diff options
Diffstat (limited to 'nix/hosts')
33 files changed, 986 insertions, 394 deletions
diff --git a/nix/hosts/caladan/darwin-configuration.nix b/nix/hosts/caladan/darwin-configuration.nix index ef18642..6fdbdaa 100644 --- a/nix/hosts/caladan/darwin-configuration.nix +++ b/nix/hosts/caladan/darwin-configuration.nix @@ -85,10 +85,10 @@ { hostName = "corrino.emile.space"; system = "x86_64-linux"; - maxJobs = 16; + maxJobs = 10; speedFactor = 2; - # Feature | Derivations requiring it + # Feature | Derivations requiring it # ----------------|----------------------------------------------------- # kvm | Everything which builds inside a vm, like NixOS tests # nixos-test | Machine can run NixOS tests @@ -110,8 +110,9 @@ ]; }; - nixpkgs = { - config.allowUnfree = true; + nixpkgs.config = { + allowUnfree = true; + allowUnsupportedSystem = true; }; services.nix-daemon.enable = true; diff --git a/nix/hosts/caladan/emacs_config.el b/nix/hosts/caladan/emacs_config.el new file mode 100644 index 0000000..01cf5bd --- /dev/null +++ b/nix/hosts/caladan/emacs_config.el @@ -0,0 +1,203 @@ +;;; emacs-config --- My emacs config + +;;; Commentary: +;;; This is my (currently often changing) Emacs config + +;;; Code: + +(require 'package) +(package-initialize) +(add-to-list 'package-archives + '("melpa" . "https://melpa.org/packages/") t) + +(unless package-archive-contents + (package-refresh-contents)) + +(dolist (package '(use-package sly corfu org)) + (unless (package-installed-p package) + (package-install package))) + +(scroll-bar-mode -1) +(load-theme 'leuven) ;; light theme +(setq pixel-scroll-precision-mode 1) +(xterm-mouse-mode 1) + +(setq standard-indent 2) +(setq create-lockfiles nil) +(setq delete-old-versions -1) +(setq make-backup-files nil) ; stop creating ~ files +(setq version-control t) +(setq coding-system-for-write 'utf-8) +(setq-default indent-tabs-mode nil) ;; use spaces, not tabs +(setq show-paren-delay 0) +(show-paren-mode) + +(setq custom-file (expand-file-name "custom.el" user-emacs-directory)) + +(add-to-list 'display-buffer-alist + '("\\`\\*\\(Warnings\\|Compile-Log\\)\\*\\'" + (display-buffer-no-window) + (allow-no-window . t))) + +;; general purpose emacs settings +(use-package emacs + :init + + ;; do not allow cursor in the minibuffer prompt + (setq minibuffer-prompt-properties + '(read-only t cursor-intangible t face minibuffer-prompt)) + (add-hook 'minibuffer-setup-hook #'cursor-intangible-mode) + + ;; support opening new minibuffers from inside existing minibuffers + (setq enable-recursive-minibuffers t) + + ;; Emacs 28 and newer: Hide commands in M-x which do not work in the current + ;; mode. Vertico commands are hidden in normal buffers. This setting is + ;; useful beyond Vertico. + (setq read-extended-command-predicate #'command-completion-default-include-p)) + +;; org-mode +(use-package org) +(define-key global-map "\C-cl" 'org-store-link) +(define-key global-map "\C-ca" 'org-agenda) +(setq org-log-done t) + +;; =============== plugins ================== + +;; Corfu - COmpletion in Region FUnction +;; https://github.com/minad/corfu +(declare-function global-corfu-mode "proced") +(declare-function corfu-history-mode "proced") +(declare-function corfu-mode "proced") +(defvar corfu-map) +(use-package corfu + :custom + (corfu-cycle-tab t) + (corfu-auto t) + (corfu-auto-prefix 2) + (corfu-auto-delay 0.0) + (corfu-quit-at-boundary 'separator) + (corfu-echo-documentation 0.5) + (corfu-preview-current 'insert) + (corfu-preselect 'prompt) + :bind (:map corfu-map + ("M-SPC" . corfu-insert-separator) + ("RET" . nil) + ("TAB" . corfu-next) + ([tab] . corfu-next) + ("S-TAB" . corfu-previous) + ([backtab] . corfu-previous) + ("S-<return>" . corfu-insert)) + :init + (global-corfu-mode) + (corfu-history-mode) + + :config + (add-hook 'eshell-mode-hook + (lambda () + (setq-local corfu-quit-at-boundary t + corfu-quit-no-match t + corfu-auto nil) + (corfu-mode)))) + +;; Marginalia - Marginalia in the minibuffer +;; https://github.com/minad/marginalia +(declare-function marginalia-mode "proced") +(use-package marginalia + :custom + (marginalia-max-relative-age 0) + (marginalia-align 'right) + :init + (marginalia-mode)) + +;; == Fancy icons == +;; all-the-icons +;; https://github.com/domtronn/all-the-icons.el +(use-package all-the-icons + :if (display-graphic-p)) + +;; ... also in completions +(declare-function all-the-icons-completion-mode "proced") +(use-package all-the-icons-completion + :after (marginalia all-the-icons) + :hook (marginalia . all-the-icons-completion-marginalia-setup) + :init (all-the-icons-completion-mode)) + +;; vectico.el - VERTical Interactive COmpletion +;; https://github.com/minad/vertico +(declare-function vertico-mode "proced") +(use-package vertico + :init (vertico-mode) + :custom (vertico-count 13) + (vertico-resize t) + (vertico-cycle nil) + :config (vertico-mode)) + +;; orderless - completion +;; This allows searching for space separated terms in any order +;; https://github.com/oantolin/orderless +(use-package orderless + :init (setq completion-styles '(orderless basic) + completion-category-defaults nil + completion-category-overrides '((file (styles partial-completion))))) + + +;; markdown mode +;; https://jblevins.org/projects/markdown-mode/ +(defvar markdown-command) +(use-package markdown-mode + :ensure t + :mode ("README\\.md\\'" . gfm-mode) + :init (setq markdown-command "multimarkdown")) + +;; Minibuffer with help when waiting too long +;; In emacs per default with Emacs v30 +(declare-function which-key-mode "proced") +(defvar which-key-idle-delay) +(defvar which-key-idle-secondary-delay) +(use-package which-key + :ensure t + :config + (setq which-key-idle-delay 0.1) + (setq which-key-idle-secondary-delay 0.1) + (which-key-mode)) + +;; flycheck - Syntax checking for GNU Emacs¶ +;; https://www.flycheck.org/en/latest/ +(declare-function global-flycheck-mode "proced") +(use-package flycheck + :ensure t + :init (global-flycheck-mode)) + +;; allow the deletion of selected text (don't know why this isn't implemented by default) +(use-package delsel + :ensure nil ; no need to install it as it is built-in, but needs to be activated + :hook (after-init . delete-selection-mode)) + +;; Configure the Lisp program for SLY +(add-to-list 'exec-path "/Users/emile/.nix-profile/bin") +(defvar inferior-lisp-program "sbcl") + +;; configure parinfer to be enabled as a mode when the major lisp mode is enabled +(add-to-list 'load-path "/Users/emile/parinfer-rust") +(add-hook 'emacs-lisp-mode 'parinfer-rust-mode) +(declare-function lispy-mode "proced") +(add-hook 'emacs-lisp-mods (lambda () (lispy-mode 1))) + +;; pixel perfect ultra precise low latency scrolling +(declare-function ultra-scroll-mode "proced") +(use-package ultra-scroll + ; if you git clone'd instead of package-vc-install + ;:load-path "~/code/emacs/ultra-scroll" + + :init + (setq scroll-conservatively 101 ; important! + scroll-margin 0) + :config + (ultra-scroll-mode 1)) + +(use-package breadcrumb + :ensure t) + +(provide '.emacs) +;;; emacs_config.el ends here diff --git a/nix/hosts/caladan/home_emile.nix b/nix/hosts/caladan/home_emile.nix index 2a52db9..545c4d5 100644 --- a/nix/hosts/caladan/home_emile.nix +++ b/nix/hosts/caladan/home_emile.nix @@ -1,4 +1,4 @@ -{ pkgs, ... }: +{ lib, pkgs, ... }: { home = { @@ -60,6 +60,18 @@ ''; }; + neovim = let + custom_plugins = pkgs.callPackage ./nvim_plugins.nix { }; + in { + enable = true; + plugins = with pkgs.vimPlugins // custom_plugins; [ + neovim-ayu + lisp.vlime + ]; + extraConfig = '' + ''; + }; + emacs = { enable = true; package = pkgs.emacs; @@ -69,299 +81,8 @@ magit # Git parinfer-rust-mode # Lisp Parens tuareg # OCaml - howm # Notes ]; - extraConfig = '' - (require 'package) - (package-initialize) - (add-to-list 'package-archives - '("melpa" . "https://melpa.org/packages/") t) - (unless package-archive-contents - (package-refresh-contents)) - - (dolist (package '(use-package sly corfu org)) - (unless (package-installed-p package) - (package-install package))) - - (when (display-graphic-p) - (tool-bar-mode 0) - (scroll-bar-mode 'left)) - - (load-theme 'leuven) ;; light theme - (setq pixel-scroll-precision-mode 1) - - (setq standard-indent 2) - (setq create-lockfiles nil) - (setq delete-old-versions -1) - (setq make-backup-files nil) ; stop creating ~ files - (setq version-control t) - (setq coding-system-for-write 'utf-8) - (setq-default indent-tabs-mode nil) ;; use spaces, not tabs - (setq show-paren-delay 0) - (show-paren-mode) - - (setq custom-file (expand-file-name "custom.el" user-emacs-directory)) - - (add-to-list 'display-buffer-alist - '("\\`\\*\\(Warnings\\|Compile-Log\\)\\*\\'" - (display-buffer-no-window) - (allow-no-window . t))) - - ;; general purpose emacs settings - (use-package emacs - :init - - ;; do not allow cursor in the minibuffer prompt - (setq minibuffer-prompt-properties - '(read-only t cursor-intangible t face minibuffer-prompt)) - (add-hook 'minibuffer-setup-hook #'cursor-intangible-mode) - - ;; support opening new minibuffers from inside existing minibuffers - (setq enable-recursive-minibuffers t) - - ;; Emacs 28 and newer: Hide commands in M-x which do not work in the current - ;; mode. Vertico commands are hidden in normal buffers. This setting is - ;; useful beyond Vertico. - (setq read-extended-command-predicate #'command-completion-default-include-p)) - - ;; Add "lisp" to the list of languages babel is allowed to eval - ;(setq-default org-babel-lisp-eval-fn #'sly-eval) - (org-babel-do-load-languages - 'org-babel-load-languages - '((lisp . t))) - - ;; org-mode - (use-package org) - (define-key global-map "\C-cl" 'org-store-link) - (define-key global-map "\C-ca" 'org-agenda) - (setq org-log-done t) - - ;; =============== plugins ================== - - ;; Corfu - COmpletion in Region FUnction - ;; https://github.com/minad/corfu - (use-package corfu - :custom - (corfu-cycle-tab t) - (corfu-auto t) - (corfu-auto-prefix 2) - (corfu-auto-delay 0.0) - (corfu-quit-at-boundary 'separator) - (corfu-echo-documentation 0.5) - (corfu-preview-current 'insert) - (corfu-preselect 'prompt) - :bind (:map corfu-map - ("M-SPC" . corfu-insert-separator) - ("RET" . nil) - ("TAB" . corfu-next) - ([tab] . corfu-next) - ("S-TAB" . corfu-previous) - ([backtab] . corfu-previous) - ("S-<return>" . corfu-insert)) - :init - (global-corfu-mode) - (corfu-history-mode) - - :config - (add-hook 'eshell-mode-hook - (lambda () - (setq-local corfu-quit-at-boundary t - corfu-quit-no-match t - corfu-auto nil) - (corfu-mode)))) - - ;; Marginalia - Marginalia in the minibuffer - ;; https://github.com/minad/marginalia - (use-package marginalia - :custom - (marginalia-max-relative-age 0) - (marginalia-align 'right) - :init - (marginalia-mode)) - - ;; == Fancy icons == - ;; all-the-icons - ;; https://github.com/domtronn/all-the-icons.el - (use-package all-the-icons - :if (display-graphic-p)) - - ;; ... also in completions - (use-package all-the-icons-completion - :after (marginalia all-the-icons) - :hook (marginalia . all-the-icons-completion-marginalia-setup) - :init (all-the-icons-completion-mode)) - - ;; vectico.el - VERTical Interactive COmpletion - ;; https://github.com/minad/vertico - (use-package vertico - :init (vertico-mode) - :custom (vertico-count 13) - (vertico-resize t) - (vertico-cycle nil) - :config (vertico-mode)) - - ;; orderless - completion - ;; This allows searching for space separated terms in any order - ;; https://github.com/oantolin/orderless - (use-package orderless - :init (setq completion-styles '(orderless basic) - completion-category-defaults nil - completion-category-overrides '((file (styles partial-completion))) - )) - - - ;; markdown mode - ;; https://jblevins.org/projects/markdown-mode/ - (use-package markdown-mode - :ensure t - :mode ("README\\.md\\'" . gfm-mode) - :init (setq markdown-command "multimarkdown")) - - ;; Minibuffer with help when waiting too long - ;; In emacs per default with Emacs v30 - (use-package which-key - :ensure t - :config - (setq which-key-idle-delay 0.1) - (setq which-key-idle-secondary-delay 0.1) - (which-key-mode)) - - ;; imenu-list - Display imenu (symbols) in a separate buffer - ;; https://github.com/bmag/imenu-list - (use-package imenu-list :ensure t - :init - (setq imenu-list-auto-resize t) - (setq imenu-list-focus-after-activation t)) - - ;; flycheck - Syntax checking for GNU Emacs¶ - ;; https://www.flycheck.org/en/latest/ - (use-package flycheck - :ensure t - :init (global-flycheck-mode)) - - ;; allow the deletion of selected text (don't know why this isn't implemented by default) - (use-package delsel - :ensure nil ; no need to install it as it is built-in, but needs to be activated - :hook (after-init . delete-selection-mode)) - - ; howm mode - ; (require 'howm) - (use-package howm - :ensure t - :init - ;; Where to store the files? - (setq howm-file-name-format "%Y/%m/%Y-%m-%d-%H%M%S.md") - (setq howm-view-title-header "#") ; markdown mode! - (setq howm-directory "~/Notes") - (setq howm-home-directory howm-directory) - (setq howm-keyword-file (expand-file-name ".howm-keys" howm-home-directory)) - (setq howm-history-file (expand-file-name ".howm-history" howm-home-directory)) - - ;; Use ripgrep as grep - (setq howm-view-use-grep t) - (setq howm-view-grep-command "rg") - (setq howm-view-grep-option "-nH --no-heading --color never") - (setq howm-view-grep-extended-option nil) - (setq howm-view-grep-fixed-option "-F") - (setq howm-view-grep-expr-option nil) - (setq howm-view-grep-file-stdin-option nil)) - - - ;; Rename buffers to their title - (add-hook 'howm-mode-hook 'howm-mode-set-buffer-name) - (add-hook 'after-save-hook 'howm-mode-set-buffer-name) - - ; OCaml mode - (use-package tuareg) - (setq tuareg-indent-align-with-first-arg t) - - (defun insert-date () - "Insert today's date at point" - (interactive "*") - (insert (format-time-string "%F"))) - (global-set-key (kbd "C-c C-.") #'insert-date) - - - ;; Configure the Lisp program for SLIME - (add-to-list 'exec-path "/Users/emile/.nix-profile/bin") - (defvar inferior-lisp-program "sbcl") - - ;; configure parinfer to be enabled as a mode when the major lisp mode is enabled - (add-to-list 'load-path "/Users/emile/parinfer-rust") - (add-hook 'emacs-lisp-mode 'parinfer-rust-mode) - (add-hook 'emacs-lisp-mods (lambda () (lispy-mode 1))) - - ;; erc (emacs irc) settings - (use-package erc - :config - (setopt erc-modules - (seq-union '(sals nicks bufbar nickbar scrolltobottom) - etc-modules)) - (setopt erc-sasl-mechanism 'external) - - - :custom - (erc-prompt-for-nickserv-password nil) - (erc-inhibit-multiline-input t) - (erc-send-whitespace-lines t) - (erc-ask-about-multiline-input t) - (erc-server-reconnect-timeout 30) - (erc-interactive-display 'buffer) - - (erc-autojoin-timing 'ident) - (erc-autojoin-channels-alist '((Libera.Chat "#r2wars"))) - - :bind - ;; Insert \n when hitting <RET> and send messages using C-c C-c - (:map erc-mode-map - ("RET" . nil) - ("C-c C-c" . #'erc-send-current-line))) - - (use-package ultra-scroll - ; if you git clone'd instead of package-vc-install - ;:load-path "~/code/emacs/ultra-scroll" - - :init - (setq scroll-conservatively 101 ; important! - scroll-margin 0) - :config - (ultra-scroll-mode 1)) - - (global-set-key (kbd "C-c e l") (lambda () - (interactive) - (if (get-buffer "irc.libera.chat") - (erc-track-switch-buffer 1) - (when (y-or-n-p "Start ERC? ") - (erc-tls :server "irc.libera.chat" - :port 6697 - :nick "hanemile" - :client-certificate - '(,(expand-file-name "~/libera.key") - ,(expand-file-name "~/libera.crt"))))))) - - (use-package org-roam - :ensure t - :custom - (org-roam-directory (file-truename "/Users/emile/notes")) - :bind (("C-c n l" . org-roam-buffer-toggle) - ("C-c n f" . org-roam-node-find) - ("C-c n g" . org-roam-graph) - ("C-c n i" . org-roam-node-insert) - ("C-c n c" . org-roam-capture) - ;; Dailies - ("C-c n j" . org-roam-dailies-capture-today)) - :config - - ;; If you're using a vertical completion framework, you might want a more informative completion interface - (setq org-roam-node-display-template - (concat "${title:*} " (propertize "${tags:10}" 'face 'org-tag))) - (org-roam-db-autosync-mode) - - ;; If using org-roam-protocol - (require 'org-roam-protocol)) - - (provide '.emacs) ; makes flycheck happy - ''; + extraConfig = builtins.readFile ./emacs_config.el; }; kitty = { @@ -465,7 +186,7 @@ nixos-rebuild # editor - unstable.helix + unstable-darwin.helix ## formatter nixfmt-rfc-style # official formatter for nix code @@ -491,6 +212,7 @@ # go foo go delve + gotools # c foo cmake @@ -540,6 +262,12 @@ drawio + # cargo rustup + cargo + + # custom + libc-database + # blender # rustdesk diff --git a/nix/hosts/caladan/nvim_plugins.nix b/nix/hosts/caladan/nvim_plugins.nix new file mode 100644 index 0000000..7f07816 --- /dev/null +++ b/nix/hosts/caladan/nvim_plugins.nix @@ -0,0 +1,21 @@ +{ vimUtils, fetchgit, ... }: + +let + build = ({name, owner, rev, sha256}: vimUtils.buildVimPlugin { + inherit name; + src = fetchgit { + inherit rev sha256; + url = "https://github.com/${owner}/${name}"; + }; + dependencies = []; + }); +in { + lisp = { + vlime = build { + name = "vlime"; + owner = "l04m33"; + rev = "065b95f3ac7a455314c2bdefeb2b792f290034df"; + sha256 = "1bmmskdwvbl6lvbnjp9lls86rz0vzmk73y644bjb9ix9ygmjbia4"; + }; + }; +} diff --git a/nix/hosts/caladan/overlay.nix b/nix/hosts/caladan/overlay.nix index c9bdd79..8f3b810 100644 --- a/nix/hosts/caladan/overlay.nix +++ b/nix/hosts/caladan/overlay.nix @@ -33,11 +33,6 @@ rm tools/utils/passwd_test.go ''; }); - - # helix-2303 = self.callPackage ../../pkgs/helix-2303 { }; - # r2 = self.callPackage ../../pkgs/radare2-5.8.4 { }; - # ansel = self.callPackage ../../pkgs/ansel { }; - # typst = self.callPackage ../pkgs/radare2-5.8.4 { }; }) ]; config = { diff --git a/nix/hosts/chusuk/configuration.nix b/nix/hosts/chusuk/configuration.nix index 5ec116f..364a1c6 100644 --- a/nix/hosts/chusuk/configuration.nix +++ b/nix/hosts/chusuk/configuration.nix @@ -116,15 +116,13 @@ services = { openssh.enable = true; tailscale.enable = true; + displayManager.defaultSession = "none+i3"; xserver = { enable = true; desktopManager = { xterm.enable = false; }; - displayManager = { - defaultSession = "none+i3"; - }; windowManager.i3 = { enable = true; diff --git a/nix/hosts/corrino/configuration.nix b/nix/hosts/corrino/configuration.nix index eed5076..2f8954b 100644 --- a/nix/hosts/corrino/configuration.nix +++ b/nix/hosts/corrino/configuration.nix @@ -22,16 +22,19 @@ in ./hardware-configuration.nix ./ports.nix + # ./vm.nix ./www/git ./www/nix-cache + ./www/goapp.emile.space.nix + # screego # web ./www/emile.space.nix ./www/tmp.emile.space.nix - # ./www/hydra.emile.space.nix + ./www/hydra.emile.space.nix ./www/netbox.emile.space.nix ./www/stats.emile.space.nix # ./www/grafana.emile.space.nix @@ -41,14 +44,15 @@ in ./www/photo - # ./www/tickets.emile.space.nix - ./www/talks.emile.space.nix + ./www/tickets.emile.space.nix + # ./www/talks.emile.space.nix + ./www/miniflux.emile.space.nix # ./www/stream.emile.space.nix ./www/md.emile.space.nix ./www/social.emile.space.nix ./www/sso.emile.space.nix ./www/s3.emile.space.nix - ./www/cs.emile.space.nix + # ./www/cs.emile.space.nix ./www/irc.emile.space.nix # ./www/db.emile.space.nix @@ -479,20 +483,22 @@ in "kvm" ]; } - # { - # hostName = "caladan.pinto-pike.ts.net"; - # system = "aarch64-darwin"; - # protocol = "ssh-ng"; - # maxJobs = 1; - # speedFactor = 2; - # supportedFeatures = [ - # "nixos-test" - # "benchmark" - # "big-parallel" - # "kvm" - # ]; - # mandatoryFeatures = [ ]; - # } + { + hostName = "caladan.pinto-pike.ts.net"; + sshUser = "hydra"; + sshKey = "/var/lib/hydra/.ssh/id_ed25519"; + system = "aarch64-darwin"; + protocol = "ssh-ng"; + maxJobs = 1; + speedFactor = 2; + supportedFeatures = [ + "nixos-test" + "benchmark" + "big-parallel" + "kvm" + ]; + mandatoryFeatures = [ ]; + } ]; distributedBuilds = true; @@ -551,13 +557,25 @@ in }; "/mnt/storagebox-bx11" = { - device = "//u331921.your-storagebox.de/backup"; - fsType = "cifs"; - options = - let - automount_opts = "_netdev,x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s"; - in - [ "${automount_opts},credentials=${config.age.secrets.storage_box_bx11_password.path}" ]; + device = "u331921@u331921.your-storagebox.de:/home/backup"; + fsType = "sshfs"; + options = [ # Filesystem options + "allow_other" # for non-root access + "_netdev" # this is a network fs + + # We don't mount on demand, as that will cause services like navidrome to fail + # as the share doesn't yet exist. + #"x-systemd.automount" # mount on demand, rather than boot + + #"debug" # print debug logging + # warning: this causes the one-shot service to never exit + + # SSH options + "StrictHostKeyChecking=no" # prevent the connection from failing if the host's key hasn't been trusted yet + "ServerAliveInterval=15" # keep connections alive + "Port=23" + "IdentityFile=/root/.ssh/id_ed25519" + ]; }; }; diff --git a/nix/hosts/corrino/ports.nix b/nix/hosts/corrino/ports.nix index 10ae593..bb64934 100644 --- a/nix/hosts/corrino/ports.nix +++ b/nix/hosts/corrino/ports.nix @@ -24,6 +24,7 @@ restic = 8002; nocodb = 8003; goatcounter = 8004; + goapp = 8005; r2wars-web = 8089; ctf = 8338; magic-hash = 8339; diff --git a/nix/hosts/corrino/secrets/garage_admin_metrics_secret.age b/nix/hosts/corrino/secrets/garage_admin_metrics_secret.age new file mode 100644 index 0000000..e1af7da --- /dev/null +++ b/nix/hosts/corrino/secrets/garage_admin_metrics_secret.age @@ -0,0 +1,7 @@ +age-encryption.org/v1 +-> ssh-ed25519 gvwQ2Q 7QkcpYGeeMsbW0GcXzNGPTc0jUf4ydpMiTO6ZxEIKGY +OOxq2hMORsmUzBuoqOIPNJeLqJB0seve9PhorS6PKNs +-> ssh-ed25519 m8VklA pF7mWG6tviFC6qD88dxoQRnXGfR0AuanVyY+bh8XgV0 +mrk4HgEs3i8y5P+BSGM1psweXpY/xO+8vK/DsXyhyiY +--- zqEl/ZN/3jEgMZ/IbPbyTHGZJDDENLOnoQezaACeoSs + l,±W`\6yh. o V(?Em, ;(@0dVA =4v \ No newline at end of file diff --git a/nix/hosts/corrino/secrets/garage_admin_token_secret.age b/nix/hosts/corrino/secrets/garage_admin_token_secret.age new file mode 100644 index 0000000..2a18a6b --- /dev/null +++ b/nix/hosts/corrino/secrets/garage_admin_token_secret.age @@ -0,0 +1,7 @@ +age-encryption.org/v1 +-> ssh-ed25519 gvwQ2Q hcMMVkZSsObrOFjetml2z4eH+EfnuSsna+GaXEeMUA4 +y6lFBj49cMhOGuJBpILHsykpBMpKDHZpFXR4E4zZEbg +-> ssh-ed25519 m8VklA Z6zLilTWlGWG17Q6jBx13m3KYs3gE93TPLq0CidHeTA +eqMN5mDMasi/Nw2y5Kgwy2COna+3zbbFTTUrD/O26ls +--- QdVyqrTLmEcGSB37Ft3Ur0Ry9Jk9DyHFI6fo88tnsgI +X`wY,<A$XeDGe ;െ>1nsNr_Y\` )F#{ < \ No newline at end of file diff --git a/nix/hosts/corrino/secrets/garage_env.age b/nix/hosts/corrino/secrets/garage_env.age new file mode 100644 index 0000000..becb511 --- /dev/null +++ b/nix/hosts/corrino/secrets/garage_env.age Binary files differdiff --git a/nix/hosts/corrino/secrets/garage_rpc_secret.age b/nix/hosts/corrino/secrets/garage_rpc_secret.age index e228d0d..ce8a65a 100644 --- a/nix/hosts/corrino/secrets/garage_rpc_secret.age +++ b/nix/hosts/corrino/secrets/garage_rpc_secret.age Binary files differdiff --git a/nix/hosts/corrino/secrets/goapp_oidc_secret.age b/nix/hosts/corrino/secrets/goapp_oidc_secret.age new file mode 100644 index 0000000..ca96981 --- /dev/null +++ b/nix/hosts/corrino/secrets/goapp_oidc_secret.age @@ -0,0 +1,7 @@ +age-encryption.org/v1 +-> ssh-ed25519 gvwQ2Q Efi2feeWex0ApMR1lvO6osGzW58wiT24zLxcvWlThyc +/UnBx5j3slzIBoNhbdp9ccdk/p8rFdr/i602sO3abi4 +-> ssh-ed25519 m8VklA o9Y9PUYV9RTcQIu2PLouB9336WdJVhtrEy61UTF62WU +NQ+VueAUIqP4LGazGz/cOKtDmao4LKRWLj7fT2/0g5c +--- jjCarc6U6Mxp3VtnS7mElpuJhKjc4fjUTd6dicekLgg +AU.#z̥8wwWS1)R?'}l n/TC'>&<b_EƔōKBBylD,@(<4~̌rգ \ No newline at end of file diff --git a/nix/hosts/corrino/secrets/goapp_oidc_session_key.age b/nix/hosts/corrino/secrets/goapp_oidc_session_key.age new file mode 100644 index 0000000..938f97f --- /dev/null +++ b/nix/hosts/corrino/secrets/goapp_oidc_session_key.age @@ -0,0 +1,8 @@ +age-encryption.org/v1 +-> ssh-ed25519 gvwQ2Q BAvDdIEUEgmo963+9Wd5VLJgrp3MBISvWR3+27bfJW8 +NOEj2ObYe/cM2CaqzmbgexSEUNZIEo1ZmvlamJaSOjo +-> ssh-ed25519 m8VklA d/hwd3rGkPD3GDdlOP2XUsi687VH+tfKrAsKnImk+kI +gFAyyMZT5DK7da7YXOf/5gUd4Bi9cEe3ddMKUMuctMU +--- 9tVE+AAvptrlMZe5+UGJGzH9usnxa+ZICbikcRT0PYI +g!X+/0P ;* {Vp!4sa I+/\IԖ,op웘DP7";pPp +%c Uڜ8 \ No newline at end of file diff --git a/nix/hosts/corrino/secrets/miniflux_admin_file.age b/nix/hosts/corrino/secrets/miniflux_admin_file.age new file mode 100644 index 0000000..3e00b9b --- /dev/null +++ b/nix/hosts/corrino/secrets/miniflux_admin_file.age @@ -0,0 +1,7 @@ +age-encryption.org/v1 +-> ssh-ed25519 gvwQ2Q OGds4NLmRiMmVjPTORP3jLe3iEkqrDyTqW4V7ceFfRk +FFdZcsT9ZruNhpY5cb674qpQpK0qzHNwRPCfHvYaKcE +-> ssh-ed25519 m8VklA 84XSPja8dzJEUVR5olwNONVzNn5QrsX+R+WeBHqxXDo +5CVpnTDcO0EG3NsHdFsSABWNBIe3Xe16me13JIOlfos +--- rlIUU/0gYwxIXmpRI5/3mmZXJ+JrG/tE/3IBtpo4uT4 +-9JNVG.l.e? &r;V#ahSJWjhvѳt;3 ϫk(^QU *czFbwPZ uqĉ \ No newline at end of file diff --git a/nix/hosts/corrino/secrets/miniflux_oidc_secret.age b/nix/hosts/corrino/secrets/miniflux_oidc_secret.age new file mode 100644 index 0000000..c16754e --- /dev/null +++ b/nix/hosts/corrino/secrets/miniflux_oidc_secret.age Binary files differdiff --git a/nix/hosts/corrino/secrets/tailscale-corrino-cert.age b/nix/hosts/corrino/secrets/tailscale-corrino-cert.age new file mode 100644 index 0000000..07252cc --- /dev/null +++ b/nix/hosts/corrino/secrets/tailscale-corrino-cert.age Binary files differdiff --git a/nix/hosts/corrino/secrets/tailscale-corrino-key.age b/nix/hosts/corrino/secrets/tailscale-corrino-key.age new file mode 100644 index 0000000..36c132e --- /dev/null +++ b/nix/hosts/corrino/secrets/tailscale-corrino-key.age @@ -0,0 +1,8 @@ +age-encryption.org/v1 +-> ssh-ed25519 gvwQ2Q P6b4m51AxFbXT3OOkgMe/BPZi3240e/Gii3weyMtPxI +fRVIno8tPqh4F6e6TOj6YiW2uL9T3uqkro6EZ1mPXOc +-> ssh-ed25519 m8VklA lRMfdLzmoVybkJJvTlY1lZgkMt1R0wyjA/NFcdRFKDM +CLyqRXYetMUbsGhL8NRQ333WIy/TnJwhWX8UpxyLmbw +--- zTjX+CIXtDurBc+TaT7zQ0xn/5Xx3mIrKkAviqMgn4c +:$+D\[Q.pS<HQWMTLTGxZV '^p NDGF*ڢ:6`ˉ`aMdbN\ȣ ClH7>i_! %n eUVI4 sA6 _kP4-=.dxqt+)4`+E2 R&0__$V}Hojܾ}aB|//@L# IK3Dt +C? 4?u}7! \ No newline at end of file diff --git a/nix/hosts/corrino/vm.nix b/nix/hosts/corrino/vm.nix new file mode 100644 index 0000000..78d818f --- /dev/null +++ b/nix/hosts/corrino/vm.nix @@ -0,0 +1,55 @@ +{ pkgs, ... }: + +{ + services.emile.libvirtnix = { + enable = true; + instances = { + + vm1 = { + domain = { + name = "VM1"; + title = "vm one"; + description = "The first VM"; + id = 1; + + uuid = "E34DE478-1402-45BB-B3FD-FC960549258E"; + genid = "CA1E2462-1E9D-404C-8DDB-19EEF9D9651B"; + + os = { + nvram = { + type = "network"; + source = { + mirror = { + abi = "copy"; + ready = "yes"; + type = "network"; + }; + }; + }; + }; + + packages = { + libvirt = pkgs.libvirt; + qemu = pkgs.qemu; + }; + memory = 1024; + }; + }; + + vm2 = { + domain = { + name = "VM2"; + title = "vm one"; + description = "The second VM"; + id = 2; + + uuid = "E34DE478-1402-45BB-B3FD-FC960549258E"; + genid = "002D0D8F-B21A-4001-92BF-2313707EED9D"; + + memory = 2048; + }; + }; + + }; + }; +} diff --git a/nix/hosts/corrino/www/cs.emile.space.nix b/nix/hosts/corrino/www/cs.emile.space.nix index d07d9b2..e182f9c 100644 --- a/nix/hosts/corrino/www/cs.emile.space.nix +++ b/nix/hosts/corrino/www/cs.emile.space.nix @@ -44,18 +44,17 @@ in services.hound = { enable = true; - config = '' - { - "dbpath": "/var/lib/hound/data", - "max-concurrent-indexers" : 6, - "vcs-config" : { - "git" : { - "detect-ref" : true - } - }, - "repos" : ${repos} - } - ''; + settings = { + title = "cs.emile.space"; + dbpath = "/var/lib/hound/data"; + max-concurrent-indexers = 6; + vcs-config = { + git = { + detect-ref = true; + }; + }; + repos = repos; + }; listen = "127.0.0.1:${toString config.emile.ports.hound}"; }; diff --git a/nix/hosts/corrino/www/goapp.emile.space.nix b/nix/hosts/corrino/www/goapp.emile.space.nix new file mode 100644 index 0000000..361e95a --- /dev/null +++ b/nix/hosts/corrino/www/goapp.emile.space.nix @@ -0,0 +1,89 @@ +{ config, pkgs, ... }: + +{ + services.nginx.virtualHosts."goapp.emile.space" = { + forceSSL = true; + enableACME = true; + + locations = { + "/" = { + proxyPass = "http://${config.services.emile.goapp-frontend.host}:${toString config.services.emile.goapp-frontend.port}"; + }; + }; + }; + + services.authelia.instances.main.settings.identity_providers.oidc.clients = [ + { + id = "goapp"; + + # ; nix run nixpkgs#authelia -- crypto hash generate pbkdf2 --variant sha512 --random --random.length 72 --random.charset rfc3986 + secret = "$pbkdf2-sha512$310000$LPXJRoGR9RyTcaT6cADljg$FK8RV5CnKj5ano4fXmRzzvXcX/00F7k/G6nd67t.8iewpwyq8FntV4JgYZSV8AynYMxz1qnL4j3BzITLCM0KgQ"; + public = false; + authorization_policy = "two_factor"; + redirect_uris = [ + "https://goapp.emile.space/oauth2/callback" + ]; + scopes = [ + "openid" + "email" + "profile" + "groups" + ]; + grant_types = [ + "refresh_token" + "authorization_code" + ]; + response_types = [ "code" ]; + response_modes = [ + "form_post" + "query" + "fragment" + ]; + token_endpoint_auth_method = "client_secret_post"; + } + ]; + + environment.systemPackages = with pkgs; [ goapp-frontend ]; + + # deploy: + # - push code + # - build in order to get the new hash (nix build .#goapp-frontend-pkg) + # - update hash in the package (//nix/templates/goapp/frontent/default.nix) + # - deploy + # + # https://goapp.emile.space/oauth2/callback?code=authelia_ac_iZKCXtRMnj2yjUAmiSkg_LBWjiME2-ghE6KMkxdb6Zw.nDLgCVpu9ctH1llEKUml5rr8szd3bkZYaGa_MAOtNLI&iss=https%3A%2F%2Fsso.emile.space&scope=openid+profile+email+groups&state=random-string-here + # + # Unable to exchange authorization code for tokens + # + # unable to exchange authorization code for tokens: oauth2: "invalid_client" "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method)." + + services.emile.goapp-frontend = { + enable = true; + package = pkgs.goapp-frontend; + + host = "127.0.0.1"; + port = config.emile.ports.goapp; + public-url = "https://goapp.emile.space/"; + + oidc = { + id = "goapp"; + issuer = "https://sso.emile.space"; + cookie-name = "oidc-client"; + scopes = [ + "openid" + "profile" + "email" + "groups" + ]; + # secret-path = "/run/goapp-frontend_oidc_secret"; + secret-path = config.age.secrets.goapp_oidc_secret.path; + }; + + # TODO(emile): change these when going live + session-key-path = config.age.secrets.goapp_oidc_secret.path; + + logfile-path = "/var/log/goapp-frontend.log"; + database-path = "/var/lib/goapp-frontend/main.db"; + sessiondb-path = "/var/lib/goapp-frontend/session.db"; + }; +} diff --git a/nix/hosts/corrino/www/grafana.emile.space.nix b/nix/hosts/corrino/www/grafana.emile.space.nix index 22b444f..f8674a2 100644 --- a/nix/hosts/corrino/www/grafana.emile.space.nix +++ b/nix/hosts/corrino/www/grafana.emile.space.nix @@ -91,19 +91,30 @@ provision = { dashboards.settings = { }; datasources.settings = { + deleteDatasources = [ + { name = "Prometheus"; orgId = 1; } + { name = "Lampadas"; orgId = 1; } + ]; datasources = [ { url = "http://localhost:${toString config.services.prometheus.port}"; type = "prometheus"; - name = "Prometheus"; + name = "Prometheus Corrino"; editable = false; access = "proxy"; # server = "proxy", browser = "direct" } { - name = "loki"; - url = "http://${config.services.loki.configuration.common.instance_addr}:${toString config.services.loki.configuration.server.http_listen_port}"; - type = "loki"; + url = "http://lampadas:9009"; + type = "prometheus"; + name = "Prometheus Lampadas"; + editable = false; + access = "proxy"; # server = "proxy", browser = "direct" } + # { + # name = "loki"; + # url = "http://${config.services.loki.configuration.common.instance_addr}:${toString config.services.loki.configuration.server.http_listen_port}"; + # type = "loki"; + # } ]; }; diff --git a/nix/hosts/corrino/www/hydra.emile.space.nix b/nix/hosts/corrino/www/hydra.emile.space.nix index 941ad5b..a5cdb53 100644 --- a/nix/hosts/corrino/www/hydra.emile.space.nix +++ b/nix/hosts/corrino/www/hydra.emile.space.nix @@ -32,8 +32,6 @@ # Directory that holds Hydra garbage collector roots. gcRootsDir = "/nix/var/nix/gcroots/hydra"; - # a standalone hydra will require you to unset the buildMachinesFiles list to avoid using a nonexistant /etc/nix/hosts - buildMachinesFiles = [ ]; # you will probably also want, otherwise *everything* will be built from scratch useSubstitutes = true; diff --git a/nix/hosts/corrino/www/mc.emile.space.nix b/nix/hosts/corrino/www/mc.emile.space.nix new file mode 100644 index 0000000..8250a1d --- /dev/null +++ b/nix/hosts/corrino/www/mc.emile.space.nix @@ -0,0 +1,150 @@ +{ config, pkgs, ... }: + +{ + services.minecraft-server = { + package = pkgs.minecraft-server; + serverProperties = { + server-port = 43000; + + # 0 peaceful + # 1 easy + # 2 normal + # 3 hard + difficulty = 1; + + # 0 survival + # 1 creative + # 2 adventure + # 5 default + # "spectator" spectator + # gamemode = "survival"; + gamemode = 0; + + max-players = 10; + motd = "Neurodivergenter Hexenzirkel"; + enable-rcon = true; + "rcon.password" = "hunter2"; + enable-command-block = false; + enable-query = false; + spawn-protection = 0; + + white-list = true; + }; + openFirewall = true; + + whitelist = { + "emileemail" = "a7614a53-b8b8-47b7-91cf-860e7c7f325f"; + "dodonator23" = "f93506b6-76e8-437d-927d-dceeb833a33f"; + "ChaosAyumi" = "223040ec-ca30-4238-8b58-c81597c30426"; + "xerunala" = "962e41c8-1da8-4592-9a2f-e36cdb20d5a6"; + "rappet" = "588377a5-362f-4ea1-8195-9cf97dd7a884"; + }; + + jvmOpts = "-Xms4092M -Xmx4092M"; + eula = true; + enable = true; + declarative = true; + dataDir = "/var/lib/minecraft"; + }; + + services.nginx.virtualHosts."mc.emile.space" = { + forceSSL = true; + enableACME = true; + }; + + services.bluemap = { + enable = true; + + enableNginx = true; + host = "mc.emile.space"; + + webappSettings = { + enabled = true; + webroot = config.services.bluemap.webRoot; + }; + + # webserverSettings = {}; + webserverSettings.enabled = false; # using nginx; + webRoot = "/var/lib/bluemap/web"; + + # coreSettings = {}; + coreSettings.data = "/var/lib/bluemap"; + coreSettings.metrics = false; # don't send data to the devs + + storage = { + "file" = { + root = "${config.services.bluemap.webRoot}/maps"; + }; + }; + # storage.<name>.storage-type + + maps = let + worldpath = "/var/lib/minecraft/world"; + in { + "overworld" = { + world = "${worldpath}"; + ambient-light = 0.1; + cave-detection-ocean-floor = -5; + dimension = "minecraft:overworld"; + }; + + "nether" = { + world = "${worldpath}/DIM-1"; + sorting = 100; + sky-color = "#290000"; + void-color = "#150000"; + ambient-light = 0.6; + world-sky-light = 0; + remove-caves-below-y = -10000; + cave-detection-ocean-floor = -5; + cave-detection-uses-block-light = true; + max-y = 90; + dimension = "minecraft:the_nether"; + }; + + "end" = { + world = "${worldpath}/DIM1"; + sorting = 200; + sky-color = "#080010"; + void-color = "#080010"; + ambient-light = 0.6; + world-sky-light = 0; + remove-caves-below-y = -10000; + cave-detection-ocean-floor = -5; + dimension = "minecraft:the_end"; + }; + }; + + # A set of resourcepacks, datapacks, and mods to extract resources from, loaded in alphabetical order. + packs = {}; + + # How often to trigger rendering the map, in the format of a systemd timer onCalendar configuration. See systemd.timer(5). + # + # This one means "every three hours": + # *-*-* */3:00:00 + onCalendar = "*-*-* *:00:00"; + + eula = true; + + enableRender = true; + + # The world used by the default map ruleset. If you configure your own maps you do not need to set this. + # defaultWorld = "${config.services.minecraft.dataDir}/world"; + + addons = {}; + }; + + services.restic.backups."minecraft" = { + repository = "/mnt/storagebox-bx11/minecraft"; + paths = [ "/var/lib/minecraft" ]; + timerConfig = null; + passwordFile = config.age.secrets.restic_password.path; + initialize = true; + pruneOpts = [ + "--keep-daily 7" + "--keep-weekly 5" + "--keep-monthly 12" + "--keep-yearly 75" + ]; + }; +} diff --git a/nix/hosts/corrino/www/md.emile.space.nix b/nix/hosts/corrino/www/md.emile.space.nix index 6088ea0..d94c06c 100644 --- a/nix/hosts/corrino/www/md.emile.space.nix +++ b/nix/hosts/corrino/www/md.emile.space.nix @@ -6,7 +6,7 @@ enableACME = true; locations = { "/" = { - proxyPass = "http://127.0.0.1:${toString config.services.hedgedoc.settings.port}"; + proxyPass = "http://[${config.services.hedgedoc.settings.host}]:${toString config.services.hedgedoc.settings.port}"; }; }; }; @@ -14,10 +14,10 @@ # auth via authelia services.authelia.instances.main.settings.identity_providers.oidc.clients = [ { - id = "HedgeDoc"; + client_id = "HedgeDoc"; # ; nix run nixpkgs#authelia -- crypto hash generate pbkdf2 --variant sha512 --random --random.length 72 --random.charset rfc3986 - secret = "$pbkdf2-sha512$310000$l4Kyec7Q9oY2GAhWA/xMig$P/MYFmulfgsDNyyiclUzd6le0oSiOvqCIvl4op5DkXtVTxLWlMA3ZwhJ6Z7u.OfIREuEM2htH6asxWPhBhkpNQ"; + client_secret = "$pbkdf2-sha512$310000$l4Kyec7Q9oY2GAhWA/xMig$P/MYFmulfgsDNyyiclUzd6le0oSiOvqCIvl4op5DkXtVTxLWlMA3ZwhJ6Z7u.OfIREuEM2htH6asxWPhBhkpNQ"; public = false; authorization_policy = "two_factor"; redirect_uris = [ "https://md.emile.space/auth/oauth2/callback" ]; @@ -47,7 +47,7 @@ environmentFile = config.age.secrets.hedgedoc_environment_variables.path; settings = { - host = "127.0.0.1"; + host = "::1"; port = config.emile.ports.md; domain = "md.emile.space"; @@ -85,6 +85,20 @@ }; }; + services.restic.backups."hedgedoc" = { + repository = "/mnt/storagebox-bx11/hedgedoc"; + paths = [ "/var/lib/hedgedoc" ]; + timerConfig = null; + passwordFile = config.age.secrets.restic_password.path; + initialize = true; + pruneOpts = [ + "--keep-daily 7" + "--keep-weekly 5" + "--keep-monthly 12" + "--keep-yearly 75" + ]; + }; + # backups # services.restic.backups."hedgedoc" = { # user = "u331921"; diff --git a/nix/hosts/corrino/www/miniflux.emile.space.nix b/nix/hosts/corrino/www/miniflux.emile.space.nix new file mode 100644 index 0000000..f5b9817 --- /dev/null +++ b/nix/hosts/corrino/www/miniflux.emile.space.nix @@ -0,0 +1,73 @@ +{ config, pkgs, ... }: + +{ + services.nginx.virtualHosts."miniflux.emile.space" = { + forceSSL = true; + enableACME = true; + locations = { + "/" = { + proxyPass = "http://${config.services.miniflux.config.LISTEN_ADDR}"; + }; + }; + }; + + # auth via authelia + services.authelia.instances.main.settings.identity_providers.oidc.clients = [ + { + id = "miniflux"; + + # ; nix run nixpkgs#authelia -- crypto hash generate pbkdf2 --variant sha512 --random --random.length 72 --random.charset rfc3986 + secret = "$pbkdf2-sha512$310000$rlOuqUDGc/kl3bw7JgcSpg$4COyNudsu/7L8qhnxfcQld5Fy.ru/JUp7RCI7dCHZMtzxRnhckW8A7uz3Xeuc7.BjCIwc4GdWusPt6.TiH6Kpw"; + public = false; + authorization_policy = "two_factor"; + redirect_uris = [ "https://miniflux.emile.space/oauth2/oidc/callback" ]; + scopes = [ + "openid" + "email" + "profile" + ]; + grant_types = [ + "refresh_token" + "authorization_code" + ]; + response_types = [ "code" ]; + response_modes = [ + "form_post" + "query" + "fragment" + ]; + token_endpoint_auth_method = "client_secret_post"; + } + ]; + + services.miniflux = { + enable = true; + package = pkgs.miniflux; + config = { + BASE_URL = "https://miniflux.emile.space"; + + # Cleanup job frequency to remove old sessions and archive entries. + CLEANUP_FREQUENCY = 48; + + # Set to 1 to enable maintenance mode. Maintenance mode disables the web ui and show a text message to the users. + # MAINTENANCE_MODE = 1; + # MAINTENANCE_MESSAGE = "updating foo"; + + OAUTH2_CLIENT_ID = "miniflux"; + OAUTH2_CLIENT_SECRET_FILE = config.age.secrets.miniflux_oidc_secret.path; + OAUTH2_OIDC_DISCOVERY_ENDPOINT = "sso.emile.space"; + OAUTH2_OIDC_PROVIDER_NAME = "authelia"; + OAUTH2_PROVIDER = "oidc"; + OAUTH2_REDIRECT_URL = "https://miniflux.emile.space/oauth2/oidc/callback"; + + LISTEN_ADDR = "[::1]:${toString config.emile.ports.miniflux}"; + }; + createDatabaseLocally = true; + + # File containing the ADMIN_USERNAME and ADMIN_PASSWORD (length >= 6) in the format of an EnvironmentFile=, as described by systemd.exec(5). + adminCredentialsFile = config.age.secrets.miniflux_admin_file.path; + }; + + + +} diff --git a/nix/hosts/corrino/www/sb.emile.space.nix b/nix/hosts/corrino/www/sb.emile.space.nix new file mode 100644 index 0000000..0522e25 --- /dev/null +++ b/nix/hosts/corrino/www/sb.emile.space.nix @@ -0,0 +1,114 @@ +{ config, pkgs, ... }: + +{ + services.nginx.virtualHosts."sb.emile.space" = { + forceSSL = true; + enableACME = true; + locations = { + "/" = { + proxyPass = "http://${config.services.silverbullet.listenAddress}:${toString config.services.silverbullet.listenPort}"; + extraConfig = '' + ## Send a subrequest to Authelia to verify if the user is authenticated and has permission to access the resource. + auth_request /internal/authelia/authz; + + ## Save the upstream metadata response headers from Authelia to variables. + auth_request_set $user $upstream_http_remote_user; + auth_request_set $groups $upstream_http_remote_groups; + auth_request_set $name $upstream_http_remote_name; + auth_request_set $email $upstream_http_remote_email; + + ## Inject the metadata response headers from the variables into the request made to the backend. + proxy_set_header Remote-User $user; + proxy_set_header Remote-Groups $groups; + proxy_set_header Remote-Email $email; + proxy_set_header Remote-Name $name; + + ## Configure the redirection when the authz failure occurs. Lines starting with 'Modern Method' and 'Legacy Method' + ## should be commented / uncommented as pairs. The modern method uses the session cookies configuration's authelia_url + ## value to determine the redirection URL here. It's much simpler and compatible with the mutli-cookie domain easily. + + ## Modern Method: Set the $redirection_url to the Location header of the response to the Authz endpoint. + auth_request_set $redirection_url $upstream_http_location; + + ## Modern Method: When there is a 401 response code from the authz endpoint redirect to the $redirection_url. + error_page 401 =302 $redirection_url; + + ## Legacy Method: Set $target_url to the original requested URL. + ## This requires http_set_misc module, replace 'set_escape_uri' with 'set' if you don't have this module. + # set $target_url $scheme://$http_host$request_uri; + + ## Legacy Method: When there is a 401 response code from the authz endpoint redirect to the portal with the 'rd' + ## URL parameter set to $target_url. This requires users update 'auth.example.com/' with their external authelia URL. + # error_page 401 =302 https://sso.emile.space/?rd=$target_url; + ''; + }; + "/internal/authelia/authz" = { + extraConfig = '' + ## Essential Proxy Configuration + internal; + proxy_pass https://sso.emile.space/api/authz/auth-request; + + ## Headers + ## The headers starting with X-* are required. + proxy_set_header X-Original-Method $request_method; + proxy_set_header X-Original-URL $scheme://$http_host$request_uri; + proxy_set_header X-Forwarded-For $remote_addr; + proxy_set_header Content-Length ""; + proxy_set_header Connection ""; + + ## Basic Proxy Configuration + proxy_pass_request_body off; + proxy_next_upstream error timeout invalid_header http_500 http_502 http_503; # Timeout if the real server is dead + proxy_redirect http:// $scheme://; + proxy_http_version 1.1; + proxy_cache_bypass $cookie_session; + proxy_no_cache $cookie_session; + proxy_buffers 4 32k; + client_body_buffer_size 128k; + + ## Advanced Proxy Configuration + send_timeout 5m; + proxy_read_timeout 240; + proxy_send_timeout 240; + proxy_connect_timeout 240; + ''; + }; + }; + }; + + # auth via authelia + # services.authelia.instances.main.settings.identity_providers.oidc.clients = [ + # { + # id = "silverbullet"; + + # # ; nix run nixpkgs#authelia -- crypto hash generate pbkdf2 --variant sha512 --random --random.length 72 --random.charset rfc3986 + # secret = "$pbkdf2-sha512$310000$mxk7uITQOZNYEqeinigQnw$wsF2S6RPL2zVRg1X0bAuINh8Lu5PuA/2/FYJSy3i/Ig5vtCzaIFb0xYEcus4jkqTIgyp3aBxtgSzAKjQKC.QKg"; + # public = false; + # authorization_policy = "two_factor"; + # redirect_uris = [ "https://md.emile.space/auth/oauth2/callback" ]; + # scopes = [ + # "openid" + # "email" + # "profile" + # ]; + # grant_types = [ + # "refresh_token" + # "authorization_code" + # ]; + # response_types = [ "code" ]; + # response_modes = [ + # "form_post" + # "query" + # "fragment" + # ]; + # token_endpoint_auth_method = "client_secret_post"; + # } + # ]; + + services.silverbullet = { + enable = true; + spaceDir = "/var/lib/silverbullet"; + listenPort = 3000; + listenAddress = "[::1]"; + }; +} diff --git a/nix/hosts/corrino/www/sso.emile.space.nix b/nix/hosts/corrino/www/sso.emile.space.nix index 2596bbe..6ffff80 100644 --- a/nix/hosts/corrino/www/sso.emile.space.nix +++ b/nix/hosts/corrino/www/sso.emile.space.nix @@ -116,9 +116,9 @@ in theme = "dark"; server = { - # address = "127.0.0.1:${toString config.emile.ports.authelia}"; - host = "127.0.0.1"; - port = config.emile.ports.authelia; + address = "127.0.0.1:${toString config.emile.ports.authelia}"; + # host = "127.0.0.1"; + # port = config.emile.ports.authelia; }; # we're using a file to store the user information @@ -141,9 +141,22 @@ in storage.local.path = "/var/lib/authelia-main/db.sqlite"; session = { - domain = "sso.emile.space"; - expiration = 3600; # 1 hour - inactivity = 300; # 5 minutes + # domain = "sso.emile.space"; + # expiration = 3600; # 1 hour + # inactivity = 300; # 5 minutes + + cookies = [ + { + domain = "emile.space"; + authelia_url = "https://sso.emile.space"; + # The period of time the user can be inactive for until the session is destroyed. Useful if you want long session timers but don’t want unused devices to be vulnerable. + inactivity = "1h"; + # The period of time before the cookie expires and the session is destroyed. This is overridden by remember_me when the remember me box is checked. + expiration = "1d"; + # The period of time before the cookie expires and the session is destroyed when the remember me box is checked. Setting this to -1 disables this feature entirely for this session cookie domain + remember_me = "3M"; + } + ]; }; notifier = { @@ -196,6 +209,16 @@ in default_policy = "deny"; rules = [ { + # silverbullet needs access to these without auth + domain = "sb.emile.space"; + policy = "bypass"; + resources = [ + "/.client/manifest.json$" + "/.client/[a-zA-Z0-9_-]+.png$" + "/service_worker.js$" + ]; + } + { domain = "*.emile.space"; policy = "two_factor"; } diff --git a/nix/hosts/hacknix/burpsuitepro/default.nix b/nix/hosts/hacknix/burpsuitepro/default.nix index 8c9605d..a2b76b7 100644 --- a/nix/hosts/hacknix/burpsuitepro/default.nix +++ b/nix/hosts/hacknix/burpsuitepro/default.nix @@ -19,7 +19,7 @@ pkgs.stdenvNoCC.mkDerivation rec { eval "$(${pkgs.unzip}/bin/unzip -p ${src} chromium.properties)" mkdir -p "$HOME/.BurpSuite/burpbrowser/$linux64" ln -sf "${pkgs.chromium}/bin/chromium" "$HOME/.BurpSuite/burpbrowser/$linux64/chrome" - exec ${pkgs.jdk19}/bin/java -jar ${src} "$@"' > $out/bin/burpsuitepro + exec ${pkgs.jdk23}/bin/java -jar ${src} "$@"' > $out/bin/burpsuitepro chmod +x $out/bin/${pname} runHook postInstall ''; @@ -38,7 +38,7 @@ pkgs.stdenvNoCC.mkDerivation rec { downloadPage = "https://portswigger.net/burp/freedownload"; sourceProvenance = with sourceTypes; [ binaryBytecode ]; #license = licenses.unfree; - platforms = pkgs.jdk19.meta.platforms; + platforms = pkgs.jdk23.meta.platforms; hydraPlatforms = [ ]; maintainers = with maintainers; [ hanemile ]; }; diff --git a/nix/hosts/hacknix/configuration.nix b/nix/hosts/hacknix/configuration.nix index 388626c..85a93af 100644 --- a/nix/hosts/hacknix/configuration.nix +++ b/nix/hosts/hacknix/configuration.nix @@ -47,12 +47,15 @@ in services = { dbus.enable = true; + + displayManager.defaultSession = "xfce+i3"; + xserver = { enable = true; # Keyboard settings - layout = "us"; - xkbOptions = "caps:compose"; + xkb.layout = "us"; + xkb.options = "caps:compose"; desktopManager = { xterm.enable = false; @@ -68,7 +71,6 @@ in # default display manager when logging in displayManager = { - defaultSession = "xfce+i3"; sessionCommands = ''''; }; @@ -92,7 +94,7 @@ in # Enable sound. # sound.enable = true; # hardware.pulseaudio.enable = true; - hardware.opengl.enable = true; + hardware.graphics.enable = true; # Enable touchpad support (enabled default in most desktopManager). # services.xserver.libinput.enable = true; @@ -252,7 +254,10 @@ in # started in user sessions. programs = { - vim.defaultEditor = true; + vim = { + enable = true; + defaultEditor = true; + }; htop = { enable = true; diff --git a/nix/hosts/lampadas/configuration.nix b/nix/hosts/lampadas/configuration.nix index cc829d8..007f8a1 100644 --- a/nix/hosts/lampadas/configuration.nix +++ b/nix/hosts/lampadas/configuration.nix @@ -2,7 +2,7 @@ # your system. Help is available in the configuration.nix(5) man page, on # https://search.nixos.org/options and in the NixOS manual (`nixos-help`). -{ pkgs, lib, ... }: +{ config, pkgs, lib, ... }: let emile_keys = [ @@ -17,12 +17,34 @@ in ./hardware-configuration.nix ]; + hardware.fancontrol = { + enable = true; + config = '' + # Configuration file generated by pwmconfig, changes will be lost + INTERVAL=10 + DEVPATH=hwmon0=devices/platform/coretemp.0 hwmon1=devices/platform/nct6775.672 + DEVNAME=hwmon0=coretemp hwmon1=nct6798 + FCTEMPS=hwmon1/pwm3=hwmon0/temp2_input hwmon1/pwm2=hwmon1/temp2_input + FCFANS=hwmon1/pwm3=hwmon1/fan3_input hwmon1/pwm2=hwmon1/fan2_input + MINTEMP=hwmon1/pwm3=35 hwmon1/pwm2=35 + MAXTEMP=hwmon1/pwm3=75 hwmon1/pwm2=75 + MINSTART=hwmon1/pwm3=255 hwmon1/pwm2=255 + MINSTOP=hwmon1/pwm3=30 hwmon1/pwm2=30 + MINPWM=hwmon1/pwm3=30 hwmon1/pwm2=30 + MAXPWM=hwmon1/pwm3=255 hwmon1/pwm2=255 + ''; + }; + boot = { loader = { systemd-boot.enable = true; efi.canTouchEfiVariables = true; }; kernelParams = [ "ip=dhcp" ]; + kernelModules = [ + # fan speed modules, detected using `sensors-detect` + "coretemp" "nct6775" + ]; initrd = { availableKernelModules = [ "r8169" ]; systemd.users.root.shell = "/bin/cryptsetup-askpass"; @@ -159,10 +181,41 @@ in }; # metric exporters - prometheus.exporters = { - node.enable = true; # port 9100 - systemd.enable = true; # port 9558 - smartctl.enable = true; # port 9633 + prometheus = { + enable = true; + port = 9090; + listenAddress = "100.87.209.97"; + scrapeConfigs = [ + { + job_name = "node"; + static_configs = [{ + targets = [ + "localhost:${toString config.services.prometheus.exporters.node.port}" + ]; + }]; + } + { + job_name = "systemd"; + static_configs = [{ + targets = [ + "localhost:${toString config.services.prometheus.exporters.systemd.port}" + ]; + }]; + } + { + job_name = "smartctl"; + static_configs = [{ + targets = [ + "localhost:${toString config.services.prometheus.exporters.smartctl.port}" + ]; + }]; + } + ]; + exporters = { + node.enable = true; # port 9100 + systemd.enable = true; # port 9558 + smartctl.enable = true; # port 9633 + }; }; # shares diff --git a/nix/hosts/lernaeus/configuration.nix b/nix/hosts/lernaeus/configuration.nix index 57cacb9..43297a2 100644 --- a/nix/hosts/lernaeus/configuration.nix +++ b/nix/hosts/lernaeus/configuration.nix @@ -20,13 +20,6 @@ in ./hardware-configuration.nix ]; - ################## - # sound - - sound.enable = true; - - hardware.pulseaudio.enable = true; - hardware.pulseaudio.support32Bit = true; ## If compatibility with 32-bit applications is desired. users.extraUsers.emile.extraGroups = [ "audio" ]; @@ -39,11 +32,8 @@ in }; # Enable OpenGL - hardware.opengl = { - enable = true; - driSupport = true; - driSupport32Bit = true; - }; + hardware.graphics.enable = true; + hardware.graphics.enable32Bit = true; # Load nvidia driver for Xorg and Wayland services.xserver.videoDrivers = [ "nvidia" ]; diff --git a/nix/hosts/mail/mail.nix b/nix/hosts/mail/mail.nix index 9c15e66..2dbfc35 100644 --- a/nix/hosts/mail/mail.nix +++ b/nix/hosts/mail/mail.nix @@ -1,17 +1,27 @@ -{ ... }: +{ config, pkgs, ... }: let - release = "nixos-23.05"; -in -{ + #release = "nixos-21.11"; + # release = "nixos-23.05"; + # release = "nixos-24.05"; + release = "nixos-24.11"; +in { imports = [ (builtins.fetchTarball { # Pick a commit from the branch you are interested in url = "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/${release}/nixos-mailserver-${release}.tar.gz"; # And set its hash - sha256 = "1ngil2shzkf61qxiqw11awyl81cr7ks2kv3r3k243zz7v2xakm5c"; + #sha256 = "1i56llz037x416bw698v8j6arvv622qc0vsycd20lx3yx8n77n44"; + #sha256 = "1ngil2shzkf61qxiqw11awyl81cr7ks2kv3r3k243zz7v2xakm5c"; + #sha256 = "0000000000000000000000000000000000000000000000000000"; + sha256 = "05k4nj2cqz1c5zgqa0c6b8sp3807ps385qca74fgs6cdc415y3qw"; }) ]; + # temporary fix for the issue linked below that showed up after updating to + # nixos-24.05 and the nixos-24.05 release + # https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/issues/275 + services.dovecot2.sieve.extensions = [ "fileinto" ]; + mailserver = { enable = true; fqdn = "mail.emile.space"; @@ -20,10 +30,10 @@ in # A list of all login accounts. To create the password hashes, use # nix run nixpkgs.apacheHttpd -c htpasswd -nbB "" "super secret password" | cut -d: -f2 loginAccounts = { - "mail@emile.space" = { - hashedPasswordFile = "/etc/nixos/keys/mail"; - aliases = [ "@emile.space" ]; - }; + "mail@emile.space" = { + hashedPasswordFile = "/etc/nixos/keys/mail"; + aliases = ["@emile.space"]; + }; }; localDnsResolver = false; @@ -33,12 +43,12 @@ in #certificateScheme = 3; certificateScheme = "acme-nginx"; + # Enable IMAP and POP3 enableImap = true; enablePop3 = true; enableSubmission = true; - # as well with ssl enableImapSsl = true; enablePop3Ssl = true; enableSubmissionSsl = true; @@ -46,6 +56,5 @@ in enableManageSieve = true; virusScanning = false; - }; } |
