diff options
Diffstat (limited to 'modules')
24 files changed, 715 insertions, 0 deletions
diff --git a/modules/darwin/base.nix b/modules/darwin/base.nix new file mode 100644 index 0000000..b01bd12 --- /dev/null +++ b/modules/darwin/base.nix @@ -0,0 +1,17 @@ +{inputs, ...}: let + channelPath = i: "${inputs.${i}.outPath}"; + mapInputs = fn: map fn (builtins.filter (n: n != "self") (builtins.attrNames inputs)); +in { + imports = [../shared]; + + nix.nixPath = + mapInputs (i: "${i}=${channelPath i}"); + + programs = { + bash.enable = true; + vim.enable = true; + zsh.enable = true; + }; + + services.nix-daemon.enable = true; +} diff --git a/modules/darwin/default.nix b/modules/darwin/default.nix new file mode 100644 index 0000000..a685fab --- /dev/null +++ b/modules/darwin/default.nix @@ -0,0 +1,6 @@ +{ + flake.darwinModules = { + default = ./base.nix; + desktop = ./desktop.nix; + }; +} diff --git a/modules/darwin/desktop.nix b/modules/darwin/desktop.nix new file mode 100644 index 0000000..23664f9 --- /dev/null +++ b/modules/darwin/desktop.nix @@ -0,0 +1,30 @@ +{ + lib, + pkgs, + ... +}: { + fonts.fonts = with pkgs; + lib.mkDefault [ + (nerdfonts.override {fonts = ["FiraCode"];}) + ]; + + homebrew = { + enable = lib.mkDefault true; + caskArgs.require_sha = true; + onActivation = lib.mkDefault { + autoUpdate = true; + cleanup = "zap"; + upgrade = true; + }; + + caskArgs = { + no_quarantine = true; + }; + + casks = [ + "chromium" + ]; + }; + + programs.gnupg.agent.enable = lib.mkDefault true; +} diff --git a/modules/default.nix b/modules/default.nix new file mode 100644 index 0000000..c5f7ce9 --- /dev/null +++ b/modules/default.nix @@ -0,0 +1,6 @@ +{ + imports = [ + ./nixos + ./darwin + ]; +} diff --git a/modules/nixos/base.nix b/modules/nixos/base.nix new file mode 100644 index 0000000..ca696dd --- /dev/null +++ b/modules/nixos/base.nix @@ -0,0 +1,103 @@ +{ + config, + lib, + pkgs, + inputs, + ... +}: let + inherit (lib) mkDefault; + channelPath = i: "/etc/nix/channels/${i}"; + + mapInputs = fn: map fn (builtins.filter (n: n != "self") (builtins.attrNames inputs)); + + # yes this is a bad way to detect which option should be used (or exists) + # but i'm lazy. please do not copy this + passwordFile = + if lib.versionAtLeast config.system.stateVersion "23.11" + then "hashedPasswordFile" + else "passwordFile"; +in { + imports = [ + ../shared + ]; + + environment.systemPackages = with pkgs; [man-pages man-pages-posix]; + + documentation.man = { + generateCaches = mkDefault true; + man-db.enable = mkDefault true; + }; + + i18n = { + supportedLocales = [ + "en_US.UTF-8/UTF-8" + ]; + + defaultLocale = "en_US.UTF-8"; + }; + + networking.networkmanager = { + enable = mkDefault true; + dns = mkDefault "systemd-resolved"; + }; + + nix = { + nixPath = mapInputs (i: "${i}=${channelPath i}"); + gc.dates = mkDefault "weekly"; + settings.trusted-users = ["root" "@wheel"]; + }; + + programs = { + git.enable = mkDefault true; + vim.defaultEditor = mkDefault true; + }; + + security = { + apparmor.enable = mkDefault true; + audit.enable = mkDefault true; + auditd.enable = mkDefault true; + polkit.enable = mkDefault true; + rtkit.enable = mkDefault true; + sudo.execWheelOnly = true; + }; + + services = { + dbus.apparmor = mkDefault "enabled"; + + resolved = { + enable = mkDefault true; + dnssec = mkDefault "allow-downgrade"; + extraConfig = mkDefault '' + [Resolve] + DNS=1.1.1.1 1.0.0.1 + DNSOverTLS=yes + ''; + }; + + journald.extraConfig = '' + MaxRetentionSec=1w + ''; + }; + + system.activationScripts."upgrade-diff" = { + supportsDryActivation = true; + text = '' + ${pkgs.nvd}/bin/nvd --nix-bin-dir=${config.nix.package}/bin diff /run/current-system "$systemConfig" + ''; + }; + + systemd.tmpfiles.rules = + mapInputs (i: "L+ ${channelPath i} - - - - ${inputs.${i}.outPath}"); + + users = { + defaultUserShell = pkgs.bash; + mutableUsers = false; + + users.root = { + home = mkDefault "/root"; + uid = mkDefault config.ids.uids.root; + group = mkDefault "root"; + "${passwordFile}" = mkDefault config.age.secrets.rootPassword.path; + }; + }; +} diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix new file mode 100644 index 0000000..f43e8ae --- /dev/null +++ b/modules/nixos/default.nix @@ -0,0 +1,12 @@ +{ + flake.nixosModules = { + default = ./base.nix; + desktop = ./desktop; + gnome = ./desktop/gnome; + plasma = ./desktop/plasma; + budgie = ./desktop/budgie; + server = ./server; + services = ./services; + hardware = ./hardware; + }; +} diff --git a/modules/nixos/desktop/budgie/default.nix b/modules/nixos/desktop/budgie/default.nix new file mode 100644 index 0000000..d29649b --- /dev/null +++ b/modules/nixos/desktop/budgie/default.nix @@ -0,0 +1,44 @@ +{pkgs, ...}: { + services.xserver = { + displayManager.lightdm.greeters.slick = { + theme = { + name = "Materia-dark"; + package = pkgs.materia-theme; + }; + iconTheme = { + name = "Papirus-Dark"; + package = pkgs.papirus-icon-theme; + }; + cursorTheme = { + name = "Breeze-gtk"; + package = pkgs.libsForQt5.breeze-gtk; + }; + }; + + desktopManager.budgie = { + enable = true; + extraGSettingsOverrides = '' + [org.gnome.desktop.interface:Budgie] + gtk-theme="Materia-dark" + icon-theme="Papirus-Dark" + cursor-theme="Breeze-gtk" + font-name="Noto Sans 10" + document-font-name="Noto Sans 10" + monospace-font-name="Fira Code 10" + enable-hot-corners=true + ''; + }; + }; + + environment.budgie.excludePackages = with pkgs; [ + qogir-theme + qogir-icon-theme + ]; + + environment.systemPackages = with pkgs; [ + alacritty + breeze-gtk + materia-theme + papirus-icon-theme + ]; +} diff --git a/modules/nixos/desktop/default.nix b/modules/nixos/desktop/default.nix new file mode 100644 index 0000000..a40d94e --- /dev/null +++ b/modules/nixos/desktop/default.nix @@ -0,0 +1,56 @@ +{ + lib, + pkgs, + ... +}: { + environment = { + noXlibs = lib.mkForce false; + systemPackages = with pkgs; [wl-clipboard xclip]; + }; + + fonts = { + enableDefaultPackages = lib.mkDefault true; + + packages = lib.mkDefault (with pkgs; [ + corefonts + fira-code + (nerdfonts.override {fonts = ["FiraCode"];}) + noto-fonts + noto-fonts-extra + noto-fonts-emoji + noto-fonts-cjk-sans + ]); + + fontconfig = { + enable = lib.mkDefault true; + defaultFonts = lib.mkDefault { + serif = ["Noto Serif"]; + sansSerif = ["Noto Sans"]; + emoji = ["Noto Color Emoji"]; + monospace = ["Fira Code"]; + }; + }; + }; + + hardware.pulseaudio.enable = false; + + programs = { + dconf.enable = lib.mkDefault true; + firefox.enable = lib.mkDefault true; + xwayland.enable = lib.mkDefault true; + }; + + services = { + pipewire = lib.mkDefault { + enable = true; + wireplumber.enable = true; + alsa.enable = true; + jack.enable = true; + pulse.enable = true; + }; + + xserver.enable = lib.mkDefault true; + }; + + xdg.portal.enable = lib.mkDefault true; +} diff --git a/modules/nixos/desktop/gnome/default.nix b/modules/nixos/desktop/gnome/default.nix new file mode 100644 index 0000000..7e2c07e --- /dev/null +++ b/modules/nixos/desktop/gnome/default.nix @@ -0,0 +1,29 @@ +{ + pkgs, + lib, + ... +}: { + environment = { + gnome.excludePackages = with pkgs; [ + gnome-tour + ]; + + sessionVariables = { + NIXOS_OZONE_WL = "1"; + }; + + systemPackages = with pkgs; [ + adw-gtk3 + blackbox-terminal + ]; + }; + + services.xserver = { + displayManager.gdm = { + enable = true; + wayland = lib.mkForce true; + }; + + desktopManager.gnome.enable = true; + }; +} diff --git a/modules/nixos/desktop/plasma/default.nix b/modules/nixos/desktop/plasma/default.nix new file mode 100644 index 0000000..d580e3f --- /dev/null +++ b/modules/nixos/desktop/plasma/default.nix @@ -0,0 +1,17 @@ +{pkgs, ...}: { + environment = { + plasma5.excludePackages = with pkgs.libsForQt5; [ + khelpcenter + plasma-browser-integration + print-manager + ]; + }; + + services.xserver = { + displayManager.sddm.enable = true; + desktopManager.plasma5 = { + enable = true; + useQtScaling = true; + }; + }; +} diff --git a/modules/nixos/features/tailscale.nix b/modules/nixos/features/tailscale.nix new file mode 100644 index 0000000..cbbe2e5 --- /dev/null +++ b/modules/nixos/features/tailscale.nix @@ -0,0 +1,63 @@ +{ + config, + lib, + pkgs, + ... +}: let + cfg = config.features.tailscale; + inherit (lib) mkDefault mkEnableOption mkIf optionalAttrs; + + baseDir = ../../../secrets/systems/${config.networking.hostName}; +in { + options.features.tailscale = { + enable = mkEnableOption "enable support for tailscale"; + ssh.enable = mkEnableOption "enable support for tailscale ssh"; + }; + + config = mkIf cfg.enable { + age.secrets = mkIf cfg.ssh.enable { + tailscaleAuthKey.file = "${baseDir}/tailscaleAuthKey.age"; + }; + + networking.firewall = + { + allowedUDPPorts = [config.services.tailscale.port]; + trustedInterfaces = ["tailscale0"]; + } + // optionalAttrs cfg.ssh.enable { + allowedTCPPorts = [22]; + }; + + services = { + tailscale.enable = mkDefault true; + }; + + # https://tailscale.com/kb/1096/nixos-minecraft/ + systemd.services = mkIf cfg.ssh.enable { + tailscale-autoconnect = { + description = "Automatic connection to Tailscale"; + + after = ["network-pre.target" "tailscale.service"]; + wants = ["network-pre.target" "tailscale.service"]; + wantedBy = ["multi-user.target"]; + + serviceConfig.Type = "oneshot"; + + script = '' + # wait for tailscaled to settle + sleep 2 + + # check if we are already authenticated to tailscale + status="$(${lib.getExe pkgs.tailscale} status -json | ${lib.getExe pkgs.jq}/bin/jq -r .BackendState)" + if [ $status = "Running" ]; then # if so, then do nothing + exit 0 + fi + + # otherwise authenticate with tailscale + ${lib.getExe pkgs.tailscale}/bin/tailscale up --ssh \ + --auth-key "file:${config.age.secrets.tailscaleAuthKey.path}" + ''; + }; + }; + }; +} diff --git a/modules/nixos/features/virtualisation.nix b/modules/nixos/features/virtualisation.nix new file mode 100644 index 0000000..206a98e --- /dev/null +++ b/modules/nixos/features/virtualisation.nix @@ -0,0 +1,21 @@ +{ + config, + lib, + pkgs, + ... +}: let + cfg = config.features.virtualisation; + inherit (lib) mkEnableOption mkIf; +in { + options.features.virtualisation.enable = mkEnableOption "enable podman"; + + config.virtualisation = mkIf cfg.enable { + podman = { + enable = true; + enableNvidia = true; + extraPackages = with pkgs; [podman-compose]; + autoPrune.enable = true; + }; + oci-containers.backend = "podman"; + }; +} diff --git a/modules/nixos/hardware/default.nix b/modules/nixos/hardware/default.nix new file mode 100644 index 0000000..b939953 --- /dev/null +++ b/modules/nixos/hardware/default.nix @@ -0,0 +1,8 @@ +{lib, ...}: { + imports = [ + ./ssd.nix + ./nvidia.nix + ]; + + hardware.enableAllFirmware = lib.mkDefault true; +} diff --git a/modules/nixos/hardware/nvidia.nix b/modules/nixos/hardware/nvidia.nix new file mode 100644 index 0000000..1b42fef --- /dev/null +++ b/modules/nixos/hardware/nvidia.nix @@ -0,0 +1,34 @@ +{ + config, + lib, + pkgs, + ... +}: let + cfg = config.hardware.nvidia; + inherit (lib) mkEnableOption mkIf; +in { + options.hardware.nvidia.enable = mkEnableOption "enable nvidia support"; + + config = mkIf cfg.enable { + environment.sessionVariables = { + LIBVA_DRIVER_NAME = "vdpau"; + VDPAU_DRIVER = "nvidia"; + }; + + hardware = { + nvidia = { + package = config.boot.kernelPackages.nvidiaPackages.stable; + modesetting.enable = true; + }; + + opengl = { + enable = true; + # make steam work + driSupport32Bit = true; + extraPackages = [pkgs.vaapiVdpau]; + }; + }; + + services.xserver.videoDrivers = ["nvidia"]; + }; +} diff --git a/modules/nixos/hardware/ssd.nix b/modules/nixos/hardware/ssd.nix new file mode 100644 index 0000000..7279a12 --- /dev/null +++ b/modules/nixos/hardware/ssd.nix @@ -0,0 +1,14 @@ +{ + config, + lib, + ... +}: let + cfg = config.hardware.ssd; + inherit (lib) mkEnableOption mkIf; +in { + options.hardware.ssd.enable = mkEnableOption "ssd settings"; + + config = mkIf cfg.enable { + services.fstrim.enable = true; + }; +} diff --git a/modules/nixos/server/acme.nix b/modules/nixos/server/acme.nix new file mode 100644 index 0000000..48746c2 --- /dev/null +++ b/modules/nixos/server/acme.nix @@ -0,0 +1,14 @@ +{config, ...}: { + age.secrets = { + cloudflareApiKey.file = ../../../secrets/systems/${config.networking.hostName}/cloudflareApiKey.age; + }; + + security.acme = { + acceptTerms = true; + defaults = { + email = "[email protected]"; + dnsProvider = "cloudflare"; + credentialsFile = config.age.secrets.cloudflareApiKey.path; + }; + }; +} diff --git a/modules/nixos/server/default.nix b/modules/nixos/server/default.nix new file mode 100644 index 0000000..1f759ec --- /dev/null +++ b/modules/nixos/server/default.nix @@ -0,0 +1,39 @@ +{ + config, + lib, + pkgs, + inputs, + ... +}: { + imports = [ + ./acme.nix + ./secrets.nix + ]; + + _module.args.unstable = inputs.nixpkgs.legacyPackages.${pkgs.stdenv.hostPlatform.system}; + + documentation = { + enable = false; + + man = { + enable = false; + man-db.enable = false; + }; + + nixos.enable = false; + dev.enable = false; + }; + + environment.defaultPackages = lib.mkForce []; + + nix = { + gc = { + dates = "*-*-1,5,9,13,17,21,25,29 00:00:00"; + options = "-d --delete-older-than 2d"; + }; + + settings.allowed-users = [config.networking.hostName]; + }; + + security.pam.enableSSHAgentAuth = true; +} diff --git a/modules/nixos/server/secrets.nix b/modules/nixos/server/secrets.nix new file mode 100644 index 0000000..e435690 --- /dev/null +++ b/modules/nixos/server/secrets.nix @@ -0,0 +1,12 @@ +{config, ...}: { + age = let + baseDir = ../../../secrets/systems/${config.networking.hostName}; + in { + identityPaths = ["/etc/age/key"]; + + secrets = { + rootPassword.file = "${baseDir}/rootPassword.age"; + userPassword.file = "${baseDir}/userPassword.age"; + }; + }; +} diff --git a/modules/nixos/services/cloudflared.nix b/modules/nixos/services/cloudflared.nix new file mode 100644 index 0000000..a144266 --- /dev/null +++ b/modules/nixos/services/cloudflared.nix @@ -0,0 +1,40 @@ +{ + config, + lib, + ... +}: let + cfg = config.server.services.cloudflared; + inherit (lib) mkEnableOption mkIf; +in { + options.server.services.cloudflared = { + enable = mkEnableOption "cloudflared"; + }; + + config = mkIf cfg.enable { + age.secrets.cloudflaredCreds = { + file = ../../../secrets/systems/${config.networking.hostName}/cloudflaredCreds.age; + mode = "400"; + owner = "cloudflared"; + group = "cloudflared"; + }; + + services.cloudflared = { + enable = true; + tunnels = { + "${config.networking.hostName}-nginx" = { + default = "http_status:404"; + + ingress = let + inherit (config.services) nginx; + in + lib.genAttrs + (builtins.attrNames nginx.virtualHosts) + (_: {service = "http://localhost:${builtins.toString nginx.defaultHTTPListenPort}";}); + + originRequest.noTLSVerify = true; + credentialsFile = config.age.secrets.cloudflaredCreds.path; + }; + }; + }; + }; +} diff --git a/modules/nixos/services/default.nix b/modules/nixos/services/default.nix new file mode 100644 index 0000000..3423b79 --- /dev/null +++ b/modules/nixos/services/default.nix @@ -0,0 +1,7 @@ +{ + imports = [ + ./cloudflared.nix + ./hercules.nix + ./promtail.nix + ]; +} diff --git a/modules/nixos/services/hercules.nix b/modules/nixos/services/hercules.nix new file mode 100644 index 0000000..fc3c92d --- /dev/null +++ b/modules/nixos/services/hercules.nix @@ -0,0 +1,55 @@ +{ + config, + lib, + unstable, + ... +}: let + cfg = config.server.services.hercules-ci; + inherit (lib) mkEnableOption mkIf; + + baseDir = ../../../secrets/systems/${config.networking.hostName}; + hercArgs = { + mode = "400"; + owner = "hercules-ci-agent"; + group = "hercules-ci-agent"; + }; +in { + options.server.services.hercules-ci = { + enable = mkEnableOption "enable hercules-ci"; + secrets.enable = mkEnableOption "manage secrets for hercules-ci"; + }; + + config = mkIf cfg.enable { + age.secrets = mkIf cfg.secrets.enable { + binaryCache = + { + file = "${baseDir}/binaryCache.age"; + } + // hercArgs; + + clusterToken = + { + file = "${baseDir}/clusterToken.age"; + } + // hercArgs; + + secretsJson = + { + file = "${baseDir}/secretsJson.age"; + } + // hercArgs; + }; + + services = { + hercules-ci-agent = { + enable = true; + package = unstable.hercules-ci-agent; + settings = { + binaryCachesPath = config.age.secrets.binaryCache.path; + clusterJoinTokenPath = config.age.secrets.clusterToken.path; + secretsJsonPath = config.age.secrets.secretsJson.path; + }; + }; + }; + }; +} diff --git a/modules/nixos/services/promtail.nix b/modules/nixos/services/promtail.nix new file mode 100644 index 0000000..63faf15 --- /dev/null +++ b/modules/nixos/services/promtail.nix @@ -0,0 +1,47 @@ +{ + config, + lib, + ... +}: let + cfg = config.server.services.promtail; + inherit (lib) mkEnableOption mkIf mkOption types; +in { + options.server.services.promtail = { + enable = mkEnableOption "enable promtail"; + + clients = mkOption { + type = types.listOf types.attrs; + default = [{}]; + description = "clients for promtail"; + }; + }; + + config.services.promtail = mkIf cfg.enable { + enable = true; + configuration = { + inherit (cfg) clients; + server.disable = true; + + scrape_configs = [ + { + job_name = "journal"; + + journal = { + max_age = "12h"; + labels = { + job = "systemd-journal"; + host = "${config.networking.hostName}"; + }; + }; + + relabel_configs = [ + { + source_labels = ["__journal__systemd_unit"]; + target_label = "unit"; + } + ]; + } + ]; + }; + }; +} diff --git a/modules/shared/default.nix b/modules/shared/default.nix new file mode 100644 index 0000000..f251bb2 --- /dev/null +++ b/modules/shared/default.nix @@ -0,0 +1,8 @@ +{lib, ...}: { + imports = [./nix.nix]; + + documentation.man.enable = lib.mkDefault true; + time.timeZone = lib.mkDefault "America/New_York"; + + programs.gnupg.agent.enable = lib.mkDefault true; +} diff --git a/modules/shared/nix.nix b/modules/shared/nix.nix new file mode 100644 index 0000000..2c0aedd --- /dev/null +++ b/modules/shared/nix.nix @@ -0,0 +1,33 @@ +{ + lib, + pkgs, + inputs, + ... +}: { + nix = { + registry = + { + n.flake = lib.mkDefault inputs.nixpkgs; + } + // (builtins.mapAttrs (_: flake: {inherit flake;}) + (lib.filterAttrs (n: _: n != "nixpkgs") inputs)); + + settings = { + auto-optimise-store = pkgs.stdenv.isLinux; + experimental-features = lib.mkDefault ["nix-command" "flakes" "auto-allocate-uids" "repl-flake"]; + + trusted-substituters = lib.mkDefault ["https://cache.garnix.io"]; + trusted-public-keys = lib.mkDefault ["cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="]; + }; + + gc = { + automatic = lib.mkDefault true; + options = lib.mkDefault "--delete-older-than 7d"; + }; + }; + + nixpkgs = { + overlays = with inputs; [nur.overlay getchoo.overlays.default self.overlays.default]; + config.allowUnfree = lib.mkDefault true; + }; +} |