commit 07f6ecde04c8faeeafd8886668a2b0810794fafd · yemou.pink/nix-configs

+1 -1

dandelion/config.nix

···

       32
        
         networking.hostName = "dandelion";

     

       33
        
         nix.settings.max-jobs = 0;

     

       34
        
       

     

       35
       -
         mInfo = {

     

       36
        
           sss-mount = true;

     

       37
        
           vps = true;

     

       38
        
         };

···

       32
        
         networking.hostName = "dandelion";

     

       33
        
         nix.settings.max-jobs = 0;

     

       34
        
       

     

       35
       +
         garden.info.host = {

     

       36
        
           sss-mount = true;

     

       37
        
           vps = true;

     

       38
        
         };

+1 -1

dandelion/hardware.nix

···

       92
        
           networks."10-wan" = {

     

       93
        
             matchConfig.Name = "enp1s0";

     

       94
        
             networkConfig.DHCP = "ipv4";

     

       95
       -
             address = [ "${config.nInfo.${config.networking.hostName}.ipv6}/64" ];

     

       96
        
             routes = [ { Gateway = "fe80::1"; } ];

     

       97
        
           };

     

       98
        
         };

···

       92
        
           networks."10-wan" = {

     

       93
        
             matchConfig.Name = "enp1s0";

     

       94
        
             networkConfig.DHCP = "ipv4";

     

       95
       +
             address = [ "${config.garden.info.network.${config.networking.hostName}.ipv6}/64" ];

     

       96
        
             routes = [ { Gateway = "fe80::1"; } ];

     

       97
        
           };

     

       98
        
         };

+2 -4

dandelion/services/caddy.nix

···

       2
        
       # TODO: Separate caddy config into separate files

     

       3
        
       { config, pkgs, ... }:

     

       4
        
       let

     

       5
       -
         lily = config.nInfo.lily.netbird-ip;

     

       6
        
         cpCerts = pkgs.writeShellApplication {

     

       7
        
           name = "cpCerts";

     

       8
        
           runtimeInputs = with pkgs; [ coreutils ];

     
···

       30
        
             esac

     

       31
        
           '';

     

       32
        
         };

     

       33
       -
         cpCertsCommand =

     

       34
       -
           "${cpCerts}/bin/cpCerts {event.data.identifier} {event.data.certificate_path} "

     

       35
       -
           + "{event.data.private_key_path}";

     

       36
        
       in

     

       37
        
       {

     

       38
        
         environment.persistence."/data/persistent".directories = [

···

       2
        
       # TODO: Separate caddy config into separate files

     

       3
        
       { config, pkgs, ... }:

     

       4
        
       let

     

       5
       +
         lily = config.garden.info.network.lily.netbird-ip;

     

       6
        
         cpCerts = pkgs.writeShellApplication {

     

       7
        
           name = "cpCerts";

     

       8
        
           runtimeInputs = with pkgs; [ coreutils ];

     
···

       30
        
             esac

     

       31
        
           '';

     

       32
        
         };

     

       33
       +
         cpCertsCommand = "${cpCerts}/bin/cpCerts {event.data.identifier} {event.data.certificate_path} {event.data.private_key_path}";

     

       0
        
       
     

       0
        
       
     

       34
        
       in

     

       35
        
       {

     

       36
        
         environment.persistence."/data/persistent".directories = [

+3 -1

flake.nix

···

       42
        
           {

     

       43
        
             # TODO: replace this with treefmt or something since the functionality to scan for all nix files is being

     

       44
        
             #       deprecated

     

       45
       -
             formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixfmt-tree;

     

       0
        
       
     

       0
        
       
     

       46
        
             nixosConfigurations = genSystemConfigs (

     

       47
        
               hostname:

     

       48
        
               nixpkgs.lib.nixosSystem {

···

       42
        
           {

     

       43
        
             # TODO: replace this with treefmt or something since the functionality to scan for all nix files is being

     

       44
        
             #       deprecated

     

       45
       +
             formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixfmt-tree.override {

     

       46
       +
               settings.formatter.nixfmt.options = [ "-w 120" ];

     

       47
       +
             };

     

       48
        
             nixosConfigurations = genSystemConfigs (

     

       49
        
               hostname:

     

       50
        
               nixpkgs.lib.nixosSystem {

+1 -1

lily/config.nix

···

       26
        
           ./services/fail2ban.nix

     

       27
        
         ];

     

       28
        
       

     

       29
       -
         mInfo = {

     

       30
        
           server = true;

     

       31
        
         };

     

       32

···

       26
        
           ./services/fail2ban.nix

     

       27
        
         ];

     

       28
        
       

     

       29
       +
         garden.info.host = {

     

       30
        
           server = true;

     

       31
        
         };

     

       32

+1 -1

lily/services/fail2ban.nix

···

       1
        
       { config, ... }:

     

       2
        
       {

     

       3
        
         # Since this server is on my local network, I'm also ignoring my local ip

     

       4
       -
         services.fail2ban.ignoreIP = [ config.nInfo.lutea.ipv4-local ];

     

       5
        
       }

···

       1
        
       { config, ... }:

     

       2
        
       {

     

       3
        
         # Since this server is on my local network, I'm also ignoring my local ip

     

       4
       +
         services.fail2ban.ignoreIP = [ config.garden.info.network.lutea.ipv4-local ];

     

       5
        
       }

+2 -2

lutea/hardware.nix

···

       41
        
       

     

       42
        
         swapDevices = [ { device = "/swap/swapfile"; } ];

     

       43
        
         systemd.services.zswap = {

     

       44
       -
           description =  "Enable zswap";

     

       45
        
           enable = true;

     

       46
       -
           wantedBy = ["basic.target"];

     

       47
        
           serviceConfig = {

     

       48
        
             ExecStart = ''

     

       49
        
               ${pkgs.bash}/bin/bash -c 'cd /sys/module/zswap/parameters && \

···

       41
        
       

     

       42
        
         swapDevices = [ { device = "/swap/swapfile"; } ];

     

       43
        
         systemd.services.zswap = {

     

       44
       +
           description = "Enable zswap";

     

       45
        
           enable = true;

     

       46
       +
           wantedBy = [ "basic.target" ];

     

       47
        
           serviceConfig = {

     

       48
        
             ExecStart = ''

     

       49
        
               ${pkgs.bash}/bin/bash -c 'cd /sys/module/zswap/parameters && \

+1 -1

modules/basic.nix

···

       57
        
         services = {

     

       58
        
           acpid.enable = true;

     

       59
        
           # TODO: Setup email

     

       60
       -
           smartd.enable = config.mInfo.vps == false;

     

       61
        
         };

     

       62
        
       

     

       63
        
         systemd.network.enable = true;

···

       57
        
         services = {

     

       58
        
           acpid.enable = true;

     

       59
        
           # TODO: Setup email

     

       60
       +
           smartd.enable = config.garden.info.host.vps == false;

     

       61
        
         };

     

       62
        
       

     

       63
        
         systemd.network.enable = true;

+3 -5

modules/binary-cache.nix

···

       5
        
             substituters = [

     

       6
        
               (lib.mkIf (

     

       7
        
                 config.networking.hostName != "dandelion"

     

       8
       -
               ) "ssh-ng://nix-ssh@${config.nInfo.dandelion.netbird-ip}")

     

       9
       -
               (lib.mkIf (config.networking.hostName != "lily") "ssh-ng://nix-ssh@${config.nInfo.lily.netbird-ip}")

     

       10
       -
               (lib.mkIf (

     

       11
       -
                 config.networking.hostName != "lutea"

     

       12
       -
               ) "ssh-ng://nix-ssh@${config.nInfo.lutea.netbird-ip}")

     

       13
        
             ];

     

       14
        
           };

     

       15
        
           sshServe = {

···

       5
        
             substituters = [

     

       6
        
               (lib.mkIf (

     

       7
        
                 config.networking.hostName != "dandelion"

     

       8
       +
               ) "ssh-ng://nix-ssh@${config.garden.info.network.dandelion.netbird-ip}")

     

       9
       +
               (lib.mkIf (config.networking.hostName != "lily") "ssh-ng://nix-ssh@${config.garden.info.network.lily.netbird-ip}")

     

       10
       +
               (lib.mkIf (config.networking.hostName != "lutea") "ssh-ng://nix-ssh@${config.garden.info.network.lutea.netbird-ip}")

     

       0
        
       
     

       0
        
       
     

       11
        
             ];

     

       12
        
           };

     

       13
        
           sshServe = {

-3

modules/browsers.nix

···

       1
        
       { pkgs, ... }:

     

       2
        
       {

     

       3
       -
         imports = [ ./unfree.nix ];

     

       4
       -
         unfree.allowed = [ "microsoft-edge" ];

     

       5
       -
       

     

       6
        
         nixpkgs.overlays = [

     

       7
        
           (final: prev: {

     

       8
        
             firefox-unwrapped = prev.firefox-unwrapped.overrideAttrs (

···

       1
        
       { pkgs, ... }:

     

       2
        
       {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       3
        
         nixpkgs.overlays = [

     

       4
        
           (final: prev: {

     

       5
        
             firefox-unwrapped = prev.firefox-unwrapped.overrideAttrs (

+3 -3

modules/fail2ban.nix

···

       12
        
             rndtime = "1h";

     

       13
        
           };

     

       14
        
           ignoreIP = [

     

       15
       -
             (lib.mkIf (config.networking.hostName != "dandelion") config.nInfo.dandelion.netbird-ip)

     

       16
       -
             (lib.mkIf (config.networking.hostName != "lily") config.nInfo.lily.netbird-ip)

     

       17
       -
             (lib.mkIf (config.networking.hostName != "lutea") config.nInfo.lutea.netbird-ip)

     

       18
        
           ];

     

       19
        
           maxretry = 1;

     

       20
        
         };

···

       12
        
             rndtime = "1h";

     

       13
        
           };

     

       14
        
           ignoreIP = [

     

       15
       +
             (lib.mkIf (config.networking.hostName != "dandelion") config.garden.info.network.dandelion.netbird-ip)

     

       16
       +
             (lib.mkIf (config.networking.hostName != "lily") config.garden.info.network.lily.netbird-ip)

     

       17
       +
             (lib.mkIf (config.networking.hostName != "lutea") config.garden.info.network.lutea.netbird-ip)

     

       18
        
           ];

     

       19
        
           maxretry = 1;

     

       20
        
         };

+1 -1

modules/games.nix

···

       1
        
       { pkgs, ... }:

     

       2
        
       {

     

       3
        
         imports = [ ./unfree.nix ];

     

       4
       -
         unfree.allowed = [

     

       5
        
           "modrinth-app"

     

       6
        
           "modrinth-app-unwrapped"

     

       7
        
           "steam"

···

       1
        
       { pkgs, ... }:

     

       2
        
       {

     

       3
        
         imports = [ ./unfree.nix ];

     

       4
       +
         garden.unfree = [

     

       5
        
           "modrinth-app"

     

       6
        
           "modrinth-app-unwrapped"

     

       7
        
           "steam"

+1 -1

modules/gui.nix

···

       26
        
         ];

     

       27
        
       

     

       28
        
         imports = [ ./machineInfo.nix ];

     

       29
       -
         mInfo.gui = true;

     

       30
        
       

     

       31
        
         xdg = {

     

       32
        
           portal = {

···

       26
        
         ];

     

       27
        
       

     

       28
        
         imports = [ ./machineInfo.nix ];

     

       29
       +
         garden.info.host.gui = true;

     

       30
        
       

     

       31
        
         xdg = {

     

       32
        
           portal = {

-2

modules/im.nix

···

       1
        
       { pkgs, ... }:

     

       2
        
       {

     

       3
       -
         imports = [ ./unfree.nix ];

     

       4
       -
       

     

       5
        
         users.users.mou.packages = with pkgs; [

     

       6
        
           senpai

     

       7
        
           signal-desktop

···

       1
        
       { pkgs, ... }:

     

       2
        
       {

     

       0
        
       
     

       0
        
       
     

       3
        
         users.users.mou.packages = with pkgs; [

     

       4
        
           senpai

     

       5
        
           signal-desktop

+1 -1

modules/machineInfo.nix

···

       1
        
       { lib, ... }:

     

       2
        
       {

     

       3
       -
         options.mInfo = {

     

       4
        
           gui = lib.mkOption {

     

       5
        
             type = with lib.types; bool;

     

       6
        
             default = false;

···

       1
        
       { lib, ... }:

     

       2
        
       {

     

       3
       +
         options.garden.info.host = {

     

       4
        
           gui = lib.mkOption {

     

       5
        
             type = with lib.types; bool;

     

       6
        
             default = false;

+1 -1

modules/netbird.nix

···

       11
        
       

     

       12
        
         services.netbird.clients.homelab = {

     

       13
        
           port = 51820;

     

       14
       -
           ui.enable = config.mInfo.gui;

     

       15
        
         };

     

       16
        
       }

···

       11
        
       

     

       12
        
         services.netbird.clients.homelab = {

     

       13
        
           port = 51820;

     

       14
       +
           ui.enable = config.garden.info.host.gui;

     

       15
        
         };

     

       16
        
       }

+2 -2

modules/networkInfo.nix

···

       1
        
       { lib, ... }:

     

       2
        
       {

     

       3
       -
         options.nInfo = lib.mkOption {

     

       4
        
           description = "Information about every host in the network.";

     

       5
        
           type =

     

       6
        
             with lib.types;

     
···

       41
        
             );

     

       42
        
         };

     

       43
        
       

     

       44
       -
         config.nInfo = builtins.fromJSON (builtins.readFile ../hidden/network.json);

     

       45
        
       }

···

       1
        
       { lib, ... }:

     

       2
        
       {

     

       3
       +
         options.garden.info.network = lib.mkOption {

     

       4
        
           description = "Information about every host in the network.";

     

       5
        
           type =

     

       6
        
             with lib.types;

     
···

       41
        
             );

     

       42
        
         };

     

       43
        
       

     

       44
       +
         config.garden.info.network = builtins.fromJSON (builtins.readFile ../hidden/network.json);

     

       45
        
       }

+4 -4

modules/remoteBuildMachines.nix

···

       35
        
         programs.ssh = {

     

       36
        
           knownHosts = {

     

       37
        
             nixremote-lily = {

     

       38
       -
               hostNames = [ config.nInfo.lily.netbird-ip ];

     

       39
        
               publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINaReNM+eSIzbZvqahaAlanf0z89rJQIYWx/rlaS4f1Y";

     

       40
        
             };

     

       41
        
             nixremote-lutea = {

     

       42
       -
               hostNames = [ config.nInfo.lutea.netbird-ip ];

     

       43
        
               publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICNMTxa2zRmHIXt3ARlCplboWRdCsAmDlN8gDLik4vNs";

     

       44
        
             };

     

       45
        
           };

     
···

       58
        
                 '';

     

       59
        
             in

     

       60
        
             ''

     

       61
       -
               ${mkSshConfig "lily" config.nInfo.lily.netbird-ip}

     

       62
       -
               ${mkSshConfig "lutea" config.nInfo.lutea.netbird-ip}

     

       63
        
             '';

     

       64
        
         };

     

       65
        
       }

···

       35
        
         programs.ssh = {

     

       36
        
           knownHosts = {

     

       37
        
             nixremote-lily = {

     

       38
       +
               hostNames = [ config.garden.info.network.lily.netbird-ip ];

     

       39
        
               publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINaReNM+eSIzbZvqahaAlanf0z89rJQIYWx/rlaS4f1Y";

     

       40
        
             };

     

       41
        
             nixremote-lutea = {

     

       42
       +
               hostNames = [ config.garden.info.network.lutea.netbird-ip ];

     

       43
        
               publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICNMTxa2zRmHIXt3ARlCplboWRdCsAmDlN8gDLik4vNs";

     

       44
        
             };

     

       45
        
           };

     
···

       58
        
                 '';

     

       59
        
             in

     

       60
        
             ''

     

       61
       +
               ${mkSshConfig "lily" config.garden.info.network.lily.netbird-ip}

     

       62
       +
               ${mkSshConfig "lutea" config.garden.info.network.lutea.netbird-ip}

     

       63
        
             '';

     

       64
        
         };

     

       65
        
       }

+1 -1

modules/remoteBuilder.nix

···

       19
        
       

     

       20
        
         nix.settings.trusted-users = [ "nixremote" ];

     

       21
        
       

     

       22
       -
         services.openssh.settings.AllowUsers = [ "nixremote@${config.nInfo.dandelion.netbird-ip}" ];

     

       23
        
       }

···

       19
        
       

     

       20
        
         nix.settings.trusted-users = [ "nixremote" ];

     

       21
        
       

     

       22
       +
         services.openssh.settings.AllowUsers = [ "nixremote@${config.garden.info.network.dandelion.netbird-ip}" ];

     

       23
        
       }

+1 -2

modules/services/dendrite.nix

···

       16
        
           }

     

       17
        
         ];

     

       18
        
       

     

       19
       -
         networking.firewall.interfaces.${config.services.netbird.clients.homelab.interface}.allowedTCPPorts =

     

       20
       -
           [ 8008 ];

     

       21
        
       

     

       22
        
         services.postgresql = {

     

       23
        
           ensureDatabases = [ "dendrite" ];

···

       16
        
           }

     

       17
        
         ];

     

       18
        
       

     

       19
       +
         networking.firewall.interfaces.${config.services.netbird.clients.homelab.interface}.allowedTCPPorts = [ 8008 ];

     

       0
        
       
     

       20
        
       

     

       21
        
         services.postgresql = {

     

       22
        
           ensureDatabases = [ "dendrite" ];

+4 -5

modules/services/nextcloud.nix

···

       41
        
         };

     

       42
        
       

     

       43
        
         # This is the port that nginx listens on by default

     

       44
       -
         networking.firewall.interfaces.${config.services.netbird.clients.homelab.interface}.allowedTCPPorts =

     

       45
       -
           [ 80 ];

     

       46
        
       

     

       47
        
         services = {

     

       48
        
           redis.package = pkgs.valkey;

     
···

       70
        
             maxUploadSize = "1G";

     

       71
        
             notify_push = {

     

       72
        
               enable = true;

     

       73
       -
               nextcloudUrl = "http://${config.nInfo.${config.networking.hostName}.netbird-ip}";

     

       74
        
             };

     

       75
        
             phpOptions = {

     

       76
        
               "opcache.interned_strings_buffer" = "16";

     
···

       99
        
               };

     

       100
        
               "simpleSignUpLink.shown" = false;

     

       101
        
               trusted_proxies = [

     

       102
       -
                 config.nInfo.${config.networking.hostName}.netbird-ip

     

       103
       -
                 config.nInfo.dandelion.netbird-ip

     

       104
        
               ];

     

       105
        
             };

     

       106
        
           };

···

       41
        
         };

     

       42
        
       

     

       43
        
         # This is the port that nginx listens on by default

     

       44
       +
         networking.firewall.interfaces.${config.services.netbird.clients.homelab.interface}.allowedTCPPorts = [ 80 ];

     

       0
        
       
     

       45
        
       

     

       46
        
         services = {

     

       47
        
           redis.package = pkgs.valkey;

     
···

       69
        
             maxUploadSize = "1G";

     

       70
        
             notify_push = {

     

       71
        
               enable = true;

     

       72
       +
               nextcloudUrl = "http://${config.garden.info.network.${config.networking.hostName}.netbird-ip}";

     

       73
        
             };

     

       74
        
             phpOptions = {

     

       75
        
               "opcache.interned_strings_buffer" = "16";

     
···

       98
        
               };

     

       99
        
               "simpleSignUpLink.shown" = false;

     

       100
        
               trusted_proxies = [

     

       101
       +
                 config.garden.info.network.${config.networking.hostName}.netbird-ip

     

       102
       +
                 config.garden.info.network.dandelion.netbird-ip

     

       103
        
               ];

     

       104
        
             };

     

       105
        
           };

+2 -2

modules/services/openssh.nix

···

       13
        
         };

     

       14
        
       

     

       15
        
         services.openssh.settings.AllowUsers = [

     

       16
       -
           "mou@${config.nInfo.lutea.netbird-ip}"

     

       17
       -
           (lib.mkIf (config.networking.hostName == "lily") "mou@${config.nInfo.lutea.ipv4-local}")

     

       18
        
         ];

     

       19
        
       }

···

       13
        
         };

     

       14
        
       

     

       15
        
         services.openssh.settings.AllowUsers = [

     

       16
       +
           "mou@${config.garden.info.network.lutea.netbird-ip}"

     

       17
       +
           (lib.mkIf (config.networking.hostName == "lily") "mou@${config.garden.info.network.lutea.ipv4-local}")

     

       18
        
         ];

     

       19
        
       }

+1 -2

modules/services/pds.nix

···

       33
        
             '';

     

       34
        
         };

     

       35
        
       

     

       36
       -
         networking.firewall.interfaces.${config.services.netbird.clients.homelab.interface}.allowedTCPPorts =

     

       37
       -
           [ 3000 ];

     

       38
        
       

     

       39
        
         services.pds = {

     

       40
        
           enable = true;

···

       33
        
             '';

     

       34
        
         };

     

       35
        
       

     

       36
       +
         networking.firewall.interfaces.${config.services.netbird.clients.homelab.interface}.allowedTCPPorts = [ 3000 ];

     

       0
        
       
     

       37
        
       

     

       38
        
         services.pds = {

     

       39
        
           enable = true;

+2 -3

modules/services/tangled.nix

···

       22
        
         };

     

       23
        
       

     

       24
        
         services.openssh.settings.AllowUsers = [

     

       25
       -
           "${config.services.tangled-knotserver.gitUser}@${config.nInfo.dandelion.netbird-ip}"

     

       26
        
         ];

     

       27
        
       

     

       28
       -
         networking.firewall.interfaces.${config.services.netbird.clients.homelab.interface}.allowedTCPPorts =

     

       29
       -
           [ 5555 ];

     

       30
        
       

     

       31
        
         services.tangled-knotserver = {

     

       32
        
           enable = true;

···

       22
        
         };

     

       23
        
       

     

       24
        
         services.openssh.settings.AllowUsers = [

     

       25
       +
           "${config.services.tangled-knotserver.gitUser}@${config.garden.info.network.dandelion.netbird-ip}"

     

       26
        
         ];

     

       27
        
       

     

       28
       +
         networking.firewall.interfaces.${config.services.netbird.clients.homelab.interface}.allowedTCPPorts = [ 5555 ];

     

       0
        
       
     

       29
        
       

     

       30
        
         services.tangled-knotserver = {

     

       31
        
           enable = true;

+2 -2

modules/sss-mount.nix

···

       4
        
         pkgs,

     

       5
        
         ...

     

       6
        
       }:

     

       7
       -
       lib.mkIf (config.mInfo.sss-mount == true) {

     

       8
        
         environment.systemPackages = [ pkgs.rclone ];

     

       9
        
       

     

       10
        
         fileSystems."/sss" = {

     
···

       18
        
             "config=${pkgs.writeText "rclone-mnt.conf" ''

     

       19
        
               [sss]

     

       20
        
               type = sftp

     

       21
       -
               host = ${config.nInfo.lily.netbird-ip}

     

       22
        
               port = 2222

     

       23
        
               user = seedling

     

       24
        
               key_file = /data/seedling/id_ed25519

···

       4
        
         pkgs,

     

       5
        
         ...

     

       6
        
       }:

     

       7
       +
       lib.mkIf (config.garden.info.host.sss-mount == true) {

     

       8
        
         environment.systemPackages = [ pkgs.rclone ];

     

       9
        
       

     

       10
        
         fileSystems."/sss" = {

     
···

       18
        
             "config=${pkgs.writeText "rclone-mnt.conf" ''

     

       19
        
               [sss]

     

       20
        
               type = sftp

     

       21
       +
               host = ${config.garden.info.network.lily.netbird-ip}

     

       22
        
               port = 2222

     

       23
        
               user = seedling

     

       24
        
               key_file = /data/seedling/id_ed25519

+2 -3

modules/unfree.nix

···

       1
        
       { config, lib, ... }:

     

       2
        
       {

     

       3
       -
         options.unfree.allowed = lib.mkOption {

     

       4
        
           type = with lib.types; listOf str;

     

       5
        
           default = [ ];

     

       6
        
           description = "A list of unfree packages that are allowed to be installed";

     

       7
        
         };

     

       8
        
       

     

       9
       -
         config.nixpkgs.config.allowUnfreePredicate =

     

       10
       -
           pkg: builtins.elem (lib.getName pkg) config.unfree.allowed;

     

       11
        
       }

···

       1
        
       { config, lib, ... }:

     

       2
        
       {

     

       3
       +
         options.garden.unfree = lib.mkOption {

     

       4
        
           type = with lib.types; listOf str;

     

       5
        
           default = [ ];

     

       6
        
           description = "A list of unfree packages that are allowed to be installed";

     

       7
        
         };

     

       8
        
       

     

       9
       +
         config.nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) config.garden.unfree;

     

       0
        
       
     

       10
        
       }