My Nix Configuration

Compare changes

Choose any two refs to compare.

Changed files
+259 -63
devShells
default
hosts
marvin
prefect
packages
bgutil-pot-server
glide-browser-bin
planka
-2
TODO.md
···
- [ ] Move all Docker containers to using native versions of databases, redis, etc.
- Ensures higher performance and reduces the number of running containers.
- https://github.com/felschr/nixos-config/blob/main/services/immich.nix for an example of how to do it
-
- [ ] Add Archivebox service(needs custom module)
-
- [ ] Add Immich service
## Zaphod
+7 -3
devShells/default/default.nix
···
}:
pkgs.mkShellNoCC {
packages = [
+
# keep-sorted start
pkgs.deadnix
pkgs.just
pkgs.nil
+
pkgs.nix-output-monitor
pkgs.nix-tree
+
pkgs.nix-update
pkgs.nixd
-
pkgs.nix-output-monitor
pkgs.nixfmt-rfc-style
-
pkgs.statix
+
pkgs.nixos-rebuild-ng
pkgs.nvd
-
pkgs.nixos-rebuild-ng
+
pkgs.statix
+
pkgs.tokei
+
# keep-sorted endd
];
}
+97 -32
hosts/marvin/services/planka.nix
···
{
+
lib,
config,
self,
+
self',
+
pkgs,
...
}:
let
-
dataDir = "/var/lib/planka";
d = self.lib.data.services.planka;
+
+
commonServiceConfig = {
+
EnvironmentFile = config.age.secrets.planka-env.path;
+
StateDirectory = "planka";
+
WorkingDirectory = "/var/lib/planka";
+
User = "planka";
+
Group = "planka";
+
+
# Hardening
+
LockPersonality = true;
+
NoNewPrivileges = true;
+
PrivateDevices = true;
+
PrivateMounts = true;
+
PrivateTmp = true;
+
PrivateUsers = true;
+
ProtectClock = true;
+
ProtectControlGroups = true;
+
ProtectHome = true;
+
ProtectHostname = true;
+
ProtectKernelLogs = true;
+
ProtectKernelModules = true;
+
ProtectKernelTunables = true;
+
ProtectProc = "invisible";
+
RemoveIPC = true;
+
RestrictRealtime = true;
+
RestrictSUIDSGID = true;
+
UMask = "0660";
+
RestrictAddressFamilies = [
+
"AF_UNIX"
+
"AF_INET"
+
"AF_INET6"
+
];
+
};
in
{
-
virtualisation.oci-containers.containers = {
-
planka-server = {
-
image = "ghcr.io/plankanban/planka:2.0.0-rc.4";
-
ports = [ "${toString d.port}:1337" ];
-
environment = {
-
BASE_URL = "https://${d.extUrl}";
-
DATABASE_URL = "postgresql://planka@planka-db/planka";
-
# Default Admin
-
DEFAULT_ADMIN_EMAIL = "pyrox@pyrox.dev";
-
DEFAULT_ADMIN_USERNAME = "pyrox";
-
TRUST_PROXY = "true";
-
DEFAULT_LANGUAGE = "en-US";
+
systemd = {
+
tmpfiles.settings = {
+
"10-planka"."/var/lib/planka".d = {
+
group = "planka";
+
user = "planka";
+
mode = "0755";
};
-
environmentFiles = [ config.age.secrets.planka-env.path ];
-
volumes = [
-
"${dataDir}/user-avatars:/app/public/user-avatars"
-
"${dataDir}/project-background-images:/app/public/project-background-images"
-
"${dataDir}/attachments:/app/private/attachments"
-
"${dataDir}/favicons:/app/public/favicons"
-
"${dataDir}/background-images:/app/public/background-images"
-
];
-
extraOptions = [ "--network=planka" ];
};
-
planka-db = {
-
image = "postgres:16-alpine";
-
volumes = [ "${dataDir}/db:/var/lib/postgresql/data" ];
-
environment = {
-
POSTGRES_USER = "planka";
-
POSTGRES_DB = "planka";
-
POSTGRES_HOST_AUTH_METHOD = "trust";
+
services = {
+
planka-init-db = {
+
wantedBy = [ "multi-user.target" ];
+
after = [ "postgres.target" ];
+
description = "Planka Kanban Database Init Script";
+
path = [
+
pkgs.nodejs
+
];
+
script = ''
+
if [ ! -f /var/lib/planka/db-init-ran ]; then
+
node run ${self'.packages.planka}/lib/node_modules/planka/db/init.js && \
+
touch /var/lib/planka/db-init-ran
+
fi
+
'';
+
serviceConfig = commonServiceConfig // {
+
Type = "oneshot";
+
SyslogIdentifier = "planka-init-db";
+
};
};
-
extraOptions = [ "--network=planka" ];
+
planka-server = {
+
after = [ "planka-init-db.service" ];
+
wantedBy = [ "multi-user.target" ];
+
description = "Planka Kanban Server";
+
documentation = [ "https://docs.planka.cloud" ];
+
environment = {
+
DATABASE_URL = "postgresql://%2Frun%2Fpostgresql/planka";
+
DEFAULT_ADMIN_EMAIL = "pyrox@pyrox.dev";
+
DEFAULT_ADMIN_USERNAME = "pyrox";
+
TRUST_PROXY = "true";
+
DEFAULT_LANGUAGE = "en-US";
+
BASE_URL = "https://${d.extUrl}";
+
NODE_ENV = "production";
+
};
+
serviceConfig = commonServiceConfig // {
+
Type = "simple";
+
ExecStart = "${lib.getExe self'.packages.planka} --port ${toString d.port}";
+
SyslogIdentifier = "planka";
+
};
+
};
};
};
+
users.users.planka = {
+
isSystemUser = true;
+
group = "planka";
+
};
+
users.groups.planka = { };
+
services.postgresql = {
+
ensureUsers = [
+
{
+
name = "planka";
+
ensureDBOwnership = true;
+
ensureClauses.login = true;
+
}
+
];
+
ensureDatabases = [ "planka" ];
+
};
age.secrets.planka-env = {
file = ./secrets/planka-env.age;
-
owner = "thehedgehog";
-
group = "misc";
+
owner = "planka";
+
group = "planka";
};
services.anubis.instances.planka = {
settings = {
+2 -23
hosts/marvin/services/vaultwarden.nix
···
rocketAddress = "0.0.0.0";
rocketCliColors = false;
rocketPort = d.port;
-
websocketEnabled = true;
-
ipHeader = "X-Real-IP";
reloadTemplates = false;
logTimestampFormat = "%Y-%m-%d %H:%M:%S.%3f";
# # Ratelimiting
···
# Logging
useSyslog = true;
-
logLevel = "info";
extendedLogging = true;
# Features
···
# Invitations
invitationsAllowed = true;
-
invitationOrgName = "PyroNet Vault";
+
invitationOrgName = "dishNet Vault";
invitationExpirationHours = 168;
# Database
···
# Signups
signupsAllowed = false;
signupsVerify = true;
-
signupsVerifyResendTime = 3600;
-
signupsVerifyResendLimit = 5;
signupsDomainWhitelist = "pyrox.dev";
# Passwords
···
# Mail
smtpFrom = "vault@pyrox.dev";
-
smtpFromName = "PyroNet Vault <vault@pyrox.dev>";
+
smtpFromName = "dishNet Vault <vault@pyrox.dev>";
smtpUsername = "vault@pyrox.dev";
smtpSecurity = "force_tls";
smtpPort = 465;
···
smtpTimeout = 20;
smtpEmbedImages = true;
useSendmail = false;
-
smtpDebug = false;
-
smtpAcceptInvalidCerts = false;
-
smtpAcceptInvalidHostnames = false;
# Authentication
-
authenticatorDisableTimeDrift = false;
-
disable2faRemember = false;
incomplete2faTimeLimit = 5;
# # Email 2FA
-
emailAttemptsLimit = 3;
emailExpirationTime = 180;
emailTokenSize = 7;
requireDeviceEmail = true;
-
-
# Icons
-
disableIconDownload = false;
-
iconService = "internal";
-
iconRedirectCode = 302;
-
iconDownloadTimeout = 10;
-
iconBlacklistNonGlobalIps = true;
-
# # 30 Day TTL
-
iconCacheTtl = 30 * 24 * 60 * 60;
-
iconCacheNegttl = 30 * 24 * 60 * 60;
# Misc Settings
trashAutoDeleteDays = 14;
+1
hosts/prefect/dn42/peers/default.nix
···
(import ./kioubit.nix { inherit dn42Types; })
(import ./lare.nix { inherit dn42Types; })
(import ./potato.nix { inherit dn42Types; })
+
(import ./prefixlabs.nix { inherit dn42Types; })
(import ./routedbits.nix { inherit dn42Types; })
(import ./sunnet.nix { inherit dn42Types; })
(import ./uffsalot.nix { inherit dn42Types; })
+26
hosts/prefect/dn42/peers/prefixlabs.nix
···
+
{ dn42Types, ... }:
+
{
+
config.dn42 = {
+
peers.prefixlabs = {
+
as = 4242421240;
+
addr.v6 = "fe80::1240:2";
+
interface = "wg42_prefixlabs";
+
extendedNextHop = true;
+
# My side
+
srcAddr.v6 = "fe80::240";
+
# Communities
+
crypto = dn42Types.crypto.safePFS;
+
latency = dn42Types.latency."7.3ms";
+
bandwidth = dn42Types.bandwidth."1000mb";
+
transit = true;
+
};
+
wg.tunnels.prefixlabs = {
+
listenPort = 43240;
+
peerPubKey = "uRYzFGi+/B6pD0FR2SW3G/OzC5LPJXePNIt0s+nJfW0=";
+
peerEndpoint = "us-01.prefixlabs.net:22459";
+
peerAddrs.v4 = "172.20.209.11";
+
peerAddrs.v6 = "fe80::1240:2";
+
localAddrs.v6 = "fe80::240";
+
};
+
};
+
}
+26
packages/bgutil-pot-server/librusty_v8.nix
···
+
# COPIED FROM nixpkgs/pkgs/by-name/router
+
{
+
lib,
+
stdenv,
+
fetchurl,
+
}:
+
+
let
+
fetch_librusty_v8 =
+
args:
+
fetchurl {
+
name = "librusty_v8-${args.version}";
+
url = "https://github.com/denoland/rusty_v8/releases/download/v${args.version}/librusty_v8_release_${stdenv.hostPlatform.rust.rustcTarget}.a";
+
sha256 = args.shas.${stdenv.hostPlatform.system};
+
meta = {
+
inherit (args) version;
+
sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+
};
+
};
+
in
+
fetch_librusty_v8 {
+
version = "130.0.7";
+
shas = {
+
x86_64-linux = "sha256-pkdsuU6bAkcIHEZUJOt5PXdzK424CEgTLXjLtQ80t10=";
+
};
+
}
+49
packages/bgutil-pot-server/package.nix
···
+
{
+
lib,
+
callPackage,
+
rustPlatform,
+
fetchFromGitHub,
+
pkg-config,
+
openssl,
+
_experimental-update-script-combinators,
+
nix-update-script,
+
}:
+
rustPlatform.buildRustPackage (finalAttrs: {
+
pname = "bgutil-pot-server";
+
version = "0.6.0";
+
+
src = fetchFromGitHub {
+
owner = "jim60105";
+
repo = "bgutil-ytdlp-pot-provider-rs";
+
tag = "v${finalAttrs.version}";
+
hash = "sha256-kEu5WqOymH8yAyMhGKtVPOq3qlTRpFU/FO71uWEX/e8=";
+
};
+
+
cargoHash = "sha256-fJZeyIsFUfpWeC1MWsU1hANb6cqC9xHQOnhcohEMTeM=";
+
+
nativeBuildInputs = [
+
pkg-config
+
];
+
+
buildInputs = [
+
openssl
+
];
+
+
env.RUSTY_V8_ARCHIVE = callPackage ./librusty_v8.nix { };
+
+
doCheck = false;
+
+
passthru.updateScript = _experimental-update-script-combinators.sequence [
+
(nix-update-script { })
+
./update-librusty.sh
+
];
+
+
meta = {
+
changelog = "https://github.com/jim60105/bgutil-ytdlp-pot-provider-rs/releases/tag/v${finalAttrs.version}";
+
description = "Proof-of-origin token provider plugin for yt-dlp in Rust";
+
homepage = "https://github.com/jim60105/bgutil-ytdlp-pot-provider-rs";
+
license = lib.licenses.gpl3Plus;
+
maintainers = with lib.maintainers; [ pyrox0 ];
+
mainProgram = "bgutil-pot";
+
};
+
})
+45
packages/bgutil-pot-server/update-librusty.sh
···
+
#!/usr/bin/env nix-shell
+
#!nix-shell -i bash -p gnugrep gnused nix jq
+
# shellcheck shell=bash
+
# COPIED FROM nixpkgs/pkgs/by-name/wi/windmill
+
+
set -eu -o pipefail
+
+
echo "librusty_v8: UPDATING"
+
+
BGUTIL_LATEST_VERSION=$(curl ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} --silent --fail --location "https://api.github.com/repos/jim60105/bgutil-ytdlp-pot-provider-rs/releases/latest" | jq --raw-output .tag_name)
+
CARGO_LOCK=$(curl ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} --silent --fail --location "https://github.com/jim60105/bgutil-ytdlp-pot-provider-rs/raw/$BGUTIL_LATEST_VERSION/Cargo.lock")
+
+
PACKAGE_DIR=$(dirname "$(readlink --canonicalize-existing "${BASH_SOURCE[0]}")")
+
OUTPUT_FILE="$PACKAGE_DIR/librusty_v8.nix"
+
NEW_VERSION=$(echo "$CARGO_LOCK" | grep --after-context 5 'name = "v8"' | grep 'version =' | sed -E 's/version = "//;s/"//')
+
+
CURRENT_VERSION=""
+
if [ -f "$OUTPUT_FILE" ]; then
+
CURRENT_VERSION="$(grep 'version =' "$OUTPUT_FILE" | sed -E 's/version = "//;s/"//')"
+
fi
+
+
if [ "$CURRENT_VERSION" == "$NEW_VERSION" ]; then
+
echo "No update needed, $CURRENT_VERSION is already latest"
+
exit 0
+
fi
+
+
x86Hash="$(nix-prefetch-url --type sha256 https://github.com/denoland/rusty_v8/releases/download/v"$NEW_V")"
+
TEMP_FILE="$OUTPUT_FILE.tmp"
+
cat >"$TEMP_FILE" <<EOF
+
# COPIED FROM nixpkgs/pkgs/by-name/wi/windmill
+
# auto-generated file -- DO NOT EDIT!
+
{ fetchLibrustyV8 }:
+
+
fetchLibrustyV8 {
+
version = "$NEW_VERSION";
+
shas = {
+
# NOTE; Follows supported platforms of package (see meta.platforms attribute)!
+
x86_64-linux = "$(nix hash convert --hash-algo sha256 --from nix32 "$x86Hash")";
+
};
+
}
+
EOF
+
+
mv "$TEMP_FILE" "$OUTPUT_FILE"
+
+
echo "librusty_v8: UPDATE DONE"
+2 -2
packages/glide-browser-bin/package.nix
···
}:
stdenv.mkDerivation (finalAttrs: {
pname = "glide-browser";
-
version = "0.1.54a";
+
version = "0.1.55a";
src = fetchurl {
url = "https://github.com/glide-browser/glide/releases/download/${finalAttrs.version}/glide.linux-x86_64.tar.xz";
-
hash = "sha256-Rw85b+9eaiM9szWpYZiF7FqJY7OpliOwt09/c8UWlGk=";
+
hash = "sha256-mjk8KmB/T5ZpB9AMQw1mtb9VbMXVX2VV4N+hWpWkSYI=";
};
nativeBuildInputs = [
+4 -1
packages/planka/package.nix
···
in
stdenv.mkDerivation (finalAttrs: {
pname = "planka";
-
inherit version src meta;
+
inherit version src;
sourceRoot = "${finalAttrs.src.name}/server";
···
'';
passthru.updateScript = nix-update-script { extraArgs = [ "--version=unstable" ]; };
+
meta = meta // {
+
mainProgram = "planka";
+
};
})