Kieran's opinionated (and probably slightly dumb) nix config

Compare changes

Choose any two refs to compare.

+8
.github/workflows/deploy.yaml
···
- name: Install Nix
uses: DeterminateSystems/determinate-nix-action@main
+
with:
+
extra-conf: |
+
extra-platforms = aarch64-linux
+
+
- name: Set up QEMU
+
uses: docker/setup-qemu-action@v3
+
with:
+
platforms: arm64
- name: Setup Tailscale
uses: tailscale/github-action@v3
-1
README.md
···
├── machines
│ ├── atalanta # my macOS M4 machine
│ ├── ember # my dell r210 server (in my basement)
-
│ ├── john # shared server for cedarville
│ ├── moonlark # my framework 13 <dead>
│ ├── nest # shared tilde server through hc
│ ├── prattle # oracle cloud x86_64 server
+124 -38
flake.lock
···
]
},
"locked": {
-
"lastModified": 1764979146,
-
"narHash": "sha256-Cs9JvUD5p+Dfd2o3vCNEjSOy/DaBKKqt0mIri6mfWQA=",
+
"lastModified": 1765226744,
+
"narHash": "sha256-3uCn0DQPlyYufnTeugp4qZbdddv4q2a+y9hXdgH/iOU=",
"owner": "taciturnaxolotl",
"repo": "battleship-arena",
-
"rev": "e4a5d2409503d77bc31d2a4b3b27211ae837ea06",
+
"rev": "20d9604ef8fdd7e30244ef6e7d4cde541c4a0863",
"type": "github"
},
"original": {
···
]
},
"locked": {
-
"lastModified": 1764627417,
-
"narHash": "sha256-D6xc3Rl8Ab6wucJWdvjNsGYGSxNjQHzRc2EZ6eeQ6l4=",
+
"lastModified": 1765326679,
+
"narHash": "sha256-fTLX9kDwLr9Y0rH/nG+h1XG5UU+jBcy0PFYn5eneRX8=",
"owner": "nix-community",
"repo": "disko",
-
"rev": "5a88a6eceb8fd732b983e72b732f6f4b8269bef3",
+
"rev": "d64e5cdca35b5fad7c504f615357a7afe6d9c49e",
"type": "github"
},
"original": {
···
"type": "github"
}
},
+
"flake-utils_7": {
+
"inputs": {
+
"systems": "systems_10"
+
},
+
"locked": {
+
"lastModified": 1731533236,
+
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+
"owner": "numtide",
+
"repo": "flake-utils",
+
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+
"type": "github"
+
},
+
"original": {
+
"owner": "numtide",
+
"repo": "flake-utils",
+
"type": "github"
+
}
+
},
"flare": {
"inputs": {
"flake-utils": "flake-utils_3",
···
]
},
"locked": {
-
"lastModified": 1764866045,
-
"narHash": "sha256-0GsEtXV9OquDQ1VclQfP16cU5VZh7NEVIOjSH4UaJuM=",
+
"lastModified": 1765384171,
+
"narHash": "sha256-FuFtkJrW1Z7u+3lhzPRau69E0CNjADku1mLQQflUORo=",
"owner": "nix-community",
"repo": "home-manager",
-
"rev": "f63d0fe9d81d36e5fc95497217a72e02b8b7bcab",
+
"rev": "44777152652bc9eacf8876976fa72cc77ca8b9d8",
"type": "github"
},
"original": {
···
]
},
"locked": {
-
"lastModified": 1764589287,
-
"narHash": "sha256-71vBBU9GC+A+tdqAuFDRdx8WEVuj4OaVY5apoaAALkc=",
+
"lastModified": 1765113580,
+
"narHash": "sha256-b8YOwGDFprkQJjXsKGuSNS1pWe8w4cUW36YxlUelNpU=",
"owner": "hyprwm",
"repo": "contrib",
-
"rev": "e88d93f8aed2b9631b62ca273590fd3528310d7e",
+
"rev": "db18f83bebbc2cf43a21dbb26cd99aabe672d923",
"type": "github"
},
"original": {
···
]
},
"locked": {
-
"lastModified": 1764161084,
-
"narHash": "sha256-HN84sByg9FhJnojkGGDSrcjcbeioFWoNXfuyYfJ1kBE=",
+
"lastModified": 1765066094,
+
"narHash": "sha256-0YSU35gfRFJzx/lTGgOt6ubP8K6LeW0vaywzNNqxkl4=",
"owner": "nix-darwin",
"repo": "nix-darwin",
-
"rev": "e95de00a471d07435e0527ff4db092c84998698e",
+
"rev": "688427b1aab9afb478ca07989dc754fa543e03d5",
"type": "github"
},
"original": {
···
"nixpkgs": "nixpkgs_3"
},
"locked": {
-
"lastModified": 1764813642,
-
"narHash": "sha256-z/znqf9lNPFfFcUEh0K1hD+SDWu7E1ZCaMq8iZLhRWY=",
+
"lastModified": 1765418662,
+
"narHash": "sha256-8SSYagIUn+m9CKUYddq3DN1xkh04KCO0itB/LMgEgpc=",
"owner": "nix-community",
"repo": "nix-vscode-extensions",
-
"rev": "8a8477df6c22e188f61ea011c4654cf1a929fa54",
+
"rev": "0f6679daa3f5bc2b09827b67f49caf0ac8e3a4c8",
"type": "github"
},
"original": {
···
},
"nixos-facter-modules": {
"locked": {
-
"lastModified": 1764252389,
-
"narHash": "sha256-3bbuneTKZBkYXlm0bE36kUjiDsasoIC1GWBw/UEJ9T4=",
+
"lastModified": 1765442039,
+
"narHash": "sha256-k3lYQ+A1F7aTz8HnlU++bd9t/x/NP2A4v9+x6opcVg0=",
"owner": "numtide",
"repo": "nixos-facter-modules",
-
"rev": "5ea68886d95218646d11d3551a476d458df00778",
+
"rev": "9dd775ee92de63f14edd021d59416e18ac2c00f1",
"type": "github"
},
"original": {
···
},
"nixpkgs-unstable": {
"locked": {
-
"lastModified": 1764667669,
-
"narHash": "sha256-7WUCZfmqLAssbDqwg9cUDAXrSoXN79eEEq17qhTNM/Y=",
+
"lastModified": 1765186076,
+
"narHash": "sha256-hM20uyap1a0M9d344I692r+ik4gTMyj60cQWO+hAYP8=",
"owner": "nixos",
"repo": "nixpkgs",
-
"rev": "418468ac9527e799809c900eda37cbff999199b6",
+
"rev": "addf7cf5f383a3101ecfba091b98d0a1263dc9b8",
"type": "github"
},
"original": {
···
},
"nixpkgs_4": {
"locked": {
-
"lastModified": 1764677808,
-
"narHash": "sha256-H3lC7knbXOBrHI9hITQ7modLuX20mYJVhZORL5ioms0=",
+
"lastModified": 1765311797,
+
"narHash": "sha256-mSD5Ob7a+T2RNjvPvOA1dkJHGVrNVl8ZOrAwBjKBDQo=",
"owner": "nixos",
"repo": "nixpkgs",
-
"rev": "1aab89277eb2d87823d5b69bae631a2496cff57a",
+
"rev": "09eb77e94fa25202af8f3e81ddc7353d9970ac1b",
"type": "github"
},
"original": {
···
"type": "github"
}
},
+
"nixpkgs_8": {
+
"locked": {
+
"lastModified": 1764635402,
+
"narHash": "sha256-6rYcajRLe2C5ZYnV1HYskJl+QAkhvseWTzbdQiTN9OI=",
+
"owner": "nixos",
+
"repo": "nixpkgs",
+
"rev": "5f53b0d46d320352684242d000b36dcfbbf7b0bc",
+
"type": "github"
+
},
+
"original": {
+
"owner": "nixos",
+
"repo": "nixpkgs",
+
"type": "github"
+
}
+
},
"nixvim": {
"inputs": {
"flake-parts": "flake-parts",
···
},
"locked": {
-
"lastModified": 1764881827,
-
"narHash": "sha256-mwyl6U7n9z5tIpUlOFBmKzYXy095jwv/pRpZAExaqJU=",
+
"lastModified": 1765470296,
+
"narHash": "sha256-bURojPUn8jloR046JNZf6qrYNmEPfFEoDaLTKoP9pg4=",
"owner": "nix-community",
"repo": "NUR",
-
"rev": "05acda38483e70a819d48cb61170ff0152e8e220",
+
"rev": "441a70568483c0c48b338cca2030e3d9c7aef3ba",
"type": "github"
},
"original": {
···
"spicetify-nix": "spicetify-nix",
"tangled": "tangled",
"terminal-wakatime": "terminal-wakatime",
-
"wakatime-ls": "wakatime-ls"
+
"wakatime-ls": "wakatime-ls",
+
"zmx": "zmx"
},
"rust-overlay": {
···
"systems": "systems_8"
},
"locked": {
-
"lastModified": 1764698597,
-
"narHash": "sha256-4f0y9Fo3AChngd/qRQ7wbcy6FH33NFZbyFXn7IeUI14=",
+
"lastModified": 1765082296,
+
"narHash": "sha256-EcefoixU9ht+P6QB/TfjLY9E3MdJVfeSec6G8Ges0pA=",
"owner": "Gerg-L",
"repo": "spicetify-nix",
-
"rev": "1da6ebbbcf0301ff773e9c43bdd4c051af9523f7",
+
"rev": "ac4927ea1ec7e7ea3635a1d8b933106a596c4356",
"type": "github"
},
"original": {
···
"type": "github"
},
+
"systems_10": {
+
"locked": {
+
"lastModified": 1681028828,
+
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+
"owner": "nix-systems",
+
"repo": "default",
+
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+
"type": "github"
+
},
+
"original": {
+
"owner": "nix-systems",
+
"repo": "default",
+
"type": "github"
+
}
+
},
"systems_2": {
"locked": {
"lastModified": 1681028828,
···
"sqlite-lib-src": "sqlite-lib-src"
},
"locked": {
-
"lastModified": 1764871901,
-
"narHash": "sha256-P+4bXuzU66XYwvhw4SIC6T/dS5O5ascASGL4cb2TNuI=",
+
"lastModified": 1765368304,
+
"narHash": "sha256-Q3JC5+FYtsKJU70WIhGhsAYWzu0CvUmmbdYhcFe46Pg=",
"ref": "refs/heads/master",
-
"rev": "ca41f2429eb734a16c5f5061940acda4033d437f",
-
"revCount": 1697,
+
"rev": "a53d124ea4746109c1933f7adc72f0bde1309890",
+
"revCount": 1731,
"type": "git",
"url": "https://tangled.org/tangled.org/core"
},
···
"original": {
"owner": "mrnossiom",
"repo": "wakatime-ls",
+
"type": "github"
+
}
+
},
+
"zig2nix": {
+
"inputs": {
+
"flake-utils": "flake-utils_7",
+
"nixpkgs": "nixpkgs_8"
+
},
+
"locked": {
+
"lastModified": 1764678235,
+
"narHash": "sha256-NNQWR3DAufaH7fs6ZplfAv1xPHEc0Ne3Z0v4MNHCqSw=",
+
"owner": "Cloudef",
+
"repo": "zig2nix",
+
"rev": "8b6ec85bccdf6b91ded19e9ef671205937e271e6",
+
"type": "github"
+
},
+
"original": {
+
"owner": "Cloudef",
+
"repo": "zig2nix",
+
"type": "github"
+
}
+
},
+
"zmx": {
+
"inputs": {
+
"zig2nix": "zig2nix"
+
},
+
"locked": {
+
"lastModified": 1765397837,
+
"narHash": "sha256-nMlS9SA8MLJHJ0X/zEg3eG18mLw5vvZpZBbTbVcGFTI=",
+
"owner": "neurosnap",
+
"repo": "zmx",
+
"rev": "a22dba538a31480ed450b389f397e15880a1c53a",
+
"type": "github"
+
},
+
"original": {
+
"owner": "neurosnap",
+
"repo": "zmx",
"type": "github"
+7
flake.nix
···
url = "github:taciturnaxolotl/battleship-arena";
inputs.nixpkgs.follows = "nixpkgs";
};
+
+
zmx = {
+
url = "github:neurosnap/zmx";
+
};
};
outputs =
···
hash = "sha256-7mkrPl2CQSfc1lRjl1ilwxdYcK5iRU//QGKmdCicK30=";
};
});
+
+
zmx-binary = prev.callPackage ./packages/zmx.nix { };
})
];
};
···
home-manager.darwinModules.home-manager
agenix.darwinModules.default
unstable-overlays
+
nur.modules.darwin.default
./machines/atalanta
];
};
+4
machines/atalanta/default.nix
···
file = ../../secrets/context7.age;
owner = "kierank";
};
+
frp-auth-token = {
+
file = ../../secrets/frp-auth-token.age;
+
owner = "kierank";
+
};
};
environment.variables = {
+73 -2
machines/atalanta/home/default.nix
···
{
inputs,
pkgs,
+
osConfig,
...
}:
{
imports = [
(inputs.import-tree ../../../modules/home)
];
-
-
nixpkgs.enable = true;
home = {
username = "kierank";
···
enable = true;
swift = true;
};
+
};
+
bore = {
+
enable = true;
+
authTokenFile = osConfig.age.secrets.frp-auth-token.path;
+
};
+
ssh = {
+
enable = true;
+
+
zmx = {
+
enable = true;
+
hosts = [ "t.*" "p.*" "e.*" "j.*" ];
+
};
+
+
hosts = {
+
# Dynamic zmx sessions per server
+
"t.*" = {
+
hostname = "150.136.15.177"; # terebithia
+
};
+
+
"p.*" = {
+
hostname = "150.136.63.103"; # prattle
+
};
+
+
"e.*" = {
+
hostname = "192.168.0.94"; # ember
+
};
+
+
"j.*" = {
+
hostname = "john.cedarville.edu";
+
user = "klukas";
+
};
+
+
# Regular hosts
+
john = {
+
hostname = "john.cedarville.edu";
+
user = "klukas";
+
zmx = true;
+
};
+
+
bandit = {
+
hostname = "bandit.labs.overthewire.org";
+
port = 2220;
+
};
+
+
kali = {
+
user = "kali";
+
};
+
+
terebithia = {
+
hostname = "150.136.15.177";
+
zmx = true;
+
};
+
+
prattle = {
+
hostname = "150.136.63.103";
+
zmx = true;
+
};
+
+
ember = {
+
hostname = "192.168.0.94";
+
zmx = true;
+
};
+
+
remarkable = {
+
hostname = "10.11.99.01";
+
user = "root";
+
};
+
};
+
+
extraConfig = ''
+
IdentityFile ~/.ssh/id_rsa
+
'';
};
};
+1
machines/atalanta/home-manager.nix
···
];
home-manager = {
+
useGlobalPkgs = true;
extraSpecialArgs = {
inherit inputs outputs;
};
+5
machines/ember/default.nix
···
{
imports = [
(inputs.import-tree ../../modules/home)
+
../../modules/home/system/nixpkgs.nix.disabled
];
nixpkgs.enable = true;
···
shell.enable = true;
apps = {
helix.enable = true;
+
};
+
ssh = {
+
enable = true;
+
zmx.enable = true;
};
};
-35
machines/john/default.nix
···
-
{
-
inputs,
-
pkgs,
-
...
-
}:
-
{
-
imports = [
-
(inputs.import-tree ../../modules/home)
-
];
-
-
nixpkgs.enable = true;
-
-
home = {
-
username = "klukas";
-
homeDirectory = "/home/students/2029/klukas";
-
-
packages = with pkgs; [ ];
-
};
-
-
atelier = {
-
shell.enable = true;
-
};
-
-
# Enable home-manager
-
programs.home-manager.enable = true;
-
-
# keep hm in .local/state since we are using nix-portable
-
xdg.enable = true;
-
-
# Nicely reload system units when changing configs
-
systemd.user.startServices = "sd-switch";
-
-
# https://nixos.wiki/wiki/FAQ/When_do_I_update_stateVersion
-
home.stateVersion = "23.05";
-
}
-2
machines/moonlark/home/default.nix
···
(inputs.import-tree ../../../modules/home)
];
-
nixpkgs.enable = true;
-
home = {
username = "kierank";
homeDirectory = "/home/kierank";
+1
machines/moonlark/home-manager.nix
···
];
home-manager = {
+
useGlobalPkgs = true;
extraSpecialArgs = {
inherit inputs outputs;
};
+5
machines/nest/default.nix
···
{
imports = [
(inputs.import-tree ../../modules/home)
+
../../modules/home/system/nixpkgs.nix.disabled
];
nixpkgs.enable = true;
···
shell.enable = true;
apps = {
helix.enable = true;
+
};
+
ssh = {
+
enable = true;
+
zmx.enable = true;
};
};
+7 -2
machines/prattle/home/default.nix
···
(inputs.import-tree ../../../modules/home)
];
-
nixpkgs.enable = true;
-
home = {
username = "kierank";
homeDirectory = "/home/kierank";
+
};
+
+
atelier = {
+
ssh = {
+
enable = true;
+
zmx.enable = true;
+
};
};
programs.home-manager.enable = true;
+1
machines/prattle/home-manager.nix
···
];
home-manager = {
+
useGlobalPkgs = true;
extraSpecialArgs = {
inherit inputs outputs;
};
+1
machines/tacyon/default.nix
···
{
imports = [
(inputs.import-tree ../../modules/home)
+
../../modules/home/system/nixpkgs.nix.disabled
];
nixpkgs.enable = true;
+9
machines/terebithia/default.nix
···
file = ../../secrets/battleship-arena.age;
owner = "battleship-arena";
};
+
frp-auth-token = {
+
file = ../../secrets/frp-auth-token.age;
+
};
};
environment.sessionVariables = {
···
atelier.services.knot-sync = {
enable = true;
secretsFile = config.age.secrets.github-knot-sync.path;
+
};
+
+
atelier.services.frps = {
+
enable = true;
+
domain = "bore.dunkirk.sh";
+
authTokenFile = config.age.secrets.frp-auth-token.path;
};
services.n8n = {
+4 -2
machines/terebithia/home/default.nix
···
(inputs.import-tree ../../../modules/home)
];
-
nixpkgs.enable = true;
-
home = {
username = "kierank";
homeDirectory = "/home/kierank";
···
apps = {
helix.enable = true;
irssi.enable = true;
+
};
+
ssh = {
+
enable = true;
+
zmx.enable = true;
};
};
+1
machines/terebithia/home-manager.nix
···
];
home-manager = {
+
useGlobalPkgs = true;
extraSpecialArgs = {
inherit inputs outputs;
};
+131
modules/home/apps/bore/bore.1.md
···
+
% BORE(1) bore 1.0
+
% Kieran Klukas
+
% December 2024
+
+
# NAME
+
+
bore - secure tunneling service for exposing local services to the internet
+
+
# SYNOPSIS
+
+
**bore** [*SUBDOMAIN*] [*PORT*] [**--protocol** *PROTOCOL*] [**--label** *LABEL*] [**--save**]
+
+
**bore** **--list** | **-l**
+
+
**bore** **--saved** | **-s**
+
+
# DESCRIPTION
+
+
**bore** is a tunneling service that uses frp (fast reverse proxy) to expose local services to the internet via bore.dunkirk.sh. It provides a simple CLI for creating and managing HTTP, TCP, and UDP tunnels with optional labels and persistent configuration.
+
+
# OPTIONS
+
+
**-l**, **--list**
+
: List all active tunnels on the bore server.
+
+
**-s**, **--saved**
+
: List all saved tunnel configurations from bore.toml in the current directory.
+
+
**-p**, **--protocol** *PROTOCOL*
+
: Specify the protocol to use for the tunnel: **http** (default), **tcp**, or **udp**.
+
+
**--label** *LABEL*
+
: Assign a label/tag to the tunnel for organization and identification.
+
+
**--save**
+
: Save the tunnel configuration to bore.toml in the current directory for future use.
+
+
# ARGUMENTS
+
+
*SUBDOMAIN*
+
: The subdomain to use for the tunnel (e.g., "myapp" creates myapp.bore.dunkirk.sh). Must contain only lowercase letters, numbers, and hyphens.
+
+
*PORT*
+
: The local port to expose (e.g., 8000 for localhost:8000).
+
+
# CONFIGURATION
+
+
Tunnel configurations can be saved to a **bore.toml** file in the current directory. This file uses TOML format and can be committed to repositories.
+
+
## bore.toml Format
+
+
```toml
+
[myapp]
+
port = 8000
+
+
[api]
+
port = 3000
+
protocol = "http"
+
label = "dev"
+
+
[database]
+
port = 5432
+
protocol = "tcp"
+
label = "postgres"
+
+
[game-server]
+
port = 27015
+
protocol = "udp"
+
label = "game"
+
```
+
+
When running **bore** without arguments in a directory with bore.toml, you'll be prompted to choose between creating a new tunnel or using a saved configuration.
+
+
# EXAMPLES
+
+
Create a simple HTTP tunnel:
+
```
+
$ bore myapp 8000
+
```
+
+
Create an HTTP tunnel with a label:
+
```
+
$ bore api 3000 --label dev
+
```
+
+
Create a TCP tunnel for a database:
+
```
+
$ bore database 5432 --protocol tcp --label postgres
+
```
+
+
Create a UDP tunnel for a game server:
+
```
+
$ bore game-server 27015 --protocol udp --label game
+
```
+
+
Save a tunnel configuration:
+
```
+
$ bore frontend 5173 --label local --save
+
```
+
+
List active tunnels:
+
```
+
$ bore --list
+
```
+
+
List saved configurations:
+
```
+
$ bore --saved
+
```
+
+
Interactive mode (choose saved or new):
+
```
+
$ bore
+
```
+
+
# FILES
+
+
**bore.toml**
+
: Local tunnel configuration file (current directory)
+
+
# SEE ALSO
+
+
Dashboard: https://bore.dunkirk.sh
+
+
# BUGS
+
+
Report bugs at: https://github.com/yourusername/dots/issues
+
+
# AUTHORS
+
+
Kieran Klukas <crush@charm.land>
+38
modules/home/apps/bore/completions/bore.bash
···
+
# bash completion for bore
+
+
_bore_completion() {
+
local cur prev opts
+
COMPREPLY=()
+
cur="${COMP_WORDS[COMP_CWORD]}"
+
prev="${COMP_WORDS[COMP_CWORD-1]}"
+
opts="--list --saved --protocol --label --save -l -s -p"
+
+
# Complete flags
+
if [[ ${cur} == -* ]]; then
+
COMPREPLY=( $(compgen -W "${opts}" -- ${cur}) )
+
return 0
+
fi
+
+
# Complete protocol values after --protocol or -p
+
if [[ ${prev} == "--protocol" ]] || [[ ${prev} == "-p" ]]; then
+
COMPREPLY=( $(compgen -W "http tcp udp" -- ${cur}) )
+
return 0
+
fi
+
+
# Complete label value after --label or -l
+
if [[ ${prev} == "--label" ]] || [[ ${prev} == "-l" ]]; then
+
# Could potentially read from bore.toml for label suggestions
+
return 0
+
fi
+
+
# Complete saved tunnel names as first argument
+
if [[ ${COMP_CWORD} -eq 1 ]] && [[ -f "bore.toml" ]]; then
+
local tunnels=$(grep '^\[' bore.toml | sed 's/^\[\(.*\)\]$/\1/')
+
COMPREPLY=( $(compgen -W "${tunnels}" -- ${cur}) )
+
return 0
+
fi
+
+
return 0
+
}
+
+
complete -F _bore_completion bore
+21
modules/home/apps/bore/completions/bore.fish
···
+
# fish completion for bore
+
+
# Helper function to get saved tunnel names
+
function __bore_saved_tunnels
+
if test -f bore.toml
+
grep '^\[' bore.toml | sed 's/^\[\(.*\)\]$/\1/'
+
end
+
end
+
+
# Complete flags
+
complete -c bore -s l -l list -d 'List active tunnels'
+
complete -c bore -s s -l saved -d 'List saved tunnels from bore.toml'
+
complete -c bore -s p -l protocol -d 'Specify protocol' -xa 'http tcp udp'
+
complete -c bore -l label -d 'Assign a label to the tunnel' -r
+
complete -c bore -l save -d 'Save tunnel configuration to bore.toml'
+
+
# Complete subdomain from saved tunnels (first argument)
+
complete -c bore -n '__fish_is_first_token' -a '(__bore_saved_tunnels)' -d 'Saved tunnel'
+
+
# Port is always a number (second argument)
+
complete -c bore -n 'test (count (commandline -opc)) -eq 2' -d 'Local port'
+42
modules/home/apps/bore/completions/bore.zsh
···
+
#compdef bore
+
+
_bore() {
+
local -a tunnels
+
local curcontext="$curcontext" state line
+
typeset -A opt_args
+
+
# Read saved tunnels from bore.toml if it exists
+
if [[ -f "bore.toml" ]]; then
+
tunnels=(${(f)"$(grep '^\[' bore.toml | sed 's/^\[\(.*\)\]$/\1/')"})
+
fi
+
+
_arguments -C \
+
'1: :->subdomain' \
+
'2: :->port' \
+
'--list[List active tunnels]' \
+
'-l[List active tunnels]' \
+
'--saved[List saved tunnels from bore.toml]' \
+
'-s[List saved tunnels from bore.toml]' \
+
'--protocol[Specify protocol]:protocol:(http tcp udp)' \
+
'-p[Specify protocol]:protocol:(http tcp udp)' \
+
'--label[Assign a label to the tunnel]:label:' \
+
'--save[Save tunnel configuration to bore.toml]' \
+
&& return 0
+
+
case $state in
+
subdomain)
+
if [[ ${#tunnels[@]} -gt 0 ]]; then
+
_describe 'saved tunnels' tunnels
+
else
+
_message 'subdomain (e.g., myapp)'
+
fi
+
;;
+
port)
+
_message 'local port (e.g., 8000)'
+
;;
+
esac
+
+
return 0
+
}
+
+
_bore "$@"
+490
modules/home/apps/bore/default.nix
···
+
{
+
config,
+
lib,
+
pkgs,
+
...
+
}:
+
let
+
cfg = config.atelier.bore;
+
+
boreScript = pkgs.writeShellScript "bore" ''
+
CONFIG_FILE="bore.toml"
+
+
# Check for flags
+
if [ "$1" = "--list" ] || [ "$1" = "-l" ]; then
+
${pkgs.gum}/bin/gum style --bold --foreground 212 "Active tunnels"
+
echo
+
+
tunnels=$(${pkgs.curl}/bin/curl -s https://${cfg.domain}/api/proxy/http)
+
+
if ! echo "$tunnels" | ${pkgs.jq}/bin/jq -e '.proxies | length > 0' >/dev/null 2>&1; then
+
${pkgs.gum}/bin/gum style --foreground 117 "No active tunnels"
+
exit 0
+
fi
+
+
# Filter only online tunnels with valid conf
+
echo "$tunnels" | ${pkgs.jq}/bin/jq -r '.proxies[] | select(.status == "online" and .conf != null) | if .type == "http" then "\(.name) → https://\(.conf.subdomain).${cfg.domain} [http]" elif .type == "tcp" then "\(.name) → tcp://\(.conf.remotePort) → localhost:\(.conf.localPort) [tcp]" elif .type == "udp" then "\(.name) → udp://\(.conf.remotePort) → localhost:\(.conf.localPort) [udp]" else "\(.name) [\(.type)]" end' | while read -r line; do
+
${pkgs.gum}/bin/gum style --foreground 35 "✓ $line"
+
done
+
exit 0
+
fi
+
+
if [ "$1" = "--saved" ] || [ "$1" = "-s" ]; then
+
if [ ! -f "$CONFIG_FILE" ]; then
+
${pkgs.gum}/bin/gum style --foreground 117 "No bore.toml found in current directory"
+
exit 0
+
fi
+
+
${pkgs.gum}/bin/gum style --bold --foreground 212 "Saved tunnels in bore.toml"
+
echo
+
+
# Parse TOML and show tunnels
+
while IFS= read -r line; do
+
if [[ "$line" =~ ^\[([^]]+)\] ]]; then
+
current_tunnel="''${BASH_REMATCH[1]}"
+
elif [[ "$line" =~ ^port[[:space:]]*=[[:space:]]*([0-9]+) ]]; then
+
port="''${BASH_REMATCH[1]}"
+
elif [[ "$line" =~ ^protocol[[:space:]]*=[[:space:]]*\"([^\"]+)\" ]]; then
+
protocol="''${BASH_REMATCH[1]}"
+
elif [[ "$line" =~ ^label[[:space:]]*=[[:space:]]*\"([^\"]+)\" ]]; then
+
label="''${BASH_REMATCH[1]}"
+
proto_display="''${protocol:-http}"
+
${pkgs.gum}/bin/gum style --foreground 35 "✓ $current_tunnel → localhost:$port [$proto_display] [$label]"
+
label=""
+
protocol=""
+
elif [[ -z "$line" ]] && [[ -n "$current_tunnel" ]] && [[ -n "$port" ]]; then
+
proto_display="''${protocol:-http}"
+
${pkgs.gum}/bin/gum style --foreground 35 "✓ $current_tunnel → localhost:$port [$proto_display]"
+
current_tunnel=""
+
port=""
+
protocol=""
+
fi
+
done < "$CONFIG_FILE"
+
+
# Handle last entry if file doesn't end with blank line
+
if [[ -n "$current_tunnel" ]] && [[ -n "$port" ]]; then
+
proto_display="''${protocol:-http}"
+
if [[ -n "$label" ]]; then
+
${pkgs.gum}/bin/gum style --foreground 35 "✓ $current_tunnel → localhost:$port [$proto_display] [$label]"
+
else
+
${pkgs.gum}/bin/gum style --foreground 35 "✓ $current_tunnel → localhost:$port [$proto_display]"
+
fi
+
fi
+
exit 0
+
fi
+
+
# Get tunnel name/subdomain
+
if [ -n "$1" ]; then
+
tunnel_name="$1"
+
else
+
# Check if we have a bore.toml in current directory
+
if [ -f "$CONFIG_FILE" ]; then
+
# Count tunnels in TOML
+
tunnel_count=$(${pkgs.gnugrep}/bin/grep -c '^\[' "$CONFIG_FILE" 2>/dev/null || echo "0")
+
+
if [ "$tunnel_count" -gt 0 ]; then
+
${pkgs.gum}/bin/gum style --bold --foreground 212 "Creating bore tunnel"
+
echo
+
+
# Show choice between new or saved
+
choice=$(${pkgs.gum}/bin/gum choose "New tunnel" "Use saved tunnel")
+
+
if [ "$choice" = "Use saved tunnel" ]; then
+
# Extract tunnel names from TOML
+
saved_names=$(${pkgs.gnugrep}/bin/grep '^\[' "$CONFIG_FILE" | ${pkgs.gnused}/bin/sed 's/^\[\(.*\)\]$/\1/')
+
tunnel_name=$(echo "$saved_names" | ${pkgs.gum}/bin/gum choose)
+
+
if [ -z "$tunnel_name" ]; then
+
${pkgs.gum}/bin/gum style --foreground 196 "No tunnel selected"
+
exit 1
+
fi
+
+
# Parse TOML for this tunnel's config
+
in_section=false
+
while IFS= read -r line; do
+
if [[ "$line" =~ ^\[([^]]+)\] ]]; then
+
if [[ "''${BASH_REMATCH[1]}" = "$tunnel_name" ]]; then
+
in_section=true
+
else
+
in_section=false
+
fi
+
elif [[ "$in_section" = true ]]; then
+
if [[ "$line" =~ ^port[[:space:]]*=[[:space:]]*([0-9]+) ]]; then
+
port="''${BASH_REMATCH[1]}"
+
elif [[ "$line" =~ ^protocol[[:space:]]*=[[:space:]]*\"([^\"]+)\" ]]; then
+
protocol="''${BASH_REMATCH[1]}"
+
elif [[ "$line" =~ ^label[[:space:]]*=[[:space:]]*\"([^\"]+)\" ]]; then
+
label="''${BASH_REMATCH[1]}"
+
fi
+
fi
+
done < "$CONFIG_FILE"
+
+
proto_display="''${protocol:-http}"
+
${pkgs.gum}/bin/gum style --foreground 35 "✓ Loaded from bore.toml: $tunnel_name → localhost:$port [$proto_display]''${label:+ [$label]}"
+
else
+
# New tunnel - prompt for protocol first to determine what to ask for
+
protocol=$(${pkgs.gum}/bin/gum choose --header "Protocol:" "http" "tcp" "udp")
+
if [ -z "$protocol" ]; then
+
protocol="http"
+
fi
+
+
if [ "$protocol" = "http" ]; then
+
tunnel_name=$(${pkgs.gum}/bin/gum input --placeholder "myapp" --prompt "Subdomain: ")
+
else
+
tunnel_name=$(${pkgs.gum}/bin/gum input --placeholder "my-tunnel" --prompt "Tunnel name: ")
+
fi
+
+
if [ -z "$tunnel_name" ]; then
+
${pkgs.gum}/bin/gum style --foreground 196 "No name provided"
+
exit 1
+
fi
+
fi
+
else
+
${pkgs.gum}/bin/gum style --bold --foreground 212 "Creating bore tunnel"
+
echo
+
# Prompt for protocol first
+
protocol=$(${pkgs.gum}/bin/gum choose --header "Protocol:" "http" "tcp" "udp")
+
if [ -z "$protocol" ]; then
+
protocol="http"
+
fi
+
+
if [ "$protocol" = "http" ]; then
+
tunnel_name=$(${pkgs.gum}/bin/gum input --placeholder "myapp" --prompt "Subdomain: ")
+
else
+
tunnel_name=$(${pkgs.gum}/bin/gum input --placeholder "my-tunnel" --prompt "Tunnel name: ")
+
fi
+
+
if [ -z "$tunnel_name" ]; then
+
${pkgs.gum}/bin/gum style --foreground 196 "No name provided"
+
exit 1
+
fi
+
fi
+
else
+
${pkgs.gum}/bin/gum style --bold --foreground 212 "Creating bore tunnel"
+
echo
+
# Prompt for protocol first
+
protocol=$(${pkgs.gum}/bin/gum choose --header "Protocol:" "http" "tcp" "udp")
+
if [ -z "$protocol" ]; then
+
protocol="http"
+
fi
+
+
if [ "$protocol" = "http" ]; then
+
tunnel_name=$(${pkgs.gum}/bin/gum input --placeholder "myapp" --prompt "Subdomain: ")
+
else
+
tunnel_name=$(${pkgs.gum}/bin/gum input --placeholder "my-tunnel" --prompt "Tunnel name: ")
+
fi
+
+
if [ -z "$tunnel_name" ]; then
+
${pkgs.gum}/bin/gum style --foreground 196 "No name provided"
+
exit 1
+
fi
+
fi
+
fi
+
+
# Validate tunnel name (only for http subdomains)
+
if [ "$protocol" = "http" ]; then
+
if ! echo "$tunnel_name" | ${pkgs.gnugrep}/bin/grep -qE '^[a-z0-9-]+$'; then
+
${pkgs.gum}/bin/gum style --foreground 196 "Invalid subdomain (use only lowercase letters, numbers, and hyphens)"
+
exit 1
+
fi
+
fi
+
+
# Get port (skip if loaded from saved config)
+
if [ -z "$port" ]; then
+
if [ -n "$2" ]; then
+
port="$2"
+
else
+
port=$(${pkgs.gum}/bin/gum input --placeholder "8000" --prompt "Local port: ")
+
if [ -z "$port" ]; then
+
${pkgs.gum}/bin/gum style --foreground 196 "No port provided"
+
exit 1
+
fi
+
fi
+
fi
+
+
# Validate port
+
if ! echo "$port" | ${pkgs.gnugrep}/bin/grep -qE '^[0-9]+$'; then
+
${pkgs.gum}/bin/gum style --foreground 196 "Invalid port (must be a number)"
+
exit 1
+
fi
+
+
# Get optional protocol, label and save flag (skip if loaded from saved config)
+
save_config=false
+
if [ -z "$label" ]; then
+
shift 2 2>/dev/null || true
+
while [[ $# -gt 0 ]]; do
+
case "$1" in
+
--protocol|-p)
+
protocol="$2"
+
shift 2
+
;;
+
--label|-l)
+
label="$2"
+
shift 2
+
;;
+
--save)
+
save_config=true
+
shift
+
;;
+
*)
+
shift
+
;;
+
esac
+
done
+
+
# Prompt for protocol if not provided via flag and not loaded from saved config and not already set
+
if [ -z "$protocol" ]; then
+
protocol=$(${pkgs.gum}/bin/gum choose --header "Protocol:" "http" "tcp" "udp")
+
if [ -z "$protocol" ]; then
+
protocol="http"
+
fi
+
fi
+
+
# Prompt for label if not provided via flag and not loaded from saved config
+
if [ -z "$label" ]; then
+
# Allow multiple labels selection
+
labels=$(${pkgs.gum}/bin/gum choose --no-limit --header "Labels (select multiple):" "dev" "prod" "custom")
+
+
if [ -n "$labels" ]; then
+
# Check if custom was selected
+
if echo "$labels" | ${pkgs.gnugrep}/bin/grep -q "custom"; then
+
custom_label=$(${pkgs.gum}/bin/gum input --placeholder "my-label" --prompt "Custom label: ")
+
if [ -z "$custom_label" ]; then
+
${pkgs.gum}/bin/gum style --foreground 196 "No custom label provided"
+
exit 1
+
fi
+
# Replace 'custom' with the actual custom label
+
labels=$(echo "$labels" | ${pkgs.gnused}/bin/sed "s/custom/$custom_label/")
+
fi
+
# Join labels with comma
+
label=$(echo "$labels" | ${pkgs.coreutils}/bin/tr '\n' ',' | ${pkgs.gnused}/bin/sed 's/,$//')
+
fi
+
fi
+
fi
+
+
# Default protocol to http if still not set
+
if [ -z "$protocol" ]; then
+
protocol="http"
+
fi
+
+
# Check if local port is accessible
+
if ! ${pkgs.netcat}/bin/nc -z 127.0.0.1 "$port" 2>/dev/null; then
+
${pkgs.gum}/bin/gum style --foreground 214 "! Warning: Nothing listening on localhost:$port"
+
fi
+
+
# Save configuration if requested
+
if [ "$save_config" = true ]; then
+
# Check if tunnel already exists in TOML
+
if [ -f "$CONFIG_FILE" ] && ${pkgs.gnugrep}/bin/grep -q "^\[$tunnel_name\]" "$CONFIG_FILE"; then
+
# Update existing entry
+
${pkgs.gnused}/bin/sed -i "/^\[$tunnel_name\]/,/^\[/{
+
s/^port[[:space:]]*=.*/port = $port/
+
s/^protocol[[:space:]]*=.*/protocol = \"$protocol\"/
+
''${label:+s/^label[[:space:]]*=.*/label = \"$label\"/}
+
}" "$CONFIG_FILE"
+
else
+
# Append new entry
+
{
+
echo ""
+
echo "[$tunnel_name]"
+
echo "port = $port"
+
if [ "$protocol" != "http" ]; then
+
echo "protocol = \"$protocol\""
+
fi
+
if [ -n "$label" ]; then
+
echo "label = \"$label\""
+
fi
+
} >> "$CONFIG_FILE"
+
fi
+
+
${pkgs.gum}/bin/gum style --foreground 35 "✓ Configuration saved to bore.toml"
+
echo
+
fi
+
+
# Create config file
+
config_file=$(${pkgs.coreutils}/bin/mktemp)
+
trap "${pkgs.coreutils}/bin/rm -f $config_file" EXIT
+
+
# Encode label into proxy name if provided (format: tunnel_name[label1,label2])
+
proxy_name="$tunnel_name"
+
if [ -n "$label" ]; then
+
proxy_name="''${tunnel_name}[''${label}]"
+
fi
+
+
# Build proxy configuration based on protocol
+
if [ "$protocol" = "http" ]; then
+
${pkgs.coreutils}/bin/cat > $config_file <<EOF
+
serverAddr = "${cfg.serverAddr}"
+
serverPort = ${toString cfg.serverPort}
+
+
auth.method = "token"
+
auth.tokenSource.type = "file"
+
auth.tokenSource.file.path = "${cfg.authTokenFile}"
+
+
[[proxies]]
+
name = "$proxy_name"
+
type = "http"
+
localIP = "127.0.0.1"
+
localPort = $port
+
subdomain = "$tunnel_name"
+
EOF
+
elif [ "$protocol" = "tcp" ] || [ "$protocol" = "udp" ]; then
+
# For TCP/UDP, enable admin API to query allocated port
+
# Use Python to find a free port (cross-platform and guaranteed to work)
+
admin_port=$(${pkgs.python3}/bin/python3 -c 'import socket; s=socket.socket(); s.bind(("", 0)); print(s.getsockname()[1]); s.close()')
+
+
${pkgs.coreutils}/bin/cat > $config_file <<EOF
+
serverAddr = "${cfg.serverAddr}"
+
serverPort = ${toString cfg.serverPort}
+
+
auth.method = "token"
+
auth.tokenSource.type = "file"
+
auth.tokenSource.file.path = "${cfg.authTokenFile}"
+
+
webServer.addr = "127.0.0.1"
+
webServer.port = $admin_port
+
+
[[proxies]]
+
name = "$proxy_name"
+
type = "$protocol"
+
localIP = "127.0.0.1"
+
localPort = $port
+
remotePort = 0
+
EOF
+
else
+
${pkgs.gum}/bin/gum style --foreground 196 "Invalid protocol: $protocol (must be http, tcp, or udp)"
+
exit 1
+
fi
+
+
# Start tunnel
+
echo
+
${pkgs.gum}/bin/gum style --foreground 35 "✓ Tunnel configured"
+
${pkgs.gum}/bin/gum style --foreground 117 " Local: localhost:$port"
+
if [ "$protocol" = "http" ]; then
+
public_url="https://$tunnel_name.${cfg.domain}"
+
${pkgs.gum}/bin/gum style --foreground 117 " Public: $public_url"
+
else
+
${pkgs.gum}/bin/gum style --foreground 117 " Protocol: $protocol"
+
${pkgs.gum}/bin/gum style --foreground 214 " Waiting for server to allocate port..."
+
fi
+
echo
+
${pkgs.gum}/bin/gum style --foreground 214 "Connecting to ${cfg.serverAddr}:${toString cfg.serverPort}..."
+
echo
+
+
# For TCP/UDP, capture output to parse allocated port
+
if [ "$protocol" = "tcp" ] || [ "$protocol" = "udp" ]; then
+
# Start frpc in background and capture its PID
+
${pkgs.frp}/bin/frpc -c $config_file 2>&1 | while IFS= read -r line; do
+
echo "$line"
+
+
# Look for successful proxy start
+
if echo "$line" | ${pkgs.gnugrep}/bin/grep -q "start proxy success"; then
+
# Wait a moment for the proxy to fully initialize
+
sleep 1
+
+
# Query the frpc admin API for proxy status
+
proxy_status=$(${pkgs.curl}/bin/curl -s http://127.0.0.1:$admin_port/api/status 2>/dev/null || echo "{}")
+
+
# Try to extract remote port from JSON response
+
# Format: "remote_addr":"bore.dunkirk.sh:20097"
+
remote_addr=$(echo "$proxy_status" | ${pkgs.jq}/bin/jq -r ".tcp[]? | select(.name == \"$proxy_name\") | .remote_addr" 2>/dev/null)
+
if [ -z "$remote_addr" ] || [ "$remote_addr" = "null" ]; then
+
remote_addr=$(echo "$proxy_status" | ${pkgs.jq}/bin/jq -r ".udp[]? | select(.name == \"$proxy_name\") | .remote_addr" 2>/dev/null)
+
fi
+
+
# Extract just the port number
+
remote_port=$(echo "$remote_addr" | ${pkgs.gnugrep}/bin/grep -oP ':\K[0-9]+$')
+
+
if [ -n "$remote_port" ] && [ "$remote_port" != "null" ]; then
+
echo
+
${pkgs.gum}/bin/gum style --foreground 35 "✓ Tunnel established"
+
${pkgs.gum}/bin/gum style --foreground 117 " Local: localhost:$port"
+
${pkgs.gum}/bin/gum style --foreground 117 " Remote: ${cfg.serverAddr}:$remote_port"
+
${pkgs.gum}/bin/gum style --foreground 117 " Type: $protocol"
+
echo
+
fi
+
fi
+
done
+
else
+
exec ${pkgs.frp}/bin/frpc -c $config_file
+
fi
+
'';
+
+
bore = pkgs.stdenv.mkDerivation {
+
pname = "bore";
+
version = "1.0";
+
+
dontUnpack = true;
+
+
nativeBuildInputs = with pkgs; [ pandoc installShellFiles ];
+
+
manPageSrc = ./bore.1.md;
+
bashCompletionSrc = ./completions/bore.bash;
+
zshCompletionSrc = ./completions/bore.zsh;
+
fishCompletionSrc = ./completions/bore.fish;
+
+
buildPhase = ''
+
# Convert markdown man page to man format
+
${pkgs.pandoc}/bin/pandoc -s -t man $manPageSrc -o bore.1
+
'';
+
+
installPhase = ''
+
mkdir -p $out/bin
+
+
# Install binary
+
cp ${boreScript} $out/bin/bore
+
chmod +x $out/bin/bore
+
+
# Install man page
+
installManPage bore.1
+
+
# Install completions
+
installShellCompletion --bash --name bore $bashCompletionSrc
+
installShellCompletion --zsh --name _bore $zshCompletionSrc
+
installShellCompletion --fish --name bore.fish $fishCompletionSrc
+
'';
+
+
meta = with lib; {
+
description = "Secure tunneling service CLI";
+
homepage = "https://bore.dunkirk.sh";
+
license = licenses.mit;
+
maintainers = [ ];
+
};
+
};
+
in
+
{
+
options.atelier.bore = {
+
enable = lib.mkEnableOption "bore tunneling service";
+
+
serverAddr = lib.mkOption {
+
type = lib.types.str;
+
default = "bore.dunkirk.sh";
+
description = "bore server address";
+
};
+
+
serverPort = lib.mkOption {
+
type = lib.types.port;
+
default = 7000;
+
description = "bore server port";
+
};
+
+
domain = lib.mkOption {
+
type = lib.types.str;
+
default = "bore.dunkirk.sh";
+
description = "Domain for public tunnel URLs";
+
};
+
+
authTokenFile = lib.mkOption {
+
type = lib.types.nullOr lib.types.path;
+
default = null;
+
description = "Path to file containing authentication token";
+
};
+
};
+
+
config = lib.mkIf cfg.enable {
+
home.packages = [
+
pkgs.frp
+
bore
+
];
+
};
+
}
+183
modules/home/apps/ssh.nix
···
+
{
+
config,
+
lib,
+
pkgs,
+
inputs,
+
...
+
}:
+
with lib;
+
let
+
cfg = config.atelier.ssh;
+
in
+
{
+
options.atelier.ssh = {
+
enable = mkEnableOption "SSH configuration";
+
+
zmx = {
+
enable = mkEnableOption "zmx integration for persistent sessions";
+
hosts = mkOption {
+
type = types.listOf types.str;
+
default = [ ];
+
description = "List of host patterns to enable zmx auto-attach (e.g., 'd.*')";
+
};
+
};
+
+
extraConfig = mkOption {
+
type = types.lines;
+
default = "";
+
description = "Extra SSH configuration";
+
};
+
+
hosts = mkOption {
+
type = types.attrsOf (
+
types.submodule {
+
options = {
+
hostname = mkOption {
+
type = types.nullOr types.str;
+
default = null;
+
description = "Hostname or IP address";
+
};
+
+
port = mkOption {
+
type = types.nullOr types.int;
+
default = null;
+
description = "SSH port";
+
};
+
+
user = mkOption {
+
type = types.nullOr types.str;
+
default = null;
+
description = "Username for SSH connection";
+
};
+
+
identityFile = mkOption {
+
type = types.nullOr types.str;
+
default = null;
+
description = "Path to SSH identity file";
+
};
+
+
forwardAgent = mkOption {
+
type = types.nullOr types.bool;
+
default = null;
+
description = "Enable SSH agent forwarding";
+
};
+
+
extraOptions = mkOption {
+
type = types.attrsOf types.str;
+
default = { };
+
description = "Additional SSH options for this host";
+
};
+
+
zmx = mkOption {
+
type = types.bool;
+
default = false;
+
description = "Enable zmx persistent sessions for this host";
+
};
+
};
+
}
+
);
+
default = { };
+
description = "SSH host configurations";
+
};
+
};
+
+
config = mkIf cfg.enable {
+
# zmx provides pre-built binaries that we download instead of building from source
+
# This avoids the zig2nix dependency which causes issues in CI
+
home.packages =
+
(optionals cfg.zmx.enable [
+
pkgs.zmx-binary
+
pkgs.autossh
+
]);
+
+
programs.ssh = {
+
enable = true;
+
enableDefaultConfig = false;
+
+
matchBlocks =
+
let
+
# Convert atelier.ssh.hosts to SSH matchBlocks
+
hostConfigs = mapAttrs (
+
name: hostCfg:
+
{
+
hostname = mkIf (hostCfg.hostname != null) hostCfg.hostname;
+
port = mkIf (hostCfg.port != null) hostCfg.port;
+
user = mkIf (hostCfg.user != null) hostCfg.user;
+
identityFile = mkIf (hostCfg.identityFile != null) hostCfg.identityFile;
+
forwardAgent = mkIf (hostCfg.forwardAgent != null) hostCfg.forwardAgent;
+
extraOptions = hostCfg.extraOptions // (
+
if hostCfg.zmx then
+
{
+
RemoteCommand = "export PATH=$HOME/.nix-profile/bin:$PATH; zmx attach %n";
+
RequestTTY = "yes";
+
ControlPath = "~/.ssh/cm-%r@%h:%p";
+
ControlMaster = "auto";
+
ControlPersist = "10m";
+
}
+
else
+
{ }
+
);
+
}
+
) cfg.hosts;
+
+
# Create zmx pattern hosts if enabled
+
zmxPatternHosts = if cfg.zmx.enable then
+
listToAttrs (
+
map (pattern:
+
let
+
patternHost = cfg.hosts.${pattern} or {};
+
in {
+
name = pattern;
+
value = {
+
hostname = mkIf (patternHost.hostname or null != null) patternHost.hostname;
+
port = mkIf (patternHost.port or null != null) patternHost.port;
+
user = mkIf (patternHost.user or null != null) patternHost.user;
+
extraOptions = {
+
RemoteCommand = "export PATH=$HOME/.nix-profile/bin:$PATH; zmx attach %k";
+
RequestTTY = "yes";
+
ControlPath = "~/.ssh/cm-%r@%h:%p";
+
ControlMaster = "auto";
+
ControlPersist = "10m";
+
};
+
};
+
}) cfg.zmx.hosts
+
)
+
else
+
{ };
+
+
# Default match block for extraConfig
+
defaultBlock = if cfg.extraConfig != "" then
+
{
+
"*" = { };
+
}
+
else
+
{ };
+
in
+
defaultBlock // hostConfigs // zmxPatternHosts;
+
+
extraConfig = cfg.extraConfig;
+
};
+
+
# Add shell aliases for easier zmx usage
+
programs.zsh.shellAliases = mkIf cfg.zmx.enable {
+
zmls = "zmx list";
+
zmk = "zmx kill";
+
zma = "zmx attach";
+
ash = "autossh -M 0 -q";
+
};
+
+
programs.bash.shellAliases = mkIf cfg.zmx.enable {
+
zmls = "zmx list";
+
zmk = "zmx kill";
+
zma = "zmx attach";
+
ash = "autossh -M 0 -q";
+
};
+
+
programs.fish.shellAliases = mkIf cfg.zmx.enable {
+
zmls = "zmx list";
+
zmk = "zmx kill";
+
zma = "zmx attach";
+
ash = "autossh -M 0 -q";
+
};
+
};
+
}
-85
modules/home/apps/vscode.nix
···
-
{
-
lib,
-
pkgs,
-
config,
-
inputs,
-
...
-
}:
-
{
-
options.atelier.apps.vscode.enable = lib.mkEnableOption "Enable VSCode config";
-
config = lib.mkIf config.atelier.apps.vscode.enable {
-
nixpkgs.overlays = [
-
inputs.nix-vscode-extensions.overlays.default
-
inputs.catppuccin-vsc.overlays.default
-
];
-
programs.vscode = {
-
enable = true;
-
package = pkgs.unstable.vscode;
-
profiles.default = {
-
extensions = with pkgs.vscode-marketplace; [
-
ms-vscode.live-server
-
formulahendry.auto-rename-tag
-
edwinkofler.vscode-assorted-languages
-
golang.go
-
eamodio.gitlens
-
yzhang.markdown-all-in-one
-
github.vscode-github-actions
-
yoavbls.pretty-ts-errors
-
esbenp.prettier-vscode
-
ms-vscode.vscode-serial-monitor
-
prisma.prisma
-
ms-azuretools.vscode-docker
-
astro-build.astro-vscode
-
github.copilot
-
github.copilot-chat
-
dotjoshjohnson.xml
-
mikestead.dotenv
-
bradlc.vscode-tailwindcss
-
mechatroner.rainbow-csv
-
wakatime.vscode-wakatime
-
paulober.pico-w-go
-
ms-python.python
-
karunamurti.tera
-
biomejs.biome
-
bschulte.love
-
yinfei.luahelper
-
tamasfe.even-better-toml
-
fill-labs.dependi
-
rust-lang.rust-analyzer
-
dustypomerleau.rust-syntax
-
catppuccin.catppuccin-vsc
-
inputs.frc-nix.packages.${pkgs.stdenv.hostPlatform.system}.vscode-wpilib
-
];
-
userSettings = {
-
"editor.semanticHighlighting.enabled" = true;
-
"terminal.integrated.minimumContrastRatio" = 1;
-
"window.titleBarStyle" = "custom";
-
"gopls" = {
-
"ui.semanticTokens" = true;
-
};
-
"workbench.colorTheme" = "Catppuccin Macchiato";
-
"workbench.iconTheme" = "catppuccin-macchiato";
-
"catppuccin.accentColor" = lib.mkForce "blue";
-
"editor.fontFamily" = "'FiraCode Nerd Font', 'monospace', monospace";
-
"git.autofetch" = true;
-
"git.confirmSync" = false;
-
"github.copilot.editor.enableAutoCompletions" = false;
-
"editor.formatOnSave" = true;
-
"editor.defaultFormatter" = "biomejs.biome";
-
"[go]" = {
-
"editor.defaultFormatter" = "golang.go";
-
};
-
"[yaml]" = {
-
"editor.defaultFormatter" = "esbenp.prettier-vscode";
-
};
-
"[lua]" = {
-
"editor.defaultFormatter" = "yinfei.luahelper";
-
};
-
"[html]" = {
-
"editor.defaultFormatter" = "esbenp.prettier-vscode";
-
};
-
};
-
};
-
};
-
};
-
}
-26
modules/home/system/nixpkgs.nix
···
-
{
-
lib,
-
pkgs,
-
config,
-
inputs,
-
...
-
}:
-
{
-
options.nixpkgs.enable = lib.mkEnableOption "Enable custom nixpkgs overlays/config";
-
config = lib.mkIf config.nixpkgs.enable {
-
nixpkgs = {
-
overlays = [
-
(final: prev: {
-
unstable = import inputs.nixpkgs-unstable {
-
inherit (pkgs.stdenv.hostPlatform) system;
-
config.allowUnfree = true;
-
};
-
})
-
];
-
config = {
-
allowUnfree = true;
-
allowUnfreePredicate = _: true;
-
};
-
};
-
};
-
}
+26
modules/home/system/nixpkgs.nix.disabled
···
+
{
+
lib,
+
pkgs,
+
config,
+
inputs,
+
...
+
}:
+
{
+
options.nixpkgs.enable = lib.mkEnableOption "Enable custom nixpkgs overlays/config";
+
config = lib.mkIf config.nixpkgs.enable {
+
nixpkgs = {
+
overlays = [
+
(final: prev: {
+
unstable = import inputs.nixpkgs-unstable {
+
inherit (pkgs.stdenv.hostPlatform) system;
+
config.allowUnfree = true;
+
};
+
})
+
];
+
config = {
+
allowUnfree = true;
+
allowUnfreePredicate = _: true;
+
};
+
};
+
};
+
}
+9 -2
modules/home/system/shell.nix
···
template = "{{ if .SSHSession }}{{.HostName}} {{ end }}";
}
{
+
type = "text";
+
style = "plain";
+
background = "transparent";
+
foreground = "green";
+
template = "{{ if .Env.ZMX_SESSION }}[{{ .Env.ZMX_SESSION }}] {{ end }}";
+
}
+
{
type = "path";
style = "plain";
background = "transparent";
···
style = "plain";
foreground_templates = [
"{{if gt .Code 0}}red{{end}}"
-
"{{if eq .Code 0}}magenta{{end}}"
+
"{{if eq .Code 0}}{{if .Env.SSH_CONNECTION}}cyan{{else}}magenta{{end}}{{end}}"
];
background = "transparent";
template = "❯";
···
transient_prompt = {
foreground_templates = [
"{{if gt .Code 0}}red{{end}}"
-
"{{if eq .Code 0}}magenta{{end}}"
+
"{{if eq .Code 0}}{{if .Env.SSH_CONNECTION}}cyan{{else}}magenta{{end}}{{end}}"
];
background = "transparent";
template = "❯ ";
+19
modules/nixos/services/battleship-arena.nix
···
'';
};
+
# Service to recalculate Glicko-2 ratings (manual trigger only)
+
# Ratings automatically recalculate after each round-robin
+
# Use: sudo systemctl start battleship-arena-recalculate
+
systemd.services.battleship-arena-recalculate = {
+
description = "Recalculate Battleship Arena Glicko-2 Ratings";
+
+
environment = {
+
BATTLESHIP_RESULTS_DB = cfg.resultsDb;
+
};
+
+
serviceConfig = {
+
Type = "oneshot";
+
User = "battleship-arena";
+
Group = "battleship-arena";
+
WorkingDirectory = "/var/lib/battleship-arena";
+
ExecStart = "${cfg.package}/bin/battleship-arena recalculate-ratings";
+
};
+
};
+
# Allow battleship-arena user to create transient systemd units for sandboxing
security.polkit.extraConfig = ''
polkit.addRule(function(action, subject) {
+97
modules/nixos/services/bore/404.html
···
+
<!DOCTYPE html>
+
<html lang="en">
+
+
<head>
+
<meta charset="UTF-8">
+
<meta name="viewport" content="width=device-width, initial-scale=1.0">
+
<title>404 - bore</title>
+
<link rel="icon"
+
href="data:image/svg+xml,<svg xmlns=%22http://www.w3.org/2000/svg%22 viewBox=%220 0 100 100%22><text y=%22.9em%22 font-size=%2290%22>🚇</text></svg>">
+
<style>
+
* {
+
margin: 0;
+
padding: 0;
+
box-sizing: border-box;
+
}
+
+
body {
+
font-family: 'SF Mono', 'Monaco', monospace;
+
background: #0d1117;
+
color: #e6edf3;
+
min-height: 100vh;
+
display: flex;
+
align-items: center;
+
justify-content: center;
+
padding: 2rem;
+
}
+
+
.container {
+
text-align: center;
+
max-width: 600px;
+
}
+
+
.error-code {
+
font-size: 8rem;
+
font-weight: 700;
+
color: #8b949e;
+
line-height: 1;
+
margin-bottom: 1rem;
+
}
+
+
.emoji {
+
font-size: 4rem;
+
margin-bottom: 2rem;
+
opacity: 0.5;
+
}
+
+
h1 {
+
font-size: 2rem;
+
margin-bottom: 1rem;
+
color: #e6edf3;
+
}
+
+
p {
+
color: #8b949e;
+
font-size: 1rem;
+
margin-bottom: 2rem;
+
line-height: 1.6;
+
}
+
+
.countdown {
+
color: #14b8a6;
+
font-size: 1.2rem;
+
font-weight: 600;
+
font-variant-numeric: tabular-nums;
+
}
+
</style>
+
</head>
+
+
<body>
+
<div class="container">
+
<div class="emoji">🚇</div>
+
<div class="error-code">404</div>
+
<h1>wrong stop!</h1>
+
<p>this tunnel doesn't go anywhere. maybe it was never built, or perhaps it collapsed?</p>
+
<p>redirecting in <span class="countdown" id="countdown">5.000</span>s</p>
+
</div>
+
+
<script>
+
let timeLeft = 5000; // 5 seconds in milliseconds
+
const countdownEl = document.getElementById('countdown');
+
const startTime = Date.now();
+
+
const interval = setInterval(() => {
+
const elapsed = Date.now() - startTime;
+
timeLeft = Math.max(0, 5000 - elapsed);
+
+
countdownEl.textContent = (timeLeft / 1000).toFixed(3);
+
+
if (timeLeft <= 0) {
+
clearInterval(interval);
+
window.location.href = 'https://bore.dunkirk.sh';
+
}
+
}, 10); // Update every 10ms for smooth countdown
+
</script>
+
</body>
+
+
</html>
+48
modules/nixos/services/bore/README.md
···
+
# Bore
+
+
![screenshot](https://hc-cdn.hel1.your-objectstorage.com/s/v3/7652f29dacb8f76d_screenshot_2025-12-09_at_16.57.47.png)
+
+
Bore is a lightweight wrapper around `frp` which provides a dashboard and a nice `gum` based cli. It supports HTTP, TCP, and UDP tunneling. If you would like to run this in your own nix flake then simplify vendor this folder and `./modules/home/bore` and import the folders into the appropriate home manager and nixos configurations.
+
+
## Client Configuration
+
+
```nix
+
atelier = {
+
bore = {
+
enable = true;
+
authTokenFile = osConfig.age.secrets.bore.path
+
};
+
}
+
```
+
+
and be sure to have a definition for your agenix secret in the osConfig as well:
+
+
```nix
+
age = {
+
identityPaths = [
+
"path/to/ssh/key"
+
];
+
secrets = {
+
bore = {
+
file = ./path/to/bore.age;
+
owner = "username";
+
};
+
};
+
}
+
```
+
+
## Server Configuration
+
+
For TCP and UDP tunneling support, configure the server with allowed port ranges:
+
+
```nix
+
atelier.services.frps = {
+
enable = true;
+
domain = "bore.dunkirk.sh";
+
authTokenFile = config.age.secrets.bore.path;
+
allowedTCPPorts = [ 20000 20001 20002 20003 20004 ];
+
allowedUDPPorts = [ 20000 20001 20002 20003 20004 ];
+
};
+
```
+
+
The secret file is just a oneline file with the key in it. If you do end up deploying this feel free to email me and let me know! I would love to hear about your setup!
+190
modules/nixos/services/bore/bore.nix
···
+
{
+
config,
+
lib,
+
pkgs,
+
...
+
}:
+
let
+
cfg = config.atelier.services.frps;
+
in
+
{
+
options.atelier.services.frps = {
+
enable = lib.mkEnableOption "frp server for tunneling services";
+
+
bindAddr = lib.mkOption {
+
type = lib.types.str;
+
default = "0.0.0.0";
+
description = "Address to bind frp server to";
+
};
+
+
bindPort = lib.mkOption {
+
type = lib.types.port;
+
default = 7000;
+
description = "Port for frp control connection";
+
};
+
+
vhostHTTPPort = lib.mkOption {
+
type = lib.types.port;
+
default = 7080;
+
description = "Port for HTTP virtual host traffic";
+
};
+
+
allowedTCPPorts = lib.mkOption {
+
type = lib.types.listOf lib.types.port;
+
default = lib.lists.range 20000 20099;
+
example = [ 20000 20001 20002 20003 20004 ];
+
description = "TCP port range to allow for TCP tunnels (default: 20000-20099)";
+
};
+
+
allowedUDPPorts = lib.mkOption {
+
type = lib.types.listOf lib.types.port;
+
default = lib.lists.range 20000 20099;
+
example = [ 20000 20001 20002 20003 20004 ];
+
description = "UDP port range to allow for UDP tunnels (default: 20000-20099)";
+
};
+
+
authToken = lib.mkOption {
+
type = lib.types.nullOr lib.types.str;
+
default = null;
+
description = "Authentication token for clients (deprecated: use authTokenFile)";
+
};
+
+
authTokenFile = lib.mkOption {
+
type = lib.types.nullOr lib.types.path;
+
default = null;
+
description = "Path to file containing authentication token";
+
};
+
+
domain = lib.mkOption {
+
type = lib.types.str;
+
example = "bore.dunkirk.sh";
+
description = "Base domain for subdomains (e.g., *.bore.dunkirk.sh)";
+
};
+
+
enableCaddy = lib.mkOption {
+
type = lib.types.bool;
+
default = true;
+
description = "Automatically configure Caddy reverse proxy for wildcard domain";
+
};
+
};
+
+
config = lib.mkIf cfg.enable {
+
assertions = [
+
{
+
assertion = cfg.authToken != null || cfg.authTokenFile != null;
+
message = "Either authToken or authTokenFile must be set for frps";
+
}
+
];
+
+
# Open firewall ports for frp control connection and TCP/UDP tunnels
+
networking.firewall.allowedTCPPorts = [ cfg.bindPort ] ++ cfg.allowedTCPPorts;
+
networking.firewall.allowedUDPPorts = cfg.allowedUDPPorts;
+
+
# frp server service
+
systemd.services.frps =
+
let
+
tokenConfig =
+
if cfg.authTokenFile != null then
+
''
+
auth.tokenSource.type = "file"
+
auth.tokenSource.file.path = "${cfg.authTokenFile}"
+
''
+
else
+
''auth.token = "${cfg.authToken}"'';
+
+
configFile = pkgs.writeText "frps.toml" ''
+
bindAddr = "${cfg.bindAddr}"
+
bindPort = ${toString cfg.bindPort}
+
vhostHTTPPort = ${toString cfg.vhostHTTPPort}
+
+
# Dashboard and Prometheus metrics
+
webServer.addr = "127.0.0.1"
+
webServer.port = 7400
+
enablePrometheus = true
+
+
# Authentication token - clients need this to connect
+
auth.method = "token"
+
${tokenConfig}
+
+
# Subdomain support for *.${cfg.domain}
+
subDomainHost = "${cfg.domain}"
+
+
# Allow port ranges for TCP/UDP tunnels
+
# Format: [[{"start": 20000, "end": 20099}]]
+
allowPorts = [
+
{ start = 20000, end = 20099 }
+
]
+
+
# Custom 404 page
+
custom404Page = "${./404.html}"
+
+
# Logging
+
log.to = "console"
+
log.level = "info"
+
'';
+
in
+
{
+
description = "frp server for ${cfg.domain} tunneling";
+
after = [ "network.target" ];
+
wantedBy = [ "multi-user.target" ];
+
serviceConfig = {
+
Type = "simple";
+
Restart = "on-failure";
+
RestartSec = "5s";
+
ExecStart = "${pkgs.frp}/bin/frps -c ${configFile}";
+
};
+
};
+
+
# Automatically configure Caddy for wildcard domain
+
services.caddy = lib.mkIf cfg.enableCaddy {
+
# Dashboard for base domain
+
virtualHosts."${cfg.domain}" = {
+
extraConfig = ''
+
tls {
+
dns cloudflare {env.CLOUDFLARE_API_TOKEN}
+
}
+
header {
+
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+
}
+
+
# Proxy /api/* to frps dashboard
+
handle /api/* {
+
reverse_proxy localhost:7400
+
}
+
+
# Serve dashboard HTML
+
handle {
+
root * ${./.}
+
try_files dashboard.html
+
file_server
+
}
+
'';
+
};
+
+
# Wildcard subdomain proxy to frps
+
virtualHosts."*.${cfg.domain}" = {
+
extraConfig = ''
+
tls {
+
dns cloudflare {env.CLOUDFLARE_API_TOKEN}
+
}
+
header {
+
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+
}
+
reverse_proxy localhost:${toString cfg.vhostHTTPPort} {
+
header_up X-Forwarded-Proto {scheme}
+
header_up X-Forwarded-For {remote}
+
header_up Host {host}
+
}
+
handle_errors {
+
@404 expression {http.error.status_code} == 404
+
handle @404 {
+
root * ${./.}
+
rewrite * /404.html
+
file_server
+
}
+
}
+
'';
+
};
+
};
+
};
+
}
+24
modules/nixos/services/bore/bore.toml.example
···
+
# bore tunnel configuration
+
# Save this file as "bore.toml" in your project directory
+
+
[myapp]
+
port = 8000
+
+
[api]
+
port = 3000
+
protocol = "http"
+
label = "dev"
+
+
[frontend]
+
port = 5173
+
label = "local"
+
+
[database]
+
port = 5432
+
protocol = "tcp"
+
label = "postgres"
+
+
[game-server]
+
port = 27015
+
protocol = "udp"
+
label = "game"
+626
modules/nixos/services/bore/dashboard.html
···
+
<!DOCTYPE html>
+
<html lang="en">
+
+
<head>
+
<meta charset="UTF-8">
+
<meta name="viewport" content="width=device-width, initial-scale=1.0">
+
<title>bore</title>
+
<meta name="description" content="bore - secure tunneling service for exposing local services to the internet">
+
<meta property="og:title" content="bore - tunnel dashboard">
+
<meta property="og:description" content="secure tunneling service powered by frp on bore.dunkirk.sh">
+
<meta property="og:type" content="website">
+
<meta property="og:url" content="https://bore.dunkirk.sh">
+
<meta name="twitter:card" content="summary">
+
<meta name="twitter:title" content="bore - tunnel dashboard">
+
<meta name="twitter:description" content="secure tunneling service powered by frp on bore.dunkirk.sh">
+
<link rel="icon"
+
href="data:image/svg+xml,<svg xmlns=%22http://www.w3.org/2000/svg%22 viewBox=%220 0 100 100%22><text y=%22.9em%22 font-size=%2290%22>🚇</text></svg>">
+
<style>
+
* {
+
margin: 0;
+
padding: 0;
+
box-sizing: border-box;
+
}
+
+
body {
+
font-family: 'SF Mono', 'Monaco', monospace;
+
background: #0d1117;
+
color: #e6edf3;
+
padding: 2rem;
+
line-height: 1.5;
+
min-height: 100vh;
+
display: flex;
+
flex-direction: column;
+
}
+
+
body.loading .container {
+
opacity: 0;
+
}
+
+
.loading-bar {
+
position: fixed;
+
top: 0;
+
left: 0;
+
width: 100%;
+
height: 3px;
+
background: transparent;
+
z-index: 9999;
+
overflow: hidden;
+
}
+
+
.loading-bar::before {
+
content: '';
+
position: absolute;
+
top: 0;
+
left: 0;
+
width: 100%;
+
height: 100%;
+
background: linear-gradient(90deg, #14b8a6, #fb923c);
+
animation: loading 1.5s ease-in-out infinite;
+
}
+
+
body:not(.loading) .loading-bar {
+
display: none;
+
}
+
+
@keyframes loading {
+
0% {
+
transform: translateX(-100%);
+
}
+
50% {
+
transform: translateX(0%);
+
}
+
100% {
+
transform: translateX(100%);
+
}
+
}
+
+
.container {
+
max-width: 1200px;
+
margin: 0 auto;
+
flex: 1;
+
width: 100%;
+
opacity: 1;
+
transition: opacity 0.3s ease-in-out;
+
}
+
+
header {
+
margin-bottom: 3rem;
+
}
+
+
h1 {
+
font-size: 2.5rem;
+
background: linear-gradient(135deg, #14b8a6, #fb923c);
+
-webkit-background-clip: text;
+
-webkit-text-fill-color: transparent;
+
margin-bottom: 0.5rem;
+
}
+
+
.subtitle {
+
color: #8b949e;
+
font-size: 0.95rem;
+
}
+
+
.stats {
+
display: grid;
+
grid-template-columns: repeat(auto-fit, minmax(200px, 1fr));
+
gap: 1rem;
+
margin-bottom: 2rem;
+
}
+
+
.stat-card {
+
background: #161b22;
+
border: 1px solid #30363d;
+
border-radius: 0;
+
padding: 1.5rem;
+
}
+
+
.stat-label {
+
color: #8b949e;
+
font-size: 0.85rem;
+
margin-bottom: 0.5rem;
+
}
+
+
.stat-value {
+
font-size: 2rem;
+
font-weight: 600;
+
color: #14b8a6;
+
}
+
+
.stat-value.orange {
+
color: #fb923c;
+
}
+
+
.section {
+
background: #161b22;
+
border: 1px solid #30363d;
+
border-radius: 0;
+
padding: 1.5rem;
+
margin-bottom: 2rem;
+
}
+
+
h2 {
+
color: #14b8a6;
+
font-size: 1.2rem;
+
margin-bottom: 1.5rem;
+
display: flex;
+
align-items: center;
+
gap: 0.5rem;
+
}
+
+
.tunnel-list {
+
display: flex;
+
flex-direction: column;
+
gap: 1rem;
+
}
+
+
.tunnel {
+
background: #0d1117;
+
border: 1px solid #30363d;
+
border-radius: 0;
+
padding: 1rem;
+
display: grid;
+
grid-template-columns: 1fr auto;
+
gap: 1rem;
+
align-items: center;
+
}
+
+
.tunnel-icon {
+
display: none;
+
}
+
+
.tunnel-info {
+
flex: 1;
+
}
+
+
.tunnel-name {
+
color: #e6edf3;
+
font-weight: 600;
+
margin-bottom: 0.25rem;
+
display: flex;
+
align-items: center;
+
gap: 0.5rem;
+
}
+
+
.tunnel-label {
+
display: inline-block;
+
padding: 0.125rem 0.5rem;
+
font-size: 0.7rem;
+
font-weight: 500;
+
border-radius: 0;
+
margin-left: 0.25rem;
+
border: 1px solid;
+
}
+
+
.tunnel-url {
+
color: #8b949e;
+
font-size: 0.85rem;
+
}
+
+
.tunnel-url a {
+
color: #14b8a6;
+
text-decoration: none;
+
}
+
+
.tunnel-url a:hover {
+
text-decoration: underline;
+
}
+
+
.tunnel-status {
+
padding: 0.25rem 0.75rem;
+
border-radius: 0;
+
font-size: 0.8rem;
+
font-weight: 500;
+
}
+
+
.status-online {
+
background: rgba(20, 184, 166, 0.2);
+
color: #14b8a6;
+
border: 1px solid #14b8a6;
+
}
+
+
.empty-state {
+
text-align: center;
+
padding: 3rem 1rem;
+
color: #8b949e;
+
}
+
+
.empty-icon {
+
font-size: 3rem;
+
margin-bottom: 1rem;
+
opacity: 0.5;
+
}
+
+
code {
+
background: #0d1117;
+
padding: 0.2rem 0.5rem;
+
border-radius: 0;
+
color: #fb923c;
+
font-size: 0.9rem;
+
}
+
+
.usage {
+
background: #0d1117;
+
padding: 1rem;
+
border-radius: 0;
+
margin-top: 1rem;
+
}
+
+
.usage pre {
+
color: #8b949e;
+
font-size: 0.9rem;
+
overflow-x: auto;
+
}
+
+
.last-updated {
+
text-align: center;
+
color: #8b949e;
+
font-size: 0.8rem;
+
margin-top: 2rem;
+
padding: 2rem 0;
+
}
+
+
.last-updated a {
+
color: #14b8a6;
+
text-decoration: none;
+
}
+
+
.last-updated a:hover {
+
text-decoration: underline;
+
}
+
+
.offline-tunnels {
+
margin-top: 1.5rem;
+
padding-top: 1.5rem;
+
border-top: 1px solid #30363d;
+
}
+
+
.offline-tunnel {
+
padding: 0.5rem 0;
+
color: #8b949e;
+
font-size: 0.85rem;
+
display: flex;
+
justify-content: space-between;
+
align-items: center;
+
}
+
+
.offline-tunnel-name {
+
opacity: 0.6;
+
}
+
+
.offline-tunnel-stats {
+
font-size: 0.75rem;
+
opacity: 0.5;
+
}
+
</style>
+
</head>
+
+
<body class="loading">
+
<div class="loading-bar"></div>
+
<main class="container">
+
<header>
+
<h1>🚇 bore</h1>
+
<p class="subtitle">fancy tunnels @ terebithia</p>
+
</header>
+
+
<div class="stats">
+
<div class="stat-card">
+
<div class="stat-label">active tunnels</div>
+
<div class="stat-value" id="activeTunnels">—</div>
+
</div>
+
<div class="stat-card">
+
<div class="stat-label">active connections</div>
+
<div class="stat-value" id="totalConnections">—</div>
+
</div>
+
<div class="stat-card">
+
<div class="stat-label">server status</div>
+
<div class="stat-value orange" id="serverStatus">—</div>
+
</div>
+
<div class="stat-card">
+
<div class="stat-label">total upload</div>
+
<div class="stat-value" id="totalUpload">—</div>
+
</div>
+
<div class="stat-card">
+
<div class="stat-label">total download</div>
+
<div class="stat-value" id="totalDownload">—</div>
+
</div>
+
</div>
+
+
<section class="section">
+
<h2>~boreholes</h2>
+
<div class="tunnel-list" id="tunnelList">
+
<div class="empty-state">
+
<div class="empty-icon">🚇</div>
+
<p>no active tunnels</p>
+
</div>
+
</div>
+
</section>
+
</main>
+
+
<footer class="last-updated">
+
last updated: <span id="lastUpdated">never</span><br>
+
made with ♥︎ by <a href="https://dunkirk.sh" target="_blank">kieran klukas</a>
+
</footer>
+
+
<script>
+
let fetchFailCount = 0;
+
const MAX_FAIL_COUNT = 3;
+
let lastProxiesState = null;
+
+
// Predefined color palette for labels
+
const labelColors = [
+
{ color: '#a78bfa', bg: 'rgba(167, 139, 250, 0.2)' }, // purple
+
{ color: '#f472b6', bg: 'rgba(244, 114, 182, 0.2)' }, // pink
+
{ color: '#facc15', bg: 'rgba(250, 204, 21, 0.2)' }, // yellow
+
{ color: '#60a5fa', bg: 'rgba(96, 165, 250, 0.2)' }, // blue
+
{ color: '#f87171', bg: 'rgba(248, 113, 113, 0.2)' }, // red
+
{ color: '#38bdf8', bg: 'rgba(56, 189, 248, 0.2)' }, // sky
+
{ color: '#c084fc', bg: 'rgba(192, 132, 252, 0.2)' }, // violet
+
{ color: '#fb7185', bg: 'rgba(251, 113, 133, 0.2)' }, // rose
+
];
+
+
// Hash string to index
+
function stringToColorIndex(str) {
+
let hash = 0;
+
for (let i = 0; i < str.length; i++) {
+
hash = str.charCodeAt(i) + ((hash << 5) - hash);
+
}
+
return Math.abs(hash) % labelColors.length;
+
}
+
+
// Get label color and styles
+
function getLabelStyle(label) {
+
const trimmedLabel = label.trim();
+
if (trimmedLabel === 'prod') {
+
return {
+
color: '#22c55e',
+
bgColor: 'rgba(34, 197, 94, 0.2)',
+
borderColor: '#22c55e'
+
};
+
}
+
+
if (trimmedLabel === 'dev') {
+
return {
+
color: '#fb923c',
+
bgColor: 'rgba(251, 146, 60, 0.2)',
+
borderColor: '#fb923c'
+
};
+
}
+
+
const colorIndex = stringToColorIndex(trimmedLabel);
+
const colorScheme = labelColors[colorIndex];
+
return {
+
color: colorScheme.color,
+
bgColor: colorScheme.bg,
+
borderColor: colorScheme.color
+
};
+
}
+
+
async function fetchStats() {
+
try {
+
// Fetch server info
+
const serverResponse = await fetch('/api/serverinfo');
+
if (!serverResponse.ok) throw new Error('API unavailable');
+
const serverData = await serverResponse.json();
+
+
// Fetch HTTP proxies (tunnels)
+
const proxiesResponse = await fetch('/api/proxy/http');
+
const proxiesData = await proxiesResponse.json();
+
+
// Reset fail count on success
+
fetchFailCount = 0;
+
+
// Update stats
+
document.getElementById('activeTunnels').textContent = serverData.clientCounts || 0;
+
document.getElementById('serverStatus').textContent = 'online';
+
document.getElementById('totalConnections').textContent = serverData.curConns || 0;
+
document.getElementById('totalUpload').textContent = formatBytes(serverData.totalTrafficOut || 0);
+
document.getElementById('totalDownload').textContent = formatBytes(serverData.totalTrafficIn || 0);
+
+
// Update page title
+
const tunnelCount = serverData.clientCounts || 0;
+
const totalTraffic = formatBytes((serverData.totalTrafficIn || 0) + (serverData.totalTrafficOut || 0));
+
document.title = tunnelCount > 0
+
? `bore - ${tunnelCount} active • ${totalTraffic}`
+
: 'bore';
+
+
// Check if tunnel list structure changed
+
const proxies = proxiesData.proxies || [];
+
const currentState = JSON.stringify(proxies.map(p => ({ name: p.name, status: p.status })));
+
+
if (currentState !== lastProxiesState) {
+
// Structure changed, rebuild DOM
+
lastProxiesState = currentState;
+
renderTunnelList(proxies);
+
} else {
+
// Structure unchanged, just update data
+
updateTunnelData(proxies);
+
}
+
+
document.getElementById('lastUpdated').textContent = new Date().toLocaleTimeString();
+
+
// Remove loading class after first successful fetch
+
document.body.classList.remove('loading');
+
} catch (error) {
+
fetchFailCount++;
+
document.getElementById('serverStatus').textContent = 'offline';
+
console.error('Failed to fetch stats:', error);
+
+
// Reload page if failed multiple times (server might have updated)
+
if (fetchFailCount >= MAX_FAIL_COUNT) {
+
console.log('Multiple fetch failures detected, reloading page...');
+
window.location.reload();
+
}
+
}
+
}
+
+
function renderTunnelList(proxies) {
+
const tunnelList = document.getElementById('tunnelList');
+
const onlineTunnels = proxies.filter(p => p.status === 'online');
+
const offlineTunnels = proxies.filter(p => p.status !== 'online');
+
+
if (onlineTunnels.length === 0 && offlineTunnels.length === 0) {
+
tunnelList.innerHTML = `
+
<div class="empty-state">
+
<div class="empty-icon">🚇</div>
+
<p>no active tunnels</p>
+
</div>
+
`;
+
} else {
+
let html = '';
+
+
// Render online tunnels
+
if (onlineTunnels.length > 0) {
+
html += onlineTunnels.map(proxy => {
+
const subdomain = proxy.conf?.subdomain || 'unknown';
+
const url = `https://${subdomain}.bore.dunkirk.sh`;
+
+
// Parse labels from proxy name (format: subdomain[label1,label2])
+
const labelMatch = proxy.name.match(/\[([^\]]+)\]$/);
+
const labels = labelMatch ? labelMatch[1].split(',') : [];
+
const displayName = labels.length > 0 ? proxy.name.replace(/\[[^\]]+\]$/, '') : proxy.name;
+
+
const labelHtml = labels.map(label => {
+
const trimmedLabel = label.trim();
+
const style = getLabelStyle(trimmedLabel);
+
return `<span class="tunnel-label" style="color: ${style.color}; background: ${style.bgColor}; border-color: ${style.borderColor};">${trimmedLabel}</span>`;
+
}).join('');
+
+
return `
+
<div class="tunnel" data-tunnel="${proxy.name}">
+
<div class="tunnel-info">
+
<div class="tunnel-name">
+
${displayName || 'unnamed'}
+
${labelHtml}
+
</div>
+
<div class="tunnel-url">
+
<a href="${url}" target="_blank">${url}</a>
+
</div>
+
<div style="color: #8b949e; font-size: 0.75rem; margin-top: 0.25rem;">
+
started: <span data-start-time="${proxy.lastStartTime || ''}"></span> • traffic in: <span data-traffic-in="${proxy.name}">0 B</span> • out: <span data-traffic-out="${proxy.name}">0 B</span>
+
</div>
+
</div>
+
<div class="tunnel-status status-online">online</div>
+
</div>
+
`;
+
}).join('');
+
}
+
+
// Render offline tunnels
+
if (offlineTunnels.length > 0) {
+
html += '<div class="offline-tunnels">';
+
html += '<div style="color: #8b949e; font-size: 0.85rem; margin-bottom: 0.75rem;">recently disconnected</div>';
+
html += offlineTunnels.map(proxy => {
+
// Parse labels from proxy name (format: subdomain[label1,label2])
+
const labelMatch = proxy.name.match(/\[([^\]]+)\]$/);
+
const labels = labelMatch ? labelMatch[1].split(',').map(l => l.trim()) : [];
+
const displayName = labels.length > 0 ? proxy.name.replace(/\[[^\]]+\]$/, '') : proxy.name;
+
const labelStr = labels.length > 0 ? ` [${labels.join(', ')}]` : '';
+
+
if (!proxy.conf) {
+
return `
+
<div class="offline-tunnel" data-tunnel="${proxy.name}">
+
<span class="offline-tunnel-name">${displayName || 'unnamed'}${labelStr}</span>
+
<span class="offline-tunnel-stats">in: <span data-traffic-in="${proxy.name}">0 B</span> • out: <span data-traffic-out="${proxy.name}">0 B</span></span>
+
</div>
+
`;
+
}
+
+
const subdomain = proxy.conf.subdomain || 'unknown';
+
const url = `https://${subdomain}.bore.dunkirk.sh`;
+
return `
+
<div class="offline-tunnel" data-tunnel="${proxy.name}">
+
<span class="offline-tunnel-name">${displayName || 'unnamed'}${labelStr} → ${url}</span>
+
<span class="offline-tunnel-stats">in: <span data-traffic-in="${proxy.name}">0 B</span> • out: <span data-traffic-out="${proxy.name}">0 B</span></span>
+
</div>
+
`;
+
}).join('');
+
html += '</div>';
+
}
+
+
tunnelList.innerHTML = html;
+
+
// Update all relative times
+
updateRelativeTimes();
+
+
+
}
+
+
// Update data
+
updateTunnelData(proxies);
+
}
+
+
function updateTunnelData(proxies) {
+
proxies.forEach(proxy => {
+
const trafficInEl = document.querySelector(`[data-traffic-in="${proxy.name}"]`);
+
const trafficOutEl = document.querySelector(`[data-traffic-out="${proxy.name}"]`);
+
+
if (trafficInEl) trafficInEl.textContent = formatBytes(proxy.todayTrafficIn || 0);
+
if (trafficOutEl) trafficOutEl.textContent = formatBytes(proxy.todayTrafficOut || 0);
+
+
+
});
+
+
// Update relative times
+
updateRelativeTimes();
+
}
+
+
function formatBytes(bytes) {
+
if (bytes === 0) return '0 B';
+
const k = 1024;
+
const sizes = ['B', 'KB', 'MB', 'GB'];
+
const i = Math.floor(Math.log(bytes) / Math.log(k));
+
return Math.round(bytes / Math.pow(k, i) * 100) / 100 + ' ' + sizes[i];
+
}
+
+
function formatTime(timeStr) {
+
// Input format: "12-08 20:15:20" (MM-DD HH:MM:SS)
+
const [datePart, timePart] = timeStr.split(' ');
+
const [month, day] = datePart.split('-');
+
const [hour, minute, second] = timePart.split(':');
+
+
const now = new Date();
+
const inputDate = new Date(now.getFullYear(), parseInt(month) - 1, parseInt(day), parseInt(hour), parseInt(minute), parseInt(second));
+
+
const diffInSeconds = (now.getTime() - inputDate.getTime()) / 1000;
+
const diffInMinutes = Math.round(diffInSeconds / 60);
+
const diffInHours = Math.round(diffInMinutes / 60);
+
+
if (diffInSeconds < 60) {
+
return 'just now';
+
} else if (diffInHours < 1) {
+
return diffInMinutes === 1 ? '1 minute ago' : `${diffInMinutes} minutes ago`;
+
} else if (now.toDateString() === inputDate.toDateString()) {
+
return 'today';
+
} else if (
+
new Date(now.getFullYear(), now.getMonth(), now.getDate() - 1).toDateString() ===
+
inputDate.toDateString()
+
) {
+
return 'yesterday';
+
} else {
+
return inputDate.toLocaleTimeString([], {
+
month: 'numeric',
+
day: 'numeric',
+
hour: 'numeric',
+
minute: 'numeric',
+
});
+
}
+
}
+
+
function updateRelativeTimes() {
+
document.querySelectorAll('[data-start-time]').forEach(element => {
+
const timeStr = element.getAttribute('data-start-time');
+
element.textContent = formatTime(timeStr);
+
});
+
}
+
+
// Fetch immediately and then every 5 seconds
+
fetchStats();
+
setInterval(fetchStats, 5000);
+
+
// Update relative times every 10 seconds
+
setInterval(updateRelativeTimes, 10000);
+
</script>
+
</body>
+
+
</html>
+48
packages/zmx.nix
···
+
{ pkgs, lib, stdenv, fetchurl, autoPatchelfHook }:
+
+
stdenv.mkDerivation rec {
+
pname = "zmx";
+
version = "0.1.0";
+
+
src = fetchurl {
+
url = if stdenv.isLinux then
+
(if stdenv.isAarch64 then
+
"https://zmx.sh/a/zmx-${version}-linux-aarch64.tar.gz"
+
else
+
"https://zmx.sh/a/zmx-${version}-linux-x86_64.tar.gz")
+
else if stdenv.isDarwin then
+
(if stdenv.isAarch64 then
+
"https://zmx.sh/a/zmx-${version}-macos-aarch64.tar.gz"
+
else
+
"https://zmx.sh/a/zmx-${version}-macos-x86_64.tar.gz")
+
else throw "Unsupported platform";
+
+
hash = if stdenv.isLinux && stdenv.isAarch64 then
+
"sha256-sv83lR4DLJE+gsMtqCk6VCFdo5n4lhI0P1loxAf0iOg="
+
else if stdenv.isLinux then
+
"sha256-c+wCUcm7DEO55wXuHq0aP0Kn908jj1FM5Z+JQJnKE0M="
+
else if stdenv.isDarwin && stdenv.isAarch64 then
+
"sha256-dM6MFikdbpN+n8BK6fLbzyJfi88xetCWL9H5VfGB07o="
+
else
+
"sha256-B52NC8NEjVPDNSG11qPb0uRNExB66bllnK7ivXMJbHk=";
+
};
+
+
nativeBuildInputs = lib.optionals stdenv.isLinux [ autoPatchelfHook ];
+
+
sourceRoot = ".";
+
+
installPhase = ''
+
runHook preInstall
+
mkdir -p $out/bin
+
cp zmx $out/bin/
+
chmod +x $out/bin/zmx
+
runHook postInstall
+
'';
+
+
meta = with lib; {
+
description = "Session persistence for terminal processes";
+
homepage = "https://zmx.sh";
+
license = licenses.mit;
+
platforms = platforms.unix;
+
};
+
}
+13
secrets/frp-auth-token.age
···
+
age-encryption.org/v1
+
-> ssh-rsa DqcG0Q
+
O9AWztjhnwqJ/hh/jmHu0E+7DTK27ZB7A4eJBowY2hoMrEPabrGBPhZlLoTlSk6x
+
8GTzzdC4cU6jBBwJm3CrrVgxRlIBL23Vz0AWOKfyoFUraYZxDsoifeNAqQ/hgQ1Y
+
BntX55o5z5UhE7M1Dwa57haRnBD/2K2TRQR3BNrFGjHUhiiC4ovavULf3/Ac9trh
+
+umeYLBLK7pPQGhGytrVIIOmGdRq4ZzV8bfUsZyaJiVO5VACshsQWkx0Pj4szKXk
+
/gRerjo2P8yZJ7kg+aRn7cD6WdcpCMQZVbKgtIbe5BE15AzCdxprgQBz4N0Uthox
+
J53hLGvAOgHYdR8CHebymxBNMFdaYBPjBwhHyAlTi5TrPy5S9XtyBEg6h0mHeo+L
+
kSlUacifevkE4qZM5pVVf29YCvAPEC6VlQLAb3m4bppnpg2NBZJQo8iXNP88G53X
+
3axYCAufQttqcUe97yzcHYqXin8UXN8yJXjFNBXPtQ3ScVuSPWO+2V9pyDPRZhk8
+
+
--- 1JfGe2s3sQu5LP07sNvuBwqGUOiOQnrtQXp9+pE4ms8
+
(I ��Pfc�h,X��d�� ��x��O��p��p�F���'`�����u�
+3
secrets/secrets.nix
···
"battleship-arena.age".publicKeys = [
kierank
];
+
"frp-auth-token.age".publicKeys = [
+
kierank
+
];
}