aboutsummaryrefslogtreecommitdiff
path: root/modules/computers
diff options
context:
space:
mode:
Diffstat (limited to 'modules/computers')
-rw-r--r--modules/computers/nixnode.nix627
-rw-r--r--modules/computers/nixy.nix584
2 files changed, 616 insertions, 595 deletions
diff --git a/modules/computers/nixnode.nix b/modules/computers/nixnode.nix
index 3cf6999..65400c2 100644
--- a/modules/computers/nixnode.nix
+++ b/modules/computers/nixnode.nix
@@ -1,347 +1,368 @@
{ inputs, config, ... }:
let
- nixos = config.flake.modules.nixos;
+ nixos = config.flake.modules.nixos;
in
{
- flake.nixosConfigurations.nixnode = inputs.nixpkgs.lib.nixosSystem {
- modules = [ nixos.nixnode ];
- };
+ flake.nixosConfigurations.nixnode = inputs.nixpkgs.lib.nixosSystem {
+ modules = [ nixos.nixnode ];
+ };
- flake.modules.nixos.nixnode =
- # Edit this configuration file to define what should be installed on
- # your system. Help is available in the configuration.nix(5) man page, on
- # https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
+ flake.modules.nixos.nixnode =
+ # Edit this configuration file to define what should be installed on
+ # your system. Help is available in the configuration.nix(5) man page, on
+ # https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
- { config, lib, pkgs, ... }:
+ {
+ config,
+ lib,
+ pkgs,
+ ...
+ }:
- {
- imports =
- [
- nixos.teh-nix
- nixos.linode
- inputs.STK.nixosModules.default
- inputs.sops.nixosModules.sops
- inputs.nixos-mailserver.nixosModules.default
- inputs.neodrive-website.nixosModules.default
- ];
+ {
+ imports = [
+ nixos.teh-nix
+ nixos.linode
+ inputs.STK.nixosModules.default
+ inputs.sops.nixosModules.sops
+ inputs.nixos-mailserver.nixosModules.default
+ inputs.neodrive-website.nixosModules.default
+ ];
- teh-nix.nix.enable = true;
+ teh-nix.nix.enable = true;
- # Use the GRUB 2 boot loader.
- boot.loader.grub.enable = true;
- # boot.loader.grub.efiSupport = true;
- # boot.loader.grub.efiInstallAsRemovable = true;
- # boot.loader.efi.efiSysMountPoint = "/boot/efi";
- # Define on which hard drive you want to install Grub.
- # boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
+ # Use the GRUB 2 boot loader.
+ boot.loader.grub.enable = true;
+ # boot.loader.grub.efiSupport = true;
+ # boot.loader.grub.efiInstallAsRemovable = true;
+ # boot.loader.efi.efiSysMountPoint = "/boot/efi";
+ # Define on which hard drive you want to install Grub.
+ # boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
- networking.hostName = "nixnode"; # Define your hostname.
- # Pick only one of the below networking options.
- # networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
- networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
+ networking.hostName = "nixnode"; # Define your hostname.
+ # Pick only one of the below networking options.
+ # networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
+ networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
- # Set your time zone.
- time.timeZone = "NZ";
+ # Set your time zone.
+ time.timeZone = "NZ";
- # Configure network proxy if necessary
- # networking.proxy.default = "http://user:password@proxy:port/";
- # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+ # Configure network proxy if necessary
+ # networking.proxy.default = "http://user:password@proxy:port/";
+ # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
- # Select internationalisation properties.
- # i18n.defaultLocale = "en_US.UTF-8";
- # console = {
- # font = "Lat2-Terminus16";
- # keyMap = "us";
- # useXkbConfcpfig = true; # use xkb.options in tty.
- # };
+ # Select internationalisation properties.
+ # i18n.defaultLocale = "en_US.UTF-8";
+ # console = {
+ # font = "Lat2-Terminus16";
+ # keyMap = "us";
+ # useXkbConfcpfig = true; # use xkb.options in tty.
+ # };
- # Enable the X11 windowing system.
- # services.xserver.enable = true;
+ # Enable the X11 windowing system.
+ # services.xserver.enable = true;
- security.sudo.wheelNeedsPassword = false;
+ security.sudo.wheelNeedsPassword = false;
- sops.defaultSopsFile = ../../secrets/general.yaml;
- sops.defaultSopsFormat = "yaml";
+ sops.defaultSopsFile = ../../secrets/general.yaml;
+ sops.defaultSopsFormat = "yaml";
- sops.age.keyFile = "/home/boss/.config/sops/age/keys.txt";
+ sops.age.keyFile = "/home/boss/.config/sops/age/keys.txt";
- sops.secrets = {
- #"wg/nixy/pub" = { };
- "wg/nixnode/priv" = { };
- "acme/linode" = {
- owner = "acme";
- mode = "440";
- };
- "mail/boss" = { };
- "nginx/dashboard-htpasswd" = {
- owner = "nginx";
- mode = "400";
- };
- };
+ sops.secrets = {
+ #"wg/nixy/pub" = { };
+ "wg/nixnode/priv" = { };
+ "acme/linode" = {
+ owner = "acme";
+ mode = "440";
+ };
+ "mail/boss" = { };
+ "nginx/dashboard-htpasswd" = {
+ owner = "nginx";
+ mode = "400";
+ };
+ };
- networking.firewall = {
- enable = true;
- allowedTCPPorts = [ 80 443 ];
- allowedUDPPorts = [ 51820 ];
- };
+ networking.firewall = {
+ enable = true;
+ allowedTCPPorts = [
+ 80
+ 443
+ ];
+ allowedUDPPorts = [ 51820 ];
+ };
- security.acme.acceptTerms = true;
- # security.acme.useRoot = true;
- security.acme.defaults.email = "boss@tehbox.org";
- # security.acme.certs = {
- # "tehbox.org" =
- # {
- # webroot = "/var/lib/acme/acme-challenge/";
- # email = "boss@tehbox.org";
- # extraDomainNames = (map (sub: sub + ".tehbox.org" ) [ "www" "git" ]);
- # #dnsProvider = "linode";
- # # dnsResolver = "92.123.94.2";
- # # dnsPropagationCheck = false;
- # #environmentFile = environmentFile;
- # };
- # };
- users.groups.acme.members = [ "nginx" ];
+ security.acme.acceptTerms = true;
+ # security.acme.useRoot = true;
+ security.acme.defaults.email = "boss@tehbox.org";
+ # security.acme.certs = {
+ # "tehbox.org" =
+ # {
+ # webroot = "/var/lib/acme/acme-challenge/";
+ # email = "boss@tehbox.org";
+ # extraDomainNames = (map (sub: sub + ".tehbox.org" ) [ "www" "git" ]);
+ # #dnsProvider = "linode";
+ # # dnsResolver = "92.123.94.2";
+ # # dnsPropagationCheck = false;
+ # #environmentFile = environmentFile;
+ # };
+ # };
+ users.groups.acme.members = [ "nginx" ];
- # Wireguard
- networking = {
- nat = {
- enable = true;
- externalInterface = "eth0";
- internalInterfaces = [ "wg0" ];
- };
+ # Wireguard
+ networking = {
+ nat = {
+ enable = true;
+ externalInterface = "eth0";
+ internalInterfaces = [ "wg0" ];
+ };
- wireguard.interfaces.wg0 = {
- ips = [ "10.100.0.1/24" ];
- listenPort = 51820;
+ wireguard.interfaces.wg0 = {
+ ips = [ "10.100.0.1/24" ];
+ listenPort = 51820;
- postSetup = ''
-${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
-'';
- postShutdown = ''
-${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
-'';
+ postSetup = ''
+ ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
+ '';
+ postShutdown = ''
+ ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
+ '';
- privateKeyFile = config.sops.secrets."wg/nixnode/priv".path;
+ privateKeyFile = config.sops.secrets."wg/nixnode/priv".path;
- peers = [
- {
- name = "nixy";
- publicKey = "FMkFU9k+YeCvj48+WDVglySgoncbITqkS//o2e+TClY=";
- allowedIPs = [ "10.100.0.2/32" ];
- }
- ];
- };
- };
+ peers = [
+ {
+ name = "nixy";
+ publicKey = "FMkFU9k+YeCvj48+WDVglySgoncbITqkS//o2e+TClY=";
+ allowedIPs = [ "10.100.0.2/32" ];
+ }
+ ];
+ };
+ };
- services.nginx = {
- enable = true;
- # Log the vhost at the start of each line ("vcombined") so goaccess
- # can split traffic by subdomain
- commonHttpConfig = ''
-log_format vcombined '$host:$server_port $remote_addr - $remote_user [$time_local] '
- '"$request" $status $body_bytes_sent '
- '"$http_referer" "$http_user_agent"';
-access_log /var/log/nginx/access.log vcombined;
-'';
- # virtualHosts.${config.mailserver.fqdn}.enableACME = true;
- virtualHosts = {
- "tehbox.org" = {
- root = "${inputs.self.packages.x86_64-linux.teh-website}/srv/www";
- serverAliases = [ "www.tehbox.org" ];
- enableACME = true;
- forceSSL = true;
- };
- "files.tehbox.org" = {
- root = "/srv/files";
- enableACME = true;
- forceSSL = true;
- };
- # "stk.lug.ac" = {
- # root = "${inputs.self.packages.x86_64-linux.stk-installers}/srv/www";
- # enableACME = true;
- # forceSSL = true;
- # locations."/".extraConfig = "autoindex on;\n";
- # };
- "dashboard.tehbox.org" = {
- root = "/var/lib/goaccess/html";
- basicAuthFile = config.sops.secrets."nginx/dashboard-htpasswd".path;
- enableACME = true;
- forceSSL = true;
- };
- "_" = {
- globalRedirect = "tehbox.org";
- };
- };
- };
+ services.nginx = {
+ enable = true;
+ # Log the vhost at the start of each line ("vcombined") so goaccess
+ # can split traffic by subdomain
+ commonHttpConfig = ''
+ log_format vcombined '$host:$server_port $remote_addr - $remote_user [$time_local] '
+ '"$request" $status $body_bytes_sent '
+ '"$http_referer" "$http_user_agent"';
+ access_log /var/log/nginx/access.log vcombined;
+ '';
+ # virtualHosts.${config.mailserver.fqdn}.enableACME = true;
+ virtualHosts = {
+ "tehbox.org" = {
+ root = "${inputs.self.packages.x86_64-linux.teh-website}/srv/www";
+ serverAliases = [ "www.tehbox.org" ];
+ enableACME = true;
+ forceSSL = true;
+ };
+ "files.tehbox.org" = {
+ root = "/srv/files";
+ enableACME = true;
+ forceSSL = true;
+ };
+ # "stk.lug.ac" = {
+ # root = "${inputs.self.packages.x86_64-linux.stk-installers}/srv/www";
+ # enableACME = true;
+ # forceSSL = true;
+ # locations."/".extraConfig = "autoindex on;\n";
+ # };
+ "dashboard.tehbox.org" = {
+ root = "/var/lib/goaccess/html";
+ basicAuthFile = config.sops.secrets."nginx/dashboard-htpasswd".path;
+ enableACME = true;
+ forceSSL = true;
+ };
+ "_" = {
+ globalRedirect = "tehbox.org";
+ };
+ };
+ };
- # Web traffic dashboard, rebuilt from the nginx access log every 10 minutes.
- # --persist/--restore keep the totals in /var/lib/goaccess/db across log rotations.
- systemd.services.goaccess-report = {
- description = "Build goaccess report for dashboard.tehbox.org";
- serviceConfig = {
- Type = "oneshot";
- User = "nginx";
- Group = "nginx";
- StateDirectory = [ "goaccess" "goaccess/db" "goaccess/html" ];
- };
- script = ''
-${pkgs.goaccess}/bin/goaccess /var/log/nginx/access.log \
- --log-format=VCOMBINED \
- --num-tests=0 \
- --no-query-string \
- --persist --restore --db-path=/var/lib/goaccess/db \
- --html-report-title="tehbox.org traffic" \
- -o /var/lib/goaccess/html/index.html
-'';
- };
- systemd.timers.goaccess-report = {
- wantedBy = [ "timers.target" ];
- timerConfig = {
- OnCalendar = "*:0/10";
- Persistent = true;
- };
- };
+ # Web traffic dashboard, rebuilt from the nginx access log every 10 minutes.
+ # --persist/--restore keep the totals in /var/lib/goaccess/db across log rotations.
+ systemd.services.goaccess-report = {
+ description = "Build goaccess report for dashboard.tehbox.org";
+ serviceConfig = {
+ Type = "oneshot";
+ User = "nginx";
+ Group = "nginx";
+ StateDirectory = [
+ "goaccess"
+ "goaccess/db"
+ "goaccess/html"
+ ];
+ };
+ script = ''
+ ${pkgs.goaccess}/bin/goaccess /var/log/nginx/access.log \
+ --log-format=VCOMBINED \
+ --num-tests=0 \
+ --no-query-string \
+ --persist --restore --db-path=/var/lib/goaccess/db \
+ --html-report-title="tehbox.org traffic" \
+ -o /var/lib/goaccess/html/index.html
+ '';
+ };
+ systemd.timers.goaccess-report = {
+ wantedBy = [ "timers.target" ];
+ timerConfig = {
+ OnCalendar = "*:0/10";
+ Persistent = true;
+ };
+ };
- teh-nix.services.cgit = {
- enable = true;
- authorizedKeys = config.users.users.boss.openssh.authorizedKeys.keys;
- authorizedUsers = [ "boss" ];
- domain = "git.tehbox.org";
- enableACME = true;
- # useACMEHost = "tehbox.org";
- forceSSL = true;
- # onlySSL = true;
- };
+ teh-nix.services.cgit = {
+ enable = true;
+ authorizedKeys = config.users.users.boss.openssh.authorizedKeys.keys;
+ authorizedUsers = [ "boss" ];
+ domain = "git.tehbox.org";
+ enableACME = true;
+ # useACMEHost = "tehbox.org";
+ forceSSL = true;
+ # onlySSL = true;
+ };
- services.neodrive-website = {
- enable = true;
- domain = "neodrive.tehbox.org";
- };
+ services.neodrive-website = {
+ enable = true;
+ domain = "neodrive.tehbox.org";
+ };
- services.znc = {
- enable = true;
- mutable = true;
- useLegacyConfig = false;
- openFirewall = true;
- config = {
- SSLCertFile = "/var/lib/acme/tehbox.org/key.pem";
- LoadModule = [ "webadmin" ];
- User.boss = {
- Admin = true;
- Pass.password = {
- Method = "sha256";
- Hash = "401e8fed9a3ab1f93047b7465fd7cc6b0ca5aaed6b1c0482f0f4331ebdca8647";
- Salt = "*F_-,pqOdiJi;p)JoMnm";
- };
- };
- User.komodo = {
- Admin = false;
- Pass.password = {
- Method = "sha256";
- Hash = "2c624debe3e2672383346230b6acad82192e40df05666481f792a9dd97d935cc";
- Salt = "q9At0+KZvmofZil(3us1";
- };
- };
- };
- };
+ services.znc = {
+ enable = true;
+ mutable = true;
+ useLegacyConfig = false;
+ openFirewall = true;
+ config = {
+ SSLCertFile = "/var/lib/acme/tehbox.org/key.pem";
+ LoadModule = [ "webadmin" ];
+ User.boss = {
+ Admin = true;
+ Pass.password = {
+ Method = "sha256";
+ Hash = "401e8fed9a3ab1f93047b7465fd7cc6b0ca5aaed6b1c0482f0f4331ebdca8647";
+ Salt = "*F_-,pqOdiJi;p)JoMnm";
+ };
+ };
+ User.komodo = {
+ Admin = false;
+ Pass.password = {
+ Method = "sha256";
+ Hash = "2c624debe3e2672383346230b6acad82192e40df05666481f792a9dd97d935cc";
+ Salt = "q9At0+KZvmofZil(3us1";
+ };
+ };
+ };
+ };
- services.openssh = {
- enable = true;
- settings.PermitRootLogin = "no";
- settings.PasswordAuthentication = false;
- };
+ services.openssh = {
+ enable = true;
+ settings.PermitRootLogin = "no";
+ settings.PasswordAuthentication = false;
+ };
- services.superTuxKarts = {
- enable = true;
- port = 2759;
- package = pkgs.superTuxKart;
- serverOptions = {
- server-name = "LUG STK server";
- server-mode = 3;
- server-difficulty = 3;
- server-max-players = 16;
- track-voting = false;
- voting-timeout = 15;
- private-server-password = "lug@uoa";
- motd = "Server for LUG@UoA\nChampionship coming soon!";
- live-spectate = true;
- server-configurable = true;
- };
- };
+ services.superTuxKarts = {
+ enable = true;
+ port = 2759;
+ package = pkgs.superTuxKart;
+ serverOptions = {
+ server-name = "LUG STK server";
+ server-mode = 3;
+ server-difficulty = 3;
+ server-max-players = 16;
+ track-voting = false;
+ voting-timeout = 15;
+ private-server-password = "lug@uoa";
+ motd = "Server for LUG@UoA\nChampionship coming soon!";
+ live-spectate = true;
+ server-configurable = true;
+ };
+ };
- mailserver = {
- enable = true;
- stateVersion = 3;
- fqdn = "tehbox.org";
- domains = [ "tehbox.org" ];
+ mailserver = {
+ enable = true;
+ stateVersion = 3;
+ fqdn = "tehbox.org";
+ domains = [ "tehbox.org" ];
- x509.useACMEHost = config.mailserver.fqdn;
+ x509.useACMEHost = config.mailserver.fqdn;
- loginAccounts = {
- "boss@tehbox.org" = {
- hashedPasswordFile = config.sops.secrets."mail/boss".path;
- aliases = ["postmaster@tehbox.org"];
- };
- };
+ loginAccounts = {
+ "boss@tehbox.org" = {
+ hashedPasswordFile = config.sops.secrets."mail/boss".path;
+ aliases = [ "postmaster@tehbox.org" ];
+ };
+ };
- # certificateScheme = "acme";
- };
+ # certificateScheme = "acme";
+ };
- users.users.boss = {
- isNormalUser = true;
- extraGroups = [ "wheel" "networkmanager"]; # Enable ‘sudo’ for the user.
- home = "/home/boss";
- openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJOukEKExoF6vr3vciQN8pBdd4FtZtRzqIGFJrUvllOY boss@nixy" ];
- };
- users.groups.files.members = [ "boss" "nginx" ];
- users.groups.nginx.members = [ "nginx" "znc" ];
+ users.users.boss = {
+ isNormalUser = true;
+ extraGroups = [
+ "wheel"
+ "networkmanager"
+ ]; # Enable ‘sudo’ for the user.
+ home = "/home/boss";
+ openssh.authorizedKeys.keys = [
+ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJOukEKExoF6vr3vciQN8pBdd4FtZtRzqIGFJrUvllOY boss@nixy"
+ ];
+ };
+ users.groups.files.members = [
+ "boss"
+ "nginx"
+ ];
+ users.groups.nginx.members = [
+ "nginx"
+ "znc"
+ ];
- environment.systemPackages = with pkgs; [
- vim
- emacs
- inetutils
- mtr
- sysstat
- git
- goaccess
- inputs.self.packages.x86_64-linux.teh-website
- # inputs.self.packages.x86_64-linux.stk-installers
- ];
+ environment.systemPackages = with pkgs; [
+ vim
+ emacs
+ inetutils
+ mtr
+ sysstat
+ git
+ goaccess
+ inputs.self.packages.x86_64-linux.teh-website
+ # inputs.self.packages.x86_64-linux.stk-installers
+ ];
+ # Open ports in the firewall.
+ # networking.firewall.allowedTCPPorts = [ ... ];
+ # networking.firewall.allowedUDPPorts = [ ... ];
+ # Or disable the firewall altogether.
+ # networking.firewall.enable = false;
- # Open ports in the firewall.
- # networking.firewall.allowedTCPPorts = [ ... ];
- # networking.firewall.allowedUDPPorts = [ ... ];
- # Or disable the firewall altogether.
- # networking.firewall.enable = false;
+ networking.usePredictableInterfaceNames = false;
+ networking.useDHCP = false;
+ networking.interfaces.eth0.useDHCP = true;
- networking.usePredictableInterfaceNames = false;
- networking.useDHCP = false;
- networking.interfaces.eth0.useDHCP = true;
+ # Copy the NixOS configuration file and link it from the resulting system
+ # (/run/current-system/configuration.nix). This is useful in case you
+ # accidentally delete configuration.nix.
+ # system.copySystemConfiguration = true;
- # Copy the NixOS configuration file and link it from the resulting system
- # (/run/current-system/configuration.nix). This is useful in case you
- # accidentally delete configuration.nix.
- # system.copySystemConfiguration = true;
+ # This option defines the first version of NixOS you have installed on this particular machine,
+ # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+ #
+ # Most users should NEVER change this value after the initial install, for any reason,
+ # even if you've upgraded your system to a new NixOS release.
+ #
+ # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+ # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+ # to actually do that.
+ #
+ # This value being lower than the current NixOS release does NOT mean your system is
+ # out of date, out of support, or vulnerable.
+ #
+ # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+ # and migrated your data accordingly.
+ #
+ # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
+ system.stateVersion = "25.05"; # Did you read the comment?
- # This option defines the first version of NixOS you have installed on this particular machine,
- # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
- #
- # Most users should NEVER change this value after the initial install, for any reason,
- # even if you've upgraded your system to a new NixOS release.
- #
- # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
- # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
- # to actually do that.
- #
- # This value being lower than the current NixOS release does NOT mean your system is
- # out of date, out of support, or vulnerable.
- #
- # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
- # and migrated your data accordingly.
- #
- # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
- system.stateVersion = "25.05"; # Did you read the comment?
-
- };
+ };
}
diff --git a/modules/computers/nixy.nix b/modules/computers/nixy.nix
index 95820f5..140c50f 100644
--- a/modules/computers/nixy.nix
+++ b/modules/computers/nixy.nix
@@ -1,343 +1,343 @@
{ inputs, config, ... }:
let
- nixos = config.flake.modules.nixos;
- hm = config.flake.modules.homeManager;
+ nixos = config.flake.modules.nixos;
+ hm = config.flake.modules.homeManager;
in
{
- flake.nixosConfigurations.nixy = inputs.nixpkgs.lib.nixosSystem {
- modules = [ nixos.nixy ];
- };
+ flake.nixosConfigurations.nixy = inputs.nixpkgs.lib.nixosSystem {
+ modules = [ nixos.nixy ];
+ };
- flake.modules.nixos.nixy =
- # Edit this configuration file to define what should be installed on
- # your system. Help is available in the configuration.nix(5) man page
- # and in the NixOS manual (accessible by running ‘nixos-help’).
+ flake.modules.nixos.nixy =
+ # Edit this configuration file to define what should be installed on
+ # your system. Help is available in the configuration.nix(5) man page
+ # and in the NixOS manual (accessible by running ‘nixos-help’).
- { config, pkgs, ... }:
- {
- imports =
- [
- nixos.teh-nix
- nixos.my-pkgs
- nixos.tuf
- inputs.sops.nixosModules.sops
- #inputs.spicetify-nix.nixosModules.default
- inputs.home-manager.nixosModules.home-manager
- inputs.stylix.nixosModules.stylix
- ];
+ { config, pkgs, ... }:
+ {
+ imports = [
+ nixos.teh-nix
+ nixos.my-pkgs
+ nixos.tuf
+ inputs.sops.nixosModules.sops
+ #inputs.spicetify-nix.nixosModules.default
+ inputs.home-manager.nixosModules.home-manager
+ inputs.stylix.nixosModules.stylix
+ ];
- home-manager.useGlobalPkgs = true;
- home-manager.useUserPackages = true;
- home-manager.users.boss = hm.boss;
+ home-manager.useGlobalPkgs = true;
+ home-manager.useUserPackages = true;
+ home-manager.users.boss = hm.boss;
- teh-nix.nix.enable = true;
- programs.nix-ld.enable = true;
- programs.nix-ld.libraries = with pkgs; [
- # stdenv.cc.cc
- glib
- glibc
- nspr
- nss
- dbus
- atk
- cups
- cairo
- gtk3
- alsa-lib
- expat
- fontconfig
- freetype
- libgbm
- libnotify
- libsecret
- libxkbcommon
- mesa
- pango
- libX11
- libXcomposite
- libXcursor
- libXdamage
- libXext
- libXfixes
- libXi
- libXrandr
- libXrender
- libXtst
- libxcb
- ];
+ teh-nix.nix.enable = true;
+ programs.nix-ld.enable = true;
+ programs.nix-ld.libraries = with pkgs; [
+ # stdenv.cc.cc
+ glib
+ glibc
+ nspr
+ nss
+ dbus
+ atk
+ cups
+ cairo
+ gtk3
+ alsa-lib
+ expat
+ fontconfig
+ freetype
+ libgbm
+ libnotify
+ libsecret
+ libxkbcommon
+ mesa
+ pango
+ libX11
+ libXcomposite
+ libXcursor
+ libXdamage
+ libXext
+ libXfixes
+ libXi
+ libXrandr
+ libXrender
+ libXtst
+ libxcb
+ ];
- # Use the systemd-boot EFI boot loader.
- boot = {
- loader.grub.enable = true;
- loader.grub.device = "nodev";
- loader.grub.efiSupport = true;
- loader.grub.enableCryptodisk = true;
- # loader.grub.useOSProber = true;
- loader.efi.canTouchEfiVariables = true;
- kernel.sysctl."kernel.sysrq" = 502;
- plymouth.enable = true;
- };
+ # Use the systemd-boot EFI boot loader.
+ boot = {
+ loader.grub.enable = true;
+ loader.grub.device = "nodev";
+ loader.grub.efiSupport = true;
+ loader.grub.enableCryptodisk = true;
+ # loader.grub.useOSProber = true;
+ loader.efi.canTouchEfiVariables = true;
+ kernel.sysctl."kernel.sysrq" = 502;
+ plymouth.enable = true;
+ };
+ networking.hostName = "nixy"; # Define your hostname.
+ # Pick only one of the below networking options.
+ # networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
+ networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
- networking.hostName = "nixy"; # Define your hostname.
- # Pick only one of the below networking options.
- # networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
- networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
+ sops.defaultSopsFile = ../../secrets/general.yaml;
+ sops.defaultSopsFormat = "yaml";
- sops.defaultSopsFile = ../../secrets/general.yaml;
- sops.defaultSopsFormat = "yaml";
+ sops.age.keyFile = "/home/boss/.config/sops/age/keys.txt";
- sops.age.keyFile = "/home/boss/.config/sops/age/keys.txt";
+ sops.secrets = {
+ #"wg/nixnode/pub" = { };
+ "wg/nixy/priv" = {
+ restartUnits = [ "nm-file-secret-agent.service" ];
+ group = "networkmanager";
+ mode = "440";
+ };
+ };
- sops.secrets = {
- #"wg/nixnode/pub" = { };
- "wg/nixy/priv" = {
- restartUnits = [ "nm-file-secret-agent.service" ];
- group = "networkmanager";
- mode = "440";
- };
- };
+ networking.firewall = {
+ allowedUDPPorts = [ 51820 ];
+ allowedTCPPorts = [ 8081 ];
+ };
+ networking.networkmanager.ensureProfiles = {
+ profiles = {
+ wg-nixnode = {
+ connection = {
+ id = "wg-nixnode";
+ autoconnect = "false";
+ interface-name = "wg0";
+ type = "wireguard";
+ };
+ ipv4 = {
+ address1 = "10.100.0.2/32";
+ may-fail = "false";
+ method = "manual";
+ };
+ ipv6 = {
+ method = "disabled";
+ };
+ wireguard = {
+ listen-port = "51820";
+ private-key-flags = 1;
+ #private-key = "dummy";
+ };
+ proxy = { };
+ "wireguard-peer./6bWy02DhOSjaeXk+ol5ATgEYDDJvL+mTO9SCNvfIUQ=" = {
+ allowed-ips = "0.0.0.0/0;";
+ endpoint = "172.105.172.191:51820";
+ persistent-keepalive = "25";
+ };
+ };
+ };
+ secrets.entries = [
+ {
+ matchId = "wg-nixnode";
+ matchType = "wireguard";
+ matchSetting = "wireguard";
+ key = "private-key";
+ file = config.sops.secrets."wg/nixy/priv".path;
+ }
+ ];
+ };
- networking.firewall = {
- allowedUDPPorts = [ 51820 ];
- allowedTCPPorts = [ 8081 ];
- };
- networking.networkmanager.ensureProfiles = {
- profiles = {
- wg-nixnode = {
- connection = {
- id = "wg-nixnode";
- autoconnect = "false";
- interface-name = "wg0";
- type = "wireguard";
- };
- ipv4 = {
- address1 = "10.100.0.2/32";
- may-fail = "false";
- method = "manual";
- };
- ipv6 = {
- method = "disabled";
- };
- wireguard = {
- listen-port = "51820";
- private-key-flags = 1;
- #private-key = "dummy";
- };
- proxy = { };
- "wireguard-peer./6bWy02DhOSjaeXk+ol5ATgEYDDJvL+mTO9SCNvfIUQ=" = {
- allowed-ips = "0.0.0.0/0;";
- endpoint = "172.105.172.191:51820";
- persistent-keepalive = "25";
- };
- };
- };
- secrets.entries = [
- {
- matchId = "wg-nixnode";
- matchType = "wireguard";
- matchSetting = "wireguard";
- key = "private-key";
- file = config.sops.secrets."wg/nixy/priv".path;
- }
- ];
- };
+ systemd.services."nm-file-secret-agent" = {
+ serviceConfig.User = "boss";
+ };
- systemd.services."nm-file-secret-agent" = {
- serviceConfig.User = "boss";
- };
+ # Set your time zone.
+ time.timeZone = "NZ";
+ # Configure network proxy if necessary
+ # networking.proxy.default = "http://user:password@proxy:port/";
+ # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
- # Set your time zone.
- time.timeZone = "NZ";
+ # Select internationalisation properties.
+ i18n.defaultLocale = "en_US.UTF-8";
+ console = {
+ font = "Lat2-Terminus16";
+ #keyMap = "us";
+ #useXkbConfig = true; # use xkbOptions in tty.
+ };
- # Configure network proxy if necessary
- # networking.proxy.default = "http://user:password@proxy:port/";
- # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+ teh-nix.xorg = {
+ enable = true;
+ };
- # Select internationalisation properties.
- i18n.defaultLocale = "en_US.UTF-8";
- console = {
- font = "Lat2-Terminus16";
- #keyMap = "us";
- #useXkbConfig = true; # use xkbOptions in tty.
- };
+ programs.hyprland = {
+ enable = false;
+ #package = inputs.hyprland.packages.${pkgs.system}.hyprland;
+ #portalPackage = inputs.hyprland.packages.${pkgs.system}.xdg-desktop-portal-hyprland;
+ };
- teh-nix.xorg = {
- enable = true;
- };
+ security.pam.services.swaylock = { };
- programs.hyprland = {
- enable = false;
- #package = inputs.hyprland.packages.${pkgs.system}.hyprland;
- #portalPackage = inputs.hyprland.packages.${pkgs.system}.xdg-desktop-portal-hyprland;
- };
+ # Enable CUPS to print documents.
+ services.printing.enable = true;
+ services.printing.drivers = with pkgs; [
+ hplip
+ ];
+ services.avahi = {
+ enable = true;
+ nssmdns4 = true;
+ openFirewall = true;
+ };
- security.pam.services.swaylock = {};
+ # Enable sound.
+ #sound.enable = true;
+ services.pipewire = {
+ enable = true;
+ alsa.enable = false;
+ alsa.support32Bit = false;
+ pulse.enable = true;
+ };
- # Enable CUPS to print documents.
- services.printing.enable = true;
- services.printing.drivers = with pkgs;[
- hplip
- ];
- services.avahi = {
- enable = true;
- nssmdns4 = true;
- openFirewall = true;
- };
+ services.upower.enable = true;
- # Enable sound.
- #sound.enable = true;
- services.pipewire = {
- enable = true;
- alsa.enable = false;
- alsa.support32Bit = false;
- pulse.enable = true;
- };
+ # Enable touchpad support (enabled default in most desktopManager).
+ security.rtkit.enable = true;
+ services.libinput = {
+ enable = true;
+ mouse = {
+ accelProfile = "flat";
+ };
+ };
- services.upower.enable = true;
+ # Define a user account. Don't forget to set a password with ‘passwd’.
+ users.users.boss = {
+ isNormalUser = true;
+ extraGroups = [
+ "wheel"
+ "networkmanager"
+ "input"
+ "uinput"
+ ];
+ };
- # Enable touchpad support (enabled default in most desktopManager).
- security.rtkit.enable = true;
- services.libinput = {
- enable = true;
- mouse = {
- accelProfile = "flat";
- };
- };
+ fonts.packages = with pkgs; [
+ #(nerdfonts.override { fonts = [ "Cousine" ]; })
+ nerd-fonts.cousine
+ ];
- # Define a user account. Don't forget to set a password with ‘passwd’.
- users.users.boss = {
- isNormalUser = true;
- extraGroups = [ "wheel" "networkmanager" "input" "uinput" ];
- };
+ # List packages installed in system profile. To search, run:
+ # $ nix search wget
+ environment.systemPackages = with pkgs; [
+ vim
+ firefox
+ pfetch
+ fastfetch
+ pinentry-gtk2
+ git
+ nm-file-secret-agent
+ deploy-rs
+ ];
+ documentation.dev.enable = true;
- fonts.packages = with pkgs; [
- #(nerdfonts.override { fonts = [ "Cousine" ]; })
- nerd-fonts.cousine
- ];
+ hardware.graphics.enable32Bit = true;
+ programs.steam = {
+ enable = true;
+ package = pkgs.steam.override {
+ extraEnv = {
+ __NV_PRIME_RENDER_OFFLOAD = 1;
+ __NV_PRIME_RENDER_OFFLOAD_PROVIDER = "NVIDIA-G0";
+ __GLX_VENDOR_LIBRARY_NAME = "nvidia";
+ __VK_LAYER_NV_optimus = "NVIDIA_only";
+ };
+ };
- # List packages installed in system profile. To search, run:
- # $ nix search wget
- environment.systemPackages = with pkgs;
- [
- vim
- firefox
- pfetch
- fastfetch
- pinentry-gtk2
- git
- nm-file-secret-agent
- deploy-rs
- ];
- documentation.dev.enable = true;
+ extraCompatPackages = with pkgs; [
+ proton-ge-bin
+ ];
+ };
- hardware.graphics.enable32Bit = true;
- programs.steam = {
- enable = true;
- package = pkgs.steam.override {
- extraEnv = {
- __NV_PRIME_RENDER_OFFLOAD=1;
- __NV_PRIME_RENDER_OFFLOAD_PROVIDER="NVIDIA-G0";
- __GLX_VENDOR_LIBRARY_NAME="nvidia";
- __VK_LAYER_NV_optimus="NVIDIA_only";
- };
- };
+ # Some programs need SUID wrappers, can be configured further or are
+ # started in user sessions.
+ # programs.mtr.enable = true;
+ programs.gnupg = {
+ agent = {
+ enable = true;
+ pinentryPackage = pkgs.pinentry-gtk2;
+ };
+ # enableSSHSupport = true;
+ };
- extraCompatPackages = with pkgs; [
- proton-ge-bin
- ];
- };
+ hardware.bluetooth.enable = true; # enables support for Bluetooth
+ hardware.bluetooth.powerOnBoot = true; # powers up the default Bluetooth controller on boot
+ services.blueman.enable = true;
- # Some programs need SUID wrappers, can be configured further or are
- # started in user sessions.
- # programs.mtr.enable = true;
- programs.gnupg = {
- agent = {
- enable = true;
- pinentryPackage = pkgs.pinentry-gtk2;
- };
- # enableSSHSupport = true;
- };
+ systemd.tmpfiles.rules = [
+ "f /var/lib/systemd/linger/boss" # enables lingering
+ ];
- hardware.bluetooth.enable = true; # enables support for Bluetooth
- hardware.bluetooth.powerOnBoot = true; # powers up the default Bluetooth controller on boot
- services.blueman.enable = true;
+ # programs.dconf.enable = true;
- systemd.tmpfiles.rules = [
- "f /var/lib/systemd/linger/boss" # enables lingering
- ];
+ services.ratbagd.enable = true;
- # programs.dconf.enable = true;
+ # xdg.portal.enable = true;
+ # services.flatpak.enable = true;
+ stylix = {
+ enable = true;
- services.ratbagd.enable = true;
+ base16Scheme = "${pkgs.base16-schemes}/share/themes/material-palenight.yaml";
- # xdg.portal.enable = true;
- # services.flatpak.enable = true;
+ image = ../../wallpaper.png;
+ targets.grub.useWallpaper = true;
- stylix = {
- enable = true;
+ opacity = {
+ terminal = 0.8;
+ };
- base16Scheme = "${pkgs.base16-schemes}/share/themes/material-palenight.yaml";
+ polarity = "dark";
- image = ../../wallpaper.png;
- targets.grub.useWallpaper = true;
+ fonts = {
+ monospace = {
+ package = pkgs.nerd-fonts.cousine;
+ name = "Cousine Nerd Font Mono";
+ };
- opacity = {
- terminal = 0.8;
- };
+ serif = {
+ package = pkgs.dejavu_fonts;
+ name = "DejaVu Serif";
+ };
- polarity = "dark";
+ sansSerif = {
+ package = pkgs.dejavu_fonts;
+ name = "DejaVu Sans";
+ };
- fonts = {
- monospace = {
- package = pkgs.nerd-fonts.cousine;
- name = "Cousine Nerd Font Mono";
- };
+ emoji = {
+ package = pkgs.noto-fonts-color-emoji;
+ name = "Noto Color Emoji";
+ };
- serif = {
- package = pkgs.dejavu_fonts;
- name = "DejaVu Serif";
- };
+ sizes = {
+ terminal = 10;
+ applications = 10;
+ desktop = 10;
+ popups = 10;
+ };
+ };
- sansSerif = {
- package = pkgs.dejavu_fonts;
- name = "DejaVu Sans";
- };
+ cursor = {
+ package = pkgs.nordzy-cursor-theme;
+ name = "Nordzy-cursors";
+ size = 20;
+ };
+ };
- emoji = {
- package = pkgs.noto-fonts-color-emoji;
- name = "Noto Color Emoji";
- };
+ # Copy the NixOS configuration file and link it from the resulting system
+ # (/run/current-system/configuration.nix). This is useful in case you
+ # accidentally delete configuration.nix.
+ # system.copySystemConfiguration = true;
- sizes = {
- terminal = 10;
- applications = 10;
- desktop = 10;
- popups = 10;
- };
- };
+ # This value determines the NixOS release from which the default
+ # settings for stateful data, like file locations and database versions
+ # on your system were taken. It‘s perfectly fine and recommended to leave
+ # this value at the release version of the first install of this system.
+ # Before changing this value read the documentation for this option
+ # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+ system.stateVersion = "24.05"; # Did you read the comment?
- cursor = {
- package = pkgs.nordzy-cursor-theme;
- name = "Nordzy-cursors";
- size = 20;
- };
- };
-
- # Copy the NixOS configuration file and link it from the resulting system
- # (/run/current-system/configuration.nix). This is useful in case you
- # accidentally delete configuration.nix.
- # system.copySystemConfiguration = true;
-
- # This value determines the NixOS release from which the default
- # settings for stateful data, like file locations and database versions
- # on your system were taken. It‘s perfectly fine and recommended to leave
- # this value at the release version of the first install of this system.
- # Before changing this value read the documentation for this option
- # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
- system.stateVersion = "24.05"; # Did you read the comment?
-
- };
+ };
}
generated by cgit v1.3.1 (git 2.54.0) at 2026-11-03 23:13:25 +0000