYxlJt1KVLgyNkJqjG06t96i3NcJaIm5tZNsGRDKrU8Jh6EiSzCquGOy4oblpE7lCdK5mlHXL5a0WRiaWTUqo27qTGT7o5jskXHQw8X+/iTP6LO8GpDcL/YCpF/HpV3JiuHLifJoV3u6Cj5qFyCfxF6k7h1gXUZxdMtovpicbzHeJS+4pAnrdR6NmavjlBKDZFRa6cUY0011ZuA4HYm4SdEPTCyEzOLNsmx4iwNao/jH1sPb6hQxfQrI/2xbKJYLeGJBDagCjEOB+bo1sUaTepDVSHAGUVpb6ZdW98AUs+zOiKAhE19H1NRuRRQcyq+6fMFh1+qyIoIELiJNlKcTjv53r30gyvnbz+FPLWqqvskZhRnwrF5JFFqwZ8Rkt/sS8TCQVT3ZGfOHF3J6yApb9GKQVu3D45efUePaPrGHVtWdJmQRVpQNKDAYoxOWT6yMhHH96juDh17QrqSvD6M+NqydP2K4q6zQE4rfSkTz9xPR/O7SvLUIZ6jDKj7TfNqOIpqVLaq8wiSPB3MW75RZKiGqcyH4aiEDgpYJRatF3+qZPx3zyUD8Oh5teEWya/HdqqW24a8FdmuQvdwE+ksCpeMJrVslQNDWpwpmRgJe3Nal7/qhdxh92WBSSteHmRSoFLKDwZAUa/f6Np1SXR7sc9fNeIggDvv3Ctx8LrUWpYTae1iGcaa8bwMPiwYXs0tLF+wmQHSypcMdl9CH76jhBRM+8cBzshiCISzJ4xrVUi91or5eOtXHaUM9BOqVZb1uykU/mkWWGQqdzo5Ng9POWUBxLvR4JywSVo4BaDawRykevOjM8JZFGYLfyOk45+MRRuESJWYnjf6P3V3f8l5Ai3SL0g7q/BImZ09iC2jTib8qlRrLMMJ+OQqx45TeCwicBnmV2hqz77KYvikgYLpYQUGkFKcqpP17nXKajbkvEP+2pIQQp6GRptp0Q3TvbOSZSvBJCmr6/6AQ2EXxTKMS2caUsw2bH2btkk45epPKJY1Qg1QOcjRwCUzy0ametW85M+5a3TSKjYAT5lNDb84q2mdMwy5giSI3iglUemcNYFurVlgGcY2CJJw6xi6UiqaqGIEhU9Sn9ns0cHejtu5Uoy+jxyuNaHyuH/f3pB/jdkCzkyTrxT4j5Lpdu6+Le4MdRbn+FGVtopn0LuoqHG8FhourPmpkQxdwA2Yq9glf9MuqiHz1aDri5rDQs/fdCYffvTxEEkZMvYdNIL+m/9talRX7wS1CffCqUrglcfKZxsbvPY9pK9YSxhOmtyZ/vyRBAMlA8Daz0o0mV7czV35tTPPoD36pgo04JenFRaKopwgyQ,iv:682Ok4M7ptRiWBytvbbiDyBCKBdZ51AIn7VWA62GdBk=,tag:UWsWZnDZ10dMF2vAB8V8tA==,type:str]
sops: sops:
age: age:
- enc: | - recipient: age14gfh682a7m7jfp3qrulql03x5rs7yedwmxwksxrrmgjsunstyuksqx93pz
enc: |
-----BEGIN AGE ENCRYPTED FILE----- -----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1WkdJMnJ3Y3IvN3lkemJK YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1WkdJMnJ3Y3IvN3lkemJK
RjF0dmgzT2lDcENka3BlK1NQRTBuR1BtSmhnCmI2cnRWdVpIM2t5SWNMOWNWdG84 RjF0dmgzT2lDcENka3BlK1NQRTBuR1BtSmhnCmI2cnRWdVpIM2t5SWNMOWNWdG84
@@ -83,8 +66,7 @@ sops:
U0tmdFBuZnJES3piOTZNV0VKQmQ0eVUKCWRQ/flLzmpC64WyLoipklZBmrkpYiUg U0tmdFBuZnJES3piOTZNV0VKQmQ0eVUKCWRQ/flLzmpC64WyLoipklZBmrkpYiUg
PRu+itNolpPTHm96pe+P93g2iP0wgekG0cX21wkiU2xaLF3dY2FEIA== PRu+itNolpPTHm96pe+P93g2iP0wgekG0cX21wkiU2xaLF3dY2FEIA==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
recipient: age14gfh682a7m7jfp3qrulql03x5rs7yedwmxwksxrrmgjsunstyuksqx93pz lastmodified: "2026-01-28T21:02:05Z"
lastmodified: "2026-07-28T14:33:14Z" mac: ENC[AES256_GCM,data:b9aX43ViObNX29DkVNHtwkQRm26PRe2rZYhDnL1ZYLLWyaO3OGP9+rM4vHT0lyuowQ6+Ur3IMPVpUSziXYLh3mtxr0hyYy5Y1miBuIxXYLBi3oLRTW1TgZdklzFDVL3c1GT4lXEh4q9KG3dP64r9/8dvjO2iRIosZ93/l0pIi3A=,iv:/gdNfVy8UiQsIRAHh2jiha5fL+wmfgp0srxt17Ry4Xs=,tag:YdVbvpBnQSaIarGIfiTzKQ==,type:str]
mac: ENC[AES256_GCM,data:bEcpoMFzXbK4WCs94Y4I5CDo9JDC4/6iRMfgc41m1o8/qJhKyJUWWZcPhJSaRSituTYyPjSe8aB6k2Vwpgcd+hk41JC2Op09mnjBWfDQz6Ts0YbZAnZ/dV4IrzdxYRtM91EXmJnROeiTftGgYN/6Awa8I+ie3UFBl8u6/5UoD7o=,iv:MIhnNS9RGFWKJ0LI7Ae9gTEcGzfKwQB4bg4oSAs8/Go=,tag:W/zfVpxn+sRa+FOrR9fKyA==,type:str]
unencrypted_suffix: _unencrypted unencrypted_suffix: _unencrypted
version: 3.13.2 version: 3.11.0
users/blake/default.nix
+4 -7
View File
@@ -5,10 +5,9 @@
inputs, inputs,
... ...
}: let }: let
platform =
if builtins.pathExists "/System/Library/CoreServices" platform = if builtins.pathExists "/System/Library/CoreServices" then "darwin" else "nixos";
then "darwin"
else "nixos";
in { in {
# create blake user # create blake user
users = { users = {
@@ -25,9 +24,6 @@ in {
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBK0AGJfZGyqW8/krvQV+PL7axcDW/EnKyHy9M8wryQx klefki" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBK0AGJfZGyqW8/krvQV+PL7axcDW/EnKyHy9M8wryQx klefki"
"ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBPdC9cCX8awvA19Ri65fvbYjZYe8X1Ef+nOZAIv92AS6u4SkJYqOvPYfqRHXORNDpbzjTV6nackyCKvV5EO4niv4MFIgdkEQwuVHcYX32/dOsWdDoeXBT/l2sFFM7JESwQ== blake@zygarde" "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBPdC9cCX8awvA19Ri65fvbYjZYe8X1Ef+nOZAIv92AS6u4SkJYqOvPYfqRHXORNDpbzjTV6nackyCKvV5EO4niv4MFIgdkEQwuVHcYX32/dOsWdDoeXBT/l2sFFM7JESwQ== blake@zygarde"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOVsjLEbnW/KeFXogppi0AP6ZbCZpObu7zFeRV/aLkP9 blake@lugia" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOVsjLEbnW/KeFXogppi0AP6ZbCZpObu7zFeRV/aLkP9 blake@lugia"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHJiskD81/2bd63sbJVSN0xPNwnbCGXheIBIKrwShDoo bhelderman@cen-it-07.local"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO06en1r4+zg8JMGPq7WiZeh/DBUvfhDJX3e+J5Z5Ttk blake@snowbelle"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP0FLKK9yEPYpGuCjoX0e7Ky/zTPfzDk7IkrR3tOmELP blake@vaniville"
]; ];
}; };
}; };
@@ -48,6 +44,7 @@ in {
nix.settings.trusted-users = ["blake"]; nix.settings.trusted-users = ["blake"];
programs.zsh.enable = true; programs.zsh.enable = true;
sops.secrets = { sops.secrets = {
"blake_passwd" = { "blake_passwd" = {
owner = "root"; owner = "root";
users/blake/dots/core/gpg/default.nix
-1
View File
@@ -6,7 +6,6 @@
}: let }: let
program = "gpg"; program = "gpg";
cfg = config.dots.${program}; cfg = config.dots.${program};
isLinux = pkgs.stdenv.isLinux;
#sec = sops.secrets; #sec = sops.secrets;
in { in {
options.dots.${program} = { options.dots.${program} = {
users/blake/dots/core/lf/lfrc
+1 -1
View File
@@ -23,9 +23,9 @@ set ignorecase true
# shortcuts # shortcuts
map gb cd /holocron map gb cd /holocron
map gz cd %{{ [ -d /holocron ] && printf /holocron || printf /media/holocron }}
map gn cd ~/.nix map gn cd ~/.nix
map gc cd ~/.config map gc cd ~/.config
map gv cd /var/lib
# navigation # navigation
map [ half-up map [ half-up
users/blake/dots/core/nvf/default.nix
+7 -31
View File
@@ -26,15 +26,14 @@ in {
vim = { vim = {
clipboard = clipboard =
# On Linux, use wl-copy as you do now # On Linux, use wl-copy as you do now
if isLinux if isLinux then {
then {
enable = true; enable = true;
providers.wl-copy.enable = true; providers.wl-copy.enable = true;
registers = "unnamed,unnamedplus"; registers = "unnamedplus,unnamed";
} }
else { else {
enable = true; enable = true;
registers = "unnamed,unnamedplus"; registers = "unnamedplus,unnamed";
}; };
globals = { globals = {
@@ -44,35 +43,12 @@ in {
vimAlias = true; vimAlias = true;
# fix indents lsp.enable = true;
autocmds = [
{
enable = true;
event = ["BufEnter"];
pattern = ["*"];
command = "setlocal indentexpr=nvim_treesitter#indent()";
}
];
lsp = {
enable = true;
formatOnSave = true;
};
statusline.lualine.enable = true; statusline.lualine.enable = true;
telescope.enable = true; telescope.enable = true;
autocomplete.nvim-cmp.enable = true; autocomplete.nvim-cmp.enable = true;
autopairs.nvim-autopairs.enable = true; autopairs.nvim-autopairs.enable = true;
treesitter = {
enable = true;
#grammars = pkgs.vimPlugins.nvim-treesitter.allGrammars;
indent = {
enable = true;
};
};
keymaps = [ keymaps = [
# visual line movement (insert mode) # visual line movement (insert mode)
{ {
@@ -177,6 +153,7 @@ in {
]; ];
options = { options = {
# line numbers # line numbers
number = true; number = true;
numberwidth = 2; numberwidth = 2;
@@ -187,6 +164,7 @@ in {
shiftwidth = 2; shiftwidth = 2;
softtabstop = -1; softtabstop = -1;
expandtab = true; expandtab = true;
smarttab = true;
autoindent = true; autoindent = true;
# search # search
@@ -209,12 +187,10 @@ in {
}; };
languages = { languages = {
enableTreesitter = true; enableTreesitter = isLinux;
nix = { nix = {
enable = true; enable = true;
treesitter.enable = true;
treesitter.package = pkgs.vimPlugins.nvim-treesitter.grammarPlugins.nix;
format = { format = {
enable = true; enable = true;
type = ["alejandra"]; type = ["alejandra"];
users/blake/dots/core/ssh/default.nix
+4 -20
View File
@@ -7,8 +7,6 @@
program = "ssh"; program = "ssh";
cfg = config.dots.${program}; cfg = config.dots.${program};
home_dir = config.home.homeDirectory; home_dir = config.home.homeDirectory;
isLinux = pkgs.stdenv.isLinux;
isDarwin = pkgs.stdenv.isDarwin;
in { in {
options.dots.${program} = { options.dots.${program} = {
enable = lib.mkEnableOption "enables ${program}"; enable = lib.mkEnableOption "enables ${program}";
@@ -18,7 +16,7 @@ in {
programs.ssh = { programs.ssh = {
enable = true; enable = true;
enableDefaultConfig = false; enableDefaultConfig = false;
settings = { matchBlocks = {
"*" = { "*" = {
identityFile = "${home_dir}/.ssh/id_blake"; identityFile = "${home_dir}/.ssh/id_blake";
forwardAgent = false; forwardAgent = false;
@@ -32,32 +30,18 @@ in {
controlPath = "~/.ssh/master-%r@%n:%p"; controlPath = "~/.ssh/master-%r@%n:%p";
controlPersist = "no"; controlPersist = "no";
}; };
"git.holocron.blue" = { "git.blakedheld.xyz" = {
user = "gitea"; user = "gitea";
port = 7567; port = 7567;
}; };
"git.lumiose.holocron.blue" = { "git.snowbelle.lan" = {
user = "gitea"; user = "gitea";
port = 7567; port = 7567;
}; };
"shauna" = { "bebe" = {
hostname = "10.10.0.1"; hostname = "10.10.0.1";
user = "root"; user = "root";
}; };
"snowbelle" = {
hostname = "10.10.0.10";
user = "blake";
identityFile = "${home_dir}/.ssh/id_snowbelle";
};
"vaniville" = {
hostname = "96.126.127.102";
user = "blake";
};
"lumiose" = {
hostname = "10.10.0.11";
user = "blake";
identityFile = "${home_dir}/.ssh/id_snowbelle";
};
}; };
}; };
users/blake/dots/core/xdg/default.nix
-1
View File
@@ -26,7 +26,6 @@ in {
userDirs = lib.mkIf isLinux { userDirs = lib.mkIf isLinux {
enable = true; enable = true;
setSessionVariables = true;
# writes ~/.config/user-dirs.dirs # writes ~/.config/user-dirs.dirs
desktop = "${home_dir}/desktop"; desktop = "${home_dir}/desktop";
download = "${home_dir}/downloads"; download = "${home_dir}/downloads";
users/blake/dots/core/zsh/default.nix
+8 -36
View File
@@ -7,7 +7,6 @@
program = "zsh"; program = "zsh";
cfg = config.dots.${program}; cfg = config.dots.${program};
home_dir = config.home.homeDirectory; home_dir = config.home.homeDirectory;
isDarwin = pkgs.stdenv.isDarwin;
#sec = sops.secrets; #sec = sops.secrets;
in { in {
options.dots.${program} = { options.dots.${program} = {
@@ -24,6 +23,7 @@ in {
programs.${program} = { programs.${program} = {
enable = true; enable = true;
dotDir = "${config.xdg.configHome}/zsh"; dotDir = "${config.xdg.configHome}/zsh";
#dotDir = ".config/zsh";
autocd = true; autocd = true;
enableCompletion = true; enableCompletion = true;
@@ -41,20 +41,18 @@ in {
path = "$XDG_STATE_HOME/zsh/history"; path = "$XDG_STATE_HOME/zsh/history";
}; };
shellAliases = shellAliases = {
{
# --- zsh --- # --- zsh ---
cfz = "nvim ${home_dir}/.config/zsh/.zshrc";
src = "source ${home_dir}/.config/zsh/.zshrc"; src = "source ${home_dir}/.config/zsh/.zshrc";
# --- config editing --- # --- config editing ---
cfl = "nvim /home/blake/.nix/users/blake/dots/core/lf/lfrc"; cfl = "nvim ${home_dir}/.config/lf/lfrc";
cfz = "nvim /home/blake/.nix/users/blake/dots/core/zsh/default.nix";
cfv = "sudo lf /var/lib";
# --- navigation --- # --- navigation ---
# ls = "ls --color=auto --group-directories-first"; ls = "ls --color=auto --group-directories-first";
# ll = "ls -lh --color=auto --group-directories-first"; ll = "ls -lh --color=auto --group-directories-first";
# la = "ls -Alh --color=auto --group-directories-first"; la = "ls -Alh --color=auto --group-directories-first";
".." = "cd .."; ".." = "cd ..";
"..." = "cd ../.."; "..." = "cd ../..";
fs = "du -h | sort -h"; fs = "du -h | sort -h";
@@ -94,19 +92,8 @@ in {
pull = "git pull"; pull = "git pull";
dotfiles = "/usr/bin/git --git-dir=${home_dir}/.dotfiles --work-tree=$HOME"; dotfiles = "/usr/bin/git --git-dir=${home_dir}/.dotfiles --work-tree=$HOME";
dtf = "/usr/bin/git --git-dir=${home_dir}/.dotfiles --work-tree=$HOME"; dtf = "/usr/bin/git --git-dir=${home_dir}/.dotfiles --work-tree=$HOME";
# nix shit
sec = "sops ${home_dir}/.nix/secrets/secrets.yaml"; sec = "sops ${home_dir}/.nix/secrets/secrets.yaml";
# zfs
dfzfs = "zfs list -r -o name,used,usedsnap,usedds";
# --- yt-dlp ---
yt-music = "noglob yt-dlp -f 'bestaudio/best' --extract-audio --audio-format opus --audio-quality 0 --embed-metadata --embed-thumbnail -o '%(playlist_index)02d - %(title)s.%(ext)s'";
# --- dumb shit ---
fix-music = "sudo find /holocron/media/music -type d -exec chmod 2770 {} + && sudo find /holocron/media/music -type f -exec chmod 660 {} +";
# --- systemd --- # --- systemd ---
stat = "sudo systemctl status"; stat = "sudo systemctl status";
restart = "sudo systemctl restart"; restart = "sudo systemctl restart";
@@ -119,21 +106,7 @@ in {
peace = "systemctl poweroff"; peace = "systemctl poweroff";
love = "systemctl reboot"; love = "systemctl reboot";
lock = "loginctl lock-session"; lock = "loginctl lock-session";
} };
# use GNU core utils ls on macos
// (
if isDarwin
then {
ls = "gls --color=auto --group-directories-first";
ll = "gls -lh --color=auto --group-directories-first";
la = "gls -Alh --color=auto --group-directories-first";
}
else {
ls = "ls --color=auto --group-directories-first";
ll = "ls -lh --color=auto --group-directories-first";
la = "ls -Alh --color=auto --group-directories-first";
}
);
initContent = '' initContent = ''
@@ -144,7 +117,6 @@ in {
alias lf='lfcd' alias lf='lfcd'
lfcd () {cd "$(command lf -print-last-dir "$@")"} lfcd () {cd "$(command lf -print-last-dir "$@")"}
''; '';
syntaxHighlighting = { syntaxHighlighting = {

Some files were not shown because too many files have changed in this diff Show More