nix machine / user configurations

feat(wolumonde): nsid tracker, use proxyWebsockets, hetzner things [skip ci]

ptr.pet 0626ed12 3163f8b0

verified
+3 -6
.gitignore
···
doc/index.html
keys
-
# Result of bud commands
-
vm
-
iso
-
doi
-
-
pkgs/_sources/.shake*
ssh_key
secrets/deploy-webhook.nu
# dnscontrol
creds.json
+
+
# deploy resources
+
.hetzner
+347
flake.lock
···
"type": "github"
}
},
+
"crane_2": {
+
"flake": false,
+
"locked": {
+
"lastModified": 1727316705,
+
"narHash": "sha256-/mumx8AQ5xFuCJqxCIOFCHTVlxHkMT21idpbgbm/TIE=",
+
"owner": "ipetkov",
+
"repo": "crane",
+
"rev": "5b03654ce046b5167e7b0bccbd8244cb56c16f0e",
+
"type": "github"
+
},
+
"original": {
+
"owner": "ipetkov",
+
"ref": "v0.19.0",
+
"repo": "crane",
+
"type": "github"
+
}
+
},
"darwin": {
"inputs": {
"nixpkgs": [
···
"type": "github"
}
},
+
"dream2nix": {
+
"inputs": {
+
"nixpkgs": [
+
"nsid-tracker",
+
"nci",
+
"nixpkgs"
+
],
+
"purescript-overlay": "purescript-overlay",
+
"pyproject-nix": "pyproject-nix"
+
},
+
"locked": {
+
"lastModified": 1752547840,
+
"narHash": "sha256-T6wYez5urMcY8oUetwOIqPcqj77Ey3qka7wQsi6YCd4=",
+
"owner": "nix-community",
+
"repo": "dream2nix",
+
"rev": "667ba5ee25c95cf63ace92307db270e235dce66e",
+
"type": "github"
+
},
+
"original": {
+
"owner": "nix-community",
+
"repo": "dream2nix",
+
"type": "github"
+
}
+
},
"flake-compat": {
"flake": false,
"locked": {
···
"owner": "edolstra",
"repo": "flake-compat",
"rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
+
"type": "github"
+
},
+
"original": {
+
"owner": "edolstra",
+
"repo": "flake-compat",
+
"type": "github"
+
}
+
},
+
"flake-compat_2": {
+
"flake": false,
+
"locked": {
+
"lastModified": 1696426674,
+
"narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+
"owner": "edolstra",
+
"repo": "flake-compat",
+
"rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
"type": "github"
},
"original": {
···
"url": "https://github.com/lucide-icons/lucide/releases/download/0.483.0/lucide-icons-0.483.0.zip"
}
},
+
"mk-naked-shell": {
+
"flake": false,
+
"locked": {
+
"lastModified": 1681286841,
+
"narHash": "sha256-3XlJrwlR0nBiREnuogoa5i1b4+w/XPe0z8bbrJASw0g=",
+
"owner": "yusdacra",
+
"repo": "mk-naked-shell",
+
"rev": "7612f828dd6f22b7fb332cc69440e839d7ffe6bd",
+
"type": "github"
+
},
+
"original": {
+
"owner": "yusdacra",
+
"repo": "mk-naked-shell",
+
"type": "github"
+
}
+
},
"naked-shell": {
"locked": {
"lastModified": 1681286841,
···
"type": "github"
}
},
+
"naked-shell_3": {
+
"locked": {
+
"lastModified": 1681286841,
+
"narHash": "sha256-3XlJrwlR0nBiREnuogoa5i1b4+w/XPe0z8bbrJASw0g=",
+
"owner": "90-008",
+
"repo": "mk-naked-shell",
+
"rev": "7612f828dd6f22b7fb332cc69440e839d7ffe6bd",
+
"type": "github"
+
},
+
"original": {
+
"owner": "90-008",
+
"repo": "mk-naked-shell",
+
"type": "github"
+
}
+
},
+
"nci": {
+
"inputs": {
+
"crane": "crane_2",
+
"dream2nix": "dream2nix",
+
"mk-naked-shell": "mk-naked-shell",
+
"nixpkgs": [
+
"nsid-tracker",
+
"nixpkgs"
+
],
+
"parts": "parts_2",
+
"rust-overlay": "rust-overlay_2",
+
"treefmt": "treefmt"
+
},
+
"locked": {
+
"lastModified": 1752905922,
+
"narHash": "sha256-fhwoEa+rjxLsRANRqh4jl4evnGpVNTLWUf4a/KDkQ3k=",
+
"owner": "yusdacra",
+
"repo": "nix-cargo-integration",
+
"rev": "47e02f590e1e2c72b4ffc2bcf92b2b11c3195395",
+
"type": "github"
+
},
+
"original": {
+
"owner": "yusdacra",
+
"repo": "nix-cargo-integration",
+
"type": "github"
+
}
+
},
+
"ncr": {
+
"inputs": {
+
"nixpkgs": [
+
"nixpkgs"
+
]
+
},
+
"locked": {
+
"lastModified": 1752857134,
+
"narHash": "sha256-1ANFEQe6KW3ncMuIOxwLiwvwC3dpALUSYxq9CSPsOz8=",
+
"ref": "refs/heads/main",
+
"rev": "52576c71435602e25555a4116dfb0a42f3412b11",
+
"revCount": 17,
+
"type": "git",
+
"url": "https://tangled.sh/@poor.dog/nixos-cloud-resources"
+
},
+
"original": {
+
"type": "git",
+
"url": "https://tangled.sh/@poor.dog/nixos-cloud-resources"
+
}
+
},
"nixos-hardware": {
"locked": {
"lastModified": 1752048960,
···
"type": "github"
}
},
+
"nixpkgs-lib_3": {
+
"locked": {
+
"lastModified": 1751159883,
+
"narHash": "sha256-urW/Ylk9FIfvXfliA1ywh75yszAbiTEVgpPeinFyVZo=",
+
"owner": "nix-community",
+
"repo": "nixpkgs.lib",
+
"rev": "14a40a1d7fb9afa4739275ac642ed7301a9ba1ab",
+
"type": "github"
+
},
+
"original": {
+
"owner": "nix-community",
+
"repo": "nixpkgs.lib",
+
"type": "github"
+
}
+
},
"nixpkgs-wayland": {
"flake": false,
"locked": {
···
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
+
}
+
},
+
"nsid-tracker": {
+
"inputs": {
+
"naked-shell": "naked-shell_3",
+
"nci": "nci",
+
"nixpkgs": [
+
"nixpkgs"
+
],
+
"parts": "parts_3",
+
"systems": "systems_6"
+
},
+
"locked": {
+
"lastModified": 1752990833,
+
"narHash": "sha256-c8H6QAX2iIDLaYTLN8b1iOKxnpQouJoSGtDqMuyV9Nw=",
+
"ref": "refs/heads/main",
+
"rev": "73978e71f695685986843f71c46387117fc8f4f8",
+
"revCount": 28,
+
"type": "git",
+
"url": "https://tangled.sh/@poor.dog/nsid-tracker"
+
},
+
"original": {
+
"type": "git",
+
"url": "https://tangled.sh/@poor.dog/nsid-tracker"
}
},
"nur": {
···
"type": "github"
}
},
+
"parts_2": {
+
"inputs": {
+
"nixpkgs-lib": [
+
"nsid-tracker",
+
"nci",
+
"nixpkgs"
+
]
+
},
+
"locked": {
+
"lastModified": 1751413152,
+
"narHash": "sha256-Tyw1RjYEsp5scoigs1384gIg6e0GoBVjms4aXFfRssQ=",
+
"owner": "hercules-ci",
+
"repo": "flake-parts",
+
"rev": "77826244401ea9de6e3bac47c2db46005e1f30b5",
+
"type": "github"
+
},
+
"original": {
+
"owner": "hercules-ci",
+
"repo": "flake-parts",
+
"type": "github"
+
}
+
},
+
"parts_3": {
+
"inputs": {
+
"nixpkgs-lib": "nixpkgs-lib_3"
+
},
+
"locked": {
+
"lastModified": 1751413152,
+
"narHash": "sha256-Tyw1RjYEsp5scoigs1384gIg6e0GoBVjms4aXFfRssQ=",
+
"owner": "hercules-ci",
+
"repo": "flake-parts",
+
"rev": "77826244401ea9de6e3bac47c2db46005e1f30b5",
+
"type": "github"
+
},
+
"original": {
+
"owner": "hercules-ci",
+
"repo": "flake-parts",
+
"type": "github"
+
}
+
},
+
"purescript-overlay": {
+
"inputs": {
+
"flake-compat": "flake-compat_2",
+
"nixpkgs": [
+
"nsid-tracker",
+
"nci",
+
"dream2nix",
+
"nixpkgs"
+
],
+
"slimlock": "slimlock"
+
},
+
"locked": {
+
"lastModified": 1728546539,
+
"narHash": "sha256-Sws7w0tlnjD+Bjck1nv29NjC5DbL6nH5auL9Ex9Iz2A=",
+
"owner": "thomashoneyman",
+
"repo": "purescript-overlay",
+
"rev": "4ad4c15d07bd899d7346b331f377606631eb0ee4",
+
"type": "github"
+
},
+
"original": {
+
"owner": "thomashoneyman",
+
"repo": "purescript-overlay",
+
"type": "github"
+
}
+
},
+
"pyproject-nix": {
+
"inputs": {
+
"nixpkgs": [
+
"nsid-tracker",
+
"nci",
+
"dream2nix",
+
"nixpkgs"
+
]
+
},
+
"locked": {
+
"lastModified": 1752481895,
+
"narHash": "sha256-luVj97hIMpCbwhx3hWiRwjP2YvljWy8FM+4W9njDhLA=",
+
"owner": "pyproject-nix",
+
"repo": "pyproject.nix",
+
"rev": "16ee295c25107a94e59a7fc7f2e5322851781162",
+
"type": "github"
+
},
+
"original": {
+
"owner": "pyproject-nix",
+
"repo": "pyproject.nix",
+
"type": "github"
+
}
+
},
"root": {
"inputs": {
"agenix": "agenix",
···
"limbusart": "limbusart",
"lix-module": "lix-module",
"naked-shell": "naked-shell_2",
+
"ncr": "ncr",
"nixos-hardware": "nixos-hardware",
"nixos-persistence": "nixos-persistence",
"nixos-wsl": "nixos-wsl",
"nixpkgs": "nixpkgs_3",
"nixpkgs-wayland": "nixpkgs-wayland",
+
"nsid-tracker": "nsid-tracker",
"nur": "nur",
"skeetdeck": "skeetdeck",
"tangled": "tangled"
···
"type": "github"
}
},
+
"rust-overlay_2": {
+
"inputs": {
+
"nixpkgs": [
+
"nsid-tracker",
+
"nci",
+
"nixpkgs"
+
]
+
},
+
"locked": {
+
"lastModified": 1752892850,
+
"narHash": "sha256-LLvDqLiK2+dr7bQqKTnZIZ8F1H67DLt3FUyVrGolGVw=",
+
"owner": "oxalica",
+
"repo": "rust-overlay",
+
"rev": "742248f12aed0183a124637e8b27a238a47f46a2",
+
"type": "github"
+
},
+
"original": {
+
"owner": "oxalica",
+
"repo": "rust-overlay",
+
"type": "github"
+
}
+
},
"skeetdeck": {
"flake": false,
"locked": {
···
"url": "file:///home/kirara/proj/skeetdeck-dist.tar.gz"
}
},
+
"slimlock": {
+
"inputs": {
+
"nixpkgs": [
+
"nsid-tracker",
+
"nci",
+
"dream2nix",
+
"purescript-overlay",
+
"nixpkgs"
+
]
+
},
+
"locked": {
+
"lastModified": 1688756706,
+
"narHash": "sha256-xzkkMv3neJJJ89zo3o2ojp7nFeaZc2G0fYwNXNJRFlo=",
+
"owner": "thomashoneyman",
+
"repo": "slimlock",
+
"rev": "cf72723f59e2340d24881fd7bf61cb113b4c407c",
+
"type": "github"
+
},
+
"original": {
+
"owner": "thomashoneyman",
+
"repo": "slimlock",
+
"type": "github"
+
}
+
},
"sqlite-lib-src": {
"flake": false,
"locked": {
···
"type": "github"
}
},
+
"systems_6": {
+
"locked": {
+
"lastModified": 1680978846,
+
"narHash": "sha256-Gtqg8b/v49BFDpDetjclCYXm8mAnTrUzR0JnE2nv5aw=",
+
"owner": "nix-systems",
+
"repo": "x86_64-linux",
+
"rev": "2ecfcac5e15790ba6ce360ceccddb15ad16d08a8",
+
"type": "github"
+
},
+
"original": {
+
"owner": "nix-systems",
+
"repo": "x86_64-linux",
+
"type": "github"
+
}
+
},
"tangled": {
"inputs": {
"gitignore": "gitignore",
···
"original": {
"type": "git",
"url": "https://tangled.sh/@tangled.sh/core"
+
}
+
},
+
"treefmt": {
+
"inputs": {
+
"nixpkgs": [
+
"nsid-tracker",
+
"nci",
+
"nixpkgs"
+
]
+
},
+
"locked": {
+
"lastModified": 1752055615,
+
"narHash": "sha256-19m7P4O/Aw/6+CzncWMAJu89JaKeMh3aMle1CNQSIwM=",
+
"owner": "numtide",
+
"repo": "treefmt-nix",
+
"rev": "c9d477b5d5bd7f26adddd3f96cfd6a904768d4f9",
+
"type": "github"
+
},
+
"original": {
+
"owner": "numtide",
+
"repo": "treefmt-nix",
+
"type": "github"
}
}
},
+14 -2
flake.nix
···
tangled.url = "git+https://tangled.sh/@tangled.sh/core";
tangled.inputs.nixpkgs.follows = "nixpkgs";
+
+
ncr.url = "git+https://tangled.sh/@poor.dog/nixos-cloud-resources";
+
ncr.inputs.nixpkgs.follows = "nixpkgs";
+
+
nsid-tracker.url = "git+https://tangled.sh/@poor.dog/nsid-tracker";
+
nsid-tracker.inputs.nixpkgs.follows = "nixpkgs";
};
outputs =
···
}) cmds
)
(
-
lib.mapAttrs (_: pkgs: {
+
lib.mapAttrs
+
(_: pkgs: (
+
lib.mapAttrs
+
(_: app: app.program)
+
(inputs.ncr.makeApps {inherit pkgs; inherit (inputs) self;})
+
) // {
generate-firefox-addons = toString "${pkgs.generate-firefox-addons}/bin/generate-firefox-addons";
dns = toString "${pkgs.dnsmngmt}/bin/dns";
-
}) allPkgs
+
})
+
allPkgs
);
in
{
+5 -11
hosts/wolumonde/default.nix
···
{
imports = [
inputs.agenix.nixosModules.default
-
# inputs.nixtopo.nixosModules.default
+
inputs.ncr.nixosModules.firewall
+
inputs.ncr.nixosModules.firewall-hetzner
] ++ (tlib.importFolder (toString ./modules));
environment.systemPackages = with pkgs; [
···
zramSwap.enable = true;
# firewall stuffs
-
networking.firewall = {
+
networking.firewall.enable = true;
+
providers.hetzner.firewall = {
enable = true;
-
allowedTCPPorts = [
-
22
-
80
-
443
-
5005
-
];
-
allowedUDPPortRanges = [ ];
+
id = 476406;
};
-
-
virtualisation.docker.enable = false;
system.stateVersion = "22.05";
}
+5
hosts/wolumonde/modules/hardware-configuration.nix
···
device = "/dev/sda1";
fsType = "ext4";
};
+
fileSystems."/mnt/data" = {
+
device = "/dev/disk/by-id/scsi-0HC_Volume_102930299";
+
fsType = "btrfs";
+
options = [ "noatime" "autodefrag" "compress-force=zstd:8" ];
+
};
}
+4
hosts/wolumonde/modules/netbird.nix
···
useAcmeCertificates = true;
};
};
+
networking.firewall.public."netbird coturn" ={
+
allowedTCPPortRanges = [{from = 3478; to = 3479;}];
+
allowedUDPPortRanges = [{from = 3478; to = 3479;} {from = 49152; to = 65535;}];
+
};
services.nginx.virtualHosts.${cfg.domain} = {
useACMEHost = "gaze.systems";
+2
hosts/wolumonde/modules/nginx.nix
···
statusPage = true;
};
+
networking.firewall.public."http(s)".allowedTCPPorts = [80 443];
+
# output json logs so we can consume them more easily
services.nginx.appendHttpConfig = ''
log_format json_logs escape=json '{'
+53
hosts/wolumonde/modules/nsid-tracker.nix
···
+
{
+
pkgs,
+
inputs,
+
...
+
}:
+
let
+
server = inputs.nsid-tracker.packages.${pkgs.system}.server;
+
client = inputs.nsid-tracker.packages.${pkgs.system}.client.overrideAttrs (old: {
+
PUBLIC_API_URL = "gaze.systems/nsid-tracker/api";
+
});
+
port = 6432;
+
in
+
{
+
users.users.nsidtracker = {
+
isSystemUser = true;
+
home = "/mnt/data/nsid-tracker";
+
createHome = true;
+
group = "nsidtracker";
+
};
+
users.groups.nsidtracker = { };
+
+
systemd.services.nsid-tracker = {
+
description = "nsid-tracker";
+
wantedBy = [ "multi-user.target" ];
+
after = [ "network.target" ];
+
environment = {
+
HOME = "/mnt/data/nsid-tracker";
+
PORT = toString port;
+
};
+
serviceConfig = {
+
User = "nsidtracker";
+
ExecStart = "${server}/bin/server";
+
Restart = "on-failure";
+
RestartSec = 5;
+
WorkingDirectory = "/mnt/data/nsid-tracker";
+
};
+
};
+
+
services.nginx.virtualHosts."gaze.systems" = {
+
locations."/nsid-tracker/api" = {
+
proxyPass = "http://localhost:${toString port}/";
+
proxyWebsockets = true;
+
extraConfig = ''
+
rewrite ^/nsid-tracker/api/(.*) /$1 break;
+
'';
+
};
+
locations."/nsid-tracker".return = "301 /nsid-tracker/";
+
locations."/nsid-tracker/" = {
+
alias = "${client}/";
+
tryFiles = "$uri $uri/ /index.html";
+
};
+
};
+
}
+1 -2
hosts/wolumonde/modules/pds.nix
···
# silly but i want root domain >:3
"/xrpc" = {
proxyPass = pdsLocalhost;
+
proxyWebsockets = true;
# pass ws headers so we can actually proxy the ws
extraConfig = ''
-
proxy_set_header Upgrade $http_upgrade;
-
proxy_set_header Connection $connection_upgrade;
proxy_set_header id $request_id;
client_max_body_size 100M;
'';
+1
hosts/wolumonde/modules/ssh.nix
···
users.users.root.openssh.authorizedKeys.keys = [
(builtins.readFile "${inputs.self}/secrets/yusdacra.key.pub")
];
+
networking.firewall.public."ssh".allowedTCPPorts = [22];
}
+2 -10
hosts/wolumonde/modules/tangled.nix
···
kTLS = true;
locations."/" = {
proxyPass = "http://${knotCfg.server.listenAddr}";
-
extraConfig = ''
-
proxy_set_header Upgrade $http_upgrade;
-
proxy_set_header Connection $connection_upgrade;
-
proxy_set_header id $request_id;
-
'';
+
proxyWebsockets = true;
};
};
···
kTLS = true;
locations."/" = {
proxyPass = "http://${spindleCfg.server.listenAddr}";
-
extraConfig = ''
-
proxy_set_header Upgrade $http_upgrade;
-
proxy_set_header Connection $connection_upgrade;
-
proxy_set_header id $request_id;
-
'';
+
proxyWebsockets = true;
};
};
+2
hosts/wolumonde/modules/unbound.nix
···
forward-addr = [
"1.1.1.1"
"1.0.0.1"
+
"9.9.9.9"
+
"8.8.8.8"
];
}
];
secrets/netbirdClientKey.age

This is a binary file and will not be displayed.