+2

.tsk/archive/tsk-1.tsk

··· 1 1 + Remove immich overlay 2 2 +

+2

.tsk/archive/tsk-2.tsk

··· 1 1 + Remove plex overlay 2 2 +

+2

.tsk/archive/tsk-3.tsk

··· 1 1 + finish migration to flake 2 2 +

+1

.tsk/index

··· 1 1 + tsk-1 Remove immich overlay 1755227223

+1

.tsk/next

··· 1 1 + 4

+1

.tsk/tasks/tsk-1.tsk

··· 1 1 + ../archive/tsk-1.tsk

+6 -1

boot.nix

··· 1 1 - { ... }: { 1 1 + { ... }: 2 2 + { 2 3 # Use the systemd-boot EFI boot loader. 3 4 boot.loader.systemd-boot.enable = true; 4 5 boot.loader.efi.canTouchEfiVariables = true; 6 6 + 7 7 + boot.supportedFilesystems = [ "zfs" ]; 8 8 + boot.zfs.forceImportRoot = false; 9 9 + boot.zfs.extraPools = [ "shokuhou" "mentalout" ]; 5 10 }

-31

common.nix

··· 1 1 - { ... }: 2 2 - { 3 3 - # Set your time zone. 4 4 - time.timeZone = "America/Chicago"; 5 5 - 6 6 - # Select internationalisation properties. 7 7 - i18n.defaultLocale = "en_US.UTF-8"; 8 8 - # console = { 9 9 - # font = "Lat2-Terminus16"; 10 10 - # keyMap = "us"; 11 11 - # useXkbConfig = true; # use xkb.options in tty. 12 12 - # }; 13 13 - 14 14 - # Automatic doc cache generation 15 15 - documentation.man.generateCaches = true; 16 16 - 17 17 - # Automatic system upgrades 18 18 - system.autoUpgrade = { 19 19 - enable = true; 20 20 - dates = "09:00"; 21 21 - randomizedDelaySec = "45min"; 22 22 - }; 23 23 - 24 24 - # Automatic Garbage Collection 25 25 - nix.gc.automatic = true; 26 26 - nix.gc.options = "--delete-older-than 8d"; 27 27 - nix.settings.trusted-users = [ "@wheel" ]; 28 28 - 29 29 - # I don't care that much about free vs unfree 30 30 - nixpkgs.config.allowUnfree = true; 31 31 - }

+67

configuration.nix

··· 1 1 + # Edit this configuration file to define what should be installed on 2 2 + ## your system. Help is available in the configuration.nix(5) man page, on 3 3 + # https://search.nixos.org/options and in the NixOS manual (`nixos-help`). 4 4 + 5 5 + { ... }: 6 6 + 7 7 + { 8 8 + imports = 9 9 + [ 10 10 + # Include the results of the hardware scan. 11 11 + ./hardware-configuration.nix 12 12 + ./boot.nix 13 13 + ./networking.nix 14 14 + #./gui.nix 15 15 + ./users.nix 16 16 + ./packages.nix 17 17 + ./services.nix 18 18 + ]; 19 19 + # Set your time zone. 20 20 + time.timeZone = "America/Chicago"; 21 21 + 22 22 + # Select internationalisation properties. 23 23 + i18n.defaultLocale = "en_US.UTF-8"; 24 24 + # console = { 25 25 + # font = "Lat2-Terminus16"; 26 26 + # keyMap = "us"; 27 27 + # useXkbConfig = true; # use xkb.options in tty. 28 28 + # }; 29 29 + 30 30 + # Copy the NixOS configuration file and link it from the resulting system 31 31 + # (/run/current-system/configuration.nix). This is useful in case you 32 32 + # accidentally delete configuration.nix. 33 33 + #system.copySystemConfiguration = true; 34 34 + 35 35 + # Automatic doc cache generation 36 36 + documentation.man.generateCaches = true; 37 37 + 38 38 + # Automatic system upgrades 39 39 + system.autoUpgrade = { 40 40 + enable = true; 41 41 + dates = "09:00"; 42 42 + randomizedDelaySec = "45min"; 43 43 + }; 44 44 + 45 45 + # Automatic Garbage Collection 46 46 + nix.gc.automatic = true; 47 47 + nix.gc.options = "--delete-older-than 8d"; 48 48 + 49 49 + # This option defines the first version of NixOS you have installed on this particular machine, 50 50 + # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions. 51 51 + # 52 52 + # Most users should NEVER change this value after the initial install, for any reason, 53 53 + # even if you've upgraded your system to a new NixOS release. 54 54 + # 55 55 + # This value does NOT affect the Nixpkgs version your packages and OS are pulled from, 56 56 + # so changing it will NOT upgrade your system. 57 57 + # 58 58 + # This value being lower than the current NixOS release does NOT mean your system is 59 59 + # out of date, out of support, or vulnerable. 60 60 + # 61 61 + # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration, 62 62 + # and migrated your data accordingly. 63 63 + # 64 64 + # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion . 65 65 + system.stateVersion = "23.11"; # Did you read the comment? 66 66 + 67 67 + }

+1

coredns/localhost.hosts

··· 1 1 + 127.0.0.1 *.localhost

+9

coredns/ngp.computer.hosts

··· 1 1 + 192.168.1.3 img.ngp.computer 2 2 + 192.168.1.3 photos.ngp.computer 3 3 + 192.168.1.3 misaki.ngp.computer 4 4 + 192.168.1.3 files.ngp.computer 5 5 + 6 6 + fe80::9ab7:85ff:fe1e:dfe8 img.ngp.computer 7 7 + fe80::9ab7:85ff:fe1e:dfe8 photos.ngp.computer 8 8 + fe80::9ab7:85ff:fe1e:dfe8 misaki.ngp.computer 9 9 + fe80::9ab7:85ff:fe1e:dfe8 files.ngp.computer

+17

coredns/packetlost.dev.hosts

··· 1 1 + # Services 2 2 + 192.168.1.3 git.packetlost.dev 3 3 + 192.168.1.3 plex.packetlost.dev 4 4 + 192.168.1.3 jellyfin.packetlost.dev 5 5 + 192.168.1.3 nats.packetlost.dev 6 6 + 7 7 + # LAN Hosts 8 8 + 192.168.1.3 misaki.packetlost.dev misaki 9 9 + 192.168.1.3 cache.packetlost.dev cache 10 10 + 192.168.1.5 komoe.packetlost.dev komoe 11 11 + 192.168.1.6 rainbow.packetlost.dev rainbow 12 12 + 192.168.1.10 ichika.packetlost.dev ichika 13 13 + 192.168.1.11 futaba.packetlost.dev futaba 14 14 + 192.168.1.12 mitsumi.packetlost.dev mitsumi 15 15 + 192.168.1.13 orangepi5.packetlost.dev orangepi5 16 16 + 192.168.1.30 touma.packetlost.dev touma 17 17 + 192.168.1.33 kamijou.packetlost.dev kamijou

-254

default-home.nix

··· 1 1 - { 2 2 - pkgs, 3 3 - unstable, 4 4 - inputs, 5 5 - config, 6 6 - ... 7 7 - }: 8 8 - { 9 9 - imports = [ 10 10 - inputs.agenix.homeManagerModules.default 11 11 - ]; 12 12 - home.username = "noah"; 13 13 - home.homeDirectory = "/home/noah"; 14 14 - 15 15 - age.identityPaths = [ 16 16 - "${config.home.homeDirectory}/.ssh/id_rsa" 17 17 - "${config.home.homeDirectory}/.ssh/id_ed25519" 18 18 - "${config.home.homeDirectory}/.ssh/id_ed25519_age" 19 19 - ]; 20 20 - 21 21 - home.packages = with pkgs; [ 22 22 - inputs.agenix.packages."${system}".agenix 23 23 - # main tool 24 24 - direnv 25 25 - tree 26 26 - btop 27 27 - htop 28 28 - rsync 29 29 - unzip 30 30 - fd 31 31 - ripgrep 32 32 - catgirl 33 33 - netcat 34 34 - stunnel 35 35 - fzf 36 36 - iperf3 37 37 - entr 38 38 - lf 39 39 - #devenv # broken 40 40 - plan9port 41 41 - pwgen 42 42 - metastore 43 43 - isync 44 44 - pass 45 45 - tmux 46 46 - age 47 47 - 48 48 - # Dev tools 49 49 - gcc 50 50 - go 51 51 - unstable.gopls 52 52 - gnumake 53 53 - babashka 54 54 - # Babashka common aliases 55 55 - neil 56 56 - ccls 57 57 - clojure 58 58 - unstable.clj-kondo 59 59 - unstable.clojure-lsp 60 60 - unstable.janet 61 61 - unstable.jpm 62 62 - graalvmPackages.graalvm-ce 63 63 - cmake 64 64 - universal-ctags 65 65 - kotlin 66 66 - nodejs 67 67 - node2nix 68 68 - opam 69 69 - rustup 70 70 - zig 71 71 - scala_3 72 72 - scalafmt 73 73 - # scala LSP 74 74 - unstable.metals 75 75 - # Scala / Java build tool 76 76 - sbt 77 77 - luarocks 78 78 - luajit 79 79 - lua-language-server 80 80 - leiningen 81 81 - libressl 82 82 - erlang 83 83 - elixir 84 84 - ghc 85 85 - nil 86 86 - python3 87 87 - typescript 88 88 - #vscode-langservers-extracted 89 89 - scdoc 90 90 - #dockerfile-language-server-nodejs 91 91 - #yaml-language-server 92 92 - mkcert 93 93 - natscli 94 94 - poetry 95 95 - sqlite 96 96 - pandoc 97 97 - unstable.harec 98 98 - unstable.hare 99 99 - unstable.haredo 100 100 - unstable.haredoc 101 101 - unstable.gleam 102 102 - unstable.rebar3 103 103 - unstable.bun 104 104 - unstable.gh 105 105 - unstable.kraft 106 106 - #unstable.claude-code 107 107 - 108 108 - # Python dev tools 109 109 - pyright 110 110 - python313Packages.python-lsp-server 111 111 - python313Packages.python-lsp-ruff 112 112 - 113 113 - # Certificate Management 114 114 - minica 115 115 - mkcert 116 116 - step-cli 117 117 - 118 118 - ]; 119 119 - 120 120 - nix = { 121 121 - #package = pkgs.nix; 122 122 - settings = { 123 123 - experimental-features = [ 124 124 - "nix-command" 125 125 - "flakes" 126 126 - ]; 127 127 - extra-trusted-users = [ 128 128 - "noah" 129 129 - ]; 130 130 - extra-substituters = [ 131 131 - "https://cache.ngp.computer" 132 132 - ]; 133 133 - extra-trusted-public-keys = [ 134 134 - "misaki.packetlost.dev:y5Z/utaVBozpL0UAbUQDWLjpm2sVMOoKzyG76n/167A=" 135 135 - ]; 136 136 - }; 137 137 - }; 138 138 - 139 139 - programs.fish = { 140 140 - enable = true; 141 141 - #package = unstable.fish; 142 142 - }; 143 143 - programs.neovim = { 144 144 - #package = unstable.neovim-unwrapped; 145 145 - enable = true; 146 146 - defaultEditor = true; 147 147 - withNodeJs = true; 148 148 - withPython3 = true; 149 149 - extraPackages = with pkgs; [ 150 150 - unstable.fzf 151 151 - unstable.ripgrep 152 152 - luarocks 153 153 - unstable.tree-sitter 154 154 - ]; 155 155 - }; 156 156 - programs.home-manager.enable = true; 157 157 - programs.helix.enable = true; 158 158 - programs.jujutsu = { 159 159 - enable = true; 160 160 - }; 161 161 - programs.git = { 162 162 - enable = true; 163 163 - lfs.enable = true; 164 164 - settings.user.name = "Noah Pederson"; 165 165 - settings.user.email = "noah@packetlost.dev"; 166 166 - extraConfig = { 167 167 - sendemail = { 168 168 - smtpserver = "smtp.migadu.com"; 169 169 - smtpuser = "noah@packetlost.dev"; 170 170 - smptencryption = "tls"; 171 171 - smtpserverport = 587; 172 172 - }; 173 173 - init = { 174 174 - defaultBranch = "master"; 175 175 - }; 176 176 - pull = { 177 177 - rebase = true; 178 178 - }; 179 179 - credential = { 180 180 - helper = "cache"; 181 181 - }; 182 182 - rerere.enable = true; 183 183 - }; 184 184 - ignores = [ 185 185 - ".direnv/" 186 186 - ".envrc" 187 187 - "flake.nix" 188 188 - "shell.nix" 189 189 - ".env/" 190 190 - ".clj-kondo/" 191 191 - ]; 192 192 - }; 193 193 - programs.aerc = { 194 194 - enable = true; 195 195 - package = unstable.aerc; 196 196 - }; 197 197 - programs.ssh = { 198 198 - enable = true; 199 199 - matchBlocks."*".addKeysToAgent = "yes"; 200 200 - }; 201 201 - 202 202 - services.ssh-agent.enable = true; 203 203 - services.mako.enable = false; 204 204 - 205 205 - programs.ssh.extraConfig = builtins.readFile ./ssh/extra; 206 206 - services.gpg-agent = { 207 207 - enable = true; 208 208 - defaultCacheTtl = 1800; 209 209 - }; 210 210 - 211 211 - programs.direnv = { 212 212 - enable = true; 213 213 - nix-direnv.enable = true; 214 214 - }; 215 215 - 216 216 - xdg.enable = true; 217 217 - 218 218 - # Independent config files. 219 219 - xdg.configFile.nvim = { 220 220 - source = ./nvim; 221 221 - recursive = true; 222 222 - }; 223 223 - 224 224 - xdg.configFile.vis = { 225 225 - source = ./vis; 226 226 - recursive = true; 227 227 - }; 228 228 - 229 229 - xdg.configFile.fish = { 230 230 - source = ./fish; 231 231 - recursive = true; 232 232 - force = true; 233 233 - }; 234 234 - 235 235 - xdg.configFile.aerc = { 236 236 - source = ./aerc; 237 237 - recursive = true; 238 238 - }; 239 239 - 240 240 - home.file.".local/bin" = { 241 241 - source = ./scripts; 242 242 - recursive = true; 243 243 - }; 244 244 - age.secrets.catgirl-libera = { 245 245 - file = ./secrets/catgirl-libera.age; 246 246 - path = "${config.xdg.configHome}/catgirl/libera"; 247 247 - symlink = true; 248 248 - }; 249 249 - 250 250 - manual.manpages.enable = true; 251 251 - 252 252 - home.stateVersion = "23.11"; 253 253 - 254 254 - }

+16

default.nix

··· 1 1 + let 2 2 + nix-pre-commit-hooks = import (builtins.fetchTarball "https://github.com/cachix/pre-commit-hooks.nix/tarball/master"); 3 3 + in 4 4 + { 5 5 + # Configured with the module options defined in `modules/pre-commit.nix`: 6 6 + pre-commit-check = nix-pre-commit-hooks.run { 7 7 + src = ./.; 8 8 + # If your hooks are intrusive, avoid running on each commit with a default_states like this: 9 9 + # default_stages = ["manual" "push"]; 10 10 + hooks = { 11 11 + nixpkgs-fmt.enable = true; 12 12 + nil.enable = true; 13 13 + luacheck.enable = true; 14 14 + }; 15 15 + }; 16 16 + }

+5 -17

fish/config.fish

··· 17 17 abbr gd "git diff" 18 18 abbr ga "git add" 19 19 abbr glog "git log –graph –decorate –oneline –all" 20 20 - if type -q "emanote" 21 21 - abbr n "cd ~/repos/notes" 22 22 - abbr ne "cd ~/repos/notes; nvim" 23 23 - end 24 24 - 25 25 - abbr srhtclone "git clone git@git.sr.ht:~chiefnoah/" 26 26 - abbr ghclone "git clone git@github.com:chiefnoah/" 27 20 28 21 if test -d "~/repos" 29 22 alias r "cd ~/repos" 30 23 end 31 24 25 25 + # We start the ssh-agent in noah-home.nix, so we'll add the socket to the environment 32 26 set -Ux SSH_AUTH_SOCK /var/run/user/(id -u)/ssh-agent 33 33 - # PATH stuff 34 27 35 35 - if test -z "(pgrep ssh-agent)" 36 36 - eval (ssh-agent -c) > /dev/null # no output 37 37 - set -Ux SSH_AUTH_SOCK $SSH_AUTH_SOCK 38 38 - set -Ux SSH_AGENT_PID $SSH_AGENT_PID 39 39 - set -Ux SSH_AUTH_SOCK $SSH_AUTH_SOCK 40 40 - end 28 28 + # PATH stuff 41 29 42 42 - # Run ssh-agent 43 30 if type -q "direnv" 44 31 direnv hook fish | source 45 32 set -g direnv_fish_mode eval_on_arrow ··· 53 40 # NATS config 54 41 set -Ux NATS_URL tls://misaki.local 55 42 set -Ux NATS_CA /srv/nats/minica.pem 56 56 - set -Ux NATS_CERT /srv/nats/touma-nixos@packetlost.dev/cert.pem 57 57 - set -Ux NATS_KEY /srv/nats/touma-nixos@packetlost.dev/key.pem 43 43 + set -Ux NATS_CERT /srv/nats/misaki.packetlost.dev/cert.pem 44 44 + set -Ux NATS_KEY /srv/nats/misaki.packetlost.dev/key.pem 45 45 + 58 46 59 47 # Keybindings 60 48 fish_default_key_bindings

+1 -1

fish/functions/lfcd.fish

··· 13 13 14 14 function lfcd 15 15 set tmp (mktemp) 16 16 - lf -last-dir-path=$tmp $argv 16 16 + yazi --cwd-file=$tmp $argv 17 17 if test -f "$tmp" 18 18 set dir (cat $tmp) 19 19 rm -f $tmp

+78 -89

flake.lock

··· 4 4 "inputs": { 5 5 "darwin": "darwin", 6 6 "home-manager": "home-manager", 7 7 - "nixpkgs": [ 8 8 - "nixpkgs" 9 9 - ], 7 7 + "nixpkgs": "nixpkgs", 10 8 "systems": "systems" 11 9 }, 12 10 "locked": { ··· 48 46 "determinate-nixd-aarch64-darwin": { 49 47 "flake": false, 50 48 "locked": { 51 51 - "narHash": "sha256-zK2dgNHh/p92rk5jN+Y1LOMn0HEdTsS+7XXwb2g52oM=", 49 49 + "narHash": "sha256-uWDS94cAYprGj+AwuT42nuuDDicRLj1S0JwalZGeBRU=", 52 50 "type": "file", 53 53 - "url": "https://install.determinate.systems/determinate-nixd/tag/v3.15.2/macOS" 51 51 + "url": "https://install.determinate.systems/determinate-nixd/tag/v3.15.1/macOS" 54 52 }, 55 53 "original": { 56 54 "type": "file", 57 57 - "url": "https://install.determinate.systems/determinate-nixd/tag/v3.15.2/macOS" 55 55 + "url": "https://install.determinate.systems/determinate-nixd/tag/v3.15.1/macOS" 58 56 } 59 57 }, 60 58 "determinate-nixd-aarch64-linux": { 61 59 "flake": false, 62 60 "locked": { 63 63 - "narHash": "sha256-ckvZP0zFcbzLXWYOJUqYXkKBt0b2IZcQEr7YjEVtwOI=", 61 61 + "narHash": "sha256-uHBcZCh2/Bj5/88TDihupA336tSQDk7s5lVP66IDAX0=", 64 62 "type": "file", 65 65 - "url": "https://install.determinate.systems/determinate-nixd/tag/v3.15.2/aarch64-linux" 63 63 + "url": "https://install.determinate.systems/determinate-nixd/tag/v3.15.1/aarch64-linux" 66 64 }, 67 65 "original": { 68 66 "type": "file", 69 69 - "url": "https://install.determinate.systems/determinate-nixd/tag/v3.15.2/aarch64-linux" 67 67 + "url": "https://install.determinate.systems/determinate-nixd/tag/v3.15.1/aarch64-linux" 70 68 } 71 69 }, 72 70 "determinate-nixd-x86_64-linux": { 73 71 "flake": false, 74 72 "locked": { 75 75 - "narHash": "sha256-8dLtm8FJrpyBmrNpspJj30/6I5HGEfjjXuFqURcZ8pk=", 73 73 + "narHash": "sha256-y+l05H6GNv/1WcrMztDYem8VBWqjc9gNg4WjeQ1PQxo=", 76 74 "type": "file", 77 77 - "url": "https://install.determinate.systems/determinate-nixd/tag/v3.15.2/x86_64-linux" 75 75 + "url": "https://install.determinate.systems/determinate-nixd/tag/v3.15.1/x86_64-linux" 78 76 }, 79 77 "original": { 80 78 "type": "file", 81 81 - "url": "https://install.determinate.systems/determinate-nixd/tag/v3.15.2/x86_64-linux" 79 79 + "url": "https://install.determinate.systems/determinate-nixd/tag/v3.15.1/x86_64-linux" 82 80 } 83 81 }, 84 82 "determinite": { ··· 92 90 ] 93 91 }, 94 92 "locked": { 95 95 - "lastModified": 1768964099, 96 96 - "narHash": "sha256-sV1OJYyktJRl7I3HxeBvWTWXjqm2uCTS3gS1p+DLn7c=", 97 97 - "rev": "a5469e9aa3870941320cb92d899b66e141c5a3cd", 98 98 - "revCount": 394, 93 93 + "lastModified": 1766549083, 94 94 + "narHash": "sha256-G1Hljg7vIBt8n9cxO382YAZWtZU/mYfQcg3icdNG8RQ=", 95 95 + "rev": "ba8999fac986e70f52b4cba15047be7bbb7b6346", 96 96 + "revCount": 318, 99 97 "type": "tarball", 100 100 - "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/determinate/3.15.2/019bde7d-0725-73ef-9705-498c50ef6e00/source.tar.gz" 98 98 + "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/determinate/3.15.1/019b4e8a-dc22-75db-aef5-a447efbb1a13/source.tar.gz" 101 99 }, 102 100 "original": { 103 101 "type": "tarball", ··· 123 121 "flake-compat_2": { 124 122 "flake": false, 125 123 "locked": { 126 126 - "lastModified": 1767039857, 127 127 - "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=", 124 124 + "lastModified": 1761588595, 125 125 + "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=", 128 126 "owner": "edolstra", 129 127 "repo": "flake-compat", 130 130 - "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab", 128 128 + "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5", 131 129 "type": "github" 132 130 }, 133 131 "original": { ··· 136 134 "type": "github" 137 135 } 138 136 }, 139 139 - "flake-compat_3": { 140 140 - "flake": false, 141 141 - "locked": { 142 142 - "lastModified": 1767039857, 143 143 - "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=", 144 144 - "owner": "NixOS", 145 145 - "repo": "flake-compat", 146 146 - "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab", 147 147 - "type": "github" 148 148 - }, 149 149 - "original": { 150 150 - "owner": "NixOS", 151 151 - "repo": "flake-compat", 152 152 - "type": "github" 153 153 - } 154 154 - }, 155 137 "flake-parts": { 156 138 "inputs": { 157 139 "nixpkgs-lib": [ ··· 248 230 ] 249 231 }, 250 232 "locked": { 251 251 - "lastModified": 1768949235, 252 252 - "narHash": "sha256-TtjKgXyg1lMfh374w5uxutd6Vx2P/hU81aEhTxrO2cg=", 233 233 + "lastModified": 1767024057, 234 234 + "narHash": "sha256-B1aycRjMRvb6QOGbnqDhiDzZwMebj5jxZ5qyJzaKvpI=", 253 235 "owner": "nix-community", 254 236 "repo": "home-manager", 255 255 - "rev": "75ed713570ca17427119e7e204ab3590cc3bf2a5", 237 237 + "rev": "34578a2fdfce4257ce5f5baf6e7efbd4e4e252b1", 256 238 "type": "github" 257 239 }, 258 240 "original": { ··· 266 248 "inputs": { 267 249 "flake-parts": "flake-parts", 268 250 "git-hooks-nix": "git-hooks-nix", 269 269 - "nixpkgs": "nixpkgs", 251 251 + "nixpkgs": "nixpkgs_2", 270 252 "nixpkgs-23-11": "nixpkgs-23-11", 271 253 "nixpkgs-regression": "nixpkgs-regression" 272 254 }, 273 255 "locked": { 274 274 - "lastModified": 1768960381, 275 275 - "narHash": "sha256-32oMe1y+kwvIJNiJsIvozTuSmDxcwST06i+0ak+L4AU=", 276 276 - "rev": "45ce621408cb8c9a724193d5fe858eb839662db8", 277 277 - "revCount": 24453, 256 256 + "lastModified": 1766546676, 257 257 + "narHash": "sha256-GsC52VFF9Gi2pgP/haQyPdQoF5Qe2myk1tsPcuJZI28=", 258 258 + "rev": "51dacdd248e8071cd0243a8245c8c42ac1f33307", 259 259 + "revCount": 24299, 278 260 "type": "tarball", 279 279 - "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nix-src/3.15.2/019bde75-b4ee-74b2-a812-28dc2ee83d58/source.tar.gz" 261 261 + "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nix-src/3.15.1/019b4e84-d036-75db-b6c6-6bc2e2035c53/source.tar.gz" 280 262 }, 281 263 "original": { 282 264 "type": "tarball", 283 265 "url": "https://flakehub.com/f/DeterminateSystems/nix-src/%2A" 284 266 } 285 267 }, 286 286 - "nixos-wsl": { 287 287 - "inputs": { 288 288 - "flake-compat": "flake-compat_2", 289 289 - "nixpkgs": [ 290 290 - "nixpkgs" 291 291 - ] 292 292 - }, 268 268 + "nixpkgs": { 293 269 "locked": { 294 294 - "lastModified": 1769217863, 295 295 - "narHash": "sha256-RY9kJDXD6+2Td/59LkZ0PFSereCXHdBX9wIkbYjRKCY=", 296 296 - "owner": "nix-community", 297 297 - "repo": "NixOS-WSL", 298 298 - "rev": "38a5250e57f583662eac3b944830e4b9e169e965", 270 270 + "lastModified": 1754028485, 271 271 + "narHash": "sha256-IiiXB3BDTi6UqzAZcf2S797hWEPCRZOwyNThJIYhUfk=", 272 272 + "owner": "NixOS", 273 273 + "repo": "nixpkgs", 274 274 + "rev": "59e69648d345d6e8fef86158c555730fa12af9de", 299 275 "type": "github" 300 276 }, 301 277 "original": { 302 302 - "owner": "nix-community", 303 303 - "ref": "main", 304 304 - "repo": "NixOS-WSL", 278 278 + "owner": "NixOS", 279 279 + "ref": "nixos-25.05", 280 280 + "repo": "nixpkgs", 305 281 "type": "github" 306 282 } 307 283 }, 308 308 - "nixpkgs": { 309 309 - "locked": { 310 310 - "lastModified": 1761597516, 311 311 - "narHash": "sha256-wxX7u6D2rpkJLWkZ2E932SIvDJW8+ON/0Yy8+a5vsDU=", 312 312 - "rev": "daf6dc47aa4b44791372d6139ab7b25269184d55", 313 313 - "revCount": 811874, 314 314 - "type": "tarball", 315 315 - "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.2505.811874%2Brev-daf6dc47aa4b44791372d6139ab7b25269184d55/019a3494-3498-707e-9086-1fb81badc7fe/source.tar.gz" 316 316 - }, 317 317 - "original": { 318 318 - "type": "tarball", 319 319 - "url": "https://flakehub.com/f/NixOS/nixpkgs/0.2505" 320 320 - } 321 321 - }, 322 284 "nixpkgs-23-11": { 323 285 "locked": { 324 286 "lastModified": 1717159533, ··· 353 315 }, 354 316 "nixpkgs-unstable": { 355 317 "locked": { 356 356 - "lastModified": 1769018530, 357 357 - "narHash": "sha256-MJ27Cy2NtBEV5tsK+YraYr2g851f3Fl1LpNHDzDX15c=", 318 318 + "lastModified": 1766902085, 319 319 + "narHash": "sha256-coBu0ONtFzlwwVBzmjacUQwj3G+lybcZ1oeNSQkgC0M=", 358 320 "owner": "nixos", 359 321 "repo": "nixpkgs", 360 360 - "rev": "88d3861acdd3d2f0e361767018218e51810df8a1", 322 322 + "rev": "c0b0e0fddf73fd517c3471e546c0df87a42d53f4", 361 323 "type": "github" 362 324 }, 363 325 "original": { ··· 369 331 }, 370 332 "nixpkgs_2": { 371 333 "locked": { 372 372 - "lastModified": 1769089682, 373 373 - "narHash": "sha256-9yA/LIuAVQq0lXelrZPjLuLVuZdm03p8tfmHhnDIkms=", 334 334 + "lastModified": 1761597516, 335 335 + "narHash": "sha256-wxX7u6D2rpkJLWkZ2E932SIvDJW8+ON/0Yy8+a5vsDU=", 336 336 + "rev": "daf6dc47aa4b44791372d6139ab7b25269184d55", 337 337 + "revCount": 811874, 338 338 + "type": "tarball", 339 339 + "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.2505.811874%2Brev-daf6dc47aa4b44791372d6139ab7b25269184d55/019a3494-3498-707e-9086-1fb81badc7fe/source.tar.gz" 340 340 + }, 341 341 + "original": { 342 342 + "type": "tarball", 343 343 + "url": "https://flakehub.com/f/NixOS/nixpkgs/0.2505" 344 344 + } 345 345 + }, 346 346 + "nixpkgs_3": { 347 347 + "locked": { 348 348 + "lastModified": 1767047869, 349 349 + "narHash": "sha256-tzYsEzXEVa7op1LTnrLSiPGrcCY6948iD0EcNLWcmzo=", 374 350 "owner": "nixos", 375 351 "repo": "nixpkgs", 376 376 - "rev": "078d69f03934859a181e81ba987c2bb033eebfc5", 352 352 + "rev": "89dbf01df72eb5ebe3b24a86334b12c27d68016a", 377 353 "type": "github" 378 354 }, 379 355 "original": { ··· 383 359 "type": "github" 384 360 } 385 361 }, 362 362 + "nixpkgs_4": { 363 363 + "locked": { 364 364 + "lastModified": 1764947035, 365 365 + "narHash": "sha256-EYHSjVM4Ox4lvCXUMiKKs2vETUSL5mx+J2FfutM7T9w=", 366 366 + "owner": "NixOS", 367 367 + "repo": "nixpkgs", 368 368 + "rev": "a672be65651c80d3f592a89b3945466584a22069", 369 369 + "type": "github" 370 370 + }, 371 371 + "original": { 372 372 + "owner": "NixOS", 373 373 + "ref": "nixpkgs-unstable", 374 374 + "repo": "nixpkgs", 375 375 + "type": "github" 376 376 + } 377 377 + }, 386 378 "pre-commit-hooks": { 387 379 "inputs": { 388 388 - "flake-compat": "flake-compat_3", 380 380 + "flake-compat": "flake-compat_2", 389 381 "gitignore": "gitignore", 390 390 - "nixpkgs": [ 391 391 - "nixpkgs" 392 392 - ] 382 382 + "nixpkgs": "nixpkgs_4" 393 383 }, 394 384 "locked": { 395 395 - "lastModified": 1769069492, 396 396 - "narHash": "sha256-Efs3VUPelRduf3PpfPP2ovEB4CXT7vHf8W+xc49RL/U=", 385 385 + "lastModified": 1765911976, 386 386 + "narHash": "sha256-t3T/xm8zstHRLx+pIHxVpQTiySbKqcQbK+r+01XVKc0=", 397 387 "owner": "cachix", 398 388 "repo": "git-hooks.nix", 399 399 - "rev": "a1ef738813b15cf8ec759bdff5761b027e3e1d23", 389 389 + "rev": "b68b780b69702a090c8bb1b973bab13756cc7a27", 400 390 "type": "github" 401 391 }, 402 392 "original": { ··· 410 400 "agenix": "agenix", 411 401 "determinite": "determinite", 412 402 "home-manager": "home-manager_2", 413 413 - "nixos-wsl": "nixos-wsl", 414 414 - "nixpkgs": "nixpkgs_2", 403 403 + "nixpkgs": "nixpkgs_3", 415 404 "nixpkgs-unstable": "nixpkgs-unstable", 416 405 "pre-commit-hooks": "pre-commit-hooks" 417 406 }

+57 -161

flake.nix

··· 5 5 # Specify the source of Home Manager and Nixpkgs. 6 6 nixpkgs.url = "github:nixos/nixpkgs/nixos-25.11"; 7 7 nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable"; 8 8 - nixos-wsl = { 9 9 - url = "github:nix-community/NixOS-WSL/main"; 10 10 - inputs.nixpkgs.follows = "nixpkgs"; 11 11 - }; 12 8 determinite = { 13 9 url = "https://flakehub.com/f/DeterminateSystems/determinate/3"; 14 10 inputs.nixpkgs.follows = "nixpkgs"; ··· 17 13 url = "github:nix-community/home-manager/release-25.11"; 18 14 inputs.nixpkgs.follows = "nixpkgs"; 19 15 }; 20 20 - pre-commit-hooks = { 21 21 - url = "github:cachix/git-hooks.nix"; 22 22 - inputs.nixpkgs.follows = "nixpkgs"; 23 23 - }; 24 24 - agenix = { 25 25 - url = "github:ryantm/agenix"; 26 26 - inputs.nixpkgs.follows = "nixpkgs"; 27 27 - }; 16 16 + pre-commit-hooks.url = "github:cachix/git-hooks.nix"; 17 17 + agenix.url = "github:ryantm/agenix"; 28 18 }; 29 19 30 20 outputs = 31 31 - { 32 32 - self, 33 33 - nixpkgs, 34 34 - nixpkgs-unstable, 35 35 - nixos-wsl, 36 36 - determinite, 37 37 - home-manager, 38 38 - pre-commit-hooks, 39 39 - agenix, 40 40 - ... 21 21 + { self 22 22 + , nixpkgs 23 23 + , nixpkgs-unstable 24 24 + , determinite 25 25 + , home-manager 26 26 + , pre-commit-hooks 27 27 + , agenix 28 28 + , ... 41 29 }@inputs: 42 30 let 43 43 - supportedSystems = [ 44 44 - "x86_64-linux" 45 45 - "aarch64-linux" 46 46 - "x86_64-darwin" 47 47 - "aarch64-darwin" 48 48 - ]; 49 49 - forAllSystems = nixpkgs.lib.genAttrs supportedSystems; 50 50 - basicSystem = 51 51 - { 52 52 - system ? "x86_64-linux", 53 53 - modules ? [ ], 54 54 - useUnstable ? false, 55 55 - extraGroups ? [ ], 56 56 - overlays ? [ ], 57 57 - enableNFTables ? true, 58 58 - }: 59 59 - let 60 60 - unstable = import nixpkgs-unstable { 61 61 - inherit system overlays; 62 62 - config.allowUnfree = true; 63 63 - }; 64 64 - in 65 65 - inputs.nixpkgs.lib.nixosSystem { 66 66 - inherit system; 67 67 - specialArgs = { 68 68 - inherit inputs extraGroups enableNFTables; 69 69 - } 70 70 - // nixpkgs.lib.optionalAttrs useUnstable { 71 71 - inherit unstable; 72 72 - }; 73 73 - modules = [ 74 74 - determinite.nixosModules.default 75 75 - ./common.nix 76 76 - ./users.nix 77 77 - ./services.nix 78 78 - agenix.nixosModules.default 79 79 - home-manager.nixosModules.home-manager 80 80 - { 81 81 - home-manager.useGlobalPkgs = true; 82 82 - home-manager.useUserPackages = true; 83 83 - home-manager.users.noah = ./default-home.nix; 84 84 - home-manager.extraSpecialArgs = { 85 85 - inherit inputs; 86 86 - } 87 87 - // nixpkgs.lib.optionalAttrs useUnstable { 88 88 - inherit unstable; 89 89 - }; 90 90 - } 91 91 - ] 92 92 - ++ modules; 93 93 - }; 94 94 - in 95 95 - { 96 96 - # incomplete 97 97 - nixosConfigurations.odin = basicSystem { 98 98 - extraGroups = [ 99 99 - "libvirtd" 100 100 - "qemu-libvirtd" 101 101 - "docker" 102 102 - ]; 103 103 - useUnstable = true; 104 104 - modules = [ 105 105 - ./host-specific/odin/configuration.nix 106 106 - ]; 31 31 + system = "x86_64-linux"; 32 32 + pkgs = import nixpkgs { 33 33 + inherit system; 107 34 }; 108 108 - nixosConfigurations.shizuri = basicSystem { 109 109 - useUnstable = true; 110 110 - modules = [ 111 111 - ./host-specific/shizuri/configuration.nix 112 112 - ]; 113 113 - }; 114 114 - nixosConfigurations.misaki = basicSystem { 115 115 - useUnstable = true; 116 116 - extraGroups = [ 117 117 - "render" 118 118 - "nats" 119 119 - "litterbox" 120 120 - "httpd" 121 121 - ]; 122 122 - modules = [ 123 123 - ./host-specific/misaki/configuration.nix 124 124 - ]; 35 35 + unstable = import nixpkgs-unstable { 36 36 + inherit system; 37 37 + config.allowUnfreePredicate = 38 38 + pkg: 39 39 + builtins.elem (pkgs.lib.getName pkg) [ 40 40 + "plexmediaserver" 41 41 + "teamspeak-server" 42 42 + ]; 125 43 overlays = [ 126 44 (final: prev: { 127 45 # Override the version of Plex installed to be the latest ··· 142 60 }) 143 61 ]; 144 62 }; 145 145 - nixosConfigurations.touma-wsl = basicSystem { 146 146 - useUnstable = true; 63 63 + supportedSystems = [ 64 64 + "x86_64-linux" 65 65 + "aarch64-linux" 66 66 + "x86_64-darwin" 67 67 + "aarch64-darwin" 68 68 + ]; 69 69 + forAllSystems = nixpkgs.lib.genAttrs supportedSystems; 70 70 + in 71 71 + { 72 72 + nixosConfigurations.misaki = inputs.nixpkgs.lib.nixosSystem { 73 73 + system = "x86_64-linux"; 74 74 + specialArgs = { inherit unstable inputs home-manager; }; 147 75 modules = [ 148 148 - ./host-specific/touma-wsl.nix 149 149 - nixos-wsl.nixosModules.default 76 76 + determinite.nixosModules.default 77 77 + ./configuration.nix 78 78 + agenix.nixosModules.default 79 79 + home-manager.nixosModules.home-manager 80 80 + { 81 81 + home-manager.useGlobalPkgs = true; 82 82 + home-manager.useUserPackages = true; 83 83 + home-manager.users.noah = ./home.nix; 84 84 + home-manager.extraSpecialArgs = { 85 85 + inherit unstable; 86 86 + }; 87 87 + 88 88 + # Optionally, use home-manager.extraSpecialArgs to pass 89 89 + # arguments to home.nix 90 90 + } 150 91 ]; 151 151 - enableNFTables = false; 152 92 }; 153 153 - nixosConfigurations.edge = basicSystem { 154 154 - useUnstable = true; 155 155 - modules = [ 156 156 - ./host-specific/edge/configuration.nix 157 157 - ]; 158 158 - }; 159 159 - homeConfigurations."noah-aleister" = home-manager.lib.homeManagerConfiguration { 160 160 - pkgs = import nixpkgs { 161 161 - system = "aarch64-darwin"; 162 162 - config.allowUnfree = true; 163 163 - }; 93 93 + homeConfigurations."noah" = home-manager.lib.homeManagerConfiguration { 94 94 + inherit pkgs; 95 95 + 164 96 # Specify your home configuration modules here, for example, 165 97 # the path to your home.nix. 166 166 - modules = [ 167 167 - ./host-specific/aleister-noah.nix 168 168 - agenix.homeManagerModules.default 169 169 - ]; 98 98 + modules = [ ./noah-home.nix ]; 170 99 171 100 # Optionally use extraSpecialArgs 172 101 # to pass through arguments to home.nix 173 102 extraSpecialArgs = { 174 174 - unstable = import nixpkgs-unstable { 175 175 - system = "aarch64-darwin"; 176 176 - config.allowUnfree = true; 177 177 - }; 103 103 + inherit unstable; 178 104 }; 179 105 }; 180 180 - homeConfigurations."noah" = 181 181 - let 182 182 - system = "x86_64-linux"; 183 183 - pkgs = import nixpkgs { 184 184 - inherit system; 185 185 - config.allowUnfree = true; 186 186 - }; 187 187 - unstable = import nixpkgs-unstable { 188 188 - inherit system; 189 189 - config.allowUnfree = true; 190 190 - }; 191 191 - in 192 192 - home-manager.lib.homeManagerConfiguration { 193 193 - inherit pkgs; 194 194 - # Specify your home configuration modules here, for example, 195 195 - # the path to your home.nix. 196 196 - modules = [ 197 197 - ./default-home.nix 198 198 - { 199 199 - nix.package = pkgs.nix; 200 200 - } 201 201 - ]; 202 202 - 203 203 - # Optionally use extraSpecialArgs 204 204 - # to pass through arguments to home.nix 205 205 - extraSpecialArgs = { 206 206 - inherit unstable; 207 207 - inputs = inputs; 208 208 - }; 209 209 - }; 210 106 checks = forAllSystems (system: { 211 211 - pre-commit-check = pre-commit-hooks.lib.${system}.run { 107 107 + pre-commit-check = inputs.pre-commit-hooks.lib.${system}.run { 212 108 src = ./.; 213 109 # If your hooks are intrusive, avoid running on each commit with a default_states like this: 214 110 # default_stages = ["manual" "push"]; 215 111 hooks = { 216 216 - nixfmt-rfc-style.enable = true; 112 112 + nixpkgs-fmt.enable = true; 217 113 nil.enable = true; 218 114 luacheck.enable = true; 219 115 }; ··· 223 119 default = nixpkgs.legacyPackages.${system}.mkShell { 224 120 inherit (self.checks.${system}.pre-commit-check) shellHook; 225 121 buildInputs = [ 226 226 - nixpkgs.legacyPackages.${system}.nixfmt-rfc-style 122 122 + pkgs.nixfmt-rfc-style 227 123 ] 228 124 ++ self.checks.${system}.pre-commit-check.enabledPackages; 229 125 }; 230 126 }); 231 231 - formatter = forAllSystems (system: inputs.nixpkgs.legacyPackages.${system}.nixfmt-rfc-style); 127 127 + formatter.${system} = inputs.nixpkgs.legacyPackages.${system}.nixfmt-rfc-style; 232 128 }; 233 129 }

-30

ghostty/config

··· 1 1 - #font-size = 13 2 2 - font-family = TX-02 Medium 3 3 - theme = flat-remix-light 4 4 - #theme = dark:catppuccin-frappe,light:catppuccin-latte 5 5 - shell-integration = fish 6 6 - link-url = true 7 7 - clipboard-read = allow 8 8 - 9 9 - #window-decoration = true 10 10 - 11 11 - font-feature = calt 12 12 - font-feature = ccmp 13 13 - font-feature = locl 14 14 - font-feature = ordn 15 15 - font-feature = mark 16 16 - font-feature = mkmk 17 17 - #font-feature = aalt 18 18 - #font-feature = ss01 19 19 - #font-feature = ss02 20 20 - #font-feature = ss03 21 21 - #font-feature = ss04 22 22 - #font-feature = ss05 23 23 - #font-feature = ss06 24 24 - #font-feature = ss07 25 25 - #font-feature = ss08 26 26 - 27 27 - custom-shader = ~/.config/ghostty/shaders/galaxy.glsl 28 28 - #custom-shader = ~/.config/ghostty/shaders/tft.glsl 29 29 - #custom-shader = ~/.config/ghostty/shaders/retro-terminal.glsl 30 30 - #custom-shader = ~/.config/ghostty/shaders/bettercrt.glsl

-42

ghostty/themes/flat-remix-light

··· 1 1 - # standard colors 2 2 - # black 3 3 - palette = 0=#404040 4 4 - # red 5 5 - palette = 1=#d41919 6 6 - # green 7 7 - palette = 2=#12715f 8 8 - # yellow 9 9 - palette = 3=#fea44c 10 10 - # blue 11 11 - palette = 4=#367bf0 12 12 - # purple 13 13 - palette = 5=#8c42ab 14 14 - # cyan 15 15 - palette = 6=#4aaee6 16 16 - # white 17 17 - palette = 7=#ffffff 18 18 - 19 19 - # intense colors 20 20 - # black (grey) 21 21 - palette = 8=#737680 22 22 - # red 23 23 - palette = 9=#811035 24 24 - # green 25 25 - palette = 10=#23bac2 26 26 - # yellow 27 27 - palette = 11=#fe7171 28 28 - # blue 29 29 - palette = 12=#54bd8e 30 30 - # purple 31 31 - palette = 13=#d41919 32 32 - # cyan 33 33 - palette = 14=#367bf0 34 34 - # white 35 35 - palette = 15=#aaaaaa 36 36 - 37 37 - background = #e4e4e7 38 38 - foreground = #404040 39 39 - cursor-color = #272a34 40 40 - cursor-text = #b8174c 41 41 - selection-background = #737680 42 42 - selection-foreground = #ffffff

-79

gui.nix

··· 1 1 - { pkgs, unstable, ... }: 2 2 - { 3 3 - # Enable the X11 windowing system. 4 4 - services.xserver.enable = true; 5 5 - 6 6 - # Configure keymap in X11 7 7 - # services.xserver.xkb.layout = "us"; 8 8 - # services.xserver.xkb.options = "eurosign:e,caps:escape"; 9 9 - 10 10 - # Enable CUPS to print documents. 11 11 - # services.printing.enable = true; 12 12 - 13 13 - # Enable sound. 14 14 - security.rtkit.enable = true; 15 15 - services.pipewire = { 16 16 - enable = true; 17 17 - alsa.enable = true; 18 18 - alsa.support32Bit = true; 19 19 - pulse.enable = true; 20 20 - wireplumber.enable = true; 21 21 - }; 22 22 - 23 23 - # Graphics and parallel compute configuration 24 24 - hardware.opengl.extraPackages = [ 25 25 - pkgs.libva 26 26 - ]; 27 27 - 28 28 - # Enable touchpad support (enabled default in most desktopManager). 29 29 - # services.xserver.libinput.enable = true; 30 30 - 31 31 - # Fonts 32 32 - fonts.packages = with pkgs; [ 33 33 - fira-code 34 34 - fira-code-symbols 35 35 - noto-fonts 36 36 - noto-fonts-cjk 37 37 - noto-fonts-emoji 38 38 - noto-fonts-extra 39 39 - (nerdfonts.override { fonts = [ "FiraCode" ]; }) 40 40 - ]; 41 41 - 42 42 - # Polkit is a dependency of Sway. It's responsible for handling security policies 43 43 - security.polkit.enable = true; 44 44 - 45 45 - # Enable the sway window manager 46 46 - programs.sway = { 47 47 - enable = true; 48 48 - package = unstable.sway; 49 49 - wrapperFeatures.gtk = true; 50 50 - }; 51 51 - # Use greetd as the displaymanager 52 52 - #services.xserver.displayManager.greetd.enable = true; 53 53 - #services.xserver.displayManager.lightdm.enable = false; 54 54 - services.xserver.displayManager.sddm.enable = true; 55 55 - services.xserver.displayManager.defaultSession = "none+i3"; 56 56 - services.xserver.displayManager.autoLogin = { 57 57 - enable = true; 58 58 - user = "noah"; 59 59 - }; 60 60 - 61 61 - # i3, for when I need XOrg 62 62 - services.xserver.windowManager.i3 = { 63 63 - enable = true; 64 64 - extraPackages = with pkgs; [ 65 65 - dmenu 66 66 - i3status 67 67 - i3lock 68 68 - i3blocks 69 69 - ]; 70 70 - }; 71 71 - 72 72 - xdg.portal = { 73 73 - enable = true; 74 74 - wlr.enable = true; 75 75 - extraPortals = [ pkgs.xdg-desktop-portal-gtk ]; 76 76 - }; 77 77 - services.dbus.enable = true; 78 78 - services.gnome.gnome-keyring.enable = true; 79 79 - }

+72

hardware-configuration.nix

··· 1 1 + # Do not modify this file! It was generated by ‘nixos-generate-config’ 2 2 + # and may be overwritten by future invocations. Please make changes 3 3 + # to /etc/nixos/configuration.nix instead. 4 4 + { config, lib, pkgs, modulesPath, ... }: 5 5 + 6 6 + { 7 7 + imports = 8 8 + [ 9 9 + (modulesPath + "/installer/scan/not-detected.nix") 10 10 + ]; 11 11 + 12 12 + boot.kernelPackages = pkgs.linuxPackages; 13 13 + boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "dm-raid" "raid1" ]; 14 14 + boot.initrd.kernelModules = [ "dm-snapshot" "dm-raid" "raid1" ]; 15 15 + boot.kernelModules = [ "kvm-amd" "zfs" ]; 16 16 + boot.kernelParams = [ "i915.enable_guc=3" ]; 17 17 + boot.extraModulePackages = [ ]; 18 18 + 19 19 + fileSystems."/" = 20 20 + { 21 21 + device = "/dev/disk/by-uuid/1988fa0d-ff4a-44aa-a93e-7f0bf3cea5cf"; 22 22 + fsType = "ext4"; 23 23 + }; 24 24 + 25 25 + fileSystems."/boot" = 26 26 + { 27 27 + device = "/dev/disk/by-uuid/81D4-01CD"; 28 28 + fsType = "vfat"; 29 29 + }; 30 30 + 31 31 + swapDevices = [ ]; 32 32 + 33 33 + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking 34 34 + # (the default) this is the recommended approach. When using systemd-networkd it's 35 35 + # still possible to use this option, but it's recommended to use it in conjunction 36 36 + # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`. 37 37 + networking.useDHCP = lib.mkDefault true; 38 38 + # networking.interfaces.enp4s0f0.useDHCP = lib.mkDefault true; 39 39 + # networking.interfaces.enp4s0f1.useDHCP = lib.mkDefault true; 40 40 + # networking.interfaces.enp6s0.useDHCP = lib.mkDefault true; 41 41 + 42 42 + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; 43 43 + hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; 44 44 + 45 45 + #nixpkgs.config.packageOverrides = pkgs: { 46 46 + # vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; }; 47 47 + #}; 48 48 + hardware.graphics = { 49 49 + enable = true; 50 50 + extraPackages = with pkgs; [ 51 51 + intel-media-driver 52 52 + #vaapiVdpau 53 53 + #libvdpau-va-gl # unmaintained, very old 54 54 + intel-compute-runtime 55 55 + vpl-gpu-rt 56 56 + ]; 57 57 + #extraPackages32 = with pkgs; [ 58 58 + # intel-media-driver 59 59 + # vaapiVdpau 60 60 + # #libvdpau-va-gl 61 61 + # intel-compute-runtime 62 62 + # vpl-gpu-rt 63 63 + #]; 64 64 + }; 65 65 + environment.variables = { 66 66 + VDPAU_DRIVER = "va_gl"; 67 67 + LIBVA_DRIVER_NAME = "iHD"; 68 68 + LIBVA_DRIVERS_PATH = "/run/opengl-driver/lib/dri"; 69 69 + GST_VAAPI_ALL_DRIVERS = "1"; 70 70 + }; 71 71 + #services.xserver.videoDrivers = [ "intel" ]; 72 72 + }

+221

home.nix

··· 1 1 + { pkgs, lib, unstable, ... }: 2 2 + { 3 3 + home.packages = with pkgs; [ 4 4 + # main tool 5 5 + direnv 6 6 + fish 7 7 + tree 8 8 + btop 9 9 + htop 10 10 + amdgpu_top 11 11 + tmux 12 12 + mtr 13 13 + pavucontrol 14 14 + moreutils 15 15 + rsync 16 16 + unzip 17 17 + fd 18 18 + ripgrep 19 19 + netcat 20 20 + stunnel 21 21 + fzf 22 22 + iperf3 23 23 + entr 24 24 + step-cli 25 25 + natscli 26 26 + nkeys 27 27 + mkcert 28 28 + jq 29 29 + bat 30 30 + sqlite 31 31 + age 32 32 + just 33 33 + isync 34 34 + unstable.catgirl 35 35 + unstable.zellij 36 36 + unstable.yt-dlp 37 37 + unstable.deno 38 38 + unstable.ffmpeg 39 39 + 40 40 + # Dev tools 41 41 + git 42 42 + gcc 43 43 + go 44 44 + gnumake 45 45 + #babashka 46 46 + ccls 47 47 + #clojure 48 48 + #cmake 49 49 + ctags 50 50 + #kotlin 51 51 + #nodejs 52 52 + #node2nix 53 53 + #opam 54 54 + rustup 55 55 + #zig 56 56 + luarocks 57 57 + luajit 58 58 + lua-language-server 59 59 + #leiningen 60 60 + libressl 61 61 + #erlang 62 62 + #elixir 63 63 + #ghc 64 64 + nil 65 65 + python3 66 66 + uv 67 67 + #unstable.harec 68 68 + #unstable.hare 69 69 + #unstable.haredo 70 70 + #unstable.gleam 71 71 + #unstable.rebar3 72 72 + #unstable.flyctl 73 73 + #unstable.bun 74 74 + #unstable.gh 75 75 + #unstable.kraft 76 76 + #unstable.doctl 77 77 + 78 78 + clinfo 79 79 + 80 80 + # Server-specific tools 81 81 + gocryptfs 82 82 + sftpgo 83 83 + ]; 84 84 + 85 85 + 86 86 + programs.fish.enable = true; 87 87 + programs.neovim = { 88 88 + #package = unstable.neovim-unwrapped; 89 89 + enable = true; 90 90 + defaultEditor = true; 91 91 + extraPackages = with pkgs; [ 92 92 + fzf 93 93 + ripgrep 94 94 + luarocks 95 95 + unstable.tree-sitter 96 96 + ]; 97 97 + withNodeJs = true; 98 98 + withPython3 = true; 99 99 + }; 100 100 + programs.git = { 101 101 + enable = true; 102 102 + lfs.enable = true; 103 103 + userName = "Noah Pederson"; 104 104 + userEmail = "noah@packetlost.dev"; 105 105 + extraConfig = { 106 106 + sendemail = { 107 107 + smtpserver = "smtp.migadu.com"; 108 108 + smtpuser = "noah@packetlost.dev"; 109 109 + smtpencryption = "ssl"; 110 110 + smtpserverport = 465; 111 111 + }; 112 112 + init = { 113 113 + defaultBranch = "master"; 114 114 + }; 115 115 + pull = { 116 116 + rebase = true; 117 117 + }; 118 118 + credential = { 119 119 + helper = "cache"; 120 120 + }; 121 121 + }; 122 122 + ignores = [ 123 123 + ".direnv/" 124 124 + ".envrc" 125 125 + "flake.nix" 126 126 + "shell.nix" 127 127 + ".env/" 128 128 + ".clj-kondo/" 129 129 + ]; 130 130 + }; 131 131 + 132 132 + services.mbsync = { 133 133 + enable = true; 134 134 + frequency = "*:0/10"; 135 135 + #configFile = ./mbsyncrc; 136 136 + }; 137 137 + 138 138 + programs.aerc = { 139 139 + enable = true; 140 140 + #package = unstable.aerc; 141 141 + }; 142 142 + 143 143 + programs.ssh = { 144 144 + enable = true; 145 145 + extraConfig = builtins.readFile ./ssh/extra; 146 146 + }; 147 147 + services.ssh-agent.enable = true; 148 148 + 149 149 + programs.direnv = { 150 150 + enable = true; 151 151 + nix-direnv.enable = true; 152 152 + }; 153 153 + 154 154 + programs.yazi = { 155 155 + enable = true; 156 156 + package = unstable.yazi; 157 157 + enableFishIntegration = true; 158 158 + settings = { 159 159 + preview = { 160 160 + image_quality = 90; 161 161 + }; 162 162 + tasks = { 163 163 + image_bound = [ 0 0 ]; 164 164 + }; 165 165 + }; 166 166 + plugins = { 167 167 + rsync = unstable.yaziPlugins.rsync; 168 168 + piper = unstable.yaziPlugins.piper; 169 169 + nord = unstable.yaziPlugins.nord; 170 170 + mediainfo = unstable.yaziPlugins.mediainfo; 171 171 + glow = unstable.yaziPlugins.glow; 172 172 + git = unstable.yaziPlugins.git; 173 173 + diff = unstable.yaziPlugins.diff; 174 174 + duckdb = unstable.yaziPlugins.duckdb; 175 175 + }; 176 176 + }; 177 177 + 178 178 + # Independent config files. 179 179 + xdg.configFile.nvim = { 180 180 + source = ./nvim; 181 181 + recursive = true; 182 182 + }; 183 183 + 184 184 + xdg.configFile.fish = { 185 185 + source = ./fish; 186 186 + recursive = true; 187 187 + }; 188 188 + 189 189 + xdg.configFile.kitty = { 190 190 + source = ./kitty; 191 191 + recursive = true; 192 192 + }; 193 193 + 194 194 + xdg.configFile.aerc = { 195 195 + source = ./aerc; 196 196 + recursive = true; 197 197 + }; 198 198 + 199 199 + xdg.configFile.sway = { 200 200 + source = ./sway; 201 201 + recursive = true; 202 202 + }; 203 203 + 204 204 + xdg.configFile.i3status = { 205 205 + source = ./i3status; 206 206 + recursive = true; 207 207 + }; 208 208 + 209 209 + xdg.configFile.vis = { 210 210 + source = ./vis; 211 211 + recursive = true; 212 212 + }; 213 213 + 214 214 + home.file.".local/bin" = { 215 215 + source = ./scripts; 216 216 + recursive = true; 217 217 + }; 218 218 + 219 219 + home.stateVersion = "23.11"; 220 220 + 221 221 + }

-397

host-specific/aleister-noah.nix

··· 1 1 - { 2 2 - pkgs, 3 3 - unstable, 4 4 - lib, 5 5 - inputs, 6 6 - ... 7 7 - }: 8 8 - { 9 9 - # Home Manager needs a bit of information about you and the paths it should 10 10 - # manage. 11 11 - home.username = "noah"; 12 12 - home.homeDirectory = "/Users/noah"; 13 13 - imports = [ 14 14 - inputs.agenix.homeManagerModules.default 15 15 - ]; 16 16 - nix = { 17 17 - package = pkgs.nix; 18 18 - settings = { 19 19 - experimental-features = [ 20 20 - "nix-command" 21 21 - "flakes" 22 22 - ]; 23 23 - }; 24 24 - }; 25 25 - 26 26 - # I generally don't care about unfree stuff 27 27 - nixpkgs.config.allowUnfree = true; 28 28 - nixpkgs.config.allowUnfreePredicte = _: true; 29 29 - 30 30 - home.packages = with pkgs; [ 31 31 - # main tool 32 32 - direnv 33 33 - #fish 34 34 - tree 35 35 - btop 36 36 - # Apple Silicon top monitoring 37 37 - macpm 38 38 - htop 39 39 - mtr 40 40 - moreutils 41 41 - rsync 42 42 - bash 43 43 - tmux 44 44 - coreutils 45 45 - util-linux 46 46 - p7zip 47 47 - unar 48 48 - watch 49 49 - 50 50 - unzip 51 51 - fd 52 52 - jq 53 53 - ripgrep 54 54 - bat 55 55 - netcat 56 56 - stunnel 57 57 - iperf3 58 58 - entr 59 59 - ncdu 60 60 - # broken? 61 61 - #unstable.bitwarden-cli 62 62 - sqlite 63 63 - age 64 64 - just 65 65 - mdr 66 66 - unstable.catgirl 67 67 - plan9port 68 68 - unstable.rc 69 69 - unstable.glow 70 70 - unstable.vis 71 71 - # Tcl/Tk 72 72 - #unstable.tcl 73 73 - #unstable.tk 74 74 - #unstable.tclPackages.tclx 75 75 - nodejs 76 76 - 77 77 - # Dev tools 78 78 - git 79 79 - git-filter-repo 80 80 - unstable.ruff 81 81 - # Rust REPL 82 82 - evcxr 83 83 - #unstable.gcc 84 84 - #unstable.clang 85 85 - # Swift stuff 86 86 - #swift 87 87 - #swift-format 88 88 - # Swift LSP 89 89 - #sourcekit-lsp 90 90 - unstable.go 91 91 - unstable.gopls 92 92 - gnumake 93 93 - #unstable.babashka 94 94 - #unstable.ccls 95 95 - unstable.clojure 96 96 - unstable.cljfmt 97 97 - unstable.clojure-lsp 98 98 - unstable.janet 99 99 - unstable.jpm 100 100 - unstable.fennel-ls 101 101 - unstable.graalvmPackages.graalvm-ce 102 102 - unstable.crystal 103 103 - unstable.crystalline 104 104 - cmake 105 105 - ctags 106 106 - #kotlin 107 107 - #nodejs 108 108 - #yarn 109 109 - #node2nix 110 110 - #opam 111 111 - # Scala stuff 112 112 - #unstable.scala_3 113 113 - #unstable.scalafmt 114 114 - #unstable.metals 115 115 - # Scala / Java build tool 116 116 - #unstable.sbt 117 117 - # Haskell 118 118 - #cabal-install 119 119 - #ghc 120 120 - 121 121 - # Lua 122 122 - luarocks 123 123 - luajit 124 124 - unstable.lua-language-server 125 125 - luaformatter 126 126 - libressl 127 127 - # Erlang 128 128 - #erlang 129 129 - #elixir 130 130 - unstable.nil # nix language server 131 131 - unstable.nixd 132 132 - #typescript 133 133 - # This is currently broken 134 134 - #vscode-langservers-extracted 135 135 - scdoc 136 136 - #dockerfile-language-server-nodejs 137 137 - # BROKEN 138 138 - #yaml-language-server 139 139 - mkcert 140 140 - natscli 141 141 - python314 142 142 - unstable.uv 143 143 - sqlite 144 144 - #unstable.gleam 145 145 - #unstable.rebar3 146 146 - #unstable.flyctl 147 147 - unstable.bun 148 148 - unstable.gh 149 149 - unstable.kraft 150 150 - unstable.doctl 151 151 - 152 152 - # GUI tools 153 153 - zathura 154 154 - unstable.opencode 155 155 - 156 156 - # Python dev tools 157 157 - #unstable.pyright 158 158 - unstable.basedpyright 159 159 - unstable.python313Packages.python-lsp-server 160 160 - unstable.python313Packages.python-lsp-ruff 161 161 - 162 162 - # JavaScript tools 163 163 - #typescript-language-server 164 164 - 165 165 - # Certificate Management 166 166 - minica 167 167 - mkcert 168 168 - step-cli 169 169 - unstable.claude-code 170 170 - 171 171 - # Fish Plugins 172 172 - #fishPlugins.fzf 173 173 - #fishPlugins.pure 174 174 - 175 175 - # Libraries because MacOS is kinda stupid 176 176 - ncurses 177 177 - ]; 178 178 - 179 179 - #programs.fish = { 180 180 - # enable = true; 181 181 - # package = unstable.fish; 182 182 - #}; 183 183 - programs.fzf = { 184 184 - enable = true; 185 185 - enableFishIntegration = true; 186 186 - }; 187 187 - programs.pistol.enable = true; 188 188 - programs.home-manager.enable = true; 189 189 - programs.neovim = { 190 190 - package = unstable.neovim-unwrapped; 191 191 - enable = true; 192 192 - defaultEditor = true; 193 193 - withNodeJs = false; 194 194 - withPython3 = true; 195 195 - extraPackages = with pkgs; [ 196 196 - fzf 197 197 - ripgrep 198 198 - luarocks 199 199 - tree-sitter 200 200 - ]; 201 201 - }; 202 202 - programs.git = { 203 203 - enable = true; 204 204 - lfs.enable = true; 205 205 - userName = "Noah Pederson"; 206 206 - userEmail = "noah@packetlost.dev"; 207 207 - extraConfig = { 208 208 - sendemail = { 209 209 - smtpserver = "smtp.migadu.com"; 210 210 - smtpuser = "noah@packetlost.dev"; 211 211 - smtpauth = "plain"; 212 212 - smtpencryption = "tls"; 213 213 - smtpserverport = 465; 214 214 - }; 215 215 - init = { 216 216 - defaultBranch = "master"; 217 217 - }; 218 218 - pull = { 219 219 - rebase = true; 220 220 - }; 221 221 - push = { 222 222 - default = "simple"; 223 223 - autoSetupRemote = true; 224 224 - followTags = true; 225 225 - }; 226 226 - credential = { 227 227 - helper = "cache"; 228 228 - }; 229 229 - alias = { 230 230 - out = "log @{u}.."; 231 231 - }; 232 232 - column = { 233 233 - ui = "auto"; 234 234 - }; 235 235 - branch = { 236 236 - sort = "-committerdate"; 237 237 - }; 238 238 - tag = { 239 239 - sort = "version:refname"; 240 240 - }; 241 241 - diff = { 242 242 - algorithm = "histogram"; 243 243 - colorMoved = "plain"; 244 244 - mnemonicPrefix = true; 245 245 - renames = true; 246 246 - }; 247 247 - fetch = { 248 248 - prune = true; 249 249 - pruneTags = true; 250 250 - all = true; 251 251 - }; 252 252 - help = { 253 253 - autocorrect = "prompt"; 254 254 - }; 255 255 - commit = { 256 256 - verbose = true; 257 257 - }; 258 258 - rerere = { 259 259 - enabled = true; 260 260 - autoupdate = true; 261 261 - }; 262 262 - rebase = { 263 263 - autoSquash = true; 264 264 - autoStash = true; 265 265 - updateRefs = true; 266 266 - }; 267 267 - merge = { 268 268 - conflictStyle = "zdiff3"; 269 269 - }; 270 270 - }; 271 271 - ignores = [ 272 272 - ".direnv/" 273 273 - ".envrc" 274 274 - ".env/" 275 275 - ".clj-kondo/" 276 276 - ]; 277 277 - }; 278 278 - programs.aerc = { 279 279 - enable = true; 280 280 - }; 281 281 - programs.ssh = { 282 282 - enable = true; 283 283 - extraConfig = builtins.readFile ../ssh/extra; 284 284 - addKeysToAgent = "yes"; 285 285 - forwardAgent = true; 286 286 - }; 287 287 - 288 288 - programs.yazi = 289 289 - let 290 290 - localPkgs = pkgs; 291 291 - yaziPlugins = localPkgs.yaziPlugins; 292 292 - plugins = lib.attrsets.getAttrs [ 293 293 - "rsync" 294 294 - "piper" 295 295 - "nord" 296 296 - "mediainfo" 297 297 - "glow" 298 298 - "git" 299 299 - "diff" 300 300 - "duckdb" 301 301 - ] yaziPlugins; 302 302 - in 303 303 - { 304 304 - inherit plugins; 305 305 - enable = true; 306 306 - package = localPkgs.yazi; 307 307 - enableFishIntegration = true; 308 308 - settings = { 309 309 - preview = { 310 310 - image_quality = 90; 311 311 - }; 312 312 - tasks = { 313 313 - image_bound = [ 314 314 - 0 315 315 - 0 316 316 - ]; 317 317 - }; 318 318 - }; 319 319 - }; 320 320 - 321 321 - programs.direnv = { 322 322 - enable = true; 323 323 - nix-direnv.enable = true; 324 324 - }; 325 325 - 326 326 - programs.nix-index = { 327 327 - enable = true; 328 328 - enableFishIntegration = true; 329 329 - }; 330 330 - programs.helix = { 331 331 - enable = true; 332 332 - settings = { 333 333 - theme = "everforest_dark"; 334 334 - editor.cursor-shape = { 335 335 - normal = "block"; 336 336 - insert = "bar"; 337 337 - select = "underline"; 338 338 - }; 339 339 - }; 340 340 - languages.language = [ 341 341 - { 342 342 - name = "nix"; 343 343 - auto-format = true; 344 344 - formatter.command = "${pkgs.nixfmt}/bin/nixfmt"; 345 345 - } 346 346 - { 347 347 - name = "rust"; 348 348 - auto-format = true; 349 349 - formatter.command = "${pkgs.rustfmt}/bin/rustfmt"; 350 350 - } 351 351 - ]; 352 352 - }; 353 353 - 354 354 - # Independent config files. 355 355 - xdg.configFile.nvim = { 356 356 - source = ../nvim; 357 357 - recursive = true; 358 358 - }; 359 359 - 360 360 - xdg.configFile.vis = { 361 361 - source = ../vis; 362 362 - recursive = true; 363 363 - }; 364 364 - 365 365 - xdg.configFile.fish = { 366 366 - source = ../fish; 367 367 - recursive = true; 368 368 - }; 369 369 - xdg.configFile."fish/completions/nix.fish".source = 370 370 - "${pkgs.nix}/share/fish/vendor_completions.d/nix.fish"; 371 371 - 372 372 - xdg.configFile.aerc = { 373 373 - source = ../aerc; 374 374 - recursive = true; 375 375 - }; 376 376 - 377 377 - xdg.configFile.ghostty = { 378 378 - source = ../ghostty; 379 379 - recursive = true; 380 380 - }; 381 381 - 382 382 - home.file.".local/bin" = { 383 383 - source = ../scripts; 384 384 - recursive = true; 385 385 - }; 386 386 - home.file.".luacheckrc" = { 387 387 - text = '' 388 388 - globals = { 389 389 - "vim", 390 390 - "vis", 391 391 - } 392 392 - ''; 393 393 - }; 394 394 - 395 395 - home.stateVersion = "24.11"; 396 396 - 397 397 - }

-207

host-specific/edge/configuration.nix

··· 1 1 - # Edit this configuration file to define what should be installed on 2 2 - # your system. Help is available in the configuration.nix(5) man page, on 3 3 - # https://search.nixos.org/options and in the NixOS manual (`nixos-help`). 4 4 - 5 5 - { 6 6 - config, 7 7 - lib, 8 8 - pkgs, 9 9 - inputs, 10 10 - ... 11 11 - }: 12 12 - let 13 13 - system = pkgs.stdenv.targetPlatform.system; 14 14 - agave = (builtins.getFlake "/home/noah/repos/agave"); 15 15 - in 16 16 - { 17 17 - imports = [ 18 18 - # Include the results of the hardware scan. 19 19 - ./hardware-configuration.nix 20 20 - agave.nixosModules.default 21 21 - ]; 22 22 - 23 23 - nix.settings.experimental-features = [ 24 24 - "nix-command" 25 25 - "flakes" 26 26 - ]; 27 27 - 28 28 - # Use the systemd-boot EFI boot loader. 29 29 - boot.loader.systemd-boot.enable = true; 30 30 - #boot.loader.grub.device = "nodev"; 31 31 - #boot.loader.grub.efiSupport = true; 32 32 - #boot.loader.grub.useOSProber = true; 33 33 - boot.loader.efi.canTouchEfiVariables = true; 34 34 - 35 35 - # Use latest kernel. 36 36 - boot.kernelPackages = pkgs.linuxPackages_latest; 37 37 - 38 38 - networking.hostName = "edge"; # Define your hostname. 39 39 - 40 40 - # Configure network connections interactively with nmcli or nmtui. 41 41 - networking.networkmanager.enable = true; 42 42 - 43 43 - # Set your time zone. 44 44 - # time.timeZone = "Europe/Amsterdam"; 45 45 - 46 46 - # Configure network proxy if necessary 47 47 - # networking.proxy.default = "http://user:password@proxy:port/"; 48 48 - # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; 49 49 - 50 50 - # Select internationalisation properties. 51 51 - i18n.defaultLocale = "en_US.UTF-8"; 52 52 - console = { 53 53 - font = "Lat2-Terminus16"; 54 54 - keyMap = "us"; 55 55 - #useXkbConfig = true; # use xkb.options in tty. 56 56 - }; 57 57 - 58 58 - # Enable the X11 windowing system. 59 59 - # services.xserver.enable = true; 60 60 - 61 61 - # Configure keymap in X11 62 62 - # services.xserver.xkb.layout = "us"; 63 63 - # services.xserver.xkb.options = "eurosign:e,caps:escape"; 64 64 - 65 65 - # Enable CUPS to print documents. 66 66 - # services.printing.enable = true; 67 67 - 68 68 - # Enable sound. 69 69 - # services.pulseaudio.enable = true; 70 70 - # OR 71 71 - # services.pipewire = { 72 72 - # enable = true; 73 73 - # pulse.enable = true; 74 74 - # }; 75 75 - 76 76 - # Enable touchpad support (enabled default in most desktopManager). 77 77 - # services.libinput.enable = true; 78 78 - 79 79 - # Define a user account. Don't forget to set a password with ‘passwd’. 80 80 - # users.users.alice = { 81 81 - # isNormalUser = true; 82 82 - # extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user. 83 83 - # packages = with pkgs; [ 84 84 - # tree 85 85 - # ]; 86 86 - # }; 87 87 - 88 88 - # programs.firefox.enable = true; 89 89 - 90 90 - # List packages installed in system profile. 91 91 - # You can use https://search.nixos.org/ to find more packages (and options). 92 92 - environment.systemPackages = with pkgs; [ 93 93 - neovim 94 94 - wget 95 95 - git 96 96 - htop 97 97 - inputs.agenix.packages."${system}".agenix 98 98 - agave.packages.${system}.solana 99 99 - agave.packages.${system}.solana-keygen 100 100 - ]; 101 101 - 102 102 - services.tailscale.useRoutingFeatures = "both"; 103 103 - 104 104 - # Some programs need SUID wrappers, can be configured further or are 105 105 - # started in user sessions. 106 106 - # programs.mtr.enable = true; 107 107 - # programs.gnupg.agent = { 108 108 - # enable = true; 109 109 - # enableSSHSupport = true; 110 110 - # }; 111 111 - 112 112 - # List services that you want to enable: 113 113 - 114 114 - # Enable the OpenSSH daemon. 115 115 - services.openssh.enable = true; 116 116 - services.openssh.openFirewall = true; 117 117 - 118 118 - # Open ports in the firewall. 119 119 - # networking.firewall.allowedTCPPorts = [ ... ]; 120 120 - # networking.firewall.allowedUDPPorts = [ ... ]; 121 121 - # Or disable the firewall altogether. 122 122 - networking.firewall.enable = true; 123 123 - networking.firewall = { 124 124 - allowPing = true; 125 125 - allowedUDPPorts = [ ]; 126 126 - allowedUDPPortRanges = [ 127 127 - # Agave 128 128 - { 129 129 - from = 8000; 130 130 - to = 8020; 131 131 - } 132 132 - ]; 133 133 - allowedTCPPorts = [ 134 134 - 2375 135 135 - 3000 136 136 - # Agave 137 137 - 8001 138 138 - 8899 139 139 - 8900 140 140 - 10000 141 141 - ]; 142 142 - }; 143 143 - security.pam.loginLimits = [ 144 144 - { 145 145 - domain = "*"; 146 146 - type = "soft"; 147 147 - item = "nofile"; 148 148 - value = "100000"; 149 149 - } 150 150 - { 151 151 - domain = "*"; 152 152 - type = "hard"; 153 153 - item = "nofile"; 154 154 - value = "1000000"; 155 155 - } 156 156 - ]; 157 157 - 158 158 - age.secrets.validator-identity = { 159 159 - file = ../../secrets/validator-identity.age; 160 160 - owner = "sol"; 161 161 - group = "sol"; 162 162 - }; 163 163 - services.ambient-validator = { 164 164 - enable = true; 165 165 - package = agave.packages.${system}.ambient-validator; 166 166 - # this needs to be a secret 167 167 - identityKeypair = config.age.secrets.validator-identity.path; 168 168 - rpcBindAddress = "0.0.0.0"; 169 169 - geyserPluginConfig = { 170 170 - libpath = "${agave.packages.${system}.yellowstone-geyser}/lib/libyellowstone_grpc_geyser.so"; 171 171 - log = { 172 172 - level = "info"; 173 173 - }; 174 174 - tokio = { 175 175 - worker_threads = 4; 176 176 - affinity = null; 177 177 - }; 178 178 - grpc = { 179 179 - address = "0.0.0.0:10000"; 180 180 - }; 181 181 - }; 182 182 - }; 183 183 - # Copy the NixOS configuration file and link it from the resulting system 184 184 - # (/run/current-system/configuration.nix). This is useful in case you 185 185 - # accidentally delete configuration.nix. 186 186 - # system.copySystemConfiguration = true; 187 187 - 188 188 - # This option defines the first version of NixOS you have installed on this particular machine, 189 189 - # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions. 190 190 - # 191 191 - # Most users should NEVER change this value after the initial install, for any reason, 192 192 - # even if you've upgraded your system to a new NixOS release. 193 193 - # 194 194 - # This value does NOT affect the Nixpkgs version your packages and OS are pulled from, 195 195 - # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how 196 196 - # to actually do that. 197 197 - # 198 198 - # This value being lower than the current NixOS release does NOT mean your system is 199 199 - # out of date, out of support, or vulnerable. 200 200 - # 201 201 - # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration, 202 202 - # and migrated your data accordingly. 203 203 - # 204 204 - # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion . 205 205 - system.stateVersion = "25.11"; # Did you read the comment? 206 206 - 207 207 - }

-46

host-specific/edge/hardware-configuration.nix

··· 1 1 - # Do not modify this file! It was generated by ‘nixos-generate-config’ 2 2 - # and may be overwritten by future invocations. Please make changes 3 3 - # to /etc/nixos/configuration.nix instead. 4 4 - { config, lib, pkgs, modulesPath, ... }: 5 5 - 6 6 - { 7 7 - imports = 8 8 - [ (modulesPath + "/installer/scan/not-detected.nix") 9 9 - ]; 10 10 - 11 11 - boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" ]; 12 12 - boot.initrd.kernelModules = [ ]; 13 13 - boot.kernelModules = [ "kvm-amd" ]; 14 14 - boot.extraModulePackages = [ ]; 15 15 - 16 16 - fileSystems."/" = 17 17 - { device = "/dev/disk/by-uuid/8101a0a8-a8c6-4083-85b6-c136d3c80f2e"; 18 18 - fsType = "ext4"; 19 19 - }; 20 20 - 21 21 - fileSystems."/boot" = 22 22 - { device = "/dev/disk/by-uuid/E7AD-32DA"; 23 23 - fsType = "vfat"; 24 24 - options = [ "fmask=0077" "dmask=0077" ]; 25 25 - }; 26 26 - 27 27 - swapDevices = [ ]; 28 28 - 29 29 - nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; 30 30 - hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; 31 31 - boot.swraid = { 32 32 - enable = true; 33 33 - #mdadmConf = '' 34 34 - # ARRAY /dev/md126 metadata=1.2 UUID=27cd6eab:f0304d07:b859f0f2:1a8f29b7 35 35 - # MAILADDR noah 36 36 - #''; 37 37 - }; 38 38 - 39 39 - # stuff for Agave 40 40 - boot.kernel.sysctl."net.core.rmem_default" = 134217728; 41 41 - boot.kernel.sysctl."net.core.rmem_max" = 134217728; 42 42 - boot.kernel.sysctl."net.core.wmem_default" = 134217728; 43 43 - boot.kernel.sysctl."net.core.wmem_max" = 134217728; 44 44 - boot.kernel.sysctl."vm.max_map_count" = 1000000; 45 45 - boot.kernel.sysctl."fs.nr_open" = 1000000; 46 46 - }

-13

host-specific/misaki/boot.nix

··· 1 1 - { ... }: 2 2 - { 3 3 - # Use the systemd-boot EFI boot loader. 4 4 - boot.loader.systemd-boot.enable = true; 5 5 - boot.loader.efi.canTouchEfiVariables = true; 6 6 - 7 7 - boot.supportedFilesystems = [ "zfs" ]; 8 8 - boot.zfs.forceImportRoot = false; 9 9 - boot.zfs.extraPools = [ 10 10 - "shokuhou" 11 11 - "mentalout" 12 12 - ]; 13 13 - }

-13

host-specific/misaki/configuration.nix

··· 1 1 - { ... }: 2 2 - { 3 3 - imports = [ 4 4 - ./boot.nix 5 5 - ./users.nix 6 6 - ./hardware-configuration.nix 7 7 - ./networking.nix 8 8 - ./packages.nix 9 9 - ./services.nix 10 10 - ]; 11 11 - nixpkgs.config.allowUnfree = true; 12 12 - system.stateVersion = "23.11"; # Did you read the comment? 13 13 - }

-1

host-specific/misaki/coredns/localhost.hosts

··· 1 1 - 127.0.0.1 *.localhost

-11

host-specific/misaki/coredns/ngp.computer.hosts

··· 1 1 - 192.168.1.3 img.ngp.computer 2 2 - 192.168.1.3 photos.ngp.computer 3 3 - 192.168.1.3 misaki.ngp.computer 4 4 - 192.168.1.3 files.ngp.computer 5 5 - 192.168.1.3 cache.ngp.computer 6 6 - 7 7 - fe80::9ab7:85ff:fe1e:dfe8 img.ngp.computer 8 8 - fe80::9ab7:85ff:fe1e:dfe8 photos.ngp.computer 9 9 - fe80::9ab7:85ff:fe1e:dfe8 misaki.ngp.computer 10 10 - fe80::9ab7:85ff:fe1e:dfe8 files.ngp.computer 11 11 - fe80::9ab7:85ff:fe1e:dfe8 cache.ngp.computer

-17

host-specific/misaki/coredns/packetlost.dev.hosts

··· 1 1 - # Services 2 2 - 192.168.1.3 git.packetlost.dev 3 3 - 192.168.1.3 plex.packetlost.dev 4 4 - 192.168.1.3 jellyfin.packetlost.dev 5 5 - 192.168.1.3 nats.packetlost.dev 6 6 - 7 7 - # LAN Hosts 8 8 - 192.168.1.3 misaki.packetlost.dev misaki 9 9 - 192.168.1.3 cache.packetlost.dev cache 10 10 - 192.168.1.5 komoe.packetlost.dev komoe 11 11 - 192.168.1.6 rainbow.packetlost.dev rainbow 12 12 - 192.168.1.10 ichika.packetlost.dev ichika 13 13 - 192.168.1.11 futaba.packetlost.dev futaba 14 14 - 192.168.1.12 mitsumi.packetlost.dev mitsumi 15 15 - 192.168.1.13 orangepi5.packetlost.dev orangepi5 16 16 - 192.168.1.30 touma.packetlost.dev touma 17 17 - 192.168.1.33 kamijou.packetlost.dev kamijou

-91

host-specific/misaki/hardware-configuration.nix

··· 1 1 - # Do not modify this file! It was generated by ‘nixos-generate-config’ 2 2 - # and may be overwritten by future invocations. Please make changes 3 3 - # to /etc/nixos/configuration.nix instead. 4 4 - { 5 5 - config, 6 6 - lib, 7 7 - pkgs, 8 8 - modulesPath, 9 9 - ... 10 10 - }: 11 11 - 12 12 - { 13 13 - imports = [ 14 14 - (modulesPath + "/installer/scan/not-detected.nix") 15 15 - ]; 16 16 - 17 17 - boot.kernelPackages = pkgs.linuxPackages; 18 18 - boot.initrd.availableKernelModules = [ 19 19 - "nvme" 20 20 - "xhci_pci" 21 21 - "ahci" 22 22 - "usbhid" 23 23 - "usb_storage" 24 24 - "sd_mod" 25 25 - "dm-raid" 26 26 - "raid1" 27 27 - ]; 28 28 - boot.initrd.kernelModules = [ 29 29 - "dm-snapshot" 30 30 - "dm-raid" 31 31 - "raid1" 32 32 - ]; 33 33 - boot.kernelModules = [ 34 34 - "kvm-amd" 35 35 - "zfs" 36 36 - ]; 37 37 - boot.kernelParams = [ "i915.enable_guc=3" ]; 38 38 - boot.extraModulePackages = [ ]; 39 39 - 40 40 - fileSystems."/" = { 41 41 - device = "/dev/disk/by-uuid/1988fa0d-ff4a-44aa-a93e-7f0bf3cea5cf"; 42 42 - fsType = "ext4"; 43 43 - }; 44 44 - 45 45 - fileSystems."/boot" = { 46 46 - device = "/dev/disk/by-uuid/81D4-01CD"; 47 47 - fsType = "vfat"; 48 48 - }; 49 49 - 50 50 - swapDevices = [ ]; 51 51 - 52 52 - # Enables DHCP on each ethernet and wireless interface. In case of scripted networking 53 53 - # (the default) this is the recommended approach. When using systemd-networkd it's 54 54 - # still possible to use this option, but it's recommended to use it in conjunction 55 55 - # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`. 56 56 - networking.useDHCP = lib.mkDefault true; 57 57 - # networking.interfaces.enp4s0f0.useDHCP = lib.mkDefault true; 58 58 - # networking.interfaces.enp4s0f1.useDHCP = lib.mkDefault true; 59 59 - # networking.interfaces.enp6s0.useDHCP = lib.mkDefault true; 60 60 - 61 61 - nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; 62 62 - hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; 63 63 - 64 64 - #nixpkgs.config.packageOverrides = pkgs: { 65 65 - # vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; }; 66 66 - #}; 67 67 - hardware.graphics = { 68 68 - enable = true; 69 69 - extraPackages = with pkgs; [ 70 70 - intel-media-driver 71 71 - #vaapiVdpau 72 72 - #libvdpau-va-gl # unmaintained, very old 73 73 - intel-compute-runtime 74 74 - vpl-gpu-rt 75 75 - ]; 76 76 - #extraPackages32 = with pkgs; [ 77 77 - # intel-media-driver 78 78 - # vaapiVdpau 79 79 - # #libvdpau-va-gl 80 80 - # intel-compute-runtime 81 81 - # vpl-gpu-rt 82 82 - #]; 83 83 - }; 84 84 - environment.variables = { 85 85 - VDPAU_DRIVER = "va_gl"; 86 86 - LIBVA_DRIVER_NAME = "iHD"; 87 87 - LIBVA_DRIVERS_PATH = "/run/opengl-driver/lib/dri"; 88 88 - GST_VAAPI_ALL_DRIVERS = "1"; 89 89 - }; 90 90 - #services.xserver.videoDrivers = [ "intel" ]; 91 91 - }

-115

host-specific/misaki/networking.nix

··· 1 1 - { config, ... }: 2 2 - { 3 3 - # networking.hostName = "nixos"; # Define your hostname. 4 4 - # Pick only one of the below networking options. 5 5 - # networking.wireless.enable = true; # Enables wireless support via wpa_supplicant. 6 6 - # networking.networkmanager.enable = true; # Easiest to use and most distros use this by default. 7 7 - networking.hostName = "misaki"; 8 8 - # I like systemd-networkd 9 9 - systemd.network.enable = true; 10 10 - systemd.network.networks."50-wlp2s0" = { 11 11 - matchConfig.name = "wlp2s0"; 12 12 - networkConfig.DHCP = "yes"; 13 13 - linkConfig.RequiredForOnline = "no"; 14 14 - }; 15 15 - 16 16 - networking.tempAddresses = "disabled"; 17 17 - 18 18 - networking.interfaces = { 19 19 - enp4s0f1 = { 20 20 - ipv4.addresses = [ 21 21 - { 22 22 - address = "192.168.1.3"; 23 23 - prefixLength = 24; 24 24 - } 25 25 - ]; 26 26 - }; 27 27 - }; 28 28 - networking.defaultGateway = { 29 29 - address = "192.168.1.1"; 30 30 - interface = "enp4s0f1"; 31 31 - }; 32 32 - 33 33 - networking.defaultGateway6 = { 34 34 - address = "fe80::2870:4eff:fe84:d884"; 35 35 - interface = "enp4s0f1"; 36 36 - }; 37 37 - 38 38 - networking.nameservers = [ 39 39 - "192.168.1.3" 40 40 - "45.90.28.93" 41 41 - "45.90.30.93" 42 42 - ]; 43 43 - 44 44 - # This is necessary for ZFS 45 45 - networking.hostId = "5beebabe"; 46 46 - 47 47 - networking.useNetworkd = true; 48 48 - # TODO: static IP @ 192.168.1.2 49 49 - 50 50 - # Configure network proxy if necessary 51 51 - # networking.proxy.default = "http://user:password@proxy:port/"; 52 52 - # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; 53 53 - # Open ports in the firewall. 54 54 - # networking.firewall.allowedTCPPorts = [ ... ]; 55 55 - # networking.firewall.allowedUDPPorts = [ ... ]; 56 56 - # Or disable the firewall altogether. 57 57 - # TODO: allow some ports 58 58 - networking.firewall = { 59 59 - enable = true; 60 60 - allowPing = true; 61 61 - trustedInterfaces = [ 62 62 - "tailscale0" 63 63 - ]; 64 64 - allowedUDPPorts = [ 65 65 - # DNS 66 66 - 53 67 67 - config.services.tailscale.port 68 68 - ]; 69 69 - allowedTCPPorts = [ 70 70 - # DNS over TCP 71 71 - 53 72 72 - # NFSv4 73 73 - 2049 74 74 - # HTTP(s) 75 75 - 443 76 76 - 80 77 77 - # iperf3 78 78 - 5201 79 79 - 5301 80 80 - 5401 81 81 - # NATS 82 82 - 4222 83 83 - # Prometheus 84 84 - 9001 85 85 - # Minio 86 86 - 9003 87 87 - # Minio web 88 88 - 9004 89 89 - # AFP via Netatalk 90 90 - 548 91 91 - #9p 92 92 - 564 93 93 - # Misc development 94 94 - 3000 95 95 - ]; 96 96 - }; 97 97 - 98 98 - services.tailscale.useRoutingFeatures = "both"; 99 99 - 100 100 - services.avahi = { 101 101 - enable = true; 102 102 - nssmdns4 = true; 103 103 - nssmdns6 = true; 104 104 - ipv6 = true; 105 105 - openFirewall = true; 106 106 - publish = { 107 107 - enable = true; 108 108 - addresses = true; 109 109 - workstation = true; 110 110 - userServices = true; 111 111 - domain = true; 112 112 - }; 113 113 - }; 114 114 - 115 115 - }

-67

host-specific/misaki/packages.nix

··· 1 1 - { 2 2 - pkgs, 3 3 - lib, 4 4 - inputs, 5 5 - ... 6 6 - }: 7 7 - { 8 8 - 9 9 - # List packages installed in system profile. To search, run: 10 10 - # $ nix search wget 11 11 - environment.systemPackages = with pkgs; [ 12 12 - neovim 13 13 - appimage-run 14 14 - wget 15 15 - kitty 16 16 - w3m 17 17 - fishPlugins.fzf-fish 18 18 - fzf 19 19 - qemu 20 20 - OVMF 21 21 - metastore 22 22 - # 9p 23 23 - diod 24 24 - plan9port 25 25 - vis 26 26 - rc 27 27 - ncdu 28 28 - inputs.agenix.packages."${system}".agenix 29 29 - 30 30 - # ZFS / filesystem stuff 31 31 - zfs 32 32 - 33 33 - # GPU stuff 34 34 - intel-gpu-tools 35 35 - #(ffmpeg-full.override { 36 36 - # withUnfree = true; 37 37 - # withMfx = false; 38 38 - # withSmallBuild = false; 39 39 - # withTensorflow = false; 40 40 - #}) 41 41 - libva 42 42 - libva-utils 43 43 - nvtopPackages.intel 44 44 - ]; 45 45 - 46 46 - # Fix dynamically linked libraries for unpackaged binaries 47 47 - programs.nix-ld = { 48 48 - enable = true; 49 49 - libraries = with pkgs; [ 50 50 - # Add missing dynamic libraries for unpackaged programs HERE 51 51 - # NOT in environment.systemPackages 52 52 - zlib 53 53 - ]; 54 54 - }; 55 55 - 56 56 - programs.fuse.userAllowOther = true; 57 57 - 58 58 - # Whitelist some unfree packages 59 59 - #nixpkgs.config.allowUnfreePredicate = 60 60 - # pkg: 61 61 - # builtins.elem (lib.getName pkg) [ 62 62 - # "tailscale" 63 63 - # "plexmediaserver" 64 64 - # "teamspeak-server" 65 65 - # "ffmpeg-full" 66 66 - # ]; 67 67 - }

-3

host-specific/misaki/scripts/fix-jpeg-raw-duplicates-immich.rcsh

··· 1 1 - #!/usr/bin/env rc 2 2 - 3 3 - nix run 'github:nixos/nixpkgs?ref=nixos-unstable-small#immich-go' -- stack -k `{pa show immich-api} -s 'https://photos.ngp.computer' --manage-raw-jpeg StackCoverJPG

-13

host-specific/misaki/scripts/nr

··· 1 1 - #!/usr/bin/env rc 2 2 - 3 3 - flag x + 4 4 - 5 5 - if(~ $1 -x) { 6 6 - flake e + 7 7 - shift 8 8 - } 9 9 - 10 10 - pkg=$1 11 11 - shift 12 12 - 13 13 - exec nix run --impure 'nixpkgs#'^$pkg -- $*

-8

host-specific/misaki/scripts/oclip

··· 1 1 - #!/usr/bin/env rc 2 2 - flag e + 3 3 - 4 4 - if (~ $1 -x) { 5 5 - flag x + 6 6 - } 7 7 - data=`{base64 <[0=0]} 8 8 - printf '\033]52;c;%s\007' $"data

-14

host-specific/misaki/scripts/update-src

··· 1 1 - #!/usr/bin/env rc 2 2 - 3 3 - background=() 4 4 - for(repo in `{cat downstream}) { 5 5 - echo Updating $repo 6 6 - git -C $repo fetch --all --tags --prune --force & 7 7 - background=($apid $background) 8 8 - } 9 9 - 10 10 - for (i in $background) { 11 11 - wait $i 12 12 - } 13 13 - 14 14 - echo Done!

-578

host-specific/misaki/services.nix

··· 1 1 - { 2 2 - config, 3 3 - pkgs, 4 4 - unstable, 5 5 - ... 6 6 - }: 7 7 - { 8 8 - 9 9 - services.zfs = { 10 10 - autoScrub.enable = true; 11 11 - }; 12 12 - services.nfs.server.enable = true; 13 13 - # Some programs need SUID wrappers, can be configured further or are 14 14 - # started in user sessions. 15 15 - # programs.mtr.enable = true; 16 16 - programs.gnupg.agent = { 17 17 - enable = true; 18 18 - enableSSHSupport = false; 19 19 - }; 20 20 - 21 21 - # Fish shell, the best 22 22 - programs.fish.enable = true; 23 23 - 24 24 - # MOSH, SSH over flakey connections 25 25 - programs.mosh.enable = true; 26 26 - 27 27 - # List services that you want to enable: 28 28 - 29 29 - # Enable the OpenSSH daemon. 30 30 - services.openssh = { 31 31 - enable = true; 32 32 - openFirewall = true; 33 33 - settings.PasswordAuthentication = false; 34 34 - }; 35 35 - 36 36 - # This option is for enabling the bolt daemon for managing Thunderbolt/USB4 Devices. 37 37 - services.hardware.bolt.enable = true; 38 38 - 39 39 - services.ergochat.enable = true; 40 40 - 41 41 - # Containers and VMs 42 42 - virtualisation = { 43 43 - podman = { 44 44 - enable = true; 45 45 - dockerCompat = true; 46 46 - defaultNetwork.settings.dns_enabled = true; 47 47 - }; 48 48 - }; 49 49 - 50 50 - # Samba, for shares 51 51 - # TODO 52 52 - services.samba = { 53 53 - enable = true; 54 54 - openFirewall = true; 55 55 - nmbd.enable = true; 56 56 - winbindd.enable = true; 57 57 - settings = { 58 58 - global = { 59 59 - workgroup = "WORKGROUP"; 60 60 - "server string" = "misaki"; 61 61 - security = "user"; 62 62 - "use sendfile" = "yes"; 63 63 - "hosts allow" = "192.168.1. 127.0.0.1 localhost"; 64 64 - "hosts deny" = "0.0.0.0/0"; 65 65 - "guest account" = "nobody"; 66 66 - "map to guest" = "bad user"; 67 67 - deadtime = 30; 68 68 - }; 69 69 - shokuhou = { 70 70 - path = "/srv/shokuhou"; 71 71 - browseable = "yes"; 72 72 - "read only" = "no"; 73 73 - "guest ok" = "no"; 74 74 - "create mask" = "0644"; 75 75 - "directory mask" = "0755"; 76 76 - "force user" = "noah"; 77 77 - "force group" = "nas"; 78 78 - }; 79 79 - mentalout = { 80 80 - path = "/srv/mentalout"; 81 81 - browseable = "yes"; 82 82 - "read only" = "no"; 83 83 - "guest ok" = "no"; 84 84 - "create mask" = "0644"; 85 85 - "directory mask" = "0755"; 86 86 - "force user" = "noah"; 87 87 - "force group" = "nas"; 88 88 - }; 89 89 - }; 90 90 - }; 91 91 - services.samba-wsdd = { 92 92 - enable = true; 93 93 - openFirewall = true; 94 94 - }; 95 95 - 96 96 - services.coredns = { 97 97 - enable = true; 98 98 - config = '' 99 99 - packetlost.dev { 100 100 - hosts ${./coredns/packetlost.dev.hosts} packetlost.dev { 101 101 - fallthrough 102 102 - } 103 103 - bind enp4s0f1 104 104 - } 105 105 - ngp.computer { 106 106 - hosts ${./coredns/ngp.computer.hosts} ngp.computer { 107 107 - fallthrough 108 108 - } 109 109 - bind enp4s0f1 110 110 - } 111 111 - localhost { 112 112 - hosts ${./coredns/localhost.hosts} localhost { 113 113 - fallthrough 114 114 - } 115 115 - bind enp4s0f1 116 116 - } 117 117 - . { 118 118 - # NextDNS 119 119 - forward . tls://2a07:a8c0::dd:2feb:853 tls://2a07:a8c1::dd:2feb:853 tls://45.90.28.93:853 tls://45.90.30.93:853 { 120 120 - tls_servername dd2feb.dns.nextdns.io 121 121 - health_check 5s 122 122 - } 123 123 - bind enp4s0f1 124 124 - cache 125 125 - errors 126 126 - log 127 127 - } 128 128 - ''; 129 129 - }; 130 130 - 131 131 - services.nats = { 132 132 - enable = true; 133 133 - jetstream = true; 134 134 - user = "nats"; 135 135 - group = "nats"; 136 136 - serverName = "misaki"; 137 137 - dataDir = "/srv/shokuhou/applications/nats"; 138 138 - validateConfig = false; 139 139 - settings = { 140 140 - authorization = { 141 141 - users = [ 142 142 - { 143 143 - user = "seedbox@packetlost.dev"; 144 144 - permissions = { 145 145 - publish = [ 146 146 - "torrents" 147 147 - "torrents.>" 148 148 - "$JS.API.INFO" 149 149 - #"$JS.API.STREAM.INFO.>" 150 150 - "$KV.torrents.>" 151 151 - #"$JS.API.STREAM.*.*.OBJ_torrents" 152 152 - "$JS.API.*.*.OBJ_torrents" 153 153 - "$JS.API.STREAM.MSG.GET.OBJ_torrents" 154 154 - "$JS.API.*.*.OBJ_torrents.>" 155 155 - "$O.torrents.>" 156 156 - ]; 157 157 - subscribe = [ 158 158 - "torrents.>" 159 159 - "_INBOX.>" 160 160 - ]; 161 161 - allow_responses = false; 162 162 - }; 163 163 - } 164 164 - { user = "odin@packetlost.dev"; } 165 165 - { user = "misaki@packetlost.dev"; } 166 166 - { user = "noah@packetlost.dev"; } 167 167 - { user = "touma-nixos@packetlost.dev"; } 168 168 - ]; 169 169 - }; 170 170 - tls = { 171 171 - cert_file = "/srv/nats/nats.packetlost.dev/cert.pem"; 172 172 - key_file = "/srv/nats/nats.packetlost.dev/key.pem"; 173 173 - ca_file = "/srv/nats/minica.pem"; 174 174 - verify_and_map = true; 175 175 - }; 176 176 - jetstream = { 177 177 - # 50GB 178 178 - max_file_store = 53687091200; 179 179 - max_mem = 8589934592; 180 180 - }; 181 181 - }; 182 182 - }; 183 183 - 184 184 - # Minio's object storage has been mostly replaced with NATS. If I specifically need a 185 185 - # S3-like API, this will be revived. 186 186 - services.minio = { 187 187 - enable = false; 188 188 - listenAddress = ":9003"; 189 189 - consoleAddress = ":9004"; 190 190 - dataDir = [ 191 191 - /srv/shokuhou/applications/minio 192 192 - ]; 193 193 - }; 194 194 - 195 195 - services.netatalk = { 196 196 - enable = true; 197 197 - settings = { 198 198 - time-machine = { 199 199 - path = "/srv/shokuhou/backup/timemachine"; 200 200 - "valid users" = "noah"; 201 201 - "time machine" = true; 202 202 - }; 203 203 - }; 204 204 - }; 205 205 - 206 206 - services.webdav.enable = false; 207 207 - services.sftpgo = { 208 208 - enable = false; 209 209 - dataDir = /srv/shokuhou/documents/sftpgo; 210 210 - group = "nas"; 211 211 - }; 212 212 - services.syncthing = { 213 213 - enable = false; 214 214 - openDefaultPorts = true; 215 215 - # disable the sync folder creation 216 216 - extraFlags = [ "--no-default-folder" ]; 217 217 - settings = { 218 218 - folders = { 219 219 - "Sync" = { 220 220 - path = "/srv/shokuhou/documents/sync"; 221 221 - }; 222 222 - }; 223 223 - }; 224 224 - }; 225 225 - 226 226 - services.grafana = { 227 227 - enable = false; 228 228 - settings.server.http_port = 2342; 229 229 - settings.server.domain = "grafana.packetlost.dev"; 230 230 - settings.server.http_addr = "127.0.0.1"; 231 231 - }; 232 232 - 233 233 - services.prometheus = { 234 234 - enable = false; 235 235 - port = 9001; 236 236 - exporters = { 237 237 - node = { 238 238 - enable = true; 239 239 - enabledCollectors = [ "systemd" ]; 240 240 - port = 9002; 241 241 - }; 242 242 - }; 243 243 - 244 244 - scrapeConfigs = [ 245 245 - { 246 246 - job_name = "chrysalis"; 247 247 - static_configs = [ 248 248 - { targets = [ "127.0.0.1:${builtins.toString config.services.prometheus.exporters.node.port}" ]; } 249 249 - ]; 250 250 - } 251 251 - ]; 252 252 - }; 253 253 - 254 254 - # TODO: figure out how to appropriately configure this 255 255 - services.step-ca = { 256 256 - enable = false; 257 257 - openFirewall = true; 258 258 - port = 8443; 259 259 - address = "0.0.0.0"; 260 260 - intermediatePasswordFile = /etc/nixos/step-ca-intermediate-ca-password; 261 261 - settings = builtins.fromJSON (builtins.readFile /home/noah/.step/config/ca.json); 262 262 - }; 263 263 - 264 264 - age.secrets.acme = { 265 265 - file = ../../secrets/porkbun-api-key.age; 266 266 - owner = "root"; 267 267 - group = "acme"; 268 268 - }; 269 269 - 270 270 - security.acme = { 271 271 - acceptTerms = true; 272 272 - defaults.email = "noah@packetlost.dev"; 273 273 - certs."plex.packetlost.dev" = { 274 274 - group = "httpd"; 275 275 - dnsProvider = "porkbun"; 276 276 - environmentFile = config.age.secrets.acme.path; 277 277 - }; 278 278 - certs."img.ngp.computer" = { 279 279 - group = "httpd"; 280 280 - dnsProvider = "porkbun"; 281 281 - environmentFile = config.age.secrets.acme.path; 282 282 - }; 283 283 - certs."files.ngp.computer" = { 284 284 - group = "httpd"; 285 285 - dnsProvider = "porkbun"; 286 286 - environmentFile = config.age.secrets.acme.path; 287 287 - }; 288 288 - certs."cache.ngp.computer" = { 289 289 - group = "httpd"; 290 290 - dnsProvider = "porkbun"; 291 291 - environmentFile = config.age.secrets.acme.path; 292 292 - }; 293 293 - certs."photos.ngp.computer" = { 294 294 - group = "httpd"; 295 295 - dnsProvider = "porkbun"; 296 296 - environmentFile = config.age.secrets.acme.path; 297 297 - }; 298 298 - certs."jellyfin.packetlost.dev" = { 299 299 - group = "httpd"; 300 300 - dnsProvider = "porkbun"; 301 301 - environmentFile = config.age.secrets.acme.path; 302 302 - }; 303 303 - }; 304 304 - 305 305 - # A test email server that only works on LAN 306 306 - services.maddy = { 307 307 - enable = true; 308 308 - openFirewall = true; 309 309 - primaryDomain = "misaki.local"; 310 310 - ensureAccounts = [ 311 311 - "noah@misaki.local" 312 312 - "postmaster@misaki.local" 313 313 - "test@misaki.local" 314 314 - ]; 315 315 - ensureCredentials = { 316 316 - "noah@misaki.local".passwordFile = "${pkgs.writeText "noah" "Password123"}"; 317 317 - "postmaster@misaki.local".passwordFile = "${pkgs.writeText "noah" "Password123"}"; 318 318 - "test@misaki.local".passwordFile = "${pkgs.writeText "test" "Password123"}"; 319 319 - }; 320 320 - }; 321 321 - 322 322 - age.secrets.nix-serve = { 323 323 - file = ../../secrets/nix-serve-secret-key.age; 324 324 - owner = "root"; 325 325 - group = "root"; 326 326 - }; 327 327 - services.nix-serve = { 328 328 - enable = true; 329 329 - package = unstable.nix-serve-ng; 330 330 - secretKeyFile = config.age.secrets.nix-serve.path; 331 331 - openFirewall = true; 332 332 - }; 333 333 - 334 334 - services.plex = { 335 335 - enable = true; 336 336 - openFirewall = false; # we proxy this with nginx 337 337 - group = "nas"; 338 338 - user = "noah"; 339 339 - package = unstable.plex; 340 340 - }; 341 341 - 342 342 - services.jellyfin = { 343 343 - enable = true; 344 344 - openFirewall = true; 345 345 - user = "noah"; 346 346 - group = "nas"; 347 347 - logDir = "/srv/shokuhou/applications/jellyfin/log"; 348 348 - cacheDir = "/srv/shokuhou/applications/jellyfin/cache"; 349 349 - dataDir = "/srv/shokuhou/applications/jellyfin/data"; 350 350 - configDir = "/srv/shokuhou/applications/jellyfin/config"; 351 351 - }; 352 352 - 353 353 - services.gitea = { 354 354 - enable = false; 355 355 - user = "git"; 356 356 - domain = "git.packetlost.dev"; 357 357 - }; 358 358 - 359 359 - # Litterbox, collect my IRC logs 360 360 - systemd = { 361 361 - services = { 362 362 - "litterbox@" = { 363 363 - path = [ pkgs.litterbox ]; 364 364 - serviceConfig = { 365 365 - StartLimitIntervalSec = 5; 366 366 - StartLimitBurst = 10; 367 367 - Restart = "on-failure"; 368 368 - RestartSec = "10s"; 369 369 - Type = "simple"; 370 370 - ExecStart = "${pkgs.litterbox}/bin/litterbox /srv/litterbox/%i.conf"; 371 371 - ExecReload = "kill -USR1 $MAINPID"; 372 372 - User = "noah"; 373 373 - Group = "litterbox"; 374 374 - }; 375 375 - }; 376 376 - 377 377 - #"litterbox@libera.irc.packetlost.dev" = { 378 378 - # overrideStrategy = "asDropin"; 379 379 - # wantedBy = [ "multi-user.target" ]; 380 380 - #}; 381 381 - "update-downstream-src" = { 382 382 - path = with pkgs; [ 383 383 - rc 384 384 - coreutils 385 385 - git 386 386 - openssh 387 387 - ]; 388 388 - script = "exec ${./scripts/update-src}"; 389 389 - serviceConfig = { 390 390 - Type = "oneshot"; 391 391 - User = "noah"; 392 392 - WorkingDirectory = "/srv/src"; 393 393 - }; 394 394 - }; 395 395 - }; 396 396 - timers = { 397 397 - "update-downstream-src" = { 398 398 - wantedBy = [ "timers.target" ]; 399 399 - timerConfig = { 400 400 - OnCalendar = "daily"; 401 401 - Persistent = true; 402 402 - }; 403 403 - }; 404 404 - }; 405 405 - }; 406 406 - 407 407 - services.teamspeak3 = { 408 408 - enable = true; 409 409 - openFirewall = true; 410 410 - }; 411 411 - 412 412 - services.immich = { 413 413 - enable = true; 414 414 - package = unstable.immich; 415 415 - accelerationDevices = [ "/dev/dri/renderD128" ]; 416 416 - mediaLocation = "/srv/shokuhou/pictures/immich"; 417 417 - }; 418 418 - users.users.immich.extraGroups = [ 419 419 - "video" 420 420 - "render" 421 421 - "nas" 422 422 - ]; 423 423 - 424 424 - # Nginx Reverse SSL Proxy 425 425 - services.nginx = { 426 426 - enable = true; 427 427 - group = "nas"; 428 428 - user = "noah"; 429 429 - recommendedGzipSettings = true; 430 430 - recommendedOptimisation = true; 431 431 - #recommendedProxySettings = true; 432 432 - recommendedTlsSettings = true; 433 433 - 434 434 - virtualHosts."photos.ngp.computer" = { 435 435 - enableACME = true; 436 436 - acmeRoot = null; 437 437 - forceSSL = true; 438 438 - locations."/" = { 439 439 - proxyPass = "http://[::1]:${toString config.services.immich.port}"; 440 440 - proxyWebsockets = true; 441 441 - recommendedProxySettings = true; 442 442 - extraConfig = '' 443 443 - client_max_body_size 50000M; 444 444 - proxy_read_timeout 600s; 445 445 - proxy_send_timeout 600s; 446 446 - send_timeout 600s; 447 447 - ''; 448 448 - }; 449 449 - }; 450 450 - virtualHosts."img.ngp.computer" = { 451 451 - forceSSL = true; 452 452 - enableACME = true; 453 453 - acmeRoot = null; 454 454 - root = "/srv/shokuhou/pictures/public"; 455 455 - extraConfig = '' 456 456 - sendfile on; 457 457 - autoindex_exact_size on; 458 458 - tcp_nopush on; 459 459 - ''; 460 460 - locations."/" = { 461 461 - extraConfig = '' 462 462 - autoindex on; 463 463 - autoindex_exact_size on; 464 464 - alias /srv/shokuhou/pictures/public/$1; 465 465 - ''; 466 466 - }; 467 467 - }; 468 468 - virtualHosts."files.ngp.computer" = { 469 469 - forceSSL = true; 470 470 - enableACME = true; 471 471 - acmeRoot = null; 472 472 - root = null; 473 473 - extraConfig = '' 474 474 - sendfile on; 475 475 - tcp_nopush on; 476 476 - ''; 477 477 - locations."/books/" = { 478 478 - extraConfig = '' 479 479 - autoindex on; 480 480 - autoindex_exact_size on; 481 481 - alias /srv/shokuhou/books/sync/$1; 482 482 - ''; 483 483 - }; 484 484 - }; 485 485 - virtualHosts."jellyfin.packetlost.dev" = { 486 486 - forceSSL = true; 487 487 - enableACME = true; 488 488 - acmeRoot = null; 489 489 - http2 = true; 490 490 - locations."/" = { 491 491 - proxyPass = "http://localhost:8096/"; 492 492 - }; 493 493 - }; 494 494 - virtualHosts."cache.ngp.computer" = { 495 495 - forceSSL = true; 496 496 - enableACME = true; 497 497 - acmeRoot = null; 498 498 - http2 = true; 499 499 - locations."/".proxyPass = 500 500 - "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}"; 501 501 - }; 502 502 - 503 503 - # give a name to the virtual host. It also becomes the server name. 504 504 - virtualHosts."plex.packetlost.dev" = { 505 505 - # Since we want a secure connection, we force SSL 506 506 - forceSSL = true; 507 507 - enableACME = true; 508 508 - acmeRoot = null; 509 509 - 510 510 - # http2 can more performant for streaming: https://blog.cloudflare.com/introducing-http2/ 511 511 - http2 = true; 512 512 - 513 513 - # Provide the ssl cert and key for the vhost 514 514 - # These are filled in automatically with ACME 515 515 - extraConfig = '' 516 516 - 517 517 - #Some players don't reopen a socket and playback stops totally instead of resuming after an extended pause 518 518 - send_timeout 100m; 519 519 - 520 520 - # Why this is important: https://blog.cloudflare.com/ocsp-stapling-how-cloudflare-just-made-ssl-30/ 521 521 - ssl_stapling on; 522 522 - ssl_stapling_verify on; 523 523 - 524 524 - ssl_protocols TLSv1 TLSv1.1 TLSv1.2; 525 525 - ssl_prefer_server_ciphers on; 526 526 - #Intentionally not hardened for security for player support and encryption video streams has a lot of overhead with something like AES-256-GCM-SHA384. 527 527 - ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA'; 528 528 - 529 529 - # Forward real ip and host to Plex 530 530 - proxy_set_header X-Real-IP $remote_addr; 531 531 - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 532 532 - proxy_set_header X-Forwarded-Proto $scheme; 533 533 - proxy_set_header Host $server_addr; 534 534 - proxy_set_header Referer $server_addr; 535 535 - proxy_set_header Origin $server_addr; 536 536 - 537 537 - # Plex has A LOT of javascript, xml and html. This helps a lot, but if it causes playback issues with devices turn it off. 538 538 - gzip on; 539 539 - gzip_vary on; 540 540 - gzip_min_length 1000; 541 541 - gzip_proxied any; 542 542 - gzip_types text/plain text/css text/xml application/xml text/javascript application/x-javascript image/svg+xml; 543 543 - gzip_disable "MSIE [1-6]\."; 544 544 - 545 545 - # Nginx default client_max_body_size is 1MB, which breaks Camera Upload feature from the phones. 546 546 - # Increasing the limit fixes the issue. Anyhow, if 4K videos are expected to be uploaded, the size might need to be increased even more 547 547 - client_max_body_size 100M; 548 548 - 549 549 - # Plex headers 550 550 - proxy_set_header X-Plex-Client-Identifier $http_x_plex_client_identifier; 551 551 - proxy_set_header X-Plex-Device $http_x_plex_device; 552 552 - proxy_set_header X-Plex-Device-Name $http_x_plex_device_name; 553 553 - proxy_set_header X-Plex-Platform $http_x_plex_platform; 554 554 - proxy_set_header X-Plex-Platform-Version $http_x_plex_platform_version; 555 555 - proxy_set_header X-Plex-Product $http_x_plex_product; 556 556 - proxy_set_header X-Plex-Token $http_x_plex_token; 557 557 - proxy_set_header X-Plex-Version $http_x_plex_version; 558 558 - proxy_set_header X-Plex-Nocache $http_x_plex_nocache; 559 559 - proxy_set_header X-Plex-Provides $http_x_plex_provides; 560 560 - proxy_set_header X-Plex-Device-Vendor $http_x_plex_device_vendor; 561 561 - proxy_set_header X-Plex-Model $http_x_plex_model; 562 562 - 563 563 - # Websockets 564 564 - proxy_http_version 1.1; 565 565 - proxy_set_header Upgrade $http_upgrade; 566 566 - proxy_set_header Connection "upgrade"; 567 567 - 568 568 - # Buffering off send to the client as soon as the data is received from Plex. 569 569 - proxy_redirect off; 570 570 - proxy_buffering off; 571 571 - ''; 572 572 - 573 573 - locations."/" = { 574 574 - proxyPass = "http://localhost:32400/"; 575 575 - }; 576 576 - }; 577 577 - }; 578 578 - }

-6

host-specific/misaki/users.nix

··· 1 1 - { ... }: 2 2 - { 3 3 - users.groups.nas.gid = 1001; 4 4 - users.groups.httpd.gid = 1002; 5 5 - users.groups.litterbox.gid = 1003; 6 6 - }

-6

host-specific/odin/boot.nix

··· 1 1 - { ... }: 2 2 - { 3 3 - # Use the systemd-boot EFI boot loader. 4 4 - boot.loader.systemd-boot.enable = true; 5 5 - boot.loader.efi.canTouchEfiVariables = true; 6 6 - }

-62

host-specific/odin/configuration.nix

··· 1 1 - # Edit this configuration file to define what should be installed on 2 2 - ## your system. Help is available in the configuration.nix(5) man page, on 3 3 - # https://search.nixos.org/options and in the NixOS manual (`nixos-help`). 4 4 - 5 5 - { ... }: 6 6 - { 7 7 - imports = [ 8 8 - # Include the results of the hardware scan. 9 9 - ./hardware-configuration.nix 10 10 - ./boot.nix 11 11 - ./networking.nix 12 12 - #./gui.nix 13 13 - ./packages.nix 14 14 - ./services.nix 15 15 - ]; 16 16 - 17 17 - nixpkgs.config.allowUnfree = true; 18 18 - 19 19 - # Set your time zone. 20 20 - time.timeZone = "America/Chicago"; 21 21 - 22 22 - # Select internationalisation properties. 23 23 - i18n.defaultLocale = "en_US.UTF-8"; 24 24 - # console = { 25 25 - # font = "Lat2-Terminus16"; 26 26 - # keyMap = "us"; 27 27 - # useXkbConfig = true; # use xkb.options in tty. 28 28 - # }; 29 29 - 30 30 - # Automatic doc cache generation 31 31 - documentation.man.generateCaches = true; 32 32 - 33 33 - # Automatic system upgrades 34 34 - system.autoUpgrade = { 35 35 - enable = true; 36 36 - dates = "09:00"; 37 37 - randomizedDelaySec = "45min"; 38 38 - }; 39 39 - 40 40 - # Automatic Garbage Collection 41 41 - nix.gc.automatic = true; 42 42 - nix.gc.options = "--delete-older-than 8d"; 43 43 - 44 44 - # This option defines the first version of NixOS you have installed on this particular machine, 45 45 - # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions. 46 46 - # 47 47 - # Most users should NEVER change this value after the initial install, for any reason, 48 48 - # even if you've upgraded your system to a new NixOS release. 49 49 - # 50 50 - # This value does NOT affect the Nixpkgs version your packages and OS are pulled from, 51 51 - # so changing it will NOT upgrade your system. 52 52 - # 53 53 - # This value being lower than the current NixOS release does NOT mean your system is 54 54 - # out of date, out of support, or vulnerable. 55 55 - # 56 56 - # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration, 57 57 - # and migrated your data accordingly. 58 58 - # 59 59 - # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion . 60 60 - system.stateVersion = "23.11"; # Did you read the comment? 61 61 - 62 62 - }

-9

host-specific/odin/default.nix

··· 1 1 - { ... }: 2 2 - { 3 3 - imports = [ 4 4 - ./hardware-configuration.nix 5 5 - ./networking.nix 6 6 - ./packages.nix 7 7 - ./services.nix 8 8 - ]; 9 9 - }

-98

host-specific/odin/gui.nix

··· 1 1 - { pkgs, ... }: 2 2 - { 3 3 - # Enable the X11 windowing system. 4 4 - services.xserver = { 5 5 - enable = true; 6 6 - videoDrivers = [ "amdgpu" ]; 7 7 - }; 8 8 - 9 9 - # Fix for HIP libraries 10 10 - systemd.tmpfiles.rules = [ 11 11 - "L+ /opt/rocm/hip - - - - ${pkgs.rocmPackages.clr}" 12 12 - ]; 13 13 - 14 14 - # Configure keymap in X11 15 15 - # services.xserver.xkb.layout = "us"; 16 16 - # services.xserver.xkb.options = "eurosign:e,caps:escape"; 17 17 - 18 18 - # Enable CUPS to print documents. 19 19 - # services.printing.enable = true; 20 20 - 21 21 - # Enable sound. 22 22 - security.rtkit.enable = true; 23 23 - services.pipewire = { 24 24 - enable = true; 25 25 - alsa.enable = true; 26 26 - alsa.support32Bit = true; 27 27 - pulse.enable = true; 28 28 - wireplumber.enable = true; 29 29 - }; 30 30 - 31 31 - # Graphics and parallel compute configuration 32 32 - hardware.graphics = { 33 33 - enable = true; 34 34 - extraPackages = with pkgs; [ 35 35 - libva 36 36 - mesa 37 37 - rocmPackages.clr.icd 38 38 - ]; 39 39 - }; 40 40 - 41 41 - # Enable touchpad support (enabled default in most desktopManager). 42 42 - # services.xserver.libinput.enable = true; 43 43 - 44 44 - # Fonts 45 45 - fonts.packages = with pkgs; [ 46 46 - fira-code 47 47 - fira-code-symbols 48 48 - noto-fonts 49 49 - noto-fonts-cjk-sans 50 50 - noto-fonts-color-emoji 51 51 - nerd-fonts.fira-code 52 52 - ]; 53 53 - 54 54 - # Polkit is a dependency of Sway. It's responsible for handling security policies 55 55 - security.polkit.enable = true; 56 56 - 57 57 - # Enable the sway window manager 58 58 - programs.sway = { 59 59 - enable = true; 60 60 - #package = unstable.sway; 61 61 - wrapperFeatures.gtk = true; 62 62 - }; 63 63 - # Use greetd as the displaymanager 64 64 - #services.xserver.displayManager.greetd.enable = true; 65 65 - #services.xserver.displayManager.lightdm.enable = false; 66 66 - services.displayManager.sddm.enable = true; 67 67 - services.displayManager.defaultSession = "sway"; 68 68 - services.displayManager.autoLogin = { 69 69 - enable = true; 70 70 - user = "noah"; 71 71 - }; 72 72 - 73 73 - # i3, for when I need XOrg 74 74 - services.xserver.windowManager.i3 = { 75 75 - enable = true; 76 76 - extraPackages = with pkgs; [ 77 77 - dmenu 78 78 - i3status 79 79 - i3lock 80 80 - i3blocks 81 81 - ]; 82 82 - }; 83 83 - 84 84 - xdg.portal = { 85 85 - enable = true; 86 86 - wlr.enable = true; 87 87 - extraPortals = [ pkgs.xdg-desktop-portal-gtk ]; 88 88 - }; 89 89 - xdg.mime = { 90 90 - enable = true; 91 91 - defaultApplications = { 92 92 - "x-scheme-handler/http" = "org.firefox.firefox.desktop"; 93 93 - "x-scheme-handler/https" = "org.firefox.firefox.desktop"; 94 94 - }; 95 95 - }; 96 96 - services.dbus.enable = true; 97 97 - services.gnome.gnome-keyring.enable = true; 98 98 - }

-93

host-specific/odin/hardware-configuration.nix

··· 1 1 - # Do not modify this file! It was generated by ‘nixos-generate-config’ 2 2 - # and may be overwritten by future invocations. Please make changes 3 3 - # to /etc/nixos/configuration.nix instead. 4 4 - { 5 5 - config, 6 6 - lib, 7 7 - modulesPath, 8 8 - pkgs, 9 9 - ... 10 10 - }: 11 11 - 12 12 - { 13 13 - imports = [ 14 14 - (modulesPath + "/installer/scan/not-detected.nix") 15 15 - ]; 16 16 - 17 17 - boot.kernelPackages = pkgs.linuxPackages_latest; 18 18 - boot.initrd.availableKernelModules = [ 19 19 - "nvme" 20 20 - "xhci_pci" 21 21 - "thunderbolt" 22 22 - "usb_storage" 23 23 - "usbhid" 24 24 - "sd_mod" 25 25 - "sdhci_pci" 26 26 - ]; 27 27 - boot.initrd.kernelModules = [ 28 28 - "kvm-amd" 29 29 - "amdgpu" 30 30 - "nvme" 31 31 - "xhci_pci" 32 32 - "thunderbolt" 33 33 - "usb_storage" 34 34 - "usbhid" 35 35 - "sd_mod" 36 36 - "sdhci_pci" 37 37 - ]; 38 38 - boot.kernelModules = [ 39 39 - "kvm-amd" 40 40 - "amdgpu" 41 41 - "nvme" 42 42 - "xhci_pci" 43 43 - "thunderbolt" 44 44 - "usb_storage" 45 45 - "usbhid" 46 46 - "sd_mod" 47 47 - "sdhci_pci" 48 48 - ]; 49 49 - virtualisation.libvirtd = { 50 50 - enable = true; 51 51 - qemu = { 52 52 - runAsRoot = false; 53 53 - }; 54 54 - }; 55 55 - #boot.extraModulePackages = with config.boot.kernelPackages; [ ]; 56 56 - boot.kernelParams = [ ]; 57 57 - 58 58 - hardware.enableRedistributableFirmware = true; 59 59 - 60 60 - fileSystems."/" = { 61 61 - device = "/dev/disk/by-uuid/07019c69-2597-410d-a8a0-a8ffb0f58883"; 62 62 - fsType = "ext4"; 63 63 - }; 64 64 - 65 65 - fileSystems."/boot" = { 66 66 - device = "/dev/disk/by-uuid/4B85-C90A"; 67 67 - fsType = "vfat"; 68 68 - }; 69 69 - 70 70 - swapDevices = [ 71 71 - { 72 72 - device = "/swapfile"; 73 73 - size = 32 * 1024; 74 74 - } 75 75 - ]; 76 76 - 77 77 - # Enables DHCP on each ethernet and wireless interface. In case of scripted networking 78 78 - # (the default) this is the recommended approach. When using systemd-networkd it's 79 79 - # still possible to use this option, but it's recommended to use it in conjunction 80 80 - # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`. 81 81 - networking.useDHCP = lib.mkDefault true; 82 82 - # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true; 83 83 - # networking.interfaces.wlp2s0.useDHCP = lib.mkDefault true; 84 84 - 85 85 - nixpkgs.hostPlatform = { 86 86 - #gcc.arch = "znver2"; 87 87 - #gcc.tune = "znver2"; 88 88 - system = "x86_64-linux"; 89 89 - #gcc.arch = "x86-64-v3"; 90 90 - }; 91 91 - #nix.settings.system-features = ["gccarch-znver2" "big-parallel" "nixos-test" "benchmark" "kvm"]; 92 92 - hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; 93 93 - }

-78

host-specific/odin/networking.nix

··· 1 1 - { ... }: 2 2 - { 3 3 - # networking.hostName = "nixos"; # Define your hostname. 4 4 - # Pick only one of the below networking options. 5 5 - # networking.wireless.enable = true; # Enables wireless support via wpa_supplicant. 6 6 - # networking.networkmanager.enable = true; # Easiest to use and most distros use this by default. 7 7 - networking.hostName = "odin"; 8 8 - # I like systemd-networkd 9 9 - systemd.network.enable = true; 10 10 - systemd.network.networks."50-wlp2s0" = { 11 11 - matchConfig.name = "wlp2s0"; 12 12 - networkConfig.DHCP = "yes"; 13 13 - linkConfig.RequiredForOnline = "no"; 14 14 - }; 15 15 - 16 16 - networking.tempAddresses = "disabled"; 17 17 - 18 18 - networking.useNetworkd = true; 19 19 - # TODO: static IP @ 192.168.1.6 20 20 - 21 21 - # Configure network proxy if necessary 22 22 - # networking.proxy.default = "http://user:password@proxy:port/"; 23 23 - # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; 24 24 - # Open ports in the firewall. 25 25 - # networking.firewall.allowedTCPPorts = [ ... ]; 26 26 - # networking.firewall.allowedUDPPorts = [ ... ]; 27 27 - # Or disable the firewall altogether. 28 28 - networking.firewall = { 29 29 - enable = true; 30 30 - allowPing = true; 31 31 - allowedUDPPorts = [ ]; 32 32 - allowedUDPPortRanges = [ ]; 33 33 - allowedTCPPorts = [ 34 34 - 2375 35 35 - 3000 36 36 - ]; 37 37 - }; 38 38 - 39 39 - services.avahi = { 40 40 - enable = true; 41 41 - nssmdns4 = true; 42 42 - nssmdns6 = true; 43 43 - ipv6 = true; 44 44 - openFirewall = true; 45 45 - publish = { 46 46 - enable = true; 47 47 - addresses = true; 48 48 - workstation = true; 49 49 - userServices = true; 50 50 - domain = true; 51 51 - }; 52 52 - }; 53 53 - 54 54 - # NFS mounts 55 55 - 56 56 - fileSystems = { 57 57 - "/srv/shokuhou" = { 58 58 - device = "192.168.1.3:/srv/shokuhou"; 59 59 - fsType = "nfs"; 60 60 - options = [ 61 61 - "nfsvers=4" 62 62 - "user" 63 63 - "x-system.automount" 64 64 - "x-system.idle-timeout=600" 65 65 - ]; 66 66 - }; 67 67 - "/srv/mentalout" = { 68 68 - device = "192.168.1.3:/srv/mentalout"; 69 69 - fsType = "nfs"; 70 70 - options = [ 71 71 - "nfsvers=4" 72 72 - "user" 73 73 - "x-system.automount" 74 74 - "x-system.idle-timeout=600" 75 75 - ]; 76 76 - }; 77 77 - }; 78 78 - }

-129

host-specific/odin/packages.nix

··· 1 1 - { pkgs, lib, ... }: 2 2 - let # bash script to let dbus know about important env variables and 3 3 - # propagate them to relevent services run at the end of sway config 4 4 - # see 5 5 - # https://github.com/emersion/xdg-desktop-portal-wlr/wiki/"It-doesn't-work"-Troubleshooting-Checklist 6 6 - # note: this is pretty much the same as /etc/sway/config.d/nixos.conf but also restarts 7 7 - # some user services to make sure they have the correct environment variables 8 8 - dbus-sway-environment = pkgs.writeTextFile { 9 9 - name = "dbus-sway-environment"; 10 10 - destination = "/bin/dbus-sway-environment"; 11 11 - executable = true; 12 12 - 13 13 - text = '' 14 14 - dbus-update-activation-environment --systemd WAYLAND_DISPLAY XDG_CURRENT_DESKTOP=sway 15 15 - systemctl --user stop pipewire pipewire-media-session xdg-desktop-portal xdg-desktop-portal-wlr 16 16 - systemctl --user start pipewire pipewire-media-session xdg-desktop-portal xdg-desktop-portal-wlr 17 17 - ''; 18 18 - }; 19 19 - 20 20 - # currently, there is some friction between sway and gtk: 21 21 - # https://github.com/swaywm/sway/wiki/GTK-3-settings-on-Wayland 22 22 - # the suggested way to set gtk settings is with gsettings 23 23 - # for gsettings to work, we need to tell it where the schemas are 24 24 - # using the XDG_DATA_DIR environment variable 25 25 - # run at the end of sway config 26 26 - configure-gtk = pkgs.writeTextFile { 27 27 - name = "configure-gtk"; 28 28 - destination = "/bin/configure-gtk"; 29 29 - executable = true; 30 30 - text = 31 31 - let 32 32 - # TODO: figure out why these bindings exist or where they're used 33 33 - schema = pkgs.gsettings-desktop-schemas; 34 34 - datadir = "${schema}/share/gsettings-schemas/${schema.name}"; 35 35 - in 36 36 - '' 37 37 - 6 gnome_schema=org.gnome.desktop.interface 38 38 - gsettings set $gnome_schema gtk-theme 'Dracula' 39 39 - ''; 40 40 - }; 41 41 - in 42 42 - { 43 43 - 44 44 - # List packages installed in system profile. To search, run: 45 45 - # $ nix search wget 46 46 - environment.systemPackages = with pkgs; [ 47 47 - neovim 48 48 - appimage-run 49 49 - tzdata 50 50 - wget 51 51 - kitty 52 52 - file 53 53 - w3m 54 54 - fishPlugins.fzf-fish 55 55 - fzf 56 56 - qemu 57 57 - qemu-user 58 58 - qemu-utils 59 59 - qemu_full 60 60 - OVMF 61 61 - #9p stuff 62 62 - diod 63 63 - plan9port 64 64 - vis 65 65 - rc 66 66 - ncdu 67 67 - 68 68 - smartmontools 69 69 - 70 70 - # Sway stuff 71 71 - wdisplays 72 72 - mako 73 73 - bemenu 74 74 - wl-clipboard 75 75 - slurp 76 76 - grim 77 77 - swayidle 78 78 - swaylock 79 79 - adwaita-icon-theme 80 80 - dracula-theme 81 81 - glib 82 82 - xdg-utils 83 83 - wayland 84 84 - configure-gtk 85 85 - dbus-sway-environment 86 86 - dbus 87 87 - pkg-config 88 88 - zlib 89 89 - # why wouldn't I want documentation on my system 90 90 - man-pages 91 91 - man-pages-posix 92 92 - perf 93 93 - ]; 94 94 - documentation.dev.enable = true; 95 95 - 96 96 - # Fix dynamically linked libraries for unpackaged binaries 97 97 - programs.nix-ld = { 98 98 - enable = true; 99 99 - libraries = with pkgs; [ 100 100 - # Add missing dynamic libraries for unpackaged programs HERE 101 101 - # NOT in environment.systemPackages 102 102 - zlib 103 103 - openssl 104 104 - sqlite 105 105 - libunwind 106 106 - libglvnd 107 107 - libclang 108 108 - systemdLibs 109 109 - ]; 110 110 - }; 111 111 - programs.nix-index = { 112 112 - enable = true; 113 113 - enableFishIntegration = true; 114 114 - enableBashIntegration = false; 115 115 - enableZshIntegration = false; 116 116 - }; 117 117 - 118 118 - # Run other bins in QEMU 119 119 - boot.binfmt.emulatedSystems = [ 120 120 - "aarch64-linux" 121 121 - "riscv64-linux" 122 122 - ]; 123 123 - # UEFI firmware support for QEMU 124 124 - systemd.tmpfiles.rules = [ "L+ /var/lib/qemu/firmware - - - - ${pkgs.qemu}/share/qemu/firmware" ]; 125 125 - 126 126 - # Logseq uses an ancient version of Electron, so we enable that 127 127 - nixpkgs.config.permittedInsecurePackages = [ "electron-25.9.0" ]; 128 128 - nixpkgs.config.allowUnfree = true; 129 129 - }

-33

host-specific/odin/services.nix

··· 1 1 - { ... }: 2 2 - { 3 3 - # Some programs need SUID wrappers, can be configured further or are 4 4 - # started in user sessions. 5 5 - # programs.mtr.enable = true; 6 6 - programs.gnupg.agent = { 7 7 - enable = true; 8 8 - enableSSHSupport = false; 9 9 - }; 10 10 - 11 11 - # Fish shell, the best 12 12 - programs.fish.enable = true; 13 13 - 14 14 - services.tailscale.useRoutingFeatures = "client"; 15 15 - 16 16 - services.redis.servers."" = { 17 17 - enable = true; 18 18 - }; 19 19 - 20 20 - # Containers and VMs 21 21 - virtualisation = { 22 22 - podman = { 23 23 - enable = false; 24 24 - dockerCompat = true; 25 25 - defaultNetwork.settings.dns_enabled = true; 26 26 - dockerSocket.enable = true; 27 27 - }; 28 28 - docker = { 29 29 - enable = true; 30 30 - storageDriver = "overlay2"; 31 31 - }; 32 32 - }; 33 33 - }

-6

host-specific/shizuri/boot.nix

··· 1 1 - { ... }: 2 2 - { 3 3 - # Use the systemd-boot EFI boot loader. 4 4 - boot.loader.systemd-boot.enable = true; 5 5 - boot.loader.efi.canTouchEfiVariables = true; 6 6 - }

-13

host-specific/shizuri/configuration.nix

··· 1 1 - { ... }: 2 2 - { 3 3 - imports = [ 4 4 - # Include the results of the hardware scan. 5 5 - ./hardware-configuration.nix 6 6 - ./boot.nix 7 7 - ./networking.nix 8 8 - ./gui.nix 9 9 - ./packages.nix 10 10 - ./services.nix 11 11 - ]; 12 12 - system.stateVersion = "23.11"; # Did you read the comment? 13 13 - }

-27

host-specific/shizuri/gs.sh

··· 1 1 - #!/usr/bin/env bash 2 2 - set -xeuo pipefail 3 3 - 4 4 - gamescopeArgs=( 5 5 - --adaptive-sync # VRR support 6 6 - --hdr-enabled 7 7 - --mangoapp # performance overlay 8 8 - --rt 9 9 - --steam 10 10 - ) 11 11 - steamArgs=( 12 12 - -pipewire-dmabuf 13 13 - -tenfoot 14 14 - ) 15 15 - mangoConfig=( 16 16 - cpu_temp 17 17 - gpu_temp 18 18 - ram 19 19 - vram 20 20 - ) 21 21 - mangoVars=( 22 22 - MANGOHUD=1 23 23 - MANGOHUD_CONFIG="$(IFS=,; echo "${mangoConfig[*]}")" 24 24 - ) 25 25 - 26 26 - export "${mangoVars[@]}" 27 27 - exec gamescope "${gamescopeArgs[@]}" -- steam "${steamArgs[@]}"

-115

host-specific/shizuri/gui.nix

··· 1 1 - { pkgs, ... }: 2 2 - { 3 3 - # Enable the X11 windowing system. 4 4 - services.xserver = { 5 5 - enable = true; 6 6 - videoDrivers = [ "amdgpu" ]; 7 7 - }; 8 8 - 9 9 - # Fix for HIP libraries 10 10 - systemd.tmpfiles.rules = [ 11 11 - "L+ /opt/rocm/hip - - - - ${pkgs.rocmPackages.clr}" 12 12 - ]; 13 13 - 14 14 - # Configure keymap in X11 15 15 - services.xserver.xkb = { 16 16 - layout = "us"; 17 17 - variant = ""; 18 18 - }; 19 19 - # services.xserver.xkb.options = "eurosign:e,caps:escape"; 20 20 - 21 21 - # Enable CUPS to print documents. 22 22 - # services.printing.enable = true; 23 23 - 24 24 - # Enable sound. 25 25 - security.rtkit.enable = true; 26 26 - services.pipewire = { 27 27 - enable = true; 28 28 - alsa.enable = true; 29 29 - alsa.support32Bit = true; 30 30 - pulse.enable = true; 31 31 - wireplumber.enable = true; 32 32 - }; 33 33 - 34 34 - # Graphics and parallel compute configuration 35 35 - hardware.graphics = { 36 36 - enable = true; 37 37 - extraPackages = with pkgs; [ 38 38 - libva 39 39 - mesa 40 40 - rocmPackages.clr.icd 41 41 - ]; 42 42 - }; 43 43 - 44 44 - # Enable touchpad support (enabled default in most desktopManager). 45 45 - # services.xserver.libinput.enable = true; 46 46 - 47 47 - # Fonts 48 48 - fonts.packages = with pkgs; [ 49 49 - fira-code 50 50 - fira-code-symbols 51 51 - noto-fonts 52 52 - noto-fonts-cjk-sans 53 53 - noto-fonts-color-emoji 54 54 - nerd-fonts.fira-code 55 55 - ]; 56 56 - 57 57 - # Polkit is a dependency of Sway. It's responsible for handling security policies 58 58 - security.polkit.enable = true; 59 59 - 60 60 - # Enable the sway window manager 61 61 - programs.sway = { 62 62 - enable = false; 63 63 - #package = unstable.sway; 64 64 - wrapperFeatures.gtk = true; 65 65 - }; 66 66 - # Use greetd as the displaymanager 67 67 - #services.xserver.displayManager.greetd.enable = true; 68 68 - 69 69 - services.xserver.displayManager.lightdm.enable = false; 70 70 - 71 71 - #services.displayManager.sddm.enable = true; 72 72 - #services.displayManager.defaultSession = "sway"; 73 73 - #services.displayManager.autoLogin = { 74 74 - # enable = true; 75 75 - # user = "noah"; 76 76 - #}; 77 77 - services.xserver.desktopManager.xfce.enable = false; 78 78 - services.xserver.desktopManager.lxqt = { 79 79 - enable = true; 80 80 - }; 81 81 - services.xscreensaver.enable = true; 82 82 - security.pam.services.xscreensaver.enable = true; 83 83 - 84 84 - # i3, for when I need XOrg 85 85 - services.xserver.windowManager.i3 = { 86 86 - enable = false; 87 87 - extraPackages = with pkgs; [ 88 88 - dmenu 89 89 - i3status 90 90 - i3lock 91 91 - i3blocks 92 92 - ]; 93 93 - }; 94 94 - 95 95 - xdg.portal = { 96 96 - enable = true; 97 97 - wlr.enable = true; 98 98 - extraPortals = [ 99 99 - pkgs.xdg-desktop-portal 100 100 - pkgs.xdg-desktop-portal-wlr 101 101 - pkgs.xdg-desktop-portal-gtk 102 102 - pkgs.xdg-desktop-portal-termfilechooser 103 103 - pkgs.lxqt.xdg-desktop-portal-lxqt 104 104 - ]; 105 105 - }; 106 106 - xdg.mime = { 107 107 - enable = true; 108 108 - defaultApplications = { 109 109 - "x-scheme-handler/http" = "org.firefox.firefox.desktop"; 110 110 - "x-scheme-handler/https" = "org.firefox.firefox.desktop"; 111 111 - }; 112 112 - }; 113 113 - services.dbus.enable = true; 114 114 - services.gnome.gnome-keyring.enable = true; 115 115 - }

-84

host-specific/shizuri/hardware-configuration.nix

··· 1 1 - # Do not modify this file! It was generated by ‘nixos-generate-config’ 2 2 - # and may be overwritten by future invocations. Please make changes 3 3 - # to /etc/nixos/configuration.nix instead. 4 4 - { 5 5 - config, 6 6 - lib, 7 7 - pkgs, 8 8 - modulesPath, 9 9 - ... 10 10 - }: 11 11 - 12 12 - { 13 13 - imports = [ 14 14 - (modulesPath + "/installer/scan/not-detected.nix") 15 15 - ]; 16 16 - 17 17 - boot.kernelPackages = pkgs.linuxPackages_latest; 18 18 - boot.initrd.availableKernelModules = [ 19 19 - "nvme" 20 20 - "xhci_pci" 21 21 - "thunderbolt" 22 22 - "usb_storage" 23 23 - "usbhid" 24 24 - "uas" 25 25 - "sd_mod" 26 26 - ]; 27 27 - boot.initrd.kernelModules = [ ]; 28 28 - boot.kernelModules = [ "kvm-amd" ]; 29 29 - boot.extraModulePackages = [ ]; 30 30 - 31 31 - # Bluetooth / wireless configuration 32 32 - hardware.bluetooth = { 33 33 - enable = true; 34 34 - powerOnBoot = true; 35 35 - settings = { 36 36 - General = { 37 37 - # Shows battery charge of connected devices on supported 38 38 - # Bluetooth adapters. Defaults to 'false'. 39 39 - Experimental = true; 40 40 - # When enabled other devices can connect faster to us, however 41 41 - # the tradeoff is increased power consumption. Defaults to 42 42 - # 'false'. 43 43 - FastConnectable = true; 44 44 - }; 45 45 - Policy = { 46 46 - # Enable all controllers when they are found. This includes 47 47 - # adapters present on start as well as adapters that are plugged 48 48 - # in later on. Defaults to 'true'. 49 49 - AutoEnable = true; 50 50 - }; 51 51 - }; 52 52 - }; 53 53 - 54 54 - fileSystems."/" = { 55 55 - device = "/dev/disk/by-uuid/9a7cbffe-6c10-4220-bb99-4dcea8181dcc"; 56 56 - fsType = "ext4"; 57 57 - }; 58 58 - 59 59 - fileSystems."/boot" = { 60 60 - device = "/dev/disk/by-uuid/9AC5-62C3"; 61 61 - fsType = "vfat"; 62 62 - options = [ 63 63 - "fmask=0077" 64 64 - "dmask=0077" 65 65 - ]; 66 66 - }; 67 67 - 68 68 - swapDevices = [ { device = "/dev/disk/by-uuid/a19d8fad-d8d2-4bbe-a233-e645020419ff"; } ]; 69 69 - fileSystems."/srv/mugino" = { 70 70 - device = "/dev/disk/by-uuid/d832dd9f-1fbb-4ca7-9097-0ba329b838af"; 71 71 - fsType = "ext4"; 72 72 - }; 73 73 - 74 74 - # Enables DHCP on each ethernet and wireless interface. In case of scripted networking 75 75 - # (the default) this is the recommended approach. When using systemd-networkd it's 76 76 - # still possible to use this option, but it's recommended to use it in conjunction 77 77 - # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`. 78 78 - networking.useDHCP = lib.mkDefault true; 79 79 - # networking.interfaces.enp191s0.useDHCP = lib.mkDefault true; 80 80 - # networking.interfaces.wlp192s0.useDHCP = lib.mkDefault true; 81 81 - 82 82 - nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; 83 83 - hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; 84 84 - }

-78

host-specific/shizuri/networking.nix

··· 1 1 - { ... }: 2 2 - { 3 3 - # networking.hostName = "nixos"; # Define your hostname. 4 4 - # Pick only one of the below networking options. 5 5 - # networking.wireless.enable = true; # Enables wireless support via wpa_supplicant. 6 6 - # networking.networkmanager.enable = true; # Easiest to use and most distros use this by default. 7 7 - networking.hostName = "shizuri"; 8 8 - # I like systemd-networkd 9 9 - systemd.network.enable = true; 10 10 - systemd.network.networks."50-wlp2s0" = { 11 11 - matchConfig.name = "wlp2s0"; 12 12 - networkConfig.DHCP = "yes"; 13 13 - linkConfig.RequiredForOnline = "no"; 14 14 - }; 15 15 - 16 16 - networking.tempAddresses = "disabled"; 17 17 - 18 18 - networking.useNetworkd = true; 19 19 - # TODO: static IP @ 192.168.1.2 20 20 - 21 21 - # Configure network proxy if necessary 22 22 - # networking.proxy.default = "http://user:password@proxy:port/"; 23 23 - # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; 24 24 - # Open ports in the firewall. 25 25 - # networking.firewall.allowedTCPPorts = [ ... ]; 26 26 - # networking.firewall.allowedUDPPorts = [ ... ]; 27 27 - # Or disable the firewall altogether. 28 28 - # TODO: allow some ports 29 29 - networking.firewall = { 30 30 - enable = false; 31 31 - allowPing = true; 32 32 - allowedUDPPorts = [ ]; 33 33 - allowedTCPPorts = [ 34 34 - 1234 35 35 - 2375 36 36 - ]; 37 37 - }; 38 38 - 39 39 - services.avahi = { 40 40 - enable = true; 41 41 - nssmdns4 = true; 42 42 - nssmdns6 = true; 43 43 - ipv6 = true; 44 44 - openFirewall = true; 45 45 - publish = { 46 46 - enable = true; 47 47 - addresses = true; 48 48 - workstation = true; 49 49 - userServices = true; 50 50 - domain = true; 51 51 - }; 52 52 - }; 53 53 - 54 54 - # NFS mounts 55 55 - 56 56 - fileSystems = { 57 57 - "/srv/shokuhou" = { 58 58 - device = "192.168.1.3:/srv/shokuhou"; 59 59 - fsType = "nfs"; 60 60 - options = [ 61 61 - "nfsvers=4" 62 62 - "user" 63 63 - "x-system.automount" 64 64 - "x-system.idle-timeout=600" 65 65 - ]; 66 66 - }; 67 67 - "/srv/mentalout" = { 68 68 - device = "192.168.1.3:/srv/mentalout"; 69 69 - fsType = "nfs"; 70 70 - options = [ 71 71 - "nfsvers=4" 72 72 - "user" 73 73 - "x-system.automount" 74 74 - "x-system.idle-timeout=600" 75 75 - ]; 76 76 - }; 77 77 - }; 78 78 - }

-173

host-specific/shizuri/packages.nix

··· 1 1 - { pkgs, lib, ... }: 2 2 - let # bash script to let dbus know about important env variables and 3 3 - # propagate them to relevent services run at the end of sway config 4 4 - # see 5 5 - # https://github.com/emersion/xdg-desktop-portal-wlr/wiki/"It-doesn't-work"-Troubleshooting-Checklist 6 6 - # note: this is pretty much the same as /etc/sway/config.d/nixos.conf but also restarts 7 7 - # some user services to make sure they have the correct environment variables 8 8 - dbus-sway-environment = pkgs.writeTextFile { 9 9 - name = "dbus-sway-environment"; 10 10 - destination = "/bin/dbus-sway-environment"; 11 11 - executable = true; 12 12 - 13 13 - text = '' 14 14 - dbus-update-activation-environment --systemd WAYLAND_DISPLAY XDG_CURRENT_DESKTOP=sway 15 15 - systemctl --user stop pipewire pipewire-media-session xdg-desktop-portal xdg-desktop-portal-wlr 16 16 - systemctl --user start pipewire pipewire-media-session xdg-desktop-portal xdg-desktop-portal-wlr 17 17 - ''; 18 18 - }; 19 19 - 20 20 - # currently, there is some friction between sway and gtk: 21 21 - # https://github.com/swaywm/sway/wiki/GTK-3-settings-on-Wayland 22 22 - # the suggested way to set gtk settings is with gsettings 23 23 - # for gsettings to work, we need to tell it where the schemas are 24 24 - # using the XDG_DATA_DIR environment variable 25 25 - # run at the end of sway config 26 26 - configure-gtk = pkgs.writeTextFile { 27 27 - name = "configure-gtk"; 28 28 - destination = "/bin/configure-gtk"; 29 29 - executable = true; 30 30 - text = 31 31 - let 32 32 - # TODO: figure out why these bindings exist or where they're used 33 33 - schema = pkgs.gsettings-desktop-schemas; 34 34 - datadir = "${schema}/share/gsettings-schemas/${schema.name}"; 35 35 - in 36 36 - '' 37 37 - 6 gnome_schema=org.gnome.desktop.interface 38 38 - gsettings set $gnome_schema gtk-theme 'Dracula' 39 39 - ''; 40 40 - }; 41 41 - in 42 42 - { 43 43 - 44 44 - # List packages installed in system profile. To search, run: 45 45 - # $ nix search wget 46 46 - environment.systemPackages = with pkgs; [ 47 47 - mangohud 48 48 - neovim 49 49 - appimage-run 50 50 - tzdata 51 51 - wget 52 52 - kitty 53 53 - file 54 54 - w3m 55 55 - fishPlugins.fzf-fish 56 56 - fzf 57 57 - qemu 58 58 - qemu-user 59 59 - qemu-utils 60 60 - qemu_full 61 61 - OVMF 62 62 - #9p stuff 63 63 - diod 64 64 - plan9port 65 65 - vis 66 66 - rc 67 67 - 68 68 - smartmontools 69 69 - 70 70 - # Sway stuff 71 71 - wdisplays 72 72 - mako 73 73 - bemenu 74 74 - wl-clipboard 75 75 - slurp 76 76 - grim 77 77 - swayidle 78 78 - swaylock 79 79 - adwaita-icon-theme 80 80 - dracula-theme 81 81 - glib 82 82 - xdg-utils 83 83 - xdg-desktop-portal 84 84 - wayland 85 85 - configure-gtk 86 86 - lxqt.lxqt-menu-data # for lxqt 87 87 - dbus-sway-environment 88 88 - dbus 89 89 - pkg-config 90 90 - zlib 91 91 - # why wouldn't I want documentation on my system 92 92 - man-pages 93 93 - man-pages-posix 94 94 - linuxPackages_latest.perf 95 95 - ]; 96 96 - 97 97 - environment.loginShellInit = '' 98 98 - [[ "$(tty)" = "/dev/tty1" ]] && /home/noah/repos/nixos/gs.sh 99 99 - ''; 100 100 - 101 101 - documentation.dev.enable = true; 102 102 - 103 103 - # Fix dynamically linked libraries for unpackaged binaries 104 104 - programs.nix-ld = { 105 105 - enable = true; 106 106 - libraries = with pkgs; [ 107 107 - # Add missing dynamic libraries for unpackaged programs HERE 108 108 - # NOT in environment.systemPackages 109 109 - zlib 110 110 - openssl 111 111 - sqlite 112 112 - libunwind 113 113 - libglvnd 114 114 - libclang 115 115 - systemdLibs 116 116 - ]; 117 117 - }; 118 118 - programs.nix-index = { 119 119 - enable = true; 120 120 - enableFishIntegration = true; 121 121 - enableBashIntegration = false; 122 122 - enableZshIntegration = false; 123 123 - }; 124 124 - 125 125 - programs.steam = { 126 126 - enable = true; 127 127 - remotePlay.openFirewall = true; # Open ports in the firewall for Steam Remote Play 128 128 - dedicatedServer.openFirewall = true; # Open ports in the firewall for Source Dedicated Server 129 129 - localNetworkGameTransfers.openFirewall = true; # Open ports in the firewall for Steam Local Network Game Transfers 130 130 - gamescopeSession.enable = true; 131 131 - }; 132 132 - programs.gamescope = { 133 133 - enable = true; 134 134 - capSysNice = true; 135 135 - }; 136 136 - # Boot to bigpicture 137 137 - services.getty.autologinUser = "noah"; 138 138 - 139 139 - programs.appimage = { 140 140 - enable = true; 141 141 - binfmt = true; 142 142 - }; 143 143 - 144 144 - # Run other bins in QEMU 145 145 - boot.binfmt.emulatedSystems = [ 146 146 - "aarch64-linux" 147 147 - "riscv64-linux" 148 148 - ]; 149 149 - # UEFI firmware support for QEMU 150 150 - systemd.tmpfiles.rules = [ "L+ /var/lib/qemu/firmware - - - - ${pkgs.qemu}/share/qemu/firmware" ]; 151 151 - 152 152 - # Logseq uses an ancient version of Electron, so we enable that 153 153 - nixpkgs.config.permittedInsecurePackages = [ "electron-25.9.0" ]; 154 154 - 155 155 - # I don't care too much about unfree 156 156 - nixpkgs.config.allowUnfree = true; 157 157 - # Whitelist some unfree packages 158 158 - nixpkgs.config.allowUnfreePredicate = 159 159 - pkg: 160 160 - builtins.elem (lib.getName pkg) [ 161 161 - "discord" 162 162 - "spotify" 163 163 - "obsidian" 164 164 - "unstable.obsidian" 165 165 - "tailscale" 166 166 - "google-chrome" 167 167 - "slack" 168 168 - "steam" 169 169 - "steam-original" 170 170 - "steam-unwrapped" 171 171 - "steam-run" 172 172 - ]; 173 173 - }

-44

host-specific/shizuri/services.nix

··· 1 1 - { pkgs, ... }: 2 2 - { 3 3 - # Some programs need SUID wrappers, can be configured further or are 4 4 - # started in user sessions. 5 5 - # programs.mtr.enable = true; 6 6 - programs.gnupg.agent = { 7 7 - enable = true; 8 8 - enableSSHSupport = false; 9 9 - }; 10 10 - 11 11 - # Enable the OpenSSH daemon. 12 12 - services.openssh = { 13 13 - enable = true; 14 14 - settings.X11Forwarding = true; 15 15 - }; 16 16 - 17 17 - # Smart Card daemon 18 18 - services.pcscd.enable = true; 19 19 - 20 20 - # This option is for enabling the bolt daemon for managing Thunderbolt/USB4 Devices. 21 21 - services.hardware.bolt.enable = true; 22 22 - 23 23 - services.fwupd.enable = true; 24 24 - 25 25 - services.xrdp = { 26 26 - enable = true; 27 27 - openFirewall = true; 28 28 - defaultWindowManager = "${pkgs.lxqt.lxqt-session}/bin/lxqt-session"; 29 29 - }; 30 30 - 31 31 - # Containers and VMs 32 32 - virtualisation = { 33 33 - podman = { 34 34 - enable = false; 35 35 - dockerCompat = true; 36 36 - defaultNetwork.settings.dns_enabled = true; 37 37 - dockerSocket.enable = true; 38 38 - }; 39 39 - docker = { 40 40 - enable = true; 41 41 - storageDriver = "overlay2"; 42 42 - }; 43 43 - }; 44 44 - }

-55

host-specific/touma-wsl.nix

··· 1 1 - # Edit this configuration file to define what should be installed on 2 2 - # your system. Help is available in the configuration.nix(5) man page, on 3 3 - # https://search.nixos.org/options and in the NixOS manual (`nixos-help`). 4 4 - 5 5 - # NixOS-WSL specific options are documented on the NixOS-WSL repository: 6 6 - # https://github.com/nix-community/NixOS-WSL 7 7 - 8 8 - { pkgs, inputs, ... }: 9 9 - { 10 10 - imports = [ 11 11 - # WSL has no hardware configuration 12 12 - ../users.nix 13 13 - ../services.nix 14 14 - ]; 15 15 - wsl = { 16 16 - enable = true; 17 17 - defaultUser = "noah"; 18 18 - wslConf.network.hostname = "touma-wsl-nixos"; 19 19 - }; 20 20 - # List packages installed in system profile. To search, run: 21 21 - # $ nix search wget 22 22 - environment.systemPackages = with pkgs; [ 23 23 - neovim 24 24 - appimage-run 25 25 - wget 26 26 - kitty 27 27 - w3m 28 28 - fishPlugins.fzf-fish 29 29 - fzf 30 30 - qemu 31 31 - OVMF 32 32 - gitFull 33 33 - # plan9 34 34 - diod 35 35 - plan9port 36 36 - vis 37 37 - rc 38 38 - 39 39 - xdg-utils 40 40 - inputs.agenix.packages."${system}".agenix 41 41 - ]; 42 42 - services.openssh.enable = true; 43 43 - 44 44 - # Fix dynamically linked libraries for unpackaged binaries 45 45 - programs.nix-ld = { 46 46 - enable = true; 47 47 - libraries = with pkgs; [ 48 48 - # Add missing dynamic libraries for unpackaged programs HERE 49 49 - # NOT in environment.systemPackages 50 50 - zlib 51 51 - fuse3 52 52 - ]; 53 53 - }; 54 54 - system.stateVersion = "24.11"; 55 55 - }

-196

i3/config

··· 1 1 - # This file has been auto-generated by i3-config-wizard(1). 2 2 - # It will not be overwritten, so edit it as you like. 3 3 - # 4 4 - # Should you change your keyboard layout some time, delete 5 5 - # this file and re-run i3-config-wizard(1). 6 6 - # 7 7 - 8 8 - # i3 config file (v4) 9 9 - # 10 10 - # Please see https://i3wm.org/docs/userguide.html for a complete reference! 11 11 - 12 12 - set $mod Mod4 13 13 - 14 14 - # Font for window titles. Will also be used by the bar unless a different font 15 15 - # is used in the bar {} block below. 16 16 - font pango:monospace 8 17 17 - 18 18 - # This font is widely installed, provides lots of unicode glyphs, right-to-left 19 19 - # text rendering and scalability on retina/hidpi displays (thanks to pango). 20 20 - #font pango:DejaVu Sans Mono 8 21 21 - 22 22 - # Start XDG autostart .desktop files using dex. See also 23 23 - # https://wiki.archlinux.org/index.php/XDG_Autostart 24 24 - exec --no-startup-id dex --autostart --environment i3 25 25 - 26 26 - # The combination of xss-lock, nm-applet and pactl is a popular choice, so 27 27 - # they are included here as an example. Modify as you see fit. 28 28 - 29 29 - # xss-lock grabs a logind suspend inhibit lock and will use i3lock to lock the 30 30 - # screen before suspend. Use loginctl lock-session to lock your screen. 31 31 - exec --no-startup-id xss-lock --transfer-sleep-lock -- i3lock --nofork 32 32 - 33 33 - # NetworkManager is the most popular way to manage wireless networks on Linux, 34 34 - # and nm-applet is a desktop environment-independent system tray GUI for it. 35 35 - exec --no-startup-id nm-applet 36 36 - 37 37 - # Use pactl to adjust volume in PulseAudio. 38 38 - set $refresh_i3status killall -SIGUSR1 i3status 39 39 - bindsym XF86AudioRaiseVolume exec --no-startup-id pactl set-sink-volume @DEFAULT_SINK@ +10% && $refresh_i3status 40 40 - bindsym XF86AudioLowerVolume exec --no-startup-id pactl set-sink-volume @DEFAULT_SINK@ -10% && $refresh_i3status 41 41 - bindsym XF86AudioMute exec --no-startup-id pactl set-sink-mute @DEFAULT_SINK@ toggle && $refresh_i3status 42 42 - bindsym XF86AudioMicMute exec --no-startup-id pactl set-source-mute @DEFAULT_SOURCE@ toggle && $refresh_i3status 43 43 - 44 44 - # Use Mouse+$mod to drag floating windows to their wanted position 45 45 - floating_modifier $mod 46 46 - 47 47 - # move tiling windows via drag & drop by left-clicking into the title bar, 48 48 - # or left-clicking anywhere into the window while holding the floating modifier. 49 49 - tiling_drag modifier titlebar 50 50 - 51 51 - # start a terminal 52 52 - bindsym $mod+Return exec kitty 53 53 - 54 54 - # kill focused window 55 55 - bindsym $mod+Shift+q kill 56 56 - 57 57 - # start dmenu (a program launcher) 58 58 - bindsym $mod+d exec --no-startup-id dmenu_run 59 59 - # A more modern dmenu replacement is rofi: 60 60 - # bindcode $mod+40 exec "rofi -modi drun,run -show drun" 61 61 - # There also is i3-dmenu-desktop which only displays applications shipping a 62 62 - # .desktop file. It is a wrapper around dmenu, so you need that installed. 63 63 - # bindcode $mod+40 exec --no-startup-id i3-dmenu-desktop 64 64 - 65 65 - # change focus 66 66 - bindsym $mod+h focus left 67 67 - bindsym $mod+j focus down 68 68 - bindsym $mod+k focus up 69 69 - bindsym $mod+l focus right 70 70 - 71 71 - 72 72 - # alternatively, you can use the cursor keys: 73 73 - bindsym $mod+Left focus left 74 74 - bindsym $mod+Down focus down 75 75 - bindsym $mod+Up focus up 76 76 - bindsym $mod+Right focus right 77 77 - 78 78 - # move focused window 79 79 - bindsym $mod+Shift+h move left 80 80 - bindsym $mod+Shift+j move down 81 81 - bindsym $mod+Shift+k move up 82 82 - bindsym $mod+Shift+l move right 83 83 - 84 84 - # alternatively, you can use the cursor keys: 85 85 - bindsym $mod+Shift+Left move left 86 86 - bindsym $mod+Shift+Down move down 87 87 - bindsym $mod+Shift+Up move up 88 88 - bindsym $mod+Shift+Right move right 89 89 - 90 90 - # split in horizontal orientation 91 91 - bindsym $mod+g split h 92 92 - 93 93 - # split in vertical orientation 94 94 - bindsym $mod+v split v 95 95 - 96 96 - # enter fullscreen mode for the focused container 97 97 - bindsym $mod+f fullscreen toggle 98 98 - 99 99 - # change container layout (stacked, tabbed, toggle split) 100 100 - bindsym $mod+s layout stacking 101 101 - bindsym $mod+w layout tabbed 102 102 - bindsym $mod+e layout toggle split 103 103 - 104 104 - # toggle tiling / floating 105 105 - bindsym $mod+Shift+space floating toggle 106 106 - 107 107 - # change focus between tiling / floating windows 108 108 - bindsym $mod+space focus mode_toggle 109 109 - 110 110 - # focus the parent container 111 111 - bindsym $mod+a focus parent 112 112 - 113 113 - # focus the child container 114 114 - #bindsym $mod+d focus child 115 115 - 116 116 - # Define names for default workspaces for which we configure key bindings later on. 117 117 - # We use variables to avoid repeating the names in multiple places. 118 118 - set $ws1 "1" 119 119 - set $ws2 "2" 120 120 - set $ws3 "3" 121 121 - set $ws4 "4" 122 122 - set $ws5 "5" 123 123 - set $ws6 "6" 124 124 - set $ws7 "7" 125 125 - set $ws8 "8" 126 126 - set $ws9 "9" 127 127 - set $ws10 "10" 128 128 - 129 129 - # switch to workspace 130 130 - bindsym $mod+1 workspace number $ws1 131 131 - bindsym $mod+2 workspace number $ws2 132 132 - bindsym $mod+3 workspace number $ws3 133 133 - bindsym $mod+4 workspace number $ws4 134 134 - bindsym $mod+5 workspace number $ws5 135 135 - bindsym $mod+6 workspace number $ws6 136 136 - bindsym $mod+7 workspace number $ws7 137 137 - bindsym $mod+8 workspace number $ws8 138 138 - bindsym $mod+9 workspace number $ws9 139 139 - bindsym $mod+0 workspace number $ws10 140 140 - # Tab navigation 141 141 - bindsym $mod+Tab workspace next 142 142 - bindsym $mod+Shift+Tab workspace prev 143 143 - 144 144 - # move focused container to workspace 145 145 - bindsym $mod+Shift+1 move container to workspace number $ws1 146 146 - bindsym $mod+Shift+2 move container to workspace number $ws2 147 147 - bindsym $mod+Shift+3 move container to workspace number $ws3 148 148 - bindsym $mod+Shift+4 move container to workspace number $ws4 149 149 - bindsym $mod+Shift+5 move container to workspace number $ws5 150 150 - bindsym $mod+Shift+6 move container to workspace number $ws6 151 151 - bindsym $mod+Shift+7 move container to workspace number $ws7 152 152 - bindsym $mod+Shift+8 move container to workspace number $ws8 153 153 - bindsym $mod+Shift+9 move container to workspace number $ws9 154 154 - bindsym $mod+Shift+0 move container to workspace number $ws10 155 155 - 156 156 - # reload the configuration file 157 157 - bindsym $mod+Shift+c reload 158 158 - # restart i3 inplace (preserves your layout/session, can be used to upgrade i3) 159 159 - bindsym $mod+Shift+r restart 160 160 - # exit i3 (logs you out of your X session) 161 161 - bindsym $mod+Shift+e exec "i3-nagbar -t warning -m 'You pressed the exit shortcut. Do you really want to exit i3? This will end your X session.' -B 'Yes, exit i3' 'i3-msg exit'" 162 162 - 163 163 - # resize window (you can also use the mouse for that) 164 164 - mode "resize" { 165 165 - # These bindings trigger as soon as you enter the resize mode 166 166 - 167 167 - # Pressing left will shrink the window’s width. 168 168 - # Pressing right will grow the window’s width. 169 169 - # Pressing up will shrink the window’s height. 170 170 - # Pressing down will grow the window’s height. 171 171 - bindsym h resize shrink width 10 px or 10 ppt 172 172 - bindsym j resize grow height 10 px or 10 ppt 173 173 - bindsym k resize shrink height 10 px or 10 ppt 174 174 - bindsym l resize grow width 10 px or 10 ppt 175 175 - 176 176 - # same bindings, but for the arrow keys 177 177 - bindsym Left resize shrink width 10 px or 10 ppt 178 178 - bindsym Down resize grow height 10 px or 10 ppt 179 179 - bindsym Up resize shrink height 10 px or 10 ppt 180 180 - bindsym Right resize grow width 10 px or 10 ppt 181 181 - 182 182 - # back to normal: Enter or Escape or $mod+r 183 183 - bindsym Return mode "default" 184 184 - bindsym Escape mode "default" 185 185 - bindsym $mod+r mode "default" 186 186 - } 187 187 - 188 188 - bindsym $mod+r mode "resize" 189 189 - 190 190 - # Start i3bar to display a workspace bar (plus the system information i3status 191 191 - # finds out, if available) 192 192 - bar { 193 193 - status_command i3status 194 194 - } 195 195 - 196 196 - exec barrier

+111

networking.nix

··· 1 1 + { config, ... }: 2 2 + { 3 3 + # networking.hostName = "nixos"; # Define your hostname. 4 4 + # Pick only one of the below networking options. 5 5 + # networking.wireless.enable = true; # Enables wireless support via wpa_supplicant. 6 6 + # networking.networkmanager.enable = true; # Easiest to use and most distros use this by default. 7 7 + networking.hostName = "misaki"; 8 8 + # I like systemd-networkd 9 9 + systemd.network.enable = true; 10 10 + systemd.network.networks."50-wlp2s0" = { 11 11 + matchConfig.name = "wlp2s0"; 12 12 + networkConfig.DHCP = "yes"; 13 13 + linkConfig.RequiredForOnline = "no"; 14 14 + }; 15 15 + 16 16 + networking.tempAddresses = "disabled"; 17 17 + 18 18 + networking.interfaces = { 19 19 + enp4s0f1 = { 20 20 + ipv4.addresses = [{ 21 21 + address = "192.168.1.3"; 22 22 + prefixLength = 24; 23 23 + }]; 24 24 + }; 25 25 + }; 26 26 + networking.defaultGateway = { 27 27 + address = "192.168.1.1"; 28 28 + interface = "enp4s0f1"; 29 29 + }; 30 30 + 31 31 + networking.defaultGateway6 = { 32 32 + address = "fe80::2870:4eff:fe84:d884"; 33 33 + interface = "enp4s0f1"; 34 34 + }; 35 35 + 36 36 + networking.nameservers = [ 37 37 + "192.168.1.3" 38 38 + "45.90.28.93" 39 39 + "45.90.30.93" 40 40 + ]; 41 41 + 42 42 + # This is necessary for ZFS 43 43 + networking.hostId = "5beebabe"; 44 44 + 45 45 + networking.useNetworkd = true; 46 46 + # TODO: static IP @ 192.168.1.2 47 47 + 48 48 + # Configure network proxy if necessary 49 49 + # networking.proxy.default = "http://user:password@proxy:port/"; 50 50 + # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; 51 51 + # Open ports in the firewall. 52 52 + # networking.firewall.allowedTCPPorts = [ ... ]; 53 53 + # networking.firewall.allowedUDPPorts = [ ... ]; 54 54 + # Or disable the firewall altogether. 55 55 + # TODO: allow some ports 56 56 + networking.firewall = { 57 57 + enable = true; 58 58 + allowPing = true; 59 59 + trustedInterfaces = [ 60 60 + "tailscale0" 61 61 + ]; 62 62 + allowedUDPPorts = [ 63 63 + # DNS 64 64 + 53 65 65 + config.services.tailscale.port 66 66 + ]; 67 67 + allowedTCPPorts = [ 68 68 + # DNS over TCP 69 69 + 53 70 70 + # NFSv4 71 71 + 2049 72 72 + # HTTP(s) 73 73 + 443 74 74 + 80 75 75 + # iperf3 76 76 + 5201 77 77 + 5301 78 78 + 5401 79 79 + # NATS 80 80 + 4222 81 81 + # Prometheus 82 82 + 9001 83 83 + # Minio 84 84 + 9003 85 85 + # Minio web 86 86 + 9004 87 87 + # AFP via Netatalk 88 88 + 548 89 89 + #9p 90 90 + 564 91 91 + # Misc development 92 92 + 3000 93 93 + ]; 94 94 + }; 95 95 + 96 96 + services.avahi = { 97 97 + enable = true; 98 98 + nssmdns4 = true; 99 99 + nssmdns6 = true; 100 100 + ipv6 = true; 101 101 + openFirewall = true; 102 102 + publish = { 103 103 + enable = true; 104 104 + addresses = true; 105 105 + workstation = true; 106 106 + userServices = true; 107 107 + domain = true; 108 108 + }; 109 109 + }; 110 110 + 111 111 + }

-2

nvim/after/ftplugin/janet.lua

··· 1 1 - vim.o.tabstop = 2 2 2 - vim.o.shiftwidth = 2

+2 -11

nvim/init.lua

··· 7 7 -- Config for Nord, which I usually use 8 8 -- vim.g.nord_italic = false 9 9 -- vim.g.nord_bold = false 10 10 - local known_hosts = { 11 11 - ["aleister.packetlost.dev"] = "light", 12 12 - ["aleister.local"] = "light", 13 13 - ["accelerator"] = "light" 14 14 - } 15 15 - local background = known_hosts[vim.loop.os_gethostname()] 16 16 - if not background then 17 17 - background = "dark" 18 18 - end 19 19 - vim.opt.background = background 20 20 - --vim.opt.background = "dark" 10 10 + --vim.opt.background = "light" 11 11 + vim.opt.background = "dark" 21 12 22 13 -- Formatting and vim config 23 14 vim.opt.expandtab = true

+1 -1

nvim/lua/lsp/janet_lsp.lua

··· 2 2 cmd = { 3 3 "janet", 4 4 "-i", 5 5 - "/Users/noah/repos/janet-lsp/build/janet-lsp.jimage", 5 5 + "/home/noah/repos/janet-lsp/jpm_tree/lib/janet-lsp.jimage", 6 6 "--stdio", 7 7 } 8 8 }

+3 -3

nvim/lua/lsp.lua

··· 44 44 end, opts) 45 45 vim.keymap.set("n", "<space>D", vim.lsp.buf.type_definition, opts) 46 46 vim.keymap.set("n", "<space>rn", vim.lsp.buf.rename, opts) 47 47 - vim.keymap.set("n", "<leader>ca", vim.lsp.buf.code_action, opts) 47 47 + vim.keymap.set("n", "<space>ca", vim.lsp.buf.code_action, opts) 48 48 vim.keymap.set("n", "gr", vim.lsp.buf.references, opts) 49 49 vim.keymap.set("n", "<space>e", vim.diagnostic.open_float, opts) 50 50 - vim.keymap.set("n", "[d", function () vim.diagnostic.jump {count = -1, float = true} end, opts) 51 51 - vim.keymap.set("n", "]d", function () vim.diagnostic.jump {count = 1, float = true} end, opts) 50 50 + vim.keymap.set("n", "[d", vim.diagnostic.goto_prev, opts) 51 51 + vim.keymap.set("n", "]d", vim.diagnostic.goto_next, opts) 52 52 vim.keymap.set("n", "<space>q", vim.diagnostic.setloclist, opts) 53 53 vim.keymap.set("n", "<space>f", 54 54 function() vim.lsp.buf.format { async = true } end, opts)

+22 -11

nvim/lua/plugins.lua

··· 121 121 }, 122 122 }, -- Git stuff 123 123 -- GitGutter, shows inline difs 124 124 - --"airblade/vim-gitgutter", 124 124 + "airblade/vim-gitgutter", 125 125 { 126 126 "NeogitOrg/neogit", 127 127 dependencies = { ··· 277 277 { "rktjmp/hotpot.nvim", lazy = true, ft = "fennel", config = true }, 278 278 { "Olical/nfnl", lazy = true, ft = "fennel", config = true }, -- Rust stuff 279 279 { 280 280 - "mrcjkb/rustaceanvim", 281 281 - lazy = false, 282 282 - version = "^6" 280 280 + "simrat39/rust-tools.nvim", 281 281 + lazy = true, 282 282 + ft = { "rust" }, 283 283 + config = function() 284 284 + local rt = require("rust-tools") 285 285 + rt.setup({ 286 286 + server = { 287 287 + on_attach = function(_, bufnr) 288 288 + -- Hover actions 289 289 + vim.keymap.set("n", "<C-space>", 290 290 + rt.hover_actions.hover_actions, 291 291 + { buffer = bufnr }) 292 292 + -- Code action groups 293 293 + vim.keymap.set("n", "<Leader>a", 294 294 + rt.code_action_group.code_action_group, 295 295 + { buffer = bufnr }) 296 296 + end 297 297 + } 298 298 + }) 299 299 + end, 300 300 + dependencies = { "nvim-lua/plenary.nvim" } 283 301 }, 284 302 { "mfussenegger/nvim-dap", lazy = true, ft = { "c", "rust" } }, 285 303 { ··· 335 353 end 336 354 }, 337 355 { "lewis6991/gitsigns.nvim", config = true }, 338 338 - { 339 339 - "greggh/claude-code.nvim", 340 340 - dependencies = { 341 341 - "nvim-lua/plenary.nvim" 342 342 - }, 343 343 - config = true 344 344 - } 345 356 346 357 } 347 358 })

+26

overrides/immich-sources.json

··· 1 1 + { 2 2 + "version": "1.138.1", 3 3 + "hash": "sha256-oaZN0kF82mS25bDSTXRjYnWG9RAMSbCUhXn9t0am96U=", 4 4 + "components": { 5 5 + "cli": { 6 6 + "npmDepsHash": "sha256-6k83QOdKh+FlVnYvA9j60115oohUMDc2YvGaj/GMukE=", 7 7 + "version": "2.2.79" 8 8 + }, 9 9 + "server": { 10 10 + "npmDepsHash": "sha256-4sqWIIGQ8ZW7TvJoNjNNliriuV6Su0askAN6pAq9VFc=", 11 11 + "version": "1.138.1" 12 12 + }, 13 13 + "web": { 14 14 + "npmDepsHash": "sha256-+W8cDgy3qe6RDen8SEdHPNADkKb4zZH8C/Am/bdU42c=", 15 15 + "version": "1.138.1" 16 16 + }, 17 17 + "open-api/typescript-sdk": { 18 18 + "npmDepsHash": "sha256-GfmFPsnFu7l4EsnPDv4nj5KLkOz8nEJvMT1BE7zIQ3k=", 19 19 + "version": "1.138.1" 20 20 + }, 21 21 + "geonames": { 22 22 + "timestamp": "20250818205425", 23 23 + "hash": "sha256-ceYdHKPxVzmqVIcA5odqPAnjeB0sR7GW2k/Csp0nepY=" 24 24 + } 25 25 + } 26 26 + }

+126

packages.nix

··· 1 1 + { pkgs, lib, inputs, ... }: 2 2 + let # bash script to let dbus know about important env variables and 3 3 + # propagate them to relevent services run at the end of sway config 4 4 + # see 5 5 + # https://github.com/emersion/xdg-desktop-portal-wlr/wiki/"It-doesn't-work"-Troubleshooting-Checklist 6 6 + # note: this is pretty much the same as /etc/sway/config.d/nixos.conf but also restarts 7 7 + # some user services to make sure they have the correct environment variables 8 8 + dbus-sway-environment = pkgs.writeTextFile { 9 9 + name = "dbus-sway-environment"; 10 10 + destination = "/bin/dbus-sway-environment"; 11 11 + executable = true; 12 12 + 13 13 + text = '' 14 14 + dbus-update-activation-environment --systemd WAYLAND_DISPLAY XDG_CURRENT_DESKTOP=sway 15 15 + systemctl --user stop pipewire pipewire-media-session xdg-desktop-portal xdg-desktop-portal-wlr 16 16 + systemctl --user start pipewire pipewire-media-session xdg-desktop-portal xdg-desktop-portal-wlr 17 17 + ''; 18 18 + }; 19 19 + 20 20 + # currently, there is some friction between sway and gtk: 21 21 + # https://github.com/swaywm/sway/wiki/GTK-3-settings-on-Wayland 22 22 + # the suggested way to set gtk settings is with gsettings 23 23 + # for gsettings to work, we need to tell it where the schemas are 24 24 + # using the XDG_DATA_DIR environment variable 25 25 + # run at the end of sway config 26 26 + configure-gtk = pkgs.writeTextFile { 27 27 + name = "configure-gtk"; 28 28 + destination = "/bin/configure-gtk"; 29 29 + executable = true; 30 30 + text = 31 31 + let 32 32 + # TODO: figure out why these bindings exist or where they're used 33 33 + schema = pkgs.gsettings-desktop-schemas; 34 34 + datadir = "${schema}/share/gsettings-schemas/${schema.name}"; 35 35 + in 36 36 + '' 37 37 + 6 gnome_schema=org.gnome.desktop.interface 38 38 + gsettings set $gnome_schema gtk-theme 'Dracula' 39 39 + ''; 40 40 + }; 41 41 + in 42 42 + { 43 43 + 44 44 + # List packages installed in system profile. To search, run: 45 45 + # $ nix search wget 46 46 + environment.systemPackages = with pkgs; [ 47 47 + neovim 48 48 + appimage-run 49 49 + wget 50 50 + kitty 51 51 + w3m 52 52 + fishPlugins.fzf-fish 53 53 + fzf 54 54 + qemu 55 55 + OVMF 56 56 + metastore 57 57 + # 9p 58 58 + diod 59 59 + plan9port 60 60 + vis 61 61 + rc 62 62 + ncdu 63 63 + inputs.agenix.packages."${system}".agenix 64 64 + 65 65 + # ZFS / filesystem stuff 66 66 + zfs 67 67 + 68 68 + # GPU stuff 69 69 + intel-gpu-tools 70 70 + #(ffmpeg-full.override { 71 71 + # withUnfree = true; 72 72 + # withMfx = false; 73 73 + # withSmallBuild = false; 74 74 + # withTensorflow = false; 75 75 + #}) 76 76 + libva 77 77 + libva-utils 78 78 + nvtopPackages.intel 79 79 + 80 80 + # Sway stuff 81 81 + wdisplays 82 82 + mako 83 83 + bemenu 84 84 + wl-clipboard 85 85 + slurp 86 86 + grim 87 87 + swayidle 88 88 + swaylock 89 89 + adwaita-icon-theme 90 90 + dracula-theme 91 91 + glib 92 92 + xdg-utils 93 93 + wayland 94 94 + configure-gtk 95 95 + dbus-sway-environment 96 96 + dbus 97 97 + ]; 98 98 + 99 99 + # Fix dynamically linked libraries for unpackaged binaries 100 100 + programs.nix-ld = { 101 101 + enable = true; 102 102 + libraries = with pkgs; [ 103 103 + # Add missing dynamic libraries for unpackaged programs HERE 104 104 + # NOT in environment.systemPackages 105 105 + zlib 106 106 + ]; 107 107 + }; 108 108 + 109 109 + programs.fuse.userAllowOther = true; 110 110 + 111 111 + 112 112 + # Logseq uses an ancient version of Electron, so we enable that 113 113 + nixpkgs.config.permittedInsecurePackages = [ "electron-25.9.0" ]; 114 114 + 115 115 + # Whitelist some unfree packages 116 116 + nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ 117 117 + "discord" 118 118 + "spotify" 119 119 + "obsidian" 120 120 + "tailscale" 121 121 + "plexmediaserver" 122 122 + "sftpgo" 123 123 + "teamspeak-server" 124 124 + "ffmpeg-full" 125 125 + ]; 126 126 + }

+3

scripts/fix-jpeg-raw-duplicates-immich.rcsh

··· 1 1 + #!/usr/bin/env rc 2 2 + 3 3 + nix run 'github:nixos/nixpkgs?ref=nixos-unstable-small#immich-go' -- stack -k `{pa show immich-api} -s 'https://photos.ngp.computer' --manage-raw-jpeg StackCoverJPG

+3 -3

scripts/nr

··· 1 1 #!/usr/bin/env rc 2 2 3 3 - flag e + 3 3 + flag x + 4 4 5 5 if(~ $1 -x) { 6 6 - flag x + 6 6 + flake e + 7 7 shift 8 8 } 9 9 10 10 pkg=$1 11 11 shift 12 12 13 13 - exec nix run 'nixpkgs#'^$pkg -- $* 13 13 + exec nix run --impure 'nixpkgs#'^$pkg -- $*

+8

scripts/oclip

··· 1 1 + #!/usr/bin/env rc 2 2 + flag e + 3 3 + 4 4 + if (~ $1 -x) { 5 5 + flag x + 6 6 + } 7 7 + data=`{base64 <[0=0]} 8 8 + printf '\033]52;c;%s\007' $"data

-3

scripts/ocopy

··· 1 1 - #!/usr/bin/env sh 2 2 - 3 3 - printf "\033]52;c;%s\007" "$(base64 <&0)"

-10

secrets/catgirl-libera.age

··· 1 1 - age-encryption.org/v1 2 2 - -> ssh-ed25519 QBbeMw PrgR2RT7HMRapTw8QcRtBU1vfOdrvOdFR+dxlaTMSH4 3 3 - 2oG68+hYV5W90Beaqpi/VonPwXzB52NTwwJGKmV8YM0 4 4 - -> ssh-ed25519 Wv0Urw LvqWE5p2G3QnxbqOQMSd631mCqfhJvE9P/yRuwTTkFk 5 5 - 3jGowP4TKe3T92NXcZjmqU+QFGcyuT2+H3EU/nqTF8s 6 6 - -> ssh-ed25519 WVNCXA YGX6M8E4JGpJNeZIhiN/t+tx1NQNc+Ewy9HC2dxm3yY 7 7 - mhxXrgnbh4ng2tIeQrYfxlnlSCk/fTEBDDOg2MEVP2g 8 8 - --- JpMgqNty36r0OAyDTaLY8yiFHGXzQLm8gh6XXmJQ094 9 9 - E~�ƿ׭#2%%��`Ϳ�~��~�Si<�3� 10 10 - 7k��b�+OMr�3GxžhG�WY9.�xU1�Re�*%���v�!����������2�wJ_B�)�"��I��k��[u�jvV5��8n�D��2���H�|

secrets/nix-serve-secret-key.age

This is a binary file and will not be displayed.

-13

secrets/noah-hashed-password.age

··· 1 1 - age-encryption.org/v1 2 2 - -> ssh-ed25519 e6zq8g Y6AKrd+CWu2+QqPEslYof/XQTTSMf/WNlW9t8FagYgQ 3 3 - +hiVmTdBt2w/CUusGWOmHgPB3/A3NlcVJ6a4hieWKaE 4 4 - -> ssh-ed25519 FcROng uBO/aCTSS5JU9ZTkyRgFeYhmkcXdifUycQk8CEGADx0 5 5 - LZE8JNFrlOeySFamABnZuZHdXdLPYB8/X4gic3stCuw 6 6 - -> ssh-ed25519 OV+2QQ m13opn5yD0oMLSR8j1jiI9CkzwDSZI37UhJdLQ/KzjE 7 7 - 6arhn/OFKiGrFabcFCF/yTtTSQImORJX5Ohq50I3xpU 8 8 - -> ssh-ed25519 h/Fm0A HfM3i56ldP9EvwYTNorzdtkwn21zvFd6cEqUINsg8hg 9 9 - RJo7z0Nk179ZiazofToA+0KOD3CWfpzaFcZWrSeVsuo 10 10 - -> ssh-ed25519 Aoo1Gg DKY2avQ+UMyIytEefP6C3LTXTT7QaDBDguxu4G3j/iY 11 11 - EqCq0BeV+rToFnOCbD9ru9KroXxGcYKRnryKF7N8Uoo 12 12 - --- L0JkNEz2vJ0m7+8PQELugzzhQAKV/6z/JrU2qeTDPWI 13 13 - /g�DQ�ӳ`�����<�S��U���p}E+(��2H�'��͖�������Av6p.P#,����l�����@��7���|F�;;�Dޓ,�8@���E{

+5 -8

secrets/porkbun-api-key.age

··· 1 1 age-encryption.org/v1 2 2 - -> ssh-ed25519 e6zq8g x6PGKDva9Uj/rVaeOiWSBKTgNsi6ZT1XtHdUEAPn7Wo 3 3 - hziH64vy2Dx0dMEEKphhw54hzyzhgAYONxaSqDgguP0 4 4 - -> ssh-ed25519 QBbeMw G775f6PEJrogzi+h0cDKhCmfZ4t8uaJSsGqSuLdwq1M 5 5 - TR9UfYVljeb+DtttBpMlinZjbPNKL7+omEasEo0nEjE 6 6 - -> ssh-ed25519 Wv0Urw jXwjCKuCW6z7ZGu0hp/igks4vgCcGGng0VGXeHakJRI 7 7 - b6fciWjygpGMI83E3C3JBjJZ7X5tDXRPRKgn1Uy/1P0 8 8 - --- X67NLqQNueHXFrw9Z2SBA880xnUEPLbKRjADgdiBfIs 9 9 - &u&6�=�ڌ5�!,B[��e������F�[��9�� "lU����<�9�D$m̆��6`JU �dB~S�A6D;s��љ:M��p g�Y��
@pBj�6���f����p�;��{�H�y�2{�?���#Pl�D@#ye��3��jD��tץ����6���=�A�������lJڊQ'���..>�(񵑅|wn��Zf<=
_ 2 2 + -> ssh-ed25519 e6zq8g CdLTZ6uXiJB+xaD+I5NVHD5OxLSH+yAz99j04GiKukU 3 3 + kQTUR4yK23wHV9QGMlmTmIlMh63nP49g1NrS+sJKfBY 4 4 + --- H6/xHryPPKmAWW/bDXUN4YBXMKrsFpUAveKxWsT0SH0 5 5 + �E����,�ήS��P)A.������9O\�����2n��U�!���X�a���l�Z�4*(G�[��>�Zl� 6 6 + :QՅ���������o����$=��& ڍ�w�t^�<<E�0p�8��:����G�̉����J#�QR�����p�򘐞�kA,�=!��5�KK��0o��nQ��)�\\�ĘN�����wQ�҉

+4 -24

secrets/secrets.nix

··· 1 1 let 2 2 - noah = [ 3 3 - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDQFlX3hhXxsqAUYLvF+IX1YWQ+k22OHlqMOjgyNBe9e noah@misaki" 4 4 - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC/cXL1cV6QUW5z2bJp1mCu0CXrcc0Dntdxaeo3fg60N noah@odin" 5 5 - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIChbA8oSqYgmjIGYjlpAPLf+Nl6IlcSb2Zmh/Hl6xm88 noah@accelerator" 6 6 - ]; 2 2 + noah = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDQFlX3hhXxsqAUYLvF+IX1YWQ+k22OHlqMOjgyNBe9e noah@misaki"; 7 3 misaki = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO+Rcf4Lr+JPWGKQol6eAml6SMgERkGJWgN7y1qYUUvX root@nixos"; 8 8 - edge = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINCmFKYXpQf1E8E7fj5s+3R33HPRjPhXrv++FCKYBCd4 root@nixos"; 9 9 - odin = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJIuvOXEK7M2i/Q8FeableBS+L20zwQpLetOuFGUhba2 root@nixos"; 10 10 - touma-wsl = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFeyj52bQ/nf5k4HwDckeHy8wU3weDtY6IF6VlUJ/hAH root@nixos"; 11 11 - shizuri = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIaMdVtl8UlDa9kI/PO62Glu/PeJXfgXNsVg92b+BibE root@nixos"; 12 12 - hosts = [ 13 13 - misaki 14 14 - edge 15 15 - odin 16 16 - touma-wsl 17 17 - shizuri 18 18 - ]; 4 4 + #users = [noah]; 19 5 in 20 6 { 21 21 - "porkbun-api-key.age".publicKeys = [ misaki ] ++ noah; 22 22 - "noah-hashed-password.age".publicKeys = hosts; 23 23 - "nix-serve-secret-key.age".publicKeys = [ 24 24 - misaki 25 25 - noah 26 26 - ]; 27 27 - "validator-identity.age".publicKeys = [ edge ]; 28 28 - "catgirl-libera.age".publicKeys = noah; 7 7 + "porkbun-api-key.age".publicKeys = [ noah misaki ]; 8 8 + "nix-serve-secret-key.age".publicKeys = [ misaki noah ]; 29 9 }

secrets/validator-identity.age

This is a binary file and will not be displayed.

+562 -18

services.nix

··· 1 1 - { enableNFTables, lib, ... }: 1 1 + { config 2 2 + , pkgs 3 3 + , unstable 4 4 + , ... 5 5 + }: 2 6 { 3 7 8 8 + services.zfs = { 9 9 + autoScrub.enable = true; 10 10 + }; 11 11 + services.nfs.server.enable = true; 4 12 # Some programs need SUID wrappers, can be configured further or are 5 13 # started in user sessions. 6 6 - programs.mtr.enable = true; 14 14 + # programs.mtr.enable = true; 15 15 + programs.gnupg.agent = { 16 16 + enable = true; 17 17 + enableSSHSupport = false; 18 18 + }; 7 19 8 20 # Fish shell, the best 9 21 programs.fish.enable = true; 10 22 23 23 + # MOSH, SSH over flakey connections 24 24 + programs.mosh.enable = true; 25 25 + 26 26 + # List services that you want to enable: 27 27 + 28 28 + # Enable the OpenSSH daemon. 29 29 + services.openssh = { 30 30 + enable = true; 31 31 + openFirewall = true; 32 32 + settings.PasswordAuthentication = false; 33 33 + }; 34 34 + 35 35 + # This option is for enabling the bolt daemon for managing Thunderbolt/USB4 Devices. 36 36 + services.hardware.bolt.enable = true; 37 37 + 11 38 # Tailscale 12 39 services.tailscale = { 13 40 enable = true; 41 41 + useRoutingFeatures = "client"; 42 42 + }; 43 43 + 44 44 + # Containers and VMs 45 45 + virtualisation = { 46 46 + podman = { 47 47 + enable = true; 48 48 + dockerCompat = true; 49 49 + defaultNetwork.settings.dns_enabled = true; 50 50 + }; 51 51 + }; 52 52 + 53 53 + # Samba, for shares 54 54 + # TODO 55 55 + services.samba = { 56 56 + enable = true; 14 57 openFirewall = true; 58 58 + nmbd.enable = true; 59 59 + winbindd.enable = true; 60 60 + settings = { 61 61 + global = { 62 62 + workgroup = "WORKGROUP"; 63 63 + "server string" = "misaki"; 64 64 + security = "user"; 65 65 + "use sendfile" = "yes"; 66 66 + "hosts allow" = "192.168.1. 127.0.0.1 localhost"; 67 67 + "hosts deny" = "0.0.0.0/0"; 68 68 + "guest account" = "nobody"; 69 69 + "map to guest" = "bad user"; 70 70 + deadtime = 30; 71 71 + }; 72 72 + shokuhou = { 73 73 + path = "/srv/shokuhou"; 74 74 + browseable = "yes"; 75 75 + "read only" = "no"; 76 76 + "guest ok" = "no"; 77 77 + "create mask" = "0644"; 78 78 + "directory mask" = "0755"; 79 79 + "force user" = "noah"; 80 80 + "force group" = "nas"; 81 81 + }; 82 82 + mentalout = { 83 83 + path = "/srv/mentalout"; 84 84 + browseable = "yes"; 85 85 + "read only" = "no"; 86 86 + "guest ok" = "no"; 87 87 + "create mask" = "0644"; 88 88 + "directory mask" = "0755"; 89 89 + "force user" = "noah"; 90 90 + "force group" = "nas"; 91 91 + }; 92 92 + }; 15 93 }; 16 16 - # Don't wait for networks on boot, should speed up boot 17 17 - systemd.network.wait-online.enable = false; 18 18 - boot.initrd.systemd.network.wait-online.enable = false; 19 19 - networking.firewall.trustedInterfaces = [ "tailscale0" ]; 94 94 + services.samba-wsdd = { 95 95 + enable = true; 96 96 + openFirewall = true; 97 97 + }; 20 98 21 21 - # Enable the OpenSSH daemon. 22 22 - services.openssh = { 99 99 + services.coredns = { 23 100 enable = true; 101 101 + config = '' 102 102 + packetlost.dev { 103 103 + hosts ${./coredns/packetlost.dev.hosts} packetlost.dev { 104 104 + fallthrough 105 105 + } 106 106 + bind enp4s0f1 107 107 + } 108 108 + ngp.computer { 109 109 + hosts ${./coredns/ngp.computer.hosts} ngp.computer { 110 110 + fallthrough 111 111 + } 112 112 + bind enp4s0f1 113 113 + } 114 114 + localhost { 115 115 + hosts ${./coredns/localhost.hosts} localhost { 116 116 + fallthrough 117 117 + } 118 118 + bind enp4s0f1 119 119 + } 120 120 + . { 121 121 + # NextDNS 122 122 + forward . tls://2a07:a8c0::dd:2feb:853 tls://2a07:a8c1::dd:2feb:853 tls://45.90.28.93:853 tls://45.90.30.93:853 { 123 123 + tls_servername dd2feb.dns.nextdns.io 124 124 + health_check 5s 125 125 + } 126 126 + bind enp4s0f1 127 127 + cache 128 128 + errors 129 129 + log 130 130 + } 131 131 + ''; 132 132 + }; 133 133 + 134 134 + services.nats = { 135 135 + enable = true; 136 136 + jetstream = true; 137 137 + user = "nats"; 138 138 + group = "nats"; 139 139 + serverName = "misaki"; 140 140 + dataDir = "/srv/shokuhou/applications/nats"; 141 141 + validateConfig = false; 142 142 + settings = { 143 143 + authorization = { 144 144 + users = [ 145 145 + { 146 146 + user = "seedbox@packetlost.dev"; 147 147 + permissions = { 148 148 + publish = [ 149 149 + "torrents" 150 150 + "torrents.>" 151 151 + "$JS.API.INFO" 152 152 + #"$JS.API.STREAM.INFO.>" 153 153 + "$KV.torrents.>" 154 154 + #"$JS.API.STREAM.*.*.OBJ_torrents" 155 155 + "$JS.API.*.*.OBJ_torrents" 156 156 + "$JS.API.STREAM.MSG.GET.OBJ_torrents" 157 157 + "$JS.API.*.*.OBJ_torrents.>" 158 158 + "$O.torrents.>" 159 159 + ]; 160 160 + subscribe = [ 161 161 + "torrents.>" 162 162 + "_INBOX.>" 163 163 + ]; 164 164 + allow_responses = false; 165 165 + }; 166 166 + } 167 167 + { user = "odin@packetlost.dev"; } 168 168 + { user = "misaki@packetlost.dev"; } 169 169 + { user = "noah@packetlost.dev"; } 170 170 + { user = "touma-nixos@packetlost.dev"; } 171 171 + ]; 172 172 + }; 173 173 + tls = { 174 174 + cert_file = "/srv/nats/nats.packetlost.dev/cert.pem"; 175 175 + key_file = "/srv/nats/nats.packetlost.dev/key.pem"; 176 176 + ca_file = "/srv/nats/minica.pem"; 177 177 + verify_and_map = true; 178 178 + }; 179 179 + jetstream = { 180 180 + # 50GB 181 181 + max_file_store = 53687091200; 182 182 + max_mem = 8589934592; 183 183 + }; 184 184 + }; 185 185 + }; 186 186 + 187 187 + # Minio's object storage has been mostly replaced with NATS. If I specifically need a 188 188 + # S3-like API, this will be revived. 189 189 + services.minio = { 190 190 + enable = false; 191 191 + listenAddress = ":9003"; 192 192 + consoleAddress = ":9004"; 193 193 + dataDir = [ 194 194 + /srv/shokuhou/applications/minio 195 195 + ]; 196 196 + }; 197 197 + 198 198 + services.netatalk = { 199 199 + enable = true; 200 200 + settings = { 201 201 + time-machine = { 202 202 + path = "/srv/shokuhou/backup/timemachine"; 203 203 + "valid users" = "noah"; 204 204 + "time machine" = true; 205 205 + }; 206 206 + }; 207 207 + }; 208 208 + 209 209 + services.webdav.enable = false; 210 210 + services.sftpgo = { 211 211 + enable = false; 212 212 + dataDir = /srv/shokuhou/documents/sftpgo; 213 213 + group = "nas"; 214 214 + }; 215 215 + services.syncthing = { 216 216 + enable = false; 217 217 + openDefaultPorts = true; 218 218 + # disable the sync folder creation 219 219 + extraFlags = [ "--no-default-folder" ]; 220 220 + settings = { 221 221 + folders = { 222 222 + "Sync" = { 223 223 + path = "/srv/shokuhou/documents/sync"; 224 224 + }; 225 225 + }; 226 226 + }; 227 227 + }; 228 228 + 229 229 + services.grafana = { 230 230 + enable = false; 231 231 + settings.server.http_port = 2342; 232 232 + settings.server.domain = "grafana.packetlost.dev"; 233 233 + settings.server.http_addr = "127.0.0.1"; 234 234 + }; 235 235 + 236 236 + services.prometheus = { 237 237 + enable = false; 238 238 + port = 9001; 239 239 + exporters = { 240 240 + node = { 241 241 + enable = true; 242 242 + enabledCollectors = [ "systemd" ]; 243 243 + port = 9002; 244 244 + }; 245 245 + }; 246 246 + 247 247 + scrapeConfigs = [ 248 248 + { 249 249 + job_name = "chrysalis"; 250 250 + static_configs = [ 251 251 + { targets = [ "127.0.0.1:${builtins.toString config.services.prometheus.exporters.node.port}" ]; } 252 252 + ]; 253 253 + } 254 254 + ]; 255 255 + }; 256 256 + 257 257 + # TODO: figure out how to appropriately configure this 258 258 + services.step-ca = { 259 259 + enable = false; 24 260 openFirewall = true; 25 25 - settings.PasswordAuthentication = false; 261 261 + port = 8443; 262 262 + address = "0.0.0.0"; 263 263 + intermediatePasswordFile = /etc/nixos/step-ca-intermediate-ca-password; 264 264 + settings = builtins.fromJSON (builtins.readFile /home/noah/.step/config/ca.json); 26 265 }; 27 266 28 28 - # MOSH, SSH over flakey connections 29 29 - programs.mosh.enable = true; 30 30 - } 31 31 - // lib.optionalAttrs enableNFTables { 32 32 - # Use nftables 33 33 - networking.nftables.enable = true; 34 34 - # Support native nftables in tailscale 35 35 - systemd.services.tailscaled.serviceConfig.Environment = [ 36 36 - "TS_DEBUG_FIREWALL_MODE=nftables" 267 267 + age.secrets.acme = { 268 268 + file = ./secrets/porkbun-api-key.age; 269 269 + owner = "root"; 270 270 + group = "acme"; 271 271 + }; 272 272 + 273 273 + # TODO: re-enable this once Agenix is set up 274 274 + security.acme = { 275 275 + acceptTerms = true; 276 276 + defaults.email = "noah@packetlost.dev"; 277 277 + certs."plex.packetlost.dev" = { 278 278 + dnsProvider = "porkbun"; 279 279 + group = "httpd"; 280 280 + environmentFile = config.age.secrets.acme.path; 281 281 + }; 282 282 + certs."img.ngp.computer" = { 283 283 + group = "httpd"; 284 284 + dnsProvider = "porkbun"; 285 285 + environmentFile = config.age.secrets.acme.path; 286 286 + }; 287 287 + certs."files.ngp.computer" = { 288 288 + group = "httpd"; 289 289 + dnsProvider = "porkbun"; 290 290 + environmentFile = config.age.secrets.acme.path; 291 291 + }; 292 292 + certs."photos.ngp.computer" = { 293 293 + group = "httpd"; 294 294 + dnsProvider = "porkbun"; 295 295 + environmentFile = config.age.secrets.acme.path; 296 296 + }; 297 297 + certs."jellyfin.packetlost.dev" = { 298 298 + group = "httpd"; 299 299 + dnsProvider = "porkbun"; 300 300 + environmentFile = config.age.secrets.acme.path; 301 301 + }; 302 302 + }; 303 303 + 304 304 + # A test email server that only works on LAN 305 305 + services.maddy = { 306 306 + enable = true; 307 307 + openFirewall = true; 308 308 + primaryDomain = "misaki.local"; 309 309 + ensureAccounts = [ 310 310 + "noah@misaki.local" 311 311 + "postmaster@misaki.local" 312 312 + "test@misaki.local" 313 313 + ]; 314 314 + ensureCredentials = { 315 315 + "noah@misaki.local".passwordFile = "${pkgs.writeText "noah" "Password123"}"; 316 316 + "postmaster@misaki.local".passwordFile = "${pkgs.writeText "noah" "Password123"}"; 317 317 + "test@misaki.local".passwordFile = "${pkgs.writeText "test" "Password123"}"; 318 318 + }; 319 319 + }; 320 320 + 321 321 + age.secrets.nix-serve = { 322 322 + file = ./secrets/nix-serve-secret-key.age; 323 323 + owner = "root"; 324 324 + group = "root"; 325 325 + }; 326 326 + services.nix-serve = { 327 327 + enable = true; 328 328 + package = unstable.nix-serve-ng; 329 329 + secretKeyFile = config.age.secrets.nix-serve.path; 330 330 + openFirewall = true; 331 331 + }; 332 332 + 333 333 + services.plex = { 334 334 + enable = true; 335 335 + openFirewall = false; # we proxy this with nginx 336 336 + group = "nas"; 337 337 + user = "noah"; 338 338 + package = unstable.plex; 339 339 + }; 340 340 + 341 341 + services.jellyfin = { 342 342 + enable = true; 343 343 + openFirewall = true; 344 344 + user = "noah"; 345 345 + group = "nas"; 346 346 + logDir = "/srv/shokuhou/applications/jellyfin/log"; 347 347 + cacheDir = "/srv/shokuhou/applications/jellyfin/cache"; 348 348 + dataDir = "/srv/shokuhou/applications/jellyfin/data"; 349 349 + configDir = "/srv/shokuhou/applications/jellyfin/config"; 350 350 + }; 351 351 + 352 352 + # services.gitea = { 353 353 + # enable = true; 354 354 + # user = "git"; 355 355 + # domain = "git.packetlost.dev"; 356 356 + # }; 357 357 + 358 358 + # Litterbox, collect my IRC logs 359 359 + systemd = { 360 360 + services = { 361 361 + "litterbox@" = { 362 362 + path = [ pkgs.litterbox ]; 363 363 + serviceConfig = { 364 364 + StartLimitIntervalSec = 5; 365 365 + StartLimitBurst = 10; 366 366 + Restart = "on-failure"; 367 367 + RestartSec = "10s"; 368 368 + Type = "simple"; 369 369 + ExecStart = "${pkgs.litterbox}/bin/litterbox /srv/litterbox/%i.conf"; 370 370 + ExecReload = "kill -USR1 $MAINPID"; 371 371 + User = "noah"; 372 372 + Group = "litterbox"; 373 373 + }; 374 374 + }; 375 375 + 376 376 + #"litterbox@libera.irc.packetlost.dev" = { 377 377 + # overrideStrategy = "asDropin"; 378 378 + # wantedBy = [ "multi-user.target" ]; 379 379 + #}; 380 380 + "update-downstream-src" = { 381 381 + path = with pkgs; [ 382 382 + rc 383 383 + coreutils 384 384 + git 385 385 + openssh 386 386 + ]; 387 387 + script = "exec ${./scripts/update-src}"; 388 388 + serviceConfig = { 389 389 + Type = "oneshot"; 390 390 + User = "noah"; 391 391 + WorkingDirectory = "/srv/src"; 392 392 + }; 393 393 + }; 394 394 + }; 395 395 + timers = { 396 396 + "update-downstream-src" = { 397 397 + wantedBy = [ "timers.target" ]; 398 398 + timerConfig = { 399 399 + OnCalendar = "daily"; 400 400 + Persistent = true; 401 401 + }; 402 402 + }; 403 403 + }; 404 404 + }; 405 405 + 406 406 + services.teamspeak3 = { 407 407 + enable = true; 408 408 + openFirewall = true; 409 409 + }; 410 410 + 411 411 + services.immich = { 412 412 + enable = true; 413 413 + package = unstable.immich; 414 414 + accelerationDevices = [ "/dev/dri/renderD128" ]; 415 415 + mediaLocation = "/srv/shokuhou/pictures/immich"; 416 416 + }; 417 417 + users.users.immich.extraGroups = [ 418 418 + "video" 419 419 + "render" 420 420 + "nas" 37 421 ]; 422 422 + 423 423 + # Nginx Reverse SSL Proxy 424 424 + services.nginx = { 425 425 + enable = true; 426 426 + group = "nas"; 427 427 + user = "noah"; 428 428 + 429 429 + # This is disabled for now 430 430 + #virtualHosts."${config.services.grafana.settings.server.domain}" = { 431 431 + # locations."/" = { 432 432 + # proxyPass = "http://127.0.0.1:${builtins.toString config.services.grafana.settings.server.http_port}"; 433 433 + # proxyWebsockets = true; 434 434 + # }; 435 435 + #}; 436 436 + 437 437 + virtualHosts."cache.packetlost.dev" = { 438 438 + locations."/".proxyPass = 439 439 + "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}"; 440 440 + }; 441 441 + virtualHosts."photos.ngp.computer" = { 442 442 + enableACME = false; 443 443 + useACMEHost = "photos.ngp.computer"; 444 444 + acmeRoot = null; 445 445 + forceSSL = true; 446 446 + locations."/" = { 447 447 + proxyPass = "http://[::1]:${toString config.services.immich.port}"; 448 448 + proxyWebsockets = true; 449 449 + recommendedProxySettings = true; 450 450 + extraConfig = '' 451 451 + client_max_body_size 50000M; 452 452 + proxy_read_timeout 600s; 453 453 + proxy_send_timeout 600s; 454 454 + send_timeout 600s; 455 455 + ''; 456 456 + }; 457 457 + }; 458 458 + virtualHosts."img.ngp.computer" = { 459 459 + forceSSL = true; 460 460 + enableACME = false; 461 461 + useACMEHost = "img.ngp.computer"; 462 462 + acmeRoot = null; 463 463 + root = "/srv/shokuhou/pictures/public"; 464 464 + extraConfig = '' 465 465 + sendfile on; 466 466 + autoindex_exact_size on; 467 467 + tcp_nopush on; 468 468 + ''; 469 469 + locations."/" = { 470 470 + extraConfig = '' 471 471 + autoindex on; 472 472 + autoindex_exact_size on; 473 473 + alias /srv/shokuhou/pictures/public/$1; 474 474 + ''; 475 475 + }; 476 476 + }; 477 477 + virtualHosts."files.ngp.computer" = { 478 478 + forceSSL = true; 479 479 + enableACME = false; 480 480 + useACMEHost = "files.ngp.computer"; 481 481 + acmeRoot = null; 482 482 + root = null; 483 483 + extraConfig = '' 484 484 + sendfile on; 485 485 + tcp_nopush on; 486 486 + ''; 487 487 + locations."/books/" = { 488 488 + extraConfig = '' 489 489 + autoindex on; 490 490 + autoindex_exact_size on; 491 491 + alias /srv/shokuhou/books/sync/$1; 492 492 + ''; 493 493 + }; 494 494 + }; 495 495 + virtualHosts."jellyfin.packetlost.dev" = { 496 496 + forceSSL = true; 497 497 + enableACME = false; 498 498 + useACMEHost = "jellyfin.packetlost.dev"; 499 499 + acmeRoot = null; 500 500 + http2 = true; 501 501 + locations."/" = { 502 502 + proxyPass = "http://localhost:8096/"; 503 503 + }; 504 504 + }; 505 505 + 506 506 + # give a name to the virtual host. It also becomes the server name. 507 507 + virtualHosts."plex.packetlost.dev" = { 508 508 + # Since we want a secure connection, we force SSL 509 509 + forceSSL = true; 510 510 + enableACME = false; 511 511 + useACMEHost = "plex.packetlost.dev"; 512 512 + acmeRoot = null; 513 513 + 514 514 + # http2 can more performant for streaming: https://blog.cloudflare.com/introducing-http2/ 515 515 + http2 = true; 516 516 + 517 517 + # Provide the ssl cert and key for the vhost 518 518 + # These are filled in automatically with ACME 519 519 + extraConfig = '' 520 520 + 521 521 + #Some players don't reopen a socket and playback stops totally instead of resuming after an extended pause 522 522 + send_timeout 100m; 523 523 + 524 524 + # Why this is important: https://blog.cloudflare.com/ocsp-stapling-how-cloudflare-just-made-ssl-30/ 525 525 + ssl_stapling on; 526 526 + ssl_stapling_verify on; 527 527 + 528 528 + ssl_protocols TLSv1 TLSv1.1 TLSv1.2; 529 529 + ssl_prefer_server_ciphers on; 530 530 + #Intentionally not hardened for security for player support and encryption video streams has a lot of overhead with something like AES-256-GCM-SHA384. 531 531 + ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA'; 532 532 + 533 533 + # Forward real ip and host to Plex 534 534 + proxy_set_header X-Real-IP $remote_addr; 535 535 + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 536 536 + proxy_set_header X-Forwarded-Proto $scheme; 537 537 + proxy_set_header Host $server_addr; 538 538 + proxy_set_header Referer $server_addr; 539 539 + proxy_set_header Origin $server_addr; 540 540 + 541 541 + # Plex has A LOT of javascript, xml and html. This helps a lot, but if it causes playback issues with devices turn it off. 542 542 + gzip on; 543 543 + gzip_vary on; 544 544 + gzip_min_length 1000; 545 545 + gzip_proxied any; 546 546 + gzip_types text/plain text/css text/xml application/xml text/javascript application/x-javascript image/svg+xml; 547 547 + gzip_disable "MSIE [1-6]\."; 548 548 + 549 549 + # Nginx default client_max_body_size is 1MB, which breaks Camera Upload feature from the phones. 550 550 + # Increasing the limit fixes the issue. Anyhow, if 4K videos are expected to be uploaded, the size might need to be increased even more 551 551 + client_max_body_size 100M; 552 552 + 553 553 + # Plex headers 554 554 + proxy_set_header X-Plex-Client-Identifier $http_x_plex_client_identifier; 555 555 + proxy_set_header X-Plex-Device $http_x_plex_device; 556 556 + proxy_set_header X-Plex-Device-Name $http_x_plex_device_name; 557 557 + proxy_set_header X-Plex-Platform $http_x_plex_platform; 558 558 + proxy_set_header X-Plex-Platform-Version $http_x_plex_platform_version; 559 559 + proxy_set_header X-Plex-Product $http_x_plex_product; 560 560 + proxy_set_header X-Plex-Token $http_x_plex_token; 561 561 + proxy_set_header X-Plex-Version $http_x_plex_version; 562 562 + proxy_set_header X-Plex-Nocache $http_x_plex_nocache; 563 563 + proxy_set_header X-Plex-Provides $http_x_plex_provides; 564 564 + proxy_set_header X-Plex-Device-Vendor $http_x_plex_device_vendor; 565 565 + proxy_set_header X-Plex-Model $http_x_plex_model; 566 566 + 567 567 + # Websockets 568 568 + proxy_http_version 1.1; 569 569 + proxy_set_header Upgrade $http_upgrade; 570 570 + proxy_set_header Connection "upgrade"; 571 571 + 572 572 + # Buffering off send to the client as soon as the data is received from Plex. 573 573 + proxy_redirect off; 574 574 + proxy_buffering off; 575 575 + ''; 576 576 + 577 577 + locations."/" = { 578 578 + proxyPass = "http://localhost:32400/"; 579 579 + }; 580 580 + }; 581 581 + }; 38 582 }

+6 -1

shell.nix

··· 1 1 { pkgs ? import <nixos-unstable> { } }: 2 2 - pkgs.mkShell { packages = with pkgs; [ nil lua-language-server ]; } 2 2 + pkgs.mkShell { 3 3 + packages = with pkgs; [ nil lua-language-server nixpkgs-fmt ]; 4 4 + shellHook = '' 5 5 + ${(import ./default.nix).pre-commit-check.shellHook} 6 6 + ''; 7 7 + }

-32

ssh/extra

··· 1 1 AddKeysToAgent yes 2 2 ServerAliveInterval 60 3 3 - ForwardAgent yes 4 3 ControlMaster auto 5 4 ControlPath ~/.ssh/master-%r@%h:%p 6 5 ··· 26 25 IdentityFile ~/.ssh/id_ed25519 27 26 ForwardAgent yes 28 27 29 29 - Host aleister 30 30 - HostName 192.168.1.16 31 31 - User noah 32 32 - IdentityFile ~/.ssh/id_ed25519 33 33 - ForwardAgent yes 34 34 - 35 28 Host komoe 36 29 HostName 192.168.1.5 37 30 User noah 38 31 IdentityFile ~/.ssh/id_ed25519 39 32 ForwardAgent yes 40 40 - 41 41 - Host othinus 42 42 - HostName 192.168.1.4 43 43 - User noah 44 44 - IdentityFile ~/.ssh/id_ed25519 45 45 - ForwardAgent yes 46 46 - 47 47 - Host odin 48 48 - HostName 192.168.1.6 49 49 - User noah 50 50 - IdentityFile ~/.ssh/id_ed25519 51 51 - ForwardAgent yes 52 52 - 53 53 - Host accelerator 54 54 - HostName 192.168.1.7 55 55 - User noah 56 56 - IdentityFile ~/.ssh/id_ed25519 57 57 - ForwardAgent yes 58 58 - 59 59 - Host shizuri 60 60 - HostName 192.168.1.15 61 61 - User noah 62 62 - IdentityFile ~/.ssh/id_ed25519 63 63 - ForwardAgent yes 64 64 - ForwardX11 yes 65 33 66 34 Host sdf 67 35 HostName tty.sdf.org

+13 -18

sway/odin

··· 2 2 #workspace $ws1 output DP-6 3 3 #workspace $ws2 output HDMI-A-1 4 4 5 5 - output "Acer Technologies XV272U 0x0000A50C" { 6 6 - mode 2560x1440@143.999Hz 7 7 - pos 440 0 8 8 - transform normal 9 9 - scale 1.0 10 10 - scale_filter nearest 11 11 - adaptive_sync off 12 12 - dpms on 13 13 - } 14 14 - output "LG Electronics LG ULTRAGEAR 307NTPC58464" { 15 15 - mode 3440x1440@85.0Hz 16 16 - pos 0 1440 17 17 - transform normal 18 18 - scale 1.0 19 19 - scale_filter nearest 20 20 - adaptive_sync on 21 21 - dpms on 22 22 - } 5 5 + # HDMI is the main output 6 6 + output HDMI-A-1 pos 0 0 7 7 + output HDMI-A-1 adaptive_sync off 8 8 + output DP-9 pos -430 1440 9 9 + output DP-9 adaptive_sync on 10 10 + # Sometimes the DP identifier changes for some reason 11 11 + output DP-6 pos -430 1440 12 12 + output DP-6 adaptive_sync on 13 13 + output DP-10 pos -430 1440 14 14 + output DP-10 adaptive_sync on 15 15 + # The HDMI gets messed up too :( 16 16 + output HDMI-A-2 pos 0 0 17 17 + output HDMI-A-2 adaptive_sync off

+10 -17

users.nix

··· 1 1 - { 2 2 - pkgs, 3 3 - lib, 4 4 - config, 5 5 - extraGroups ? [ ], 6 6 - ... 7 7 - }: 1 1 + { pkgs, lib, ... }: 8 2 { 9 9 - 10 3 # Declarative only optoins. 11 4 # I don't want to allow ad-hoc modifying users on the system. 12 5 # Users must be declared either as part of a package or in this file. 13 6 users.mutableUsers = false; 14 7 15 15 - age.secrets.noah-password = { 16 16 - file = ./secrets/noah-hashed-password.age; 17 17 - owner = "root"; 18 18 - group = "root"; 19 19 - }; 20 20 - 21 8 # Define a user account. Don't forget to set a password with ‘passwd’. 22 9 users.users.noah = { 23 10 isNormalUser = true; ··· 25 12 extraGroups = [ 26 13 "wheel" 27 14 "video" 15 15 + "render" 28 16 "nas" 29 29 - ] 30 30 - ++ extraGroups; # Enable ‘sudo’ for the user. 31 31 - hashedPasswordFile = config.age.secrets.noah-password.path; 17 17 + "nats" 18 18 + "litterbox" 19 19 + "httpd" 20 20 + ]; # Enable ‘sudo’ for the user. 21 21 + hashedPasswordFile = "/etc/nixos/noah-password"; 32 22 openssh.authorizedKeys.keys = lib.strings.splitString "\n" ( 33 23 builtins.readFile ( 34 24 builtins.fetchurl { ··· 41 31 ) 42 32 ); 43 33 }; 34 34 + 44 35 users.groups.nas.gid = 1001; 36 36 + users.groups.httpd.gid = 1002; 37 37 + users.groups.litterbox.gid = 1003; 45 38 }

+28 -42

vis/visrc.lua

··· 1 1 require('vis') 2 2 - local plugin_manager = 'plugins/vis-plug' 2 2 + 3 3 + local plug = require('plugins/vis-plug') 4 4 + 3 5 local plugins = { 4 4 - --{ 'timoha/vis-acme', theme = true, file = 'acme' }, 6 6 + { 'timoha/vis-acme', theme = true, file = 'acme' }, 5 7 { 'milhnl/vis-format' }, 6 8 { url = 'https://git.cepl.eu/cgit/vis/vis-fzf-open' }, 7 9 { url = 'https://gitlab.com/muhq/vis-lspc.git' }, 8 10 { url = 'https://repo.or.cz/vis-parkour.git', alias = 'vis-parkour' } 9 11 } 10 12 11 11 - function setup_plug() 12 12 - if not pcall(require, 'plugins/vis-plug') then 13 13 - os.execute('git clone --quiet https://github.com/erf/vis-plug ' .. 14 14 - (os.getenv('XDG_CONFIG_HOME') or os.getenv('HOME') .. '/.config') 15 15 - .. '/vis/plugins/vis-plug') 16 16 - end 17 17 - return require('plugins/vis-plug') 18 18 - end 19 19 - local plug = setup_plug() 13 13 + plug.init(plugins, true) 14 14 + 15 15 + 16 16 + 20 17 21 21 - plug.init(plugins, true) 22 18 23 23 - function configure_plugin(name, config) 24 24 - if vis:module_exist(name) then 25 25 - local module = require(name) 26 26 - config(module) 27 27 - end 28 28 - end 29 19 30 20 vis.events.subscribe(vis.events.INIT, function() 31 31 - configure_plugin('plugins/vis-format', function(format) 32 32 - vis:map(vis.modes.NORMAL, '<C-p>', ':fzf<Enter>') 33 33 - vis:map(vis.modes.NORMAL, '=', format.apply) 34 34 - end) 35 35 - configure_plugin('plugins/vis-lspc', function(lspc) 36 36 - if next(lspc) then 37 37 - lspc.logging = true 38 38 - lspc.log_file = "/tmp/lspc.log" 21 21 + local format = require('plugins/vis-format') 22 22 + vis:map(vis.modes.NORMAL, '<C-p>', ':fzf<Enter>') 23 23 + vis:map(vis.modes.NORMAL, '=', format.apply) 24 24 + local lspc = require('plugins/vis-lspc') 25 25 + if next(lspc) then 26 26 + lspc.logging = true 27 27 + lspc.log_file = "/tmp/lspc.log" 39 28 40 40 - lspc.ls_map.rust = { 41 41 - name = "rust", 42 42 - cmd = "rust-analyzer", 43 43 - formatting_options = {tabSize = 4, insertSpaces = true} 44 44 - } 45 45 - lspc.ls_map.lua = { 46 46 - name = "lua", 47 47 - cmd = "lua-language-server", 48 48 - formatting_options = { insertSpaces = false } 49 49 - } 50 50 - end 51 51 - end) 29 29 + lspc.ls_map.rust = { 30 30 + name = "rust", 31 31 + cmd = "rust-analyzer", 32 32 + formatting_options = {tabSize = 4, insertSpaces = true} 33 33 + } 34 34 + end 52 35 end) 53 36 54 37 55 55 - vis.events.subscribe(vis.events.WIN_OPEN, function() 38 38 + vis.events.subscribe(vis.events.WIN_OPEN, function(win) 56 39 --per-window configuration-- 57 40 --vis:command('set number') 58 58 - --vis:command('set showtab on') 59 59 - --vis:command('set showspace off') 41 41 + vis:command('set showtab on') 42 42 + vis:command('set showspace on') 60 43 vis:command('set autoindent on') 61 44 vis:command('set cursorline on') 62 45 vis:command('set tabwidth 4') 63 46 end) 64 64 - return nil 47 47 + 48 48 + 49 49 + 50 50 +