yep, more dotfiles

feat: add wiroprint-server

+14 -3
apps/default.nix
···
{ pkgs-per-system }:
-
{ lib
, ...
}@pkgs:
let
apps = {
-
flash-installer-iso-x86_64-linux = import ./flash-installer.nix pkgs-per-system.x86_64-linux pkgs;
};
in
-
lib.mapAttrs (_: program: { type = "app"; inherit program; }) apps
···
{ pkgs-per-system }:
+
{ self
+
, lib
, ...
}@pkgs:
let
+
inherit (self.outputs) flake-lib;
+
+
iso-x86_64-linux = flake-lib.nixos.createSystem pkgs-per-system.x86_64-linux [ ../nixos/profiles/installer.nix ];
+
path-iso-x86_64-linux = "${iso-x86_64-linux.config.system.build.isoImage}/iso/${iso-x86_64-linux.config.isoImage.isoName}";
+
+
iso-rpi = flake-lib.nixos.createSystem pkgs-per-system.aarch64-linux [ ../nixos/profiles/installer-rpi.nix ];
+
path-iso-rpi = "${iso-rpi.config.system.build.sdImage}/iso/${iso-rpi.config.sdImage.isoName}";
+
apps = {
+
inherit iso-rpi;
+
+
installer-iso-x86_64-linux = import ./flash-installer.nix pkgs path-iso-x86_64-linux;
+
installer-rpi = import ./flash-installer.nix pkgs path-iso-rpi;
};
in
lib.mapAttrs (_: program: { type = "app"; inherit program; }) apps
+2 -10
apps/flash-installer.nix
···
-
targetSystemPkgs:
-
{ self
, lib
···
, ...
}@pkgs:
-
let
-
inherit (self.outputs) flake-lib;
-
-
iso = flake-lib.nixos.createSystem targetSystemPkgs [ ../nixos/profiles/installer.nix ];
-
# Build installer ISO
-
isoPath = "${iso.config.system.build.isoImage}/iso/${iso.config.isoImage.isoName}";
-
in
lib.getExe (writeShellApplication {
name = "flash-installer";
runtimeInputs = with pkgs; [ pv fzf ];
···
echo "Flashing to $dev"
# Format selected disk
-
pv -tpreb "${isoPath}" | sudo dd bs=4M of="$dev" iflag=fullblock conv=notrunc,noerror oflag=sync
'';
})
···
{ self
, lib
···
, ...
}@pkgs:
+
image-path:
lib.getExe (writeShellApplication {
name = "flash-installer";
runtimeInputs = with pkgs; [ pv fzf ];
···
echo "Flashing to $dev"
# Format selected disk
+
pv -tpreb "${image-path}" | sudo dd bs=4M of="$dev" iflag=fullblock conv=notrunc,noerror oflag=sync
'';
})
+7 -1
configurations.nix
···
# Servers
"weird-row-server" = createSystem pkgs [
-
(system "weird-row-server" "server")
(managedDiskLayout "ext4-hetzner" { device = "sda"; swapSize = 2; })
(user "milomoisson" { description = "Milo Moisson"; profile = "server"; keys = keys.users; })
];
};
···
# Servers
"weird-row-server" = createSystem pkgs [
+
(system "weird-row-server" "main-server")
(managedDiskLayout "ext4-hetzner" { device = "sda"; swapSize = 2; })
+
(user "milomoisson" { description = "Milo Moisson"; profile = "server"; keys = keys.users; })
+
];
+
+
"wiroprint-server" = createSystem pkgs [
+
(system "wiroprint-server" "print-server")
+
# (managedDiskLayout "ext4-hetzner" { device = "sda"; swapSize = 2; })
(user "milomoisson" { description = "Milo Moisson"; profile = "server"; keys = keys.users; })
];
};
-2
home-manager/fragments/shell.nix
···
# that depends on fish internal ls wrappers and can be overridden by
# bad configuration. (e.g. NixOS `environment.shellAliases` default)
ls = "${lib.getExe pkgs.eza} --color=auto --icons=auto --hyperlink";
-
-
pasters = "${lib.getExe pkgs.curl} --data-binary @- https://paste.rs/";
};
shellAbbrs = {
···
# that depends on fish internal ls wrappers and can be overridden by
# bad configuration. (e.g. NixOS `environment.shellAliases` default)
ls = "${lib.getExe pkgs.eza} --color=auto --icons=auto --hyperlink";
};
shellAbbrs = {
+1
home-manager/fragments/tools.nix
···
openssl
ouch
parallel
pv
restic
ripgrep
···
openssl
ouch
parallel
+
lpkgs.paste-rs
pv
restic
ripgrep
+12 -4
home-manager/profiles/desktop.nix
···
programs.ssh = {
enable = true;
-
matchBlocks."weird-row-server" = {
-
hostname = "weird-row.portal.wiro.world";
-
# TODO: reduce automated load on ssh port by changing to a random port
-
# port = ""
};
};
···
programs.ssh = {
enable = true;
+
matchBlocks = {
+
"weird-row-server" = {
+
hostname = "weird-row.portal.wiro.world";
+
# TODO: reduce automated load on ssh port by changing to a random port
+
# port = ""
+
};
+
+
"wiroprint" = {
+
hostname = "wiroprint.portal.wiro.world";
+
# this machine is not accessible on the public network via SSH
+
# port = "";
+
};
};
};
+40
nixos/layout/ext4.nix
···
···
+
{ config
+
, ...
+
}:
+
+
let
+
cfg = config.local.disk;
+
in
+
{
+
config.disko.devices.disk.primary = {
+
type = "disk";
+
device = cfg.device;
+
content = {
+
type = "gpt";
+
partitions = {
+
boot = {
+
size = "1M";
+
type = "EF02";
+
priority = 1;
+
};
+
ESP = {
+
size = "512M";
+
type = "EF00";
+
content = {
+
type = "filesystem";
+
format = "vfat";
+
mountpoint = "/boot";
+
};
+
};
+
root = {
+
size = "100%";
+
content = {
+
type = "filesystem";
+
format = "ext4";
+
mountpoint = "/";
+
};
+
};
+
};
+
};
+
};
+
}
+101
nixos/profiles/installer-rpi.nix
···
···
+
{ self
+
, lib
+
, pkgs
+
, lpkgs
+
+
, modulesPath
+
, ...
+
}:
+
+
let
+
inherit (self.inputs) nixos-hardware;
+
+
keys = import ../../secrets/keys.nix;
+
+
binName = drv: drv.meta.mainProgram;
+
+
flakeUri = "github:mrnossiom/dotfiles";
+
+
## Formatting related
+
+
# Does the whole destroy, format, mount disko cycle
+
# disko-cycle <hostname>
+
disko-cycle = pkgs.writeShellScriptBin "disko-cycle" ''
+
if [ -z "$1" ]; then echo "Hostname unset"; exit; fi
+
+
echo "Running disko destroy, format and mount script for $1"
+
nix build ${flakeUri}#nixosConfigurations.$1.config.system.build.diskoScript
+
sudo bash result
+
'';
+
+
## NixOS install related
+
+
# Generates hardware related config and uploads it to a paste service
+
# link-hardware-config [root]
+
link-hardware-config = pkgs.writeShellScriptBin "link-hardware-config" ''
+
nixos-generate-config --root ''${1:-/mnt} --show-hardware-config | ${lib.getExe lpkgs.paste-rs}
+
'';
+
+
# Install specified flake system to /mnt
+
# install-system <hostname>
+
install-system = pkgs.writeShellScriptBin "install-system" ''
+
if [ -z "$1" ]; then echo "Hostname unset"; exit; fi
+
+
echo "Installing $1"
+
nixos-install --system ${flakeUri}#$1
+
'';
+
in
+
{
+
imports = [
+
nixos-hardware.nixosModules.raspberry-pi-4
+
"${modulesPath}/installer/sd-card/sd-image-aarch64.nix"
+
];
+
+
config = {
+
sdImage.compressImage = false;
+
+
boot.kernelPackages = lib.mkForce pkgs.linuxKernel.packages.linux_rpi4;
+
+
nix.settings = {
+
experimental-features = [ "nix-command" "flakes" ];
+
extra-substituters = [
+
"https://nix-community.cachix.org"
+
"https://mrnossiom.cachix.org"
+
];
+
extra-trusted-public-keys = [
+
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+
"mrnossiom.cachix.org-1:WKo+xfDFaT6pRP4YiIFsEXvyBzI/Pm9uGhURgF1wlQg="
+
];
+
};
+
+
users.users.nixos = {
+
isNormalUser = true;
+
extraGroups = [ "wheel" ];
+
# Add our keys to default users for better remote experience
+
openssh.authorizedKeys.keys = keys.users;
+
};
+
+
# Start wpa_supplicant right away
+
systemd.services.wpa_supplicant.wantedBy = lib.mkForce [ "multi-user.target" ];
+
+
services.getty.helpLine = ''
+
Available custom tools:
+
- File System: ${binName disko-cycle}
+
- Installation: ${binName link-hardware-config}, ${binName install-system}
+
+
Troubleshoot:
+
- If the disko installer fails to finish due to a dark error just wipe the disk table
+
$ parted /dev/<disk-id> -- mklabel gpt
+
'';
+
+
environment.systemPackages = [
+
disko-cycle
+
link-hardware-config
+
install-system
+
];
+
+
services.openssh.enable = true;
+
+
security.sudo.wheelNeedsPassword = false;
+
};
+
}
+7 -9
nixos/profiles/installer.nix
···
{ lib
, pkgs
, modulesPath
, ...
}:
let
-
inherit (pkgs) writeShellScriptBin pastebinit;
-
keys = import ../../secrets/keys.nix;
binName = drv: drv.meta.mainProgram;
-
flakeUri = "github:mrnossiom/dotfiles/nixos";
## Wireless related
# connect-wifi <interface> <BSSID>
-
connect-wifi = writeShellScriptBin "connect-wifi" ''
if [ -z "$1" ]; then echo "Interface unset"; exit; fi
if [ -z "$2" ]; then echo "SSID unset"; exit; fi
···
# Does the whole destroy, format, mount disko cycle
# disko-cycle <hostname>
-
disko-cycle = writeShellScriptBin "disko-cycle" ''
if [ -z "$1" ]; then echo "Hostname unset"; exit; fi
echo "Running disko destroy, format and mount script for $1"
···
## NixOS install related
-
# Generates hardware related config and uploads it to pastebin
# link-hardware-config [root]
-
link-hardware-config = writeShellScriptBin "link-hardware-config" ''
-
nixos-generate-config --root ''${1:-/mnt} --show-hardware-config | ${lib.getExe' pastebinit "pastebinit"}
'';
# Install specified flake system to /mnt
···
echo "Installing $1"
nixos-install --system ${flakeUri}#$1
'';
-
in
{
imports = [ "${modulesPath}/installer/cd-dvd/installation-cd-minimal-new-kernel.nix" ];
···
{ lib
, pkgs
+
, lpkgs
, modulesPath
, ...
}:
let
keys = import ../../secrets/keys.nix;
binName = drv: drv.meta.mainProgram;
+
flakeUri = "github:mrnossiom/dotfiles";
## Wireless related
# connect-wifi <interface> <BSSID>
+
connect-wifi = pkgs.writeShellScriptBin "connect-wifi" ''
if [ -z "$1" ]; then echo "Interface unset"; exit; fi
if [ -z "$2" ]; then echo "SSID unset"; exit; fi
···
# Does the whole destroy, format, mount disko cycle
# disko-cycle <hostname>
+
disko-cycle = pkgs.writeShellScriptBin "disko-cycle" ''
if [ -z "$1" ]; then echo "Hostname unset"; exit; fi
echo "Running disko destroy, format and mount script for $1"
···
## NixOS install related
+
# Generates hardware related config and uploads it to a paste service
# link-hardware-config [root]
+
link-hardware-config = pkgs.writeShellScriptBin "link-hardware-config" ''
+
nixos-generate-config --root ''${1:-/mnt} --show-hardware-config | ${lib.getExe lpkgs.paste-rs}
'';
# Install specified flake system to /mnt
···
echo "Installing $1"
nixos-install --system ${flakeUri}#$1
'';
in
{
imports = [ "${modulesPath}/installer/cd-dvd/installation-cd-minimal-new-kernel.nix" ];
+100
nixos/profiles/print-server.nix
···
···
+
{ self
+
, config
+
, upkgs
+
, ...
+
}:
+
+
let
+
inherit (self.inputs) srvos agenix tangled;
+
+
all-secrets = import ../../secrets;
+
+
ext-if = "eth0";
+
external-ip = "91.99.55.74";
+
external-netmask = 27;
+
external-gw = "144.x.x.255";
+
external-ip6 = "2a01:4f8:c2c:76d2::1";
+
external-netmask6 = 64;
+
external-gw6 = "fe80::1";
+
+
octoprint-hostname = "print.wiro.world";
+
octoprint-port = 3000;
+
in
+
{
+
imports = [
+
srvos.nixosModules.server
+
srvos.nixosModules.hardware-hetzner-cloud
+
srvos.nixosModules.mixins-terminfo
+
+
agenix.nixosModules.default
+
+
tangled.nixosModules.knotserver
+
];
+
+
config = {
+
age.secrets = all-secrets.deploy;
+
+
boot.loader.grub.enable = true;
+
boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" "ext4" ];
+
+
# Single network card is `eth0`
+
networking.usePredictableInterfaceNames = false;
+
+
networking.nameservers = [ "2001:4860:4860::8888" "2001:4860:4860::8844" ];
+
+
networking = {
+
interfaces.${ext-if} = {
+
ipv4.addresses = [{ address = external-ip; prefixLength = external-netmask; }];
+
ipv6.addresses = [{ address = external-ip6; prefixLength = external-netmask6; }];
+
};
+
defaultGateway = { interface = ext-if; address = external-gw; };
+
defaultGateway6 = { interface = ext-if; address = external-gw6; };
+
+
firewall.allowedTCPPorts = [ 22 80 443 ];
+
};
+
+
services.openssh.enable = true;
+
+
services.fail2ban = {
+
enable = true;
+
+
maxretry = 5;
+
ignoreIP = [ ];
+
+
bantime = "24h";
+
bantime-increment = {
+
enable = true;
+
multipliers = "1 2 4 8 16 32 64";
+
maxtime = "168h";
+
overalljails = true;
+
};
+
+
jails = { };
+
};
+
+
services.caddy = {
+
enable = true;
+
package = upkgs.caddy;
+
+
globalConfig = ''
+
metrics { per_host }
+
'';
+
+
virtualHosts.${octoprint-hostname}.extraConfig = ''
+
reverse_proxy http://localhost:${toString octoprint-port}
+
'';
+
};
+
+
services.octoprint = {
+
enable = true;
+
host = octoprint-hostname;
+
port = octoprint-port;
+
};
+
+
security.sudo.wheelNeedsPassword = false;
+
+
local.fragment.nix.enable = true;
+
+
programs.fish.enable = true;
+
};
+
}
nixos/profiles/server.nix nixos/profiles/main-server.nix
+1
pkgs/default.nix
···
find-unicode = pkgs.callPackage ./find-unicode.nix { };
names = pkgs.callPackage ./names.nix { };
otree = pkgs.callPackage ./otree.nix { };
probe-rs-udev-rules = pkgs.callPackage ./probe-rs-udev-rules.nix { };
# Import packages defined in foreign repositories
···
find-unicode = pkgs.callPackage ./find-unicode.nix { };
names = pkgs.callPackage ./names.nix { };
otree = pkgs.callPackage ./otree.nix { };
+
paste-rs = pkgs.callPackage ./paste-rs.nix { };
probe-rs-udev-rules = pkgs.callPackage ./probe-rs-udev-rules.nix { };
# Import packages defined in foreign repositories
+12
pkgs/paste-rs.nix
···
···
+
{ writeShellApplication
+
+
, curl
+
}:
+
+
writeShellApplication {
+
name = "pasters";
+
runtimeInputs = [ curl ];
+
text = ''
+
curl --data-binary @- https://paste.rs/
+
'';
+
}