commit 4556170d55e467095427df64969545294aa25404 · ptr.pet/ark

+20 -12

flake.nix

···

       11
        
             tlib = import ./lib lib;

     

       12
        
             l = lib;

     

       13
        
       

     

       14
       -
             makePkgsSet = system: import ./pkgs-set {

     

       15
       -
               inherit system lib tlib flakeInputs;

     

       16
       -
             };

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       17
        
             allPkgsSets = tlib.genSystems makePkgsSet;

     

       18
        
       

     

       19
        
             miscApps =

     

       20
        
               l.mapAttrs

     

       21
        
                 (

     

       22
       -
                   _: l.mapAttrs (_: cmd: {

     

       23
       -
                     type = "app";

     

       24
       -
                     program = cmd;

     

       25
       -
                   })

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       26
        
                 )

     

       27
        
                 (

     

       28
       -
                   l.mapAttrs

     

       29
       -
                   (_: set: {

     

       30
        
                     deploy-ncr = l.getExe set.terra.deploy-ncr;

     

       31
        
                     dns = l.getExe set.terra.dnsmngmt;

     

       32
       -
                   })

     

       33
       -
                   allPkgsSets

     

       34
        
                 );

     

       35
        
           in

     

       36
        
           {

     
···

       38
        
             nixosConfigurations = import ./hosts { inherit lib tlib allPkgsSets; };

     

       39
        
             homeConfigurations = import ./users { inherit lib tlib allPkgsSets; };

     

       40
        
       

     

       41
       -
             legacyPackages = l.mapAttrs (_: set: set.pkgs // {inherit (set) inputs;}) allPkgsSets;

     

       42
        
             packages = l.mapAttrs (_: set: set.exported) allPkgsSets;

     

       43
        
             apps = miscApps;

     

       44

···

       11
        
             tlib = import ./lib lib;

     

       12
        
             l = lib;

     

       13
        
       

     

       14
       +
             makePkgsSet =

     

       15
       +
               system:

     

       16
       +
               import ./pkgs-set {

     

       17
       +
                 inherit

     

       18
       +
                   system

     

       19
       +
                   lib

     

       20
       +
                   tlib

     

       21
       +
                   flakeInputs

     

       22
       +
                   ;

     

       23
       +
               };

     

       24
        
             allPkgsSets = tlib.genSystems makePkgsSet;

     

       25
        
       

     

       26
        
             miscApps =

     

       27
        
               l.mapAttrs

     

       28
        
                 (

     

       29
       +
                   _:

     

       30
       +
                   l.mapAttrs (

     

       31
       +
                     _: cmd: {

     

       32
       +
                       type = "app";

     

       33
       +
                       program = cmd;

     

       34
       +
                     }

     

       35
       +
                   )

     

       36
        
                 )

     

       37
        
                 (

     

       38
       +
                   l.mapAttrs (_: set: {

     

       0
        
       
     

       39
        
                     deploy-ncr = l.getExe set.terra.deploy-ncr;

     

       40
        
                     dns = l.getExe set.terra.dnsmngmt;

     

       41
       +
                   }) allPkgsSets

     

       0
        
       
     

       42
        
                 );

     

       43
        
           in

     

       44
        
           {

     
···

       46
        
             nixosConfigurations = import ./hosts { inherit lib tlib allPkgsSets; };

     

       47
        
             homeConfigurations = import ./users { inherit lib tlib allPkgsSets; };

     

       48
        
       

     

       49
       +
             legacyPackages = l.mapAttrs (_: set: set.pkgs // { inherit (set) inputs; }) allPkgsSets;

     

       50
        
             packages = l.mapAttrs (_: set: set.exported) allPkgsSets;

     

       51
        
             apps = miscApps;

     

       52

+12 -13

hosts/tkaronto/default.nix

···

       145
        
           4995

     

       146
        
         ];

     

       147
        
         # musikcube

     

       148
       -
         networking.firewall.allowedTCPPorts =

     

       149
       -
           [

     

       150
       -
             7905

     

       151
       -
             7906

     

       152
       -
           ]

     

       153
       -
           ++ [

     

       154
       -
             6695

     

       155
       -
             6696

     

       156
       -
             6697

     

       157
       -
             6698

     

       158
       -
             6699

     

       159
       -
           ]

     

       160
       -
           ++ [ 50300 ];

     

       161
        
       

     

       162
        
         # for tailscale

     

       163
        
         networking.firewall.checkReversePath = "loose";

···

       145
        
           4995

     

       146
        
         ];

     

       147
        
         # musikcube

     

       148
       +
         networking.firewall.allowedTCPPorts = [

     

       149
       +
           7905

     

       150
       +
           7906

     

       151
       +
         ]

     

       152
       +
         ++ [

     

       153
       +
           6695

     

       154
       +
           6696

     

       155
       +
           6697

     

       156
       +
           6698

     

       157
       +
           6699

     

       158
       +
         ]

     

       159
       +
         ++ [ 50300 ];

     

       0
        
       
     

       160
        
       

     

       161
        
         # for tailscale

     

       162
        
         networking.firewall.checkReversePath = "loose";

+2 -1

hosts/wolumonde/default.nix

···

       10
        
           "${inputs.agenix}/modules/age.nix"

     

       11
        
           "${inputs.ncr}/firewall"

     

       12
        
           "${inputs.ncr}/firewall/hetzner"

     

       13
       -
         ] ++ (tlib.importFolder (toString ./modules));

     

       0
        
       
     

       14
        
       

     

       15
        
         environment.systemPackages = with pkgs; [

     

       16
        
           magic-wormhole-rs

···

       10
        
           "${inputs.agenix}/modules/age.nix"

     

       11
        
           "${inputs.ncr}/firewall"

     

       12
        
           "${inputs.ncr}/firewall/hetzner"

     

       13
       +
         ]

     

       14
       +
         ++ (tlib.importFolder (toString ./modules));

     

       15
        
       

     

       16
        
         environment.systemPackages = with pkgs; [

     

       17
        
           magic-wormhole-rs

+13 -14

hosts/wolumonde/modules/atproto.nix

···

       30
        
         };

     

       31
        
       in

     

       32
        
       {

     

       33
       -
         services.nginx.virtualHosts =

     

       34
       -
           {

     

       35
       -
             # "gaze.systems" = mkWellKnownCfg {

     

       36
       -
             #   "atproto-did" = pkgs.writeText "server" "did:plc:dfl62fgb7wtjj3fcbb72naae";

     

       37
       -
             # };

     

       38
       -
             "poor.dog" = mkWellKnownCfg {

     

       39
       -
               "atproto-did" = pkgs.writeText "server" "did:plc:dfl62fgb7wtjj3fcbb72naae";

     

       40
       -
             };

     

       41
       -
             # "9.0.0.0.8.e.f.1.5.0.7.4.0.1.0.0.2.ip6.arpa" = mkWellKnownCfg {

     

       42
       -
             #   "atproto-did" = pkgs.writeText "server" "did:plc:dfl62fgb7wtjj3fcbb72naae";

     

       43
       -
             # };

     

       44
       -
           }

     

       45
       -
           // (mkDidWebCfg "dawn.gaze.systems")

     

       46
       -
           // (mkDidWebCfg "guestbook.gaze.systems");

     

       47
        
         # // (mkDidWebCfg "9.0.0.0.8.e.f.1.5.0.7.4.0.1.0.0.2.ip6.arpa");

     

       48
        
       }

···

       30
        
         };

     

       31
        
       in

     

       32
        
       {

     

       33
       +
         services.nginx.virtualHosts = {

     

       34
       +
           # "gaze.systems" = mkWellKnownCfg {

     

       35
       +
           #   "atproto-did" = pkgs.writeText "server" "did:plc:dfl62fgb7wtjj3fcbb72naae";

     

       36
       +
           # };

     

       37
       +
           "poor.dog" = mkWellKnownCfg {

     

       38
       +
             "atproto-did" = pkgs.writeText "server" "did:plc:dfl62fgb7wtjj3fcbb72naae";

     

       39
       +
           };

     

       40
       +
           # "9.0.0.0.8.e.f.1.5.0.7.4.0.1.0.0.2.ip6.arpa" = mkWellKnownCfg {

     

       41
       +
           #   "atproto-did" = pkgs.writeText "server" "did:plc:dfl62fgb7wtjj3fcbb72naae";

     

       42
       +
           # };

     

       43
       +
         }

     

       44
       +
         // (mkDidWebCfg "dawn.gaze.systems")

     

       45
       +
         // (mkDidWebCfg "guestbook.gaze.systems");

     

       0
        
       
     

       46
        
         # // (mkDidWebCfg "9.0.0.0.8.e.f.1.5.0.7.4.0.1.0.0.2.ip6.arpa");

     

       47
        
       }

+1 -1

hosts/wolumonde/modules/blog.nix

···

       6
        
       }:

     

       7
        
       let

     

       8
        
         PUBLIC_BASE_URL = "https://gaze.systems";

     

       9
       -
         modules = (pkgs.callPackage "${inputs.blog}/nix/modules.nix" {}).overrideAttrs (_: {

     

       10
        
           outputHash = "sha256-CO0bFv5WbNBSgucHCb+I9kIZEkh6QqWngRra0luMtSI=";

     

       11
        
         });

     

       12
        
         pkg = pkgs.callPackage "${inputs.blog}/nix" {

···

       6
        
       }:

     

       7
        
       let

     

       8
        
         PUBLIC_BASE_URL = "https://gaze.systems";

     

       9
       +
         modules = (pkgs.callPackage "${inputs.blog}/nix/modules.nix" { }).overrideAttrs (_: {

     

       10
        
           outputHash = "sha256-CO0bFv5WbNBSgucHCb+I9kIZEkh6QqWngRra0luMtSI=";

     

       11
        
         });

     

       12
        
         pkg = pkgs.callPackage "${inputs.blog}/nix" {

+12 -4

hosts/wolumonde/modules/headplane.nix

···

       1
       -
       {lib, config, pkgs, terra, inputs, ...}:

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2
        
       let

     

       3
       -
         format = pkgs.formats.yaml {};

     

       4
        
       

     

       5
        
         # A workaround generate a valid Headscale config accepted by Headplane when `config_strict == true`.

     

       6
        
         settings = lib.recursiveUpdate config.services.headscale.settings {

     
···

       14
        
         headscaleConfig = format.generate "headscale.yml" settings;

     

       15
        
       

     

       16
        
         cfg = config.services.headplane.settings;

     

       17
       -
       in {

     

       18
       -
         imports = ["${inputs.headplane}/nix/module.nix"];

     

       0
        
       
     

       19
        
       

     

       20
        
         services.headplane = {

     

       21
        
           enable = true;

···

       1
       +
       {

     

       2
       +
         lib,

     

       3
       +
         config,

     

       4
       +
         pkgs,

     

       5
       +
         terra,

     

       6
       +
         inputs,

     

       7
       +
         ...

     

       8
       +
       }:

     

       9
        
       let

     

       10
       +
         format = pkgs.formats.yaml { };

     

       11
        
       

     

       12
        
         # A workaround generate a valid Headscale config accepted by Headplane when `config_strict == true`.

     

       13
        
         settings = lib.recursiveUpdate config.services.headscale.settings {

     
···

       21
        
         headscaleConfig = format.generate "headscale.yml" settings;

     

       22
        
       

     

       23
        
         cfg = config.services.headplane.settings;

     

       24
       +
       in

     

       25
       +
       {

     

       26
       +
         imports = [ "${inputs.headplane}/nix/module.nix" ];

     

       27
        
       

     

       28
        
         services.headplane = {

     

       29
        
           enable = true;

+10 -3

hosts/wolumonde/modules/headscale.nix/default.nix

···

       1
       -
       {config, ...}: let

     

       0
        
       
     

       2
        
         rootDomain = "gaze.systems";

     

       3
        
         domain = "vpn.${rootDomain}";

     

       4
       -
       in {

     

       0
        
       
     

       5
        
         age.secrets.headscaleOidcSecret = {

     

       6
        
           file = ../../../../secrets/headscaleOidcSecret.age;

     

       7
        
           mode = "600";

     
···

       21
        
             };

     

       22
        
             dns = {

     

       23
        
               base_domain = "lan.${rootDomain}";

     

       24
       -
               nameservers.global = ["1.1.1.1" "1.0.0.1" "9.9.9.9" "149.112.112.112"];

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       25
        
             };

     

       26
        
             oidc = {

     

       27
        
               issuer = config.services.pocket-id.settings.APP_URL;

···

       1
       +
       { config, ... }:

     

       2
       +
       let

     

       3
        
         rootDomain = "gaze.systems";

     

       4
        
         domain = "vpn.${rootDomain}";

     

       5
       +
       in

     

       6
       +
       {

     

       7
        
         age.secrets.headscaleOidcSecret = {

     

       8
        
           file = ../../../../secrets/headscaleOidcSecret.age;

     

       9
        
           mode = "600";

     
···

       23
        
             };

     

       24
        
             dns = {

     

       25
        
               base_domain = "lan.${rootDomain}";

     

       26
       +
               nameservers.global = [

     

       27
       +
                 "1.1.1.1"

     

       28
       +
                 "1.0.0.1"

     

       29
       +
                 "9.9.9.9"

     

       30
       +
                 "149.112.112.112"

     

       31
       +
               ];

     

       32
        
             };

     

       33
        
             oidc = {

     

       34
        
               issuer = config.services.pocket-id.settings.APP_URL;

+1 -1

hosts/wolumonde/modules/limbusart.nix

···

       5
        
         ...

     

       6
        
       }:

     

       7
        
       let

     

       8
       -
         pkg = pkgs.callPackage "${inputs.limbusart}/package.nix" {};

     

       9
        
       in

     

       10
        
       {

     

       11
        
         systemd.services.limbusart = {

···

       5
        
         ...

     

       6
        
       }:

     

       7
        
       let

     

       8
       +
         pkg = pkgs.callPackage "${inputs.limbusart}/package.nix" { };

     

       9
        
       in

     

       10
        
       {

     

       11
        
         systemd.services.limbusart = {

+2 -2

hosts/wolumonde/modules/nginx.nix

···

       16
        
           statusPage = true;

     

       17
        
         };

     

       18
        
       

     

       19
       -
         networking.firewall.public."http".allowedTCPPorts = [80];

     

       20
       -
         networking.firewall.public."https".allowedTCPPorts = [443];

     

       21
        
       

     

       22
        
         # output json logs so we can consume them more easily

     

       23
        
         services.nginx.appendHttpConfig = ''

···

       16
        
           statusPage = true;

     

       17
        
         };

     

       18
        
       

     

       19
       +
         networking.firewall.public."http".allowedTCPPorts = [ 80 ];

     

       20
       +
         networking.firewall.public."https".allowedTCPPorts = [ 443 ];

     

       21
        
       

     

       22
        
         # output json logs so we can consume them more easily

     

       23
        
         services.nginx.appendHttpConfig = ''

+4 -4

hosts/wolumonde/modules/nsid-tracker.nix

···

       6
        
       }:

     

       7
        
       let

     

       8
        
         client-modules =

     

       9
       -
           (pkgs.callPackage "${inputs.nsid-tracker}/nix/client-modules.nix" {})

     

       10
       -
           .overrideAttrs (_: {

     

       11
       -
             outputHash = "sha256-TzTafbNTng/mMyf0yR9Rc6XS9/zzipwmK9SUWm2XxeY=";

     

       12
       -
           });

     

       13
        
         client = pkgs.callPackage "${inputs.nsid-tracker}/nix/client.nix" {

     

       14
        
           PUBLIC_API_URL = "gaze.systems/nsid-tracker/api";

     

       15
        
           inherit client-modules;

···

       6
        
       }:

     

       7
        
       let

     

       8
        
         client-modules =

     

       9
       +
           (pkgs.callPackage "${inputs.nsid-tracker}/nix/client-modules.nix" { }).overrideAttrs

     

       10
       +
             (_: {

     

       11
       +
               outputHash = "sha256-TzTafbNTng/mMyf0yR9Rc6XS9/zzipwmK9SUWm2XxeY=";

     

       12
       +
             });

     

       13
        
         client = pkgs.callPackage "${inputs.nsid-tracker}/nix/client.nix" {

     

       14
        
           PUBLIC_API_URL = "gaze.systems/nsid-tracker/api";

     

       15
        
           inherit client-modules;

+29 -30

hosts/wolumonde/modules/pds.nix

···

       6
        
         services.nginx.virtualHosts.${config.services.pds.settings.PDS_HOSTNAME} = {

     

       7
        
           useACMEHost = "gaze.systems";

     

       8
        
           forceSSL = true;

     

       9
       -
           locations =

     

       10
       -
             {

     

       11
       -
               # we need to proxy /xrpc for pds to work

     

       12
       -
               # silly but i want root domain >:3

     

       13
       -
               "/xrpc" = {

     

       14
       -
                 proxyPass = pdsLocalhost;

     

       15
       -
                 proxyWebsockets = true;

     

       16
       -
                 # pass ws headers so we can actually proxy the ws

     

       17
       -
                 extraConfig = ''

     

       18
       -
                   proxy_set_header id $request_id;

     

       19
       -
                   client_max_body_size 100M;

     

       20
       -
                 '';

     

       21
       -
                 # higher prio just to make sure

     

       22
       -
                 priority = 100;

     

       23
       -
               };

     

       24
       -
             }

     

       25
       -
             # others

     

       26
       -
             // (lib.genAttrs

     

       27
       -
               [

     

       28
       -
                 "/@atproto"

     

       29
       -
                 "/oauth"

     

       30
       -
                 "=/.well-known/oauth-protected-resource"

     

       31
       -
                 "=/.well-known/oauth-authorization-server"

     

       32
       -
               ]

     

       33
       -
               (_: {

     

       34
       -
                 proxyPass = pdsLocalhost;

     

       35
       -
                 # higher prio just to make sure

     

       36
       -
                 priority = 100;

     

       37
       -
               })

     

       38
       -
             );

     

       39
        
         };

     

       40
        
         # setup pds stuff

     

       41
        
         services.pds = {

···

       6
        
         services.nginx.virtualHosts.${config.services.pds.settings.PDS_HOSTNAME} = {

     

       7
        
           useACMEHost = "gaze.systems";

     

       8
        
           forceSSL = true;

     

       9
       +
           locations = {

     

       10
       +
             # we need to proxy /xrpc for pds to work

     

       11
       +
             # silly but i want root domain >:3

     

       12
       +
             "/xrpc" = {

     

       13
       +
               proxyPass = pdsLocalhost;

     

       14
       +
               proxyWebsockets = true;

     

       15
       +
               # pass ws headers so we can actually proxy the ws

     

       16
       +
               extraConfig = ''

     

       17
       +
                 proxy_set_header id $request_id;

     

       18
       +
                 client_max_body_size 100M;

     

       19
       +
               '';

     

       20
       +
               # higher prio just to make sure

     

       21
       +
               priority = 100;

     

       22
       +
             };

     

       23
       +
           }

     

       24
       +
           # others

     

       25
       +
           // (lib.genAttrs

     

       26
       +
             [

     

       27
       +
               "/@atproto"

     

       28
       +
               "/oauth"

     

       29
       +
               "=/.well-known/oauth-protected-resource"

     

       30
       +
               "=/.well-known/oauth-authorization-server"

     

       31
       +
             ]

     

       32
       +
             (_: {

     

       33
       +
               proxyPass = pdsLocalhost;

     

       34
       +
               # higher prio just to make sure

     

       35
       +
               priority = 100;

     

       36
       +
             })

     

       37
       +
           );

     

       0
        
       
     

       38
        
         };

     

       39
        
         # setup pds stuff

     

       40
        
         services.pds = {

+15 -8

hosts/wolumonde/modules/perses.nix/default.nix

···

       1
       -
       { pkgs, terra, config, ... }:

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2
        
       let

     

       3
        
         domain = "dash.gaze.systems";

     

       4
        
         port = 7412;

     
···

       15
        
           security = {

     

       16
        
             enable_auth = true;

     

       17
        
             authentication = {

     

       18
       -
               providers.oidc = [{

     

       19
       -
                 slug_id = "pocketid";

     

       20
       -
                 name = "Pocket ID";

     

       21
       -
                 client_id = "aa583db6-e03c-4490-853a-7f2b3e089fbe";

     

       22
       -
                 issuer = config.services.pocket-id.settings.APP_URL;

     

       23
       -
                 scopes = ["openid profile email"];

     

       24
       -
               }];

     

       0
        
       
     

       0
        
       
     

       25
        
               disable_sign_up = true;

     

       26
        
             };

     

       27
        
             cookie = {

···

       1
       +
       {

     

       2
       +
         pkgs,

     

       3
       +
         terra,

     

       4
       +
         config,

     

       5
       +
         ...

     

       6
       +
       }:

     

       7
        
       let

     

       8
        
         domain = "dash.gaze.systems";

     

       9
        
         port = 7412;

     
···

       20
        
           security = {

     

       21
        
             enable_auth = true;

     

       22
        
             authentication = {

     

       23
       +
               providers.oidc = [

     

       24
       +
                 {

     

       25
       +
                   slug_id = "pocketid";

     

       26
       +
                   name = "Pocket ID";

     

       27
       +
                   client_id = "aa583db6-e03c-4490-853a-7f2b3e089fbe";

     

       28
       +
                   issuer = config.services.pocket-id.settings.APP_URL;

     

       29
       +
                   scopes = [ "openid profile email" ];

     

       30
       +
                 }

     

       31
       +
               ];

     

       32
        
               disable_sign_up = true;

     

       33
        
             };

     

       34
        
             cookie = {

+1 -1

hosts/wolumonde/modules/ssh.nix

···

       8
        
         users.users.root.openssh.authorizedKeys.keys = [

     

       9
        
           (builtins.readFile "${inputs.self}/secrets/yusdacra.key.pub")

     

       10
        
         ];

     

       11
       -
         networking.firewall.public."ssh".allowedTCPPorts = [22];

     

       12
        
       }

···

       8
        
         users.users.root.openssh.authorizedKeys.keys = [

     

       9
        
           (builtins.readFile "${inputs.self}/secrets/yusdacra.key.pub")

     

       10
        
         ];

     

       11
       +
         networking.firewall.public."ssh".allowedTCPPorts = [ 22 ];

     

       12
        
       }

+2 -1

hosts/wolumonde/modules/tailscale.nix

···

       1
       -
       {config, ...}: {

     

       0
        
       
     

       2
        
         age.secrets.tailscaleAuthKey.file = ../../../secrets/tailscaleAuthKey.age;

     

       3
        
       

     

       4
        
         services.tailscale = {

···

       1
       +
       { config, ... }:

     

       2
       +
       {

     

       3
        
         age.secrets.tailscaleAuthKey.file = ../../../secrets/tailscaleAuthKey.age;

     

       4
        
       

     

       5
        
         services.tailscale = {

+10 -4

hosts/wolumonde/modules/tangled.nix

···

       1
       -
       { lib, config, inputs, terra, ... }:

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2
        
       let

     

       3
        
         knotCfg = config.services.tangled-knot;

     

       4
        
         spindleCfg = config.services.tangled-spindle;

     
···

       46
        
           group = "spindle";

     

       47
        
           isSystemUser = true;

     

       48
        
         };

     

       49
       -
         users.groups.spindle = {};

     

       50
       -
         users.groups.podman.members = ["spindle"];

     

       51
        
         systemd.services.spindle = {

     

       52
       -
           after = lib.mkForce ["network.target"];

     

       53
        
           serviceConfig = {

     

       54
        
             User = "spindle";

     

       55
        
             Group = "spindle";

···

       1
       +
       {

     

       2
       +
         lib,

     

       3
       +
         config,

     

       4
       +
         inputs,

     

       5
       +
         terra,

     

       6
       +
         ...

     

       7
       +
       }:

     

       8
        
       let

     

       9
        
         knotCfg = config.services.tangled-knot;

     

       10
        
         spindleCfg = config.services.tangled-spindle;

     
···

       52
        
           group = "spindle";

     

       53
        
           isSystemUser = true;

     

       54
        
         };

     

       55
       +
         users.groups.spindle = { };

     

       56
       +
         users.groups.podman.members = [ "spindle" ];

     

       57
        
         systemd.services.spindle = {

     

       58
       +
           after = lib.mkForce [ "network.target" ];

     

       59
        
           serviceConfig = {

     

       60
        
             User = "spindle";

     

       61
        
             Group = "spindle";

+6 -4

hosts/wolumonde/modules/unbound.nix

···

       1
       -
       {config, lib, ...}: let

     

       0
        
       
     

       2
        
         cfg = config.services.unbound.settings;

     

       3
       -
       in {

     

       0
        
       
     

       4
        
         services.unbound = {

     

       5
        
           enable = true;

     

       6
        
           enableRootTrustAnchor = false;

     
···

       47
        
           };

     

       48
        
         };

     

       49
        
         networking.firewall = {

     

       50
       -
           allowedTCPPorts = [cfg.server.port];

     

       51
       -
           allowedUDPPorts = [cfg.server.port];

     

       52
        
         };

     

       53
        
       }

···

       1
       +
       { config, lib, ... }:

     

       2
       +
       let

     

       3
        
         cfg = config.services.unbound.settings;

     

       4
       +
       in

     

       5
       +
       {

     

       6
        
         services.unbound = {

     

       7
        
           enable = true;

     

       8
        
           enableRootTrustAnchor = false;

     
···

       49
        
           };

     

       50
        
         };

     

       51
        
         networking.firewall = {

     

       52
       +
           allowedTCPPorts = [ cfg.server.port ];

     

       53
       +
           allowedUDPPorts = [ cfg.server.port ];

     

       54
        
         };

     

       55
        
       }

+2 -1

hosts/wsl/default.nix

···

       12
        
           ../../users/firewatch

     

       13
        
           "${inputs.nixos-wsl}/modules"

     

       14
        
           "${inputs.agenix}/modules/age.nix"

     

       15
       -
         ] ++ (tlib.importFolder (toString ./modules));

     

       0
        
       
     

       16
        
       

     

       17
        
         wsl.enable = true;

     

       18
        
         wsl.defaultUser = "firewatch";

···

       12
        
           ../../users/firewatch

     

       13
        
           "${inputs.nixos-wsl}/modules"

     

       14
        
           "${inputs.agenix}/modules/age.nix"

     

       15
       +
         ]

     

       16
       +
         ++ (tlib.importFolder (toString ./modules));

     

       17
        
       

     

       18
        
         wsl.enable = true;

     

       19
        
         wsl.defaultUser = "firewatch";

+27 -26

pkgs-set/default.nix

···

       14
        
           # config.permittedInsecurePackages = ["electron-25.9.0"];

     

       15
        
         };

     

       16
        
         _inputs = import ../_sources/generated.nix {

     

       17
       -
           inherit (_pkgs) fetchgit fetchurl fetchFromGitHub dockerTools;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       18
        
         };

     

       19
       -
         inputs = (l.mapAttrs (_: inp: inp // {__toString = s: toString s.src;}) _inputs) // flakeInputs;

     

       20
        
         pkgs = _pkgs.appendOverlays (

     

       21
        
           l.flatten (

     

       22
       -
             l.mapAttrsToList

     

       23
       -
             (

     

       24
        
               name: _:

     

       25
       -
                 if name != "disabled"

     

       26
       -
                 then

     

       27
       -
                   let

     

       28
       -
                     o = import "${./overlays}/${name}";

     

       29
       -
                   in

     

       30
       -
                   if (l.functionArgs o) ? inputs

     

       31
       -
                   then o { inherit inputs; }

     

       32
       -
                   else o

     

       33
       -
                 else

     

       34
       -
                   []

     

       35
       -
             )

     

       36
       -
             (l.readDir ./overlays)

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       37
        
           )

     

       38
        
         );

     

       39
       -
         terraPkgs =

     

       40
       -
           pkgs.lib.makeScope pkgs.newScope (

     

       41
       -
             self:

     

       42
       -
               l.genAttrs

     

       43
       -
               (l.map (l.removeSuffix ".nix") (l.attrNames (l.readDir ./pkgs)))

     

       44
       -
               (name: self.callPackage "${./pkgs}/${name}.nix" {

     

       45
       -
                 inherit inputs tlib;

     

       46
       -
               })

     

       47
       -
           );

     

       48
        
         pkgsToExport = pkgs.lib.getAttrs (import ./exported.nix) (pkgs // terraPkgs);

     

       49
       -
       in {

     

       0
        
       
     

       50
        
         inherit pkgs inputs;

     

       51
        
         terra = terraPkgs;

     

       52
        
         exported = pkgsToExport;

···

       14
        
           # config.permittedInsecurePackages = ["electron-25.9.0"];

     

       15
        
         };

     

       16
        
         _inputs = import ../_sources/generated.nix {

     

       17
       +
           inherit (_pkgs)

     

       18
       +
             fetchgit

     

       19
       +
             fetchurl

     

       20
       +
             fetchFromGitHub

     

       21
       +
             dockerTools

     

       22
       +
             ;

     

       23
        
         };

     

       24
       +
         inputs = (l.mapAttrs (_: inp: inp // { __toString = s: toString s.src; }) _inputs) // flakeInputs;

     

       25
        
         pkgs = _pkgs.appendOverlays (

     

       26
        
           l.flatten (

     

       27
       +
             l.mapAttrsToList (

     

       0
        
       
     

       28
        
               name: _:

     

       29
       +
               if name != "disabled" then

     

       30
       +
                 let

     

       31
       +
                   o = import "${./overlays}/${name}";

     

       32
       +
                 in

     

       33
       +
                 if (l.functionArgs o) ? inputs then o { inherit inputs; } else o

     

       34
       +
               else

     

       35
       +
                 [ ]

     

       36
       +
             ) (l.readDir ./overlays)

     

       37
       +
           )

     

       38
       +
         );

     

       39
       +
         terraPkgs = pkgs.lib.makeScope pkgs.newScope (

     

       40
       +
           self:

     

       41
       +
           l.genAttrs (l.map (l.removeSuffix ".nix") (l.attrNames (l.readDir ./pkgs))) (

     

       42
       +
             name:

     

       43
       +
             self.callPackage "${./pkgs}/${name}.nix" {

     

       44
       +
               inherit inputs tlib;

     

       45
       +
             }

     

       46
        
           )

     

       47
        
         );

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       48
        
         pkgsToExport = pkgs.lib.getAttrs (import ./exported.nix) (pkgs // terraPkgs);

     

       49
       +
       in

     

       50
       +
       {

     

       51
        
         inherit pkgs inputs;

     

       52
        
         terra = terraPkgs;

     

       53
        
         exported = pkgsToExport;

+8 -5

pkgs-set/overlays/_lix.nix

···

       1
       -
       {inputs}: final: prev:

     

       2
       -
       (import "${inputs.lix-module}/overlay.nix" {lix = null;})

     

       3
       -
       final (prev // {

     

       4
       -
         lix = final.lixPackageSets.latest.lix;

     

       5
       -
       })

     

       0
        
       
     

       0
        
       
     

       0

···

       1
       +
       { inputs }:

     

       2
       +
       final: prev:

     

       3
       +
       (import "${inputs.lix-module}/overlay.nix" { lix = null; }) final (

     

       4
       +
         prev

     

       5
       +
         // {

     

       6
       +
           lix = final.lixPackageSets.latest.lix;

     

       7
       +
         }

     

       8
       +
       )

+1 -1

pkgs-set/pkgs/buildGoApplication.nix

···

       1
       -
       {callPackage, inputs, ...}:

     

       2
        
       (callPackage "${inputs.gomod2nix}/builder" {

     

       3
        
         gomod2nix = null;

     

       4
        
       }).buildGoApplication

···

       1
       +
       { callPackage, inputs, ... }:

     

       2
        
       (callPackage "${inputs.gomod2nix}/builder" {

     

       3
        
         gomod2nix = null;

     

       4
        
       }).buildGoApplication

+1 -1

pkgs-set/pkgs/headplane.nix

···

       1
       -
       {callPackage, inputs, ...}: callPackage "${inputs.headplane}/nix/package.nix" {}

···

       1
       +
       { callPackage, inputs, ... }: callPackage "${inputs.headplane}/nix/package.nix" { }

+1 -1

pkgs-set/pkgs/nsid-tracker-server.nix

···

       1
       -
       {callPackage, inputs, ...}: callPackage "${inputs.nsid-tracker}/nix/server.nix" {}

···

       1
       +
       { callPackage, inputs, ... }: callPackage "${inputs.nsid-tracker}/nix/server.nix" { }

+12 -10

pkgs-set/pkgs/tangled-knot.nix

···

       6
        
         ...

     

       7
        
       }:

     

       8
        
       let

     

       9
       -
         unwrapped = (callPackage "${inputs.tangled}/nix/pkgs/knot-unwrapped.nix" {

     

       10
       -
           modules = tangled-modules;

     

       11
       -
           sqlite-lib = tangled-sqlite-lib;

     

       12
       -
           gitignoreSource = null;

     

       13
       -
         }).overrideAttrs (_: {

     

       14
       -
           src = inputs.tangled;

     

       15
       -
         });

     

       0
        
       
     

       0
        
       
     

       16
        
       in

     

       17
       -
         callPackage "${inputs.tangled}/nix/pkgs/knot.nix" {

     

       18
       -
           knot-unwrapped = unwrapped;

     

       19
       -
         }

···

       6
        
         ...

     

       7
        
       }:

     

       8
        
       let

     

       9
       +
         unwrapped =

     

       10
       +
           (callPackage "${inputs.tangled}/nix/pkgs/knot-unwrapped.nix" {

     

       11
       +
             modules = tangled-modules;

     

       12
       +
             sqlite-lib = tangled-sqlite-lib;

     

       13
       +
             gitignoreSource = null;

     

       14
       +
           }).overrideAttrs

     

       15
       +
             (_: {

     

       16
       +
               src = inputs.tangled;

     

       17
       +
             });

     

       18
        
       in

     

       19
       +
       callPackage "${inputs.tangled}/nix/pkgs/knot.nix" {

     

       20
       +
         knot-unwrapped = unwrapped;

     

       21
       +
       }

+1 -1

pkgs-set/pkgs/tangled-modules.nix

···

       1
       -
       {inputs, ...}: "${inputs.tangled}/nix/gomod2nix.toml"

···

       1
       +
       { inputs, ... }: "${inputs.tangled}/nix/gomod2nix.toml"

+4 -3

pkgs-set/pkgs/tangled-spindle.nix

···

       9
        
         modules = tangled-modules;

     

       10
        
         sqlite-lib = tangled-sqlite-lib;

     

       11
        
         gitignoreSource = null;

     

       12
       -
       }).overrideAttrs (_: {

     

       13
       -
         src = inputs.tangled;

     

       14
       -
       })

     

       0

···

       9
        
         modules = tangled-modules;

     

       10
        
         sqlite-lib = tangled-sqlite-lib;

     

       11
        
         gitignoreSource = null;

     

       12
       +
       }).overrideAttrs

     

       13
       +
         (_: {

     

       14
       +
           src = inputs.tangled;

     

       15
       +
         })

+1 -1

pkgs-set/pkgs/tangled-sqlite-lib.nix

···

       1
       -
       {callPackage, inputs, ...}:

     

       2
        
       callPackage "${inputs.tangled}/nix/pkgs/sqlite-lib.nix" {

     

       3
        
         sqlite-lib-src = inputs.tangled-sqlite-lib;

     

       4
        
       }

···

       1
       +
       { callPackage, inputs, ... }:

     

       2
        
       callPackage "${inputs.tangled}/nix/pkgs/sqlite-lib.nix" {

     

       3
        
         sqlite-lib-src = inputs.tangled-sqlite-lib;

     

       4
        
       }

+3 -5

shells/default.nix

···

       3
        
         allPkgsSets,

     

       4
        
         ...

     

       5
        
       }:

     

       6
       -
       lib.mapAttrs

     

       7
       -
       (

     

       8
        
         system: set:

     

       9
        
         let

     

       10
        
           inherit (set) pkgs;

     

       11
       -
           agenix = pkgs.callPackage "${set.inputs.agenix}/pkgs/agenix.nix" {};

     

       12
        
           agenix-wrapped = pkgs.writeShellApplication {

     

       13
        
             name = "agenix";

     

       14
        
             runtimeInputs = [ agenix ];

     
···

       53
        
             '';

     

       54
        
           };

     

       55
        
         }

     

       56
       -
       )

     

       57
       -
       allPkgsSets

···

       3
        
         allPkgsSets,

     

       4
        
         ...

     

       5
        
       }:

     

       6
       +
       lib.mapAttrs (

     

       0
        
       
     

       7
        
         system: set:

     

       8
        
         let

     

       9
        
           inherit (set) pkgs;

     

       10
       +
           agenix = pkgs.callPackage "${set.inputs.agenix}/pkgs/agenix.nix" { };

     

       11
        
           agenix-wrapped = pkgs.writeShellApplication {

     

       12
        
             name = "agenix";

     

       13
        
             runtimeInputs = [ agenix ];

     
···

       52
        
             '';

     

       53
        
           };

     

       54
        
         }

     

       55
       +
       ) allPkgsSets

     

       0

+2 -2

users/dusk@devel.mobi/default.nix

···

       44
        
           PATH = "${pkgs.coreutils-full}/bin:$PATH";

     

       45
        
         };

     

       46
        
       

     

       47
       -
         age.identityPaths = ["${config.home.homeDirectory}/.ssh/id_ed25519"];

     

       48
        
         home = {

     

       49
        
           homeDirectory = "/home/dusk";

     

       50
        
           username = "dusk";

     
···

       65
        
           enable = true;

     

       66
        
           controlServer = "https://vpn.gaze.systems";

     

       67
        
           authKeyFile = config.age.secrets.tailscaleAuthKey.path;

     

       68
       -
           extraUpFlags = ["--hostname=dusk-devel-mobi"];

     

       69
        
         };

     

       70
        
       

     

       71
        
         programs = {

···

       44
        
           PATH = "${pkgs.coreutils-full}/bin:$PATH";

     

       45
        
         };

     

       46
        
       

     

       47
       +
         age.identityPaths = [ "${config.home.homeDirectory}/.ssh/id_ed25519" ];

     

       48
        
         home = {

     

       49
        
           homeDirectory = "/home/dusk";

     

       50
        
           username = "dusk";

     
···

       65
        
           enable = true;

     

       66
        
           controlServer = "https://vpn.gaze.systems";

     

       67
        
           authKeyFile = config.age.secrets.tailscaleAuthKey.path;

     

       68
       +
           extraUpFlags = [ "--hostname=dusk-devel-mobi" ];

     

       69
        
         };

     

       70
        
       

     

       71
        
         programs = {

+1 -1

users/dusk@devel.mobi/nsid-tracker.nix

···

       14
        
           };

     

       15
        
       

     

       16
        
           Service = {

     

       17
       -
             ExecStartPre="${pkgs.coreutils-full}/bin/mkdir -p %D/nsid-tracker";

     

       18
        
             ExecStart = "${pkgs.dash}/bin/dash -c 'cd %D/nsid-tracker && ${server}/bin/server'";

     

       19
        
             Restart = "on-failure";

     

       20
        
             RestartSec = 5;

···

       14
        
           };

     

       15
        
       

     

       16
        
           Service = {

     

       17
       +
             ExecStartPre = "${pkgs.coreutils-full}/bin/mkdir -p %D/nsid-tracker";

     

       18
        
             ExecStart = "${pkgs.dash}/bin/dash -c 'cd %D/nsid-tracker && ${server}/bin/server'";

     

       19
        
             Restart = "on-failure";

     

       20
        
             RestartSec = 5;

+13 -3

users/modules/netbird/default.nix

···

       1
       -
       {lib, config, pkgs, ...}: let

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2
        
         l = lib;

     

       3
        
         t = l.types;

     

       4
        
         cfg = config.services.netbird;

     
···

       16
        
         wrappedProxychains = pkgs.writers.writeBashBin "netbird-proxychains" ''

     

       17
        
           ${pkgs.proxychains-ng}/bin/proxychains4 -f "${proxychainsCfg}" $@

     

       18
        
         '';

     

       19
       -
       in {

     

       0
        
       
     

       20
        
         options = {

     

       21
        
           services.netbird = {

     

       22
        
             enable = l.mkEnableOption "netbird client";

     
···

       37
        
           };

     

       38
        
         };

     

       39
        
         config = l.mkIf cfg.enable {

     

       40
       -
           home.packages = [ wrapped wrappedProxychains ];

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       41
        
           services.netbird.proxyScript = wrappedProxychains;

     

       42
        
           systemd.user.services.netbird = {

     

       43
        
             Unit = {

···

       1
       +
       {

     

       2
       +
         lib,

     

       3
       +
         config,

     

       4
       +
         pkgs,

     

       5
       +
         ...

     

       6
       +
       }:

     

       7
       +
       let

     

       8
        
         l = lib;

     

       9
        
         t = l.types;

     

       10
        
         cfg = config.services.netbird;

     
···

       22
        
         wrappedProxychains = pkgs.writers.writeBashBin "netbird-proxychains" ''

     

       23
        
           ${pkgs.proxychains-ng}/bin/proxychains4 -f "${proxychainsCfg}" $@

     

       24
        
         '';

     

       25
       +
       in

     

       26
       +
       {

     

       27
        
         options = {

     

       28
        
           services.netbird = {

     

       29
        
             enable = l.mkEnableOption "netbird client";

     
···

       44
        
           };

     

       45
        
         };

     

       46
        
         config = l.mkIf cfg.enable {

     

       47
       +
           home.packages = [

     

       48
       +
             wrapped

     

       49
       +
             wrappedProxychains

     

       50
       +
           ];

     

       51
        
           services.netbird.proxyScript = wrappedProxychains;

     

       52
        
           systemd.user.services.netbird = {

     

       53
        
             Unit = {

+2 -1

users/modules/nushell/default.nix

···

       1
       -
       {pkgs, lib, ...}: {

     

       0
        
       
     

       2
        
         programs.carapace.enable = true;

     

       3
        
         programs.carapace.enableNushellIntegration = true;

     

       4
        
         programs.nushell = {

···

       1
       +
       { pkgs, lib, ... }:

     

       2
       +
       {

     

       3
        
         programs.carapace.enable = true;

     

       4
        
         programs.carapace.enableNushellIntegration = true;

     

       5
        
         programs.nushell = {

+16 -5

users/modules/tailscale/default.nix

···

       1
       -
       {lib, config, pkgs, ...}: let

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2
        
         l = lib;

     

       3
        
         t = l.types;

     

       4
        
         cfg = config.services.tailscale;

     
···

       15
        
         wrapped = pkgs.writers.writeBashBin "tailscale" ''

     

       16
        
           ${pkgs.tailscale}/bin/tailscale --socket $XDG_RUNTIME_DIR/tailscaled.sock $@

     

       17
        
         '';

     

       18
       -
       in {

     

       0
        
       
     

       19
        
         options = {

     

       20
        
           services.tailscale = {

     

       21
        
             enable = l.mkEnableOption "tailscale client";

     
···

       31
        
             };

     

       32
        
             extraUpFlags = l.mkOption {

     

       33
        
               type = t.listOf t.str;

     

       34
       -
               default = [];

     

       35
        
               description = "Extra flags to pass to tailscale up";

     

       36
        
             };

     

       37
        
             proxyScript = l.mkOption {

     
···

       42
        
           };

     

       43
        
         };

     

       44
        
         config = l.mkIf cfg.enable {

     

       45
       -
           home.packages = [ wrapped wrappedProxychains ];

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       46
        
           services.tailscale.proxyScript = wrappedProxychains;

     

       47
        
           systemd.user.services.tailscaled = {

     

       48
        
             Unit = {

     
···

       54
        
               ExecStart = "${pkgs.tailscale}/bin/tailscaled --tun=userspace-networking --socks5-server=localhost:1055 --outbound-http-proxy-listen=localhost:1055 --socket %t/tailscaled.sock";

     

       55
        
               Restart = "on-failure";

     

       56
        
               RestartSec = "5s";

     

       57
       -
             } // l.optionalAttrs (cfg.authKeyFile != null) {

     

       0
        
       
     

       58
        
               ExecStartPost = "${wrapped}/bin/tailscale up --reset --login-server=${cfg.controlServer} --auth-key=file:${cfg.authKeyFile} ${l.concatStringsSep " " cfg.extraUpFlags}";

     

       59
        
             };

     

       60

···

       1
       +
       {

     

       2
       +
         lib,

     

       3
       +
         config,

     

       4
       +
         pkgs,

     

       5
       +
         ...

     

       6
       +
       }:

     

       7
       +
       let

     

       8
        
         l = lib;

     

       9
        
         t = l.types;

     

       10
        
         cfg = config.services.tailscale;

     
···

       21
        
         wrapped = pkgs.writers.writeBashBin "tailscale" ''

     

       22
        
           ${pkgs.tailscale}/bin/tailscale --socket $XDG_RUNTIME_DIR/tailscaled.sock $@

     

       23
        
         '';

     

       24
       +
       in

     

       25
       +
       {

     

       26
        
         options = {

     

       27
        
           services.tailscale = {

     

       28
        
             enable = l.mkEnableOption "tailscale client";

     
···

       38
        
             };

     

       39
        
             extraUpFlags = l.mkOption {

     

       40
        
               type = t.listOf t.str;

     

       41
       +
               default = [ ];

     

       42
        
               description = "Extra flags to pass to tailscale up";

     

       43
        
             };

     

       44
        
             proxyScript = l.mkOption {

     
···

       49
        
           };

     

       50
        
         };

     

       51
        
         config = l.mkIf cfg.enable {

     

       52
       +
           home.packages = [

     

       53
       +
             wrapped

     

       54
       +
             wrappedProxychains

     

       55
       +
           ];

     

       56
        
           services.tailscale.proxyScript = wrappedProxychains;

     

       57
        
           systemd.user.services.tailscaled = {

     

       58
        
             Unit = {

     
···

       64
        
               ExecStart = "${pkgs.tailscale}/bin/tailscaled --tun=userspace-networking --socks5-server=localhost:1055 --outbound-http-proxy-listen=localhost:1055 --socket %t/tailscaled.sock";

     

       65
        
               Restart = "on-failure";

     

       66
        
               RestartSec = "5s";

     

       67
       +
             }

     

       68
       +
             // l.optionalAttrs (cfg.authKeyFile != null) {

     

       69
        
               ExecStartPost = "${wrapped}/bin/tailscale up --reset --login-server=${cfg.controlServer} --auth-key=file:${cfg.authKeyFile} ${l.concatStringsSep " " cfg.extraUpFlags}";

     

       70
        
             };

     

       71

+2 -2

users/root/default.nix

···

       1
        
       { pkgs, ... }:

     

       2
        
       {

     

       3
        
         users.users.root.initialHashedPassword = "$6$XLWo1sPpgp63Zm$XHBbULH9q1gb/.yalPPU/I7EgTcW80bM.moCjIe/qGyOwE47VcXNVbTHloBZdIWQq0MfIG0IxInAu59.oJyos/";

     

       4
       -
         environment.systemPackages = [pkgs.nushell];

     

       5
        
         users.users.root.shell = pkgs.nushell;

     

       6
        
         home-manager.users.root = {

     

       7
       -
           imports = [../modules/nushell];

     

       8
        
         };

     

       9
        
       }

···

       1
        
       { pkgs, ... }:

     

       2
        
       {

     

       3
        
         users.users.root.initialHashedPassword = "$6$XLWo1sPpgp63Zm$XHBbULH9q1gb/.yalPPU/I7EgTcW80bM.moCjIe/qGyOwE47VcXNVbTHloBZdIWQq0MfIG0IxInAu59.oJyos/";

     

       4
       +
         environment.systemPackages = [ pkgs.nushell ];

     

       5
        
         users.users.root.shell = pkgs.nushell;

     

       6
        
         home-manager.users.root = {

     

       7
       +
           imports = [ ../modules/nushell ];

     

       8
        
         };

     

       9
        
       }