ryan.freumh.org
+63
-2
README.md
+63
-2
README.md
···+My personal Nix and NixOS configuration for reproducible, declarative systems and environments across multiple hosts.+This is a personal configuration with limited applicability to others, though some patterns may be useful for reference.+Common self-hosting services have been extracted to a separate project, [Eilean](https://github.com/RyanGibb/eilean-nix).+See the [NixOS manual](https://nixos.org/manual/nixos/stable/#ch-installation) for how to install NixOS.+[`deploy-rs`](https://github.com/serokell/deploy-rs) can be used to update remote hosts via SSH with `deploy .#hostname`.+1. Install [Nix](https://nixos.org/download/) and [enable flakes](https://nixos.wiki/wiki/flakes#Other_Distros.2C_without_Home-Manager).+2. Clone this repository and follow the [Home Manager manual](https://nix-community.github.io/home-manager/index.xhtml#sec-install-standalone).+- [`flake.nix`](./flake.nix) - Entry point where inputs, outputs, and [overlays](https://nixos.org/manual/nixpkgs/stable/#chap-overlays) are defined.+- [`hosts/`](./hosts/) - Host-specific configurations where each subdirectory represents a separate machine.+- Servers are even-toed ungulates ([Artiodactyls](https://en.wikipedia.org/wiki/Artiodactyl)), e.g. the [Network-Attached Storage (NAS) server](https://ryan.freumh.org/nas.html) [`elephant`](./hosts/elephant).+- SBCs are small mammals ([Eulipotyphla](https://en.wikipedia.org/wiki/Eulipotyphla)), e.g. the [Home Assistant](https://www.home-assistant.io/) server and [Zigbee](https://en.wikipedia.org/wiki/Zigbee) bridge [`shrew`](./hosts/shrew).+- Desktops are carnivores ([Carnivora](https://en.wikipedia.org/wiki/Carnivora)), e.g. the tower PC [`vulpine`](./hosts/vulpine).+- Work-associated hosts are aquatic, e.g. the VPSs for [Eon](https://github.com/RyanGibb/eon) experiments [`duck`](./hosts/duck), and running the [EEG](https://www.cst.cam.ac.uk/research/eeg) infrastructure including using the federated [Shibboleth](https://www.shibboleth.net/) identity server to provision [Matrix](https://matrix.org/) accounts [`swan`](./hosts/swan).+- [`barnacle`](./hosts/barnacle/default.nix) builds an ISO image that can be written to media like a USB flash drive to create a read-only live USB that can be booted to provide the custom environment on all my other hosts and used to, for example, install an operating system, with the [`install.sh`](./hosts/barnacle/install.sh) script.+- `hardware-configuration.nix` - Hardware-specific configuration generated by `nixos-generate-config`.+- `minimal.nix` - A minimal configuration that can be useful when updating with insufficient disk space.+The minimal configuration can be build, the `default.nix` system garbage collected, and then the updated configuration built.+- [`modules/`](./modules/) - NixOS modules of common functionality extracted into modular components which can be enabled by host configurations.+- [`pkgs/`](./pkgs/) - Custom package definitions for packages not available in nixpkgs or requiring modifications.+To add a new secret, update [secrets.nix](./secrets/secrets.nix) and run `cd secrets && agenix -e <secret-name>.age`.
+158
-104
flake.lock
+158
-104
flake.lock
··········································+"url": "https://github.com/lucide-icons/lucide/releases/download/0.483.0/lucide-icons-0.483.0.zip"+"url": "https://github.com/lucide-icons/lucide/releases/download/0.483.0/lucide-icons-0.483.0.zip"·······································
+5
-5
flake.nix
+5
-5
flake.nix
············
+4
-45
home/calendar.nix
+4
-45
home/calendar.nix
···
+23
-14
home/default.nix
+23
-14
home/default.nix
···-selected=$((tac "$hist_file"; find ~/ ~/projects -mindepth 1 -maxdepth 1 -type d -not -path '*/[.]*'; echo /etc/nixos) | awk '!seen[$0]++' | fzf --print-query | tail -n 1)·········# https://stackoverflow.com/questions/62182401/neovim-screen-lagging-when-switching-mode-from-insert-to-normal···-bind-key K run-shell 'tmux ls | grep -v attached | cut -d: -f1 | xargs -I {} tmux kill-window -t {}'
+1
-1
home/emacs/default.nix
+1
-1
home/emacs/default.nix
+1
-1
home/gui/default.nix
+1
-1
home/gui/default.nix
-1
home/gui/sway.nix
-1
home/gui/sway.nix
+4
-4
home/gui/wm/config.d/bindings
+4
-4
home/gui/wm/config.d/bindings
···
+10
-9
home/mail.nix
+10
-9
home/mail.nix
······macro index,pager <F1> '"<change-folder> ${config.accounts.email.maildirBasePath}/ryan@freumh.org/Inbox<enter>"'············onNotify = "${sync-mail}/bin/sync-mail ryan.gibb@cl.cam.ac.uk:INBOX ryan.gibb@cl.cam.ac.uk:Sidebox";······onNotify = "${sync-mail}/bin/sync-mail ryangibb321@gmail.com:INBOX ryangibb321@gmail.com:Sidebox";···
+4
home/zsh.cfg
+4
home/zsh.cfg
······
+23
-1
hosts/elephant/services.nix
+23
-1
hosts/elephant/services.nix
············
+8
-5
hosts/gecko/default.nix
+8
-5
hosts/gecko/default.nix
·········
+31
hosts/hippo/default.nix
+31
hosts/hippo/default.nix
···
+33
hosts/hippo/disk-config.nix
+33
hosts/hippo/disk-config.nix
···
+40
hosts/hippo/hardware-configuration.nix
+40
hosts/hippo/hardware-configuration.nix
···+hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+2
-475
hosts/owl/default.nix
+2
-475
hosts/owl/default.nix
···-# sudo openssl x509 -in /var/lib/acme/mail.freumh.org/fullchain.pem -pubkey -noout | openssl pkey -pubin -outform der | sha256sum | awk '{print "3 1 1", $1}'-# openssl x509 -in ~/downloads/lets-encrypt-$i.pem -pubkey -noout | openssl pkey -pubin -outform der | sha256sum | awk '{print "2 1 1", $1}'-add_header Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval' blob:; base-uri 'self'; frame-src 'self'; frame-ancestors 'self'; form-action 'self';" always;···
+518
hosts/owl/services.nix
+518
hosts/owl/services.nix
···+add_header Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval' blob:; base-uri 'self'; frame-src 'self'; frame-ancestors 'self'; form-action 'self';" always;+# sudo openssl x509 -in /var/lib/acme/mail.freumh.org/fullchain.pem -pubkey -noout | openssl pkey -pubin -outform der | sha256sum | awk '{print "3 1 1", $1}'+# openssl x509 -in ~/downloads/lets-encrypt-$i.pem -pubkey -noout | openssl pkey -pubin -outform der | sha256sum | awk '{print "2 1 1", $1}'
+1
-10
hosts/vulpine/default.nix
+1
-10
hosts/vulpine/default.nix
······
-57
modules/colour-guesser.nix
-57
modules/colour-guesser.nix
···
+1
secrets/secrets.nix
+1
secrets/secrets.nix
+7
secrets/tangled.age
+7
secrets/tangled.age
···+G๏ฟฝ๏ฟฝ๏ฟฝ๏ฟฝ}w๏ฟฝ๏ฟฝ๏ฟฝ๏ฟฝ{๏ฟฝ n๏ฟฝod&i,V๏ฟฝ๏ฟฝ๏ฟฝ๏ฟฝU๏ฟฝ๏ฟฝ%๏ฟฝ'!R46๏ฟฝ{>๏ฟฝ )>to๏ฟฝ]Hh๏ฟฝ๏ฟฝ๏ฟฝ๏ฟฝ๏ฟฝ2F๏ฟฝ๏ฟฝA๏ฟฝ ๏ฟฝ๏ฟฝ๏ฟฝTv๏ฟฝ!๏ฟฝ;๏ฟฝ๏ฟฝ๏ฟฝ)R๏ฟฝlM%U =|W"?*๏ฟฝ๏ฟฝe๏ฟฝ ๏ฟฝ"๏ฟฝ๏ฟฝ๏ฟฝ๏ฟฝi๏ฟฝKB๏ฟฝF
-43
templates/host/default.nix
-43
templates/host/default.nix
···