feat: Dendritic pattern

This re-write was done with the help of claude, and still needs a
decent amount of changes before it properly follows the dendritic
pattern

2 files changed, 690 insertions, 0 deletions

diff --git a/modules/computers/nixnode.nix b/modules/computers/nixnode.nix
new file mode 100644
index 0000000..3cf6999
--- /dev/null
+++ b/modules/computers/nixnode.nix
@@ -0,0 +1,347 @@
+{ inputs, config, ... }:
+let
+    nixos = config.flake.modules.nixos;
+in
+{
+    flake.nixosConfigurations.nixnode = inputs.nixpkgs.lib.nixosSystem {
+        modules = [ nixos.nixnode ];
+    };
+
+    flake.modules.nixos.nixnode =
+        # Edit this configuration file to define what should be installed on
+        # your system. Help is available in the configuration.nix(5) man page, on
+        # https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
+
+        { config, lib, pkgs, ... }:
+
+        {
+            imports =
+                [
+                    nixos.teh-nix
+                    nixos.linode
+                    inputs.STK.nixosModules.default
+                    inputs.sops.nixosModules.sops
+                    inputs.nixos-mailserver.nixosModules.default
+                    inputs.neodrive-website.nixosModules.default
+                ];
+
+            teh-nix.nix.enable = true;
+
+            # Use the GRUB 2 boot loader.
+            boot.loader.grub.enable = true;
+            # boot.loader.grub.efiSupport = true;
+            # boot.loader.grub.efiInstallAsRemovable = true;
+            # boot.loader.efi.efiSysMountPoint = "/boot/efi";
+            # Define on which hard drive you want to install Grub.
+            # boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
+
+            networking.hostName = "nixnode"; # Define your hostname.
+            # Pick only one of the below networking options.
+            # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+            networking.networkmanager.enable = true;  # Easiest to use and most distros use this by default.
+
+            # Set your time zone.
+            time.timeZone = "NZ";
+
+            # Configure network proxy if necessary
+            # networking.proxy.default = "http://user:password@proxy:port/";
+            # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+            # Select internationalisation properties.
+            # i18n.defaultLocale = "en_US.UTF-8";
+            # console = {
+            #   font = "Lat2-Terminus16";
+            #   keyMap = "us";
+            #   useXkbConfcpfig = true; # use xkb.options in tty.
+            # };
+
+            # Enable the X11 windowing system.
+            # services.xserver.enable = true;
+
+            security.sudo.wheelNeedsPassword = false;
+
+            sops.defaultSopsFile = ../../secrets/general.yaml;
+            sops.defaultSopsFormat = "yaml";
+
+            sops.age.keyFile = "/home/boss/.config/sops/age/keys.txt";
+
+            sops.secrets = {
+                #"wg/nixy/pub" = { };
+                "wg/nixnode/priv" = { };
+                "acme/linode" = {
+                    owner = "acme";
+                    mode = "440";
+                };
+                "mail/boss" = { };
+                "nginx/dashboard-htpasswd" = {
+                    owner = "nginx";
+                    mode = "400";
+                };
+            };
+
+            networking.firewall = {
+                enable = true;
+                allowedTCPPorts = [ 80 443 ];
+                allowedUDPPorts = [ 51820 ];
+            };
+
+            security.acme.acceptTerms = true;
+            # security.acme.useRoot = true;
+            security.acme.defaults.email = "boss@tehbox.org";
+            # security.acme.certs = {
+            #     "tehbox.org" = 
+            #       {
+            #           webroot = "/var/lib/acme/acme-challenge/";
+            #           email = "boss@tehbox.org";
+            #           extraDomainNames = (map (sub: sub + ".tehbox.org" ) [ "www" "git" ]);
+            #           #dnsProvider = "linode";
+            #           # dnsResolver = "92.123.94.2";
+            #           # dnsPropagationCheck = false;
+            #           #environmentFile = environmentFile;
+            #       };
+            # };
+            users.groups.acme.members = [ "nginx" ];
+
+            # Wireguard
+            networking = {
+                nat = {
+                    enable = true;
+                    externalInterface = "eth0";
+                    internalInterfaces = [ "wg0" ];
+                };
+
+                wireguard.interfaces.wg0 = {
+                    ips = [ "10.100.0.1/24" ];
+                    listenPort = 51820;
+
+                    postSetup = ''
+${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
+'';
+                    postShutdown = ''
+${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
+'';
+
+                    privateKeyFile = config.sops.secrets."wg/nixnode/priv".path;
+
+                    peers = [
+                        {
+                            name = "nixy";
+                            publicKey = "FMkFU9k+YeCvj48+WDVglySgoncbITqkS//o2e+TClY=";
+                            allowedIPs = [ "10.100.0.2/32" ];
+                        }
+                    ];
+                };
+            };
+
+            services.nginx = {
+                enable = true;
+                # Log the vhost at the start of each line ("vcombined") so goaccess
+                # can split traffic by subdomain
+                commonHttpConfig = ''
+log_format vcombined '$host:$server_port $remote_addr - $remote_user [$time_local] '
+                     '"$request" $status $body_bytes_sent '
+                     '"$http_referer" "$http_user_agent"';
+access_log /var/log/nginx/access.log vcombined;
+'';
+                # virtualHosts.${config.mailserver.fqdn}.enableACME = true;
+                virtualHosts = {
+                    "tehbox.org" = {
+                        root = "${inputs.self.packages.x86_64-linux.teh-website}/srv/www";
+                        serverAliases = [ "www.tehbox.org" ];
+                        enableACME = true;
+                        forceSSL = true;
+                    };
+                    "files.tehbox.org" = {
+                        root = "/srv/files";
+                        enableACME = true;
+                        forceSSL = true;
+                    };
+                    # "stk.lug.ac" = {
+                    #     root = "${inputs.self.packages.x86_64-linux.stk-installers}/srv/www";
+                    #     enableACME = true;
+                    #     forceSSL = true;
+                    #     locations."/".extraConfig = "autoindex on;\n";
+                    # };
+                    "dashboard.tehbox.org" = {
+                        root = "/var/lib/goaccess/html";
+                        basicAuthFile = config.sops.secrets."nginx/dashboard-htpasswd".path;
+                        enableACME = true;
+                        forceSSL = true;
+                    };
+                    "_" = {
+                        globalRedirect = "tehbox.org";
+                    };
+                };
+            };
+
+            # Web traffic dashboard, rebuilt from the nginx access log every 10 minutes.
+            # --persist/--restore keep the totals in /var/lib/goaccess/db across log rotations.
+            systemd.services.goaccess-report = {
+                description = "Build goaccess report for dashboard.tehbox.org";
+                serviceConfig = {
+                    Type = "oneshot";
+                    User = "nginx";
+                    Group = "nginx";
+                    StateDirectory = [ "goaccess" "goaccess/db" "goaccess/html" ];
+                };
+                script = ''
+${pkgs.goaccess}/bin/goaccess /var/log/nginx/access.log \
+  --log-format=VCOMBINED \
+  --num-tests=0 \
+  --no-query-string \
+  --persist --restore --db-path=/var/lib/goaccess/db \
+  --html-report-title="tehbox.org traffic" \
+  -o /var/lib/goaccess/html/index.html
+'';
+            };
+            systemd.timers.goaccess-report = {
+                wantedBy = [ "timers.target" ];
+                timerConfig = {
+                    OnCalendar = "*:0/10";
+                    Persistent = true;
+                };
+            };
+
+            teh-nix.services.cgit = {
+                enable = true;
+                authorizedKeys = config.users.users.boss.openssh.authorizedKeys.keys;
+                authorizedUsers = [ "boss" ];
+                domain = "git.tehbox.org";
+                enableACME = true;
+                # useACMEHost = "tehbox.org";
+                forceSSL = true;
+                # onlySSL = true;
+            };
+
+            services.neodrive-website = {
+                    enable = true;
+                    domain = "neodrive.tehbox.org";
+            };
+
+            services.znc = {
+                enable = true;
+                mutable = true;
+                useLegacyConfig = false;
+                openFirewall = true;
+                config = {
+                    SSLCertFile = "/var/lib/acme/tehbox.org/key.pem";
+                    LoadModule = [ "webadmin" ];
+                    User.boss = {
+                        Admin = true;
+                        Pass.password = {
+                            Method = "sha256";
+        	                Hash = "401e8fed9a3ab1f93047b7465fd7cc6b0ca5aaed6b1c0482f0f4331ebdca8647";
+        	                Salt = "*F_-,pqOdiJi;p)JoMnm";
+                        };
+                    };
+                    User.komodo = {
+                        Admin = false;
+                        Pass.password = {
+                            Method = "sha256";
+                            Hash = "2c624debe3e2672383346230b6acad82192e40df05666481f792a9dd97d935cc";
+                            Salt = "q9At0+KZvmofZil(3us1";
+                        };
+                    };
+                };
+            };
+
+            services.openssh = {
+                enable = true;
+                settings.PermitRootLogin = "no";
+                settings.PasswordAuthentication = false;
+            };
+
+            services.superTuxKarts = {
+                enable = true;
+        	    port = 2759;
+                package = pkgs.superTuxKart;
+                serverOptions = {
+                    server-name = "LUG STK server";
+                    server-mode = 3;
+                    server-difficulty = 3;
+                    server-max-players = 16;
+                    track-voting = false;
+                    voting-timeout = 15;
+        	        private-server-password = "lug@uoa";
+                    motd = "Server for LUG@UoA\nChampionship coming soon!";
+                    live-spectate = true;
+                    server-configurable = true;
+                };
+            };
+
+            mailserver = {
+                enable = true;
+                stateVersion = 3;
+                fqdn = "tehbox.org";
+                domains = [ "tehbox.org" ];
+
+                x509.useACMEHost = config.mailserver.fqdn;
+
+                loginAccounts = {
+                    "boss@tehbox.org" = {
+                        hashedPasswordFile = config.sops.secrets."mail/boss".path;
+                        aliases = ["postmaster@tehbox.org"];
+                    };
+                };
+
+                # certificateScheme = "acme";
+            };
+
+            users.users.boss = {
+                isNormalUser = true;
+                extraGroups = [ "wheel" "networkmanager"]; # Enable ‘sudo’ for the user.
+                home = "/home/boss";
+                openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJOukEKExoF6vr3vciQN8pBdd4FtZtRzqIGFJrUvllOY boss@nixy" ];
+            };
+            users.groups.files.members = [ "boss" "nginx" ];
+            users.groups.nginx.members = [ "nginx" "znc" ];
+
+            environment.systemPackages = with pkgs; [
+                vim
+                emacs
+                inetutils
+                mtr
+                sysstat
+                git
+                goaccess
+                inputs.self.packages.x86_64-linux.teh-website
+                # inputs.self.packages.x86_64-linux.stk-installers
+            ];
+
+
+            # Open ports in the firewall.
+            # networking.firewall.allowedTCPPorts = [ ... ];
+            # networking.firewall.allowedUDPPorts = [ ... ];
+            # Or disable the firewall altogether.
+            # networking.firewall.enable = false;
+
+            networking.usePredictableInterfaceNames = false;
+            networking.useDHCP = false;
+            networking.interfaces.eth0.useDHCP = true;
+
+            # Copy the NixOS configuration file and link it from the resulting system
+            # (/run/current-system/configuration.nix). This is useful in case you
+            # accidentally delete configuration.nix.
+            # system.copySystemConfiguration = true;
+
+            # This option defines the first version of NixOS you have installed on this particular machine,
+            # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+            #
+            # Most users should NEVER change this value after the initial install, for any reason,
+            # even if you've upgraded your system to a new NixOS release.
+            #
+            # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+            # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+            # to actually do that.
+            #
+            # This value being lower than the current NixOS release does NOT mean your system is
+            # out of date, out of support, or vulnerable.
+            #
+            # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+            # and migrated your data accordingly.
+            #
+            # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
+            system.stateVersion = "25.05"; # Did you read the comment?
+
+        };
+}
diff --git a/modules/computers/nixy.nix b/modules/computers/nixy.nix
new file mode 100644
index 0000000..95820f5
--- /dev/null
+++ b/modules/computers/nixy.nix
@@ -0,0 +1,343 @@
+{ inputs, config, ... }:
+let
+    nixos = config.flake.modules.nixos;
+    hm = config.flake.modules.homeManager;
+in
+{
+    flake.nixosConfigurations.nixy = inputs.nixpkgs.lib.nixosSystem {
+        modules = [ nixos.nixy ];
+    };
+
+    flake.modules.nixos.nixy =
+        # Edit this configuration file to define what should be installed on
+        # your system.  Help is available in the configuration.nix(5) man page
+        # and in the NixOS manual (accessible by running ‘nixos-help’).
+
+        { config, pkgs, ... }:
+        {
+            imports =
+        	    [
+                    nixos.teh-nix
+                    nixos.my-pkgs
+                    nixos.tuf
+                    inputs.sops.nixosModules.sops
+                    #inputs.spicetify-nix.nixosModules.default
+                    inputs.home-manager.nixosModules.home-manager
+                    inputs.stylix.nixosModules.stylix
+        	    ];
+
+            home-manager.useGlobalPkgs = true;
+            home-manager.useUserPackages = true;
+            home-manager.users.boss = hm.boss;
+
+            teh-nix.nix.enable = true;
+            programs.nix-ld.enable = true;
+            programs.nix-ld.libraries = with pkgs; [
+                # stdenv.cc.cc
+                glib
+                glibc
+                nspr
+                nss
+                dbus
+                atk
+                cups
+                cairo
+                gtk3
+                alsa-lib
+                expat
+                fontconfig
+                freetype
+                libgbm
+                libnotify
+                libsecret
+                libxkbcommon
+                mesa
+                pango
+                libX11
+                libXcomposite
+                libXcursor
+                libXdamage
+                libXext
+                libXfixes
+                libXi
+                libXrandr
+                libXrender
+                libXtst
+                libxcb
+            ];
+
+            # Use the systemd-boot EFI boot loader.
+            boot = {
+                loader.grub.enable = true;
+                loader.grub.device = "nodev";
+                loader.grub.efiSupport = true;
+        	    loader.grub.enableCryptodisk = true;
+                # loader.grub.useOSProber = true;
+                loader.efi.canTouchEfiVariables = true;
+                kernel.sysctl."kernel.sysrq" = 502;
+                plymouth.enable = true;
+            };
+
+
+            networking.hostName = "nixy"; # Define your hostname.
+            # Pick only one of the below networking options.
+            # networking.wireless.enable = true;	# Enables wireless support via wpa_supplicant.
+            networking.networkmanager.enable = true;	# Easiest to use and most distros use this by default.
+
+            sops.defaultSopsFile = ../../secrets/general.yaml;
+            sops.defaultSopsFormat = "yaml";
+
+            sops.age.keyFile = "/home/boss/.config/sops/age/keys.txt";
+
+            sops.secrets = {
+                #"wg/nixnode/pub" = { };
+                "wg/nixy/priv" = {
+                    restartUnits = [ "nm-file-secret-agent.service" ];
+                    group = "networkmanager";
+                    mode = "440";
+                };
+            };
+
+            networking.firewall = {
+                allowedUDPPorts = [ 51820 ];
+                allowedTCPPorts = [ 8081 ];
+            };
+            networking.networkmanager.ensureProfiles = {
+                profiles = {
+                    wg-nixnode = {
+                        connection = {
+                            id = "wg-nixnode";
+                            autoconnect = "false";
+                            interface-name = "wg0";
+                            type = "wireguard";
+                        };
+                        ipv4 = {
+                            address1 = "10.100.0.2/32";
+                            may-fail = "false";
+                            method = "manual";
+                        };
+                        ipv6 = {
+                            method = "disabled";
+                        };
+                        wireguard = {
+                            listen-port = "51820";
+                            private-key-flags = 1;
+                            #private-key = "dummy";
+                        };
+                        proxy = { };
+                        "wireguard-peer./6bWy02DhOSjaeXk+ol5ATgEYDDJvL+mTO9SCNvfIUQ=" = {
+                            allowed-ips = "0.0.0.0/0;";
+                            endpoint = "172.105.172.191:51820";
+                            persistent-keepalive = "25";
+                        };
+                    };
+                };
+                secrets.entries = [
+                    {
+                        matchId = "wg-nixnode";
+                        matchType = "wireguard";
+                        matchSetting = "wireguard";
+                        key = "private-key";
+                        file = config.sops.secrets."wg/nixy/priv".path;
+                    }
+                ];
+            };
+
+            systemd.services."nm-file-secret-agent" = {
+                serviceConfig.User = "boss";
+            };
+
+
+            # Set your time zone.
+            time.timeZone = "NZ";
+
+            # Configure network proxy if necessary
+            # networking.proxy.default = "http://user:password@proxy:port/";
+            # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+            # Select internationalisation properties.
+            i18n.defaultLocale = "en_US.UTF-8";
+            console = {
+        	    font = "Lat2-Terminus16";
+        	    #keyMap = "us";
+        	    #useXkbConfig = true; # use xkbOptions in tty.
+            };
+
+            teh-nix.xorg = {
+                enable = true;
+            };
+
+            programs.hyprland = {
+                enable = false;
+                #package = inputs.hyprland.packages.${pkgs.system}.hyprland;
+                #portalPackage = inputs.hyprland.packages.${pkgs.system}.xdg-desktop-portal-hyprland;
+            };
+
+            security.pam.services.swaylock = {};
+
+        	# Enable CUPS to print documents.
+        	services.printing.enable = true;
+            services.printing.drivers = with pkgs;[
+                hplip
+            ];
+            services.avahi = {
+                enable = true;
+                nssmdns4 = true;
+                openFirewall = true;
+            };
+
+        	# Enable sound.
+        	#sound.enable = true;
+        	services.pipewire = {
+        		enable = true;
+        		alsa.enable = false;
+        		alsa.support32Bit = false;
+        		pulse.enable = true;
+        	};
+
+            services.upower.enable = true;
+
+        	# Enable touchpad support (enabled default in most desktopManager).
+            security.rtkit.enable = true;
+            services.libinput = {
+                enable = true;
+        		mouse = {
+        			accelProfile = "flat";
+        		};
+        	};
+
+        	# Define a user account. Don't forget to set a password with ‘passwd’.
+        	users.users.boss = {
+        	    isNormalUser = true;
+        	    extraGroups = [ "wheel" "networkmanager" "input" "uinput" ];
+        	};
+
+        	fonts.packages = with pkgs; [
+        	    #(nerdfonts.override { fonts = [ "Cousine" ]; })
+                nerd-fonts.cousine
+        	];
+
+        	# List packages installed in system profile. To search, run:
+        	# $ nix search wget
+        	environment.systemPackages = with pkgs;
+        	    [
+        		    vim
+        		    firefox
+        		    pfetch
+        		    fastfetch
+                    pinentry-gtk2
+                    git
+                    nm-file-secret-agent
+                    deploy-rs
+        	    ];
+            documentation.dev.enable = true;
+
+            hardware.graphics.enable32Bit = true;
+            programs.steam = {
+                enable = true;
+                package = pkgs.steam.override {
+                    extraEnv = {
+                        __NV_PRIME_RENDER_OFFLOAD=1;
+                        __NV_PRIME_RENDER_OFFLOAD_PROVIDER="NVIDIA-G0";
+                        __GLX_VENDOR_LIBRARY_NAME="nvidia";
+                        __VK_LAYER_NV_optimus="NVIDIA_only";
+                    };
+                };
+
+                extraCompatPackages = with pkgs; [
+                    proton-ge-bin
+                ];
+            };
+
+        	# Some programs need SUID wrappers, can be configured further or are
+        	# started in user sessions.
+        	# programs.mtr.enable = true;
+        	programs.gnupg = {
+                agent = {
+        	        enable = true;
+                    pinentryPackage = pkgs.pinentry-gtk2;
+                };
+        	    #	 enableSSHSupport = true;
+        	};
+
+            hardware.bluetooth.enable = true; # enables support for Bluetooth
+            hardware.bluetooth.powerOnBoot = true; # powers up the default Bluetooth controller on boot
+            services.blueman.enable = true;
+
+            systemd.tmpfiles.rules = [
+                "f /var/lib/systemd/linger/boss" # enables lingering
+            ];
+
+            # programs.dconf.enable = true;
+
+
+            services.ratbagd.enable = true;
+
+            # xdg.portal.enable = true;
+            # services.flatpak.enable = true;
+
+            stylix = {
+                enable = true;
+
+                base16Scheme = "${pkgs.base16-schemes}/share/themes/material-palenight.yaml";
+
+                image = ../../wallpaper.png;
+                targets.grub.useWallpaper = true;
+
+                opacity = {
+                    terminal = 0.8;
+                };
+
+                polarity = "dark";
+
+                fonts = {
+                    monospace = {
+                        package = pkgs.nerd-fonts.cousine;
+                        name = "Cousine Nerd Font Mono";
+                    };
+
+                    serif = {
+                        package = pkgs.dejavu_fonts;
+                        name = "DejaVu Serif";
+                    };
+
+                    sansSerif = {
+                        package = pkgs.dejavu_fonts;
+                        name = "DejaVu Sans";
+                    };
+
+                    emoji = {
+                        package = pkgs.noto-fonts-color-emoji;
+                        name = "Noto Color Emoji";
+                    };
+
+                    sizes = {
+                        terminal = 10;
+                        applications = 10;
+                        desktop = 10;
+                        popups = 10;
+                    };
+                };
+
+                cursor = {
+                    package = pkgs.nordzy-cursor-theme;
+                    name = "Nordzy-cursors";
+                    size = 20;
+                };
+            };
+
+        	# Copy the NixOS configuration file and link it from the resulting system
+        	# (/run/current-system/configuration.nix). This is useful in case you
+        	# accidentally delete configuration.nix.
+        	# system.copySystemConfiguration = true;
+
+        	# This value determines the NixOS release from which the default
+        	# settings for stateful data, like file locations and database versions
+        	# on your system were taken. It‘s perfectly fine and recommended to leave
+        	# this value at the release version of the first install of this system.
+        	# Before changing this value read the documentation for this option
+        	# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+        	system.stateVersion = "24.05"; # Did you read the comment?
+
+        };
+}