diff --git a/.gitignore b/.gitignore index 7ad6275..b91777e 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ /.direnv +/result diff --git a/README.md b/README.md index e0a673f..aa927d4 100644 --- a/README.md +++ b/README.md @@ -1,10 +1,22 @@ # NixOS & Home Manager config +This repository contains all my system configurations, mostly deployed using Nix and [Clan]. + ## Structure -- **home**: Home Manager modules -- **hosts**: Host-specific configs +- **home**: Dotfiles +- **machines**: Host-specific configs - **infra**: Terraform/OpenTofu files -- **secrets**: Age-encrypted secrets shared between multiple hosts. - Host-specific secrets are stored in their own directories. -- **system**: Base NixOS modules shared among all hosts +- **vars**: Encrypted secrets managed by clan +- **modules**: NixOS modules +- **clanServices**: Custom [Clan Services](https://docs.clan.lol/reference/clanServices) + +## Dotfiles + +### Linking with dotbotc (for windows) + +```sh +dotbot -c ./dotbot/windows.yaml -d home +``` + +[Clan]: https//clan.lol diff --git a/clan/flake-module.nix b/clan/flake-module.nix new file mode 100644 index 0000000..c15a957 --- /dev/null +++ b/clan/flake-module.nix @@ -0,0 +1,185 @@ +{ self, lib, ... }: +{ + imports = [ + ./machines.nix + ./monitoring.nix + ./network.nix + ]; + + clan.meta.name = "blossom"; + clan.meta.domain = "val"; + + clan.secrets.age.plugins = [ + "age-plugin-yubikey" + ]; + + clan.inventory.instances."rpqt-admin" = { + module.input = "clan-core"; + module.name = "admin"; + roles.default.tags.server = { }; + roles.default.machines.haze = { }; + roles.default.settings.allowedKeys = { + rpqt_haze = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGa8R8obgptefcp27Cdp9bc2fiyc9x0oTfMsTPFp2ktE rpqt@haze"; + nixbld_haze = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIyNC2sn5m7m52r4kVZqg0T7abqdz5xh/blU3cYtHKAE nixbld@haze"; + }; + }; + + clan.inventory.instances."sshd" = { + module.input = "clan-core"; + module.name = "sshd"; + roles.server.tags.all = { }; + roles.server.extraModules = [ + self.nixosModules.hardened-ssh-server + ]; + roles.server.settings = { + certificate.searchDomains = [ + "home.rpqt.fr" + ]; + }; + + roles.client.tags.all = { }; + roles.client.settings = { + certificate.searchDomains = [ + "home.rpqt.fr" + ]; + }; + }; + + clan.inventory.instances.user-rpqt = { + module.input = "clan-core"; + module.name = "users"; + roles.default.machines.haze = { + settings = { + user = "rpqt"; + }; + }; + roles.default.extraModules = [ + self.nixosModules.user-rpqt + ]; + }; + + clan.inventory.instances.common-config = { + module = { + input = "clan-core"; + name = "importer"; + }; + roles.default.tags.all = { }; + roles.default.extraModules = [ self.nixosModules.common ]; + }; + + clan.inventory.instances.server-config = { + module = { + input = "clan-core"; + name = "importer"; + }; + roles.default.tags.server = { }; + roles.default.extraModules = [ + { + nix.gc.automatic = lib.mkDefault true; + nix.gc.dates = lib.mkDefault "Mon 3:15"; + nix.gc.randomizedDelaySec = lib.mkDefault "30min"; + nix.gc.options = lib.mkDefault "--delete-older-than 30d"; + } + ]; + }; + + clan.inventory.instances."garage" = { + module.input = "clan-core"; + module.name = "garage"; + roles.default.tags.garage = { }; + }; + + clan.inventory.instances."garage-config" = { + module.input = "clan-core"; + module.name = "importer"; + roles.default.tags.garage = { }; + roles.default.extraModules = [ ../modules/garage.nix ]; + }; + + clan.inventory.instances."trusted-nix-caches" = { + module.input = "clan-core"; + module.name = "trusted-nix-caches"; + roles.default.tags.all = { }; + }; + + clan.inventory.instances."borgbackup-storagebox" = { + module.input = "clan-core"; + module.name = "borgbackup"; + + roles.client.machines = lib.genAttrs [ "crocus" "genepi" "verbena" ] ( + machine: + let + config = self.nixosConfigurations.${machine}.config; + user = "u422292"; + host = "${user}.your-storagebox.de"; + in + { + settings.destinations."storagebox-${config.networking.hostName}" = { + repo = "${user}@${host}:./borgbackup/${config.networking.hostName}"; + rsh = "ssh -oPort=23 -i ${ + config.clan.core.vars.generators.borgbackup.files."borgbackup.ssh".path + } -oStrictHostKeyChecking=accept-new"; + }; + } + ); + roles.client.extraModules = [ + ../modules/storagebox.nix + ]; + roles.server.machines = { }; + }; + + clan.inventory.instances.syncthing = { + roles.peer.tags.syncthing = { }; + roles.peer.settings.folders = { + Documents = { + path = "~/Documents"; + }; + Music = { + path = "~/Music"; + }; + Pictures = { + path = "~/Pictures"; + }; + Videos = { + path = "~/Videos"; + }; + }; + roles.peer.settings.extraDevices = { + pixel-7a = { + id = "IZE7B4Z-LKTJY6Q-77NN4JG-ADYRC77-TYPZTXE-Q35BWV2-AEO7Q3R-ZE63IAU"; + name = "Pixel 7a"; + addresses = [ "dynamic" ]; + }; + }; + }; + + clan.inventory.instances.buildbot = { + module.input = "self"; + module.name = "@rpqt/buildbot"; + + roles.master.machines.verbena = { + settings = { + domain = "buildbot.turifer.dev"; + admins = [ "rpqt" ]; + topic = "buildbot-nix"; + gitea.instanceUrl = "https://git.turifer.dev"; + }; + }; + + roles.master.extraModules = [ + { + services.nginx.virtualHosts."buildbot.turifer.dev" = { + enableACME = true; + forceSSL = true; + }; + + security.acme.certs."buildbot.turifer.dev" = { + email = "admin@turifer.dev"; + }; + } + ]; + + roles.worker.machines.verbena = { }; + }; + +} diff --git a/clan/machines.nix b/clan/machines.nix new file mode 100644 index 0000000..8910a89 --- /dev/null +++ b/clan/machines.nix @@ -0,0 +1,28 @@ +{ + clan.inventory.machines = { + crocus = { + tags = [ + "garage" + "server" + ]; + }; + genepi = { + tags = [ + "garage" + "server" + "syncthing" + ]; + }; + haze = { + tags = [ + "syncthing" + ]; + }; + verbena = { + tags = [ + "garage" + "server" + ]; + }; + }; +} diff --git a/clan/monitoring.nix b/clan/monitoring.nix new file mode 100644 index 0000000..668b23e --- /dev/null +++ b/clan/monitoring.nix @@ -0,0 +1,46 @@ +{ self, ... }: +{ + clan.inventory.instances.prometheus = { + module.input = "self"; + module.name = "@rpqt/prometheus"; + + roles.scraper.machines.genepi = { }; + roles.scraper.settings = { + extraScrapeConfigs = [ + { + job_name = "garage"; + static_configs = [ + { + labels.instance = "crocus"; + targets = [ "crocus.home.rpqt.fr:3903" ]; + } + { + labels.instance = "genepi"; + targets = [ "genepi.home.rpqt.fr:3903" ]; + } + { + labels.instance = "verbena"; + targets = [ "verbena.home.rpqt.fr:3903" ]; + } + ]; + authorization = { + type = "Bearer"; + credentials_file = + self.nixosConfigurations.verbena.config.clan.core.vars.generators.garage.files.metrics_token.path; + }; + } + ]; + }; + + roles.target.tags.server = { }; + roles.target.settings = { + exporters = { + node = { + enabledCollectors = [ + "systemd" + ]; + }; + }; + }; + }; +} diff --git a/clan/network.nix b/clan/network.nix new file mode 100644 index 0000000..8c9e3d0 --- /dev/null +++ b/clan/network.nix @@ -0,0 +1,87 @@ +{ self, ... }: +{ + clan.inventory.instances.zerotier = { + roles.controller.machines.crocus = { }; + roles.moon.machines.crocus = { + settings = { + stableEndpoints = [ + "116.203.18.122" + "2a01:4f8:1c1e:e415::/64" + ]; + }; + }; + roles.peer.tags."all" = { }; + }; + + clan.inventory.instances.internet = { + roles.default.machines.verbena.settings.host = self.infra.machines.verbena.ipv4; + roles.default.machines.crocus.settings.host = self.infra.machines.crocus.ipv4; + }; + + clan.inventory.instances.wireguard = { + module.name = "wireguard"; + module.input = "clan-core"; + roles.controller = { + machines.verbena.settings = { + endpoint = "wg1.turifer.dev"; + }; + }; + roles.peer.machines = { + haze = { }; + crocus = { }; + genepi = { }; + }; + }; + + clan.inventory.instances.certificates = { + module.name = "certificates"; + module.input = "clan-core"; + + roles.ca.machines.verbena = { + settings.acmeEmail = "admin@rpqt.fr"; + settings.tlds = [ "val" ]; + }; + roles.default.tags.all = { }; + roles.default.settings.acmeEmail = "admin@rpqt.fr"; + }; + + # Temporarily patched version of clan-core/coredns for AAAA records support + clan.inventory.instances.coredns = { + module.name = "@rpqt/coredns"; + module.input = "self"; + + roles.default.tags.all = { }; + roles.server.machines.verbena = { + settings.ip = "fd28:387a:90:c400::1"; + settings.dnsPort = 53; + }; + roles.server.machines.crocus = { + settings.ip = "fd28:387a:90:c400:6db2:dfc3:c376:9956"; + }; + roles.server.settings = { + tld = "val"; + }; + + roles.default.machines.verbena.settings = { + ip = "fd28:387a:90:c400::1"; + services = [ + "ca" + "vaultwarden" + ]; + }; + + roles.default.machines.genepi.settings = { + ip = "fd28:387a:90:c400:ab23:3d38:a148:f539"; # FIXME: IPv4 expected (A record) + services = [ + "actual" + "assistant" + "glance" + "grafana" + "images" + "lounge" + "pinchflat" + "rss" + ]; + }; + }; +} diff --git a/clanServices/buildbot/default.nix b/clanServices/buildbot/default.nix new file mode 100644 index 0000000..9ccab43 --- /dev/null +++ b/clanServices/buildbot/default.nix @@ -0,0 +1,158 @@ +{ self, ... }: +{ lib, ... }: +{ + _class = "clan.service"; + manifest.name = "buildbot"; + + roles.master = { + interface.options = { + domain = lib.mkOption { + type = lib.types.str; + description = "Domain name under which the buildbot frontend is reachable"; + example = "https://buildbot.example.com"; + }; + admins = lib.mkOption { + type = lib.types.listOf lib.types.str; + description = "List of usernames allowed to authenticate to the buildbot frontend"; + example = [ "Mic92" ]; + }; + topic = lib.mkOption { + type = lib.types.str; + description = "Name of the topic attached to repositories that should be built"; + example = "buildbot-nix"; + }; + gitea.instanceUrl = lib.mkOption { + type = lib.types.str; + description = "URL of the Gitea instance"; + example = "https://git.example.com"; + }; + }; + + perInstance = + { + settings, + roles, + ... + }: + { + nixosModule = + { + config, + lib, + pkgs, + ... + }: + { + imports = [ + self.inputs.buildbot-nix.nixosModules.buildbot-master + ]; + + services.buildbot-nix.master = { + enable = true; + workersFile = config.clan.core.vars.generators.buildbot.files.workers-file.path; + inherit (settings) domain admins; + + authBackend = "gitea"; + gitea = { + enable = true; + inherit (settings.gitea) instanceUrl; + inherit (settings) topic; + + tokenFile = config.clan.core.vars.generators.buildbot.files.api-token.path; + webhookSecretFile = config.clan.core.vars.generators.buildbot.files.webhook-secret.path; + + oauthId = config.clan.core.vars.generators.buildbot.files.oauth-id.value; + oauthSecretFile = config.clan.core.vars.generators.buildbot.files.oauth-secret.path; + }; + }; + + clan.core.vars.generators.buildbot = { + prompts.api-token = { + description = "gitea API token"; + type = "hidden"; + persist = true; + }; + prompts.webhook-secret = { + description = "gitea webhook secret"; + type = "hidden"; + persist = true; + }; + prompts.oauth-id = { + description = "oauth client id"; + persist = true; + }; + files.oauth-id.secret = false; + prompts.oauth-secret = { + description = "oauth secret"; + type = "hidden"; + persist = true; + }; + + dependencies = [ "buildbot-worker" ]; + files.workers-file.secret = true; + runtimeInputs = [ pkgs.python3 ]; + script = '' + python3 - << EOF + import os + import json + + password_path = os.path.join(os.environ.get("in"), "buildbot-worker/worker-password") + password = open(password_path).read().strip() + + workers = [ + { + "name": "${config.networking.hostName}", + "pass": password, + "cores": 4, + }, + ]; + + workers_file_path = os.path.join(os.environ.get("out"), "workers-file") + with open(workers_file_path, "w") as workers_file: + workers_file.write(json.dumps(workers)) + + EOF + ''; + }; + }; + }; + }; + + roles.worker = { + perInstance = + { + settings, + roles, + ... + }: + { + nixosModule = + { + config, + lib, + pkgs, + ... + }: + { + imports = [ + self.inputs.buildbot-nix.nixosModules.buildbot-worker + ]; + + services.buildbot-nix.worker = { + enable = true; + workerPasswordFile = config.clan.core.vars.generators.buildbot-worker.files.worker-password.path; + }; + + clan.core.vars.generators.buildbot-worker = { + files.worker-password = { }; + runtimeInputs = [ + pkgs.openssl + ]; + script = '' + openssl rand -hex 32 > "$out"/worker-password + ''; + }; + }; + }; + }; +} diff --git a/clanServices/buildbot/flake-module.nix b/clanServices/buildbot/flake-module.nix new file mode 100644 index 0000000..867a703 --- /dev/null +++ b/clanServices/buildbot/flake-module.nix @@ -0,0 +1,4 @@ +{ self, lib, ... }: +{ + clan.modules."@rpqt/buildbot" = lib.modules.importApply ./default.nix { inherit self; }; +} diff --git a/clanServices/coredns/README.md b/clanServices/coredns/README.md new file mode 100644 index 0000000..6283045 --- /dev/null +++ b/clanServices/coredns/README.md @@ -0,0 +1,73 @@ +!!! Danger "Experimental" + This service is experimental and will change in the future. + +This module enables hosting clan-internal services easily, which can be resolved +inside your VPN. This allows defining a custom top-level domain (e.g. `.clan`) +and exposing endpoints from a machine to others, which will be +accessible under `http://.clan` in your browser. + +The service consists of two roles: + +- A `server` role: This is the DNS-server that will be queried when trying to + resolve clan-internal services. It defines the top-level domain. +- A `default` role: This does two things. First, it sets up the nameservers so + that clan-internal queries are resolved via the `server` machine, while + external queries are resolved as normal via DHCP. Second, it allows exposing + services (see example below). + +## Example Usage + +Here the machine `dnsserver` is designated as internal DNS-server for the TLD +`.foo`. `server01` will host an application that shall be reachable at +`http://one.foo` and `server02` is going to be reachable at `http://two.foo`. +`client` is any other machine that is part of the clan but does not host any +services. + +When `client` tries to resolve `http://one.foo`, the DNS query will be +routed to `dnsserver`, which will answer with `192.168.1.3`. If it tries to +resolve some external domain (e.g. `https://clan.lol`), the query will not be +routed to `dnsserver` but resolved as before, via the nameservers advertised by +DHCP. + +```nix +inventory = { + + machines = { + dnsserver = { }; # 192.168.1.2 + server01 = { }; # 192.168.1.3 + server02 = { }; # 192.168.1.4 + client = { }; # 192.168.1.5 + }; + + instances = { + coredns = { + + module.name = "@clan/coredns"; + module.input = "self"; + + # Add the default role to all machines, including `client` + roles.default.tags.all = { }; + + # DNS server queries to http://.foo are resolved here + roles.server.machines."dnsserver".settings = { + ip = "192.168.1.2"; + tld = "foo"; + }; + + # First service + # Registers http://one.foo will resolve to 192.168.1.3 + # underlying service runs on server01 + roles.default.machines."server01".settings = { + ip = "192.168.1.3"; + services = [ "one" ]; + }; + + # Second service + roles.default.machines."server02".settings = { + ip = "192.168.1.4"; + services = [ "two" ]; + }; + }; + }; +}; +``` diff --git a/clanServices/coredns/default.nix b/clanServices/coredns/default.nix new file mode 100644 index 0000000..20d4350 --- /dev/null +++ b/clanServices/coredns/default.nix @@ -0,0 +1,235 @@ +{ ... }: + +{ + _class = "clan.service"; + manifest.name = "coredns"; + manifest.description = "Clan-internal DNS and service exposure"; + manifest.categories = [ "Network" ]; + manifest.readme = builtins.readFile ./README.md; + + roles.server = { + description = "A DNS server that resolves services in the clan network."; + interface = + { lib, ... }: + { + options.tld = lib.mkOption { + type = lib.types.str; + default = "clan"; + description = '' + Top-level domain for this instance. All services below this will be + resolved internally. + ''; + }; + + options.ip = lib.mkOption { + type = lib.types.str; + # TODO: Set a default + description = "IP for the DNS to listen on"; + }; + + options.dnsPort = lib.mkOption { + type = lib.types.int; + default = 1053; + description = "Port of the clan-internal DNS server"; + }; + }; + + perInstance = + { + roles, + settings, + ... + }: + { + nixosModule = + { + lib, + pkgs, + ... + }: + + let + hostServiceEntries = + host: + lib.strings.concatStringsSep "\n" ( + map ( + service: + let + ip = roles.default.machines.${host}.settings.ip; + isIPv4 = addr: (builtins.match "\\." addr) != null; + recordType = if (isIPv4 ip) then "A" else "AAAA"; + in + "${service} IN ${recordType} ${ip} ; ${host}" + ) roles.default.machines.${host}.settings.services + ); + + hostnameEntries = '' + crocus 10800 IN AAAA fd28:387a:90:c400:6db2:dfc3:c376:9956 + genepi 10800 IN AAAA fd28:387a:90:c400:ab23:3d38:a148:f539 + verbena 10800 IN AAAA fd28:387a:90:c400::1 + haze 10800 IN AAAA fd28:387a:90:c400:840e:e9db:4c08:b920 + ''; + + zonefile = builtins.toFile "${settings.tld}.zone" ( + '' + $TTL 3600 ; 1 Hour + $ORIGIN ${settings.tld}. + ${settings.tld}. IN SOA ns1 admin.rpqt.fr. ( + 2025112300 ; serial + 10800 ; refresh + 3600 ; retry + 604800 ; expire + 300 ; minimum + ) + + ${builtins.concatStringsSep "\n" ( + lib.lists.imap1 (i: _m: "@ 1D IN NS ns${toString i}.${settings.tld}.") ( + lib.attrNames roles.server.machines + ) + )} + + ${builtins.concatStringsSep "\n" ( + lib.lists.imap1 (i: m: "ns${toString i} 10800 IN CNAME ${m}.${settings.tld}.") ( + lib.attrNames roles.server.machines + ) + )} + + '' + + hostnameEntries + + "\n" + + (lib.strings.concatStringsSep "\n" ( + map (host: hostServiceEntries host) (lib.attrNames roles.default.machines) + )) + ); + in + { + networking.firewall.interfaces.wireguard = { + allowedTCPPorts = [ settings.dnsPort ]; + allowedUDPPorts = [ settings.dnsPort ]; + }; + + services.coredns = { + enable = true; + config = + + let + dnsPort = builtins.toString settings.dnsPort; + in + + '' + .:${dnsPort} { + bind wireguard + forward . 1.1.1.1 + cache 30 + } + + ${settings.tld}:${dnsPort} { + bind wireguard + file ${zonefile} + } + ''; + }; + }; + }; + }; + + roles.default = { + description = "A machine that registers the 'server' role as resolver and registers services under the configured TLD in the resolver."; + interface = + { lib, ... }: + { + options.services = lib.mkOption { + type = lib.types.listOf lib.types.str; + default = [ ]; + description = '' + Service endpoints this host exposes (without TLD). Each entry will + be resolved to . using the configured top-level domain. + ''; + }; + + options.ip = lib.mkOption { + type = lib.types.str; + # TODO: Set a default + description = "IP on which the services will listen"; + }; + + options.dnsPort = lib.mkOption { + type = lib.types.int; + default = 1053; + description = "Port of the clan-internal DNS server"; + }; + }; + + perInstance = + { roles, settings, ... }: + { + nixosModule = + { config, lib, ... }: + { + + networking.nameservers = map ( + m: + let + port = config.services.unbound.settings.server.port or 53; + in + "127.0.0.1:${toString port}#${roles.server.machines.${m}.settings.tld}" + ) (lib.attrNames roles.server.machines); + + services.resolved.domains = map (m: "~${roles.server.machines.${m}.settings.tld}") ( + lib.attrNames roles.server.machines + ); + + services.unbound = { + enable = true; + # resolveLocalQueries = true; + checkconf = true; + settings = { + server = { + port = 5353; + verbosity = 2; + interface = [ "127.0.0.1" ]; + access-control = [ "127.0.0.0/8 allow" ]; + do-not-query-localhost = "no"; + domain-insecure = map (m: "${roles.server.machines.${m}.settings.tld}.") ( + lib.attrNames roles.server.machines + ); + }; + + # Default: forward everything else to DHCP-provided resolvers + # forward-zone = [ + # { + # name = "."; + # forward-addr = "127.0.0.53@53"; # Forward to systemd-resolved + # } + # ]; + forward-zone = [ + { + name = "."; + forward-tls-upstream = true; + forward-addr = [ + "9.9.9.9#dns.quad9.net" + "149.112.112.112#dns.quad9.net" + "1.1.1.1@853#cloudflare-dns.com" + "1.0.0.1@853#cloudflare-dns.com" + "2606:4700:4700::1111@853#cloudflare-dns.com" + "2606:4700:4700::1001@853#cloudflare-dns.com" + "8.8.8.8#dns.google" + "8.8.4.4#dns.google" + "2001:4860:4860::8888#dns.google" + "2001:4860:4860::8844#dns.google" + ]; + } + ]; + + stub-zone = { + name = "${roles.server.machines.${(lib.head (lib.attrNames roles.server.machines))}.settings.tld}."; + stub-addr = map ( + m: "${roles.server.machines.${m}.settings.ip}@${builtins.toString settings.dnsPort}" + ) (lib.attrNames roles.server.machines); + }; + }; + }; + }; + }; + }; +} diff --git a/clanServices/coredns/flake-module.nix b/clanServices/coredns/flake-module.nix new file mode 100644 index 0000000..69c8537 --- /dev/null +++ b/clanServices/coredns/flake-module.nix @@ -0,0 +1,18 @@ +{ ... }: +let + module = ./default.nix; +in +{ + clan.modules = { + "@rpqt/coredns" = module; + }; + # perSystem = + # { ... }: + # { + # clan.nixosTests.coredns = { + # imports = [ ./tests/vm/default.nix ]; + + # clan.modules."@rpqt/coredns" = module; + # }; + # }; +} diff --git a/clanServices/flake-module.nix b/clanServices/flake-module.nix new file mode 100644 index 0000000..138d0f4 --- /dev/null +++ b/clanServices/flake-module.nix @@ -0,0 +1,7 @@ +{ + imports = [ + ./buildbot/flake-module.nix + ./coredns/flake-module.nix + ./prometheus/flake-module.nix + ]; +} diff --git a/clanServices/prometheus/README.md b/clanServices/prometheus/README.md new file mode 100644 index 0000000..01c8a77 --- /dev/null +++ b/clanServices/prometheus/README.md @@ -0,0 +1,38 @@ +This module enables collecting metrics from machines in clan, using Prometheus. + +There are two roles: + +- A `target` role for machines on which to collect and export metrics. +- A `scraper` roles for machines that fetch metrics from `target` machines and + store them in the long term. + + +```nix +inventory = { + + machines = { + server01.tags.server = {}; + server02.tags.server = {}; + metrics.tags.server = {}; # metrics collector + }; + + instances = { + prometheus = { + module.name = "@rpqt/prometheus"; + module.input = "self"; + + roles.scraper.machines."metrics" = {}; + + # Collect metrics on all servers + roles.target.tags.server = { + settings = { + exporters = { + # Enable the node-exporter metrics source + node.enabledCollectors = [ "systemd" ]; + }; + }; + }; + }; + }; +}; +``` diff --git a/clanServices/prometheus/default.nix b/clanServices/prometheus/default.nix new file mode 100644 index 0000000..58762f3 --- /dev/null +++ b/clanServices/prometheus/default.nix @@ -0,0 +1,114 @@ +{ self, ... }: +{ lib, ... }: +{ + _class = "clan.service"; + manifest.name = "prometheus"; + manifest.description = "Prometheus metrics collection across the clan network."; + manifest.readme = builtins.readFile ./README.md; + + # Only works with zerotier (until a unified network module is ready) + + roles.scraper = { + description = "A server that scrapes metrics from exporters of machines that have the 'target' role."; + interface = { + options.extraScrapeConfigs = lib.mkOption { + type = lib.types.listOf lib.types.attrs; + description = "A list of additional scrape configurations."; + }; + }; + + perInstance = + { + settings, + roles, + ... + }: + { + nixosModule = + { config, lib, ... }: + { + services.prometheus.enable = true; + services.prometheus.scrapeConfigs = + let + allExporters = lib.unique ( + lib.concatLists ( + lib.map (machine: lib.attrNames machine.settings.exporters) (lib.attrValues roles.target.machines) + ) + ); + hasExporter = + exporter: machine: lib.hasAttr exporter roles.target.machines.${machine}.settings.exporters; + mkScrapeConfig = ( + exporter: + let + machinesWithExporter = lib.filter (hasExporter exporter) (lib.attrNames roles.target.machines); + in + { + job_name = exporter; + static_configs = lib.map (machineName: { + targets = + let + targetConfig = self.nixosConfigurations.${machineName}.config; + targetHost = targetConfig.clan.core.vars.generators.zerotier.files.zerotier-ip.value; + in + [ + "[${targetHost}]:${toString targetConfig.services.prometheus.exporters.${exporter}.port}" + ]; + labels.instance = machineName; + }) machinesWithExporter; + } + ); + in + (lib.map mkScrapeConfig allExporters) ++ settings.extraScrapeConfigs; + + clan.core.state.prometheus.folders = [ "/var/lib/${config.services.prometheus.stateDir}" ]; + }; + }; + }; + + roles.target = { + description = "A machine on which to collect and export metrics."; + interface = + { lib, ... }: + { + options = { + exporters = lib.mkOption { + type = lib.types.attrs; + default = { }; + example = { + node = { + enabledCollectors = [ "systemd" ]; + port = 9002; + }; + }; + description = "Attribute set of exporters to enable"; + }; + }; + }; + + perInstance = + { + instanceName, + settings, + machine, + roles, + ... + }: + { + nixosModule = + { config, lib, ... }: + { + services.prometheus.exporters = builtins.mapAttrs ( + name: exporterSettings: + exporterSettings + // { + enable = true; + } + ) settings.exporters; + + networking.firewall.interfaces."zts7mq7onf".allowedTCPPorts = lib.map ( + exporterName: config.services.prometheus.exporters.${exporterName}.port + ) (lib.attrNames settings.exporters); + }; + }; + }; +} diff --git a/clanServices/prometheus/flake-module.nix b/clanServices/prometheus/flake-module.nix new file mode 100644 index 0000000..0c56386 --- /dev/null +++ b/clanServices/prometheus/flake-module.nix @@ -0,0 +1,4 @@ +{ self, lib, ... }: +{ + clan.modules."@rpqt/prometheus" = lib.modules.importApply ./default.nix { inherit self; }; +} diff --git a/devShells/flake-module.nix b/devShells/flake-module.nix new file mode 100644 index 0000000..961492c --- /dev/null +++ b/devShells/flake-module.nix @@ -0,0 +1,26 @@ +{ + perSystem = + { + inputs', + pkgs, + ... + }: + { + devShells.default = pkgs.mkShellNoCC { + packages = [ + inputs'.clan-core.packages.clan-cli + pkgs.garage + pkgs.nil # Nix language server + pkgs.nixfmt + pkgs.opentofu + pkgs.terraform-ls + pkgs.deploy-rs + pkgs.zsh + ]; + shellHook = '' + export GARAGE_RPC_SECRET=$(clan vars get crocus garage-shared/rpc_secret) + export GARAGE_RPC_HOST=5d8249fe49264d36bc3532bd88400498bf9497b5cd4872245eb820d5d7797ed6@crocus.val:3901 + ''; + }; + }; +} diff --git a/dotbot/windows.yaml b/dotbot/windows.yaml new file mode 100644 index 0000000..1750fde --- /dev/null +++ b/dotbot/windows.yaml @@ -0,0 +1,8 @@ +- defaults: + link: + relink: true + +- link: + ~/AppData/Roaming/helix/config.toml: .config/helix/config.toml + ~/AppData/Roaming/jj/config.toml: .config/jj/config.toml + ~/AppData/Roaming/nushell/config.nu: .config/nushell/config.nu diff --git a/flake.lock b/flake.lock index 547ca88..e7e5916 100644 --- a/flake.lock +++ b/flake.lock @@ -1,25 +1,25 @@ { "nodes": { - "agenix": { + "buildbot-nix": { "inputs": { - "darwin": "darwin", - "home-manager": "home-manager", + "flake-parts": "flake-parts", + "hercules-ci-effects": "hercules-ci-effects", "nixpkgs": [ "nixpkgs" ], - "systems": "systems" + "treefmt-nix": "treefmt-nix" }, "locked": { - "lastModified": 1745630506, - "narHash": "sha256-bHCFgGeu8XjWlVuaWzi3QONjDW3coZDqSHvnd4l7xus=", - "owner": "ryantm", - "repo": "agenix", - "rev": "96e078c646b711aee04b82ba01aefbff87004ded", + "lastModified": 1768230255, + "narHash": "sha256-d98+nRSV2X86LcJUDZDAR9wvmmGG1uMzY5/zJdKH9pU=", + "owner": "nix-community", + "repo": "buildbot-nix", + "rev": "6c62d4e0e82b607638b00d6f4f4ad06646342826", "type": "github" }, "original": { - "owner": "ryantm", - "repo": "agenix", + "owner": "nix-community", + "repo": "buildbot-nix", "type": "github" } }, @@ -27,23 +27,24 @@ "inputs": { "data-mesher": "data-mesher", "disko": "disko", - "flake-parts": "flake-parts", + "flake-parts": [ + "flake-parts" + ], "nix-darwin": "nix-darwin", "nix-select": "nix-select", - "nixos-facter-modules": "nixos-facter-modules", "nixpkgs": [ "nixpkgs" ], "sops-nix": "sops-nix", - "systems": "systems_2", - "treefmt-nix": "treefmt-nix" + "systems": "systems", + "treefmt-nix": "treefmt-nix_2" }, "locked": { - "lastModified": 1747400548, - "narHash": "sha256-zvBGXYkd8pZKkBXlLdcw0/nxSoGJOkwGbc6dz9NS4G8=", + "lastModified": 1768662392, + "narHash": "sha256-tE6k6yaQDF1n4YkTC4aH+BgKNQM36bYdhslP0udgMyY=", "ref": "refs/heads/main", - "rev": "56f3fd0a454635d0449330e6848a98bab6da020e", - "revCount": 6979, + "rev": "1f2f93239ef3638d4b7a2187d021b8d8fe6507b8", + "revCount": 12169, "type": "git", "url": "https://git.clan.lol/clan/clan-core" }, @@ -52,28 +53,6 @@ "url": "https://git.clan.lol/clan/clan-core" } }, - "darwin": { - "inputs": { - "nixpkgs": [ - "agenix", - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1744478979, - "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=", - "owner": "lnl7", - "repo": "nix-darwin", - "rev": "43975d782b418ebf4969e9ccba82466728c2851b", - "type": "github" - }, - "original": { - "owner": "lnl7", - "ref": "master", - "repo": "nix-darwin", - "type": "github" - } - }, "data-mesher": { "inputs": { "flake-parts": [ @@ -84,27 +63,47 @@ "clan-core", "nixpkgs" ], - "systems": [ - "clan-core", - "systems" - ], "treefmt-nix": [ "clan-core", "treefmt-nix" ] }, "locked": { - "lastModified": 1747329636, - "narHash": "sha256-mmyx5trq5ZQp6uShbHNfqgSxdg9OeArcZGdZKtHjhqw=", - "rev": "7afcd6f322b9839699f6f31d5bed884c6dd412c4", + "lastModified": 1768383623, + "narHash": "sha256-X1jD5UvgYW50wWxdxJn9b8hiOvpSoLcO3ZC1AZx7+gQ=", + "rev": "82c2fbf84ea0162d95b4958f02499e68c9a843a6", "type": "tarball", - "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/7afcd6f322b9839699f6f31d5bed884c6dd412c4.tar.gz" + "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/82c2fbf84ea0162d95b4958f02499e68c9a843a6.tar.gz" }, "original": { "type": "tarball", "url": "https://git.clan.lol/clan/data-mesher/archive/main.tar.gz" } }, + "direnv-instant": { + "inputs": { + "flake-parts": [ + "flake-parts" + ], + "nixpkgs": [ + "nixpkgs" + ], + "treefmt-nix": "treefmt-nix_3" + }, + "locked": { + "lastModified": 1768657403, + "narHash": "sha256-YkbdCu2ZInQj72rQQLgVP2x1m8il8+DtwzypBiYrrfE=", + "owner": "Mic92", + "repo": "direnv-instant", + "rev": "ab8c70c557f610e20008eb407d17cfd78b44ea1c", + "type": "github" + }, + "original": { + "owner": "Mic92", + "repo": "direnv-instant", + "type": "github" + } + }, "disko": { "inputs": { "nixpkgs": [ @@ -113,11 +112,11 @@ ] }, "locked": { - "lastModified": 1747274630, - "narHash": "sha256-87RJwXbfOHyzTB9LYagAQ6vOZhszCvd8Gvudu+gf3qo=", + "lastModified": 1766150702, + "narHash": "sha256-P0kM+5o+DKnB6raXgFEk3azw8Wqg5FL6wyl9jD+G5a4=", "owner": "nix-community", "repo": "disko", - "rev": "ec7c109a4f794fce09aad87239eab7f66540b888", + "rev": "916506443ecd0d0b4a0f4cf9d40a3c22ce39b378", "type": "github" }, "original": { @@ -133,11 +132,11 @@ ] }, "locked": { - "lastModified": 1747274630, - "narHash": "sha256-87RJwXbfOHyzTB9LYagAQ6vOZhszCvd8Gvudu+gf3qo=", + "lastModified": 1766150702, + "narHash": "sha256-P0kM+5o+DKnB6raXgFEk3azw8Wqg5FL6wyl9jD+G5a4=", "owner": "nix-community", "repo": "disko", - "rev": "ec7c109a4f794fce09aad87239eab7f66540b888", + "rev": "916506443ecd0d0b4a0f4cf9d40a3c22ce39b378", "type": "github" }, "original": { @@ -149,16 +148,16 @@ "flake-parts": { "inputs": { "nixpkgs-lib": [ - "clan-core", + "buildbot-nix", "nixpkgs" ] }, "locked": { - "lastModified": 1743550720, - "narHash": "sha256-hIshGgKZCgWh6AYJpJmRgFdR3WUbkY04o82X05xqQiY=", + "lastModified": 1767609335, + "narHash": "sha256-feveD98mQpptwrAEggBQKJTYbvwwglSbOv53uCfH9PY=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "c621e8422220273271f52058f618c94e405bb0f5", + "rev": "250481aafeb741edfe23d29195671c19b36b6dca", "type": "github" }, "original": { @@ -167,19 +166,63 @@ "type": "github" } }, + "flake-parts_2": { + "inputs": { + "nixpkgs-lib": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1768135262, + "narHash": "sha256-PVvu7OqHBGWN16zSi6tEmPwwHQ4rLPU9Plvs8/1TUBY=", + "owner": "hercules-ci", + "repo": "flake-parts", + "rev": "80daad04eddbbf5a4d883996a73f3f542fa437ac", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "flake-parts", + "type": "github" + } + }, + "hercules-ci-effects": { + "inputs": { + "flake-parts": [ + "buildbot-nix", + "flake-parts" + ], + "nixpkgs": [ + "buildbot-nix", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1765774562, + "narHash": "sha256-UQhfCggNGDc7eam+EittlYmeW89CZVT1KkFIHZWBH7k=", + "owner": "hercules-ci", + "repo": "hercules-ci-effects", + "rev": "edcbb19948b6caf1700434e369fde6ff9e6a3c93", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "hercules-ci-effects", + "type": "github" + } + }, "home-manager": { "inputs": { "nixpkgs": [ - "agenix", "nixpkgs" ] }, "locked": { - "lastModified": 1745494811, - "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=", + "lastModified": 1768598210, + "narHash": "sha256-kkgA32s/f4jaa4UG+2f8C225Qvclxnqs76mf8zvTVPg=", "owner": "nix-community", "repo": "home-manager", - "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be", + "rev": "c47b2cc64a629f8e075de52e4742de688f930dc6", "type": "github" }, "original": { @@ -188,41 +231,6 @@ "type": "github" } }, - "home-manager_2": { - "inputs": { - "nixpkgs": [ - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1747374689, - "narHash": "sha256-JT/aBZqmK1LbExzwT9cPkvxKc0IC4i6tZKOPjsSWFbI=", - "owner": "nix-community", - "repo": "home-manager", - "rev": "d2263ce5f4c251c0f7608330e8fdb7d1f01f0667", - "type": "github" - }, - "original": { - "owner": "nix-community", - "repo": "home-manager", - "type": "github" - } - }, - "impermanence": { - "locked": { - "lastModified": 1737831083, - "narHash": "sha256-LJggUHbpyeDvNagTUrdhe/pRVp4pnS6wVKALS782gRI=", - "owner": "nix-community", - "repo": "impermanence", - "rev": "4b3e914cdf97a5b536a889e939fb2fd2b043a170", - "type": "github" - }, - "original": { - "owner": "nix-community", - "repo": "impermanence", - "type": "github" - } - }, "nix-darwin": { "inputs": { "nixpkgs": [ @@ -231,11 +239,11 @@ ] }, "locked": { - "lastModified": 1747365160, - "narHash": "sha256-4ZVr0x+ry6ybym/VhVYACj0HlJo44YxAaPGOxiS88Hg=", + "lastModified": 1768561867, + "narHash": "sha256-prGOZ+w3pZfGTRxworKcJliCNsewF0L4HUPjgU/6eaw=", "owner": "nix-darwin", "repo": "nix-darwin", - "rev": "8817b00b0011750381d0d44bb94d61087349b6ba", + "rev": "8b720b9662d4dd19048664b7e4216ce530591adc", "type": "github" }, "original": { @@ -246,11 +254,11 @@ }, "nix-select": { "locked": { - "lastModified": 1745005516, - "narHash": "sha256-IVaoOGDIvAa/8I0sdiiZuKptDldrkDWUNf/+ezIRhyc=", - "rev": "69d8bf596194c5c35a4e90dd02c52aa530caddf8", + "lastModified": 1763303120, + "narHash": "sha256-yxcNOha7Cfv2nhVpz9ZXSNKk0R7wt4AiBklJ8D24rVg=", + "rev": "3d1e3860bef36857a01a2ddecba7cdb0a14c35a9", "type": "tarball", - "url": "https://git.clan.lol/api/v1/repos/clan/nix-select/archive/69d8bf596194c5c35a4e90dd02c52aa530caddf8.tar.gz" + "url": "https://git.clan.lol/api/v1/repos/clan/nix-select/archive/3d1e3860bef36857a01a2ddecba7cdb0a14c35a9.tar.gz" }, "original": { "type": "tarball", @@ -272,32 +280,17 @@ "type": "github" } }, - "nixos-facter-modules": { - "locked": { - "lastModified": 1743671943, - "narHash": "sha256-7sYig0+RcrR3sOL5M+2spbpFUHyEP7cnUvCaqFOBjyU=", - "owner": "nix-community", - "repo": "nixos-facter-modules", - "rev": "58ad9691670d293a15221d4a78818e0088d2e086", - "type": "github" - }, - "original": { - "owner": "nix-community", - "repo": "nixos-facter-modules", - "type": "github" - } - }, "nixos-generators": { "inputs": { "nixlib": "nixlib", "nixpkgs": "nixpkgs" }, "locked": { - "lastModified": 1742568034, - "narHash": "sha256-QaMEhcnscfF2MqB7flZr+sLJMMYZPnvqO4NYf9B4G38=", + "lastModified": 1764234087, + "narHash": "sha256-NHF7QWa0ZPT8hsJrvijREW3+nifmF2rTXgS2v0tpcEA=", "owner": "nix-community", "repo": "nixos-generators", - "rev": "42ee229088490e3777ed7d1162cb9e9d8c3dbb11", + "rev": "032a1878682fafe829edfcf5fdfad635a2efe748", "type": "github" }, "original": { @@ -308,11 +301,11 @@ }, "nixos-hardware": { "locked": { - "lastModified": 1747129300, - "narHash": "sha256-L3clA5YGeYCF47ghsI7Tcex+DnaaN/BbQ4dR2wzoiKg=", + "lastModified": 1768584846, + "narHash": "sha256-IRPmIOV2tPwxbhP/I9M5AmwhTC0lMPtoPStC+8T6xl0=", "owner": "NixOS", "repo": "nixos-hardware", - "rev": "e81fd167b33121269149c57806599045fd33eeed", + "rev": "cce68f4a54fa4e3d633358364477f5cc1d782440", "type": "github" }, "original": { @@ -340,11 +333,11 @@ }, "nixpkgs_2": { "locked": { - "lastModified": 1747179050, - "narHash": "sha256-qhFMmDkeJX9KJwr5H32f1r7Prs7XbQWtO0h3V0a0rFY=", + "lastModified": 1768564909, + "narHash": "sha256-Kell/SpJYVkHWMvnhqJz/8DqQg2b6PguxVWOuadbHCc=", "owner": "nixos", "repo": "nixpkgs", - "rev": "adaa24fbf46737f3f1b5497bf64bae750f82942e", + "rev": "e4bae1bd10c9c57b2cf517953ab70060a828ee6f", "type": "github" }, "original": { @@ -356,14 +349,17 @@ }, "root": { "inputs": { - "agenix": "agenix", + "buildbot-nix": "buildbot-nix", "clan-core": "clan-core", + "direnv-instant": "direnv-instant", "disko": "disko_2", - "home-manager": "home-manager_2", - "impermanence": "impermanence", + "flake-parts": "flake-parts_2", + "home-manager": "home-manager", "nixos-generators": "nixos-generators", "nixos-hardware": "nixos-hardware", - "nixpkgs": "nixpkgs_2" + "nixpkgs": "nixpkgs_2", + "srvos": "srvos", + "terranix": "terranix" } }, "sops-nix": { @@ -374,11 +370,11 @@ ] }, "locked": { - "lastModified": 1746485181, - "narHash": "sha256-PxrrSFLaC7YuItShxmYbMgSuFFuwxBB+qsl9BZUnRvg=", + "lastModified": 1768481291, + "narHash": "sha256-NjKtkJraCZEnLHAJxLTI+BfdU//9coAz9p5TqveZwPU=", "owner": "Mic92", "repo": "sops-nix", - "rev": "e93ee1d900ad264d65e9701a5c6f895683433386", + "rev": "e085e303dfcce21adcb5fec535d65aacb066f101", "type": "github" }, "original": { @@ -387,6 +383,26 @@ "type": "github" } }, + "srvos": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1768523683, + "narHash": "sha256-UbkyPXPPAbz0gHIWvHZ+jrPTruZqkpuwTFo5JXPnIgU=", + "owner": "nix-community", + "repo": "srvos", + "rev": "90e9331fd79d4c3bb5c1e7cd2df2e560565fe543", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "srvos", + "type": "github" + } + }, "systems": { "locked": { "lastModified": 1681028828, @@ -417,7 +433,52 @@ "type": "github" } }, + "terranix": { + "inputs": { + "flake-parts": [ + "flake-parts" + ], + "nixpkgs": [ + "nixpkgs" + ], + "systems": "systems_2" + }, + "locked": { + "lastModified": 1762472226, + "narHash": "sha256-iVS4sxVgGn+T74rGJjEJbzx+kjsuaP3wdQVXBNJ79A0=", + "owner": "terranix", + "repo": "terranix", + "rev": "3b5947a48da5694094b301a3b1ef7b22ec8b19fc", + "type": "github" + }, + "original": { + "owner": "terranix", + "repo": "terranix", + "type": "github" + } + }, "treefmt-nix": { + "inputs": { + "nixpkgs": [ + "buildbot-nix", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1768031762, + "narHash": "sha256-b2gJDJfi+TbA7Hu2sKip+1mWqya0GJaWrrXQjpbOVTU=", + "owner": "numtide", + "repo": "treefmt-nix", + "rev": "0c445aa21b01fd1d4bb58927f7b268568af87b20", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "treefmt-nix", + "type": "github" + } + }, + "treefmt-nix_2": { "inputs": { "nixpkgs": [ "clan-core", @@ -425,11 +486,32 @@ ] }, "locked": { - "lastModified": 1747299117, - "narHash": "sha256-JGjCVbxS+9t3tZ2IlPQ7sdqSM4c+KmIJOXVJPfWmVOU=", + "lastModified": 1768158989, + "narHash": "sha256-67vyT1+xClLldnumAzCTBvU0jLZ1YBcf4vANRWP3+Ak=", "owner": "numtide", "repo": "treefmt-nix", - "rev": "e758f27436367c23bcd63cd973fa5e39254b530e", + "rev": "e96d59dff5c0d7fddb9d113ba108f03c3ef99eca", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "treefmt-nix", + "type": "github" + } + }, + "treefmt-nix_3": { + "inputs": { + "nixpkgs": [ + "direnv-instant", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1768031762, + "narHash": "sha256-b2gJDJfi+TbA7Hu2sKip+1mWqya0GJaWrrXQjpbOVTU=", + "owner": "numtide", + "repo": "treefmt-nix", + "rev": "0c445aa21b01fd1d4bb58927f7b268568af87b20", "type": "github" }, "original": { diff --git a/flake.nix b/flake.nix index 5103abf..a3b99cd 100644 --- a/flake.nix +++ b/flake.nix @@ -5,128 +5,60 @@ inputs@{ nixpkgs, clan-core, - home-manager, - impermanence, - nixos-generators, - nixos-hardware, - self, + flake-parts, ... }: - let - clan = clan-core.lib.buildClan { - self = self; - meta.name = "blossom"; - specialArgs = { - inherit inputs self; - inherit (import ./parts) keys; - }; - inventory = { - instances = { - "rpqt-admin" = { - module.input = "clan-core"; - module.name = "admin"; - roles.default.machines = { - "crocus" = { }; - "genepi" = { }; - "haze" = { }; - }; - roles.default.settings.allowedKeys = { - rpqt_haze = (import ./parts).keys.rpqt.haze; - }; - }; - }; - services = { - zerotier.default = { - roles.controller.machines = [ - "crocus" - ]; - roles.peer.machines = [ - "haze" - "genepi" - ]; - }; - sshd.default = { - roles.server.machines = [ "crocus" ]; - }; - user-password.rpqt = { - roles.default.machines = [ - "crocus" - "genepi" - "haze" - ]; - config.user = "rpqt"; - }; - }; - }; - }; - in - { - inherit (clan) clanInternals nixosConfigurations; + flake-parts.lib.mkFlake { inherit inputs; } ({ + imports = [ + clan-core.flakeModules.default + inputs.terranix.flakeModule + ./clan/flake-module.nix + ./clanServices/flake-module.nix + ./devShells/flake-module.nix + ./home-manager/flake-module.nix + ./infra/flake-module.nix + ./modules/flake-module.nix + ./packages/flake-module.nix + ]; - devShells = - let - system = "x86_64-linux"; - pkgs = import nixpkgs { - inherit system; - }; - in - { - "${system}".default = pkgs.mkShell { - packages = [ - inputs.agenix.packages.${system}.default - clan-core.packages.${system}.clan-cli - pkgs.nil # Nix language server - pkgs.nixfmt-rfc-style - pkgs.opentofu - pkgs.terraform-ls - pkgs.deploy-rs - pkgs.zsh - ]; - shellhook = '' - exec zsh - ''; - }; - }; - }; + systems = [ + "x86_64-linux" + "aarch64-linux" + ]; + }); inputs = { - nixpkgs = { - url = "github:nixos/nixpkgs?ref=nixos-unstable"; - }; - disko = { - url = "github:nix-community/disko"; - inputs.nixpkgs.follows = "nixpkgs"; - }; - home-manager = { - url = "github:nix-community/home-manager"; - inputs.nixpkgs.follows = "nixpkgs"; - }; - impermanence = { - url = "github:nix-community/impermanence"; - }; - nixos-hardware = { - url = "github:NixOS/nixos-hardware/master"; - }; - nixos-generators = { - url = "github:nix-community/nixos-generators"; - }; - agenix = { - url = "github:ryantm/agenix"; - inputs.nixpkgs.follows = "nixpkgs"; - }; - clan-core = { - url = "git+https://git.clan.lol/clan/clan-core"; - inputs.nixpkgs.follows = "nixpkgs"; - }; - }; + nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable"; - nixConfig = { - extra-substituters = [ - "https://cache.nixos.org" - "https://nix-community.cachix.org" - ]; - extra-trusted-public-keys = [ - "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" - ]; + disko.url = "github:nix-community/disko"; + disko.inputs.nixpkgs.follows = "nixpkgs"; + + home-manager.url = "github:nix-community/home-manager"; + home-manager.inputs.nixpkgs.follows = "nixpkgs"; + + nixos-hardware.url = "github:NixOS/nixos-hardware/master"; + + nixos-generators.url = "github:nix-community/nixos-generators"; + + clan-core.url = "git+https://git.clan.lol/clan/clan-core"; + clan-core.inputs.nixpkgs.follows = "nixpkgs"; + clan-core.inputs.flake-parts.follows = "flake-parts"; + + flake-parts.url = "github:hercules-ci/flake-parts"; + flake-parts.inputs.nixpkgs-lib.follows = "nixpkgs"; + + srvos.url = "github:nix-community/srvos"; + srvos.inputs.nixpkgs.follows = "nixpkgs"; + + buildbot-nix.url = "github:nix-community/buildbot-nix"; + buildbot-nix.inputs.nixpkgs.follows = "nixpkgs"; + + direnv-instant.url = "github:Mic92/direnv-instant"; + direnv-instant.inputs.nixpkgs.follows = "nixpkgs"; + direnv-instant.inputs.flake-parts.follows = "flake-parts"; + + terranix.url = "github:terranix/terranix"; + terranix.inputs.nixpkgs.follows = "nixpkgs"; + terranix.inputs.flake-parts.follows = "flake-parts"; }; } diff --git a/home/chat.nix b/home-manager/chat.nix similarity index 56% rename from home/chat.nix rename to home-manager/chat.nix index 25fcf22..0b9cd4a 100644 --- a/home/chat.nix +++ b/home-manager/chat.nix @@ -1,5 +1,14 @@ -{ config, pkgs, ... }: { + self, + config, + pkgs, + ... +}: +{ + imports = [ + self.homeManagerModules.dotfiles + ]; + home.packages = with pkgs; [ senpai ]; xdg.configFile."senpai".source = "${config.dotfiles.path}/.config/senpai"; diff --git a/home-manager/cli.nix b/home-manager/cli.nix new file mode 100644 index 0000000..89ccda3 --- /dev/null +++ b/home-manager/cli.nix @@ -0,0 +1,76 @@ +{ + self, + config, + osConfig, + pkgs, + ... +}: +let + shellAliases = { + ls = "eza"; + lsa = "ls -A"; + ll = "ls -lh"; + lla = "ls -lAh"; + h = "hx"; + g = "git"; + cd = "z"; + tree = "eza --tree"; + ".." = "cd .."; + "..." = "cd ../.."; + }; +in +{ + imports = [ + self.homeManagerModules.dotfiles + ]; + + home.packages = with pkgs; [ + age + age-plugin-yubikey + bottom + btop + comma + difftastic + doggo + duf + eza + fd + glow + jjui + lazygit + nh + passage + rage + ripgrep + skim + tealdeer + vivid + yazi + zoxide + ]; + + programs.zoxide.enable = true; + programs.starship.enable = true; + programs.bat.enable = true; + + programs.atuin.enable = true; + xdg.dataFile."atuin/key".source = + config.lib.file.mkOutOfStoreSymlink osConfig.clan.core.vars.generators.atuin.files.key.path; + + programs.zsh = { + enable = true; + syntaxHighlighting.enable = true; + inherit shellAliases; + }; + + programs.fish = { + enable = true; + inherit shellAliases; + }; + + xdg.configFile."git".source = "${config.dotfiles.path}/.config/git"; + xdg.configFile."jj/config.toml".source = "${config.dotfiles.path}/.config/jj/config.toml"; + xdg.configFile."task/taskrc".source = "${config.dotfiles.path}/.config/task/taskrc"; + + home.sessionPath = [ "${config.dotfiles.path}/bin" ]; +} diff --git a/home/common.nix b/home-manager/common.nix similarity index 100% rename from home/common.nix rename to home-manager/common.nix diff --git a/home/desktop/default.nix b/home-manager/desktop/default.nix similarity index 56% rename from home/desktop/default.nix rename to home-manager/desktop/default.nix index 2c51df5..b46f155 100644 --- a/home/desktop/default.nix +++ b/home-manager/desktop/default.nix @@ -3,13 +3,13 @@ imports = [ ./fonts.nix ./pass.nix + ./terminal.nix ./wayland.nix ]; home.packages = with pkgs; [ discord seahorse - wofi-emoji ]; home.pointerCursor = { @@ -20,4 +20,14 @@ }; gtk.enable = true; + gtk.iconTheme = { + name = "WhiteSur"; + package = pkgs.whitesur-icon-theme.override { + alternativeIcons = true; + boldPanelIcons = true; + }; + }; + + qt.enable = true; + qt.platformTheme.name = "gtk"; } diff --git a/home/desktop/fonts.nix b/home-manager/desktop/fonts.nix similarity index 56% rename from home/desktop/fonts.nix rename to home-manager/desktop/fonts.nix index b19e389..b987e69 100644 --- a/home/desktop/fonts.nix +++ b/home-manager/desktop/fonts.nix @@ -6,4 +6,8 @@ ]; fonts.fontconfig.enable = true; + fonts.fontconfig.defaultFonts = { + sansSerif = [ "Adwaita Sans" ]; + monospace = [ "Adwaita Mono" ]; + }; } diff --git a/home-manager/desktop/gnome.nix b/home-manager/desktop/gnome.nix new file mode 100644 index 0000000..d246e40 --- /dev/null +++ b/home-manager/desktop/gnome.nix @@ -0,0 +1,13 @@ +{ pkgs, ... }: +{ + home.packages = with pkgs.gnomeExtensions; [ + blur-my-shell + paperwm + ]; + + dconf.settings = { + "org/gnome/nautilus/preferences" = { + show-image-thumbnails = "always"; + }; + }; +} diff --git a/home-manager/desktop/niri.nix b/home-manager/desktop/niri.nix new file mode 100644 index 0000000..9422dda --- /dev/null +++ b/home-manager/desktop/niri.nix @@ -0,0 +1,9 @@ +{ self, config, ... }: +{ + imports = [ + self.homeManagerModules.dotfiles + ./wayland.nix + ]; + + xdg.configFile."niri".source = "${config.dotfiles.path}/.config/niri"; +} diff --git a/home/desktop/pass.nix b/home-manager/desktop/pass.nix similarity index 79% rename from home/desktop/pass.nix rename to home-manager/desktop/pass.nix index 84cc37f..3b60fee 100644 --- a/home/desktop/pass.nix +++ b/home-manager/desktop/pass.nix @@ -9,6 +9,6 @@ programs.gpg.enable = true; services.gpg-agent = { enable = true; - pinentryPackage = pkgs.pinentry-gnome3; + pinentry.package = pkgs.pinentry-gnome3; }; } diff --git a/home-manager/desktop/terminal.nix b/home-manager/desktop/terminal.nix new file mode 100644 index 0000000..46ce790 --- /dev/null +++ b/home-manager/desktop/terminal.nix @@ -0,0 +1,22 @@ +{ + config, + pkgs, + self, + ... +}: +{ + imports = [ + self.homeManagerModules.dotfiles + ]; + + home.packages = [ + pkgs.alacritty + pkgs.ghostty + ]; + + programs.alacritty.enable = true; + xdg.configFile."alacritty/alacritty.toml".source = + "${config.dotfiles.path}/.config/alacritty/alacritty.toml"; + + xdg.configFile."ghostty/config".source = "${config.dotfiles.path}/.config/ghostty/config"; +} diff --git a/home-manager/desktop/vicinae.nix b/home-manager/desktop/vicinae.nix new file mode 100644 index 0000000..ecb446a --- /dev/null +++ b/home-manager/desktop/vicinae.nix @@ -0,0 +1,19 @@ +{ + config, + lib, + ... +}: +{ + programs.vicinae = { + enable = true; + systemd.enable = true; + systemd.autoStart = true; + }; + + xdg.configFile."vicinae/vicinae.json".source = + lib.mkForce "${config.dotfiles.path}/.config/vicinae/vicinae.json"; + + xdg.configFile."matugen/config.toml".source = "${config.dotfiles.path}/.config/matugen/config.toml"; + xdg.configFile."matugen/templates/vicinae.toml".source = + "${config.dotfiles.path}/.config/matugen/templates/vicinae.toml"; +} diff --git a/home/desktop/wayland.nix b/home-manager/desktop/wayland.nix similarity index 84% rename from home/desktop/wayland.nix rename to home-manager/desktop/wayland.nix index cdcefb0..2402cce 100644 --- a/home/desktop/wayland.nix +++ b/home-manager/desktop/wayland.nix @@ -1,7 +1,6 @@ { pkgs, ... }: { home.packages = with pkgs; [ - waypaper wl-clipboard ]; } diff --git a/home-manager/dev.nix b/home-manager/dev.nix new file mode 100644 index 0000000..06c3332 --- /dev/null +++ b/home-manager/dev.nix @@ -0,0 +1,42 @@ +{ + self, + config, + pkgs, + ... +}: +{ + imports = [ + ./cli.nix + ./helix.nix + self.homeManagerModules.dotfiles + self.inputs.direnv-instant.homeModules.direnv-instant + ]; + + home.packages = with pkgs; [ + delta + direnv + gh + hut + jujutsu + nix-output-monitor + python3 + radicle-desktop + radicle-node + radicle-tui + typescript-language-server + nil # Nix language server + nixfmt-rfc-style + nixpkgs-review + ]; + + programs.direnv = { + enable = true; + enableZshIntegration = true; + nix-direnv.enable = true; + }; + + programs.direnv-instant.enable = true; + + xdg.configFile."hut/config".source = "${config.dotfiles.path}/.config/hut/config"; + home.file.".ssh/config".source = "${config.dotfiles.path}/.ssh/config"; +} diff --git a/home/dotfiles.nix b/home-manager/dotfiles.nix similarity index 90% rename from home/dotfiles.nix rename to home-manager/dotfiles.nix index 818bec3..ff9c6d8 100644 --- a/home/dotfiles.nix +++ b/home-manager/dotfiles.nix @@ -5,7 +5,7 @@ path = lib.mkOption { type = lib.types.path; apply = toString; - default = config.lib.file.mkOutOfStoreSymlink "${config.home.homeDirectory}/rep/dotfiles"; + default = config.lib.file.mkOutOfStoreSymlink "${config.home.homeDirectory}/rep/flocon/home"; example = "${config.home.homeDirectory}/.dotfiles"; description = "Location of the dotfiles working copy"; }; diff --git a/home-manager/flake-module.nix b/home-manager/flake-module.nix new file mode 100644 index 0000000..4909227 --- /dev/null +++ b/home-manager/flake-module.nix @@ -0,0 +1,5 @@ +{ + flake.homeManagerModules = { + dotfiles.imports = [ ./dotfiles.nix ]; + }; +} diff --git a/home-manager/helix.nix b/home-manager/helix.nix new file mode 100644 index 0000000..61aa5cb --- /dev/null +++ b/home-manager/helix.nix @@ -0,0 +1,24 @@ +{ + self, + config, + pkgs, + ... +}: +{ + imports = [ + self.homeManagerModules.dotfiles + ]; + + home.packages = [ pkgs.helix ]; + + programs.helix = { + enable = true; + defaultEditor = true; + }; + + home.sessionVariables.EDITOR = "hx"; + + xdg.configFile."helix/config.toml".source = "${config.dotfiles.path}/.config/helix/config.toml"; + xdg.configFile."helix/languages.toml".source = + "${config.dotfiles.path}/.config/helix/languages.toml"; +} diff --git a/home-manager/mail/default.nix b/home-manager/mail/default.nix new file mode 100644 index 0000000..fba8674 --- /dev/null +++ b/home-manager/mail/default.nix @@ -0,0 +1,110 @@ +{ config, ... }: +let + pass = "passage"; +in +{ + programs.thunderbird = { + enable = true; + profiles = { + main = { + isDefault = true; + }; + }; + }; + + programs.aerc = { + enable = true; + # safe since the accounts file just contains commands for retrieving passwords and is readonly in the nix store + extraConfig.general.unsafe-accounts-conf = true; + }; + + accounts.email.accounts = { + "rpqt@rpqt.fr" = rec { + address = "rpqt@rpqt.fr"; + realName = "Romain Paquet"; + primary = true; + flavor = "migadu.com"; + thunderbird.enable = config.programs.thunderbird.enable; + aerc.enable = config.programs.aerc.enable; + passwordCommand = [ + pass + "show" + "mail/${address}" + ]; + folders.inbox = "INBOX"; + }; + + "admin@rpqt.fr" = rec { + address = "admin@rpqt.fr"; + aliases = [ "postmaster@rpqt.fr" ]; + realName = "Postmaster"; + flavor = "migadu.com"; + thunderbird.enable = config.programs.thunderbird.enable; + aerc.enable = config.programs.aerc.enable; + passwordCommand = [ + pass + "show" + "mail/${address}" + ]; + folders.inbox = "INBOX"; + }; + + "romain.paquet@grenoble-inp.org" = rec { + address = "romain.paquet@grenoble-inp.org"; + realName = "Romain Paquet"; + userName = "romain.paquet@grenoble-inp.org"; + imap = { + host = "imap.partage.renater.fr"; + port = 993; + }; + smtp = { + host = "smtp.partage.renater.fr"; + port = 465; + }; + thunderbird.enable = config.programs.thunderbird.enable; + aerc.enable = config.programs.aerc.enable; + passwordCommand = [ + pass + "show" + "mail/${address}" + ]; + folders.inbox = "INBOX"; + }; + + "admin@turifer.dev" = rec { + address = "admin@turifer.dev"; + aliases = [ "postmaster@turifer.dev" ]; + realName = "Postmaster"; + flavor = "migadu.com"; + thunderbird.enable = config.programs.thunderbird.enable; + aerc.enable = config.programs.aerc.enable; + passwordCommand = [ + pass + "mail/${address}" + ]; + }; + + "romain@student.agh.edu.pl" = { + address = "romain@student.agh.edu.pl"; + aliases = [ "382799@student.agh.edu.pl" ]; + realName = "Romain Paquet"; + userName = "romain@student.agh.edu.pl"; + imap = { + host = "poczta.agh.edu.pl"; + port = 993; + }; + smtp = { + host = "poczta.agh.edu.pl"; + port = 465; + }; + thunderbird.enable = config.programs.thunderbird.enable; + }; + + "romain.pqt@gmail.com" = { + address = "romain.pqt@gmail.com"; + realName = "Romain Paquet"; + flavor = "gmail.com"; + thunderbird.enable = config.programs.thunderbird.enable; + }; + }; +} diff --git a/home/minecraft.nix b/home-manager/minecraft.nix similarity index 100% rename from home/minecraft.nix rename to home-manager/minecraft.nix diff --git a/home/.clang-format b/home/.clang-format new file mode 100644 index 0000000..340e78a --- /dev/null +++ b/home/.clang-format @@ -0,0 +1,16 @@ +BasedOnStyle: LLVM + +IndentWidth: 8 +TabWidth: 8 +UseTab: Always + +ColumnLimit: 80 + +IndentCaseLabels: false +IndentGotoLabels: false + +BreakBeforeBraces: Custom +BraceWrapping: + AfterFunction: false + +AlwaysBreakAfterDefinitionReturnType: false diff --git a/home/.config/alacritty/alacritty.toml b/home/.config/alacritty/alacritty.toml new file mode 100644 index 0000000..62b95bd --- /dev/null +++ b/home/.config/alacritty/alacritty.toml @@ -0,0 +1,37 @@ +[general] +live_config_reload = false +import = ["~/.config/alacritty/themes/kanagawa_wave.toml"] + +[font] +size = 14 + +[font.bold] +family = "Jetbrains Mono NF" +style = "Bold" + +[font.bold_italic] +family = "Jetbrains Mono NF" +style = "Bold Italic" + +[font.italic] +family = "Jetbrains Mono NF" +style = "Italic" + +[font.normal] +family = "Jetbrains Mono NF" +style = "Regular" + +[[keyboard.bindings]] +action = "CreateNewWindow" +key = "Return" +mods = "Control|Shift" + +[mouse] +hide_when_typing = true + +[window] +opacity = 1.0 + +[window.padding] +x = 4 +y = 4 diff --git a/home/.config/alacritty/themes/kanagawa_lotus.toml b/home/.config/alacritty/themes/kanagawa_lotus.toml new file mode 100644 index 0000000..7621688 --- /dev/null +++ b/home/.config/alacritty/themes/kanagawa_lotus.toml @@ -0,0 +1,35 @@ +[colors.primary] +background = '#f2ecbc' +foreground = '#545464' + +[colors.normal] +black = "#1f1f28" +red = "#c84053" +green = "#6f894e" +yellow = "#77713f" +blue = "#4d699b" +magenta = "#b35b79" +cyan = "#597b75" +white = "#545464" + +[colors.bright] +black = "#8a8980" +red = "#d7474b" +green = "#6e915f" +yellow = "#836f4a" +blue = "#6693bf" +magenta = "#624c83" +cyan = "#5e857a" +white = "#43436c" + +[colors.selection] +background = '#c9cbd1' +foreground = '#dcd7ba' + +[[colors.indexed_colors]] +index = 16 +color = '#e98a00' + +[[colors.indexed_colors]] +index = 17 +color = '#e82424' diff --git a/home/.config/alacritty/themes/kanagawa_wave.toml b/home/.config/alacritty/themes/kanagawa_wave.toml new file mode 100644 index 0000000..8585305 --- /dev/null +++ b/home/.config/alacritty/themes/kanagawa_wave.toml @@ -0,0 +1,35 @@ +[[colors.indexed_colors]] +color = "0xffa066" +index = 16 + +[[colors.indexed_colors]] +color = "0xff5d62" +index = 17 + +[colors.bright] +black = "0x727169" +blue = "0x7fb4ca" +cyan = "0x7aa89f" +green = "0x98bb6c" +magenta = "0x938aa9" +red = "0xe82424" +white = "0xdcd7ba" +yellow = "0xe6c384" + +[colors.normal] +black = "0x090618" +blue = "0x7e9cd8" +cyan = "0x6a9589" +green = "0x76946a" +magenta = "0x957fb8" +red = "0xc34043" +white = "0xc8c093" +yellow = "0xc0a36e" + +[colors.primary] +background = "0x1f1f28" +foreground = "0xdcd7ba" + +[colors.selection] +background = "0x2d4f67" +foreground = "0xc8c093" diff --git a/home/.config/bat/config b/home/.config/bat/config new file mode 100644 index 0000000..b83e6e2 --- /dev/null +++ b/home/.config/bat/config @@ -0,0 +1 @@ +--theme gruvbox-dark diff --git a/home/.config/ghostty/config b/home/.config/ghostty/config new file mode 100644 index 0000000..9483b2a --- /dev/null +++ b/home/.config/ghostty/config @@ -0,0 +1,6 @@ +theme = dark:Kanagawa Wave,light:Builtin Light +font-feature = -liga +font-feature = -calt +font-feature = -dlig +font-size = 14 +window-inherit-working-directory = false diff --git a/home/.config/git/common.gitconfig b/home/.config/git/common.gitconfig new file mode 100644 index 0000000..e875b78 --- /dev/null +++ b/home/.config/git/common.gitconfig @@ -0,0 +1,54 @@ +[user] + email = rpqt@rpqt.fr + name = Romain Paquet +[init] + defaultBranch = main +[core] + excludesfile = ~/.config/git/ignore +[filter "lfs"] + clean = git-lfs clean -- %f + smudge = git-lfs smudge -- %f + process = git-lfs filter-process + required = true +[color] + ui = auto +[sendemail] + smtpserver = smtp.migadu.com + smtpuser = rpqt@rpqt.fr + smtpencryption = ssl + smtpserverport = 465 +[diff] + colormoved = "default" + colormovedws = "allow-indentation-change" +[alias] + a = add + s = status + c = commit + news = -c diff.external=difft log -p HEAD@{1}..HEAD@{0} --ext-diff + dlog = -c diff.external=difft log -p --ext-diff + dshow = -c diff.external=difft show --ext-diff + dft = -c diff.external=difft diff + lg1 = log --graph --abbrev-commit --decorate --format=format:'%C(bold blue)%h%C(reset) - %C(bold green)(%ar)%C(reset) %C(white)%s%C(reset) %C(dim white)- %an%C(reset)%C(auto)%d%C(reset)' --all + lg2 = log --graph --abbrev-commit --decorate --format=format:'%C(bold blue)%h%C(reset) - %C(bold cyan)%aD%C(reset) %C(bold green)(%ar)%C(reset)%C(auto)%d%C(reset)%n'' %C(white)%s%C(reset) %C(dim white)- %an%C(reset)' +[column] + ui = auto +[branch] + sort = -committerdate +[tag] + sort = version:refname +[push] + autoSetupRemote = true + followTags = true +[help] + autocorrect = prompt +[commit] + verbose = true +[rerere] + enabled = true + autoupdate = true +[rebase] + autoSquash = true + autoStash = true + updateRefs = true +[pull] + rebase = true diff --git a/home/.config/git/config b/home/.config/git/config new file mode 100644 index 0000000..11e6825 --- /dev/null +++ b/home/.config/git/config @@ -0,0 +1,5 @@ +[include] + path = ~/.config/git/common.gitconfig + path = ~/.config/git/local.gitconfig +[includeIf "gitdir:~/imag/"] + path = ~/.config/git/ensimag.gitconfig diff --git a/home/.config/git/ensimag.gitconfig b/home/.config/git/ensimag.gitconfig new file mode 100644 index 0000000..9f17d9f --- /dev/null +++ b/home/.config/git/ensimag.gitconfig @@ -0,0 +1,3 @@ +[user] + name = "Romain Paquet" + email = romain.paquet@grenoble-inp.org diff --git a/home/.config/git/ignore b/home/.config/git/ignore new file mode 100644 index 0000000..de033e6 --- /dev/null +++ b/home/.config/git/ignore @@ -0,0 +1,4 @@ +/.direnv +/.helix +/.settings +/.classpath diff --git a/home/.config/helix/config.toml b/home/.config/helix/config.toml new file mode 100644 index 0000000..5c3ec91 --- /dev/null +++ b/home/.config/helix/config.toml @@ -0,0 +1,21 @@ +theme = "kanagawa" + +[editor] +line-number = "absolute" +auto-completion = true +auto-format = true +end-of-line-diagnostics = "hint" + +[editor.cursor-shape] +insert = "bar" +normal = "block" + +[editor.statusline] +left = ["mode", "spinner", "file-name"] +right = ["diagnostics", "file-encoding", "file-type", "position"] +mode.normal = "NORMAL" +mode.insert = "INSERT" +mode.select = "SELECT" + +[editor.inline-diagnostics] +cursor-line = "error" diff --git a/home/.config/helix/languages.toml b/home/.config/helix/languages.toml new file mode 100644 index 0000000..3befed1 --- /dev/null +++ b/home/.config/helix/languages.toml @@ -0,0 +1,64 @@ +[[language]] +name = "c" +scope = "source.c" +file-types = ["c", "h"] +indent = { tab-width = 4, unit = "\t" } +auto-format = true +language-servers = [ { name = "clangd" } ] + +[language-server.clangd] +command = "clangd" +args = ["--header-insertion=never"] + +[[language]] +name = "rust" +language-servers = [ "rust-analyzer" ] +auto-format = true + +[language-server.rust-analyzer.config] +check.command = "clippy" + +[language-server.deno-lsp] +command = "deno" +args = ["lsp"] + +[language-server.deno-lsp.config.deno] +enable = true +lint = true +suggest.imports.hosts = { "https://deno.land" = true } + +[[language]] +name = "typescript" +file-types = ["ts"] +language-servers = ["deno-lsp"] + +[[language]] +name = "djot" +scope = "source.djot" +file-types = ["dj"] + +[[grammar]] +name = "djot" +source = { git = "https://github.com/treeman/tree-sitter-djot", rev = "master" } + +[[language]] +name = "nix" +formatter = { command = "nixfmt" } + +[[language]] +name = "java" +formatter = { command = "google-java-format", args = ["--aosp"] } +auto-format = true + +[[language]] +name = "hcl" +formatter = { command = "tofu", args = ["fmt", "-"] } +auto-format = true + +[[language]] +name = "vento" +indent = { tab-width = 2, unit = "\t" } + +[[language]] +name = "ocaml" +auto-format = true diff --git a/home/.config/hut/config b/home/.config/hut/config new file mode 100644 index 0000000..3a644b9 --- /dev/null +++ b/home/.config/hut/config @@ -0,0 +1,3 @@ +instance "sr.ht" { + access-token-cmd pass oauth/sr.ht-hut@haze +} diff --git a/home/.config/i3status-rust/bottom-config.toml b/home/.config/i3status-rust/bottom-config.toml new file mode 100644 index 0000000..bd8de83 --- /dev/null +++ b/home/.config/i3status-rust/bottom-config.toml @@ -0,0 +1,53 @@ +[theme] +theme = "kanagawa" +[theme.overrides] +separator = "" + +[icons] +icons = "material-nf" + +[[block]] +block = "privacy" +[[block.driver]] +name = "pipewire" + +[[block]] +block = "music" +format = " $icon {$combo.str(max_w:70) $prev $next |}" +[[block.click]] +button = "left" +action = "play_pause" + +[[block]] +block = "bluetooth" +mac = "20:74:CF:B5:B7:7A" +format = " $icon $name{ $percentage|} " +disconnected_format = "" + +[[block]] +block = "bluetooth" +mac = "28:11:A5:6B:44:8B" +format = " $icon $name{ $percentage|} " +disconnected_format = "" + +[[block]] +block = "bluetooth" +mac = "00:1E:7C:50:24:8F" +format = " $icon $name{ $percentage|} " +disconnected_format = "" + +[[block]] +block = "toggle" +format = " $icon ensivpn " +command_state = 'nmcli -f general.state con show Ensimag-VPN-ETU-udp | grep -v deactivated' +command_on = "pass show web/ensimag.fr | head -n 1 | nmcli c up Ensimag-VPN-ETU-udp --ask" +command_off = "nmcli c down Ensimag-VPN-ETU-udp" + +[[block]] +block = "net" +interval = 10 +device = "wlan0" +format = " $icon {$ssid|$device} " +[[block.click]] +button = "left" +cmd = "iwgtk" diff --git a/home/.config/i3status-rust/config.toml b/home/.config/i3status-rust/config.toml new file mode 100644 index 0000000..3ea7922 --- /dev/null +++ b/home/.config/i3status-rust/config.toml @@ -0,0 +1,78 @@ +[theme] +theme = "kanagawa" +[theme.overrides] +separator = "" + +[icons] +icons = "material-nf" +[icons.overrides] +sleep = "ó°’²" +no_sleep = "ó°’³" + +[[block]] +block = "toggle" +format = " $icon " +command_state = "pgrep swayidle" +command_on = "swaymsg 'exec swayidle -w'" +command_off = "pkill swayidle" +icon_on = "sleep" +icon_off = "no_sleep" + +[[block]] +block = "toggle" +format = "  $icon " +command_state = 'if [ "$($HOME/bin/darkmode status)" = "dark" ]; then echo y; fi' +command_on = "$HOME/bin/darkmode toggle" +command_off = "$HOME/bin/darkmode toggle" + +[[block]] +block = "hueshift" +format = " 󱩌 {$temperature} " +click_temp = 4000 + +[[block]] +block = "backlight" +format = " $icon $brightness.eng(width:1) " +step_width = 1 +minimum = 1 + +[[block]] +block = "sound" +driver = "pulseaudio" +headphones_indicator = true +show_volume_when_muted = true +format = " $icon $volume.eng(width:1) " +[[block.click]] +button = "left" +cmd = "pavucontrol" +[block.theme_overrides] +warning_bg = { link = "idle_bg" } +warning_fg = { link = "idle_fg"} +idle_bg = { link = "info_bg" } +idle_fg = { link = "info_fg"} + +[[block]] +block = "battery" +interval = 30 +format = " $icon $percentage " +full_format = " $icon $percentage " + +[[block]] +block = "keyboard_layout" +driver = "sway" +sway_kb_identifier = "1267:12613:ASUE140C:00_04F3:3145_Keyboard" +format = "  $layout " +[[block.click]] +button = "left" +cmd = "swaymsg input '1267:12613:ASUE140C:00_04F3:3145_Keyboard' xkb_switch_layout next" +[block.mappings] +"French (N/A)" = "fr" +"English (Colemak-DH)" = "colemak-dh" +"English (US)" = "en" + +[[block]] +block = "time" +interval = 10 +[block.format] +full = " $icon $timestamp.datetime(f:'%a %d/%m/%y %R', l:fr_FR) " +short = " $icon $timestamp.datetime(f:'%R')" diff --git a/home/.config/i3status-rust/themes/kanagawa.toml b/home/.config/i3status-rust/themes/kanagawa.toml new file mode 100644 index 0000000..655c32d --- /dev/null +++ b/home/.config/i3status-rust/themes/kanagawa.toml @@ -0,0 +1,14 @@ +idle_bg = "#151515" +idle_fg = "#dcd7ba" +info_bg = "#2d4f67" +info_fg = "#dcd7ba" +good_bg = "#151515" +good_fg = "#98971a" +warning_bg = "#ff9e3b" +warning_fg = "#16161D" +critical_bg = "#e82424" +critical_fg = "#dcd7ba" +separator = "\ue0b2" +separator_bg = "auto" +separator_fg = "auto" +alternating_tint_bg = "#151515" diff --git a/home/.config/jj/config.toml b/home/.config/jj/config.toml new file mode 100644 index 0000000..fa80ef3 --- /dev/null +++ b/home/.config/jj/config.toml @@ -0,0 +1,54 @@ +"$schema" = "https://jj-vcs.github.io/jj/latest/config-schema.json" + +[ui] +default-command = ["log", "--no-pager"] +diff-formatter = ["difft", "--color=always", "$left", "$right"] +diff-editor = ":builtin" + +[user] +name = "Romain Paquet" +email = "rpqt@rpqt.fr" + +[git] +write-change-id-header = true + +[revset-aliases] +'closest_pushable(to)' = 'heads(::to & mutable() & ~description(exact:"") & (~empty() | merges()))' + +[aliases] +s = ["status", "--no-pager"] +tug = ["bookmark", "move", "--from", "heads(::@ & bookmarks())", "--to", "closest_pushable(@)"] + +[[--scope]] +--when.repositories = ["~/agh"] +[--scope.user] +email = "romain@student.agh.edu.pl" + +[[--scope]] +--when.repositories = ["~/imag"] +[--scope.user] +email = "romain.paquet@grenoble-inp.org" + +# After this line everything is taken from https://andre.arko.net/2025/09/28/stupid-jj-tricks + +[templates] +draft_commit_description = ''' + concat( + coalesce(description, default_commit_description, "\n"), + surround( + "\nJJ: This commit contains the following changes:\n", "", + indent("JJ: ", diff.stat(72)), + ), + "\nJJ: ignore-rest\n", + diff.git(), + ) +''' +log_node = ''' +if(self && !current_working_copy && !immutable && !conflict && in_branch(self), + "â—‡", + builtin_log_node +) +''' + +[template-aliases] +"in_branch(commit)" = 'commit.contained_in("immutable_heads()..bookmarks()")' diff --git a/home/.config/kmonad/config.kbd b/home/.config/kmonad/config.kbd new file mode 100644 index 0000000..587ec51 --- /dev/null +++ b/home/.config/kmonad/config.kbd @@ -0,0 +1,46 @@ +(defcfg + input (device-file "/dev/input/by-path/platform-i8042-serio-0-event-kbd") + output (uinput-sink "KMonad laptop keyboard output") + fallthrough true +) + +(defsrc + esc f1 f2 f3 f4 f5 f6 f7 f8 f9 f10 f11 f12 prnt ins del + grv 1 2 3 4 5 6 7 8 9 0 - = bspc home + tab q w e r t y u i o p [ ] \ pgup + caps a s d f g h j k l ; ' ret pgdn + lsft z x c v b n m , . / rsft end + lctl lmet lalt spc ralt rctl +) + +(defalias + maj (layer-toggle azerty-shift) + agr (layer-toggle azerty-altgr) +) + +(deflayer azerty + esc f1 f2 f3 f4 f5 f6 f7 f8 f9 f10 f11 f12 prnt ins del + grv & é " ' \( - è \_ ç à \) = bspc home + tab a z e r t y u i o p ^ $ * pgup + caps q s d f g h j k l m ù ret pgdn + @maj w x c v b n , ; : ! rsft end + lctl lmet lalt spc @agr rctl +) + +(deflayer azerty-shift + _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ + _ 1 2 3 4 5 6 7 8 9 0 ° + _ _ + _ a _ _ _ _ _ _ _ _ _ _ £ µ _ + _ _ _ _ _ _ _ _ _ _ _ % _ _ + @maj _ _ _ _ _ _ ? . / § rsft _ + lctl lmet lalt spc ralt rctl +) + +(deflayer azerty-altgr + _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ + _ _ ~ # { [ | grv \ ^ @ ] } _ _ + _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ + _ _ _ _ _ _ _ _ _ _ _ _ _ _ + _ _ _ _ _ _ _ _ _ _ _ rsft _ + lctl lmet lalt spc @agr rctl +) diff --git a/home/.config/matugen/config.toml b/home/.config/matugen/config.toml new file mode 100644 index 0000000..e162dc3 --- /dev/null +++ b/home/.config/matugen/config.toml @@ -0,0 +1,6 @@ +[config] + +[templates.vicinae] +input_path = '~/.config/matugen/templates/vicinae.toml' +output_path = '~/.local/share/vicinae/themes/matugen.toml' +post_hook = 'vicinae theme set matugen' diff --git a/home/.config/matugen/templates/vicinae.toml b/home/.config/matugen/templates/vicinae.toml new file mode 100644 index 0000000..b56dbfb --- /dev/null +++ b/home/.config/matugen/templates/vicinae.toml @@ -0,0 +1,127 @@ +# Vicinae Matugen Theme Template +# Used LLM for initial generation, then modified to a satisfactory level + +[meta] +name = "Matugen" +description = "Material You theme generated by Matugen - {{mode}} variant" +variant = "{{mode}}" + +# ============================================================================ +# Core Colors +# ============================================================================ + +[colors.core] +accent = "{{colors.primary.default.hex}}" +accent_foreground = "{{colors.on_primary.default.hex}}" +background = "{{colors.surface.default.hex}}" +foreground = "{{colors.on_surface.default.hex}}" +secondary_background = "{{colors.surface_container.default.hex}}" +border = "{{colors.outline_variant.default.hex}}" + +# ============================================================================ +# Window Borders +# ============================================================================ + +[colors.main_window] +border = "{{colors.outline_variant.default.hex}}" + +[colors.settings_window] +border = "{{colors.outline.default.hex}}" + +# ============================================================================ +# Accent Palette +# ============================================================================ + +[colors.accents] +blue = "{{colors.primary.default.hex}}" +green = "{{colors.tertiary.default.hex}}" +magenta = "{{colors.secondary.default.hex}}" +orange = { name = "{{colors.error.default.hex}}", lighter = 40 } +red = "{{colors.error.default.hex}}" +yellow = { name = "{{colors.tertiary.default.hex}}", lighter = 80 } +cyan = { name = "{{colors.primary.default.hex}}", lighter = 50 } +purple = "{{colors.secondary.default.hex}}" + +# ============================================================================ +# Text System +# ============================================================================ + +[colors.text] +default = "{{colors.on_surface.default.hex}}" +muted = "{{colors.on_surface_variant.default.hex}}" +danger = "{{colors.error.default.hex}}" +success = "{{colors.tertiary.default.hex}}" +placeholder = { name = "{{colors.on_surface_variant.default.hex}}", opacity = 0.6 } + +[colors.text.selection] +background = "{{colors.primary.default.hex}}" +foreground = "{{colors.on_primary.default.hex}}" + +[colors.text.links] +default = "{{colors.primary.default.hex}}" +visited = { name = "{{colors.tertiary.default.hex}}", darker = 20 } + +# ============================================================================ +# Input Fields +# ============================================================================ + +[colors.input] +border = "{{colors.outline.default.hex}}" +border_focus = "{{colors.primary.default.hex}}" +border_error = "{{colors.error.default.hex}}" + +# ============================================================================ +# Buttons +# ============================================================================ + +[colors.button.primary] +background = "{{colors.surface_container_high.default.hex}}" +foreground = "{{colors.on_surface.default.hex}}" + +[colors.button.primary.hover] +background = "{{colors.surface_container_highest.default.hex}}" + +[colors.button.primary.focus] +outline = "{{colors.primary.default.hex}}" + +# ============================================================================ +# Lists +# ============================================================================ + +[colors.list.item.hover] +background = { name = "{{colors.primary_container.default.hex}}", opacity = 0.25 } +foreground = "{{colors.on_surface.default.hex}}" + +[colors.list.item.selection] +background = { name = "{{colors.primary_container.default.hex}}", opacity = 0.50 } +foreground = "{{colors.on_primary_container.default.hex}}" +secondary_background = "{{colors.primary_container.default.hex}}" +secondary_foreground = "{{colors.on_primary_container.default.hex}}" + +# ============================================================================ +# Grid Items +# ============================================================================ + +[colors.grid.item] +background = "{{colors.surface_container.default.hex}}" + +[colors.grid.item.hover] +outline = { name = "{{colors.secondary.default.hex}}", opacity = 0.8 } + +[colors.grid.item.selection] +outline = { name = "{{colors.primary.default.hex}}" } + +# ============================================================================ +# Scrollbars +# ============================================================================ + +[colors.scrollbars] +background = { name = "{{colors.primary.default.hex}}", opacity = 0.2 } + +# ============================================================================ +# Loading States +# ============================================================================ + +[colors.loading] +bar = "{{colors.primary.default.hex}}" +spinner = "{{colors.primary.default.hex}}" diff --git a/home/.config/mpd/mpd.conf b/home/.config/mpd/mpd.conf new file mode 100644 index 0000000..90fac39 --- /dev/null +++ b/home/.config/mpd/mpd.conf @@ -0,0 +1,10 @@ +music_directory "~/Music" +playlist_directory "~/.config/mpd/playlists" +db_file "~/.config/mpd/database" +restore_paused "yes" +state_file "~/.local/state/mpd" + +audio_output { + type "pipewire" + name "pipewire" +} diff --git a/home/.config/niri/config.kdl b/home/.config/niri/config.kdl new file mode 100644 index 0000000..41320b9 --- /dev/null +++ b/home/.config/niri/config.kdl @@ -0,0 +1,312 @@ +include "dms/alttab.kdl" +include "dms/binds.kdl" +include "dms/colors.kdl" +include "dms/layout.kdl" +include "dms/wpblur.kdl" + +input { + keyboard { + xkb { + layout "fr,us(colemak_dh),us" + options "grp:win_space_toggle" + } + } + + touchpad { + tap + natural-scroll + } + + // Make the mouse warp to the center of newly focused windows. + // warp-mouse-to-focus + + // Focus windows and outputs automatically when moving the mouse into them. + // Setting max-scroll-amount="0%" makes it work only on windows already fully on screen. + focus-follows-mouse max-scroll-amount="0%" +} + +workspace "browser" { +} + +output "eDP-1" { + mode "1920x1080@60.049" + scale 1 + position x=360 y=1440 +} + +output "HDMI-A-1" { + mode "3840x2160@60.000" + scale 1.5 + position x=0 y=0 +} + +layout { + gaps 8 + + center-focused-column "never" + + // You can customize the widths that "switch-preset-column-width" (Mod+R) toggles between. + preset-column-widths { + // Proportion sets the width as a fraction of the output width, taking gaps into account. + // For example, you can perfectly fit four windows sized "proportion 0.25" on an output. + // The default preset widths are 1/3, 1/2 and 2/3 of the output. + proportion 0.33333 + proportion 0.5 + proportion 0.66667 + + // Fixed sets the width in logical pixels exactly. + // fixed 1920 + } + + // You can also customize the heights that "switch-preset-window-height" (Mod+Shift+R) toggles between. + // preset-window-heights { } + + // You can change the default width of the new windows. + default-column-width { proportion 0.5; } + // If you leave the brackets empty, the windows themselves will decide their initial width. +} + +prefer-no-csd + +cursor { + hide-when-typing +} + +window-rule { + match app-id=r#"^firefox$"# + open-maximized true + open-on-workspace "browser" + focus-ring { + off + } +} + +window-rule { + match app-id=r#"^thunderbird$"# + open-maximized true + focus-ring { + off + } +} + +// Open the Firefox picture-in-picture player as floating by default. +window-rule { + // This app-id regular expression will work for both: + // - host Firefox (app-id is "firefox") + // - Flatpak Firefox (app-id is "org.mozilla.firefox") + match app-id=r#"firefox$"# title="^Picture-in-Picture$" + open-floating true +} + +binds { + // Keys consist of modifiers separated by + signs, followed by an XKB key name + // in the end. To find an XKB name for a particular key, you may use a program + // like wev. + // + // "Mod" is a special modifier equal to Super when running on a TTY, and to Alt + // when running as a winit window. + // + // Most actions that you can bind here can also be invoked programmatically with + // `niri msg action do-something`. + + // Show a list of important hotkeys. + Mod+Shift+Comma { show-hotkey-overlay; } + + // Suggested binds for running programs: terminal, app launcher, screen locker. + Mod+Return { spawn "ghostty" "+new-window"; } + // Mod+D { spawn "dms" "ipc" "call" "spotlight" "toggle"; } + Mod+D { spawn "vicinae" "toggle"; } + Super+Alt+L hotkey-overlay-title="Lock session" { spawn "loginctl" "lock-session"; } + + XF86AudioPlay { spawn "playerctl" "play-pause"; } + XF86AudioNext { spawn "playerctl" "next"; } + XF86AudioPrev { spawn "playerctl" "previous"; } + XF86Search { spawn "tofi-drun" "--drun-launch=true"; } + + Mod+W { close-window; } + + Mod+Left { focus-column-left; } + Mod+Down { focus-window-down; } + Mod+Up { focus-window-up; } + Mod+Right { focus-column-right; } + Mod+H { focus-column-left; } + Mod+J { focus-window-down; } + Mod+K { focus-window-up; } + Mod+L { focus-column-right; } + + Mod+Ctrl+Left { move-column-left; } + Mod+Ctrl+Down { move-window-down; } + Mod+Ctrl+Up { move-window-up; } + Mod+Ctrl+Right { move-column-right; } + Mod+Ctrl+H { move-column-left; } + Mod+Ctrl+J { move-window-down; } + Mod+Ctrl+K { move-window-up; } + Mod+Ctrl+L { move-column-right; } + + // Alternative commands that move across workspaces when reaching + // the first or last window in a column. + // Mod+J { focus-window-or-workspace-down; } + // Mod+K { focus-window-or-workspace-up; } + // Mod+Ctrl+J { move-window-down-or-to-workspace-down; } + // Mod+Ctrl+K { move-window-up-or-to-workspace-up; } + + Mod+Home { focus-column-first; } + Mod+End { focus-column-last; } + Mod+Ctrl+Home { move-column-to-first; } + Mod+Ctrl+End { move-column-to-last; } + + Mod+Shift+Left { focus-monitor-left; } + Mod+Shift+Down { focus-monitor-down; } + Mod+Shift+Up { focus-monitor-up; } + Mod+Shift+Right { focus-monitor-right; } + Mod+Shift+H { focus-monitor-left; } + Mod+Shift+J { focus-monitor-down; } + Mod+Shift+K { focus-monitor-up; } + Mod+Shift+L { focus-monitor-right; } + + Mod+Shift+Ctrl+Left { move-column-to-monitor-left; } + Mod+Shift+Ctrl+Down { move-column-to-monitor-down; } + Mod+Shift+Ctrl+Up { move-column-to-monitor-up; } + Mod+Shift+Ctrl+Right { move-column-to-monitor-right; } + Mod+Shift+Ctrl+H { move-column-to-monitor-left; } + Mod+Shift+Ctrl+J { move-column-to-monitor-down; } + Mod+Shift+Ctrl+K { move-column-to-monitor-up; } + Mod+Shift+Ctrl+L { move-column-to-monitor-right; } + + // Alternatively, there are commands to move just a single window: + // Mod+Shift+Ctrl+Left { move-window-to-monitor-left; } + // ... + + // And you can also move a whole workspace to another monitor: + // Mod+Shift+Ctrl+Left { move-workspace-to-monitor-left; } + // ... + + Mod+Page_Down { focus-workspace-down; } + Mod+Page_Up { focus-workspace-up; } + Mod+U { focus-workspace-down; } + Mod+I { focus-workspace-up; } + Mod+Ctrl+Page_Down { move-column-to-workspace-down; } + Mod+Ctrl+Page_Up { move-column-to-workspace-up; } + Mod+Ctrl+U { move-column-to-workspace-down; } + Mod+Ctrl+I { move-column-to-workspace-up; } + + // Alternatively, there are commands to move just a single window: + // Mod+Ctrl+Page_Down { move-window-to-workspace-down; } + // ... + + Mod+Shift+Page_Down { move-workspace-down; } + Mod+Shift+Page_Up { move-workspace-up; } + Mod+Shift+U { move-workspace-down; } + Mod+Shift+I { move-workspace-up; } + + // You can bind mouse wheel scroll ticks using the following syntax. + // These binds will change direction based on the natural-scroll setting. + // + // To avoid scrolling through workspaces really fast, you can use + // the cooldown-ms property. The bind will be rate-limited to this value. + // You can set a cooldown on any bind, but it's most useful for the wheel. + Mod+WheelScrollDown cooldown-ms=150 { focus-workspace-down; } + Mod+WheelScrollUp cooldown-ms=150 { focus-workspace-up; } + Mod+Ctrl+WheelScrollDown cooldown-ms=150 { move-column-to-workspace-down; } + Mod+Ctrl+WheelScrollUp cooldown-ms=150 { move-column-to-workspace-up; } + + Mod+WheelScrollRight { focus-column-right; } + Mod+WheelScrollLeft { focus-column-left; } + Mod+Ctrl+WheelScrollRight { move-column-right; } + Mod+Ctrl+WheelScrollLeft { move-column-left; } + + // Usually scrolling up and down with Shift in applications results in + // horizontal scrolling; these binds replicate that. + Mod+Shift+WheelScrollDown { focus-column-right; } + Mod+Shift+WheelScrollUp { focus-column-left; } + Mod+Ctrl+Shift+WheelScrollDown { move-column-right; } + Mod+Ctrl+Shift+WheelScrollUp { move-column-left; } + + // You can refer to workspaces by index. However, keep in mind that + // niri is a dynamic workspace system, so these commands are kind of + // "best effort". Trying to refer to a workspace index bigger than + // the current workspace count will instead refer to the bottommost + // (empty) workspace. + // + // For example, with 2 workspaces + 1 empty, indices 3, 4, 5 and so on + // will all refer to the 3rd workspace. + Mod+ampersand { focus-workspace 1; } + Mod+2 { focus-workspace 2; } + Mod+quotedbl { focus-workspace 3; } + Mod+apostrophe { focus-workspace 4; } + Mod+parenleft { focus-workspace 5; } + Mod+minus { focus-workspace 6; } + Mod+7 { focus-workspace 7; } + Mod+underscore { focus-workspace 8; } + Mod+9 { focus-workspace 9; } + Mod+Ctrl+1 { move-column-to-workspace 1; } + Mod+Ctrl+2 { move-column-to-workspace 2; } + Mod+Ctrl+3 { move-column-to-workspace 3; } + Mod+Ctrl+4 { move-column-to-workspace 4; } + Mod+Ctrl+5 { move-column-to-workspace 5; } + Mod+Ctrl+6 { move-column-to-workspace 6; } + Mod+Ctrl+7 { move-column-to-workspace 7; } + Mod+Ctrl+8 { move-column-to-workspace 8; } + Mod+Ctrl+9 { move-column-to-workspace 9; } + + // Switches focus between the current and the previous workspace. + Mod+Tab { focus-workspace-previous; } + + // The following binds move the focused window in and out of a column. + // If the window is alone, they will consume it into the nearby column to the side. + // If the window is already in a column, they will expel it out. + Mod+BracketLeft { consume-or-expel-window-left; } + Mod+BracketRight { consume-or-expel-window-right; } + + // Consume one window from the right to the bottom of the focused column. + Mod+Comma { consume-window-into-column; } + // Expel the bottom window from the focused column to the right. + Mod+Semicolon { expel-window-from-column; } + + Mod+R { switch-preset-column-width; } + Mod+Shift+R { switch-preset-window-height; } + Mod+Ctrl+R { reset-window-height; } + Mod+F { maximize-column; } + Mod+Shift+F { fullscreen-window; } + Mod+C { center-column; } + + Mod+Escape { toggle-overview; } + + // Finer height adjustments when in column with other windows. + Mod+Shift+Minus { set-window-height "-10%"; } + Mod+Shift+Equal { set-window-height "+10%"; } + + // Move the focused window between the floating and the tiling layout. + Mod+V { toggle-window-floating; } + Mod+Shift+V { switch-focus-between-floating-and-tiling; } + + Print { screenshot; } + Ctrl+Print { screenshot-screen; } + Alt+Print { screenshot-window; } + + // The quit action will show a confirmation dialog to avoid accidental exits. + Mod+Shift+E { quit; } + Ctrl+Alt+Delete { quit; } + + // Powers off the monitors. To turn them back on, do any input like + // moving the mouse or pressing any other key. + Mod+Shift+P { power-off-monitors; } + + Mod+N hotkey-overlay-title="Open notes" { + spawn-sh "ghostty -e hx --working-dir ~/notes ~/notes/notes.dj:9999"; + } +} + +screenshot-path "~/Pictures/Screenshots/Screenshot from %Y-%m-%d %H-%M-%S.png" + +spawn-at-startup "kdeconnect-indicator" +spawn-at-startup "~/rep/flocon/home/bin/monitor-dark-mode.sh" + +spawn-at-startup "xwayland-satellite" +environment { + DISPLAY ":0" +} + +hotkey-overlay { + skip-at-startup +} diff --git a/home/.config/niri/dms/alttab.kdl b/home/.config/niri/dms/alttab.kdl new file mode 100644 index 0000000..91d8337 --- /dev/null +++ b/home/.config/niri/dms/alttab.kdl @@ -0,0 +1,5 @@ +recent-windows { + highlight { + corner-radius 12 + } +} diff --git a/home/.config/niri/dms/binds.kdl b/home/.config/niri/dms/binds.kdl new file mode 100644 index 0000000..5f116ed --- /dev/null +++ b/home/.config/niri/dms/binds.kdl @@ -0,0 +1,55 @@ +binds { + Mod+Shift+D hotkey-overlay-title="Application Launcher" { + spawn "dms" "ipc" "call" "spotlight" "toggle"; + } + + Mod+V hotkey-overlay-title="Clipboard Manager" { + spawn "dms" "ipc" "call" "clipboard" "toggle"; + } + + Mod+M hotkey-overlay-title="Task Manager" { + spawn "dms" "ipc" "call" "processlist" "toggle"; + } + + Mod+Comma hotkey-overlay-title="Settings" { + spawn "dms" "ipc" "call" "settings" "toggle"; + } + + Mod+N hotkey-overlay-title="Notification Center" { + spawn "dms" "ipc" "call" "notifications" "toggle"; + } + + Mod+Shift+N hotkey-overlay-title="Notepad" { + spawn "dms" "ipc" "call" "notepad" "toggle"; + } + + Mod+Alt+L hotkey-overlay-title="Lock Screen" { + spawn "dms" "ipc" "call" "lock" "lock"; + } + + Ctrl+Alt+Delete hotkey-overlay-title="Task Manager" { + spawn "dms" "ipc" "call" "processlist" "toggle"; + } + + // Audio + XF86AudioRaiseVolume allow-when-locked=true { + spawn "dms" "ipc" "call" "audio" "increment" "3"; + } + XF86AudioLowerVolume allow-when-locked=true { + spawn "dms" "ipc" "call" "audio" "decrement" "3"; + } + XF86AudioMute allow-when-locked=true { + spawn "dms" "ipc" "call" "audio" "mute"; + } + XF86AudioMicMute allow-when-locked=true { + spawn "dms" "ipc" "call" "audio" "micmute"; + } + + // BL + XF86MonBrightnessUp allow-when-locked=true { + spawn "dms" "ipc" "call" "brightness" "increment" "5" ""; + } + XF86MonBrightnessDown allow-when-locked=true { + spawn "dms" "ipc" "call" "brightness" "decrement" "5" ""; + } +} \ No newline at end of file diff --git a/home/.config/niri/dms/colors.kdl b/home/.config/niri/dms/colors.kdl new file mode 100644 index 0000000..2c7487f --- /dev/null +++ b/home/.config/niri/dms/colors.kdl @@ -0,0 +1,36 @@ +layout { + background-color "transparent" + + focus-ring { + active-color "#5c5891" + inactive-color "#787680" + urgent-color "#ba1a1a" + } + + border { + active-color "#5c5891" + inactive-color "#787680" + urgent-color "#ba1a1a" + } + + shadow { + color "#00000070" + } + + tab-indicator { + active-color "#5c5891" + inactive-color "#787680" + urgent-color "#ba1a1a" + } + + insert-hint { + color "#5c589180" + } +} + +recent-windows { + highlight { + active-color "#444078" + urgent-color "#ba1a1a" + } +} diff --git a/home/.config/niri/dms/layout.kdl b/home/.config/niri/dms/layout.kdl new file mode 100644 index 0000000..36c08f3 --- /dev/null +++ b/home/.config/niri/dms/layout.kdl @@ -0,0 +1,17 @@ +layout { + gaps 4 + + border { + width 2 + } + + focus-ring { + width 2 + } +} +window-rule { + geometry-corner-radius 12 + clip-to-geometry true + tiled-state true + draw-border-with-background false +} diff --git a/home/.config/niri/dms/wpblur.kdl b/home/.config/niri/dms/wpblur.kdl new file mode 100644 index 0000000..667042f --- /dev/null +++ b/home/.config/niri/dms/wpblur.kdl @@ -0,0 +1,4 @@ +layer-rule { + match namespace="dms:blurwallpaper" + place-within-backdrop true +} diff --git a/home/.config/nushell/config.nu b/home/.config/nushell/config.nu new file mode 100644 index 0000000..6ff67b6 --- /dev/null +++ b/home/.config/nushell/config.nu @@ -0,0 +1,9 @@ +alias ls = eza +alias ll = eza -l +alias lla = eza -la +alias h = hx +alias g = git + +# Load starship prompt +mkdir ($nu.data-dir | path join "vendor/autoload") +starship init nu | save -f ($nu.data-dir | path join "vendor/autoload/starship.nu") diff --git a/home/.config/senpai/senpai.scfg b/home/.config/senpai/senpai.scfg new file mode 100644 index 0000000..72cce82 --- /dev/null +++ b/home/.config/senpai/senpai.scfg @@ -0,0 +1,4 @@ +address chat.sr.ht +nickname rpqt +username rpqt +password-cmd pass show oauth/sr.ht-senpai-irc diff --git a/home/.config/sh/aliases.sh b/home/.config/sh/aliases.sh new file mode 100644 index 0000000..1376f34 --- /dev/null +++ b/home/.config/sh/aliases.sh @@ -0,0 +1,24 @@ +alias dotfiles="/usr/bin/git --git-dir=$HOME/.dotfiles/ --work-tree=$HOME" +alias dots=dotfiles +if command -v helix >/dev/null; then + alias h='helix' +else + alias h='hx' +fi +if command -v eza >/dev/null; then + alias ls='eza' +else + alias ls='ls --color -h' +fi +alias lsa='ls -A' +alias ll='ls -l' +alias lla='ls -lA' +alias ..='cd ..' +alias ...='cd ../..' +alias bt='bluetoothctl' +alias go='GOPROXY=direct go' +alias ts='tree-sitter' +alias g='git' +alias c='cargo' +alias MAKE='make clean && make' +alias n='myrtle --notebook-dir=$HOME/notes' diff --git a/home/.config/sh/path.sh b/home/.config/sh/path.sh new file mode 100644 index 0000000..c41beec --- /dev/null +++ b/home/.config/sh/path.sh @@ -0,0 +1,4 @@ +#!/bin/sh + +# Personnal scripts +export PATH="$PATH:$HOME/bin" diff --git a/home/.config/vicinae/vicinae.json b/home/.config/vicinae/vicinae.json new file mode 100644 index 0000000..0d92315 --- /dev/null +++ b/home/.config/vicinae/vicinae.json @@ -0,0 +1,23 @@ +{ + "closeOnFocusLoss": false, + "considerPreedit": false, + "faviconService": "twenty", + "font": { + "size": 12 + }, + "keybinding": "default", + "keybinds": { + }, + "popToRootOnClose": true, + "rootSearch": { + "searchFiles": true + }, + "theme": { + "name": "matugen" + }, + "window": { + "csd": true, + "opacity": 1, + "rounding": 10 + } +} diff --git a/home/.config/zsh/haze.zsh b/home/.config/zsh/haze.zsh new file mode 100644 index 0000000..e7e39ec --- /dev/null +++ b/home/.config/zsh/haze.zsh @@ -0,0 +1,2 @@ +# Highlight the executable in green if it is found +source /usr/share/zsh/plugins/zsh-syntax-highlighting/zsh-syntax-highlighting.plugin.zsh diff --git a/home/.config/zsh/hooks.sh b/home/.config/zsh/hooks.sh new file mode 100644 index 0000000..269dee6 --- /dev/null +++ b/home/.config/zsh/hooks.sh @@ -0,0 +1,30 @@ +# Hook direnv if present +if command -v direnv >/dev/null; then + eval "$(direnv hook zsh)" +fi + +# Prompt +if command -v starship >/dev/null; then + source <(starship init zsh) +fi + +# Load opam config if present +if [ -r ~/.opam/opam-init/init.zsh ]; then + source ~/.opam/opam-init/init.zsh > /dev/null 2> /dev/null +fi + +# Launch atuin if it is installed +if command -v atuin >/dev/null; then + eval "$(atuin init zsh)" +fi + +# Set ls/tree/fd theme using vivid if it is installed +if command -v vivid >/dev/null; then + export LS_COLORS="$(vivid generate gruvbox-dark-hard)" +fi + +# Init zoxide if present and alias cd to it +if command -v zoxide >/dev/null; then + eval "$(zoxide init zsh)" + alias cd=z +fi diff --git a/home/.gitignore b/home/.gitignore new file mode 100644 index 0000000..1871e64 --- /dev/null +++ b/home/.gitignore @@ -0,0 +1 @@ +!/.config diff --git a/home/.ssh/config b/home/.ssh/config new file mode 100644 index 0000000..51534dd --- /dev/null +++ b/home/.ssh/config @@ -0,0 +1,11 @@ +Host crocus + HostName crocus.val + User root + +Host verbena + HostName verbena.val + User root + +Host genepi + HostName genepi.val + User root diff --git a/home/.zshrc b/home/.zshrc new file mode 100644 index 0000000..3e47f5e --- /dev/null +++ b/home/.zshrc @@ -0,0 +1,27 @@ +# Path +source ~/.config/sh/path.sh + +# Aliases +source ~/.config/sh/aliases.sh + +# Completion +autoload -Uz compinit +compinit +# sudo completion +zstyle ':completion::complete:*' gain-privileges 1 + +# Line movement with special keys +bindkey "^[[H" beginning-of-line +bindkey "^[[F" end-of-line +bindkey "^[[3~" delete-char + +source ~/.config/zsh/hooks.sh + +if [ -r ~/.profile ]; then + source ~/.profile +fi + +# Load machine-specific config +if [ -r ~/.config/zsh/$HOST.zsh ]; then + source ~/.config/zsh/$HOST.zsh +fi diff --git a/home/bin/monitor-dark-mode.sh b/home/bin/monitor-dark-mode.sh new file mode 100755 index 0000000..e8cdaf4 --- /dev/null +++ b/home/bin/monitor-dark-mode.sh @@ -0,0 +1,4 @@ +#!/usr/bin/env sh + +gsettings monitor org.gnome.desktop.interface color-scheme \ + | xargs -L1 "${HOME}/rep/flocon/home/bin/switch-helix-theme.sh" diff --git a/home/bin/switch-helix-theme.sh b/home/bin/switch-helix-theme.sh new file mode 100755 index 0000000..f11f803 --- /dev/null +++ b/home/bin/switch-helix-theme.sh @@ -0,0 +1,15 @@ +#!/usr/bin/env bash + +set -euox pipefail + +HELIX_CONFIG_PATH=$(readlink -f "${HOME}/.config/helix/config.toml") +HELIX_THEME_LIGHT="zed_onelight" +HELIX_THEME_DARK="kanagawa" + +if [[ "$2" == "prefer-dark" ]]; then + sed -i "s/^theme .*/theme = \"$HELIX_THEME_DARK\"/" "$HELIX_CONFIG_PATH" +else + sed -i "s/^theme .*/theme = \"$HELIX_THEME_LIGHT\"/" "$HELIX_CONFIG_PATH" +fi + +pkill -USR1 hx || true diff --git a/home/cli.nix b/home/cli.nix deleted file mode 100644 index 4a4e746..0000000 --- a/home/cli.nix +++ /dev/null @@ -1,48 +0,0 @@ -{ config, pkgs, ... }: -{ - home.packages = with pkgs; [ - bottom - btop - difftastic - doggo - duf - eza - fd - glow - lazygit - nh - ripgrep - skim - taskwarrior3 - tealdeer - vivid - zoxide - ]; - - programs.zoxide.enable = true; - programs.starship.enable = true; - programs.atuin.enable = true; - programs.bat.enable = true; - - programs.zsh = { - enable = true; - syntaxHighlighting.enable = true; - shellAliases = { - ls = "eza"; - lsa = "ls -A"; - ll = "ls -lh"; - lla = "ls -lAh"; - h = "hx"; - g = "git"; - cd = "z"; - tree = "eza --tree"; - ".." = "cd .."; - "..." = "cd ../.."; - }; - }; - - xdg.configFile."git".source = "${config.dotfiles.path}/.config/git"; - xdg.configFile."task/taskrc".source = "${config.dotfiles.path}/.config/task/taskrc"; - - home.sessionPath = [ "${config.dotfiles.path}/bin" ]; -} diff --git a/home/desktop/gnome.nix b/home/desktop/gnome.nix deleted file mode 100644 index ccaa33a..0000000 --- a/home/desktop/gnome.nix +++ /dev/null @@ -1,7 +0,0 @@ -{ pkgs, ... }: -{ - home.packages = with pkgs.gnomeExtensions; [ - blur-my-shell - paperwm - ]; -} diff --git a/home/desktop/niri.nix b/home/desktop/niri.nix deleted file mode 100644 index 73c1ac5..0000000 --- a/home/desktop/niri.nix +++ /dev/null @@ -1,5 +0,0 @@ -{ config, ... }: -{ - xdg.configFile."i3bar-river".source = "${config.dotfiles.path}/.config/i3bar-river"; - xdg.configFile."niri".source = "${config.dotfiles.path}/.config/niri"; -} diff --git a/home/desktop/sway.nix b/home/desktop/sway.nix deleted file mode 100644 index d0dbc91..0000000 --- a/home/desktop/sway.nix +++ /dev/null @@ -1,30 +0,0 @@ -{ config, pkgs, ... }: -{ - home.packages = with pkgs; [ - alacritty - ghostty - tofi - i3status-rust - mako - wlsunset - kanshi - grim - slurp - playerctl - swaybg - ]; - - xdg.configFile = { - "sway".source = "${config.dotfiles.path}/.config/sway"; - "swaylock".source = "${config.dotfiles.path}/.config/swaylock"; - "swayidle".source = "${config.dotfiles.path}/.config/swayidle"; - "kanshi".source = "${config.dotfiles.path}/.config/kanshi"; - "i3status-rust".source = "${config.dotfiles.path}/.config/i3status-rust"; - "tofi/config".source = "${config.dotfiles.path}/.config/tofi/config"; - }; - - programs.alacritty.enable = true; - xdg.configFile."alacritty".source = "${config.dotfiles.path}/.config/alacritty"; - - xdg.configFile."ghostty/config".source = "${config.dotfiles.path}/.config/ghostty/config"; -} diff --git a/home/dev.nix b/home/dev.nix deleted file mode 100644 index 2862d2d..0000000 --- a/home/dev.nix +++ /dev/null @@ -1,20 +0,0 @@ -{ config, pkgs, ... }: -{ - home.packages = with pkgs; [ - devenv - direnv - hut - radicle-node - typescript-language-server - nil # Nix language server - nixfmt-rfc-style - ]; - - programs.direnv = { - enable = true; - enableZshIntegration = true; - nix-direnv.enable = true; - }; - - xdg.configFile."hut/config".source = "${config.dotfiles.path}/.config/hut/config"; -} diff --git a/home/helix.nix b/home/helix.nix deleted file mode 100644 index 0c6f61c..0000000 --- a/home/helix.nix +++ /dev/null @@ -1,12 +0,0 @@ -{ config, pkgs, ... }: - -{ - home.packages = [ pkgs.helix ]; - - programs.helix = { - enable = true; - defaultEditor = true; - }; - - xdg.configFile."helix".source = "${config.dotfiles.path}/.config/helix"; -} diff --git a/home/mail/default.nix b/home/mail/default.nix deleted file mode 100644 index e03b31f..0000000 --- a/home/mail/default.nix +++ /dev/null @@ -1,44 +0,0 @@ -{ config, ... }: -{ - programs.thunderbird = { - enable = true; - profiles = { - main = { - isDefault = true; - }; - }; - }; - - accounts.email.accounts = { - "rpqt@rpqt.fr" = { - address = "rpqt@rpqt.fr"; - realName = "Romain Paquet"; - primary = true; - flavor = "migadu.com"; - thunderbird.enable = true; - }; - - "admin@rpqt.fr" = { - address = "admin@rpqt.fr"; - aliases = [ "postmaster@rpqt.fr" ]; - realName = "Postmaster"; - flavor = "migadu.com"; - thunderbird.enable = config.programs.thunderbird.enable; - }; - - "romain.paquet@grenoble-inp.org" = { - address = "romain.paquet@grenoble-inp.org"; - realName = "Romain Paquet"; - userName = "romain.paquet@grenoble-inp.org"; - imap = { - host = "imap.partage.renater.fr"; - port = 993; - }; - smtp = { - host = "smtp.partage.renater.fr"; - port = 465; - }; - thunderbird.enable = config.programs.thunderbird.enable; - }; - }; -} diff --git a/infra/.terraform.lock.hcl b/infra/.terraform.lock.hcl index 03dfad9..89eb186 100644 --- a/infra/.terraform.lock.hcl +++ b/infra/.terraform.lock.hcl @@ -1,44 +1,16 @@ # This file is maintained automatically by "tofu init". # Manual edits may be lost in future updates. -provider "registry.opentofu.org/go-gandi/gandi" { - version = "2.3.0" - constraints = "2.3.0" +provider "registry.opentofu.org/hashicorp/external" { + version = "2.3.5" hashes = [ - "h1:9kqWL+eFk/ogrQSltL9zVqjMcOqbvs3EgIJEeyNPb8U=", - "zh:0936d011cf75bb5162c6027d00575a586807adc9008f4152def157b6ad22bae9", - "zh:2170e671f04d3346ea416fcc404be6d05f637eab7df77e289a6898a928885f0b", - "zh:250329baae3cb09cfb88dd004d45f003ba76fbe7b8daf9d18fd640b93a2b7252", - "zh:2ccd9f253424738ca5fbbcb2127bf3713c20e87bfb3829f8c4565569424fd0bd", - "zh:3607b48bc4691cd209528f9ffe16a6cc666bd284b0d0bdfe8c4e1d538559a408", - "zh:3bc1d2b770fe0f50027da59c405b2468d1322243235367014f75f765124f458d", - "zh:6c8a9092847ee2e2890825432b54424c456638d494e49b7d1845f055214714f5", - "zh:8e0b62a330876005d52bcd65d7b1d9a679a7ac79c626e0f86661519e8f9b5698", - "zh:8f44f4d52583ff249e2001ea2a8b8841010489dd43e1a01a9ec3a6813d121c28", - "zh:9a617927d4a3a2897ff10999a19a6d1f0ef634b8c6b8fc3be12cf53948cfd9cf", - "zh:cab3c82c54e38e6001eed5b80a2d16b7824921f8f8b3909049e174c48e6e8804", - "zh:f78cc685aa4ba5056ea53a7f8ce585f87a911f0a8a387a44a33d7dfb69db7663", + "h1:en/2hMK/W/2hKtsEkbxGiiYwi/pSPS/UoGDILHIHjmw=", ] } provider "registry.opentofu.org/hetznercloud/hcloud" { - version = "1.49.1" - constraints = "~> 1.45" + version = "1.58.0" hashes = [ - "h1:FKGRNHVbcfQJd8EWrb8Ze5QHkaGr8zI+ZKxBMjvOwPk=", - "zh:3d5f9773da4f8203cf625d04a5a0e4ff7e202684c010a801a945756140c61cde", - "zh:446305d492017cda91e5c15122ec16ff15bfe3ef4d3fd6bcea0cdf7742ab1b86", - "zh:44d4f9156ed8b4f0444bd4dc456825940be49048828565964a192286d28c9f20", - "zh:492ad893d2f89bb17c9beb877c8ceb4a16caf39db1a79030fefeada6c7aa217f", - "zh:68dc552c19ad9d209ec6018445df6e06fb77a637513a53cc66ddce1b024082be", - "zh:7492495ffda6f6c49ab38b539bd2eb965b1150a63fb6b191a27dec07d17601cb", - "zh:850fe92005981ea00db86c3e49ba5b49732fdf1f7bd5530a68f6e272847059fc", - "zh:8cb67f744c233acfb1d68a6c27686315439d944edf733b95f113b4aa63d86713", - "zh:8e13dac46e8c2497772ed1baee701b1d1c26bcc95a63b5c4566c83468f504868", - "zh:c44249c6a8ba931e208a334792686b5355ab2da465cadea03c1ea8e73c02db12", - "zh:d103125a28a85c89aea0cb0c534fe3f504416c4d4fc75c37364b9ec5f66dd77d", - "zh:ed8f64e826aa9bfca95b72892271678cb78411b40d7b404a52404141e05a4ab1", - "zh:f40efad816de00b279bd1e2cbf62c76b0e5b2da150a0764f259984b318e30945", - "zh:f5e912d0873bf4ecc43feba4ceccdf158048080c76d557e47f34749139fdd452", + "h1:6C2LNEvCyGPyWgALDAFTNbRp+5Iuikd4Ju1Xejh+aeg=", ] } diff --git a/infra/README.md b/infra/README.md index 664306c..3c9e53d 100644 --- a/infra/README.md +++ b/infra/README.md @@ -19,3 +19,8 @@ tofu import hcloud_firewall.hcloud_firewall YYY ``` For Hetzner Cloud, the resource IDs can be found in the URL of the admin console. + +## Outputs + +The nix configuration reads some values from the `outputs.json` file. +When modifying these, the file should be regenerated with `tofu output -json > outputs.json`. diff --git a/infra/base.nix b/infra/base.nix new file mode 100644 index 0000000..1e7f0d3 --- /dev/null +++ b/infra/base.nix @@ -0,0 +1,24 @@ +{ + config, + lib, + pkgs, + ... +}: +{ + terraform.required_providers.hcloud.source = "hetznercloud/hcloud"; + + data.external.hcloud-token = { + program = [ + (lib.getExe ( + pkgs.writeShellApplication { + name = "get-clan-secret"; + text = '' + jq -n --arg secret "$(clan secrets get hcloud-token)" '{"secret":$secret}' + ''; + } + )) + ]; + }; + + provider.hcloud.token = config.data.external.hcloud-token "result.secret"; +} diff --git a/infra/crocus.tf b/infra/crocus.tf deleted file mode 100644 index abd9bf8..0000000 --- a/infra/crocus.tf +++ /dev/null @@ -1,52 +0,0 @@ -resource "hcloud_server" "crocus_server" { - name = "crocus" - server_type = "cx22" - image = "ubuntu-20.04" - firewall_ids = [hcloud_firewall.crocus_firewall.id] -} - -resource "hcloud_firewall" "crocus_firewall" { - name = "crocus-firewall" - - rule { - direction = "in" - protocol = "icmp" - source_ips = ["0.0.0.0/0", "::/0"] - } - - rule { - direction = "in" - protocol = "tcp" - port = "22" - source_ips = ["0.0.0.0/0", "::/0"] - } - - rule { - direction = "in" - protocol = "tcp" - port = "22" - source_ips = ["0.0.0.0/0", "::/0"] - } - - rule { - direction = "in" - protocol = "tcp" - port = "80" - source_ips = ["0.0.0.0/0", "::/0"] - } - - rule { - direction = "in" - protocol = "tcp" - port = "443" - source_ips = ["0.0.0.0/0", "::/0"] - } - - # radicle-node - rule { - direction = "in" - protocol = "tcp" - port = "8776" - source_ips = ["0.0.0.0/0", "::/0"] - } -} diff --git a/infra/dns.nix b/infra/dns.nix new file mode 100644 index 0000000..a6f7031 --- /dev/null +++ b/infra/dns.nix @@ -0,0 +1,20 @@ +{ config, ... }: +{ + resource.hcloud_zone.rpqt_fr = { + name = "rpqt.fr"; + mode = "primary"; + }; + + resource.hcloud_zone.turifer_dev = { + name = "turifer.dev"; + mode = "primary"; + }; + + output.rpqt_fr_zone_name = { + value = config.resource.hcloud_zone.rpqt_fr "name"; + }; + + output.turifer_dev_zone_name = { + value = config.resource.hcloud_zone.turifer_dev "name"; + }; +} diff --git a/infra/dns.tf b/infra/dns.tf deleted file mode 100644 index b28e757..0000000 --- a/infra/dns.tf +++ /dev/null @@ -1,23 +0,0 @@ -data "gandi_livedns_domain" "rpqt_fr" { - name = "rpqt.fr" -} - -resource "gandi_livedns_record" "rpqt_fr_radicle_a" { - zone = data.gandi_livedns_domain.rpqt_fr.id - name = "radicle" - type = "A" - ttl = 10800 - values = [ - hcloud_server.crocus_server.ipv4_address, - ] -} - -resource "gandi_livedns_record" "rpqt_fr_radicle_aaaa" { - zone = data.gandi_livedns_domain.rpqt_fr.id - name = "radicle" - type = "AAAA" - ttl = 10800 - values = [ - hcloud_server.crocus_server.ipv6_address, - ] -} diff --git a/infra/flake-module.nix b/infra/flake-module.nix new file mode 100644 index 0000000..6b19b9b --- /dev/null +++ b/infra/flake-module.nix @@ -0,0 +1,40 @@ +{ self, ... }: +{ + perSystem = + { pkgs, ... }: + { + terranix.terranixConfigurations.infra = { + terraformWrapper.package = pkgs.opentofu.withPlugins (p: [ + p.hashicorp_external + p.hetznercloud_hcloud + ]); + + extraArgs = { inherit (self) infra; }; + modules = [ + ./base.nix + ./dns.nix + ./mail.nix + ./radicle.nix + ./web.nix + ]; + }; + }; + + flake.infra = + let + tf_outputs = builtins.fromJSON (builtins.readFile ./outputs.json); + in + { + machines = { + verbena = { + ipv4 = tf_outputs.verbena_ipv4.value; + ipv6 = tf_outputs.verbena_ipv6.value; + gateway6 = tf_outputs.verbena_gateway6.value; + }; + crocus = { + ipv4 = tf_outputs.crocus_ipv4.value; + ipv6 = "2a01:4f8:1c1e:e415::1"; + }; + }; + }; +} diff --git a/infra/lib.nix b/infra/lib.nix new file mode 100644 index 0000000..cf93e1e --- /dev/null +++ b/infra/lib.nix @@ -0,0 +1,88 @@ +{ lib, ... }: +let + mkMigaduDkim = zone: name: { + inherit zone; + name = "${name}._domainkey"; + type = "CNAME"; + records = [ + { value = "${name}.${zone}._domainkey.migadu.com."; } + ]; + }; +in +{ + mkMigadu_hcloud_zone_rrset = zone: hostedEmailVerify: { + dkim_1 = mkMigaduDkim zone "key1"; + dkim_2 = mkMigaduDkim zone "key2"; + dkim_3 = mkMigaduDkim zone "key3"; + + spf = { + inherit zone; + name = "@"; + type = "TXT"; + records = [ + { + value = lib.tf.ref ''provider::hcloud::txt_record("v=spf1 include:spf.migadu.com -all")''; + } + { + value = lib.tf.ref ''provider::hcloud::txt_record("hosted-email-verify=pgeaq3bp")''; + } + ]; + }; + + dmarc = { + inherit zone; + name = "_dmarc"; + type = "TXT"; + records = [ + { + value = lib.tf.ref ''provider::hcloud::txt_record("v=DMARC1; p=quarantine;")''; + } + ]; + }; + + mx = { + inherit zone; + name = "@"; + type = "MX"; + records = [ + { value = "10 aspmx1.migadu.com."; } + { value = "20 aspmx2.migadu.com."; } + ]; + }; + + autoconfig = { + inherit zone; + name = "autoconfig"; + type = "CNAME"; + records = [ { value = "autoconfig.migadu.com."; } ]; + }; + + autodiscover = { + inherit zone; + name = "_autodiscover._tcp"; + type = "SRV"; + records = [ { value = "0 1 443 autodiscover.migadu.com."; } ]; + }; + + submissions = { + inherit zone; + name = "_submissions._tcp"; + type = "SRV"; + records = [ { value = "0 1 465 smtp.migadu.com."; } ]; + }; + + imaps = { + inherit zone; + name = "_imaps._tcp"; + type = "SRV"; + records = [ { value = "0 1 993 imap.migadu.com."; } ]; + }; + + pop3s = { + inherit zone; + name = "_pop3s._tcp"; + type = "SRV"; + records = [ { value = "0 1 995 pop.migadu.com."; } ]; + }; + }; +} diff --git a/infra/mail.nix b/infra/mail.nix new file mode 100644 index 0000000..255a3cc --- /dev/null +++ b/infra/mail.nix @@ -0,0 +1,15 @@ +{ config, lib, ... }: +let + inherit (import ./lib.nix { inherit lib; }) + mkMigadu_hcloud_zone_rrset + ; + rpqt_fr = mkMigadu_hcloud_zone_rrset (config.resource.hcloud_zone.rpqt_fr "name") "pgeaq3bp"; + + # Prefix resource names with zone name to avoid collision + turifer_dev = lib.mapAttrs' (name: value: lib.nameValuePair "turifer_dev_${name}" value) ( + mkMigadu_hcloud_zone_rrset (config.resource.hcloud_zone.turifer_dev "name") "k5z4lcfc" + ); +in +{ + resource.hcloud_zone_rrset = rpqt_fr // turifer_dev; +} diff --git a/infra/main.tf b/infra/main.tf deleted file mode 100644 index 15453d9..0000000 --- a/infra/main.tf +++ /dev/null @@ -1,12 +0,0 @@ -terraform { - required_providers { - gandi = { - source = "go-gandi/gandi" - version = "2.3.0" - } - hcloud = { - source = "hetznercloud/hcloud" - version = "~> 1.45" - } - } -} diff --git a/infra/outputs.json b/infra/outputs.json new file mode 100644 index 0000000..925eb81 --- /dev/null +++ b/infra/outputs.json @@ -0,0 +1,22 @@ +{ + "crocus_ipv4": { + "sensitive": false, + "type": "string", + "value": "116.203.18.122" + }, + "verbena_gateway6": { + "sensitive": false, + "type": "string", + "value": "2001:41d0:305:2100::1" + }, + "verbena_ipv4": { + "sensitive": false, + "type": "string", + "value": "51.68.122.153" + }, + "verbena_ipv6": { + "sensitive": false, + "type": "string", + "value": "2001:41d0:305:2100::271e" + } +} diff --git a/infra/providers.tf b/infra/providers.tf deleted file mode 100644 index d8d6d9b..0000000 --- a/infra/providers.tf +++ /dev/null @@ -1,7 +0,0 @@ -provider "gandi" { - personal_access_token = var.gandi_token -} - -provider "hcloud" { - token = var.hcloud_token -} diff --git a/infra/radicle.nix b/infra/radicle.nix new file mode 100644 index 0000000..b7f239d --- /dev/null +++ b/infra/radicle.nix @@ -0,0 +1,52 @@ +{ + config, + infra, + lib, + ... +}: +{ + resource.hcloud_zone_rrset = + let + zone = config.resource.hcloud_zone.rpqt_fr "name"; + in + { + radicle_a = { + inherit zone; + name = "radicle"; + type = "A"; + records = [ { value = infra.machines.crocus.ipv4; } ]; + }; + + radicle_aaaa = { + inherit zone; + name = "radicle"; + type = "AAAA"; + records = [ { value = infra.machines.crocus.ipv6; } ]; + }; + + radicles_srv = { + inherit zone; + name = "seed._radicle-node._tcp"; + type = "SRV"; + records = [ { value = "32767 32767 58776 radicle.rpqt.fr."; } ]; + }; + + radicles_nid = { + inherit zone; + name = "seed._radicle-node._tcp"; + type = "TXT"; + records = [ + { + value = lib.tf.ref ''provider::hcloud::txt_record("nid=z6MkuivFHDPg6Bd25v4bEWm7T7qLUYMWk1eVTE7exvum5Rvd")''; + } + ]; + }; + + radicle_ptr = { + inherit zone; + name = "_radicle-node._tcp"; + type = "PTR"; + records = [ { value = "seed._radicle-node._tcp.radicle.rpqt.fr."; } ]; + }; + }; +} diff --git a/infra/variables.tf b/infra/variables.tf deleted file mode 100644 index 3bc7123..0000000 --- a/infra/variables.tf +++ /dev/null @@ -1,7 +0,0 @@ -variable "gandi_token" { - sensitive = true -} - -variable "hcloud_token" { - sensitive = true -} diff --git a/infra/web.nix b/infra/web.nix new file mode 100644 index 0000000..2513a6a --- /dev/null +++ b/infra/web.nix @@ -0,0 +1,82 @@ +{ config, infra, ... }: +{ + resource.hcloud_zone_rrset = + let + sourcehut_pages = { + ipv4 = "46.23.81.157"; + ipv6 = "2a03:6000:1813:1337::157"; + }; + zone = config.resource.hcloud_zone.rpqt_fr "name"; + in + { + a = { + inherit zone; + name = "@"; + type = "A"; + records = [ { value = sourcehut_pages.ipv4; } ]; + }; + + aaaa = { + inherit zone; + name = "@"; + type = "AAAA"; + records = [ { value = sourcehut_pages.ipv6; } ]; + }; + + cloud_a = { + inherit zone; + name = "cloud"; + type = "A"; + records = [ { value = infra.machines.verbena.ipv4; } ]; + }; + + cloud_aaaa = { + inherit zone; + name = "cloud"; + type = "AAAA"; + records = [ { value = infra.machines.verbena.ipv6; } ]; + }; + + git_turifer_dev_a = { + zone = config.resource.hcloud_zone.turifer_dev "name"; + name = "git"; + type = "A"; + records = [ { value = infra.machines.verbena.ipv4; } ]; + }; + + git_turifer_dev_aaaa = { + zone = config.resource.hcloud_zone.turifer_dev "name"; + name = "git"; + type = "AAAA"; + records = [ { value = infra.machines.verbena.ipv6; } ]; + }; + + buildbot_turifer_dev_a = { + zone = config.resource.hcloud_zone.turifer_dev "name"; + name = "buildbot"; + type = "A"; + records = [ { value = infra.machines.verbena.ipv4; } ]; + }; + + buildbot_turifer_dev_aaaa = { + zone = config.resource.hcloud_zone.turifer_dev "name"; + name = "buildbot"; + type = "AAAA"; + records = [ { value = infra.machines.verbena.ipv6; } ]; + }; + + wg1_turifer_dev_a = { + zone = config.resource.hcloud_zone.turifer_dev "name"; + name = "wg1"; + type = "A"; + records = [ { value = infra.machines.verbena.ipv4; } ]; + }; + + wg1_turifer_dev_aaaa = { + zone = config.resource.hcloud_zone.turifer_dev "name"; + name = "wg1"; + type = "AAAA"; + records = [ { value = infra.machines.verbena.ipv6; } ]; + }; + }; +} diff --git a/inventory.json b/inventory.json new file mode 100644 index 0000000..d5755f2 --- /dev/null +++ b/inventory.json @@ -0,0 +1,18 @@ +{ + "machines": { + "verbena": { + "installedAt": 1757633120 + }, + "crocus": { + "installedAt": 1757633120 + }, + "haze": { + "installedAt": 1757633120, + "description": "Romain's laptop" + }, + "genepi": { + "installedAt": 1757633120, + "description": "Raspberry Pi 4B" + } + } +} \ No newline at end of file diff --git a/machines/README.md b/machines/README.md index 996fa70..7290d44 100644 --- a/machines/README.md +++ b/machines/README.md @@ -3,3 +3,4 @@ - **crocus**: Hetzner Cloud x86_64 VPS - **genepi**: Raspberry Pi 4B - **haze**: ASUS VivoBook Laptop +- **verbena**: OVH Cloud x86_64 VPS diff --git a/machines/crocus/configuration.nix b/machines/crocus/configuration.nix index 39e52d0..50ca761 100644 --- a/machines/crocus/configuration.nix +++ b/machines/crocus/configuration.nix @@ -1,23 +1,23 @@ { - inputs, - modulesPath, - config, + self, ... }: { imports = [ - (modulesPath + "/profiles/qemu-guest.nix") - # ./radicle.nix - ../../system - inputs.clan-core.clanModules.state-version + self.nixosModules.radicle + self.nixosModules.nix-defaults ../../modules/remote-builder.nix - ../../modules/borgbackup.nix + self.inputs.srvos.nixosModules.server + self.inputs.srvos.nixosModules.hardware-hetzner-cloud + ]; + + disabledModules = [ + self.inputs.srvos.nixosModules.mixins-cloud-init ]; nixpkgs.hostPlatform = "x86_64-linux"; networking.hostName = "crocus"; - clan.core.networking.targetHost = "root@crocus.local"; networking.useDHCP = false; systemd.network.enable = true; @@ -32,38 +32,34 @@ ]; }; - services.avahi.enable = true; + fileSystems."/data1" = { + device = "/dev/disk/by-id/scsi-0HC_Volume_103766469"; + }; - disko.devices.disk.main.device = "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_48353082"; + services.garage.settings.data_dir = [ + { + path = "/var/lib/garage/data"; + capacity = "20G"; + } + { + path = "/data1/garage"; + capacity = "20G"; + } + ]; + + clan.core.settings.state-version.enable = true; + + clan.core.networking.buildHost = "root@haze"; + + services.avahi.allowInterfaces = [ + "zts7mq7onf" + ]; boot.loader.grub = { efiSupport = true; efiInstallAsRemovable = true; }; - services.prometheus = { - enable = true; - port = 9001; - exporters = { - node = { - enable = true; - enabledCollectors = [ "systemd" ]; - port = 9002; - }; - }; - - scrapeConfigs = [ - { - job_name = "crocus"; - static_configs = [ - { - targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ]; - } - ]; - } - ]; - }; - services.nginx = { enable = true; recommendedProxySettings = true; @@ -79,4 +75,6 @@ acceptTerms = true; defaults.email = "admin@rpqt.fr"; }; + + services.tailscale.useRoutingFeatures = "server"; } diff --git a/machines/crocus/disko.nix b/machines/crocus/disko.nix index af03c18..b529126 100644 --- a/machines/crocus/disko.nix +++ b/machines/crocus/disko.nix @@ -1,17 +1,8 @@ { - clan-core, - config, - ... -}: -let - suffix = config.clan.core.vars.generators.disk-id.files.diskId.value; -in -{ - imports = [ clan-core.clanModules.disk-id ]; - disko.devices.disk.main = { - name = "main-" + suffix; + name = "main-dbca87cd30a5498488026c65b37eba60"; type = "disk"; + device = "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_48353082"; content = { type = "gpt"; partitions = { diff --git a/machines/crocus/radicle.nix b/machines/crocus/radicle.nix deleted file mode 100644 index d7f60b5..0000000 --- a/machines/crocus/radicle.nix +++ /dev/null @@ -1,21 +0,0 @@ -{ config, keys, ... }: -{ - services.radicle = { - enable = true; - privateKeyFile = config.age.secrets.radicle-private-key.path; - publicKey = keys.services.radicle; - node = { - openFirewall = true; - }; - httpd = { - enable = true; - nginx = { - serverName = "radicle.rpqt.fr"; - enableACME = true; - forceSSL = true; - }; - }; - }; - - age.secrets.radicle-private-key.file = ../../secrets/radicle-private-key.age; -} diff --git a/machines/genepi/acme.nix b/machines/genepi/acme.nix deleted file mode 100644 index d9c784d..0000000 --- a/machines/genepi/acme.nix +++ /dev/null @@ -1,21 +0,0 @@ -{ config, ... }: -{ - security.acme = { - acceptTerms = true; - defaults.email = "admin@rpqt.fr"; - }; - - age.secrets.gandi.file = ../../secrets/gandi.age; - - security.acme = { - certs."home.rpqt.fr" = { - group = config.services.nginx.group; - - domain = "home.rpqt.fr"; - extraDomainNames = [ "*.home.rpqt.fr" ]; - dnsProvider = "gandiv5"; - dnsPropagationCheck = true; - environmentFile = config.age.secrets.gandi.path; - }; - }; -} diff --git a/machines/genepi/actual.nix b/machines/genepi/actual.nix new file mode 100644 index 0000000..b455535 --- /dev/null +++ b/machines/genepi/actual.nix @@ -0,0 +1,24 @@ +{ config, ... }: +let + domain = "actual.val"; +in +{ + services.actual = { + enable = true; + settings = { + hostname = "127.0.0.1"; + port = 5555; + }; + }; + + services.nginx.virtualHosts.${domain} = { + forceSSL = true; + enableACME = true; + locations."/".proxyPass = + "http://127.0.0.1:${builtins.toString config.services.actual.settings.port}"; + }; + + security.acme.certs.${domain}.server = "https://ca.val/acme/acme/directory"; + + clan.core.state.actual.folders = [ "/var/lib/actual" ]; +} diff --git a/machines/genepi/boot.nix b/machines/genepi/boot.nix index a93d860..c6c7b80 100644 --- a/machines/genepi/boot.nix +++ b/machines/genepi/boot.nix @@ -8,12 +8,18 @@ ]; boot.loader = { - grub.enable = false; - generic-extlinux-compatible.enable = true; + generic-extlinux-compatible.enable = false; + efi.canTouchEfiVariables = true; + systemd-boot.enable = true; }; + nixpkgs.overlays = [ + (final: super: { + makeModulesClosure = x: super.makeModulesClosure (x // { allowMissing = true; }); + }) + ]; + boot.supportedFilesystems = [ - "btrfs" "vfat" ]; } diff --git a/machines/genepi/builder.nix b/machines/genepi/builder.nix index eeab549..5e4a7e3 100644 --- a/machines/genepi/builder.nix +++ b/machines/genepi/builder.nix @@ -1,4 +1,3 @@ -{ keys, ... }: { imports = [ ../../modules/remote-builder.nix @@ -6,6 +5,8 @@ roles.remote-builder = { enable = true; - authorizedKeys = [ keys.hosts.haze ]; + authorizedKeys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGa8R8obgptefcp27Cdp9bc2fiyc9x0oTfMsTPFp2ktE rpqt@haze" + ]; }; } diff --git a/machines/genepi/configuration.nix b/machines/genepi/configuration.nix index e86c027..1e48016 100644 --- a/machines/genepi/configuration.nix +++ b/machines/genepi/configuration.nix @@ -1,47 +1,37 @@ { - inputs, + self, ... }: { imports = [ - inputs.agenix.nixosModules.default - inputs.impermanence.nixosModules.impermanence - ./acme.nix + ./actual.nix ./boot.nix ./builder.nix - ./dns.nix ./freshrss.nix ./glance.nix ./homeassistant.nix - # ./immich.nix + ./immich.nix ./monitoring - ./mpd.nix ./network.nix ./nginx.nix - ./persistence.nix + ./pinchflat.nix ./syncthing.nix - ./taskchampion.nix - ../../system - ../../modules/borgbackup.nix + ../../modules/acme-home.nix + ../../modules/lounge.nix + self.nixosModules.nix-defaults - inputs.clan-core.clanModules.state-version - inputs.clan-core.clanModules.trusted-nix-caches + self.nixosModules.user-rpqt - inputs.home-manager.nixosModules.home-manager - { - home-manager.useGlobalPkgs = true; - home-manager.useUserPackages = true; - home-manager.users.rpqt = ./home.nix; - } + self.inputs.srvos.nixosModules.mixins-terminfo ]; networking.hostName = "genepi"; - clan.core.networking.targetHost = "root@genepi.local"; - nix.gc = { - automatic = true; - dates = "weekly"; - options = "--delete-older-than 30d"; - }; + time.timeZone = "Europe/Paris"; + + services.prometheus.checkConfig = "syntax-only"; + clan.core.vars.generators.garage.files.metrics_token.owner = "prometheus"; + + clan.core.settings.state-version.enable = true; } diff --git a/machines/genepi/disko.nix b/machines/genepi/disko.nix index 3fd4480..908efe6 100644 --- a/machines/genepi/disko.nix +++ b/machines/genepi/disko.nix @@ -1,74 +1,27 @@ { disko.devices.disk.main = { + name = "main-72b27bb5253045f38a07b6bc368ab85c"; type = "disk"; device = "/dev/disk/by-id/ata-WD_Green_M.2_2280_480GB_2251E6411147"; content = { type = "gpt"; partitions = { ESP = { - priority = 1; - name = "ESP"; - start = "1M"; - end = "512M"; type = "EF00"; + size = "512M"; + priority = 1; content = { type = "filesystem"; format = "vfat"; mountpoint = "/boot"; - mountOptions = [ "umask=0077" ]; }; }; root = { end = "-4G"; content = { - type = "btrfs"; - extraArgs = [ - "-L" - "nixos" - "-f" # Override existing partition - ]; - subvolumes = { - "/root" = { - mountpoint = "/"; - mountOptions = [ - "subvol=root" - "compress=zstd" - "noatime" - ]; - }; - "/home" = { - mountpoint = "/home"; - mountOptions = [ - "subvol=home" - "compress=zstd" - "noatime" - ]; - }; - "/nix" = { - mountpoint = "/nix"; - mountOptions = [ - "subvol=nix" - "compress=zstd" - "noatime" - ]; - }; - "/persist" = { - mountpoint = "/persist"; - mountOptions = [ - "subvol=persist" - "compress=zstd" - "noatime" - ]; - }; - "/log" = { - mountpoint = "/var/log"; - mountOptions = [ - "subvol=log" - "compress=zstd" - "noatime" - ]; - }; - }; + type = "filesystem"; + format = "ext4"; + mountpoint = "/"; }; }; swap = { @@ -80,7 +33,4 @@ }; }; }; - - fileSystems."/persist".neededForBoot = true; - fileSystems."/var/log".neededForBoot = true; } diff --git a/machines/genepi/dns.nix b/machines/genepi/dns.nix deleted file mode 100644 index 086bcc0..0000000 --- a/machines/genepi/dns.nix +++ /dev/null @@ -1,35 +0,0 @@ -{ config, lib, ... }: -let - domain = "home.rpqt.fr"; - genepi = { - ip = "100.83.123.79"; - subdomains = [ - "glance" - "grafana" - "images" - "rss" - "tw" - ]; - }; -in -{ - networking.firewall.interfaces."${config.services.tailscale.interfaceName}" = { - allowedTCPPorts = [ 53 ]; - allowedUDPPorts = [ 53 ]; - }; - - services.unbound = { - enable = true; - resolveLocalQueries = false; - - settings = { - server = { - interface = [ "${config.services.tailscale.interfaceName}" ]; - access-control = [ "100.0.0.0/8 allow" ]; - - local-zone = lib.map (subdomain: ''"${subdomain}.${domain}." redirect'') genepi.subdomains; - local-data = lib.map (subdomain: ''"${subdomain}.${domain}. IN A ${genepi.ip}"'') genepi.subdomains; - }; - }; - }; -} diff --git a/machines/genepi/freshrss.nix b/machines/genepi/freshrss.nix index 9797ece..511ee1d 100644 --- a/machines/genepi/freshrss.nix +++ b/machines/genepi/freshrss.nix @@ -1,26 +1,31 @@ { config, ... }: let - domain = "home.rpqt.fr"; - subdomain = "rss.${domain}"; + tld = "val"; + domain = "rss.${tld}"; in { - age.secrets.freshrss = { - file = ../../secrets/freshrss.age; - mode = "700"; - owner = config.services.freshrss.user; - }; - services.freshrss = { enable = true; - baseUrl = "https://${subdomain}"; - virtualHost = "${subdomain}"; + baseUrl = "https://${domain}"; + virtualHost = "${domain}"; defaultUser = "rpqt"; - passwordFile = config.age.secrets.freshrss.path; + passwordFile = config.clan.core.vars.generators.freshrss.files.freshrss-password.path; }; services.nginx.virtualHosts.${config.services.freshrss.virtualHost} = { forceSSL = true; - useACMEHost = "${domain}"; + enableACME = true; + }; + + security.acme.certs.${domain}.server = "https://ca.${tld}/acme/acme/directory"; + + clan.core.vars.generators.freshrss = { + prompts.freshrss-password = { + description = "freshrss default user password"; + type = "hidden"; + persist = true; + }; + files.freshrss-password.owner = config.services.freshrss.user; }; } diff --git a/machines/genepi/glance-config.nix b/machines/genepi/glance-config.nix index 4b913e6..b8d2c17 100644 --- a/machines/genepi/glance-config.nix +++ b/machines/genepi/glance-config.nix @@ -1,3 +1,4 @@ +{ tld }: { theme = { light = true; @@ -41,18 +42,105 @@ sites = [ { title = "Immich"; - url = "https://images.home.rpqt.fr"; - icon = "si:immich"; - } - { - title = "Grafana"; - url = "https://grafana.home.rpqt.fr"; - icon = "si:grafana"; + url = "https://images.${tld}"; + icon = "sh:immich"; } { title = "FreshRSS"; - url = "https://rss.home.rpqt.fr"; - icon = "si:rss"; + url = "https://rss.${tld}"; + icon = "sh:freshrss"; + } + { + title = "Syncthing"; + url = "https://genepi.${tld}/syncthing"; + icon = "sh:syncthing"; + } + { + title = "Actual Budget"; + url = "https://actual.${tld}"; + icon = "sh:actual-budget"; + } + { + title = "Gitea"; + url = "https://git.turifer.dev"; + icon = "sh:gitea"; + } + { + title = "Pinchflat"; + url = "https://pinchflat.${tld}"; + icon = "https://cdn.jsdelivr.net/gh/selfhst/icons/png/pinchflat.png"; + } + { + title = "Home Assistant"; + url = "https://assistant.${tld}"; + icon = "sh:home-assistant"; + } + { + title = "Nextcloud"; + url = "https://cloud.rpqt.fr"; + icon = "sh:nextcloud"; + } + { + title = "Buildbot"; + url = "https://buildbot.turifer.dev"; + icon = "https://buildbot.turifer.dev/icon.svg"; + } + { + title = "Radicle"; + url = "https://app.radicle.xyz/nodes/radicle.rpqt.fr"; + icon = "sh:radicle"; + } + ]; + } + { + type = "monitor"; + cache = "1m"; + title = "Monitoring"; + sites = [ + { + title = "Grafana"; + url = "https://grafana.${tld}"; + icon = "sh:grafana"; + } + { + title = "Prometheus"; + url = "http://genepi.${tld}:9090"; + icon = "sh:prometheus"; + } + ]; + } + { + type = "monitor"; + cache = "1m"; + title = "Sites"; + sites = [ + { + title = "Lounge"; + url = "https://lounge.${tld}"; + icon = "si:html5"; + } + { + title = "Web corner"; + url = "https://rpqt.fr"; + icon = "si:html5"; + } + ]; + } + { + type = "bookmarks"; + groups = [ + { + title = "Music"; + links = [ + { + title = "YouTube Music"; + url = "https://music.youtube.com"; + } + { + title = "Music for programming"; + url = "https://musicforprogramming.net/latest/"; + } + ]; } ]; } @@ -60,14 +148,20 @@ } { size = "small"; - widgets = [ - { + widgets = + let + locations = [ + "Krakow, Poland" + "Grenoble, France" + "Saint-Michel-de-Maurienne, France" + ]; + in + builtins.map (location: { type = "weather"; - location = "Grenoble, France"; + inherit location; units = "metric"; hour-format = "24h"; - } - ]; + }) locations; } ]; } @@ -85,7 +179,7 @@ cache = "12h"; feeds = [ { - url = "https://rss.home.rpqt.fr/api/query.php?user=rpqt&t=74HfeLZ6Wu9h4MmjNR38Rz&f=rss"; + url = "https://rss.${tld}/api/query.php?user=rpqt&t=74HfeLZ6Wu9h4MmjNR38Rz&f=rss"; } ]; } diff --git a/machines/genepi/glance.nix b/machines/genepi/glance.nix index a68385e..6aa1cc2 100644 --- a/machines/genepi/glance.nix +++ b/machines/genepi/glance.nix @@ -1,18 +1,20 @@ { config, ... }: let - domain = "home.rpqt.fr"; - subdomain = "glance.${domain}"; + tld = "val"; + domain = "glance.${tld}"; in { services.glance = { enable = true; - settings = ./glance-config.nix; + settings = (import ./glance-config.nix) { inherit tld; }; }; - services.nginx.virtualHosts.${subdomain} = { + services.nginx.virtualHosts.${domain} = { forceSSL = true; - useACMEHost = "${domain}"; + enableACME = true; locations."/".proxyPass = "http://127.0.0.1:${toString config.services.glance.settings.server.port}"; }; + + security.acme.certs.${domain}.server = "https://ca.${tld}/acme/acme/directory"; } diff --git a/machines/genepi/hardware-configuration.nix b/machines/genepi/hardware-configuration.nix index efcb8ff..3cc97f1 100644 --- a/machines/genepi/hardware-configuration.nix +++ b/machines/genepi/hardware-configuration.nix @@ -1,20 +1,20 @@ -{ inputs, pkgs, ... }: +{ self, pkgs, ... }: { imports = [ - # inputs.nixos-hardware.nixosModules.raspberry-pi-4 + self.inputs.nixos-hardware.nixosModules.raspberry-pi-4 ]; nixpkgs.hostPlatform = "aarch64-linux"; hardware.enableRedistributableFirmware = true; - # hardware = { - # raspberry-pi."4".apply-overlays-dtmerge.enable = true; - # deviceTree = { - # enable = true; - # filter = "*rpi-4-*.dtb"; - # }; - # }; + hardware = { + raspberry-pi."4".apply-overlays-dtmerge.enable = true; + deviceTree = { + enable = true; + filter = "*rpi-4-*.dtb"; + }; + }; environment.systemPackages = with pkgs; [ libraspberrypi diff --git a/machines/genepi/home.nix b/machines/genepi/home.nix deleted file mode 100644 index 9662907..0000000 --- a/machines/genepi/home.nix +++ /dev/null @@ -1,32 +0,0 @@ -{ - config, - pkgs, - lib, - ... -}: -{ - home.username = "rpqt"; - home.homeDirectory = lib.mkForce "/home/rpqt"; - - home.packages = [ - pkgs.helix - pkgs.ripgrep - pkgs.eza - ]; - - programs.zsh.enable = true; - programs.starship.enable = true; - programs.atuin.enable = true; - - # This value determines the Home Manager release that your configuration is - # compatible with. This helps avoid breakage when a new Home Manager release - # introduces backwards incompatible changes. - # - # You should not change this value, even if you update Home Manager. If you do - # want to update the value, then make sure to first check the Home Manager - # release notes. - home.stateVersion = "24.11"; - - # Let Home Manager install and manage itself - programs.home-manager.enable = true; -} diff --git a/machines/genepi/homeassistant.nix b/machines/genepi/homeassistant.nix index 8506960..2c61efb 100644 --- a/machines/genepi/homeassistant.nix +++ b/machines/genepi/homeassistant.nix @@ -1,10 +1,42 @@ +{ config, ... }: +let + tld = "val"; + domain = "assistant.${tld}"; +in { - virtualisation.oci-containers.containers.homeassistant = { - volumes = [ "home-assistant:/config" ]; - environment.TZ = "Europe/Paris"; - image = "ghcr.io/home-assistant/home-assistant:stable"; - extraOptions = [ - "--network=host" + services.home-assistant = { + enable = true; + extraComponents = [ + # Components required to complete the onboarding + "analytics" + "google_translate" + "met" + "radio_browser" + "shopping_list" + # For fast zlib compression + "isal" + "shelly" ]; + config = { + default_config = { }; + http = { + use_x_forwarded_for = true; + trusted_proxies = [ "127.0.0.1" ]; + }; + }; }; + + services.nginx.virtualHosts.${domain} = { + forceSSL = true; + enableACME = true; + extraConfig = '' + proxy_buffering off; + ''; + locations."/" = { + proxyPass = "http://127.0.0.1:${toString config.services.home-assistant.config.http.server_port}"; + proxyWebsockets = true; + }; + }; + + security.acme.certs.${domain}.server = "https://ca.${tld}/acme/acme/directory"; } diff --git a/machines/genepi/immich.nix b/machines/genepi/immich.nix index 7161f3c..76e7f65 100644 --- a/machines/genepi/immich.nix +++ b/machines/genepi/immich.nix @@ -1,19 +1,19 @@ { config, ... }: let - domain = "home.rpqt.fr"; - subdomain = "images.${domain}"; + tld = "val"; + domain = "images.${tld}"; in { services.immich = { enable = true; settings = { - server.externalDomain = "https://${subdomain}"; + server.externalDomain = "https://${domain}"; }; }; - services.nginx.virtualHosts.${subdomain} = { + services.nginx.virtualHosts.${domain} = { forceSSL = true; - useACMEHost = "${domain}"; + enableACME = true; locations."/" = { proxyPass = "http://${toString config.services.immich.host}:${toString config.services.immich.port}"; proxyWebsockets = true; @@ -26,5 +26,7 @@ in }; }; - clan.core.state.userdata.folders = [ "/var/lib/immich" ]; + security.acme.certs.${domain}.server = "https://ca.${tld}/acme/acme/directory"; + + clan.core.state.immich.folders = [ "/var/lib/immich" ]; } diff --git a/machines/genepi/monitoring/default.nix b/machines/genepi/monitoring/default.nix index aea5039..e5a3e88 100644 --- a/machines/genepi/monitoring/default.nix +++ b/machines/genepi/monitoring/default.nix @@ -1,6 +1,9 @@ { imports = [ ./grafana.nix - ./prometheus.nix + ]; + + networking.firewall.interfaces."zts7mq7onf".allowedTCPPorts = [ + 9090 # prometheus web interface ]; } diff --git a/machines/genepi/monitoring/grafana.nix b/machines/genepi/monitoring/grafana.nix index 7bea765..ac96660 100644 --- a/machines/genepi/monitoring/grafana.nix +++ b/machines/genepi/monitoring/grafana.nix @@ -1,6 +1,6 @@ { config, ... }: let - domain = "home.rpqt.fr"; + tld = "val"; in { services.grafana = { @@ -8,7 +8,7 @@ in settings = { server = { http_port = 3000; - domain = "grafana.${domain}"; + domain = "grafana.${tld}"; }; }; provision = { @@ -31,10 +31,13 @@ in services.nginx.virtualHosts.${config.services.grafana.settings.server.domain} = { forceSSL = true; - useACMEHost = "${domain}"; + enableACME = true; locations."/" = { proxyPass = "http://127.0.0.1:${toString config.services.grafana.settings.server.http_port}"; proxyWebsockets = true; }; }; + + security.acme.certs.${config.services.grafana.settings.server.domain}.server = + "https://ca.${tld}/acme/acme/directory"; } diff --git a/machines/genepi/monitoring/prometheus.nix b/machines/genepi/monitoring/prometheus.nix index 401a422..fcf4d20 100644 --- a/machines/genepi/monitoring/prometheus.nix +++ b/machines/genepi/monitoring/prometheus.nix @@ -58,6 +58,4 @@ in }; }; }; - - clan.core.state.userdata.folders = [ "/var/lib/prometheus2" ]; } diff --git a/machines/genepi/mpd.nix b/machines/genepi/mpd.nix deleted file mode 100644 index 3f869b5..0000000 --- a/machines/genepi/mpd.nix +++ /dev/null @@ -1,27 +0,0 @@ -{ config, ... }: -{ - services.mpd = { - enable = true; - musicDirectory = "/home/rpqt/Media/Music"; - extraConfig = '' - audio_output { - type "pulse" - name "Pulse Audio" - } - ''; - - network.listenAddress = "any"; - }; - - services.pulseaudio.enable = true; - - # Workaround: run PulseAudio system-wide so that the mpd user can access it - services.pulseaudio.systemWide = true; - - # Fixes the stutter when changing volume (found this randomly) - services.pulseaudio.daemon.config.flat-volumes = "no"; - - users.users.${config.services.mpd.user}.extraGroups = [ "pulse-access" ]; - - users.users.rpqt.homeMode = "755"; -} diff --git a/machines/genepi/network.nix b/machines/genepi/network.nix index 49b5992..e6225ef 100644 --- a/machines/genepi/network.nix +++ b/machines/genepi/network.nix @@ -1,6 +1,6 @@ { # Tailscale seems to break when not using resolved - services.resolved.enable = true; + # services.resolved.enable = true; networking.useDHCP = true; networking.interfaces.tailscale0.useDHCP = false; } diff --git a/machines/genepi/nginx.nix b/machines/genepi/nginx.nix index 410d7db..1262037 100644 --- a/machines/genepi/nginx.nix +++ b/machines/genepi/nginx.nix @@ -4,4 +4,10 @@ recommendedProxySettings = true; recommendedTlsSettings = true; }; + + networking.firewall.interfaces."zts7mq7onf".allowedTCPPorts = [ 443 ]; + networking.firewall.interfaces."wireguard".allowedTCPPorts = [ + 80 + 443 + ]; } diff --git a/machines/genepi/persistence.nix b/machines/genepi/persistence.nix deleted file mode 100644 index bca3d3e..0000000 --- a/machines/genepi/persistence.nix +++ /dev/null @@ -1,64 +0,0 @@ -{ lib, ... }: -{ - environment.persistence."/persist" = { - enable = true; - directories = [ - "/var/lib/nixos" - "/var/lib/acme" - "/var/lib/prometheus2" - "/var/lib/immich" - "/var/lib/redis-immich" - "/var/lib/postgresql" - "/var/lib/grafana" - "/var/lib/freshrss" - "/var/lib/tailscale" - ]; - files = [ - # so that systemd doesn't think each boot is the first - "/etc/machine-id" - # ssh host keys - "/etc/ssh/ssh_host_rsa_key" - "/etc/ssh/ssh_host_rsa_key.pub" - "/etc/ssh/ssh_host_ed25519_key" - "/etc/ssh/ssh_host_ed25519_key.pub" - ]; - users.rpqt = { - directories = [ ]; - files = [ ]; - home = "/home/rpqt"; - }; - }; - - # Empty root and remove snapshots older than 30 days - # boot.initrd.postDeviceCommands = lib.mkAfter '' - # mkdir /btrfs_tmp - # mount /dev/disk/by-label/nixos /btrfs_tmp - # if [[ -e /btrfs_tmp/root ]]; then - # mkdir -p /btrfs_tmp/old_roots - # timestamp=$(date --date="@$(stat -c %Y /btrfs_tmp/root)" "+%Y-%m-%-d_%H:%M:%S") - # mv /btrfs_tmp/root "/btrfs_tmp/old_roots/$timestamp" - # fi - - # delete_subvolume_recursively() { - # IFS=$'\n' - # for i in $(btrfs subvolume list -o "$1" | cut -f 9- -d ' '); do - # delete_subvolume_recursively "/btrfs_tmp/$i" - # done - # btrfs subvolume delete "$1" - # } - - # for i in $(find /btrfs_tmp/old_roots/ -maxdepth 1 -mtime +30); do - # delete_subvolume_recursively "$i" - # done - - # btrfs subvolume create /btrfs_tmp/root - # umount /btrfs_tmp - # rmdir /btrfs_tmp - # ''; - - # Give agenix persistent paths so it can load secrets before the mount - age.identityPaths = [ - "/persist/etc/ssh/ssh_host_ed25519_key" - "/persist/etc/ssh/ssh_host_rsa_key" - ]; -} diff --git a/machines/genepi/pinchflat.nix b/machines/genepi/pinchflat.nix new file mode 100644 index 0000000..14fbca2 --- /dev/null +++ b/machines/genepi/pinchflat.nix @@ -0,0 +1,37 @@ +{ + config, + pkgs, + ... +}: +let + tld = "val"; + domain = "pinchflat.${tld}"; +in +{ + services.pinchflat = { + enable = true; + secretsFile = config.clan.core.vars.generators.pinchflat.files.env.path; + mediaDir = "/home/rpqt/Music"; + }; + + clan.core.vars.generators.pinchflat = { + files.env = { }; + runtimeInputs = [ + pkgs.coreutils + pkgs.openssl + ]; + script = '' + echo "$SECRET_KEY_BASE=$(openssl rand -hex 64)" > "$out"/env + ''; + }; + + clan.core.state.pinchflat.folders = [ "/var/lib/pinchflat" ]; + + services.nginx.virtualHosts.${domain} = { + forceSSL = true; + enableACME = true; + locations."/".proxyPass = "http://127.0.0.1:${builtins.toString config.services.pinchflat.port}"; + }; + + security.acme.certs.${domain}.server = "https://ca.${tld}/acme/acme/directory"; +} diff --git a/machines/genepi/syncthing.nix b/machines/genepi/syncthing.nix index 3a0240f..fd3400e 100644 --- a/machines/genepi/syncthing.nix +++ b/machines/genepi/syncthing.nix @@ -1,57 +1,49 @@ { config, + lib, + pkgs, ... }: let user = "rpqt"; home = config.users.users.${user}.home; + tld = "val"; + domain = "genepi.${tld}"; in { + + services.nginx.virtualHosts.${domain} = { + forceSSL = true; + enableACME = true; + locations."/syncthing" = { + proxyPass = "http://${config.services.syncthing.guiAddress}"; + }; + }; + + security.acme.certs.${domain}.server = "https://ca.${tld}/acme/acme/directory"; + services.syncthing = { enable = true; user = user; - group = "users"; + group = lib.mkForce "users"; dataDir = home; - configDir = "${home}/.config/syncthing"; - openDefaultPorts = true; - overrideDevices = true; - overrideFolders = true; - settings = { - devices = { - "haze" = { - id = "QUX6KGF-7KNFTGD-RAX5OWC-NFQGRNK-S2TC2DQ-DQRWDTK-KMBTQXT-EVNRDQG"; - }; - "pixel-7a" = { - id = "IZE7B4Z-LKTJY6Q-77NN4JG-ADYRC77-TYPZTXE-Q35BWV2-AEO7Q3R-ZE63IAU"; - }; - }; - folders = { - "Documents" = { - path = "${home}/Documents"; - devices = [ - "haze" - ]; - }; - "Music" = { - path = "${home}/Media/Music"; - devices = [ - "haze" - "pixel-7a" - ]; - }; - "Pictures" = { - path = "${home}/Media/Pictures"; - devices = [ - "haze" - ]; - }; - "Videos" = { - path = "${home}/Media/Videos"; - devices = [ - "haze" - ]; - }; - }; + configDir = lib.mkForce "${home}/.config/syncthing"; + guiAddress = "0.0.0.0:8384"; + guiPasswordFile = config.clan.core.vars.generators.syncthing-gui.files.password.path; + }; + + networking.firewall.interfaces.wireguard = { + allowedTCPPorts = [ 8384 ]; + }; + + clan.core.vars.generators.syncthing-gui = { + files.password = { + secret = true; + owner = user; }; + runtimeInputs = [ pkgs.xkcdpass ]; + script = '' + xkcdpass -n 7 > $out/password + ''; }; } diff --git a/machines/genepi/taskchampion.nix b/machines/genepi/taskchampion.nix deleted file mode 100644 index b06dbc5..0000000 --- a/machines/genepi/taskchampion.nix +++ /dev/null @@ -1,19 +0,0 @@ -{ config, lib, ... }: -let - domain = "home.rpqt.fr"; - subdomain = "tw.${domain}"; - hasImpermanence = config.environment.persistence."/persist".enable; -in -{ - services.taskchampion-sync-server.enable = true; - - services.taskchampion-sync-server.dataDir = - (lib.optionalString hasImpermanence "/persist") + "/var/lib/taskchampion-sync-server"; - - services.nginx.virtualHosts.${subdomain} = { - forceSSL = true; - useACMEHost = "${domain}"; - locations."/".proxyPass = - "http://127.0.0.1:${toString config.services.taskchampion-sync-server.port}"; - }; -} diff --git a/machines/haze/configuration.nix b/machines/haze/configuration.nix index f66d604..c0e7a59 100644 --- a/machines/haze/configuration.nix +++ b/machines/haze/configuration.nix @@ -1,54 +1,61 @@ { - inputs, + self, + pkgs, ... }: { imports = [ - # inputs.disko.nixosModules.disko - inputs.agenix.nixosModules.default ./boot.nix ./chat.nix - ./firefox.nix ./gimp.nix ./gnome.nix ./hibernate.nix ./niri.nix ./ssh.nix ./steam.nix - ./thunderbird.nix ./network.nix ./syncthing.nix - ./video.nix - ../../system - inputs.clan-core.clanModules.state-version + self.nixosModules.desktop + self.nixosModules.dev + self.nixosModules.nix-defaults - inputs.home-manager.nixosModules.home-manager + self.inputs.home-manager.nixosModules.home-manager { home-manager.useGlobalPkgs = true; home-manager.useUserPackages = true; home-manager.users.rpqt = ./home.nix; - home-manager.extraSpecialArgs = { inherit inputs; }; + home-manager.extraSpecialArgs = { + inherit (self) inputs; + inherit self; + }; } ]; networking.hostName = "haze"; clan.core.networking.targetHost = "rpqt@haze.local"; - specialisation = { - hyprland.configuration = - { ... }: - { - imports = [ ./hyprland.nix ]; - disabledModules = [ ./niri.nix ]; - }; - sway.configuration = - { ... }: - { - imports = [ ./sway.nix ]; - disabledModules = [ ./niri.nix ]; - }; - }; + networking.search = [ + "val" + "wireguard" + ]; + + time.timeZone = "Europe/Paris"; + + clan.core.deployment.requireExplicitUpdate = true; + + clan.core.settings.state-version.enable = true; + + environment.systemPackages = [ + self.inputs.clan-core.packages.x86_64-linux.clan-app + pkgs.aseprite + pkgs.linux-wifi-hotspot + pkgs.anytype + pkgs.typst + pkgs.anki + ]; + + programs.kdeconnect.enable = true; # Remote builds nix = { @@ -65,4 +72,18 @@ builders-use-substitutes = true ''; }; + + nixpkgs.config.allowUnfree = true; + + i18n.supportedLocales = [ + "en_US.UTF-8/UTF-8" + "fr_FR.UTF-8/UTF-8" + ]; + + security.sudo = { + enable = true; + wheelNeedsPassword = false; + }; + + services.tailscale.useRoutingFeatures = "client"; } diff --git a/machines/haze/firefox.nix b/machines/haze/firefox.nix deleted file mode 100644 index 32391e8..0000000 --- a/machines/haze/firefox.nix +++ /dev/null @@ -1,7 +0,0 @@ -{ pkgs, ... }: -{ - programs.firefox = { - enable = true; - nativeMessagingHosts.packages = [ pkgs.passff-host ]; - }; -} diff --git a/machines/haze/gnome.nix b/machines/haze/gnome.nix index d8f1b7b..c11cd24 100644 --- a/machines/haze/gnome.nix +++ b/machines/haze/gnome.nix @@ -2,11 +2,12 @@ { services.xserver = { enable = true; - displayManager.gdm.enable = true; - desktopManager.gnome.enable = true; xkb.layout = "fr"; }; + services.displayManager.gdm.enable = true; + services.desktopManager.gnome.enable = true; + environment.gnome.excludePackages = ( with pkgs; [ diff --git a/machines/haze/hardware-configuration.nix b/machines/haze/hardware-configuration.nix index efeeffb..639e54b 100644 --- a/machines/haze/hardware-configuration.nix +++ b/machines/haze/hardware-configuration.nix @@ -4,7 +4,15 @@ hardware.enableRedistributableFirmware = true; - boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "vmd" "nvme" "usb_storage" "sd_mod" "rtsx_usb_sdmmc" ]; + boot.initrd.availableKernelModules = [ + "xhci_pci" + "thunderbolt" + "vmd" + "nvme" + "usb_storage" + "sd_mod" + "rtsx_usb_sdmmc" + ]; boot.kernelModules = [ "kvm-intel" ]; hardware.cpu.intel.updateMicrocode = config.hardware.enableRedistributableFirmware; diff --git a/machines/haze/home.nix b/machines/haze/home.nix index 0814049..79bea2e 100644 --- a/machines/haze/home.nix +++ b/machines/haze/home.nix @@ -1,17 +1,15 @@ { imports = [ - ../../home/chat.nix - ../../home/cli.nix - ../../home/common.nix - ../../home/desktop - ../../home/dev.nix - ../../home/dotfiles.nix - ../../home/helix.nix - ../../home/mail - ../../home/minecraft.nix - ../../home/desktop - ../../home/desktop/gnome.nix - ../../home/desktop/niri.nix - ../../home/desktop/sway.nix + ../../home-manager/chat.nix + ../../home-manager/common.nix + ../../home-manager/desktop + ../../home-manager/dev.nix + ../../home-manager/helix.nix + ../../home-manager/mail + ../../home-manager/minecraft.nix + ../../home-manager/desktop + ../../home-manager/desktop/gnome.nix + ../../home-manager/desktop/niri.nix + ../../home-manager/desktop/vicinae.nix ]; } diff --git a/machines/haze/hyprland.nix b/machines/haze/hyprland.nix deleted file mode 100644 index 98dfe35..0000000 --- a/machines/haze/hyprland.nix +++ /dev/null @@ -1,3 +0,0 @@ -{ - programs.hyprland.enable = true; -} diff --git a/machines/haze/network.nix b/machines/haze/network.nix index d6d4675..81bb1a0 100644 --- a/machines/haze/network.nix +++ b/machines/haze/network.nix @@ -3,9 +3,11 @@ networking.networkmanager = { enable = true; wifi.powersave = true; + plugins = [ + pkgs.networkmanager-openconnect + pkgs.networkmanager-openvpn + ]; }; users.users."rpqt".extraGroups = [ "networkmanager" ]; - - environment.systemPackages = [ pkgs.networkmanager-openconnect ]; } diff --git a/machines/haze/niri.nix b/machines/haze/niri.nix index 61e2cdb..e47300d 100644 --- a/machines/haze/niri.nix +++ b/machines/haze/niri.nix @@ -3,17 +3,14 @@ programs.niri.enable = true; environment.systemPackages = with pkgs; [ - brightnessctl - i3bar-river - mako pavucontrol playerctl - swaybg - swaylock - tofi - wl-gammarelay-rs xwayland-satellite ]; + services.gnome.gnome-keyring.enable = true; + environment.sessionVariables.NIXOS_OZONE_WL = "1"; + + programs.dms-shell.enable = true; } diff --git a/machines/haze/secrets/secrets.nix b/machines/haze/secrets/secrets.nix deleted file mode 100644 index 1f012b4..0000000 --- a/machines/haze/secrets/secrets.nix +++ /dev/null @@ -1,13 +0,0 @@ -let - keys = import ../../../parts/keys.nix; -in -{ - "syncthing-key.pem.age".publicKeys = [ - keys.hosts.haze - keys.rpqt.haze - ]; - "syncthing-cert.pem.age".publicKeys = [ - keys.hosts.haze - keys.rpqt.haze - ]; -} diff --git a/machines/haze/secrets/syncthing-cert.pem.age b/machines/haze/secrets/syncthing-cert.pem.age deleted file mode 100644 index b5dabca..0000000 Binary files a/machines/haze/secrets/syncthing-cert.pem.age and /dev/null differ diff --git a/machines/haze/secrets/syncthing-key.pem.age b/machines/haze/secrets/syncthing-key.pem.age deleted file mode 100644 index c3349ea..0000000 --- a/machines/haze/secrets/syncthing-key.pem.age +++ /dev/null @@ -1,8 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 P3fsag cm2nekzBIMCAb/yXzY4L6jIH/Sa+rSMznT88WJNkP30 -DMnRf0An69vywpHLD3RGHwE0dkaa6JIEahhQo14EEDc ---- f/kI+HBhWTQlXoWvCJaLJM70EsOkH4G8/5g9Eeu8uNc - -àT!Û÷\Î’ù6˜ -·TÀƒrϵKr»9ÕÅw¹ÌžÀ8–æ¸ÇEƒ¿´,ÜR.¢˜³’ÉiÒ ¹ßüý_'2Þ;iÒÅ„—8d¤ÏóÿÁ&DÝ«q¯²îxd -µ3Ée„xnâg~’/)݇aƒÄWÔèžG~ºÒÈBNV·ˆi¨a{ËæÝuÕÛ•ÜR=­ûMòO)$HS„Ýf¥f<ç›cóü?àï~*€Täà)WtÊñÅÀ&‚Ü8i˜óºz½è:5Ž¹[sc"ýÀì& UýËÓ9ÂÓ'í§_»´{xkE½ïؼYÁ@åÑçƒÆÚf×Uä+†—B±u¨=ÿÌY4òe3âUÕÆQLSl5 U™qÚšþ!¨h×W¼ã@}OW¨ŠÃ \ No newline at end of file diff --git a/machines/haze/ssh.nix b/machines/haze/ssh.nix index 054b746..2c63c08 100644 --- a/machines/haze/ssh.nix +++ b/machines/haze/ssh.nix @@ -1,3 +1,2 @@ { - programs.ssh.startAgent = true; } diff --git a/machines/haze/sway.nix b/machines/haze/sway.nix deleted file mode 100644 index 9e6f1a8..0000000 --- a/machines/haze/sway.nix +++ /dev/null @@ -1,11 +0,0 @@ -{ - services.gnome.gnome-keyring.enable = true; - - programs.sway = { - enable = true; - wrapperFeatures.gtk = true; - }; - - users.users."rpqt".extraGroups = [ "video" ]; - programs.light.enable = true; -} diff --git a/machines/haze/syncthing.nix b/machines/haze/syncthing.nix index 00806c4..0a6cfde 100644 --- a/machines/haze/syncthing.nix +++ b/machines/haze/syncthing.nix @@ -1,5 +1,6 @@ { config, + lib, ... }: let @@ -7,57 +8,11 @@ let home = config.users.users.${user}.home; in { - # age.secrets.syncthing-key.file = ./secrets/syncthing-key.pem.age; - # age.secrets.syncthing-cert.file = ./secrets/syncthing-cert.pem.age; - services.syncthing = { - enable = false; + enable = true; user = user; - group = "users"; + group = lib.mkForce "users"; dataDir = home; - configDir = "${home}/.config/syncthing"; - key = config.age.secrets.syncthing-key.path; - cert = config.age.secrets.syncthing-cert.path; - openDefaultPorts = true; - overrideDevices = true; - overrideFolders = true; - settings = { - devices = { - "genepi" = { - id = "EA7DC7O-IHB47EQ-AWT2QBJ-AWPDF5S-W4EM66A-KQPCTHI-UX53WKM-QTSAHQ4"; - }; - "pixel-7a" = { - id = "IZE7B4Z-LKTJY6Q-77NN4JG-ADYRC77-TYPZTXE-Q35BWV2-AEO7Q3R-ZE63IAU"; - }; - }; - folders = { - "Documents" = { - path = "${home}/Documents"; - devices = [ - "genepi" - "pixel-7a" - ]; - }; - "Music" = { - path = "${home}/Music"; - devices = [ - "genepi" - "pixel-7a" - ]; - }; - "Pictures" = { - path = "${home}/Pictures"; - devices = [ - "genepi" - ]; - }; - "Videos" = { - path = "${home}/Videos"; - devices = [ - "genepi" - ]; - }; - }; - }; + configDir = lib.mkForce "${home}/.config/syncthing"; }; } diff --git a/machines/haze/thunderbird.nix b/machines/haze/thunderbird.nix deleted file mode 100644 index c856732..0000000 --- a/machines/haze/thunderbird.nix +++ /dev/null @@ -1,3 +0,0 @@ -{ - programs.thunderbird.enable = true; -} diff --git a/machines/haze/video.nix b/machines/haze/video.nix deleted file mode 100644 index fd045fb..0000000 --- a/machines/haze/video.nix +++ /dev/null @@ -1,4 +0,0 @@ -{ pkgs, ... }: -{ - environment.systemPackages = with pkgs; [ mpv ]; -} diff --git a/machines/verbena/configuration.nix b/machines/verbena/configuration.nix new file mode 100644 index 0000000..990a3bd --- /dev/null +++ b/machines/verbena/configuration.nix @@ -0,0 +1,63 @@ +{ self, lib, ... }: +{ + imports = [ + self.nixosModules.nix-defaults + self.nixosModules.nextcloud + self.nixosModules.gitea + self.nixosModules.vaultwarden + + self.inputs.srvos.nixosModules.server + + { + # Add Pixel-7a as external device for clan wireguard network + networking.wireguard.interfaces.wireguard = { + ips = [ "100.42.42.1/32" ]; + peers = [ + { + publicKey = "BVgDQM18SfNofQsWs7m6fblaTB04Gk74VxR/zK8AKQ4="; + allowedIPs = + let + suffix = "cafe:cafe"; + in + [ "fd28:387a:90:c400:${suffix}::/96" ]; + persistentKeepalive = 25; + } + ]; + }; + } + ]; + + nixpkgs.hostPlatform = "x86_64-linux"; + + networking.hostName = "verbena"; + + networking.useDHCP = lib.mkDefault true; + + networking.defaultGateway6 = { + address = self.infra.machines.verbena.gateway6; + interface = "ens3"; + }; + networking.interfaces."ens3" = { + ipv6.addresses = [ + { + address = self.infra.machines.verbena.ipv6; + prefixLength = 64; + } + ]; + }; + + clan.core.settings.state-version.enable = true; + + services.nginx = { + enable = true; + recommendedProxySettings = true; + recommendedTlsSettings = true; + }; + + networking.firewall.allowedTCPPorts = [ + 80 + 443 + ]; + + security.acme.acceptTerms = true; +} diff --git a/machines/verbena/disko.nix b/machines/verbena/disko.nix new file mode 100644 index 0000000..0f74ef5 --- /dev/null +++ b/machines/verbena/disko.nix @@ -0,0 +1,50 @@ +# --- +# schema = "single-disk" +# [placeholders] +# mainDisk = "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0" +# --- +# This file was automatically generated! +# CHANGING this configuration requires wiping and reinstalling the machine +{ + + boot.loader.grub.efiSupport = true; + boot.loader.grub.efiInstallAsRemovable = true; + boot.loader.grub.enable = true; + disko.devices = { + disk = { + main = { + name = "main-75e31aae5e864fb39a0414ea1230ca81"; + device = "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0"; + type = "disk"; + content = { + type = "gpt"; + partitions = { + "boot" = { + size = "1M"; + type = "EF02"; # for grub MBR + priority = 1; + }; + ESP = { + type = "EF00"; + size = "500M"; + content = { + type = "filesystem"; + format = "vfat"; + mountpoint = "/boot"; + mountOptions = [ "umask=0077" ]; + }; + }; + root = { + size = "100%"; + content = { + type = "filesystem"; + format = "ext4"; + mountpoint = "/"; + }; + }; + }; + }; + }; + }; + }; +} diff --git a/machines/verbena/facter.json b/machines/verbena/facter.json new file mode 100644 index 0000000..164afc3 --- /dev/null +++ b/machines/verbena/facter.json @@ -0,0 +1,2227 @@ +{ + "version": 1, + "system": "x86_64-linux", + "virtualisation": "kvm", + "hardware": { + "bios": { + "apm_info": { + "supported": false, + "enabled": false, + "version": 0, + "sub_version": 0, + "bios_flags": 0 + }, + "vbe_info": { + "version": 0, + "video_memory": 0 + }, + "pnp": true, + "pnp_id": 0, + "lba_support": false, + "low_memory_size": 654336, + "smbios_version": 520 + }, + "bridge": [ + { + "index": 9, + "attached_to": 0, + "class_list": [ + "pci", + "bridge" + ], + "bus_type": { + "hex": "0004", + "name": "PCI", + "value": 4 + }, + "slot": { + "bus": 0, + "number": 1 + }, + "base_class": { + "hex": "0006", + "name": "Bridge", + "value": 6 + }, + "sub_class": { + "hex": "0001", + "name": "ISA bridge", + "value": 1 + }, + "vendor": { + "hex": "8086", + "name": "Intel Corporation", + "value": 32902 + }, + "sub_vendor": { + "hex": "1af4", + "value": 6900 + }, + "device": { + "hex": "7000", + "value": 28672 + }, + "sub_device": { + "hex": "1100", + "value": 4352 + }, + "model": "Intel ISA bridge", + "sysfs_id": "/devices/pci0000:00/0000:00:01.0", + "sysfs_bus_id": "0000:00:01.0", + "detail": { + "function": 0, + "command": 259, + "header_type": 0, + "secondary_bus": 0, + "irq": 0, + "prog_if": 0 + }, + "module_alias": "pci:v00008086d00007000sv00001AF4sd00001100bc06sc01i00" + }, + { + "index": 11, + "attached_to": 0, + "class_list": [ + "pci", + "bridge" + ], + "bus_type": { + "hex": "0004", + "name": "PCI", + "value": 4 + }, + "slot": { + "bus": 0, + "number": 0 + }, + "base_class": { + "hex": "0006", + "name": "Bridge", + "value": 6 + }, + "sub_class": { + "hex": "0000", + "name": "Host bridge", + "value": 0 + }, + "vendor": { + "hex": "8086", + "name": "Intel Corporation", + "value": 32902 + }, + "sub_vendor": { + "hex": "1af4", + "value": 6900 + }, + "device": { + "hex": "1237", + "value": 4663 + }, + "sub_device": { + "hex": "1100", + "value": 4352 + }, + "revision": { + "hex": "0002", + "value": 2 + }, + "model": "Intel Host bridge", + "sysfs_id": "/devices/pci0000:00/0000:00:00.0", + "sysfs_bus_id": "0000:00:00.0", + "detail": { + "function": 0, + "command": 259, + "header_type": 0, + "secondary_bus": 0, + "irq": 0, + "prog_if": 0 + }, + "module_alias": "pci:v00008086d00001237sv00001AF4sd00001100bc06sc00i00" + }, + { + "index": 12, + "attached_to": 0, + "class_list": [ + "pci", + "bridge" + ], + "bus_type": { + "hex": "0004", + "name": "PCI", + "value": 4 + }, + "slot": { + "bus": 0, + "number": 1 + }, + "base_class": { + "hex": "0006", + "name": "Bridge", + "value": 6 + }, + "sub_class": { + "hex": "0080", + "name": "Bridge", + "value": 128 + }, + "vendor": { + "hex": "8086", + "name": "Intel Corporation", + "value": 32902 + }, + "sub_vendor": { + "hex": "1af4", + "value": 6900 + }, + "device": { + "hex": "7113", + "value": 28947 + }, + "sub_device": { + "hex": "1100", + "value": 4352 + }, + "revision": { + "hex": "0003", + "value": 3 + }, + "model": "Intel Bridge", + "sysfs_id": "/devices/pci0000:00/0000:00:01.3", + "sysfs_bus_id": "0000:00:01.3", + "resources": [ + { + "type": "irq", + "base": 9, + "triggered": 0, + "enabled": true + } + ], + "detail": { + "function": 3, + "command": 259, + "header_type": 0, + "secondary_bus": 0, + "irq": 9, + "prog_if": 0 + }, + "driver": "piix4_smbus", + "driver_module": "i2c_piix4", + "drivers": [ + "piix4_smbus" + ], + "driver_modules": [ + "i2c_piix4" + ], + "module_alias": "pci:v00008086d00007113sv00001AF4sd00001100bc06sc80i00" + } + ], + "cpu": [ + { + "architecture": "x86_64", + "vendor_name": "GenuineIntel", + "family": 6, + "model": 60, + "stepping": 1, + "features": [ + "fpu", + "vme", + "de", + "pse", + "tsc", + "msr", + "pae", + "mce", + "cx8", + "apic", + "sep", + "mtrr", + "pge", + "mca", + "cmov", + "pat", + "pse36", + "clflush", + "mmx", + "fxsr", + "sse", + "sse2", + "syscall", + "nx", + "rdtscp", + "lm", + "constant_tsc", + "rep_good", + "nopl", + "xtopology", + "cpuid", + "tsc_known_freq", + "pni", + "pclmulqdq", + "vmx", + "ssse3", + "fma", + "cx16", + "pcid", + "sse4_1", + "sse4_2", + "x2apic", + "movbe", + "popcnt", + "tsc_deadline_timer", + "aes", + "xsave", + "avx", + "f16c", + "rdrand", + "hypervisor", + "lahf_lm", + "abm", + "cpuid_fault", + "pti", + "tpr_shadow", + "flexpriority", + "ept", + "vpid", + "ept_ad", + "fsgsbase", + "bmi1", + "avx2", + "smep", + "bmi2", + "erms", + "invpcid", + "xsaveopt", + "arat", + "vnmi", + "md_clear" + ], + "bugs": [ + "cpu_meltdown", + "spectre_v1", + "spectre_v2", + "spec_store_bypass", + "l1tf", + "mds", + "swapgs", + "itlb_multihit", + "srbds", + "mmio_unknown", + "bhi", + "its" + ], + "bogo": 5986.13, + "cache": 16384, + "physical_id": 0, + "siblings": 1, + "cores": 1, + "fpu": true, + "fpu_exception": true, + "cpuid_level": 13, + "write_protect": false, + "clflush_size": 64, + "cache_alignment": 64, + "address_sizes": { + "physical": "0x28", + "virtual": "0x30" + } + }, + { + "architecture": "x86_64", + "vendor_name": "GenuineIntel", + "family": 6, + "model": 60, + "stepping": 1, + "features": [ + "fpu", + "vme", + "de", + "pse", + "tsc", + "msr", + "pae", + "mce", + "cx8", + "apic", + "sep", + "mtrr", + "pge", + "mca", + "cmov", + "pat", + "pse36", + "clflush", + "mmx", + "fxsr", + "sse", + "sse2", + "syscall", + "nx", + "rdtscp", + "lm", + "constant_tsc", + "rep_good", + "nopl", + "xtopology", + "cpuid", + "tsc_known_freq", + "pni", + "pclmulqdq", + "vmx", + "ssse3", + "fma", + "cx16", + "pcid", + "sse4_1", + "sse4_2", + "x2apic", + "movbe", + "popcnt", + "tsc_deadline_timer", + "aes", + "xsave", + "avx", + "f16c", + "rdrand", + "hypervisor", + "lahf_lm", + "abm", + "cpuid_fault", + "pti", + "tpr_shadow", + "flexpriority", + "ept", + "vpid", + "ept_ad", + "fsgsbase", + "bmi1", + "avx2", + "smep", + "bmi2", + "erms", + "invpcid", + "xsaveopt", + "arat", + "vnmi", + "md_clear" + ], + "bugs": [ + "cpu_meltdown", + "spectre_v1", + "spectre_v2", + "spec_store_bypass", + "l1tf", + "mds", + "swapgs", + "itlb_multihit", + "srbds", + "mmio_unknown", + "bhi", + "its" + ], + "bogo": 5986.13, + "cache": 16384, + "physical_id": 1, + "siblings": 1, + "cores": 1, + "fpu": true, + "fpu_exception": true, + "cpuid_level": 13, + "write_protect": false, + "clflush_size": 64, + "cache_alignment": 64, + "address_sizes": { + "physical": "0x28", + "virtual": "0x30" + } + }, + { + "architecture": "x86_64", + "vendor_name": "GenuineIntel", + "family": 6, + "model": 60, + "stepping": 1, + "features": [ + "fpu", + "vme", + "de", + "pse", + "tsc", + "msr", + "pae", + "mce", + "cx8", + "apic", + "sep", + "mtrr", + "pge", + "mca", + "cmov", + "pat", + "pse36", + "clflush", + "mmx", + "fxsr", + "sse", + "sse2", + "syscall", + "nx", + "rdtscp", + "lm", + "constant_tsc", + "rep_good", + "nopl", + "xtopology", + "cpuid", + "tsc_known_freq", + "pni", + "pclmulqdq", + "vmx", + "ssse3", + "fma", + "cx16", + "pcid", + "sse4_1", + "sse4_2", + "x2apic", + "movbe", + "popcnt", + "tsc_deadline_timer", + "aes", + "xsave", + "avx", + "f16c", + "rdrand", + "hypervisor", + "lahf_lm", + "abm", + "cpuid_fault", + "pti", + "tpr_shadow", + "flexpriority", + "ept", + "vpid", + "ept_ad", + "fsgsbase", + "bmi1", + "avx2", + "smep", + "bmi2", + "erms", + "invpcid", + "xsaveopt", + "arat", + "vnmi", + "md_clear" + ], + "bugs": [ + "cpu_meltdown", + "spectre_v1", + "spectre_v2", + "spec_store_bypass", + "l1tf", + "mds", + "swapgs", + "itlb_multihit", + "srbds", + "mmio_unknown", + "bhi", + "its" + ], + "bogo": 5986.13, + "cache": 16384, + "physical_id": 2, + "siblings": 1, + "cores": 1, + "fpu": true, + "fpu_exception": true, + "cpuid_level": 13, + "write_protect": false, + "clflush_size": 64, + "cache_alignment": 64, + "address_sizes": { + "physical": "0x28", + "virtual": "0x30" + } + }, + { + "architecture": "x86_64", + "vendor_name": "GenuineIntel", + "family": 6, + "model": 60, + "stepping": 1, + "features": [ + "fpu", + "vme", + "de", + "pse", + "tsc", + "msr", + "pae", + "mce", + "cx8", + "apic", + "sep", + "mtrr", + "pge", + "mca", + "cmov", + "pat", + "pse36", + "clflush", + "mmx", + "fxsr", + "sse", + "sse2", + "syscall", + "nx", + "rdtscp", + "lm", + "constant_tsc", + "rep_good", + "nopl", + "xtopology", + "cpuid", + "tsc_known_freq", + "pni", + "pclmulqdq", + "vmx", + "ssse3", + "fma", + "cx16", + "pcid", + "sse4_1", + "sse4_2", + "x2apic", + "movbe", + "popcnt", + "tsc_deadline_timer", + "aes", + "xsave", + "avx", + "f16c", + "rdrand", + "hypervisor", + "lahf_lm", + "abm", + "cpuid_fault", + "pti", + "tpr_shadow", + "flexpriority", + "ept", + "vpid", + "ept_ad", + "fsgsbase", + "bmi1", + "avx2", + "smep", + "bmi2", + "erms", + "invpcid", + "xsaveopt", + "arat", + "vnmi", + "md_clear" + ], + "bugs": [ + "cpu_meltdown", + "spectre_v1", + "spectre_v2", + "spec_store_bypass", + "l1tf", + "mds", + "swapgs", + "itlb_multihit", + "srbds", + "mmio_unknown", + "bhi", + "its" + ], + "bogo": 5986.13, + "cache": 16384, + "physical_id": 3, + "siblings": 1, + "cores": 1, + "fpu": true, + "fpu_exception": true, + "cpuid_level": 13, + "write_protect": false, + "clflush_size": 64, + "cache_alignment": 64, + "address_sizes": { + "physical": "0x28", + "virtual": "0x30" + } + } + ], + "disk": [ + { + "index": 23, + "attached_to": 18, + "class_list": [ + "disk", + "scsi", + "block_device" + ], + "bus_type": { + "hex": "0084", + "name": "SCSI", + "value": 132 + }, + "slot": { + "bus": 0, + "number": 0 + }, + "base_class": { + "hex": "0106", + "name": "Mass Storage Device", + "value": 262 + }, + "sub_class": { + "hex": "0000", + "name": "Disk", + "value": 0 + }, + "vendor": { + "hex": "0000", + "name": "QEMU", + "value": 0 + }, + "device": { + "hex": "0000", + "name": "QEMU HARDDISK", + "value": 0 + }, + "revision": { + "hex": "0000", + "name": "2.5+", + "value": 0 + }, + "model": "QEMU HARDDISK", + "sysfs_id": "/class/block/sda", + "sysfs_bus_id": "0:0:0:0", + "sysfs_device_link": "/devices/pci0000:00/0000:00:04.0/virtio1/host0/target0:0:0/0:0:0:0", + "unix_device_name": "/dev/sda", + "unix_device_number": { + "type": 98, + "major": 8, + "minor": 0, + "range": 16 + }, + "unix_device_names": [ + "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-0", + "/dev/disk/by-path/pci-0000:00:04.0-scsi-0:0:0:0", + "/dev/sda" + ], + "unix_device_name2": "/dev/sg0", + "unix_device_number2": { + "type": 99, + "major": 21, + "minor": 0, + "range": 1 + }, + "rom_id": "0x80", + "resources": [ + { + "type": "disk_geo", + "cylinders": 9790, + "heads": 255, + "sectors": 63, + "size": "0x0", + "geo_type": "logical" + }, + { + "type": "size", + "unit": "sectors", + "value_1": 157286400, + "value_2": 512 + } + ], + "driver": "virtio_scsi", + "driver_module": "virtio_scsi", + "drivers": [ + "sd", + "virtio_scsi" + ], + "driver_modules": [ + "sd_mod", + "virtio_scsi" + ] + } + ], + "graphics_card": [ + { + "index": 16, + "attached_to": 0, + "class_list": [ + "graphics_card", + "pci" + ], + "bus_type": { + "hex": "0004", + "name": "PCI", + "value": 4 + }, + "slot": { + "bus": 0, + "number": 2 + }, + "base_class": { + "hex": "0003", + "name": "Display controller", + "value": 3 + }, + "sub_class": { + "hex": "0000", + "name": "VGA compatible controller", + "value": 0 + }, + "pci_interface": { + "hex": "0000", + "name": "VGA", + "value": 0 + }, + "vendor": { + "hex": "1013", + "name": "Cirrus Logic", + "value": 4115 + }, + "sub_vendor": { + "hex": "1af4", + "value": 6900 + }, + "device": { + "hex": "00b8", + "name": "GD 5446", + "value": 184 + }, + "sub_device": { + "hex": "1100", + "value": 4352 + }, + "model": "Cirrus Logic GD 5446", + "sysfs_id": "/devices/pci0000:00/0000:00:02.0", + "sysfs_bus_id": "0000:00:02.0", + "resources": [ + { + "type": "mem", + "base": 4227858432, + "range": 33554432, + "enabled": true, + "access": "read_only", + "prefetch": "no" + }, + { + "type": "mem", + "base": 4273537024, + "range": 4096, + "enabled": true, + "access": "read_write", + "prefetch": "no" + }, + { + "type": "mem", + "base": 786432, + "range": 131072, + "enabled": false, + "access": "read_write", + "prefetch": "no" + } + ], + "detail": { + "function": 0, + "command": 259, + "header_type": 0, + "secondary_bus": 0, + "irq": 0, + "prog_if": 0 + }, + "driver": "cirrus-qemu", + "driver_module": "cirrus_qemu", + "drivers": [ + "cirrus-qemu" + ], + "driver_modules": [ + "cirrus_qemu" + ], + "driver_info": { + "type": "x11", + "db_entry_0": [ + "4", + "cirrus" + ], + "server": "cirrus", + "xf86_version": "4", + "supports_3d": false, + "Colors": { + "all": 0, + "c8": 0, + "c15": 0, + "c16": 0, + "c24": 0, + "c32": 0 + }, + "dac_speed": 0, + "script": "" + }, + "module_alias": "pci:v00001013d000000B8sv00001AF4sd00001100bc03sc00i00" + } + ], + "hub": [ + { + "index": 24, + "attached_to": 8, + "class_list": [ + "usb", + "hub" + ], + "bus_type": { + "hex": "0086", + "name": "USB", + "value": 134 + }, + "slot": { + "bus": 0, + "number": 0 + }, + "base_class": { + "hex": "010a", + "name": "Hub", + "value": 266 + }, + "vendor": { + "hex": "1d6b", + "name": "Linux 6.14.10 uhci_hcd", + "value": 7531 + }, + "device": { + "hex": "0001", + "name": "UHCI Host Controller", + "value": 1 + }, + "revision": { + "hex": "0000", + "name": "6.14", + "value": 0 + }, + "serial": "0000:00:01.2", + "model": "Linux 6.14.10 uhci_hcd UHCI Host Controller", + "sysfs_id": "/devices/pci0000:00/0000:00:01.2/usb1/1-0:1.0", + "sysfs_bus_id": "1-0:1.0", + "resources": [ + { + "type": "baud", + "speed": 12000000, + "bits": 0, + "stop_bits": 0, + "parity": 0, + "handshake": 0 + } + ], + "detail": { + "device_class": { + "hex": "0009", + "name": "hub", + "value": 9 + }, + "device_subclass": { + "hex": "0000", + "name": "per_interface", + "value": 0 + }, + "device_protocol": 0, + "interface_class": { + "hex": "0009", + "name": "hub", + "value": 9 + }, + "interface_subclass": { + "hex": "0000", + "name": "per_interface", + "value": 0 + }, + "interface_protocol": 0, + "interface_number": 0, + "interface_alternate_setting": 0 + }, + "hotplug": "usb", + "driver": "hub", + "driver_module": "usbcore", + "drivers": [ + "hub" + ], + "driver_modules": [ + "usbcore" + ], + "module_alias": "usb:v1D6Bp0001d0614dc09dsc00dp00ic09isc00ip00in00" + } + ], + "memory": [ + { + "index": 7, + "attached_to": 0, + "class_list": [ + "memory" + ], + "base_class": { + "hex": "0101", + "name": "Internally Used Class", + "value": 257 + }, + "sub_class": { + "hex": "0002", + "name": "Main Memory", + "value": 2 + }, + "model": "Main Memory", + "resources": [ + { + "type": "mem", + "base": 0, + "range": 8130945024, + "enabled": true, + "access": "read_write", + "prefetch": "unknown" + }, + { + "type": "phys_mem", + "range": 8053063680 + } + ] + } + ], + "mouse": [ + { + "index": 25, + "attached_to": 24, + "class_list": [ + "mouse", + "usb" + ], + "bus_type": { + "hex": "0086", + "name": "USB", + "value": 134 + }, + "slot": { + "bus": 0, + "number": 0 + }, + "base_class": { + "hex": "0105", + "name": "Mouse", + "value": 261 + }, + "sub_class": { + "hex": "0003", + "name": "USB Mouse", + "value": 3 + }, + "vendor": { + "hex": "0627", + "name": "QEMU", + "value": 1575 + }, + "device": { + "hex": "0001", + "name": "QEMU USB Tablet", + "value": 1 + }, + "serial": "28754-0000:00:01.2-1", + "compat_vendor": "Unknown", + "compat_device": "Generic USB Mouse", + "model": "QEMU USB Tablet", + "sysfs_id": "/devices/pci0000:00/0000:00:01.2/usb1/1-1/1-1:1.0", + "sysfs_bus_id": "1-1:1.0", + "unix_device_name": "/dev/input/mice", + "unix_device_number": { + "type": 99, + "major": 13, + "minor": 63, + "range": 1 + }, + "unix_device_names": [ + "/dev/input/mice" + ], + "unix_device_name2": "/dev/input/mouse0", + "unix_device_number2": { + "type": 99, + "major": 13, + "minor": 32, + "range": 1 + }, + "resources": [ + { + "type": "baud", + "speed": 12000000, + "bits": 0, + "stop_bits": 0, + "parity": 0, + "handshake": 0 + } + ], + "detail": { + "device_class": { + "hex": "0000", + "name": "per_interface", + "value": 0 + }, + "device_subclass": { + "hex": "0000", + "name": "per_interface", + "value": 0 + }, + "device_protocol": 0, + "interface_class": { + "hex": "0003", + "name": "hid", + "value": 3 + }, + "interface_subclass": { + "hex": "0000", + "name": "per_interface", + "value": 0 + }, + "interface_protocol": 0, + "interface_number": 0, + "interface_alternate_setting": 0 + }, + "hotplug": "usb", + "driver": "usbhid", + "driver_module": "usbhid", + "drivers": [ + "usbhid" + ], + "driver_modules": [ + "usbhid" + ], + "driver_info": { + "type": "mouse", + "db_entry_0": [ + "explorerps/2", + "exps2" + ], + "xf86": "explorerps/2", + "gpm": "exps2", + "buttons": -1, + "wheels": -1 + }, + "module_alias": "usb:v0627p0001d0000dc00dsc00dp00ic03isc00ip00in00" + } + ], + "network_controller": [ + { + "index": 20, + "attached_to": 13, + "class_list": [ + "network_controller" + ], + "bus_type": { + "hex": "008f", + "name": "Virtio", + "value": 143 + }, + "slot": { + "bus": 0, + "number": 0 + }, + "base_class": { + "hex": "0002", + "name": "Network controller", + "value": 2 + }, + "sub_class": { + "hex": "0000", + "name": "Ethernet controller", + "value": 0 + }, + "vendor": "Virtio", + "device": "Ethernet Card 0", + "model": "Virtio Ethernet Card 0", + "sysfs_id": "/devices/pci0000:00/0000:00:03.0/virtio0", + "sysfs_bus_id": "virtio0", + "unix_device_name": "ens3", + "unix_device_names": [ + "ens3" + ], + "resources": [ + { + "type": "hwaddr", + "address": 102 + }, + { + "type": "phwaddr", + "address": 102 + } + ], + "driver": "virtio_net", + "driver_module": "virtio_net", + "drivers": [ + "virtio_net" + ], + "driver_modules": [ + "virtio_net" + ], + "module_alias": "virtio:d00000001v00001AF4" + } + ], + "network_interface": [ + { + "index": 26, + "attached_to": 20, + "class_list": [ + "network_interface" + ], + "base_class": { + "hex": "0107", + "name": "Network Interface", + "value": 263 + }, + "sub_class": { + "hex": "0001", + "name": "Ethernet", + "value": 1 + }, + "model": "Ethernet network interface", + "sysfs_id": "/class/net/ens3", + "sysfs_device_link": "/devices/pci0000:00/0000:00:03.0/virtio0", + "unix_device_name": "ens3", + "unix_device_names": [ + "ens3" + ], + "resources": [ + { + "type": "hwaddr", + "address": 102 + }, + { + "type": "phwaddr", + "address": 102 + } + ], + "driver": "virtio_net", + "driver_module": "virtio_net", + "drivers": [ + "virtio_net" + ], + "driver_modules": [ + "virtio_net" + ] + }, + { + "index": 27, + "attached_to": 0, + "class_list": [ + "network_interface" + ], + "base_class": { + "hex": "0107", + "name": "Network Interface", + "value": 263 + }, + "sub_class": { + "hex": "0000", + "name": "Loopback", + "value": 0 + }, + "model": "Loopback network interface", + "sysfs_id": "/class/net/lo", + "unix_device_name": "lo", + "unix_device_names": [ + "lo" + ] + } + ], + "pci": [ + { + "index": 13, + "attached_to": 0, + "class_list": [ + "pci", + "unknown" + ], + "bus_type": { + "hex": "0004", + "name": "PCI", + "value": 4 + }, + "slot": { + "bus": 0, + "number": 3 + }, + "base_class": { + "hex": "0002", + "name": "Network controller", + "value": 2 + }, + "sub_class": { + "hex": "0000", + "name": "Ethernet controller", + "value": 0 + }, + "vendor": { + "hex": "1af4", + "value": 6900 + }, + "sub_vendor": { + "hex": "1af4", + "value": 6900 + }, + "device": { + "hex": "1000", + "value": 4096 + }, + "sub_device": { + "hex": "0001", + "value": 1 + }, + "model": "Ethernet controller", + "sysfs_id": "/devices/pci0000:00/0000:00:03.0", + "sysfs_bus_id": "0000:00:03.0", + "resources": [ + { + "type": "io", + "base": 49152, + "range": 64, + "enabled": true, + "access": "read_write" + }, + { + "type": "irq", + "base": 10, + "triggered": 0, + "enabled": true + }, + { + "type": "mem", + "base": 4261412864, + "range": 16384, + "enabled": true, + "access": "read_only", + "prefetch": "no" + }, + { + "type": "mem", + "base": 4272947200, + "range": 524288, + "enabled": false, + "access": "read_only", + "prefetch": "no" + }, + { + "type": "mem", + "base": 4273541120, + "range": 4096, + "enabled": true, + "access": "read_write", + "prefetch": "no" + } + ], + "detail": { + "function": 0, + "command": 1287, + "header_type": 0, + "secondary_bus": 0, + "irq": 10, + "prog_if": 0 + }, + "driver": "virtio-pci", + "driver_module": "virtio_pci", + "drivers": [ + "virtio-pci" + ], + "driver_modules": [ + "virtio_pci" + ], + "module_alias": "pci:v00001AF4d00001000sv00001AF4sd00000001bc02sc00i00" + }, + { + "index": 15, + "attached_to": 0, + "class_list": [ + "pci", + "unknown" + ], + "bus_type": { + "hex": "0004", + "name": "PCI", + "value": 4 + }, + "slot": { + "bus": 0, + "number": 6 + }, + "base_class": { + "hex": "0000", + "name": "Unclassified device", + "value": 0 + }, + "sub_class": { + "hex": "00ff", + "value": 255 + }, + "vendor": { + "hex": "1af4", + "value": 6900 + }, + "sub_vendor": { + "hex": "1af4", + "value": 6900 + }, + "device": { + "hex": "1002", + "value": 4098 + }, + "sub_device": { + "hex": "0005", + "value": 5 + }, + "model": "Unclassified device", + "sysfs_id": "/devices/pci0000:00/0000:00:06.0", + "sysfs_bus_id": "0000:00:06.0", + "resources": [ + { + "type": "io", + "base": 49344, + "range": 64, + "enabled": true, + "access": "read_write" + }, + { + "type": "irq", + "base": 11, + "triggered": 0, + "enabled": true + }, + { + "type": "mem", + "base": 4261462016, + "range": 16384, + "enabled": true, + "access": "read_only", + "prefetch": "no" + } + ], + "detail": { + "function": 0, + "command": 263, + "header_type": 0, + "secondary_bus": 0, + "irq": 11, + "prog_if": 0 + }, + "driver": "virtio-pci", + "driver_module": "virtio_pci", + "drivers": [ + "virtio-pci" + ], + "driver_modules": [ + "virtio_pci" + ], + "module_alias": "pci:v00001AF4d00001002sv00001AF4sd00000005bc00scFFi00" + }, + { + "index": 17, + "attached_to": 0, + "class_list": [ + "pci", + "unknown" + ], + "bus_type": { + "hex": "0004", + "name": "PCI", + "value": 4 + }, + "slot": { + "bus": 0, + "number": 5 + }, + "base_class": { + "hex": "0007", + "name": "Communication controller", + "value": 7 + }, + "sub_class": { + "hex": "0080", + "name": "Communication controller", + "value": 128 + }, + "vendor": { + "hex": "1af4", + "value": 6900 + }, + "sub_vendor": { + "hex": "1af4", + "value": 6900 + }, + "device": { + "hex": "1003", + "value": 4099 + }, + "sub_device": { + "hex": "0003", + "value": 3 + }, + "model": "Communication controller", + "sysfs_id": "/devices/pci0000:00/0000:00:05.0", + "sysfs_bus_id": "0000:00:05.0", + "resources": [ + { + "type": "io", + "base": 49280, + "range": 64, + "enabled": true, + "access": "read_write" + }, + { + "type": "irq", + "base": 10, + "triggered": 0, + "enabled": true + }, + { + "type": "mem", + "base": 4261445632, + "range": 16384, + "enabled": true, + "access": "read_only", + "prefetch": "no" + }, + { + "type": "mem", + "base": 4273549312, + "range": 4096, + "enabled": true, + "access": "read_write", + "prefetch": "no" + } + ], + "detail": { + "function": 0, + "command": 1287, + "header_type": 0, + "secondary_bus": 0, + "irq": 10, + "prog_if": 0 + }, + "driver": "virtio-pci", + "driver_module": "virtio_pci", + "drivers": [ + "virtio-pci" + ], + "driver_modules": [ + "virtio_pci" + ], + "module_alias": "pci:v00001AF4d00001003sv00001AF4sd00000003bc07sc80i00" + } + ], + "storage_controller": [ + { + "index": 10, + "attached_to": 0, + "class_list": [ + "storage_controller", + "pci" + ], + "bus_type": { + "hex": "0004", + "name": "PCI", + "value": 4 + }, + "slot": { + "bus": 0, + "number": 4 + }, + "base_class": { + "hex": "0001", + "name": "Mass storage controller", + "value": 1 + }, + "sub_class": { + "hex": "0000", + "name": "SCSI storage controller", + "value": 0 + }, + "vendor": { + "hex": "1af4", + "value": 6900 + }, + "sub_vendor": { + "hex": "1af4", + "value": 6900 + }, + "device": { + "hex": "1004", + "value": 4100 + }, + "sub_device": { + "hex": "0008", + "value": 8 + }, + "model": "SCSI storage controller", + "sysfs_id": "/devices/pci0000:00/0000:00:04.0", + "sysfs_bus_id": "0000:00:04.0", + "resources": [ + { + "type": "io", + "base": 49216, + "range": 64, + "enabled": true, + "access": "read_write" + }, + { + "type": "irq", + "base": 11, + "triggered": 0, + "enabled": true + }, + { + "type": "mem", + "base": 4261429248, + "range": 16384, + "enabled": true, + "access": "read_only", + "prefetch": "no" + }, + { + "type": "mem", + "base": 4273545216, + "range": 4096, + "enabled": true, + "access": "read_write", + "prefetch": "no" + } + ], + "detail": { + "function": 0, + "command": 1287, + "header_type": 0, + "secondary_bus": 0, + "irq": 11, + "prog_if": 0 + }, + "driver": "virtio-pci", + "driver_module": "virtio_pci", + "drivers": [ + "virtio-pci" + ], + "driver_modules": [ + "virtio_pci" + ], + "module_alias": "pci:v00001AF4d00001004sv00001AF4sd00000008bc01sc00i00" + }, + { + "index": 14, + "attached_to": 0, + "class_list": [ + "storage_controller", + "pci" + ], + "bus_type": { + "hex": "0004", + "name": "PCI", + "value": 4 + }, + "slot": { + "bus": 0, + "number": 1 + }, + "base_class": { + "hex": "0001", + "name": "Mass storage controller", + "value": 1 + }, + "sub_class": { + "hex": "0001", + "name": "IDE interface", + "value": 1 + }, + "pci_interface": { + "hex": "0080", + "value": 128 + }, + "vendor": { + "hex": "8086", + "name": "Intel Corporation", + "value": 32902 + }, + "sub_vendor": { + "hex": "1af4", + "value": 6900 + }, + "device": { + "hex": "7010", + "value": 28688 + }, + "sub_device": { + "hex": "1100", + "value": 4352 + }, + "model": "Intel IDE interface", + "sysfs_id": "/devices/pci0000:00/0000:00:01.1", + "sysfs_bus_id": "0000:00:01.1", + "resources": [ + { + "type": "io", + "base": 1014, + "range": 1, + "enabled": true, + "access": "read_write" + }, + { + "type": "io", + "base": 368, + "range": 8, + "enabled": true, + "access": "read_write" + }, + { + "type": "io", + "base": 49440, + "range": 16, + "enabled": true, + "access": "read_write" + }, + { + "type": "io", + "base": 496, + "range": 8, + "enabled": true, + "access": "read_write" + }, + { + "type": "io", + "base": 886, + "range": 1, + "enabled": true, + "access": "read_write" + } + ], + "detail": { + "function": 1, + "command": 263, + "header_type": 0, + "secondary_bus": 0, + "irq": 0, + "prog_if": 128 + }, + "driver": "ata_piix", + "driver_module": "ata_piix", + "drivers": [ + "ata_piix" + ], + "driver_modules": [ + "ata_piix" + ], + "module_alias": "pci:v00008086d00007010sv00001AF4sd00001100bc01sc01i80" + } + ], + "system": { + "form_factor": "desktop" + }, + "unknown": [ + { + "index": 18, + "attached_to": 10, + "class_list": [ + "unknown" + ], + "base_class": { + "hex": "0000", + "name": "Unclassified device", + "value": 0 + }, + "sub_class": { + "hex": "0000", + "name": "Unclassified device", + "value": 0 + }, + "vendor": "Virtio", + "device": "", + "model": "Virtio Unclassified device", + "sysfs_id": "/devices/pci0000:00/0000:00:04.0/virtio1", + "sysfs_bus_id": "virtio1", + "driver": "virtio_scsi", + "driver_module": "virtio_scsi", + "drivers": [ + "virtio_scsi" + ], + "driver_modules": [ + "virtio_scsi" + ], + "module_alias": "virtio:d00000008v00001AF4" + }, + { + "index": 19, + "attached_to": 17, + "class_list": [ + "unknown" + ], + "base_class": { + "hex": "0000", + "name": "Unclassified device", + "value": 0 + }, + "sub_class": { + "hex": "0000", + "name": "Unclassified device", + "value": 0 + }, + "vendor": "Virtio", + "device": "", + "model": "Virtio Unclassified device", + "sysfs_id": "/devices/pci0000:00/0000:00:05.0/virtio2", + "sysfs_bus_id": "virtio2", + "driver": "virtio_console", + "driver_module": "virtio_console", + "drivers": [ + "virtio_console" + ], + "driver_modules": [ + "virtio_console" + ], + "module_alias": "virtio:d00000003v00001AF4" + }, + { + "index": 21, + "attached_to": 15, + "class_list": [ + "unknown" + ], + "base_class": { + "hex": "0000", + "name": "Unclassified device", + "value": 0 + }, + "sub_class": { + "hex": "0000", + "name": "Unclassified device", + "value": 0 + }, + "vendor": "Virtio", + "device": "", + "model": "Virtio Unclassified device", + "sysfs_id": "/devices/pci0000:00/0000:00:06.0/virtio3", + "sysfs_bus_id": "virtio3", + "driver": "virtio_balloon", + "driver_module": "virtio_balloon", + "drivers": [ + "virtio_balloon" + ], + "driver_modules": [ + "virtio_balloon" + ], + "module_alias": "virtio:d00000005v00001AF4" + }, + { + "index": 22, + "attached_to": 0, + "class_list": [ + "unknown" + ], + "base_class": { + "hex": "0007", + "name": "Communication controller", + "value": 7 + }, + "sub_class": { + "hex": "0000", + "name": "Serial controller", + "value": 0 + }, + "pci_interface": { + "hex": "0002", + "name": "16550", + "value": 2 + }, + "device": { + "hex": "0000", + "name": "16550A", + "value": 0 + }, + "model": "16550A", + "unix_device_name": "/dev/ttyS0", + "unix_device_names": [ + "/dev/ttyS0" + ], + "resources": [ + { + "type": "io", + "base": 1016, + "range": 0, + "enabled": true, + "access": "read_write" + }, + { + "type": "irq", + "base": 4, + "triggered": 0, + "enabled": true + } + ] + } + ], + "usb_controller": [ + { + "index": 8, + "attached_to": 0, + "class_list": [ + "usb_controller", + "pci" + ], + "bus_type": { + "hex": "0004", + "name": "PCI", + "value": 4 + }, + "slot": { + "bus": 0, + "number": 1 + }, + "base_class": { + "hex": "000c", + "name": "Serial bus controller", + "value": 12 + }, + "sub_class": { + "hex": "0003", + "name": "USB Controller", + "value": 3 + }, + "pci_interface": { + "hex": "0000", + "name": "UHCI", + "value": 0 + }, + "vendor": { + "hex": "8086", + "name": "Intel Corporation", + "value": 32902 + }, + "sub_vendor": { + "hex": "1af4", + "value": 6900 + }, + "device": { + "hex": "7020", + "value": 28704 + }, + "sub_device": { + "hex": "1100", + "value": 4352 + }, + "revision": { + "hex": "0001", + "value": 1 + }, + "model": "Intel USB Controller", + "sysfs_id": "/devices/pci0000:00/0000:00:01.2", + "sysfs_bus_id": "0000:00:01.2", + "resources": [ + { + "type": "io", + "base": 49408, + "range": 32, + "enabled": true, + "access": "read_write" + }, + { + "type": "irq", + "base": 11, + "triggered": 0, + "enabled": true + } + ], + "detail": { + "function": 2, + "command": 263, + "header_type": 0, + "secondary_bus": 0, + "irq": 11, + "prog_if": 0 + }, + "driver": "uhci_hcd", + "driver_module": "uhci_hcd", + "drivers": [ + "uhci_hcd" + ], + "driver_modules": [ + "uhci_hcd" + ], + "driver_info": { + "type": "module", + "db_entry_0": [ + "uhci-hcd" + ], + "active": true, + "modprobe": true, + "names": [ + "uhci-hcd" + ], + "module_args": [ + "" + ], + "conf": "" + }, + "module_alias": "pci:v00008086d00007020sv00001AF4sd00001100bc0Csc03i00" + } + ] + }, + "smbios": { + "bios": { + "handle": 0, + "vendor": "SeaBIOS", + "version": "1.16.3-debian-1.16.3-2~bpo12+1", + "date": "04/01/2014", + "features": null, + "start_address": "0xe8000", + "rom_size": 65536 + }, + "chassis": [ + { + "handle": 768, + "manufacturer": "QEMU", + "version": "pc-i440fx-9.2", + "chassis_type": { + "hex": "0001", + "name": "Other", + "value": 1 + }, + "lock_present": false, + "bootup_state": { + "hex": "0003", + "name": "Safe", + "value": 3 + }, + "power_state": { + "hex": "0003", + "name": "Safe", + "value": 3 + }, + "thermal_state": { + "hex": "0003", + "name": "Safe", + "value": 3 + }, + "security_state": { + "hex": "0002", + "name": "Unknown", + "value": 2 + }, + "oem": "0x0" + } + ], + "memory_array": [ + { + "handle": 4096, + "location": { + "hex": "0001", + "name": "Other", + "value": 1 + }, + "usage": { + "hex": "0003", + "name": "System memory", + "value": 3 + }, + "ecc": { + "hex": "0006", + "name": "Multi-bit", + "value": 6 + }, + "max_size": "0x7d0000", + "error_handle": 65534, + "slots": 1 + } + ], + "memory_array_mapped_address": [ + { + "handle": 4864, + "array_handle": 4096, + "start_address": "0x0", + "end_address": "0xc0000000", + "part_width": 1 + }, + { + "handle": 4865, + "array_handle": 4096, + "start_address": "0x100000000", + "end_address": "0x234000000", + "part_width": 1 + } + ], + "memory_device": [ + { + "handle": 4352, + "location": "DIMM 0", + "bank_location": "", + "manufacturer": "QEMU", + "part_number": "", + "array_handle": 4096, + "error_handle": 65534, + "width": 0, + "ecc_bits": 0, + "size": 8192000, + "form_factor": { + "hex": "0009", + "name": "DIMM", + "value": 9 + }, + "set": 0, + "memory_type": { + "hex": "0007", + "name": "RAM", + "value": 7 + }, + "memory_type_details": [ + "Other" + ], + "speed": 0 + } + ], + "processor": [ + { + "handle": 1024, + "socket": "CPU 0", + "socket_type": { + "hex": "0001", + "name": "Other", + "value": 1 + }, + "socket_populated": true, + "manufacturer": "QEMU", + "version": "pc-i440fx-9.2", + "part": "", + "processor_type": { + "hex": "0003", + "name": "CPU", + "value": 3 + }, + "processor_family": { + "hex": "00fe", + "name": "Other", + "value": 254 + }, + "processor_status": { + "hex": "0001", + "name": "Enabled", + "value": 1 + }, + "clock_ext": 0, + "clock_max": 2000, + "cache_handle_l1": 0, + "cache_handle_l2": 0, + "cache_handle_l3": 0 + }, + { + "handle": 1025, + "socket": "CPU 1", + "socket_type": { + "hex": "0001", + "name": "Other", + "value": 1 + }, + "socket_populated": true, + "manufacturer": "QEMU", + "version": "pc-i440fx-9.2", + "part": "", + "processor_type": { + "hex": "0003", + "name": "CPU", + "value": 3 + }, + "processor_family": { + "hex": "00fe", + "name": "Other", + "value": 254 + }, + "processor_status": { + "hex": "0001", + "name": "Enabled", + "value": 1 + }, + "clock_ext": 0, + "clock_max": 2000, + "cache_handle_l1": 0, + "cache_handle_l2": 0, + "cache_handle_l3": 0 + }, + { + "handle": 1026, + "socket": "CPU 2", + "socket_type": { + "hex": "0001", + "name": "Other", + "value": 1 + }, + "socket_populated": true, + "manufacturer": "QEMU", + "version": "pc-i440fx-9.2", + "part": "", + "processor_type": { + "hex": "0003", + "name": "CPU", + "value": 3 + }, + "processor_family": { + "hex": "00fe", + "name": "Other", + "value": 254 + }, + "processor_status": { + "hex": "0001", + "name": "Enabled", + "value": 1 + }, + "clock_ext": 0, + "clock_max": 2000, + "cache_handle_l1": 0, + "cache_handle_l2": 0, + "cache_handle_l3": 0 + }, + { + "handle": 1027, + "socket": "CPU 3", + "socket_type": { + "hex": "0001", + "name": "Other", + "value": 1 + }, + "socket_populated": true, + "manufacturer": "QEMU", + "version": "pc-i440fx-9.2", + "part": "", + "processor_type": { + "hex": "0003", + "name": "CPU", + "value": 3 + }, + "processor_family": { + "hex": "00fe", + "name": "Other", + "value": 254 + }, + "processor_status": { + "hex": "0001", + "name": "Enabled", + "value": 1 + }, + "clock_ext": 0, + "clock_max": 2000, + "cache_handle_l1": 0, + "cache_handle_l2": 0, + "cache_handle_l3": 0 + } + ], + "system": { + "handle": 256, + "manufacturer": "OpenStack Foundation", + "product": "OpenStack Nova", + "version": "19.3.2", + "wake_up": { + "hex": "0006", + "name": "Power Switch", + "value": 6 + } + } + } +} diff --git a/modules/acme-home.nix b/modules/acme-home.nix new file mode 100644 index 0000000..77de9c9 --- /dev/null +++ b/modules/acme-home.nix @@ -0,0 +1,34 @@ +{ + config, + lib, + pkgs, + ... +}: +{ + security.acme = { + acceptTerms = true; + defaults.email = lib.mkDefault "admin@rpqt.fr"; + }; + + # security.acme = { + # certs."home.rpqt.fr" = { + # group = config.services.nginx.group; + # domain = "home.rpqt.fr"; + # extraDomainNames = [ "*.home.rpqt.fr" ]; + # dnsProvider = "rfc2136"; + # dnsPropagationCheck = true; + # credentialFiles = { + # RFC2136_TSIG_SECRET_FILE = config.clan.core.vars.generators.coredns.files.tsig-key.path; + # }; + # environmentFile = pkgs.writeFile '' + # RFC2136_NAMESERVER=fd28:387a:90:c400::1 + # ''; + # email = "admin@rpqt.fr"; + # dnsResolver = "1.1.1.1:53"; + # server = "https://acme-staging-v02.api.letsencrypt.org/directory"; # TODO: use production api + # }; + # }; + + # clan.core.vars.generators.coredns.files.tsig-key.group = "acme"; + # clan.core.vars.generators.coredns.files.tsig-key.mode = "0440"; +} diff --git a/modules/borgbackup.nix b/modules/borgbackup.nix index 63b59a7..172e76e 100644 --- a/modules/borgbackup.nix +++ b/modules/borgbackup.nix @@ -1,4 +1,4 @@ -{ config, inputs, ... }: +{ config, self, ... }: let user = "u422292"; sub-user = "${user}"; @@ -7,7 +7,7 @@ in { imports = [ ./storagebox.nix - inputs.clan-core.clanModules.borgbackup + self.inputs.clan-core.clanModules.borgbackup ]; clan.borgbackup.destinations."storagebox-${config.networking.hostName}" = { diff --git a/modules/desktop.nix b/modules/desktop.nix new file mode 100644 index 0000000..294ef56 --- /dev/null +++ b/modules/desktop.nix @@ -0,0 +1,25 @@ +{ pkgs, ... }: +{ + environment.systemPackages = [ + pkgs.mpv # video player + pkgs.amberol # music player + pkgs.alacritty + pkgs.ghostty + pkgs.libreoffice + pkgs.nautilus + ]; + + programs.firefox = { + enable = true; + nativeMessagingHosts.packages = [ pkgs.passff-host ]; + }; + + programs.thunderbird.enable = true; + + programs.nautilus-open-any-terminal = { + enable = true; + terminal = "ghostty"; + }; + + services.pcscd.enable = true; +} diff --git a/modules/dev.nix b/modules/dev.nix new file mode 100644 index 0000000..294bdfa --- /dev/null +++ b/modules/dev.nix @@ -0,0 +1,6 @@ +{ + clan.core.vars.generators.atuin = { + prompts.key.persist = true; + files.key.owner = "rpqt"; + }; +} diff --git a/modules/flake-module.nix b/modules/flake-module.nix new file mode 100644 index 0000000..fba0311 --- /dev/null +++ b/modules/flake-module.nix @@ -0,0 +1,28 @@ +{ lib, ... }: +{ + flake.nixosModules = + ( + (builtins.readDir ./.) + |> lib.filterAttrs (path: type: type == "regular" && (lib.hasSuffix ".nix" path)) + |> lib.mapAttrs' ( + path: _: { + name = lib.removeSuffix ".nix" path; + value = { + imports = [ ./${path} ]; + }; + } + ) + ) + // { + server.imports = [ + ./motd.nix + ]; + + common.imports = [ + { + users.mutableUsers = lib.mkDefault false; + services.userborn.enable = lib.mkDefault true; + } + ]; + }; +} diff --git a/modules/garage.nix b/modules/garage.nix new file mode 100644 index 0000000..3740110 --- /dev/null +++ b/modules/garage.nix @@ -0,0 +1,60 @@ +{ + config, + lib, + pkgs, + self, + ... +}: +let + zerotier_interface = "zts7mq7onf"; + zerotier_ip = + self.nixosConfigurations.${config.networking.hostName}.config.clan.core.vars.generators.zerotier.files.zerotier-ip.value; + s3_port = 3900; + rpc_port = 3901; + web_port = 3902; + admin_port = 3903; +in +{ + services.garage = { + package = pkgs.garage; + settings = { + metadata_dir = "/var/lib/garage/meta"; + data_dir = lib.mkDefault "/var/lib/garage/data"; + db_engine = "sqlite"; + + replication_factor = 3; + + rpc_bind_addr = "[::]:${toString rpc_port}"; + rpc_public_addr = "[::]:${toString rpc_port}"; + + s3_api = { + api_bind_addr = "[::]:${toString s3_port}"; + s3_region = "garage"; + root_domain = ".s3.garage.home.rpqt.fr"; + }; + + s3_web = { + bind_addr = "127.0.0.1:${toString web_port}"; + root_domain = ".web.garage.home.rpqt.fr"; + }; + + admin = { + api_bind_addr = "[::]:${toString admin_port}"; + # TODO: use metrics_token + }; + }; + }; + + networking.firewall.interfaces = + let + allowedTCPPorts = [ + s3_port + rpc_port + admin_port + ]; + in + { + ${zerotier_interface} = { inherit allowedTCPPorts; }; + wireguard = { inherit allowedTCPPorts; }; + }; +} diff --git a/modules/gitea.nix b/modules/gitea.nix new file mode 100644 index 0000000..034801e --- /dev/null +++ b/modules/gitea.nix @@ -0,0 +1,71 @@ +{ config, ... }: +{ + services.gitea = { + enable = true; + lfs.enable = true; + + settings = { + # storage = { + # }; + + server = { + ROOT_URL = "https://git.turifer.dev"; + DOMAIN = "git.turifer.dev"; + }; + + session.PROVIDER = "db"; + session.COOKIE_SECURE = true; + + service.DISABLE_REGISTRATION = true; + + # Create a repository by pushing to it + repository.ENABLE_PUSH_CREATE_USER = true; + }; + }; + + systemd.services.gitea.environment = { + GITEA__storage__STORAGE_TYPE = "minio"; + GITEA__storage__MINIO_ENDPOINT = "localhost:3900"; + GITEA__storage__MINIO_BUCKET = "gitea"; + GITEA__storage__MINIO_LOCATION = "garage"; + GITEA__storage__MINIO_USE_SSL = "false"; + }; + + systemd.services.gitea.serviceConfig = { + LoadCredential = [ + "minio_access_key_id:${config.clan.core.vars.generators.gitea-s3-storage.files.access-key-id.path}" + "minio_secret_access_key:${config.clan.core.vars.generators.gitea-s3-storage.files.access-key-secret.path}" + ]; + Environment = [ + "GITEA__storage__MINIO_ACCESS_KEY_ID=%d/minio_access_key_id" + "GITEA__storage__MINIO_SECRET_ACCESS_KEY=%d/minio_secret_access_key" + ]; + }; + + clan.core.vars.generators.gitea-s3-storage = { + prompts.access-key-id = { + description = "s3 access key id"; + type = "line"; + persist = true; + }; + prompts.access-key-secret = { + description = "s3 access key secret"; + type = "hidden"; + persist = true; + }; + }; + + clan.core.state.gitea.folders = [ config.services.gitea.stateDir ]; + + services.nginx.virtualHosts."git.turifer.dev" = { + enableACME = true; + forceSSL = true; + locations."/" = { + proxyPass = "http://localhost:${builtins.toString (config.services.gitea.settings.server.HTTP_PORT)}"; + }; + }; + + security.acme.certs."git.turifer.dev" = { + email = "admin@turifer.dev"; + }; +} diff --git a/system/core/ssh-server.nix b/modules/hardened-ssh-server.nix similarity index 100% rename from system/core/ssh-server.nix rename to modules/hardened-ssh-server.nix diff --git a/modules/lounge.nix b/modules/lounge.nix new file mode 100644 index 0000000..dd23b1c --- /dev/null +++ b/modules/lounge.nix @@ -0,0 +1,13 @@ +let + tld = "val"; + domain = "lounge.${tld}"; +in +{ + services.nginx.virtualHosts.${domain} = { + enableACME = true; + forceSSL = true; + root = "/var/www/lounge"; + }; + + security.acme.certs.${domain}.server = "https://ca.${tld}/acme/acme/directory"; +} diff --git a/modules/motd.nix b/modules/motd.nix new file mode 100644 index 0000000..1547318 --- /dev/null +++ b/modules/motd.nix @@ -0,0 +1,6 @@ +{ config, ... }: +{ + users.motd = '' + Welcome to ${config.networking.hostName}! + ''; +} diff --git a/modules/nextcloud.nix b/modules/nextcloud.nix new file mode 100644 index 0000000..745cd30 --- /dev/null +++ b/modules/nextcloud.nix @@ -0,0 +1,84 @@ +{ config, pkgs, ... }: +let + fqdn = "cloud.rpqt.fr"; +in +{ + imports = [ + ./acme-home.nix + ]; + + services.nextcloud = { + enable = true; + hostName = fqdn; + https = true; + package = pkgs.nextcloud32; + config = { + dbtype = "pgsql"; + dbuser = "nextcloud"; + dbhost = "/run/postgresql"; + dbname = "nextcloud"; + # admin user is only for the initial setup + adminuser = "root"; + adminpassFile = config.clan.core.vars.generators.nextcloud.files.admin-password.path; + objectstore.s3 = { + enable = true; + bucket = "nextcloud"; + key = config.clan.core.vars.generators.nextcloud-s3-storage.files.access-key-id.value; + secretFile = config.clan.core.vars.generators.nextcloud-s3-storage.files.access-key-secret.path; + hostname = "[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]"; + port = 3900; + useSsl = false; + region = "garage"; + usePathStyle = true; + }; + }; + extraAppsEnable = true; + extraApps = { + # inherit (pkgs.nextcloud32Packages.apps) tasks; + }; + }; + + clan.core.postgresql = { + enable = true; + databases = { + nextcloud = { + create.enable = true; + restore.stopOnRestore = [ "nextcloud" ]; + }; + }; + }; + + systemd.services."nextcloud-setup" = { + requires = [ "postgresql.service" ]; + after = [ "postgresql.service" ]; + }; + + services.nginx.virtualHosts.${config.services.nextcloud.hostName} = { + forceSSL = true; + enableACME = true; + }; + + clan.core.vars.generators.nextcloud = { + prompts.admin-password = { + description = "nextcloud admin password"; + type = "hidden"; + persist = true; + }; + files.admin-password.owner = "nextcloud"; + }; + + clan.core.vars.generators.nextcloud-s3-storage = { + prompts.access-key-id = { + description = "s3 access key id"; + type = "line"; + persist = true; + }; + prompts.access-key-secret = { + description = "s3 access key secret"; + type = "hidden"; + persist = true; + }; + files.access-key-id.secret = false; + files.access-key-secret.owner = "nextcloud"; + }; +} diff --git a/system/nix/default.nix b/modules/nix-defaults.nix similarity index 53% rename from system/nix/default.nix rename to modules/nix-defaults.nix index 10d84fc..ac488ef 100644 --- a/system/nix/default.nix +++ b/modules/nix-defaults.nix @@ -1,18 +1,20 @@ { pkgs, ... }: { - imports = [ - ./nixpkgs.nix - ./substituters.nix - ]; - # for flakes environment.systemPackages = [ pkgs.git ]; nix.settings = { auto-optimise-store = true; builders-use-substitutes = true; - experimental-features = ["nix-command" "flakes"]; + experimental-features = [ + "nix-command" + "flakes" + "pipe-operators" + ]; - trusted-users = ["root" "@wheel"]; + trusted-users = [ + "root" + "@wheel" + ]; }; } diff --git a/modules/radicle.nix b/modules/radicle.nix new file mode 100644 index 0000000..ea2f2db --- /dev/null +++ b/modules/radicle.nix @@ -0,0 +1,44 @@ +{ + config, + pkgs, + ... +}: +{ + services.radicle = { + enable = true; + privateKeyFile = config.clan.core.vars.generators.radicle.files."id_ed25519".path; + publicKey = config.clan.core.vars.generators.radicle.files."id_ed25519.pub".value; + node = { + openFirewall = true; + }; + httpd = { + enable = true; + nginx = { + serverName = "radicle.rpqt.fr"; + enableACME = true; + forceSSL = true; + }; + }; + settings = { + # FIXME: activation fails with rad saying the config is invalid + web.avatarUrl = "https://rpqt.fr/favicon.svg"; + web.description = "rpqt's radicle node"; + web.pinned.repositories = [ + "rad:z2DH9K384tPCrM5HJcpiKEoZZdftY" # lila + "rad:z29gVX1f6HC1XGx755RL1m1hhMp6x" # corner + "rad:z36HRN3Soay4wMXBSiR4aW7Hg9rT7" # flocon + ]; + }; + }; + + clan.core.vars.generators.radicle = { + files."id_ed25519".secret = true; + files."id_ed25519.pub".secret = false; + runtimeInputs = [ pkgs.openssh ]; + script = '' + ssh-keygen -t ed25519 -f "$out"/id_ed25519 -N "" -C "radicle" + ''; + }; + + clan.core.state.radicle.folders = [ "/var/lib/radicle" ]; +} diff --git a/modules/remote-builder.nix b/modules/remote-builder.nix index 04b32a6..6c74f92 100644 --- a/modules/remote-builder.nix +++ b/modules/remote-builder.nix @@ -39,7 +39,9 @@ in isSystemUser = true; group = cfg.group; useDefaultShell = true; - openssh.authorizedKeys.keys = cfg.authorizedKeys; + openssh.authorizedKeys.keys = map ( + key: ''restrict,command="nix-daemon --stdio" ${key}'' + ) cfg.authorizedKeys; }; users.groups.${cfg.user} = { }; diff --git a/system/network/tailscale.nix b/modules/tailscale.nix similarity index 100% rename from system/network/tailscale.nix rename to modules/tailscale.nix diff --git a/modules/user-rpqt.nix b/modules/user-rpqt.nix new file mode 100644 index 0000000..4c1d0bb --- /dev/null +++ b/modules/user-rpqt.nix @@ -0,0 +1,21 @@ +{ lib, pkgs, ... }: +{ + users.users.rpqt = { + isNormalUser = true; + + createHome = lib.mkDefault true; + home = lib.mkDefault "/home/rpqt"; + + description = "Romain Paquet"; + + shell = pkgs.fish; + + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGa8R8obgptefcp27Cdp9bc2fiyc9x0oTfMsTPFp2ktE rpqt@haze" + ]; + + extraGroups = [ "wheel" ]; + }; + + programs.fish.enable = true; +} diff --git a/modules/vaultwarden.nix b/modules/vaultwarden.nix new file mode 100644 index 0000000..4ae455f --- /dev/null +++ b/modules/vaultwarden.nix @@ -0,0 +1,18 @@ +{ + config, + ... +}: +{ + services.vaultwarden = { + enable = true; + domain = "vaultwarden.val"; + configureNginx = true; + }; + + services.nginx.virtualHosts.${config.services.vaultwarden.domain} = { + enableACME = true; + }; + + security.acme.certs.${config.services.vaultwarden.domain}.server = + "https://ca.val/acme/acme/directory"; +} diff --git a/packages/flake-module.nix b/packages/flake-module.nix new file mode 100644 index 0000000..13305ce --- /dev/null +++ b/packages/flake-module.nix @@ -0,0 +1,26 @@ +{ inputs, self, ... }: +{ + flake.packages.aarch64-linux.genepi-installer-sd-image = inputs.nixos-generators.nixosGenerate { + specialArgs = { + inherit inputs; + }; + system = "aarch64-linux"; + format = "sd-aarch64-installer"; + modules = [ + inputs.nixos-hardware.nixosModules.raspberry-pi-4 + self.nixosModules.common + self.nixosModules.hardened-ssh-server + ./machines/genepi/network.nix + ./machines/genepi/hardware-configuration.nix + { networking.hostName = "genepi"; } + { sdImage.compressImage = false; } + { + nixpkgs.overlays = [ + (final: super: { + makeModulesClosure = x: super.makeModulesClosure (x // { allowMissing = true; }); + }) + ]; + } + ]; + }; +} diff --git a/parts/default.nix b/parts/default.nix deleted file mode 100644 index 2948de5..0000000 --- a/parts/default.nix +++ /dev/null @@ -1,3 +0,0 @@ -{ - keys = import ./keys.nix; -} diff --git a/parts/keys.nix b/parts/keys.nix deleted file mode 100644 index f6fce87..0000000 --- a/parts/keys.nix +++ /dev/null @@ -1,15 +0,0 @@ -{ - rpqt.haze = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGa8R8obgptefcp27Cdp9bc2fiyc9x0oTfMsTPFp2ktE rpqt@haze"; - - hosts = { - haze = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKga5V0H602RsBESBXf5kwRCnI1yfBPOHmjGsM4Rxf5r root@haze"; - genepi = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQUzjid5mfMYginIUCVWTF7rWvWz0mUZBZsl5EhDIDl root@genepi"; - crocus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAiz3nzuJGO5tRka2Y/kzqKa68wF7wwHr4hAympLNb9F root@crocus"; - storagebox = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIICf9svRenC/PLKIL9nk6K/pxQgoiFC41wTNvoIncOxs"; - storagebox-rsa = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA5EB5p/5Hp3hGW1oHok+PIOH9Pbn7cnUiGmUEBrCVjnAw+HrKyN8bYVV0dIGllswYXwkG/+bgiBlE6IVIBAq+JwVWu1Sss3KarHY3OvFJUXZoZyRRg/Gc/+LRCE7lyKpwWQ70dbelGRyyJFH36eNv6ySXoUYtGkwlU5IVaHPApOxe4LHPZa/qhSRbPo2hwoh0orCtgejRebNtW5nlx00DNFgsvn8Svz2cIYLxsPVzKgUxs8Zxsxgn+Q/UvR7uq4AbAhyBMLxv7DjJ1pc7PJocuTno2Rw9uMZi1gkjbnmiOh6TTXIEWbnroyIhwc8555uto9melEUmWNQ+C+PwAK+MPw=="; - }; - - services = { - radicle = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBuoHC4P0h88OAL5PJmiqkbkvQR1cwfkjaevWbwdKOU7 radicle@rpqt.fr"; - }; -} diff --git a/secrets/freshrss.age b/secrets/freshrss.age deleted file mode 100644 index bec4a3d..0000000 --- a/secrets/freshrss.age +++ /dev/null @@ -1,8 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 ELMcHw e1XlBpnFTEjcVaiz2ogDRQlrkvEK98pJb2iDaP3fAF8 -W9li/7spMyPzwaCSFkOdPOL9ZNuaGCnJxm0uB/vLyS8 --> ssh-ed25519 8TpKTA 3HeKYAD1Y9UGfCmTWdgfVRMXy/q+R2fH/rrDdCnmBgc -S2pjlFKodLcx06HqrkghUUQB8QgyxkhPean6EV7GsXM ---- g6mHVMs7rkgyIus4NGuw8h+Hai3ME0FbuIpvA2KOOYQ -–=Ï2#¯–Þ¸<+ïí -vàÙúœÂŒL¼3î@Zè,Ü…M9,C$»aèr zuO>Ç͇° \ No newline at end of file diff --git a/secrets/gandi.age b/secrets/gandi.age deleted file mode 100644 index 4a193b0..0000000 Binary files a/secrets/gandi.age and /dev/null differ diff --git a/secrets/radicle-private-key.age b/secrets/radicle-private-key.age deleted file mode 100644 index 7ed9647..0000000 --- a/secrets/radicle-private-key.age +++ /dev/null @@ -1,8 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 M/D1Cg YfbyictbASsHxNw6wLCn39IrkNtbpVM8QZNczMArVkw -om2OLtWnWYLvUm7L4tSDDXHtUKd1O+wqwKO78QZ/6cg --> ssh-ed25519 8TpKTA vtuEudd4t+4kzeztRImB1QqGtH7QJiCppBzSngEzKm4 -qUgxtzght+zL/PVuBKbD3S+B4H3siZveg7n0mqJQqDQ ---- 8xbzXxMfsk2mfLI25fp+xtzTfjJr2t6nSQWa69Ua9Mw -!™n‰ýÙù:ùŽŸ=Ä`\iý€§ˆÛMti³ðö°ÙÄÞ:ŸA'ñp––®õ¾wwª^râ€Ûâøo¶ò ,NMC„úqÚ˜âÚ¿z–YÉ\<ÒÞ•lSÒ+d^YŒϹ1rº}ï€ëã¾Z‘®ÇØfm¼ÉÒ@–‚äДèåc —3Ä|MÜìÎÕV÷Kåa½Ûå?EðAÃ+èsq,…÷™ØÃ…VÄ$|N I TÄ ¤-xÜk÷€µ$¬¢A~•WÈ'„ünM ¯¯þÑÀ˜<p¡{ÊDØå órßeù¦ûåRû²7PyQùì:©¸¹;9XÖ nu6Si剞x î˜FÔ5•ÍMÒ bœŠHYÿ[æÿgþÓžmt×è£cjÛY„