Kieran's opinionated (and probably slightly dumb) nix config

Compare changes

Choose any two refs to compare.

Changed files
+160 -86
machines
atalanta
john
modules
home
apps
nixos
-1
README.md
···
├── machines
│ ├── atalanta # my macOS M4 machine
│ ├── ember # my dell r210 server (in my basement)
-
│ ├── john # shared server for cedarville
│ ├── moonlark # my framework 13 <dead>
│ ├── nest # shared tilde server through hc
│ ├── prattle # oracle cloud x86_64 server
+28 -28
flake.lock
···
]
},
"locked": {
-
"lastModified": 1764627417,
-
"narHash": "sha256-D6xc3Rl8Ab6wucJWdvjNsGYGSxNjQHzRc2EZ6eeQ6l4=",
+
"lastModified": 1765326679,
+
"narHash": "sha256-fTLX9kDwLr9Y0rH/nG+h1XG5UU+jBcy0PFYn5eneRX8=",
"owner": "nix-community",
"repo": "disko",
-
"rev": "5a88a6eceb8fd732b983e72b732f6f4b8269bef3",
+
"rev": "d64e5cdca35b5fad7c504f615357a7afe6d9c49e",
"type": "github"
},
"original": {
···
]
},
"locked": {
-
"lastModified": 1765170903,
-
"narHash": "sha256-O8VTGey1xxiRW+Fpb+Ps9zU7ShmxUA1a7cMTcENCVNg=",
+
"lastModified": 1765384171,
+
"narHash": "sha256-FuFtkJrW1Z7u+3lhzPRau69E0CNjADku1mLQQflUORo=",
"owner": "nix-community",
"repo": "home-manager",
-
"rev": "20561be440a11ec57a89715480717baf19fe6343",
+
"rev": "44777152652bc9eacf8876976fa72cc77ca8b9d8",
"type": "github"
},
"original": {
···
"nixpkgs": "nixpkgs_3"
},
"locked": {
-
"lastModified": 1765159287,
-
"narHash": "sha256-C+dVEekU31QPaPShMaUbs3LqOVVqzq0b4gKC1jX8Mlk=",
+
"lastModified": 1765418662,
+
"narHash": "sha256-8SSYagIUn+m9CKUYddq3DN1xkh04KCO0itB/LMgEgpc=",
"owner": "nix-community",
"repo": "nix-vscode-extensions",
-
"rev": "dccd0cc3693bff67e4856b5a22445223aabc4d4b",
+
"rev": "0f6679daa3f5bc2b09827b67f49caf0ac8e3a4c8",
"type": "github"
},
"original": {
···
},
"nixos-facter-modules": {
"locked": {
-
"lastModified": 1764252389,
-
"narHash": "sha256-3bbuneTKZBkYXlm0bE36kUjiDsasoIC1GWBw/UEJ9T4=",
+
"lastModified": 1765442039,
+
"narHash": "sha256-k3lYQ+A1F7aTz8HnlU++bd9t/x/NP2A4v9+x6opcVg0=",
"owner": "numtide",
"repo": "nixos-facter-modules",
-
"rev": "5ea68886d95218646d11d3551a476d458df00778",
+
"rev": "9dd775ee92de63f14edd021d59416e18ac2c00f1",
"type": "github"
},
"original": {
···
},
"nixpkgs-unstable": {
"locked": {
-
"lastModified": 1764950072,
-
"narHash": "sha256-BmPWzogsG2GsXZtlT+MTcAWeDK5hkbGRZTeZNW42fwA=",
+
"lastModified": 1765186076,
+
"narHash": "sha256-hM20uyap1a0M9d344I692r+ik4gTMyj60cQWO+hAYP8=",
"owner": "nixos",
"repo": "nixpkgs",
-
"rev": "f61125a668a320878494449750330ca58b78c557",
+
"rev": "addf7cf5f383a3101ecfba091b98d0a1263dc9b8",
"type": "github"
},
"original": {
···
},
"nixpkgs_4": {
"locked": {
-
"lastModified": 1764983851,
-
"narHash": "sha256-y7RPKl/jJ/KAP/VKLMghMgXTlvNIJMHKskl8/Uuar7o=",
+
"lastModified": 1765311797,
+
"narHash": "sha256-mSD5Ob7a+T2RNjvPvOA1dkJHGVrNVl8ZOrAwBjKBDQo=",
"owner": "nixos",
"repo": "nixpkgs",
-
"rev": "d9bc5c7dceb30d8d6fafa10aeb6aa8a48c218454",
+
"rev": "09eb77e94fa25202af8f3e81ddc7353d9970ac1b",
"type": "github"
},
"original": {
···
},
"locked": {
-
"lastModified": 1765213466,
-
"narHash": "sha256-JdQa7m3a/oWun8TGJ+jamAdxn820RFjqDLNnl4d8a+0=",
+
"lastModified": 1765470296,
+
"narHash": "sha256-bURojPUn8jloR046JNZf6qrYNmEPfFEoDaLTKoP9pg4=",
"owner": "nix-community",
"repo": "NUR",
-
"rev": "0c5cabc4f46e5ce7e45827c22b21173a887acff2",
+
"rev": "441a70568483c0c48b338cca2030e3d9c7aef3ba",
"type": "github"
},
"original": {
···
"sqlite-lib-src": "sqlite-lib-src"
},
"locked": {
-
"lastModified": 1765171220,
-
"narHash": "sha256-K+Cs6k0nQYRwW+RwlKCZabLBOVel84C2wPEZjYOH6JA=",
+
"lastModified": 1765368304,
+
"narHash": "sha256-Q3JC5+FYtsKJU70WIhGhsAYWzu0CvUmmbdYhcFe46Pg=",
"ref": "refs/heads/master",
-
"rev": "ca8217e99806280fa77316b46b0b243647ed491c",
-
"revCount": 1722,
+
"rev": "a53d124ea4746109c1933f7adc72f0bde1309890",
+
"revCount": 1731,
"type": "git",
"url": "https://tangled.org/tangled.org/core"
},
···
"zig2nix": "zig2nix"
},
"locked": {
-
"lastModified": 1765255474,
-
"narHash": "sha256-Bs/wb2EIDe1QHsmHHQ34L0se4eANdGsQpxAsc+gDCrU=",
+
"lastModified": 1765397837,
+
"narHash": "sha256-nMlS9SA8MLJHJ0X/zEg3eG18mLw5vvZpZBbTbVcGFTI=",
"owner": "neurosnap",
"repo": "zmx",
-
"rev": "b5b525c333f086798e319b1a27f2bc0119ebca5c",
+
"rev": "a22dba538a31480ed450b389f397e15880a1c53a",
"type": "github"
},
"original": {
+8 -1
machines/atalanta/home/default.nix
···
zmx = {
enable = true;
-
hosts = [ "t.*" "p.*" "e.*" ];
+
hosts = [ "t.*" "p.*" "e.*" "j.*" ];
};
hosts = {
···
hostname = "192.168.0.94"; # ember
};
+
"j.*" = {
+
hostname = "john.cedarville.edu";
+
user = "klukas";
+
};
+
# Regular hosts
john = {
+
hostname = "john.cedarville.edu";
user = "klukas";
+
zmx = true;
};
bandit = {
-36
machines/john/default.nix
···
-
{
-
inputs,
-
pkgs,
-
...
-
}:
-
{
-
imports = [
-
(inputs.import-tree ../../modules/home)
-
../../modules/home/system/nixpkgs.nix.disabled
-
];
-
-
nixpkgs.enable = true;
-
-
home = {
-
username = "klukas";
-
homeDirectory = "/home/students/2029/klukas";
-
-
packages = with pkgs; [ ];
-
};
-
-
atelier = {
-
shell.enable = true;
-
};
-
-
# Enable home-manager
-
programs.home-manager.enable = true;
-
-
# keep hm in .local/state since we are using nix-portable
-
xdg.enable = true;
-
-
# Nicely reload system units when changing configs
-
systemd.user.startServices = "sd-switch";
-
-
# https://nixos.wiki/wiki/FAQ/When_do_I_update_stateVersion
-
home.stateVersion = "23.05";
-
}
+23 -1
modules/home/apps/bore/default.nix
···
;;
esac
done
+
+
# Prompt for label if not provided via flag and not loaded from saved config
+
if [ -z "$label" ]; then
+
echo
+
# Allow multiple labels selection
+
labels=$(${pkgs.gum}/bin/gum choose --no-limit --header "Labels (select multiple):" "dev" "prod" "custom")
+
+
if [ -n "$labels" ]; then
+
# Check if custom was selected
+
if echo "$labels" | ${pkgs.gnugrep}/bin/grep -q "custom"; then
+
custom_label=$(${pkgs.gum}/bin/gum input --placeholder "my-label" --prompt "Custom label: ")
+
if [ -z "$custom_label" ]; then
+
${pkgs.gum}/bin/gum style --foreground 196 "No custom label provided"
+
exit 1
+
fi
+
# Replace 'custom' with the actual custom label
+
labels=$(echo "$labels" | ${pkgs.gnused}/bin/sed "s/custom/$custom_label/")
+
fi
+
# Join labels with comma
+
label=$(echo "$labels" | ${pkgs.coreutils}/bin/tr '\n' ',' | ${pkgs.gnused}/bin/sed 's/,$//')
+
fi
+
fi
fi
# Check if local port is accessible
···
config_file=$(${pkgs.coreutils}/bin/mktemp)
trap "${pkgs.coreutils}/bin/rm -f $config_file" EXIT
-
# Encode label into proxy name if provided (format: subdomain[label])
+
# Encode label into proxy name if provided (format: subdomain[label1,label2])
proxy_name="$subdomain"
if [ -n "$label" ]; then
proxy_name="''${subdomain}[''${label}]"
+2 -2
modules/home/apps/ssh.nix
···
extraOptions = hostCfg.extraOptions // (
if hostCfg.zmx then
{
-
RemoteCommand = "zmx attach %n";
+
RemoteCommand = "export PATH=$HOME/.nix-profile/bin:$PATH; zmx attach %n";
RequestTTY = "yes";
ControlPath = "~/.ssh/cm-%r@%h:%p";
ControlMaster = "auto";
···
port = mkIf (patternHost.port or null != null) patternHost.port;
user = mkIf (patternHost.user or null != null) patternHost.user;
extraOptions = {
-
RemoteCommand = "zmx attach %k";
+
RemoteCommand = "export PATH=$HOME/.nix-profile/bin:$PATH; zmx attach %k";
RequestTTY = "yes";
ControlPath = "~/.ssh/cm-%r@%h:%p";
ControlMaster = "auto";
+32
modules/nixos/services/bore/README.md
···
+
# Bore
+
+
![screenshot](https://hc-cdn.hel1.your-objectstorage.com/s/v3/7652f29dacb8f76d_screenshot_2025-12-09_at_16.57.47.png)
+
+
Bore is a lightweight wrapper around `frp` which provides a dashboard and a nice `gum` based cli. If you would like to run this in your own nix flake then simplify vendor this folder and `./modules/home/bore` and import the folders into the appropriate home manager and nixos configurations.
+
+
```nix
+
atelier = {
+
bore = {
+
enable = true;
+
authTokenFile = osConfig.age.secrets.bore.path
+
};
+
}
+
```
+
+
and be sure to have a definition for your agenix secret in the osConfig as well:
+
+
```nix
+
age = {
+
identityPaths = [
+
"path/to/ssh/key"
+
];
+
secrets = {
+
bore = {
+
file = ./path/to/bore.age;
+
owner = "username";
+
};
+
};
+
}
+
```
+
+
The secret file is just a oneline file with the key in it. If you do end up deploying this feel free to email me and let me know! I would love to hear about your setup!
-5
modules/nixos/services/bore/bore.nix
···
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
}
-
# Proxy /metrics to frps dashboard
-
handle /metrics {
-
reverse_proxy localhost:7400
-
}
-
# Proxy /api/* to frps dashboard
handle /api/* {
reverse_proxy localhost:7400
+67 -12
modules/nixos/services/bore/dashboard.html
···
.tunnel-label {
display: inline-block;
padding: 0.125rem 0.5rem;
-
background: rgba(251, 146, 60, 0.2);
-
color: #fb923c;
-
border: 1px solid #fb923c;
font-size: 0.7rem;
font-weight: 500;
border-radius: 0;
+
margin-left: 0.25rem;
+
border: 1px solid;
}
.tunnel-url {
···
const MAX_FAIL_COUNT = 3;
let lastProxiesState = null;
+
// Predefined color palette for labels
+
const labelColors = [
+
{ color: '#a78bfa', bg: 'rgba(167, 139, 250, 0.2)' }, // purple
+
{ color: '#f472b6', bg: 'rgba(244, 114, 182, 0.2)' }, // pink
+
{ color: '#facc15', bg: 'rgba(250, 204, 21, 0.2)' }, // yellow
+
{ color: '#60a5fa', bg: 'rgba(96, 165, 250, 0.2)' }, // blue
+
{ color: '#f87171', bg: 'rgba(248, 113, 113, 0.2)' }, // red
+
{ color: '#38bdf8', bg: 'rgba(56, 189, 248, 0.2)' }, // sky
+
{ color: '#c084fc', bg: 'rgba(192, 132, 252, 0.2)' }, // violet
+
{ color: '#fb7185', bg: 'rgba(251, 113, 133, 0.2)' }, // rose
+
];
+
+
// Hash string to index
+
function stringToColorIndex(str) {
+
let hash = 0;
+
for (let i = 0; i < str.length; i++) {
+
hash = str.charCodeAt(i) + ((hash << 5) - hash);
+
}
+
return Math.abs(hash) % labelColors.length;
+
}
+
+
// Get label color and styles
+
function getLabelStyle(label) {
+
const trimmedLabel = label.trim();
+
if (trimmedLabel === 'prod') {
+
return {
+
color: '#22c55e',
+
bgColor: 'rgba(34, 197, 94, 0.2)',
+
borderColor: '#22c55e'
+
};
+
}
+
+
if (trimmedLabel === 'dev') {
+
return {
+
color: '#fb923c',
+
bgColor: 'rgba(251, 146, 60, 0.2)',
+
borderColor: '#fb923c'
+
};
+
}
+
+
const colorIndex = stringToColorIndex(trimmedLabel);
+
const colorScheme = labelColors[colorIndex];
+
return {
+
color: colorScheme.color,
+
bgColor: colorScheme.bg,
+
borderColor: colorScheme.color
+
};
+
}
+
async function fetchStats() {
try {
// Fetch server info
···
const subdomain = proxy.conf?.subdomain || 'unknown';
const url = `https://${subdomain}.bore.dunkirk.sh`;
-
// Parse label from proxy name (format: subdomain[label])
+
// Parse labels from proxy name (format: subdomain[label1,label2])
const labelMatch = proxy.name.match(/\[([^\]]+)\]$/);
-
const label = labelMatch ? labelMatch[1] : null;
-
const displayName = label ? proxy.name.replace(/\[[^\]]+\]$/, '') : proxy.name;
+
const labels = labelMatch ? labelMatch[1].split(',') : [];
+
const displayName = labels.length > 0 ? proxy.name.replace(/\[[^\]]+\]$/, '') : proxy.name;
+
+
const labelHtml = labels.map(label => {
+
const trimmedLabel = label.trim();
+
const style = getLabelStyle(trimmedLabel);
+
return `<span class="tunnel-label" style="color: ${style.color}; background: ${style.bgColor}; border-color: ${style.borderColor};">${trimmedLabel}</span>`;
+
}).join('');
return `
<div class="tunnel" data-tunnel="${proxy.name}">
<div class="tunnel-info">
<div class="tunnel-name">
${displayName || 'unnamed'}
-
${label ? `<span class="tunnel-label">${label}</span>` : ''}
+
${labelHtml}
</div>
<div class="tunnel-url">
<a href="${url}" target="_blank">${url}</a>
···
html += '<div class="offline-tunnels">';
html += '<div style="color: #8b949e; font-size: 0.85rem; margin-bottom: 0.75rem;">recently disconnected</div>';
html += offlineTunnels.map(proxy => {
-
// Parse label from proxy name (format: subdomain[label])
+
// Parse labels from proxy name (format: subdomain[label1,label2])
const labelMatch = proxy.name.match(/\[([^\]]+)\]$/);
-
const label = labelMatch ? labelMatch[1] : null;
-
const displayName = label ? proxy.name.replace(/\[[^\]]+\]$/, '') : proxy.name;
+
const labels = labelMatch ? labelMatch[1].split(',').map(l => l.trim()) : [];
+
const displayName = labels.length > 0 ? proxy.name.replace(/\[[^\]]+\]$/, '') : proxy.name;
+
const labelStr = labels.length > 0 ? ` [${labels.join(', ')}]` : '';
if (!proxy.conf) {
return `
<div class="offline-tunnel" data-tunnel="${proxy.name}">
-
<span class="offline-tunnel-name">${displayName || 'unnamed'}${label ? ` [${label}]` : ''}</span>
+
<span class="offline-tunnel-name">${displayName || 'unnamed'}${labelStr}</span>
<span class="offline-tunnel-stats">in: <span data-traffic-in="${proxy.name}">0 B</span> • out: <span data-traffic-out="${proxy.name}">0 B</span></span>
</div>
`;
···
const url = `https://${subdomain}.bore.dunkirk.sh`;
return `
<div class="offline-tunnel" data-tunnel="${proxy.name}">
-
<span class="offline-tunnel-name">${displayName || 'unnamed'}${label ? ` [${label}]` : ''} → ${url}</span>
+
<span class="offline-tunnel-name">${displayName || 'unnamed'}${labelStr} → ${url}</span>
<span class="offline-tunnel-stats">in: <span data-traffic-in="${proxy.name}">0 B</span> • out: <span data-traffic-out="${proxy.name}">0 B</span></span>
</div>
`;