diff --git a/.gitignore b/.gitignore index 047f75a..53b89bf 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,4 @@ -home/modules/ssh/ +home/users/maxmur/modules/ssh/ secrets/ .sops.yaml diff --git a/README.md b/README.md index 21d8931..f27f9ef 100644 --- a/README.md +++ b/README.md @@ -32,7 +32,12 @@ - ⚠️ Impermanence - to remove junk files and directories that are not specified in the config. - 💈 Stylix - to customize the theme for the entire system and the software you use. - 🍎 NixDarwin - to declaratively customize MacOS. -- 🔐 Lanzaboot - to securely boot the system. +- 🔐 Lanzaboote - to securely boot the system. +- 🤖 MicroVMs - for secure separation of services. +- ⚡ Proxmox - to run non-NixOS machines. +- 💭 Nix Topology - to visualize the network topology. +- 🔥 Sops-Nix - to securely store sensitive data. +- 🎁 NVF - for the declarative configuration neovim - 📁 Config file structure and modules with options. ## 📁 File structure diff --git a/assets/network/main.svg b/assets/network/main.svg index 9271109..71bbea2 100644 --- a/assets/network/main.svg +++ b/assets/network/main.svg @@ -1 +1 @@ -Networks OverviewHome maxmurCIDRv4192.168.1.0/24MGTS bridge networkCIDRv4192.168.0.0/24Timeweb privateCIDRv410.20.0.0/16Wireguard privateCIDRv410.200.100.0/24Services OverviewOllamanboxOllamapcboxAdGuard HomeraspNGINXraspGitlabservicesNGINXservicesNGINXsitehlboxenp0s31f6vmbr0enp0s31f6vmbr0192.168.1.10Internet*macboxMac Minieth0eth0192.168.1.75Main RouterKeenetic Gigaeth1192.168.1.1wan1192.168.0.2wifi192.168.1.1Bridge routerMGTS Innbox G84eth1192.168.0.1wan1nboxvboxnet0wlp3s0Ollamavboxnet0192.168.56.1wlp3s0192.168.1.111p8boxwlp3s0wlp3s0192.168.1.102pcboxeth0vboxnet0Ollamaeth0192.168.1.50vboxnet0192.168.56.1raspeth0wg0AdGuard Homedns192.168.1.8:53listen0.0.0.0:3000NGINXgitlab ssh0.0.0.0:4224https0.0.0.0:443syncthing web0.0.0.0:8384eth0192.168.1.8wg010.200.100.3servicesServices hostingeth0Gitlabssh0.0.0.0:4224NGINXhttp0.0.0.0:80https0.0.0.0:443eth010.20.0.5siteSite hostingeth0wg0NGINXhttp0.0.0.0:80https0.0.0.0:443eth010.20.0.4wg010.200.100.1Main SwitchTP-Link TL-SG1016Deth1eth2eth3eth4eth5Timeweb routerTimeweb internal routereth1wan1eth110.20.0.1wan1 \ No newline at end of file +Networks OverviewMicrovm hlbox natCIDRv410.0.0.0/24Home maxmurCIDRv4192.168.1.0/24MGTS bridge networkCIDRv4192.168.0.0/24NetBird privateCIDRv4100.92.0.0/16Services OverviewPostgresqldbvmAdGuard HomednsvmForgejohttps://git.maxmur.info https://git.maxmur.infogitvmNGINXhlboxProxmoxhlboxOllamanboxOllamapcboxNGINXraspVaultwardenhttps://vaultwarden.maxmur.info https://vaultwarden.maxmur.infovaultvmKeycloakvpntwvmNetBirdvpntwvmNGINXvpntwvmPostgresqlvpntwvmdbvmmicrovm, 4GB RAM10-ethvm3Postgresql10-eth02:00:00:00:00:0010.0.0.3 10.0.0.3vm302:00:00:00:00:00dnsvmmicrovm, 2GB RAM10-ethvm2AdGuard Homelisten0.0.0.0:3000 0.0.0.0:300010-eth02:02:00:00:00:0210.0.0.2 10.0.0.2vm202:02:00:00:00:02gitvmmicrovm, 4GB RAM10-ethvm4Forgejohttps://git.maxmur.info https://git.maxmur.infolisten0.0.0.0:3000 0.0.0.0:300010-eth02:00:00:02:00:0010.0.0.4 10.0.0.4vm402:00:00:02:00:00hlboxenp0s31f6vm1vm2vm3vm4vm5vmbr0dbvmmicrovmdnsvmmicrovmgitvmmicrovmvaultvmmicrovmNGINXdns.maxmur.infohttp://10.0.0.2:3000git.maxmur.infohttp://10.0.0.4:3000home.maxmur.infohttp://127.0.0.1:8082proxmox.maxmur.infohttps://192.168.1.10:8006uptime.maxmur.infohttp://127.0.0.1:64901vaultwarden.maxmur.infohttp://10.0.0.5:8001Proxmoxguestsenp0s31f6vm110.0.0.0 10.0.0.0vm210.0.0.0 10.0.0.0vm310.0.0.0 10.0.0.0vm410.0.0.0 10.0.0.0vm510.0.0.0 10.0.0.0vmbr0192.168.1.10Internet*macboxMac Minieth0eth0192.168.1.75Main RouterKeenetic Gigaeth1192.168.1.1wan1192.168.0.2wifi192.168.1.1Bridge routerMGTS Innbox G84eth1192.168.0.1wan1nboxvboxnet0wlp3s0Ollamavboxnet0192.168.56.1wlp3s0192.168.1.111p8boxwlp3s0wlp3s0192.168.1.102pcboxeth0vboxnet0Ollamaeth0192.168.1.50vboxnet0192.168.56.1raspeth0wt0NGINXeth0192.168.1.8wt0100.92.24.177Main SwitchTP-Link TL-SG1016Deth1eth2eth3eth4eth5vaultvmmicrovm, 4GB RAM10-ethvm5Vaultwardenhttps://vaultwarden.maxmur.info https://vaultwarden.maxmur.infolisten0.0.0.0:8001 0.0.0.0:800110-eth02:00:02:00:00:0010.0.0.5 10.0.0.5vm502:00:02:00:00:00vpntwvmens3wt0KeycloakNetBirdNGINXauth.ext.maxmur.infohttp://127.0.0.1:8000Postgresqlens337.252.22.10wt0100.92.0.1 \ No newline at end of file diff --git a/assets/network/network.svg b/assets/network/network.svg index ed83e06..8a5c04f 100644 --- a/assets/network/network.svg +++ b/assets/network/network.svg @@ -1 +1 @@ -Home maxmurCIDRv4192.168.1.0/24*MGTS bridge networkCIDRv4192.168.0.0/24*Timeweb privateCIDRv410.20.0.0/16*Wireguard privateCIDRv410.200.100.0/24*hlboxenp0s31f6vmbr0192.168.1.10Internet*macboxMac Minieth0192.168.1.75Main RouterKeenetic Gigaeth1192.168.1.1wan1192.168.0.2wifi192.168.1.1Bridge routerMGTS Innbox G84eth1192.168.0.1wan1nboxvboxnet0192.168.56.1wlp3s0192.168.1.111p8boxwlp3s0192.168.1.102pcboxeth0192.168.1.50vboxnet0192.168.56.1raspeth0192.168.1.8wg010.200.100.3servicesServices hostingeth010.20.0.5siteSite hostingeth010.20.0.4wg010.200.100.1Main SwitchTP-Link TL-SG1016Deth1eth2eth3eth4eth5Timeweb routerTimeweb internal routereth110.20.0.1wan1 \ No newline at end of file +Microvm hlbox natCIDRv410.0.0.0/24*Home maxmurCIDRv4192.168.1.0/24*MGTS bridge networkCIDRv4192.168.0.0/24*NetBird privateCIDRv4100.92.0.0/16*dbvmmicrovm, 4GB RAM10-eth02:00:00:00:00:0010.0.0.3 10.0.0.3vm302:00:00:00:00:00dnsvmmicrovm, 2GB RAM10-eth02:02:00:00:00:0210.0.0.2 10.0.0.2vm202:02:00:00:00:02gitvmmicrovm, 4GB RAM10-eth02:00:00:02:00:0010.0.0.4 10.0.0.4vm402:00:00:02:00:00hlboxenp0s31f6vm110.0.0.0 10.0.0.0vm210.0.0.0 10.0.0.0vm310.0.0.0 10.0.0.0vm410.0.0.0 10.0.0.0vm510.0.0.0 10.0.0.0vmbr0192.168.1.10Internet*macboxMac Minieth0192.168.1.75Main RouterKeenetic Gigaeth1192.168.1.1wan1192.168.0.2wifi192.168.1.1Bridge routerMGTS Innbox G84eth1192.168.0.1wan1nboxvboxnet0192.168.56.1wlp3s0192.168.1.111p8boxwlp3s0192.168.1.102pcboxeth0192.168.1.50vboxnet0192.168.56.1raspeth0192.168.1.8wt0100.92.24.177Main SwitchTP-Link TL-SG1016Deth1eth2eth3eth4eth5vaultvmmicrovm, 4GB RAM10-eth02:00:02:00:00:0010.0.0.5 10.0.0.5vm502:00:02:00:00:00vpntwvmens337.252.22.10wt0100.92.0.1 \ No newline at end of file diff --git a/flake.lock b/flake.lock index 149f787..9eb613b 100644 --- a/flake.lock +++ b/flake.lock @@ -144,10 +144,7 @@ }, "crane": { "inputs": { - "nixpkgs": [ - "lanzaboote", - "nixpkgs" - ] + "nixpkgs": "nixpkgs_5" }, "locked": { "lastModified": 1717535930, @@ -165,7 +162,7 @@ }, "crane_2": { "inputs": { - "nixpkgs": "nixpkgs_7" + "nixpkgs": "nixpkgs_8" }, "locked": { "lastModified": 1717383740, @@ -576,11 +573,11 @@ "systems": "systems_4" }, "locked": { - "lastModified": 1710146030, - "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=", + "lastModified": 1731533236, + "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", "owner": "numtide", "repo": "flake-utils", - "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a", + "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", "type": "github" }, "original": { @@ -593,6 +590,24 @@ "inputs": { "systems": "systems_5" }, + "locked": { + "lastModified": 1731533236, + "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "flake-utils", + "type": "github" + } + }, + "flake-utils_5": { + "inputs": { + "systems": "systems_6" + }, "locked": { "lastModified": 1726560853, "narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=", @@ -607,9 +622,9 @@ "type": "github" } }, - "flake-utils_5": { + "flake-utils_6": { "inputs": { - "systems": "systems_6" + "systems": "systems_7" }, "locked": { "lastModified": 1731533236, @@ -625,7 +640,7 @@ "type": "github" } }, - "flake-utils_6": { + "flake-utils_7": { "inputs": { "systems": [ "stylix", @@ -646,9 +661,9 @@ "type": "github" } }, - "flake-utils_7": { + "flake-utils_8": { "inputs": { - "systems": "systems_11" + "systems": "systems_12" }, "locked": { "lastModified": 1705309234, @@ -1032,7 +1047,7 @@ }, "hyprlang_2": { "inputs": { - "nixpkgs": "nixpkgs_11" + "nixpkgs": "nixpkgs_12" }, "locked": { "lastModified": 1704287638, @@ -1140,7 +1155,6 @@ "crane": "crane", "flake-compat": "flake-compat_3", "flake-parts": "flake-parts_2", - "flake-utils": "flake-utils_3", "nixpkgs": [ "nixpkgs" ], @@ -1148,16 +1162,16 @@ "rust-overlay": "rust-overlay" }, "locked": { - "lastModified": 1718178907, - "narHash": "sha256-eSZyrQ9uoPB9iPQ8Y5H7gAmAgAvCw3InStmU3oEjqsE=", + "lastModified": 1737639419, + "narHash": "sha256-AEEDktApTEZ5PZXNDkry2YV2k6t0dTgLPEmAZbnigXU=", "owner": "nix-community", "repo": "lanzaboote", - "rev": "b627ccd97d0159214cee5c7db1412b75e4be6086", + "rev": "a65905a09e2c43ff63be8c0e86a93712361f871e", "type": "github" }, "original": { "owner": "nix-community", - "ref": "v0.4.1", + "ref": "v0.4.2", "repo": "lanzaboote", "type": "github" } @@ -1178,6 +1192,28 @@ "type": "github" } }, + "microvm": { + "inputs": { + "flake-utils": "flake-utils_4", + "nixpkgs": [ + "nixpkgs" + ], + "spectrum": "spectrum" + }, + "locked": { + "lastModified": 1741275356, + "narHash": "sha256-VMeqnLv2O6Lg3/pka1tUzzbOjSmEb6RQOp9OuJRcx0A=", + "owner": "astro", + "repo": "microvm.nix", + "rev": "5e1b3dba5b52405dab79412392b9c799d49bd8c0", + "type": "github" + }, + "original": { + "owner": "astro", + "repo": "microvm.nix", + "type": "github" + } + }, "mnw": { "locked": { "lastModified": 1738852285, @@ -1266,8 +1302,8 @@ "nix-topology": { "inputs": { "devshell": "devshell", - "flake-utils": "flake-utils_4", - "nixpkgs": "nixpkgs_5", + "flake-utils": "flake-utils_5", + "nixpkgs": "nixpkgs_6", "pre-commit-hooks": "pre-commit-hooks" }, "locked": { @@ -1358,6 +1394,22 @@ } }, "nixpkgs_10": { + "locked": { + "lastModified": 1740367490, + "narHash": "sha256-WGaHVAjcrv+Cun7zPlI41SerRtfknGQap281+AakSAw=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "0196c0175e9191c474c26ab5548db27ef5d34b05", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs_11": { "locked": { "lastModified": 1735554305, "narHash": "sha256-zExSA1i/b+1NMRhGGLtNfFGXgLtgo+dcuzHzaWA6w3Q=", @@ -1373,7 +1425,7 @@ "type": "github" } }, - "nixpkgs_11": { + "nixpkgs_12": { "locked": { "lastModified": 1702645756, "narHash": "sha256-qKI6OR3TYJYQB3Q8mAZ+DG4o/BR9ptcv9UnRV2hzljc=", @@ -1389,7 +1441,7 @@ "type": "github" } }, - "nixpkgs_12": { + "nixpkgs_13": { "locked": { "lastModified": 1708093448, "narHash": "sha256-gohEm3/NVyu7WINFhRf83yJH8UM2ie/KY9Iw3VN6fiE=", @@ -1452,6 +1504,22 @@ } }, "nixpkgs_5": { + "locked": { + "lastModified": 1741865919, + "narHash": "sha256-4thdbnP6dlbdq+qZWTsm4ffAwoS8Tiq1YResB+RP6WE=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "573c650e8a14b2faa0041645ab18aed7e60f0c9a", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixpkgs-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs_6": { "locked": { "lastModified": 1730531603, "narHash": "sha256-Dqg6si5CqIzm87sp57j5nTaeBbWhHFaVyG7V6L8k3lY=", @@ -1467,7 +1535,7 @@ "type": "github" } }, - "nixpkgs_6": { + "nixpkgs_7": { "locked": { "lastModified": 1741246872, "narHash": "sha256-Q6pMP4a9ed636qilcYX8XUguvKl/0/LGXhHcRI91p0U=", @@ -1483,7 +1551,7 @@ "type": "github" } }, - "nixpkgs_7": { + "nixpkgs_8": { "locked": { "lastModified": 1714656196, "narHash": "sha256-kjQkA98lMcsom6Gbhw8SYzmwrSo+2nruiTcTZp5jK7o=", @@ -1499,7 +1567,7 @@ "type": "github" } }, - "nixpkgs_8": { + "nixpkgs_9": { "locked": { "lastModified": 1731763621, "narHash": "sha256-ddcX4lQL0X05AYkrkV2LMFgGdRvgap7Ho8kgon3iWZk=", @@ -1515,22 +1583,6 @@ "type": "github" } }, - "nixpkgs_9": { - "locked": { - "lastModified": 1740367490, - "narHash": "sha256-WGaHVAjcrv+Cun7zPlI41SerRtfknGQap281+AakSAw=", - "owner": "NixOS", - "repo": "nixpkgs", - "rev": "0196c0175e9191c474c26ab5548db27ef5d34b05", - "type": "github" - }, - "original": { - "owner": "NixOS", - "ref": "nixos-unstable", - "repo": "nixpkgs", - "type": "github" - } - }, "nmd": { "flake": false, "locked": { @@ -1550,7 +1602,7 @@ "nur": { "inputs": { "flake-parts": "flake-parts_3", - "nixpkgs": "nixpkgs_6", + "nixpkgs": "nixpkgs_7", "treefmt-nix": "treefmt-nix" }, "locked": { @@ -1593,14 +1645,14 @@ "nvf": { "inputs": { "flake-parts": "flake-parts_4", - "flake-utils": "flake-utils_5", + "flake-utils": "flake-utils_6", "mnw": "mnw", "nil": "nil", "nixpkgs": [ "nixpkgs" ], "nmd": "nmd", - "systems": "systems_7" + "systems": "systems_8" }, "locked": { "lastModified": 1741294413, @@ -1764,6 +1816,7 @@ "impermanence": "impermanence", "lanzaboote": "lanzaboote", "master": "master", + "microvm": "microvm", "nix-topology": "nix-topology", "nixpkgs": [ "unstable" @@ -1804,10 +1857,7 @@ }, "rust-overlay": { "inputs": { - "flake-utils": [ - "lanzaboote", - "flake-utils" - ], + "flake-utils": "flake-utils_3", "nixpkgs": [ "lanzaboote", "nixpkgs" @@ -1874,7 +1924,7 @@ }, "sops-nix": { "inputs": { - "nixpkgs": "nixpkgs_8" + "nixpkgs": "nixpkgs_9" }, "locked": { "lastModified": 1741043164, @@ -1890,18 +1940,34 @@ "type": "github" } }, + "spectrum": { + "flake": false, + "locked": { + "lastModified": 1733308308, + "narHash": "sha256-+RcbMAjSxV1wW5UpS9abIG1lFZC8bITPiFIKNnE7RLs=", + "ref": "refs/heads/main", + "rev": "80c9e9830d460c944c8f730065f18bb733bc7ee2", + "revCount": 792, + "type": "git", + "url": "https://spectrum-os.org/git/spectrum" + }, + "original": { + "type": "git", + "url": "https://spectrum-os.org/git/spectrum" + } + }, "stable": { "locked": { - "lastModified": 1735563628, - "narHash": "sha256-OnSAY7XDSx7CtDoqNh8jwVwh4xNL/2HaJxGjryLWzX8=", + "lastModified": 1741445498, + "narHash": "sha256-F5Em0iv/CxkN5mZ9hRn3vPknpoWdcdCyR0e4WklHwiE=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "b134951a4c9f3c995fd7be05f3243f8ecd65d798", + "rev": "52e3095f6d812b91b22fb7ad0bfc1ab416453634", "type": "github" }, "original": { "owner": "NixOS", - "ref": "nixos-24.05", + "ref": "nixos-24.11", "repo": "nixpkgs", "type": "github" } @@ -1914,13 +1980,13 @@ "base16-vim": "base16-vim", "firefox-gnome-theme": "firefox-gnome-theme", "flake-compat": "flake-compat_6", - "flake-utils": "flake-utils_6", + "flake-utils": "flake-utils_7", "git-hooks": "git-hooks", "gnome-shell": "gnome-shell", "home-manager": "home-manager_3", - "nixpkgs": "nixpkgs_9", + "nixpkgs": "nixpkgs_10", "nur": "nur_2", - "systems": "systems_9", + "systems": "systems_10", "tinted-foot": "tinted-foot", "tinted-kitty": "tinted-kitty", "tinted-schemes": "tinted-schemes", @@ -1957,6 +2023,21 @@ } }, "systems_10": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } + }, + "systems_11": { "locked": { "lastModified": 1689347949, "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=", @@ -1971,7 +2052,7 @@ "type": "github" } }, - "systems_11": { + "systems_12": { "locked": { "lastModified": 1681028828, "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", @@ -2233,7 +2314,7 @@ }, "treefmt-nix_3": { "inputs": { - "nixpkgs": "nixpkgs_10" + "nixpkgs": "nixpkgs_11" }, "locked": { "lastModified": 1739829690, @@ -2267,7 +2348,7 @@ }, "utils": { "inputs": { - "systems": "systems_8" + "systems": "systems_9" }, "locked": { "lastModified": 1710146030, @@ -2290,7 +2371,7 @@ "nixpkgs": [ "nixpkgs" ], - "systems": "systems_10" + "systems": "systems_11" }, "locked": { "lastModified": 1704466722, @@ -2339,8 +2420,8 @@ }, "yandex-music": { "inputs": { - "flake-utils": "flake-utils_7", - "nixpkgs": "nixpkgs_12", + "flake-utils": "flake-utils_8", + "nixpkgs": "nixpkgs_13", "ymExe": "ymExe" }, "locked": { diff --git a/flake.nix b/flake.nix index 5741e7e..d2083a1 100644 --- a/flake.nix +++ b/flake.nix @@ -13,7 +13,7 @@ # Latest stable stable = { - url = "github:NixOS/nixpkgs/nixos-24.05"; + url = "github:NixOS/nixpkgs/nixos-24.11"; }; # Current nixpkgs branch @@ -61,6 +61,11 @@ url = "github:nix-community/NUR"; }; + microvm = { + url = "github:astro/microvm.nix"; + inputs.nixpkgs.follows = "nixpkgs"; + }; + # MacOS configuration darwin = { url = "github:LnL7/nix-darwin/master"; @@ -114,7 +119,7 @@ }; lanzaboote = { - url = "github:nix-community/lanzaboote/v0.4.1"; + url = "github:nix-community/lanzaboote/v0.4.2"; inputs.nixpkgs.follows = "nixpkgs"; }; diff --git a/home/default.nix b/home/default.nix index cdc275d..8d0320d 100644 --- a/home/default.nix +++ b/home/default.nix @@ -32,8 +32,8 @@ userConfigurationPathExist = builtins.pathExists userConfigurationPath; userModulesPath = "${self}/home/users/${username}/modules"; userModulesPathExist = builtins.pathExists userModulesPath; - sshModulePath = "${self}/home/modules/ssh"; - sshModuleExistPath = builtins.pathExists sshModulePath; + # sshModulePath = "${self}/home/modules/ssh"; + # sshModuleExistPath = builtins.pathExists sshModulePath; in { home-manager = { useGlobalPkgs = true; @@ -72,7 +72,6 @@ in { "${self}/modules" "${self}/home/modules" ] - ++ optional sshModuleExistPath sshModulePath ++ optional userConfigurationPathExist userConfigurationPath ++ optional userModulesPathExist userModulesPath; diff --git a/home/modules/helix/default.nix b/home/modules/helix/default.nix index 066524f..4a7b258 100644 --- a/home/modules/helix/default.nix +++ b/home/modules/helix/default.nix @@ -26,6 +26,7 @@ in { programs.helix = { enable = true; + settings = { theme = "nord"; diff --git a/home/modules/hyprland/default.nix b/home/modules/hyprland/default.nix index 8d0235e..a765a4f 100644 --- a/home/modules/hyprland/default.nix +++ b/home/modules/hyprland/default.nix @@ -18,7 +18,6 @@ in { imports = [ "${self}/home/modules/hyprland/binds" - "${self}/home/modules/hyprland/monitors" ]; options = { @@ -28,7 +27,6 @@ in { config = mkIf cfg.enable { module.hyprland = { binds.enable = mkDefault cfg.enable; - monitors.enable = mkDefault cfg.enable; }; wayland.windowManager.hyprland = { diff --git a/home/modules/hyprland/monitors/default.nix b/home/modules/hyprland/monitors/default.nix deleted file mode 100644 index d9d1b68..0000000 --- a/home/modules/hyprland/monitors/default.nix +++ /dev/null @@ -1,64 +0,0 @@ -{ - config, - lib, - hostname, - ... -}: let - inherit (lib) mkEnableOption mkIf; - - cfg = config.module.hyprland.monitors; - - monitorsSettings = - if hostname == "pcbox" - then [ - "DP-1,1920x1080@144,0x0,1" - "DP-2,1920x1080@144,1920x0,1" - ] - else if hostname == "nbox" - then ["eDP-1,2880x1800@120,0x0,1.8"] - else []; - - workspacesSettings = - if hostname == "pcbox" - then [ - "1, monitor:DP-2, default:true" - "2, monitor:DP-2, default:true" - "3, monitor:DP-2, default:true" - "4, monitor:DP-2, default:true" - "5, monitor:DP-2, default:true" - "6, monitor:DP-2, default:true" - "7, monitor:DP-1, default:true" - "8, monitor:DP-1, default:true" - "9, monitor:DP-1, default:true" - "10, monitor:DP-1, default:true" - "11, monitor:DP-1, default:true" - "12, monitor:DP-1, default:true" - ] - else if hostname == "nbox" - then [ - "1, monitor:eDP-1, default:true" - "2, monitor:eDP-1, default:true" - "3, monitor:eDP-1, default:true" - "4, monitor:eDP-1, default:true" - "5, monitor:eDP-1, default:true" - "6, monitor:eDP-1, default:true" - # "7, monitor:eDP-1, default:true" - # "8, monitor:eDP-1, default:true" - # "9, monitor:eDP-1, default:true" - # "10, monitor:eDP-1, default:true" - # "11, monitor:eDP-1, default:true" - # "12, monitor:eDP-1, default:true" - ] - else []; -in { - options = { - module.hyprland.monitors.enable = mkEnableOption "Enables monitors in Hyprland"; - }; - - config = mkIf cfg.enable { - wayland.windowManager.hyprland.settings = { - monitor = monitorsSettings; - workspace = workspacesSettings; - }; - }; -} diff --git a/home/modules/librewolf/default.nix b/home/modules/librewolf/default.nix index 1d44cbd..c657edf 100644 --- a/home/modules/librewolf/default.nix +++ b/home/modules/librewolf/default.nix @@ -24,6 +24,7 @@ in { extensions.packages = with pkgs.nur.repos.rycee.firefox-addons; [ ublock-origin vimium + bitwarden ]; search = { @@ -54,13 +55,15 @@ in { foxyproxy-standard vimium wappalyzer + bitwarden ]; search = { force = true; - default = "Google"; + default = "Kagi"; order = [ + "Kagi" "Google" "DuckDuckGo" "4get" @@ -76,6 +79,22 @@ in { "Bing".metaData.hidden = true; "Amazon.com".metaData.hidden = true; + "Kagi" = { + updateInterval = 24 * 60 * 60 * 1000; + definedAliases = ["@kagi"]; + urls = [ + { + template = "https://kagi.com/search"; + params = [ + { + name = "q"; + value = "{searchTerms}"; + } + ]; + } + ]; + }; + "4get" = { updateInterval = 24 * 60 * 60 * 1000; definedAliases = ["@4get"]; @@ -257,6 +276,9 @@ in { "extensions.enabledScopes" = 15; "browser.bookmarks.addedImportButton" = false; "browser.toolbars.bookmarks.visibility" = "never"; + + "network.dns.echconfig.enabled" = false; + "network.dns.http3_echconfig.enabled" = false; }; }; }; diff --git a/home/modules/neovim/default.nix b/home/modules/neovim/default.nix index ddff96f..d4f3aa7 100644 --- a/home/modules/neovim/default.nix +++ b/home/modules/neovim/default.nix @@ -18,6 +18,7 @@ in { config = mkIf cfg.enable { programs.nvf = { enable = true; + defaultEditor = true; settings = { vim = { diff --git a/home/modules/sway/default.nix b/home/modules/sway/default.nix index 5666ed2..ddf7d62 100644 --- a/home/modules/sway/default.nix +++ b/home/modules/sway/default.nix @@ -11,7 +11,6 @@ in { imports = [ "${self}/home/modules/sway/keybinds" - "${self}/home/modules/sway/outputs" ]; options.module.sway = { @@ -21,7 +20,6 @@ in { config = mkIf cfg.enable { module.sway = { keybindings.enable = cfg.enable; - outputs.enable = cfg.enable; }; home.sessionVariables = { diff --git a/home/modules/sway/outputs/default.nix b/home/modules/sway/outputs/default.nix deleted file mode 100644 index b0d0009..0000000 --- a/home/modules/sway/outputs/default.nix +++ /dev/null @@ -1,161 +0,0 @@ -{ - config, - lib, - hostname, - ... -}: let - inherit (lib) mkEnableOption mkIf; - - cfg = config.module.sway.outputs; - - outputs = { - default = {}; - - pcbox = { - DP-1 = { - resolution = "1920x1080@144Hz"; - position = "0 0"; - }; - - DP-2 = { - resolution = "1920x1080@144Hz"; - position = "1920 0"; - }; - }; - - nbox = { - eDP-1 = { - resolution = "2880x1800@120Hz"; - position = "0 0"; - }; - }; - - p8box = { - DSI-1 = { - resolution = "800x1280@60Hz"; - position = "0 0"; - }; - }; - }; - - workspaces = { - default = []; - - pcbox = [ - { - workspace = "1"; - output = "DP-2"; - } - { - workspace = "2"; - output = "DP-2"; - } - { - workspace = "3"; - output = "DP-2"; - } - { - workspace = "4"; - output = "DP-2"; - } - { - workspace = "5"; - output = "DP-2"; - } - { - workspace = "6"; - output = "DP-2"; - } - { - workspace = "7"; - output = "DP-1"; - } - { - workspace = "8"; - output = "DP-1"; - } - { - workspace = "9"; - output = "DP-1"; - } - { - workspace = "10"; - output = "DP-1"; - } - { - workspace = "11"; - output = "DP-1"; - } - { - workspace = "12"; - output = "DP-1"; - } - ]; - - nbox = [ - { - workspace = "1"; - output = "eDP-1"; - } - { - workspace = "2"; - output = "eDP-1"; - } - { - workspace = "3"; - output = "eDP-1"; - } - { - workspace = "4"; - output = "eDP-1"; - } - { - workspace = "5"; - output = "eDP-1"; - } - { - workspace = "6"; - output = "eDP-1"; - } - ]; - - p8box = [ - { - workspace = "1"; - output = "eDP-1"; - } - { - workspace = "2"; - output = "eDP-1"; - } - { - workspace = "3"; - output = "eDP-1"; - } - { - workspace = "4"; - output = "eDP-1"; - } - { - workspace = "5"; - output = "eDP-1"; - } - { - workspace = "6"; - output = "eDP-1"; - } - ]; - }; -in { - options.module.sway.outputs = { - enable = mkEnableOption "Enable sway outputs"; - }; - - config = mkIf cfg.enable { - wayland.windowManager.sway.config = { - output = outputs.${hostname}; - - workspaceOutputAssign = workspaces.${hostname}; - }; - }; -} diff --git a/home/users/maxmur/default.nix b/home/users/maxmur/default.nix index 78de6ae..5671dfa 100644 --- a/home/users/maxmur/default.nix +++ b/home/users/maxmur/default.nix @@ -22,7 +22,6 @@ librewolf.enable = isLinux && isWorkstation; thunderbird.enable = isLinux && isWorkstation; foot.enable = isLinux && isWorkstation; - ssh.enable = isLinux && isWorkstation; hyprland.enable = hyprlandEnable && isLinux && isWorkstation; hyprlock.enable = hyprlandEnable && isLinux && isWorkstation; @@ -54,6 +53,7 @@ user = { impermanence.enable = isLinux && isWorkstation; + ssh.enable = isLinux && isWorkstation; xdg.enable = isLinux && isWorkstation; packages.enable = true; diff --git a/home/users/maxmur/modules/xdg/default.nix b/home/users/maxmur/modules/xdg/default.nix index a9ea591..a147be7 100644 --- a/home/users/maxmur/modules/xdg/default.nix +++ b/home/users/maxmur/modules/xdg/default.nix @@ -12,24 +12,46 @@ in { }; config = mkIf cfg.enable { - xdg.mimeApps = { - enable = true; + xdg = { + desktopEntries = { + browser = { + exec = "${config.module.defaults.browserCmd} %U"; + genericName = "Browser selector"; + name = "browser"; + type = "Application"; + terminal = false; + }; - defaultApplications = { - "text/markdown" = "nvim.desktop"; - "text/plain" = "nvim.desktop"; + editor = { + exec = "${config.module.defaults.editorCmd} %U"; + genericName = "Editor selector"; + name = "editor"; + type = "Application"; + terminal = true; + }; + }; + + mimeApps = { + enable = true; + + defaultApplications = { + "text/markdown" = "editor.desktop"; + "text/plain" = "editor.desktop"; + "text/x-python" = "editor.desktop"; - "text/html" = "librewolf.desktop"; - "x-scheme-handler/http" = "librewolf.desktop"; - "x-scheme-handler/https" = "librewolf.desktop"; - "x-scheme-handler/about" = "librewolf.desktop"; - "x-scheme-handler/unknown" = "librewolf.desktop"; + "text/html" = "browser.desktop"; + "x-scheme-handler/http" = "browser.desktop"; + "x-scheme-handler/https" = "browser.desktop"; + "x-scheme-handler/about" = "browser.desktop"; + "x-scheme-handler/unknown" = "browser.desktop"; - "image/png" = "org.gnome.eog.desktop"; - "image/jpeg" = "org.gnome.eog.desktop"; - "image/jpg" = "org.gnome.eog.desktop"; + "image/png" = "org.gnome.eog.desktop"; + "image/jpeg" = "org.gnome.eog.desktop"; + "image/jpg" = "org.gnome.eog.desktop"; + "image/svg" = "org.gnome.eog.desktop"; - "application/pdf" = "org.pwmt.zathura-pdf-mupdf.desktop"; + "application/pdf" = "org.pwmt.zathura-pdf-mupdf.desktop"; + }; }; }; }; diff --git a/hosts.nix b/hosts.nix index c7c8b99..b928b5c 100644 --- a/hosts.nix +++ b/hosts.nix @@ -29,7 +29,7 @@ hlbox = { username = "maxmur"; platform = "x86_64-linux"; - stateVersion = "25.05"; + stateVersion = "24.11"; isWorkstation = false; theme = "nord"; }; @@ -42,6 +42,46 @@ wm = "sway"; theme = "nord"; }; + + dnsvm = { + username = "maxmur"; + platform = "x86_64-linux"; + stateVersion = "24.11"; + isWorkstation = false; + theme = "nord"; + }; + + dbvm = { + username = "maxmur"; + platform = "x86_64-linux"; + stateVersion = "24.11"; + isWorkstation = false; + theme = "nord"; + }; + + gitvm = { + username = "maxmur"; + platform = "x86_64-linux"; + stateVersion = "24.11"; + isWorkstation = false; + theme = "nord"; + }; + + vaultvm = { + username = "maxmur"; + platform = "x86_64-linux"; + stateVersion = "24.11"; + isWorkstation = false; + theme = "nord"; + }; + + vpntwvm = { + username = "maxmur"; + platform = "x86_64-linux"; + stateVersion = "24.11"; + isWorkstation = false; + theme = "nord"; + }; }; darwin = { diff --git a/lib/default.nix b/lib/default.nix index 04e38df..39e11eb 100644 --- a/lib/default.nix +++ b/lib/default.nix @@ -30,8 +30,12 @@ swayEnable = wm == "sway"; hyprlandEnable = wm == "hyprland"; wmEnable = hyprlandEnable || swayEnable; + nixosSystem = + if stateVersion == defaultStateVersion + then inputs.stable.lib.nixosSystem + else inputs.nixpkgs.lib.nixosSystem; in - inputs.nixpkgs.lib.nixosSystem { + nixosSystem { specialArgs = { inherit inputs diff --git a/modules/defaults/applauncher/default.nix b/modules/defaults/applauncher/default.nix new file mode 100644 index 0000000..98a7b37 --- /dev/null +++ b/modules/defaults/applauncher/default.nix @@ -0,0 +1,37 @@ +{ + lib, + config, + pkgs, + ... +}: let + inherit (lib) mkOption; + inherit (lib.types) enum str; + + cfg = config.module.defaults; +in { + options.module.defaults = { + appLauncher = mkOption { + type = enum [ + "wofi" + "rofi" + "rofi-wayland" + "fuzzel" + ]; + + default = "rofi-wayland"; + }; + + appLauncherCmd = let + appLauncherExecs = { + rofi = "${pkgs.rofi}/bin/rofi -show drun"; + rofi-wayland = "${pkgs.rofi-wayland}/bin/rofi -show drun"; + wofi = "${pkgs.wofi}/wofi --show drun"; + fuzzel = "${pkgs.fuzzel}/fuzzel --show drun"; + }; + in + mkOption { + type = str; + default = appLauncherExecs.${cfg.appLauncher}; + }; + }; +} diff --git a/modules/defaults/audiocontrol/default.nix b/modules/defaults/audiocontrol/default.nix new file mode 100644 index 0000000..051c45b --- /dev/null +++ b/modules/defaults/audiocontrol/default.nix @@ -0,0 +1,15 @@ +{ + lib, + pkgs, + ... +}: let + inherit (lib) mkOption; + inherit (lib.types) str; +in { + options.module.defaults = { + audioControlCmd = mkOption { + type = str; + default = "${pkgs.pulseaudio}/bin/pactl"; + }; + }; +} diff --git a/modules/defaults/brightnesscontrol/default.nix b/modules/defaults/brightnesscontrol/default.nix new file mode 100644 index 0000000..ec557a1 --- /dev/null +++ b/modules/defaults/brightnesscontrol/default.nix @@ -0,0 +1,15 @@ +{ + lib, + pkgs, + ... +}: let + inherit (lib) mkOption; + inherit (lib.types) str; +in { + options.module.defaults = { + brightnessControlCmd = mkOption { + type = str; + default = "${pkgs.brightnessctl}/bin/brightnessctl"; + }; + }; +} diff --git a/modules/defaults/browsers/default.nix b/modules/defaults/browsers/default.nix new file mode 100644 index 0000000..bf3d6bd --- /dev/null +++ b/modules/defaults/browsers/default.nix @@ -0,0 +1,35 @@ +{ + lib, + config, + pkgs, + ... +}: let + inherit (lib) mkOption; + inherit (lib.types) enum str; + + cfg = config.module.defaults; +in { + options.module.defaults = { + browser = mkOption { + type = enum [ + "librewolf" + "firefox" + "chromium" + ]; + + default = "librewolf"; + }; + + browserCmd = let + browserExecs = { + librewolf = "${pkgs.librewolf}/bin/librewolf"; + firefox = "${pkgs.firefox}/bin/firefox"; + chromium = "${pkgs.ungoogled-chromium}/bin/chromium"; + }; + in + mkOption { + type = str; + default = browserExecs.${cfg.browser}; + }; + }; +} diff --git a/modules/defaults/cliphist/default.nix b/modules/defaults/cliphist/default.nix new file mode 100644 index 0000000..985cacb --- /dev/null +++ b/modules/defaults/cliphist/default.nix @@ -0,0 +1,29 @@ +{ + lib, + config, + pkgs, + ... +}: let + inherit (lib) mkOption; + inherit (lib.types) str; + + cfg = config.module.defaults; +in { + options.module.defaults = { + clipHistCmd = let + cliphistBase = "${pkgs.cliphist}/bin/cliphist"; + createExec = launcher: "${cliphistBase} list | ${launcher} | ${cliphistBase} decode | ${pkgs.wl-clipboard}/bin/wl-copy"; + + cliphistExecs = { + rofi = createExec "${pkgs.rofi}/bin/rofi -dmenu"; + rofi-wayland = createExec "${pkgs.rofi-wayland}/bin/rofi -dmenu"; + wofi = createExec "${pkgs.wofi}/bin/wofi --show dmenu"; + fuzzel = createExec "${pkgs.fuzzel}/bin/fuzzel -d"; + }; + in + mkOption { + type = str; + default = cliphistExecs.${cfg.appLauncher}; + }; + }; +} diff --git a/modules/defaults/default.nix b/modules/defaults/default.nix index 104a55d..0ebf2fd 100644 --- a/modules/defaults/default.nix +++ b/modules/defaults/default.nix @@ -1,148 +1,7 @@ { - lib, - config, - pkgs, + self, + allDirs, ... -}: let - inherit (lib) mkOption; - inherit (lib.types) enum str listOf; - - cfg = config.module.defaults; -in { - options.module.defaults = { - # Defaults - terminal = mkOption { - type = enum [ - "foot" - "foot-client" - "alacritty" - ]; - - default = "foot"; - }; - - appLauncher = mkOption { - type = enum [ - "wofi" - "rofi" - "rofi-wayland" - "fuzzel" - ]; - - default = "rofi-wayland"; - }; - - browser = mkOption { - type = enum [ - "librewolf" - "firefox" - "chromium" - ]; - - default = "librewolf"; - }; - - # Defaults cmds - terminalCmd = let - terminalExecs = { - foot = "${pkgs.foot}/bin/foot"; - foot-client = "${pkgs.foot}/bin/footclient"; - alacritty = "${pkgs.alacritty}/bin/alacritty"; - }; - in - mkOption { - type = str; - default = terminalExecs.${cfg.terminal}; - }; - - browserCmd = let - browserExecs = { - librewolf = "${pkgs.librewolf}/bin/librewolf"; - firefox = "${pkgs.firefox}/bin/firefox"; - chromium = "${pkgs.ungoogled-chromium}/bin/chromium"; - }; - in - mkOption { - type = str; - default = browserExecs.${cfg.browser}; - }; - - appLauncherCmd = let - appLauncherExecs = { - rofi = "${pkgs.rofi}/bin/rofi -show drun"; - rofi-wayland = "${pkgs.rofi-wayland}/bin/rofi -show drun"; - wofi = "${pkgs.wofi}/wofi --show drun"; - fuzzel = "${pkgs.fuzzel}/fuzzel --show drun"; - }; - in - mkOption { - type = str; - default = appLauncherExecs.${cfg.appLauncher}; - }; - - audioControlCmd = mkOption { - type = str; - default = "${pkgs.pulseaudio}/bin/pactl"; - }; - - brightnessControlCmd = mkOption { - type = str; - default = "${pkgs.brightnessctl}/bin/brightnessctl"; - }; - - clipHistCmd = let - cliphistBase = "${pkgs.cliphist}/bin/cliphist"; - createExec = launcher: "${cliphistBase} list | ${launcher} | ${cliphistBase} decode | ${pkgs.wl-clipboard}/bin/wl-copy"; - - cliphistExecs = { - rofi = createExec "${pkgs.rofi}/bin/rofi -dmenu"; - rofi-wayland = createExec "${pkgs.rofi-wayland}/bin/rofi -dmenu"; - wofi = createExec "${pkgs.wofi}/bin/wofi --show dmenu"; - fuzzel = createExec "${pkgs.fuzzel}/bin/fuzzel -d"; - }; - in - mkOption { - type = str; - default = cliphistExecs.${cfg.appLauncher}; - }; - - notificationsAppCmd = mkOption { - type = str; - default = "${pkgs.swaynotificationcenter}/bin/swaync-client -t -sw"; - }; - - ssh = { - pubKeys = mkOption { - type = listOf str; - default = []; - }; - }; - - network = { - iface = mkOption { - type = str; - default = ""; - }; - - ip = mkOption { - type = str; - default = ""; - }; - - gw = mkOption { - type = str; - default = ""; - }; - - mask = mkOption { - type = str; - default = ""; - }; - - cidr = mkOption { - type = str; - default = ""; - }; - }; - }; +}: { + imports = allDirs "${self}/modules/defaults"; } diff --git a/modules/defaults/editor/default.nix b/modules/defaults/editor/default.nix new file mode 100644 index 0000000..2c9caf6 --- /dev/null +++ b/modules/defaults/editor/default.nix @@ -0,0 +1,33 @@ +{ + lib, + config, + pkgs, + ... +}: let + inherit (lib) mkOption; + inherit (lib.types) enum str; + + cfg = config.module.defaults; +in { + options.module.defaults = { + editor = mkOption { + type = enum [ + "helix" + "neovim" + ]; + + default = "neovim"; + }; + + editorCmd = let + editorExecs = { + helix = "${pkgs.helix}/bin/helix"; + neovim = "${pkgs.neovim-unwrapped}/bin/neovim"; + }; + in + mkOption { + type = str; + default = editorExecs.${cfg.editor}; + }; + }; +} diff --git a/modules/defaults/network/default.nix b/modules/defaults/network/default.nix new file mode 100644 index 0000000..83f1a02 --- /dev/null +++ b/modules/defaults/network/default.nix @@ -0,0 +1,38 @@ +{lib, ...}: let + inherit (lib) mkOption; + inherit (lib.types) str; +in { + options.module.defaults = { + network = { + iface = mkOption { + type = str; + default = ""; + }; + + ip = mkOption { + type = str; + default = ""; + }; + + gw = mkOption { + type = str; + default = ""; + }; + + mask = mkOption { + type = str; + default = ""; + }; + + cidr = mkOption { + type = str; + default = ""; + }; + + mac = mkOption { + type = str; + default = ""; + }; + }; + }; +} diff --git a/modules/defaults/notificationsapp/default.nix b/modules/defaults/notificationsapp/default.nix new file mode 100644 index 0000000..ce3b334 --- /dev/null +++ b/modules/defaults/notificationsapp/default.nix @@ -0,0 +1,15 @@ +{ + lib, + pkgs, + ... +}: let + inherit (lib) mkOption; + inherit (lib.types) str; +in { + options.module.defaults = { + notificationsAppCmd = mkOption { + type = str; + default = "${pkgs.swaynotificationcenter}/bin/swaync-client -t -sw"; + }; + }; +} diff --git a/modules/defaults/ssh/default.nix b/modules/defaults/ssh/default.nix new file mode 100644 index 0000000..f2e2617 --- /dev/null +++ b/modules/defaults/ssh/default.nix @@ -0,0 +1,13 @@ +{lib, ...}: let + inherit (lib) mkOption; + inherit (lib.types) str listOf; +in { + options.module.defaults = { + ssh = { + pubKeys = mkOption { + type = listOf str; + default = []; + }; + }; + }; +} diff --git a/modules/defaults/terminal/default.nix b/modules/defaults/terminal/default.nix new file mode 100644 index 0000000..623f38e --- /dev/null +++ b/modules/defaults/terminal/default.nix @@ -0,0 +1,37 @@ +{ + lib, + config, + pkgs, + ... +}: let + inherit (lib) mkOption; + inherit (lib.types) enum str; + + cfg = config.module.defaults; +in { + options.module.defaults = { + # Defaults + terminal = mkOption { + type = enum [ + "foot" + "footclient" + "alacritty" + ]; + + default = "foot"; + }; + + # Defaults cmds + terminalCmd = let + terminalExecs = { + foot = "${pkgs.foot}/bin/foot"; + footclient = "${pkgs.foot}/bin/footclient"; + alacritty = "${pkgs.alacritty}/bin/alacritty"; + }; + in + mkOption { + type = str; + default = terminalExecs.${cfg.terminal}; + }; + }; +} diff --git a/modules/stylix/default.nix b/modules/stylix/default.nix index fd90c1b..6fa045c 100644 --- a/modules/stylix/default.nix +++ b/modules/stylix/default.nix @@ -5,6 +5,7 @@ config, hostname, theme, + stateVersion, ... }: let inherit (lib) mkEnableOption mkOption mkIf; @@ -18,13 +19,22 @@ then 24 else 14; + iosevkaPackage = + if stateVersion == "24.11" + then pkgs.nerdfonts.override {fonts = ["Iosevka"];} + else pkgs.nerd-fonts.iosevka; + jbPackage = + if stateVersion == "24.11" + then pkgs.nerdfonts.override {fonts = ["JetBrainsMono"];} + else pkgs.nerd-fonts.iosevka; + themes = { nord = { scheme = "${pkgs.base16-schemes}/share/themes/nord.yaml"; wallpaper = "${self}/assets/grey_gradient.png"; font = { - package = pkgs.nerd-fonts.iosevka; + package = iosevkaPackage; name = "Iosevka Nerd Font Mono"; }; @@ -39,7 +49,7 @@ wallpaper = "${self}/assets/grey_gradient.png"; font = { - package = pkgs.nerd-fonts.jetbrains-mono; + package = jbPackage; name = "JetBrains Mono Nerd Font"; }; diff --git a/parts/topology/default.nix b/parts/topology/default.nix index 2b54163..ad8099d 100644 --- a/parts/topology/default.nix +++ b/parts/topology/default.nix @@ -25,7 +25,7 @@ nodes.internet = mkInternet { connections = [ (mkConnection "mgts-bridge-router" "wan1") - (mkConnection "timeweb-router" "wan1") + (mkConnection "vpntwvm" "ens3") ]; }; } diff --git a/parts/topology/home/default.nix b/parts/topology/home/default.nix index dbd672e..3e609ab 100644 --- a/parts/topology/home/default.nix +++ b/parts/topology/home/default.nix @@ -24,6 +24,11 @@ name = "Home maxmur"; cidrv4 = "192.168.1.0/24"; }; + + hlbox-nat = { + name = "Microvm hlbox nat"; + cidrv4 = "10.0.0.0/24"; + }; }; nodes = { diff --git a/parts/topology/images/services/keycloak.png b/parts/topology/images/services/keycloak.png new file mode 100644 index 0000000..3cd8a93 Binary files /dev/null and b/parts/topology/images/services/keycloak.png differ diff --git a/parts/topology/images/services/netbird.png b/parts/topology/images/services/netbird.png new file mode 100644 index 0000000..9bebe95 Binary files /dev/null and b/parts/topology/images/services/netbird.png differ diff --git a/parts/topology/images/services/proxmox.jpg b/parts/topology/images/services/proxmox.jpg new file mode 100644 index 0000000..d2be9e8 Binary files /dev/null and b/parts/topology/images/services/proxmox.jpg differ diff --git a/parts/topology/images/services/psql.png b/parts/topology/images/services/psql.png new file mode 100644 index 0000000..b5b7b51 Binary files /dev/null and b/parts/topology/images/services/psql.png differ diff --git a/parts/topology/timeweb/default.nix b/parts/topology/timeweb/default.nix index 2bb0565..eed3478 100644 --- a/parts/topology/timeweb/default.nix +++ b/parts/topology/timeweb/default.nix @@ -3,132 +3,13 @@ # For nix topology topology.modules = [ ( - {config, ...}: let - inherit - (config.lib.topology) - mkRouter - mkDevice - mkConnection - ; - in { + _: { inherit (self) nixosConfigurations; networks = { - timeweb-private = { - name = "Timeweb private"; - cidrv4 = "10.20.0.0/16"; - }; - - wireguard-private = { - name = "Wireguard private"; - cidrv4 = "10.200.100.0/24"; - }; - }; - - nodes = { - timeweb-router = mkRouter "Timeweb router" { - info = "Timeweb internal router"; - interfaceGroups = [ - ["eth1"] - ["wan1"] - ]; - - interfaces = { - eth1 = { - addresses = ["10.20.0.1"]; - network = "timeweb-private"; - }; - }; - - connections = { - eth1 = [ - (mkConnection "site" "eth0") - (mkConnection "services" "eth0") - ]; - }; - }; - - site = mkDevice "site" { - deviceType = "device"; - hardware.info = "Site hosting"; - deviceIcon = ../images/timeweb.png; - - interfaces = { - eth0 = { - addresses = ["10.20.0.4"]; - network = "timeweb-private"; - }; - - wg0 = { - addresses = ["10.200.100.1"]; - network = "wireguard-private"; - renderer.hidePhysicalConnections = false; - virtual = true; - type = "wireguard"; - }; - }; - - interfaceGroups = [ - ["eth0"] - ["wg0"] - ]; - - services = { - nginx = { - name = "NGINX"; - icon = "services.nginx"; - details = { - "http" = { - text = "0.0.0.0:80"; - }; - "https" = { - text = "0.0.0.0:443"; - }; - }; - }; - }; - }; - - services = mkDevice "services" { - deviceType = "device"; - hardware.info = "Services hosting"; - deviceIcon = ../images/timeweb.png; - - interfaces = { - eth0 = { - addresses = ["10.20.0.5"]; - network = "timeweb-private"; - }; - }; - - interfaceGroups = [ - ["eth0"] - ]; - - services = { - nginx = { - name = "NGINX"; - icon = "services.nginx"; - details = { - "http" = { - text = "0.0.0.0:80"; - }; - "https" = { - text = "0.0.0.0:443"; - }; - }; - }; - - gitlab = { - name = "Gitlab"; - icon = ../images/services/gitlab.png; - details = { - "ssh" = { - text = "0.0.0.0:4224"; - }; - }; - }; - }; + netbird-private = { + name = "NetBird private"; + cidrv4 = "100.92.0.0/16"; }; }; } diff --git a/system/machine/dbvm/default.nix b/system/machine/dbvm/default.nix new file mode 100644 index 0000000..0665ee5 --- /dev/null +++ b/system/machine/dbvm/default.nix @@ -0,0 +1,61 @@ +{config, ...}: { + module = { + locales.enable = true; + security.enable = true; + timedate.enable = true; + stylix.enable = true; + users.enable = true; + minimal.enable = true; + + programs = { + hm.enable = true; + zsh.enable = true; + fish.enable = true; + systemPackages.enable = true; + }; + + defaults = { + network = { + iface = "vm3"; + ip = "10.0.0.3"; + gw = "10.0.0.0"; + mask = "255.255.255.0"; + cidr = "24"; + mac = "02:00:00:00:00:00"; + }; + + ssh.pubKeys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINWJULtMSQfTZqoXwfK32T+V+NZMqM+1rKhURlee8yS+ maxmur" + ]; + }; + + services = { + fail2ban.enable = true; + + postgresql = { + enable = true; + dataDir = "/var/lib/postgresql/17"; + authentication = "host all all 0.0.0.0/0 scram-sha-256"; + enableTCPIP = true; + + configurations = [ + "forgejo" + "vaultwarden" + "paperless" + "woodpecker" + "grafana" + ]; + }; + + ssh = { + enable = true; + listenAddresses = [ + { + addr = config.module.defaults.network.ip; + port = 34861; + } + ]; + }; + }; + }; +} diff --git a/system/machine/dbvm/modules/default.nix b/system/machine/dbvm/modules/default.nix new file mode 100644 index 0000000..8bcb676 --- /dev/null +++ b/system/machine/dbvm/modules/default.nix @@ -0,0 +1,10 @@ +{ + self, + machineDir, + allDirs, + ... +}: let + modules = "${self}/system/machine/${machineDir}/modules"; +in { + imports = allDirs modules; +} diff --git a/system/machine/dbvm/modules/hardware/default.nix b/system/machine/dbvm/modules/hardware/default.nix new file mode 100644 index 0000000..733fcad --- /dev/null +++ b/system/machine/dbvm/modules/hardware/default.nix @@ -0,0 +1,10 @@ +{ + self, + machineDir, + allDirs, + ... +}: let + machineHardwareModulesPath = "${self}/system/machine/${machineDir}/modules/hardware"; +in { + imports = allDirs machineHardwareModulesPath; +} diff --git a/system/machine/dbvm/modules/hardware/network/default.nix b/system/machine/dbvm/modules/hardware/network/default.nix new file mode 100644 index 0000000..efac4a4 --- /dev/null +++ b/system/machine/dbvm/modules/hardware/network/default.nix @@ -0,0 +1,58 @@ +{ + config, + username, + self, + ... +}: { + users.users.${username}.openssh.authorizedKeys.keys = config.module.defaults.ssh.pubKeys; + + networking = { + hostName = "dbvm"; + + firewall = { + allowedTCPPorts = [ + 5432 + 34861 + ]; + }; + }; + + systemd.network = { + enable = true; + + networks."10-eth" = { + matchConfig.MACAddress = config.module.defaults.network.mac; + + address = [ + "${config.module.defaults.network.ip}/32" + ]; + + routes = [ + { + Destination = "10.0.0.0/32"; + GatewayOnLink = true; + } + { + Destination = "0.0.0.0/0"; + Gateway = "10.0.0.0"; + GatewayOnLink = true; + } + ]; + + networkConfig = { + DNS = [ + "10.0.0.2" + ]; + }; + }; + }; + + topology.self = { + services = { + psql = { + name = "Postgresql"; + icon = "${self}/parts/topology/images/services/psql.png"; + }; + }; + }; +} diff --git a/system/machine/dbvm/modules/microvm/default.nix b/system/machine/dbvm/modules/microvm/default.nix new file mode 100644 index 0000000..ef0a8b5 --- /dev/null +++ b/system/machine/dbvm/modules/microvm/default.nix @@ -0,0 +1,42 @@ +{ + inputs, + config, + ... +}: { + imports = [ + inputs.microvm.nixosModules.microvm + ]; + + microvm = { + mem = 4 * 1024; + vcpu = 2; + storeDiskType = "squashfs"; + + hypervisor = "cloud-hypervisor"; + + interfaces = [ + { + id = config.module.defaults.network.iface; + type = "tap"; + inherit (config.module.defaults.network) mac; + } + ]; + + volumes = [ + { + mountPoint = "/var/lib"; + image = "db.img"; + size = 100 * 1024; + } + ]; + + shares = [ + { + proto = "virtiofs"; + tag = "ro-store"; + source = "/nix/store"; + mountPoint = "/nix/.ro-store"; + } + ]; + }; +} diff --git a/system/machine/dnsvm/default.nix b/system/machine/dnsvm/default.nix new file mode 100644 index 0000000..ef7f812 --- /dev/null +++ b/system/machine/dnsvm/default.nix @@ -0,0 +1,99 @@ +{config, ...}: { + module = { + locales.enable = true; + security.enable = true; + timedate.enable = true; + stylix.enable = true; + users.enable = true; + minimal.enable = true; + + programs = { + hm.enable = true; + zsh.enable = true; + fish.enable = true; + systemPackages.enable = true; + }; + + defaults = { + network = { + iface = "vm2"; + ip = "10.0.0.2"; + gw = "10.0.0.0"; + mask = "255.255.255.0"; + cidr = "24"; + mac = "02:02:00:00:00:02"; + }; + + ssh.pubKeys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINWJULtMSQfTZqoXwfK32T+V+NZMqM+1rKhURlee8yS+ maxmur" + ]; + }; + + services = { + fail2ban.enable = true; + + adguard-home = { + enable = true; + httpAddress = config.module.defaults.network.ip; + httpPort = 3000; + + bindHosts = [ + config.module.defaults.network.ip + "127.0.0.1" + ]; + + users = [ + { + name = "maxmur"; + password._secret = "/run/secrets/dnsvm/adguardhome/users/maxmur/password"; + } + ]; + + dnsRewrites = [ + { + domain = "gitlab.maxmur.info"; + answer = "192.168.1.8"; + } + { + domain = "dns.maxmur.info"; + answer = "192.168.1.10"; + } + { + domain = "git.maxmur.info"; + answer = "192.168.1.10"; + } + { + domain = "vaultwarden.maxmur.info"; + answer = "192.168.1.10"; + } + { + domain = "proxmox.maxmur.info"; + answer = "192.168.1.10"; + } + { + domain = "paper.maxmur.info"; + answer = "192.168.1.10"; + } + { + domain = "home.maxmur.info"; + answer = "192.168.1.10"; + } + { + domain = "uptime.maxmur.info"; + answer = "192.168.1.10"; + } + ]; + }; + + ssh = { + enable = true; + listenAddresses = [ + { + addr = config.module.defaults.network.ip; + port = 34861; + } + ]; + }; + }; + }; +} diff --git a/system/machine/dnsvm/modules/default.nix b/system/machine/dnsvm/modules/default.nix new file mode 100644 index 0000000..8bcb676 --- /dev/null +++ b/system/machine/dnsvm/modules/default.nix @@ -0,0 +1,10 @@ +{ + self, + machineDir, + allDirs, + ... +}: let + modules = "${self}/system/machine/${machineDir}/modules"; +in { + imports = allDirs modules; +} diff --git a/system/machine/dnsvm/modules/hardware/default.nix b/system/machine/dnsvm/modules/hardware/default.nix new file mode 100644 index 0000000..733fcad --- /dev/null +++ b/system/machine/dnsvm/modules/hardware/default.nix @@ -0,0 +1,10 @@ +{ + self, + machineDir, + allDirs, + ... +}: let + machineHardwareModulesPath = "${self}/system/machine/${machineDir}/modules/hardware"; +in { + imports = allDirs machineHardwareModulesPath; +} diff --git a/system/machine/dnsvm/modules/hardware/network/default.nix b/system/machine/dnsvm/modules/hardware/network/default.nix new file mode 100644 index 0000000..00cc746 --- /dev/null +++ b/system/machine/dnsvm/modules/hardware/network/default.nix @@ -0,0 +1,53 @@ +{ + config, + username, + ... +}: { + users.users.${username}.openssh.authorizedKeys.keys = config.module.defaults.ssh.pubKeys; + + networking = { + hostName = "dnsvm"; + + firewall = { + allowedTCPPorts = [ + 53 + 3000 + 34861 + ]; + + allowedUDPPorts = [ + 53 + ]; + }; + }; + + systemd.network = { + enable = true; + + networks."10-eth" = { + matchConfig.MACAddress = config.module.defaults.network.mac; + + address = [ + "${config.module.defaults.network.ip}/32" + ]; + + routes = [ + { + Destination = "10.0.0.0/32"; + GatewayOnLink = true; + } + { + Destination = "0.0.0.0/0"; + Gateway = "10.0.0.0"; + GatewayOnLink = true; + } + ]; + + networkConfig = { + DNS = [ + "127.0.0.1" + ]; + }; + }; + }; +} diff --git a/system/machine/dnsvm/modules/microvm/default.nix b/system/machine/dnsvm/modules/microvm/default.nix new file mode 100644 index 0000000..068f5fd --- /dev/null +++ b/system/machine/dnsvm/modules/microvm/default.nix @@ -0,0 +1,48 @@ +{ + inputs, + config, + ... +}: { + imports = [ + inputs.microvm.nixosModules.microvm + ]; + + microvm = { + mem = 2 * 1024; + vcpu = 2; + storeDiskType = "squashfs"; + + hypervisor = "cloud-hypervisor"; + + interfaces = [ + { + id = config.module.defaults.network.iface; + type = "tap"; + inherit (config.module.defaults.network) mac; + } + ]; + + volumes = [ + { + mountPoint = "/"; + image = "root.img"; + size = 45 * 1024; + } + ]; + + shares = [ + { + proto = "virtiofs"; + tag = "ro-store"; + source = "/nix/store"; + mountPoint = "/nix/.ro-store"; + } + { + proto = "virtiofs"; + tag = "secrets"; + source = "/run/secrets/dnsvm"; + mountPoint = "/run/secrets/dnsvm"; + } + ]; + }; +} diff --git a/system/machine/gitvm/default.nix b/system/machine/gitvm/default.nix new file mode 100644 index 0000000..96c1e90 --- /dev/null +++ b/system/machine/gitvm/default.nix @@ -0,0 +1,62 @@ +{config, ...}: { + module = { + locales.enable = true; + security.enable = true; + timedate.enable = true; + stylix.enable = true; + users.enable = true; + minimal.enable = true; + + programs = { + hm.enable = true; + zsh.enable = true; + fish.enable = true; + systemPackages.enable = true; + }; + + defaults = { + network = { + iface = "vm4"; + ip = "10.0.0.4"; + gw = "10.0.0.0"; + mask = "255.255.255.0"; + cidr = "24"; + mac = "02:00:00:02:00:00"; + }; + + ssh.pubKeys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINWJULtMSQfTZqoXwfK32T+V+NZMqM+1rKhURlee8yS+ maxmur" + ]; + }; + + services = { + fail2ban.enable = true; + + forgejo = { + enable = true; + domain = "git.maxmur.info"; + httpAddr = "0.0.0.0"; + sshPort = 4224; + + database = { + createDatabase = true; + name = "forgejo"; + type = "postgres"; + user = "forgejo"; + host = "10.0.0.3"; + passwordFile = "/run/secrets/db/forgejo/user"; + }; + }; + + ssh = { + enable = true; + listenAddresses = [ + { + addr = config.module.defaults.network.ip; + port = 34861; + } + ]; + }; + }; + }; +} diff --git a/system/machine/gitvm/modules/default.nix b/system/machine/gitvm/modules/default.nix new file mode 100644 index 0000000..8bcb676 --- /dev/null +++ b/system/machine/gitvm/modules/default.nix @@ -0,0 +1,10 @@ +{ + self, + machineDir, + allDirs, + ... +}: let + modules = "${self}/system/machine/${machineDir}/modules"; +in { + imports = allDirs modules; +} diff --git a/system/machine/gitvm/modules/hardware/default.nix b/system/machine/gitvm/modules/hardware/default.nix new file mode 100644 index 0000000..733fcad --- /dev/null +++ b/system/machine/gitvm/modules/hardware/default.nix @@ -0,0 +1,10 @@ +{ + self, + machineDir, + allDirs, + ... +}: let + machineHardwareModulesPath = "${self}/system/machine/${machineDir}/modules/hardware"; +in { + imports = allDirs machineHardwareModulesPath; +} diff --git a/system/machine/gitvm/modules/hardware/network/default.nix b/system/machine/gitvm/modules/hardware/network/default.nix new file mode 100644 index 0000000..e694fb3 --- /dev/null +++ b/system/machine/gitvm/modules/hardware/network/default.nix @@ -0,0 +1,49 @@ +{ + config, + username, + ... +}: { + users.users.${username}.openssh.authorizedKeys.keys = config.module.defaults.ssh.pubKeys; + + networking = { + hostName = "gitvm"; + + firewall = { + allowedTCPPorts = [ + 3000 + 4224 + 34861 + ]; + }; + }; + + systemd.network = { + enable = true; + + networks."10-eth" = { + matchConfig.MACAddress = config.module.defaults.network.mac; + + address = [ + "${config.module.defaults.network.ip}/32" + ]; + + routes = [ + { + Destination = "10.0.0.0/32"; + GatewayOnLink = true; + } + { + Destination = "0.0.0.0/0"; + Gateway = "10.0.0.0"; + GatewayOnLink = true; + } + ]; + + networkConfig = { + DNS = [ + "10.0.0.2" + ]; + }; + }; + }; +} diff --git a/system/machine/gitvm/modules/microvm/default.nix b/system/machine/gitvm/modules/microvm/default.nix new file mode 100644 index 0000000..cb422ce --- /dev/null +++ b/system/machine/gitvm/modules/microvm/default.nix @@ -0,0 +1,48 @@ +{ + inputs, + config, + ... +}: { + imports = [ + inputs.microvm.nixosModules.microvm + ]; + + microvm = { + mem = 4 * 1024; + vcpu = 2; + storeDiskType = "squashfs"; + + hypervisor = "cloud-hypervisor"; + + interfaces = [ + { + id = config.module.defaults.network.iface; + type = "tap"; + inherit (config.module.defaults.network) mac; + } + ]; + + volumes = [ + { + mountPoint = "/var/lib"; + image = "db.img"; + size = 50 * 1024; + } + ]; + + shares = [ + { + proto = "virtiofs"; + tag = "ro-store"; + source = "/nix/store"; + mountPoint = "/nix/.ro-store"; + } + { + proto = "virtiofs"; + tag = "secrets"; + source = "/run/secrets/db/forgejo"; + mountPoint = "/run/secrets/db/forgejo"; + } + ]; + }; +} diff --git a/system/machine/hlbox/default.nix b/system/machine/hlbox/default.nix index 9347402..59f015a 100644 --- a/system/machine/hlbox/default.nix +++ b/system/machine/hlbox/default.nix @@ -8,7 +8,6 @@ variables.enable = true; stylix.enable = true; nixos-ng.enable = true; - plymouth.enable = true; minimal.enable = true; programs = { @@ -38,7 +37,11 @@ }; services = { + fail2ban.enable = true; irqbalance.enable = true; + netbird.enable = true; + homepage-dashboard.enable = true; + uptime-kuma.enable = true; proxmox-ve = { enable = true; diff --git a/system/machine/hlbox/modules/acme/default.nix b/system/machine/hlbox/modules/acme/default.nix new file mode 100644 index 0000000..9fba69a --- /dev/null +++ b/system/machine/hlbox/modules/acme/default.nix @@ -0,0 +1,27 @@ +{ + config, + inputs, + pkgs, + ... +}: { + # TODO fix when lego in stable v4.20.0+ + nixpkgs.overlays = [(_: _: {lego = inputs.unstable.legacyPackages.${pkgs.system}.lego.override {};})]; + + security.acme = { + acceptTerms = true; + + defaults = { + email = "muravjev.mak@yandex.ru"; + group = "nginx"; + }; + + certs = { + "maxmur.info" = { + extraDomainNames = ["*.maxmur.info"]; + dnsProvider = "timewebcloud"; + credentialsFile = config.sops.secrets."dns/token".path; + webroot = null; + }; + }; + }; +} diff --git a/system/machine/hlbox/modules/hardware/disks/default.nix b/system/machine/hlbox/modules/hardware/disks/default.nix index 3039501..d154396 100644 --- a/system/machine/hlbox/modules/hardware/disks/default.nix +++ b/system/machine/hlbox/modules/hardware/disks/default.nix @@ -1,11 +1,18 @@ _: { swapDevices = []; - boot.zfs.extraPools = [ - "zmirror" - "zpool1" - "zpool2" - ]; + boot.zfs = { + extraPools = [ + "zmirror" + "zpool1" + "zpool2" + ]; + }; + + services.zfs = { + autoScrub.enable = true; + autoSnapshot.enable = true; + }; fileSystems = { "/" = { diff --git a/system/machine/hlbox/modules/hardware/network/default.nix b/system/machine/hlbox/modules/hardware/network/default.nix index 44d1240..f195450 100644 --- a/system/machine/hlbox/modules/hardware/network/default.nix +++ b/system/machine/hlbox/modules/hardware/network/default.nix @@ -1,12 +1,76 @@ { config, username, + lib, + self, ... -}: { +}: let + inherit (lib) genList; + + maxVMs = 5; + + vmNetworks = builtins.listToAttrs ( + map (index: { + name = "30-vm${toString index}"; + value = { + matchConfig.Name = "vm${toString index}"; + + address = [ + "10.0.0.0/32" + ]; + + routes = [ + { + Destination = "10.0.0.${toString index}/32"; + } + ]; + + networkConfig = { + IPv4Forwarding = true; + }; + }; + }) (genList (i: i + 1) maxVMs) + ); +in { users.users.${username}.openssh.authorizedKeys.keys = config.module.defaults.ssh.pubKeys; networking = { hostId = "1ac5a44c"; + nftables.enable = true; + + nat = { + enable = true; + internalIPs = ["10.0.0.0/24"]; + externalInterface = "vmbr0"; + + forwardPorts = [ + { + destination = "10.0.0.2:53"; + proto = "udp"; + sourcePort = 53; + } + { + destination = "10.0.0.2:53"; + proto = "tcp"; + sourcePort = 53; + } + ]; + }; + + firewall = { + enable = true; + + allowedTCPPorts = [ + 53 + 80 + 443 + 4224 + ]; + + allowedUDPPorts = [ + 53 + ]; + }; }; systemd.network = { @@ -17,25 +81,52 @@ }; }; - networks = { - "10-lan" = { - matchConfig.Name = [config.module.defaults.network.iface]; - networkConfig = { - Bridge = "vmbr0"; + networks = + { + "10-lan" = { + matchConfig.Name = [config.module.defaults.network.iface "vm-*"]; + networkConfig = { + Bridge = "vmbr0"; + }; }; - }; - "10-lan-bridge" = { - matchConfig.Name = "vmbr0"; - linkConfig.RequiredForOnline = "routable"; + "10-lan-bridge" = { + matchConfig.Name = "vmbr0"; + linkConfig.RequiredForOnline = "routable"; - address = [ - "${config.module.defaults.network.ip}/${config.module.defaults.network.cidr}" - ]; + address = [ + "${config.module.defaults.network.ip}/${config.module.defaults.network.cidr}" + ]; - routes = [ - {Gateway = config.module.defaults.network.gw;} - ]; + routes = [ + {Gateway = config.module.defaults.network.gw;} + ]; + + networkConfig = { + DNS = [ + "10.0.0.2" + ]; + }; + }; + } + // vmNetworks; + }; + + topology.self = let + interfaces = builtins.listToAttrs (builtins.map (index: { + name = "vm${builtins.toString index}"; + value = { + addresses = ["10.0.0.0"]; + network = "hlbox-nat"; + }; + }) (lib.genList (i: i + 1) maxVMs)); + in { + inherit interfaces; + + services = { + psql = { + name = "Proxmox"; + icon = "${self}/parts/topology/images/services/proxmox.jpg"; }; }; }; diff --git a/system/machine/hlbox/modules/microvm/default.nix b/system/machine/hlbox/modules/microvm/default.nix new file mode 100644 index 0000000..1469578 --- /dev/null +++ b/system/machine/hlbox/modules/microvm/default.nix @@ -0,0 +1,41 @@ +{ + inputs, + self, + username, + ... +}: { + imports = [ + inputs.microvm.nixosModules.host + ]; + + microvm = { + autostart = [ + "dnsvm" + "dbvm" + "gitvm" + "vaultvm" + ]; + + vms = { + dnsvm = { + flake = self; + updateFlake = "git+file:///home/${username}/Code/nixos-configuration"; + }; + + dbvm = { + flake = self; + updateFlake = "git+file:///home/${username}/Code/nixos-configuration"; + }; + + gitvm = { + flake = self; + updateFlake = "git+file:///home/${username}/Code/nixos-configuration"; + }; + + vaultvm = { + flake = self; + updateFlake = "git+file:///home/${username}/Code/nixos-configuration"; + }; + }; + }; +} diff --git a/system/machine/hlbox/modules/nginx/default.nix b/system/machine/hlbox/modules/nginx/default.nix new file mode 100644 index 0000000..db08465 --- /dev/null +++ b/system/machine/hlbox/modules/nginx/default.nix @@ -0,0 +1,78 @@ +_: { + users.users.nginx.extraGroups = ["acme"]; + + services.nginx = { + enable = true; + + recommendedProxySettings = true; + recommendedOptimisation = true; + recommendedGzipSettings = true; + recommendedTlsSettings = true; + eventsConfig = "worker_connections 200000;"; + + clientMaxBodySize = "5G"; + + streamConfig = '' + server { + listen 4224; + proxy_pass 10.0.0.4:4224; + } + ''; + + virtualHosts = { + "dns.maxmur.info" = { + forceSSL = true; + useACMEHost = "maxmur.info"; + + locations."/" = { + proxyPass = "http://10.0.0.2:3000"; + }; + }; + + "git.maxmur.info" = { + forceSSL = true; + useACMEHost = "maxmur.info"; + + locations."/" = { + proxyPass = "http://10.0.0.4:3000"; + }; + }; + + "vaultwarden.maxmur.info" = { + forceSSL = true; + useACMEHost = "maxmur.info"; + + locations."/" = { + proxyPass = "http://10.0.0.5:8001"; + }; + }; + + "proxmox.maxmur.info" = { + forceSSL = true; + useACMEHost = "maxmur.info"; + + locations."/" = { + proxyPass = "https://192.168.1.10:8006"; + }; + }; + + "home.maxmur.info" = { + forceSSL = true; + useACMEHost = "maxmur.info"; + + locations."/" = { + proxyPass = "http://127.0.0.1:8082"; + }; + }; + + "uptime.maxmur.info" = { + forceSSL = true; + useACMEHost = "maxmur.info"; + + locations."/" = { + proxyPass = "http://127.0.0.1:64901"; + }; + }; + }; + }; +} diff --git a/system/machine/nbox/default.nix b/system/machine/nbox/default.nix index 8435f11..7e18089 100644 --- a/system/machine/nbox/default.nix +++ b/system/machine/nbox/default.nix @@ -14,6 +14,7 @@ _: { nixos-ng.enable = true; plymouth.enable = true; binfmt.enable = true; + xdg.enable = true; security = { enable = true; diff --git a/system/machine/nbox/modules/hardware/display/default.nix b/system/machine/nbox/modules/hardware/display/default.nix new file mode 100644 index 0000000..c18a8ce --- /dev/null +++ b/system/machine/nbox/modules/hardware/display/default.nix @@ -0,0 +1,57 @@ +{username, ...}: let + settings = { + sway = { + output = { + eDP-1 = { + resolution = "2880x1800@120Hz"; + position = "0 0"; + }; + }; + + workspaceOutputAssign = [ + { + workspace = "1"; + output = "eDP-1"; + } + { + workspace = "2"; + output = "eDP-1"; + } + { + workspace = "3"; + output = "eDP-1"; + } + { + workspace = "4"; + output = "eDP-1"; + } + { + workspace = "5"; + output = "eDP-1"; + } + { + workspace = "6"; + output = "eDP-1"; + } + ]; + }; + + hyprland = { + monitor = ["eDP-1,2880x1800@120,0x0,1.8"]; + + workspace = [ + "1, monitor:eDP-1, default:true" + "2, monitor:eDP-1, default:true" + "3, monitor:eDP-1, default:true" + "4, monitor:eDP-1, default:true" + "5, monitor:eDP-1, default:true" + "6, monitor:eDP-1, default:true" + ]; + }; + }; +in { + home-manager.users.${username}.wayland.windowManager = { + sway.config = settings.sway; + hyprland.settings = settings.hyprland; + }; +} diff --git a/system/machine/p8box/default.nix b/system/machine/p8box/default.nix index 17ee227..9b49e76 100644 --- a/system/machine/p8box/default.nix +++ b/system/machine/p8box/default.nix @@ -11,6 +11,7 @@ _: { minimal.enable = true; nixos-ng.enable = true; plymouth.enable = true; + xdg.enable = true; security = { enable = true; diff --git a/system/machine/p8box/modules/hardware/display/default.nix b/system/machine/p8box/modules/hardware/display/default.nix new file mode 100644 index 0000000..951fab8 --- /dev/null +++ b/system/machine/p8box/modules/hardware/display/default.nix @@ -0,0 +1,57 @@ +{username, ...}: let + settings = { + sway = { + output = { + DSI-1 = { + resolution = "800x1280@60Hz"; + position = "0 0"; + }; + }; + + workspaceOutputAssign = [ + { + workspace = "1"; + output = "DSI-1"; + } + { + workspace = "2"; + output = "DSI-1"; + } + { + workspace = "3"; + output = "DSI-1"; + } + { + workspace = "4"; + output = "DSI-1"; + } + { + workspace = "5"; + output = "DSI-1"; + } + { + workspace = "6"; + output = "DSI-1"; + } + ]; + }; + + hyprland = { + monitor = ["DSI-1,800x1280@60,0x0,1.8"]; + + workspace = [ + "1, monitor:DSI-1, default:true" + "2, monitor:DSI-1, default:true" + "3, monitor:DSI-1, default:true" + "4, monitor:DSI-1, default:true" + "5, monitor:DSI-1, default:true" + "6, monitor:DSI-1, default:true" + ]; + }; + }; +in { + home-manager.users.${username}.wayland.windowManager = { + sway.config = settings.sway; + hyprland.settings = settings.hyprland; + }; +} diff --git a/system/machine/pcbox/default.nix b/system/machine/pcbox/default.nix index 6a2018f..5c0920c 100644 --- a/system/machine/pcbox/default.nix +++ b/system/machine/pcbox/default.nix @@ -14,6 +14,7 @@ nixos-ng.enable = true; plymouth.enable = true; binfmt.enable = true; + xdg.enable = true; security = { enable = true; diff --git a/system/machine/pcbox/modules/hardware/display/default.nix b/system/machine/pcbox/modules/hardware/display/default.nix new file mode 100644 index 0000000..55f72bc --- /dev/null +++ b/system/machine/pcbox/modules/hardware/display/default.nix @@ -0,0 +1,95 @@ +{username, ...}: let + settings = { + sway = { + output = { + DP-1 = { + resolution = "1920x1080@144Hz"; + position = "0 0"; + }; + + DP-2 = { + resolution = "1920x1080@144Hz"; + position = "1920 0"; + }; + }; + + workspaceOutputAssign = [ + { + workspace = "1"; + output = "DP-2"; + } + { + workspace = "2"; + output = "DP-2"; + } + { + workspace = "3"; + output = "DP-2"; + } + { + workspace = "4"; + output = "DP-2"; + } + { + workspace = "5"; + output = "DP-2"; + } + { + workspace = "6"; + output = "DP-2"; + } + { + workspace = "7"; + output = "DP-1"; + } + { + workspace = "8"; + output = "DP-1"; + } + { + workspace = "9"; + output = "DP-1"; + } + { + workspace = "10"; + output = "DP-1"; + } + { + workspace = "11"; + output = "DP-1"; + } + { + workspace = "12"; + output = "DP-1"; + } + ]; + }; + + hyprland = { + monitor = [ + "DP-1,1920x1080@144,0x0,1" + "DP-2,1920x1080@144,1920x0,1" + ]; + + workspace = [ + "1, monitor:DP-2, default:true" + "2, monitor:DP-2, default:true" + "3, monitor:DP-2, default:true" + "4, monitor:DP-2, default:true" + "5, monitor:DP-2, default:true" + "6, monitor:DP-2, default:true" + "7, monitor:DP-1, default:true" + "8, monitor:DP-1, default:true" + "9, monitor:DP-1, default:true" + "10, monitor:DP-1, default:true" + "11, monitor:DP-1, default:true" + "12, monitor:DP-1, default:true" + ]; + }; + }; +in { + home-manager.users.${username}.wayland.windowManager = { + sway.config = settings.sway; + hyprland.settings = settings.hyprland; + }; +} diff --git a/system/machine/pcbox/modules/hardware/network/default.nix b/system/machine/pcbox/modules/hardware/network/default.nix index ae5cada..b701c14 100644 --- a/system/machine/pcbox/modules/hardware/network/default.nix +++ b/system/machine/pcbox/modules/hardware/network/default.nix @@ -4,7 +4,7 @@ _: { networks.eth0 = { address = ["192.168.1.50/24"]; - dns = ["192.168.1.8"]; + dns = ["192.168.1.10"]; }; }; diff --git a/system/machine/rasp/default.nix b/system/machine/rasp/default.nix index 02649d8..9ddd674 100644 --- a/system/machine/rasp/default.nix +++ b/system/machine/rasp/default.nix @@ -4,7 +4,9 @@ network.enable = true; security.enable = true; timedate.enable = true; + stylix.enable = true; users.enable = true; + minimal.enable = true; programs = { gnupg.enable = true; @@ -32,25 +34,10 @@ }; services = { + fail2ban.enable = true; unbound.enable = true; irqbalance.enable = true; - - adguard-home = { - enable = true; - httpAddress = "192.168.1.8"; - - bindHosts = [ - "192.168.1.8" - "127.0.0.1" - ]; - - dnsRewrites = [ - { - domain = "gitlab.maxmur.info"; - anwser = "192.168.1.8"; - } - ]; - }; + netbird.enable = true; ssh = { enable = true; diff --git a/system/machine/rasp/modules/hardware/network/default.nix b/system/machine/rasp/modules/hardware/network/default.nix index cdb7055..a74d75e 100644 --- a/system/machine/rasp/modules/hardware/network/default.nix +++ b/system/machine/rasp/modules/hardware/network/default.nix @@ -15,8 +15,10 @@ }; networking = { + nftables.enable = true; + nameservers = [ - "192.168.1.8" + "192.168.1.10" ]; firewall = { @@ -43,33 +45,15 @@ }; topology.self = { - services = { - nginx.details = { - "https" = { - text = "0.0.0.0:443"; - }; - "gitlab ssh" = { - text = "0.0.0.0:4224"; - }; - "syncthing web" = { - text = "0.0.0.0:8384"; - }; - }; - - adguardhome.details = { - "dns" = { - text = "192.168.1.8:53"; - }; - }; - }; - - interfaces.wg0 = { - addresses = ["10.200.100.3"]; + interfaces.wt0 = { + addresses = ["100.92.24.177"]; renderer.hidePhysicalConnections = false; virtual = true; type = "wireguard"; + network = "netbird-private"; + physicalConnections = [ - (config.lib.topology.mkConnection "site" "wg0") + (config.lib.topology.mkConnection "vpntwvm" "wt0") ]; }; }; diff --git a/system/machine/vaultvm/default.nix b/system/machine/vaultvm/default.nix new file mode 100644 index 0000000..6b42db3 --- /dev/null +++ b/system/machine/vaultvm/default.nix @@ -0,0 +1,61 @@ +{config, ...}: { + module = { + locales.enable = true; + security.enable = true; + timedate.enable = true; + stylix.enable = true; + users.enable = true; + minimal.enable = true; + + programs = { + hm.enable = true; + zsh.enable = true; + fish.enable = true; + systemPackages.enable = true; + }; + + defaults = { + network = { + iface = "vm5"; + ip = "10.0.0.5"; + gw = "10.0.0.0"; + mask = "255.255.255.0"; + cidr = "24"; + mac = "02:00:02:00:00:00"; + }; + + ssh.pubKeys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINWJULtMSQfTZqoXwfK32T+V+NZMqM+1rKhURlee8yS+ maxmur" + ]; + }; + + services = { + fail2ban.enable = true; + + vaultwarden = { + enable = true; + dbBackend = "postgresql"; + environmentFile = "/run/secrets/vaultwarden/env"; + + config = { + DATA_FOLDER = "/var/lib/vaultwarden"; + DOMAIN = "https://vaultwarden.maxmur.info"; + ROCKET_ADDRESS = "0.0.0.0"; + ROCKET_PORT = 8001; + SIGNUPS_ALLOWED = false; + WEB_VAULT_ENABLED = true; + }; + }; + + ssh = { + enable = true; + listenAddresses = [ + { + addr = config.module.defaults.network.ip; + port = 34861; + } + ]; + }; + }; + }; +} diff --git a/system/machine/vaultvm/modules/default.nix b/system/machine/vaultvm/modules/default.nix new file mode 100644 index 0000000..8bcb676 --- /dev/null +++ b/system/machine/vaultvm/modules/default.nix @@ -0,0 +1,10 @@ +{ + self, + machineDir, + allDirs, + ... +}: let + modules = "${self}/system/machine/${machineDir}/modules"; +in { + imports = allDirs modules; +} diff --git a/system/machine/vaultvm/modules/hardware/default.nix b/system/machine/vaultvm/modules/hardware/default.nix new file mode 100644 index 0000000..733fcad --- /dev/null +++ b/system/machine/vaultvm/modules/hardware/default.nix @@ -0,0 +1,10 @@ +{ + self, + machineDir, + allDirs, + ... +}: let + machineHardwareModulesPath = "${self}/system/machine/${machineDir}/modules/hardware"; +in { + imports = allDirs machineHardwareModulesPath; +} diff --git a/system/machine/vaultvm/modules/hardware/network/default.nix b/system/machine/vaultvm/modules/hardware/network/default.nix new file mode 100644 index 0000000..c8e1613 --- /dev/null +++ b/system/machine/vaultvm/modules/hardware/network/default.nix @@ -0,0 +1,48 @@ +{ + config, + username, + ... +}: { + users.users.${username}.openssh.authorizedKeys.keys = config.module.defaults.ssh.pubKeys; + + networking = { + hostName = "vaultvm"; + + firewall = { + allowedTCPPorts = [ + 8001 + 34861 + ]; + }; + }; + + systemd.network = { + enable = true; + + networks."10-eth" = { + matchConfig.MACAddress = config.module.defaults.network.mac; + + address = [ + "${config.module.defaults.network.ip}/32" + ]; + + routes = [ + { + Destination = "10.0.0.0/32"; + GatewayOnLink = true; + } + { + Destination = "0.0.0.0/0"; + Gateway = "10.0.0.0"; + GatewayOnLink = true; + } + ]; + + networkConfig = { + DNS = [ + "10.0.0.2" + ]; + }; + }; + }; +} diff --git a/system/machine/vaultvm/modules/microvm/default.nix b/system/machine/vaultvm/modules/microvm/default.nix new file mode 100644 index 0000000..f7fb721 --- /dev/null +++ b/system/machine/vaultvm/modules/microvm/default.nix @@ -0,0 +1,48 @@ +{ + inputs, + config, + ... +}: { + imports = [ + inputs.microvm.nixosModules.microvm + ]; + + microvm = { + mem = 4 * 1024; + vcpu = 2; + storeDiskType = "squashfs"; + + hypervisor = "cloud-hypervisor"; + + interfaces = [ + { + id = config.module.defaults.network.iface; + type = "tap"; + inherit (config.module.defaults.network) mac; + } + ]; + + volumes = [ + { + mountPoint = "/var/lib"; + image = "db.img"; + size = 30 * 1024; + } + ]; + + shares = [ + { + proto = "virtiofs"; + tag = "ro-store"; + source = "/nix/store"; + mountPoint = "/nix/.ro-store"; + } + { + proto = "virtiofs"; + tag = "secrets"; + source = "/run/secrets/vaultwarden"; + mountPoint = "/run/secrets/vaultwarden"; + } + ]; + }; +} diff --git a/system/machine/vpntwvm/default.nix b/system/machine/vpntwvm/default.nix new file mode 100644 index 0000000..3d232cc --- /dev/null +++ b/system/machine/vpntwvm/default.nix @@ -0,0 +1,96 @@ +{config, ...}: { + module = { + locales.enable = true; + security.enable = true; + timedate.enable = true; + stylix.enable = true; + users.enable = true; + minimal.enable = true; + + programs = { + hm.enable = true; + zsh.enable = true; + fish.enable = true; + systemPackages.enable = true; + }; + + defaults = { + network = { + iface = "ens3"; + ip = "37.252.22.10"; + gw = "37.252.22.1"; + mask = "255.255.255.0"; + cidr = "24"; + }; + + ssh.pubKeys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP0MrNpS4NvXUqEJdo8wHHb3l6TKsgWxkSWzlWKiX+WU maxmur" + ]; + }; + + services = { + fail2ban.enable = true; + + postgresql = { + enable = true; + dataDir = "/var/lib/postgresql/17"; + authentication = "host all all 0.0.0.0/0 scram-sha-256"; + + configurations = [ + "keycloak" + ]; + }; + + keycloak = { + enable = true; + + database = { + type = "postgresql"; + username = "keycloak"; + name = "keycloak"; + host = "localhost"; + passwordFile = config.sops.secrets."db/keycloakUser".path; + }; + + settings = { + hostname = "auth.ext.maxmur.info"; + http-enabled = true; + http-port = 8000; + http-host = "127.0.0.1"; + http-relative-path = "/auth"; + proxy-headers = "xforwarded"; + }; + }; + + netbird-server = { + enable = true; + domain = "netbird.ext.maxmur.info"; + clientID = "netbird-client"; + backendID = "netbird-backend"; + keycloakDomain = "auth.ext.maxmur.info"; + keycloakURL = "https://auth.ext.maxmur.info/auth"; + keycloakRealmName = "homelab"; + coturnPasswordPath = config.sops.secrets."netbird/coturnPassword".path; + coturnSalt = config.sops.secrets."netbird/coturnSalt".path; + dataStoreEncryptionKeyPath = config.sops.secrets."netbird/dataStoreEncryptionKey".path; + clientSecretPath = config.sops.secrets."netbird/clientSecret".path; + }; + + privatebin = { + enable = true; + domain = "paste.ext.maxmur.info"; + name = "maxmur pastebin"; + }; + + ssh = { + enable = true; + listenAddresses = [ + { + addr = "0.0.0.0"; + port = 54315; + } + ]; + }; + }; + }; +} diff --git a/system/machine/vpntwvm/modules/acme/default.nix b/system/machine/vpntwvm/modules/acme/default.nix new file mode 100644 index 0000000..88fa2ce --- /dev/null +++ b/system/machine/vpntwvm/modules/acme/default.nix @@ -0,0 +1,27 @@ +{ + config, + pkgs, + inputs, + ... +}: { + # TODO fix when lego in stable v4.20.0+ + nixpkgs.overlays = [(_: _: {lego = inputs.unstable.legacyPackages.${pkgs.system}.lego.override {};})]; + + security.acme = { + acceptTerms = true; + + defaults = { + email = "muravjev.mak@yandex.ru"; + group = "nginx"; + }; + + certs = { + "ext.maxmur.info" = { + extraDomainNames = ["*.ext.maxmur.info"]; + dnsProvider = "timewebcloud"; + credentialsFile = config.sops.secrets."dns/token".path; + webroot = null; + }; + }; + }; +} diff --git a/system/machine/vpntwvm/modules/default.nix b/system/machine/vpntwvm/modules/default.nix new file mode 100644 index 0000000..8bcb676 --- /dev/null +++ b/system/machine/vpntwvm/modules/default.nix @@ -0,0 +1,10 @@ +{ + self, + machineDir, + allDirs, + ... +}: let + modules = "${self}/system/machine/${machineDir}/modules"; +in { + imports = allDirs modules; +} diff --git a/system/machine/vpntwvm/modules/hardware/default.nix b/system/machine/vpntwvm/modules/hardware/default.nix new file mode 100644 index 0000000..733fcad --- /dev/null +++ b/system/machine/vpntwvm/modules/hardware/default.nix @@ -0,0 +1,10 @@ +{ + self, + machineDir, + allDirs, + ... +}: let + machineHardwareModulesPath = "${self}/system/machine/${machineDir}/modules/hardware"; +in { + imports = allDirs machineHardwareModulesPath; +} diff --git a/system/machine/vpntwvm/modules/hardware/disks/default.nix b/system/machine/vpntwvm/modules/hardware/disks/default.nix new file mode 100644 index 0000000..8c06cbd --- /dev/null +++ b/system/machine/vpntwvm/modules/hardware/disks/default.nix @@ -0,0 +1,64 @@ +_: { + disko.devices = { + disk.disk1 = { + device = "/dev/vda"; + type = "disk"; + + content = { + type = "gpt"; + + partitions = { + boot = { + name = "boot"; + size = "1M"; + type = "EF02"; + }; + + esp = { + name = "ESP"; + size = "500M"; + type = "EF00"; + + content = { + type = "filesystem"; + format = "vfat"; + mountpoint = "/boot"; + }; + }; + + root = { + name = "root"; + size = "100%"; + + content = { + type = "lvm_pv"; + vg = "pool"; + }; + }; + }; + }; + }; + + lvm_vg = { + pool = { + type = "lvm_vg"; + + lvs = { + root = { + size = "100%FREE"; + + content = { + type = "filesystem"; + format = "ext4"; + mountpoint = "/"; + + mountOptions = [ + "defaults" + ]; + }; + }; + }; + }; + }; + }; +} diff --git a/system/machine/vpntwvm/modules/hardware/kernel/default.nix b/system/machine/vpntwvm/modules/hardware/kernel/default.nix new file mode 100644 index 0000000..f9a7319 --- /dev/null +++ b/system/machine/vpntwvm/modules/hardware/kernel/default.nix @@ -0,0 +1,3 @@ +_: { + boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "virtio_pci" "virtio_blk"]; +} diff --git a/system/machine/vpntwvm/modules/hardware/loader/default.nix b/system/machine/vpntwvm/modules/hardware/loader/default.nix new file mode 100644 index 0000000..77a9356 --- /dev/null +++ b/system/machine/vpntwvm/modules/hardware/loader/default.nix @@ -0,0 +1,6 @@ +_: { + boot.loader.grub = { + efiSupport = true; + efiInstallAsRemovable = true; + }; +} diff --git a/system/machine/vpntwvm/modules/hardware/network/default.nix b/system/machine/vpntwvm/modules/hardware/network/default.nix new file mode 100644 index 0000000..5a84b21 --- /dev/null +++ b/system/machine/vpntwvm/modules/hardware/network/default.nix @@ -0,0 +1,89 @@ +{ + config, + username, + self, + ... +}: { + users.users.${username}.openssh.authorizedKeys.keys = config.module.defaults.ssh.pubKeys; + + networking = { + hostName = "vpntwvm"; + + firewall = { + allowedTCPPorts = [ + 22 + 80 + 443 + 10000 + 33080 + 33073 + 54315 + ]; + + allowedUDPPorts = [ + 3478 + ]; + + allowedUDPPortRanges = [ + { + from = 49152; + to = 65535; + } + ]; + }; + }; + + systemd.network = { + enable = true; + + networks = { + "10-wan" = { + matchConfig.Name = config.module.defaults.network.iface; + + address = [ + "${config.module.defaults.network.ip}/${config.module.defaults.network.cidr}" + ]; + + routes = [ + {Gateway = config.module.defaults.network.gw;} + ]; + + networkConfig = { + DNS = [ + "8.8.8.8" + "8.8.4.4" + ]; + }; + }; + }; + }; + + topology.self = { + services = { + netbird = { + name = "NetBird"; + icon = "${self}/parts/topology/images/services/netbird.png"; + }; + + keycloak = { + name = "Keycloak"; + icon = "${self}/parts/topology/images/services/keycloak.png"; + }; + + psql = { + name = "Postgresql"; + icon = "${self}/parts/topology/images/services/psql.png"; + }; + }; + + interfaces = { + wt0 = { + addresses = ["100.92.0.1"]; + renderer.hidePhysicalConnections = false; + virtual = true; + type = "wireguard"; + network = "netbird-private"; + }; + }; + }; +} diff --git a/system/machine/vpntwvm/modules/nginx/default.nix b/system/machine/vpntwvm/modules/nginx/default.nix new file mode 100644 index 0000000..31b7744 --- /dev/null +++ b/system/machine/vpntwvm/modules/nginx/default.nix @@ -0,0 +1,35 @@ +_: { + users.users.nginx.extraGroups = ["acme"]; + + services.nginx = { + enable = true; + + recommendedProxySettings = true; + recommendedOptimisation = true; + recommendedGzipSettings = true; + recommendedTlsSettings = true; + + clientMaxBodySize = "5G"; + + virtualHosts = { + "auth.ext.maxmur.info" = { + forceSSL = true; + useACMEHost = "ext.maxmur.info"; + + locations."/" = { + proxyPass = "http://127.0.0.1:8000"; + }; + }; + + "netbird.ext.maxmur.info" = { + forceSSL = true; + useACMEHost = "ext.maxmur.info"; + }; + + "paste.ext.maxmur.info" = { + forceSSL = true; + useACMEHost = "ext.maxmur.info"; + }; + }; + }; +} diff --git a/system/nixos/modules/programs/systemPackages/default.nix b/system/nixos/modules/programs/systemPackages/default.nix index c040b49..6824036 100644 --- a/system/nixos/modules/programs/systemPackages/default.nix +++ b/system/nixos/modules/programs/systemPackages/default.nix @@ -2,6 +2,7 @@ pkgs, lib, config, + stateVersion, isWorkstation, ... }: let @@ -9,6 +10,15 @@ inherit (lib) optionals; cfg = config.module.programs.systemPackages; + + iosevkaPackage = + if stateVersion == "24.11" + then pkgs.nerdfonts.override {fonts = ["Iosevka"];} + else pkgs.nerd-fonts.iosevka; + jbPackage = + if stateVersion == "24.11" + then pkgs.nerdfonts.override {fonts = ["JetBrainsMono"];} + else pkgs.nerd-fonts.iosevka; in { options = { module.programs.systemPackages.enable = mkEnableOption "Enable System Software"; @@ -16,9 +26,8 @@ in { config = mkIf cfg.enable { fonts.packages = with pkgs; [ - nerd-fonts.jetbrains-mono - nerd-fonts.ubuntu-mono - nerd-fonts.iosevka + iosevkaPackage + jbPackage corefonts ]; diff --git a/system/nixos/modules/programs/xdg-portal/default.nix b/system/nixos/modules/programs/xdg-portal/default.nix index e1a97d2..50c66a9 100644 --- a/system/nixos/modules/programs/xdg-portal/default.nix +++ b/system/nixos/modules/programs/xdg-portal/default.nix @@ -16,7 +16,6 @@ in { config = mkIf cfg.enable { xdg.portal = { enable = true; - xdgOpenUsePortal = true; config = { common = { diff --git a/system/nixos/modules/services/adguard-home/default.nix b/system/nixos/modules/services/adguard-home/default.nix index 1dec23a..ff4f9de 100644 --- a/system/nixos/modules/services/adguard-home/default.nix +++ b/system/nixos/modules/services/adguard-home/default.nix @@ -1,10 +1,21 @@ { lib, config, + utils, + pkgs, ... }: let - inherit (lib) mkEnableOption mkIf mkOption; - inherit (lib.types) str listOf attrs; + inherit (lib) mkEnableOption mkIf mkOption mkForce; + inherit (lib.types) str listOf attrs int; + inherit (utils) genJqSecretsReplacementSnippet; + + genYqSecretsReplacementSnippet = attrs: fileIn: fileOut: + (genJqSecretsReplacementSnippet attrs fileIn) + + '' + ${pkgs.yq-go}/bin/yq -Poy ${fileIn} > ${fileOut} + chmod 600 ${fileOut} + rm -f ${fileIn} + ''; cfg = config.module.services.adguard-home; in { @@ -17,6 +28,11 @@ in { default = "0.0.0.0"; }; + httpPort = mkOption { + type = int; + default = 3000; + }; + bindHosts = mkOption { type = listOf str; default = ["0.0.0.0"]; @@ -26,19 +42,53 @@ in { type = listOf attrs; default = []; }; + + users = mkOption { + type = listOf attrs; + default = []; + }; }; }; config = mkIf cfg.enable { + systemd.services.adguardhome = { + preStart = mkForce (genYqSecretsReplacementSnippet config.services.adguardhome.settings "/var/lib/AdGuardHome/AdGuardHome.json" "/var/lib/AdGuardHome/AdGuardHome.yaml"); + + serviceConfig = { + DynamicUser = mkForce false; + + # hardening + LockPersonality = true; + MemoryDenyWriteExecute = true; + NoNewPrivileges = true; + PrivateMounts = true; + PrivateTmp = true; + ProtectClock = true; + ProtectControlGroups = true; + ProtectHome = true; + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + ProtectSystem = true; + RemoveIPC = true; + RestrictNamespaces = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + }; + }; + services.adguardhome = { enable = true; - port = 3000; + port = cfg.httpPort; mutableSettings = true; settings = { + inherit (cfg) users; + auth_attempts = 3; block_auth_min = 5; - http.address = "${cfg.httpAddress}:3000"; + http.address = "${cfg.httpAddress}:${builtins.toString cfg.httpPort}"; dhcp.enabled = false; statistics = { @@ -46,21 +96,64 @@ in { interval = "8760h"; }; + filtering = { + rewrites = cfg.dnsRewrites; + }; + dns = { bind_hosts = cfg.bindHosts; ratelimit = 0; - rewrites = cfg.dnsRewrites; upstream_dns = [ "tls://dns.google" - "tls://common.dot.dns.yandex.net" + "tls://cloudflare-dns.com" + "tls://dns.quad9.net" ]; bootstrap_dns = [ - "9.9.9.10" - "149.112.112.10" + "8.8.8.8" + "8.8.4.4" ]; }; + + filters = [ + { + url = "https://adguardteam.github.io/HostlistsRegistry/assets/filter_1.txt"; + name = "AdGuard DNS filter"; + id = 1; + enabled = true; + } + { + url = "https://adguardteam.github.io/HostlistsRegistry/assets/filter_2.txt"; + name = "AdAway Default Blocklist"; + id = 2; + enabled = true; + } + { + url = "https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocker/master/data/hosts/spy.txt"; + name = "Windows telemetry v4"; + id = 3; + enabled = true; + } + { + url = "https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocker/refs/heads/master/data/hosts/spy_v6.txt"; + name = "Windows telemetry v6"; + id = 4; + enabled = true; + } + { + url = "https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocker/refs/heads/master/data/hosts/extra.txt"; + name = "Windows extra v4"; + id = 5; + enabled = true; + } + { + url = "https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocker/refs/heads/master/data/hosts/extra_v6.txt"; + name = "Windows extra v6"; + id = 6; + enabled = true; + } + ]; }; }; }; diff --git a/system/nixos/modules/services/fail2ban/default.nix b/system/nixos/modules/services/fail2ban/default.nix new file mode 100644 index 0000000..4f6bf83 --- /dev/null +++ b/system/nixos/modules/services/fail2ban/default.nix @@ -0,0 +1,21 @@ +{ + lib, + config, + ... +}: let + inherit (lib) mkEnableOption mkIf; + + cfg = config.module.services.fail2ban; +in { + options = { + module.services.fail2ban = { + enable = mkEnableOption "Enable fail2ban"; + }; + }; + + config = mkIf cfg.enable { + services.fail2ban = { + enable = true; + }; + }; +} diff --git a/system/nixos/modules/services/forgejo/default.nix b/system/nixos/modules/services/forgejo/default.nix new file mode 100644 index 0000000..84a57cd --- /dev/null +++ b/system/nixos/modules/services/forgejo/default.nix @@ -0,0 +1,117 @@ +{ + lib, + config, + ... +}: let + inherit (lib) mkEnableOption mkIf mkOption; + inherit (lib.types) str attrs int; + + cfg = config.module.services.forgejo; +in { + options = { + module.services.forgejo = { + enable = mkEnableOption "Enable forgejo"; + + stateDir = mkOption { + type = str; + default = "/var/lib/forgejo"; + description = "Forgejo data dir"; + }; + + database = mkOption { + type = attrs; + default = {}; + description = "Forgejo database settings"; + }; + + domain = mkOption { + type = str; + default = "git.example.com"; + description = "Forgejo domain name"; + }; + + sshPort = mkOption { + type = int; + default = 222; + description = "Forgejo ssh port"; + }; + + httpAddr = mkOption { + type = str; + default = "127.0.0.1"; + description = "Forgejo listen address"; + }; + }; + }; + + config = mkIf cfg.enable { + services.forgejo = { + inherit (cfg) database stateDir; + + enable = true; + + settings = let + gcArgs = "--aggressive --no-cruft --prune=now"; + gcTimeout = 600; + in { + "cron.cleanup_actions".ENABLED = true; + "cron.update_mirrors".SCHEDULE = "@midnight"; + "git".GC_ARGS = gcArgs; + "git.timeout".GC = gcTimeout; + "log".LEVEL = "Error"; + "repo-archive".ENABLED = false; + "repository".DISABLE_DOWNLOAD_SOURCE_ARCHIVES = true; + "repository.issue".MAX_PINNED = 99999; + "repository.pull-request".DEFAULT_MERGE_STYLE = "rebase"; + "service".DISABLE_REGISTRATION = true; + + "server" = { + DOMAIN = cfg.domain; + HTTP_ADDR = cfg.httpAddr; + ROOT_URL = "https://${cfg.domain}"; + BUILTIN_SSH_SERVER_USER = "git"; + DISABLE_SSH = false; + SSH_PORT = cfg.sshPort; + START_SSH_SERVER = true; + }; + + "openid" = { + ENABLE_OPENID_SIGNUP = true; + }; + + "oauth2_client" = { + ENABLE_AUTO_REGISTRATION = true; + ACCOUNT_LINKING = "auto"; + }; + + "ui" = { + AMBIGUOUS_UNICODE_DETECTION = false; + }; + + "repository" = { + DEFAULT_PRIVATE = "private"; + DEFAULT_PUSH_CREATE_PRIVATE = true; + }; + + "cron" = { + ENABLED = true; + RUN_AT_START = true; + }; + + "cron.git_gc_repos" = { + ENABLED = true; + ARGS = gcArgs; + SCHEDULE = "@midnight"; + TIMEOUT = gcTimeout; + }; + + "cron.archive_cleanup" = { + ENABLED = true; + RUN_AT_START = true; + SCHEDULE = "@midnight"; + TIMEOUT = "1h"; + }; + }; + }; + }; +} diff --git a/system/nixos/modules/services/homepage-dashboard/default.nix b/system/nixos/modules/services/homepage-dashboard/default.nix index 9cf640d..3b64177 100644 --- a/system/nixos/modules/services/homepage-dashboard/default.nix +++ b/system/nixos/modules/services/homepage-dashboard/default.nix @@ -1,13 +1,18 @@ { - pkgs, lib, config, + self, ... }: let inherit (lib) mkEnableOption mkIf; cfg = config.module.services.homepage-dashboard; in { + imports = [ + "${self}/system/nixos/modules/services/homepage-dashboard/settings" + "${self}/system/nixos/modules/services/homepage-dashboard/services" + ]; + options = { module.services.homepage-dashboard = { enable = mkEnableOption "Enables homepage-dashboard"; @@ -17,44 +22,7 @@ in { config = mkIf cfg.enable { services.homepage-dashboard = { enable = true; - package = pkgs.homepage-dashboard; + listenPort = 8082; }; - - /* - systemd.services.homepage-dashboard.environment.HOMEPAGE_CONFIG_DIR = let - configDir = pkgs.linkFarm "homepage-dashboard-config" { - "settings.yaml" = yaml.generate "settings.yaml" { - title = "Germond Homelab"; - background = "https://images.unsplash.com/photo-1502790671504-542ad42d5189?auto=format&fit=crop&w=2560&q=80"; - cardBlur = "sm"; - theme = "dark"; - color = "zinc"; - iconStyle = "theme"; - statusStyle = "dot"; - - language = "fr"; - - target = "_blank"; # open links in new tabs - - hideVersion = true; - disableCollapse = true; - - logpath = pkgs.linkFarm "homepage-dashboard-null-logs" { - "logs/homepage.log" = "/dev/null"; - }; - }; - "services.yaml" = yaml.generate "services.yaml" []; - "widgets.yaml" = yaml.generate "widgets.yaml" []; - "bookmarks.yaml" = yaml.generate "bookmarks.yaml" []; - "docker.yaml" = yaml.generate "docker.yaml" {}; - "kubernetes.yaml" = yaml.generate "kubernetes.yaml" { - mode = "disabled"; - }; - "custom.css" = pkgs.writeText "custom.css" ''''; - "custom.js" = pkgs.writeText "custom.js" ''''; - }; - in - lib.mkForce "${configDir}"; - */ }; } diff --git a/system/nixos/modules/services/homepage-dashboard/services/default.nix b/system/nixos/modules/services/homepage-dashboard/services/default.nix new file mode 100644 index 0000000..59649eb --- /dev/null +++ b/system/nixos/modules/services/homepage-dashboard/services/default.nix @@ -0,0 +1,62 @@ +{ + # Icons - https://github.com/walkxcode/dashboard-icons/tree/main/svg + services.homepage-dashboard.services = [ + { + "User" = [ + { + "Vaultwarden" = { + description = "Password manager"; + href = "https://vaultwarden.maxmur.info"; + icon = "vaultwarden.svg"; + }; + } + ]; + } + { + "Services" = [ + { + "AdGuard Home" = { + description = "DNS manager"; + href = "https://dns.maxmur.info"; + icon = "adguard-home.svg"; + }; + } + { + "Forgejo" = { + description = "Local git manager"; + href = "https://git.maxmur.info"; + icon = "forgejo.svg"; + }; + } + { + "Netbird" = { + description = "VPN access to home network"; + href = "https://netbird.ext.maxmur.info"; + icon = "netbird.svg"; + }; + } + { + "Keycloak" = { + description = "IDM for manage users"; + href = "https://auth.ext.maxmur.info"; + icon = "keycloak.svg"; + }; + } + { + "PrivateBin" = { + description = "Private pastebin"; + href = "https://paste.ext.maxmur.info"; + icon = "hastypaste.svg"; + }; + } + { + "Proxmox" = { + description = "Homelab hypervisor"; + href = "https://proxmox.maxmur.info"; + icon = "proxmox.svg"; + }; + } + ]; + } + ]; +} diff --git a/system/nixos/modules/services/homepage-dashboard/settings/default.nix b/system/nixos/modules/services/homepage-dashboard/settings/default.nix new file mode 100644 index 0000000..6d27879 --- /dev/null +++ b/system/nixos/modules/services/homepage-dashboard/settings/default.nix @@ -0,0 +1,28 @@ +{ + services.homepage-dashboard.settings = { + title = "Welcome to Home!"; + favicon = "https://img.icons8.com/?size=100&id=2006&format=png&color=000000"; + background = "https://images.unsplash.com/photo-1481277542470-605612bd2d61?q=80&w=1612&auto=format&fit=crop"; + color = "white"; + theme = "dark"; + iconStyle = "theme"; + language = "en"; + + layout = { + User = { + style = "row"; + columns = 4; + }; + + Media = { + style = "row"; + columns = 4; + }; + + Services = { + style = "row"; + columns = 4; + }; + }; + }; +} diff --git a/system/nixos/modules/services/keycloak/default.nix b/system/nixos/modules/services/keycloak/default.nix new file mode 100644 index 0000000..380f074 --- /dev/null +++ b/system/nixos/modules/services/keycloak/default.nix @@ -0,0 +1,36 @@ +{ + lib, + config, + ... +}: let + inherit (lib) mkEnableOption mkIf mkOption; + inherit (lib.types) attrs; + + cfg = config.module.services.keycloak; +in { + options = { + module.services.keycloak = { + enable = mkEnableOption "Enables keycloak"; + + database = mkOption { + type = attrs; + default = {}; + description = "Settings of databese"; + }; + + settings = mkOption { + type = attrs; + default = {}; + description = "Keycloak settings"; + }; + }; + }; + + config = mkIf cfg.enable { + services.keycloak = { + inherit (cfg) database settings; + + enable = true; + }; + }; +} diff --git a/system/nixos/modules/services/netbird-server/default.nix b/system/nixos/modules/services/netbird-server/default.nix new file mode 100644 index 0000000..4a5efc5 --- /dev/null +++ b/system/nixos/modules/services/netbird-server/default.nix @@ -0,0 +1,166 @@ +{ + lib, + config, + ... +}: let + inherit (lib) mkEnableOption mkIf mkOption; + inherit (lib.types) str oneOf path; + + cfg = config.module.services.netbird-server; +in { + options = { + module.services.netbird-server = { + enable = mkEnableOption "Enables netbird-server"; + + domain = mkOption { + type = str; + default = "netbird.example.com"; + description = "Netbird domain name"; + }; + + clientID = mkOption { + type = str; + default = "netbird"; + description = "Name of netbird client from keycloak"; + }; + + backendID = mkOption { + type = str; + default = "netbird"; + description = "Name of netbird backend client for keycloak"; + }; + + keycloakDomain = mkOption { + type = str; + default = "auth.example.com"; + description = "Keycloak domain name"; + }; + + keycloakURL = mkOption { + type = str; + default = "https://auth.example.com/auth"; + description = "Path to root keycloak"; + }; + + keycloakRealmName = mkOption { + type = str; + default = "example"; + description = "Name of keycloak realm"; + }; + + coturnPasswordPath = mkOption { + type = oneOf [str path]; + default = "/run/secrets/netbird/coturnPassword"; + description = "Path to coturn password file"; + }; + + coturnSalt = mkOption { + type = oneOf [str path]; + default = "/run/secrets/netbird/coturnPassword"; + description = "Path to coturn password file"; + }; + + dataStoreEncryptionKeyPath = mkOption { + type = oneOf [str path]; + default = "/run/secrets/netbird/DataStoreEncryptionKeyPath"; + description = "Path to datastore enc key file"; + }; + + clientSecretPath = mkOption { + type = oneOf [str path]; + default = "/run/secrets/netbird/clientSecret"; + description = "Path to client secret file for netbird backend"; + }; + }; + }; + + config = mkIf cfg.enable { + services.netbird.server = { + inherit (cfg) domain; + + enable = true; + enableNginx = true; + + coturn = { + enable = true; + passwordFile = cfg.coturnPasswordPath; + }; + + dashboard = { + settings = { + AUTH_AUTHORITY = "${cfg.keycloakURL}/realms/${cfg.keycloakRealmName}"; + AUTH_AUDIENCE = cfg.clientID; + AUTH_CLIENT_ID = cfg.clientID; + AUTH_SUPPORTED_SCOPES = "openid profile email offline_access api"; + USE_AUTH0 = false; + }; + }; + + management = { + oidcConfigEndpoint = "${cfg.keycloakURL}/realms/${cfg.keycloakRealmName}/.well-known/openid-configuration"; + + settings = { + DataStoreEncryptionKey._secret = cfg.dataStoreEncryptionKeyPath; + + TURNConfig = { + Secret._secret = cfg.coturnSalt; + + Turns = [ + { + Proto = "udp"; + URI = "turn:${cfg.domain}:3478"; + Username = "netbird"; + Password._secret = cfg.coturnPasswordPath; + } + ]; + }; + + HttpConfig = { + AuthAudience = cfg.clientID; + AuthIssuer = "${cfg.keycloakURL}/realms/${cfg.keycloakRealmName}"; + AuthKeysLocation = "${cfg.keycloakURL}/realms/${cfg.keycloakRealmName}/openid-connect/certs"; + IdpSignKeyRefreshEnabled = false; + }; + + IdpManagerConfig = { + ManagerType = "keycloak"; + + ClientConfig = { + Issuer = "${cfg.keycloakURL}/realms/${cfg.keycloakRealmName}"; + TokenEndpoint = "${cfg.keycloakURL}/realms/${cfg.keycloakRealmName}/protocol/openid-connect/token"; + ClientID = cfg.backendID; + ClientSecret._secret = cfg.clientSecretPath; + }; + + ExtraConfig = { + AdminEndpoint = "${cfg.keycloakURL}/admin/realms/${cfg.keycloakRealmName}"; + }; + }; + + DeviceAuthorizationFlow = { + Provider = "hosted"; + + ProviderConfig = { + ClientID = cfg.clientID; + Audience = cfg.clientID; + Domain = cfg.keycloakDomain; + TokenEndpoint = "${cfg.keycloakURL}/realms/${cfg.keycloakRealmName}/protocol/openid-connect/token"; + DeviceAuthEndpoint = "${cfg.keycloakURL}/realms/${cfg.keycloakRealmName}/protocol/openid-connect/auth/device"; + Scope = "openid"; + UseIDToken = false; + }; + }; + + PKCEAuthorizationFlow = { + ProviderConfig = { + ClientID = cfg.clientID; + Audience = cfg.clientID; + TokenEndpoint = "${cfg.keycloakURL}/realms/${cfg.keycloakRealmName}/protocol/openid-connect/token"; + AuthorizationEndpoint = "${cfg.keycloakURL}/realms/${cfg.keycloakRealmName}/protocol/openid-connect/auth"; + }; + }; + }; + }; + }; + }; +} diff --git a/system/nixos/modules/services/paperless/default.nix b/system/nixos/modules/services/paperless/default.nix new file mode 100644 index 0000000..5d68a35 --- /dev/null +++ b/system/nixos/modules/services/paperless/default.nix @@ -0,0 +1,39 @@ +{ + lib, + config, + pkgs, + ... +}: let + inherit (lib) mkEnableOption mkIf mkOption; + inherit (lib.types) str attrs; + + cfg = config.module.services.paperless; +in { + options = { + module.services.paperless = { + enable = mkEnableOption "Enables paperless"; + + listenAddress = mkOption { + type = str; + default = "0.0.0.0"; + description = "Listen web address"; + }; + + settings = mkOption { + type = attrs; + default = {}; + description = "Paperless settings"; + }; + }; + }; + + config = mkIf cfg.enable { + services.paperless = { + inherit (cfg) settings; + + enable = true; + address = cfg.listenAddress; + passwordFile = pkgs.writeText "PaperlessPassword" "root"; # WARN: Only for initial setup, change later. + }; + }; +} diff --git a/system/nixos/modules/services/postgresql/default.nix b/system/nixos/modules/services/postgresql/default.nix new file mode 100644 index 0000000..3bb8e27 --- /dev/null +++ b/system/nixos/modules/services/postgresql/default.nix @@ -0,0 +1,71 @@ +{ + config, + lib, + pkgs, + ... +}: let + inherit (lib) mkEnableOption mkIf mkOption; + inherit (lib.types) str listOf package; + + cfg = config.module.services.postgresql; +in { + options = { + module.services.postgresql = { + enable = mkEnableOption "Enable postgresql"; + + package = mkOption { + type = package; + default = pkgs.postgresql_17; + description = "Postgresql package"; + }; + + configurations = mkOption { + type = listOf str; + default = []; + description = "Creates users and database"; + }; + + dataDir = mkOption { + type = str; + default = "/var/lib/postgresql/"; + description = "DB data dir"; + }; + + authentication = mkOption { + type = str; + default = "local all all trust"; + description = "Auth settings"; + }; + + enableTCPIP = mkEnableOption "Listen all interfaces"; + }; + }; + + config = mkIf cfg.enable { + services.postgresql = let + inherit (cfg) configurations; + + ensureDatabases = ["root"] ++ configurations; + + ensureUsers = + map (name: { + inherit name; + ensureDBOwnership = true; + ensureClauses = + if name == "root" + then { + createdb = true; + createrole = true; + superuser = true; + } + else {}; + }) + ensureDatabases; + in { + inherit ensureDatabases ensureUsers; + inherit (cfg) dataDir authentication enableTCPIP package; + + enable = true; + }; + }; +} diff --git a/system/nixos/modules/services/privatebin/default.nix b/system/nixos/modules/services/privatebin/default.nix new file mode 100644 index 0000000..f14a09a --- /dev/null +++ b/system/nixos/modules/services/privatebin/default.nix @@ -0,0 +1,72 @@ +{ + lib, + config, + ... +}: let + inherit (lib) mkEnableOption mkIf mkOption; + inherit (lib.types) str; + + cfg = config.module.services.privatebin; +in { + options = { + module.services.privatebin = { + enable = mkEnableOption "Enable privatebin"; + + domain = mkOption { + type = str; + default = "paste.example.com"; + description = "PrivateBin domain"; + }; + + name = mkOption { + type = str; + default = "PrivateBin"; + description = "PrivateBin site name"; + }; + }; + }; + + config = mkIf cfg.enable { + services.privatebin = { + enable = true; + enableNginx = true; + virtualHost = cfg.domain; + + settings = { + main = { + inherit (cfg) name; + + compression = "none"; + defaultformatter = "plaintext"; + discussion = false; + email = true; + fileupload = false; + languageselection = false; + password = true; + qrcode = true; + sizelimit = 10 * 1000 * 1000; + template = "bootstrap"; + }; + + expire = { + default = "1week"; + }; + + formatter_options = { + markdown = "Markdown"; + plaintext = "Plain Text"; + syntaxhighlighting = "Source Code"; + }; + + traffic = { + limit = 10; + }; + + purge = { + limit = 0; + batchsize = 10; + }; + }; + }; + }; +} diff --git a/system/nixos/modules/services/ssh/default.nix b/system/nixos/modules/services/ssh/default.nix index 20826aa..2bf3e31 100644 --- a/system/nixos/modules/services/ssh/default.nix +++ b/system/nixos/modules/services/ssh/default.nix @@ -40,11 +40,12 @@ in { services.openssh = { inherit (cfg) listenAddresses; + enable = true; settings = { PermitRootLogin = "no"; - PasswordAuthentication = true; + PasswordAuthentication = false; }; }; }; diff --git a/system/nixos/modules/services/uptime-kuma/default.nix b/system/nixos/modules/services/uptime-kuma/default.nix new file mode 100644 index 0000000..fe6dbbe --- /dev/null +++ b/system/nixos/modules/services/uptime-kuma/default.nix @@ -0,0 +1,33 @@ +{ + lib, + config, + ... +}: let + inherit (lib) mkEnableOption mkIf mkForce; + + cfg = config.module.services.uptime-kuma; +in { + options = { + module.services.uptime-kuma = { + enable = mkEnableOption "Enables uptime-kuma"; + }; + }; + + config = mkIf cfg.enable { + services.uptime-kuma = { + enable = true; + + settings = { + DATA_DIR = "/var/lib/uptime-kuma/"; + PORT = "64901"; + HOST = "127.0.0.1"; + }; + }; + + systemd.services.uptime-kuma = { + serviceConfig = { + DynamicUser = mkForce false; + }; + }; + }; +} diff --git a/system/nixos/modules/services/vaultwarden/default.nix b/system/nixos/modules/services/vaultwarden/default.nix new file mode 100644 index 0000000..2a0c3c6 --- /dev/null +++ b/system/nixos/modules/services/vaultwarden/default.nix @@ -0,0 +1,42 @@ +{ + lib, + config, + ... +}: let + inherit (lib) mkEnableOption mkIf mkOption; + inherit (lib.types) str attrs oneOf path; + + cfg = config.module.services.vaultwarden; +in { + options = { + module.services.vaultwarden = { + enable = mkEnableOption "Enable vaultwarden"; + + dbBackend = mkOption { + type = str; + default = "sqlite"; + description = "Db type for vaultwarden"; + }; + + environmentFile = mkOption { + type = oneOf [str path]; + default = "/run/secrets/vaultwarden/env"; + description = "Secrets in env for vaultwarden"; + }; + + config = mkOption { + type = attrs; + default = {}; + description = "Vaultwarden env"; + }; + }; + }; + + config = mkIf cfg.enable { + services.vaultwarden = { + inherit (cfg) dbBackend environmentFile config; + + enable = true; + }; + }; +} diff --git a/system/nixos/modules/timedate/default.nix b/system/nixos/modules/timedate/default.nix index 53cc4d4..4130bf7 100644 --- a/system/nixos/modules/timedate/default.nix +++ b/system/nixos/modules/timedate/default.nix @@ -14,6 +14,6 @@ in { config = mkIf cfg.enable { # Time settings time.timeZone = "Europe/Moscow"; - services.chrony.enable = true; + services.ntpd-rs.enable = true; }; } diff --git a/system/nixos/modules/xdg/default.nix b/system/nixos/modules/xdg/default.nix new file mode 100644 index 0000000..8ea2c03 --- /dev/null +++ b/system/nixos/modules/xdg/default.nix @@ -0,0 +1,29 @@ +{ + lib, + config, + ... +}: let + inherit (lib) mkEnableOption mkIf; + + cfg = config.module.xdg; +in { + options = { + module.xdg = { + enable = mkEnableOption "Enables xdg"; + }; + }; + + config = mkIf cfg.enable { + xdg = { + terminal-exec = { + enable = true; + + settings = { + default = [ + "${config.module.defaults.terminal}.desktop" + ]; + }; + }; + }; + }; +}