ryan.freumh.org
+63
-2
README.md
+63
-2
README.md
···+My personal Nix and NixOS configuration for reproducible, declarative systems and environments across multiple hosts.+This is a personal configuration with limited applicability to others, though some patterns may be useful for reference.+Common self-hosting services have been extracted to a separate project, [Eilean](https://github.com/RyanGibb/eilean-nix).+See the [NixOS manual](https://nixos.org/manual/nixos/stable/#ch-installation) for how to install NixOS.+[`deploy-rs`](https://github.com/serokell/deploy-rs) can be used to update remote hosts via SSH with `deploy .#hostname`.+1. Install [Nix](https://nixos.org/download/) and [enable flakes](https://nixos.wiki/wiki/flakes#Other_Distros.2C_without_Home-Manager).+2. Clone this repository and follow the [Home Manager manual](https://nix-community.github.io/home-manager/index.xhtml#sec-install-standalone).+- [`flake.nix`](./flake.nix) - Entry point where inputs, outputs, and [overlays](https://nixos.org/manual/nixpkgs/stable/#chap-overlays) are defined.+- [`hosts/`](./hosts/) - Host-specific configurations where each subdirectory represents a separate machine.+- Servers are even-toed ungulates ([Artiodactyls](https://en.wikipedia.org/wiki/Artiodactyl)), e.g. the [Network-Attached Storage (NAS) server](https://ryan.freumh.org/nas.html) [`elephant`](./hosts/elephant).+- SBCs are small mammals ([Eulipotyphla](https://en.wikipedia.org/wiki/Eulipotyphla)), e.g. the [Home Assistant](https://www.home-assistant.io/) server and [Zigbee](https://en.wikipedia.org/wiki/Zigbee) bridge [`shrew`](./hosts/shrew).+- Desktops are carnivores ([Carnivora](https://en.wikipedia.org/wiki/Carnivora)), e.g. the tower PC [`vulpine`](./hosts/vulpine).+- Work-associated hosts are aquatic, e.g. the VPSs for [Eon](https://github.com/RyanGibb/eon) experiments [`duck`](./hosts/duck), and running the [EEG](https://www.cst.cam.ac.uk/research/eeg) infrastructure including using the federated [Shibboleth](https://www.shibboleth.net/) identity server to provision [Matrix](https://matrix.org/) accounts [`swan`](./hosts/swan).+- [`barnacle`](./hosts/barnacle/default.nix) builds an ISO image that can be written to media like a USB flash drive to create a read-only live USB that can be booted to provide the custom environment on all my other hosts and used to, for example, install an operating system, with the [`install.sh`](./hosts/barnacle/install.sh) script.+- `hardware-configuration.nix` - Hardware-specific configuration generated by `nixos-generate-config`.+- `minimal.nix` - A minimal configuration that can be useful when updating with insufficient disk space.+The minimal configuration can be build, the `default.nix` system garbage collected, and then the updated configuration built.+- [`modules/`](./modules/) - NixOS modules of common functionality extracted into modular components which can be enabled by host configurations.+- [`pkgs/`](./pkgs/) - Custom package definitions for packages not available in nixpkgs or requiring modifications.+To add a new secret, update [secrets.nix](./secrets/secrets.nix) and run `cd secrets && agenix -e <secret-name>.age`.
+161
-107
flake.lock
+161
-107
flake.lock
·············································+"url": "https://github.com/lucide-icons/lucide/releases/download/0.483.0/lucide-icons-0.483.0.zip"+"url": "https://github.com/lucide-icons/lucide/releases/download/0.483.0/lucide-icons-0.483.0.zip"·······································
+6
-6
flake.nix
+6
-6
flake.nix
···············
+4
-62
home/calendar.nix
+4
-62
home/calendar.nix
···
+49
-36
home/default.nix
+49
-36
home/default.nix
············# https://stackoverflow.com/questions/62182401/neovim-screen-lagging-when-switching-mode-from-insert-to-normal···-bind-key K run-shell 'tmux ls | grep -v attached | cut -d: -f1 | xargs -I {} tmux kill-window -t {}'
+1
-1
home/emacs/default.nix
+1
-1
home/emacs/default.nix
+2
-2
home/gui/default.nix
+2
-2
home/gui/default.nix
-1
home/gui/sway.nix
-1
home/gui/sway.nix
+4
-4
home/gui/wm/config.d/bindings
+4
-4
home/gui/wm/config.d/bindings
···
+2
-3
home/gui/wm/scripts/swayidle_suspend.sh
+2
-3
home/gui/wm/scripts/swayidle_suspend.sh
···
+13
-12
home/mail.nix
+13
-12
home/mail.nix
···${pkgs.ugrep}/bin/ugrep -jPh -m 100 --color=never "$1" cat ${config.accounts.email.maildirBasePath}/addressbook/cam-ldap)······macro index,pager <F1> '"<change-folder> ${config.accounts.email.maildirBasePath}/ryan@freumh.org/Inbox<enter>"'············+onNotify = "${sync-mail}/bin/sync-mail ryan.gibb@cl.cam.ac.uk:INBOX ryan.gibb@cl.cam.ac.uk:Sidebox";······+onNotify = "${sync-mail}/bin/sync-mail ryangibb321@gmail.com:INBOX ryangibb321@gmail.com:Sidebox";···
+313
-314
home/nvim/default.nix
+313
-314
home/nvim/default.nix
···-map('v', '<leader>gs', function() gitsigns.stage_hunk {vim.fn.line('.'), vim.fn.line('v')} end, { desc = 'Git stage hunk' })-map('v', '<leader>gr', function() gitsigns.reset_hunk {vim.fn.line('.'), vim.fn.line('v')} end, { desc = 'Git reset hunk' })-map('n', '<leader>gtb', gitsigns.toggle_current_line_blame, { desc = 'Git toggle line blame' })+map('v', '<leader>gs', function() gitsigns.stage_hunk {vim.fn.line('.'), vim.fn.line('v')} end, { desc = 'Git stage hunk' })+map('v', '<leader>gr', function() gitsigns.reset_hunk {vim.fn.line('.'), vim.fn.line('v')} end, { desc = 'Git reset hunk' })+map('n', '<leader>gtb', gitsigns.toggle_current_line_blame, { desc = 'Git toggle line blame' })-vim.keymap.set({'n', 'x', 'o'}, 'gs', '<Plug>(leap-from-window)', { desc = "Leap from window"} )+vim.keymap.set({'n', 'x', 'o'}, 'gs', '<Plug>(leap-from-window)', { desc = "Leap from window"} )
+1
-1
home/nvim/init.lua
+1
-1
home/nvim/init.lua
···
+3
-2
home/nvim/telescope-nvim.lua
+3
-2
home/nvim/telescope-nvim.lua
···vim.keymap.set('n', '<leader>ff', require('telescope.builtin').find_files, { desc = 'Find files' })vim.keymap.set('n', '<leader><leader>', require('telescope.builtin').find_files, { desc = 'Find files' })-vim.keymap.set('n', '<leader>sd', require('telescope.builtin').live_grep, { desc = 'Find grep' })+vim.keymap.set('n', '<leader>sd', require('telescope.builtin').live_grep, { desc = 'Search directory' })vim.keymap.set('n', '<leader>fv', require('telescope.builtin').git_files, { desc = 'Find version control' })vim.keymap.set('n', '<leader>bb', function() require('telescope.builtin').buffers({ sort_mru = true }) end, { desc = 'Find buffer' })vim.keymap.set('n', '<leader>h', require('telescope.builtin').help_tags, { desc = 'Find help' })-vim.keymap.set('n', '<leader>fq', require('telescope.builtin').command_history, { desc = 'Find command' })+vim.keymap.set('n', '<leader>fq', require('telescope.builtin').commands, { desc = 'Find command' })+vim.keymap.set('n', '<leader>fQ', require('telescope.builtin').command_history, { desc = 'Find command history' })vim.keymap.set('n', '<leader>f/', require('telescope.builtin').search_history, { desc = 'Find search' })vim.keymap.set('n', '<leader>fj', require('telescope.builtin').jumplist, { desc = 'Find jumplist' })
+4
home/zsh.cfg
+4
home/zsh.cfg
······
-1
hosts/elephant/default.nix
-1
hosts/elephant/default.nix
+76
-8
hosts/elephant/services.nix
+76
-8
hosts/elephant/services.nix
··················failregex = ^.*\[warn\]\[Auth\]: Failed login attempt from user with incorrect Jellyfin credentials {"account":{"ip":"<HOST>","email":+failregex = ^(?:\[\])?\s*WARN \{[^\}]*\} Login failed for user "<F-USER>[^"]*</F-USER>" IP-address: <ADDR>···
+24
-5
hosts/gecko/default.nix
+24
-5
hosts/gecko/default.nix
···············
+31
hosts/hippo/default.nix
+31
hosts/hippo/default.nix
···
+33
hosts/hippo/disk-config.nix
+33
hosts/hippo/disk-config.nix
···
+40
hosts/hippo/hardware-configuration.nix
+40
hosts/hippo/hardware-configuration.nix
···+hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+5
-467
hosts/owl/default.nix
+5
-467
hosts/owl/default.nix
···-# sudo openssl x509 -in /var/lib/acme/mail.freumh.org/fullchain.pem -pubkey -noout | openssl pkey -pubin -outform der | sha256sum | awk '{print "3 1 1", $1}'-# openssl x509 -in ~/downloads/lets-encrypt-$i.pem -pubkey -noout | openssl pkey -pubin -outform der | sha256sum | awk '{print "2 1 1", $1}'-add_header Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval' blob:; base-uri 'self'; frame-src 'self'; frame-ancestors 'self'; form-action 'self';" always;···
+518
hosts/owl/services.nix
+518
hosts/owl/services.nix
···+add_header Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval' blob:; base-uri 'self'; frame-src 'self'; frame-ancestors 'self'; form-action 'self';" always;+# sudo openssl x509 -in /var/lib/acme/mail.freumh.org/fullchain.pem -pubkey -noout | openssl pkey -pubin -outform der | sha256sum | awk '{print "3 1 1", $1}'+# openssl x509 -in ~/downloads/lets-encrypt-$i.pem -pubkey -noout | openssl pkey -pubin -outform der | sha256sum | awk '{print "2 1 1", $1}'
+2
-11
hosts/vulpine/default.nix
+2
-11
hosts/vulpine/default.nix
······
-57
modules/colour-guesser.nix
-57
modules/colour-guesser.nix
···
+2
-2
modules/ryan-website.nix
+2
-2
modules/ryan-website.nix
······
+8
-1
nix-on-droid/default.nix
+8
-1
nix-on-droid/default.nix
·········
+1
secrets/secrets.nix
+1
secrets/secrets.nix
+7
secrets/tangled.age
+7
secrets/tangled.age
···+G๏ฟฝ๏ฟฝ๏ฟฝ๏ฟฝ}w๏ฟฝ๏ฟฝ๏ฟฝ๏ฟฝ{๏ฟฝ n๏ฟฝod&i,V๏ฟฝ๏ฟฝ๏ฟฝ๏ฟฝU๏ฟฝ๏ฟฝ%๏ฟฝ'!R46๏ฟฝ{>๏ฟฝ )>to๏ฟฝ]Hh๏ฟฝ๏ฟฝ๏ฟฝ๏ฟฝ๏ฟฝ2F๏ฟฝ๏ฟฝA๏ฟฝ ๏ฟฝ๏ฟฝ๏ฟฝTv๏ฟฝ!๏ฟฝ;๏ฟฝ๏ฟฝ๏ฟฝ)R๏ฟฝlM%U =|W"?*๏ฟฝ๏ฟฝe๏ฟฝ ๏ฟฝ"๏ฟฝ๏ฟฝ๏ฟฝ๏ฟฝi๏ฟฝKB๏ฟฝF
-43
templates/host/default.nix
-43
templates/host/default.nix
···