diff options
| -rw-r--r-- | flake.nix | 4 | ||||
| -rw-r--r-- | home-modules/apps/nvim/default.nix | 44 | ||||
| -rw-r--r-- | hosts/apocalypse/default.nix | 2 | ||||
| -rw-r--r-- | hosts/tacitus/default.nix (renamed from hosts/threshold/default.nix) | 23 | ||||
| -rw-r--r-- | hosts/tacitus/disko.nix | 91 | ||||
| -rw-r--r-- | hosts/tacitus/hardware.nix (renamed from hosts/threshold/hardware.nix) | 0 | ||||
| -rw-r--r-- | hosts/tacitus/network.nix (renamed from hosts/threshold/network.nix) | 0 | ||||
| -rw-r--r-- | hosts/threshold/disko.nix | 85 | ||||
| -rw-r--r-- | modules/default.nix | 1 | ||||
| -rw-r--r-- | modules/locale.nix | 24 | ||||
| -rw-r--r-- | services/email.nix | 15 | ||||
| -rw-r--r-- | services/gomuks.nix | 67 |
12 files changed, 232 insertions, 124 deletions
@@ -120,7 +120,7 @@ ]; }; - threshold = nixpkgs.lib.nixosSystem { + tacitus = nixpkgs.lib.nixosSystem { specialArgs = { inherit inputs; }; @@ -128,7 +128,7 @@ modules = [ ./modules ./users/wilkuu-server.nix - ./hosts/threshold + ./hosts/tacitus inputs.home-manager.nixosModules.default disko.nixosModules.disko inputs.sops-nix.nixosModules.sops diff --git a/home-modules/apps/nvim/default.nix b/home-modules/apps/nvim/default.nix index ae284bd..4dfbd17 100644 --- a/home-modules/apps/nvim/default.nix +++ b/home-modules/apps/nvim/default.nix @@ -15,41 +15,47 @@ in }; config = lib.mkIf config.homeapps.nvim.enable { + home.sessionVariables = { + TERM = "nvim"; + }; + programs.neovim = { - enable = true; + enable = false; defaultEditor = true; viAlias = true; vimAlias = true; vimdiffAlias = true; - withPython3 = true; - withNodeJs = true; - withRuby = true; + withPython3 = false; + withNodeJs = false; + withRuby = false; - coc.enable = false; - plugins = [ - ]; + # coc.enable = false; }; - home.file."./.config/nvim/lua/wilkuu/nix.lua".text = '' + home.file = lib.mkIf config.homeapps.nvim.lsp { + "./.config/nvim/lua/wilkuu/nix.lua".text = config.homeapps.nvim.lsp '' return { vue_ts_plugin = "${lib.getBin vue_ls}/lib/node_modules/@vue/language-server/node_modules/@vue/typescript-plugin/" } - ''; + '';}; home.sessionPath = [ "/home/wilkuu/.npm/bin/" ]; - home.packages = lib.mkIf config.homeapps.nvim.lsp ( + home.packages = with pkgs; - [ - lua - lua-language-server - ] - ++ [ - ts_ls - vue_ls - ] - ); + lib.mkMerge [ + (lib.mkIf config.homeapps.nvim.lsp ([ + lua + lua-language-server + ts_ls + vue_ls + ])) + [ + neovim + neovim-node-client + ] + ]; }; } diff --git a/hosts/apocalypse/default.nix b/hosts/apocalypse/default.nix index e82b048..179e2d1 100644 --- a/hosts/apocalypse/default.nix +++ b/hosts/apocalypse/default.nix @@ -23,7 +23,7 @@ addons = { desktop.hyprland.enable = false; desktop.xfce.enable = true; - desktop.cosmic.enable = false; + desktop.cosmic.enable = true; desktop.kde.enable = true; steam.enable = true; diff --git a/hosts/threshold/default.nix b/hosts/tacitus/default.nix index 485997b..1efc539 100644 --- a/hosts/threshold/default.nix +++ b/hosts/tacitus/default.nix @@ -3,7 +3,6 @@ ... }: { - imports = [ ./network.nix ./disko.nix @@ -17,18 +16,22 @@ # Bootloader and boot setup. boot.loader.efi.canTouchEfiVariables = lib.mkDefault true; - - boot.loader.grub = { - enable = true; - useOSProber = false; - device = "nodev"; + boot.loader.limine = { efiSupport = true; - default = "saved"; - memtest86.enable = true; + enable = true; + secureBoot = { + enable = true; + autoGenerateKeys = true; + autoEnrollKeys = { + extraArgs = [ + "--microsoft" + "--firmware-builtin" + ]; + }; + }; }; - # Networking setup - networking.hostName = "threshold"; + networking.hostName = "tacitus"; services.resolved = { enable = true; settings.Resolve.DNSOverTLS = "opportunistic"; diff --git a/hosts/tacitus/disko.nix b/hosts/tacitus/disko.nix new file mode 100644 index 0000000..5e36661 --- /dev/null +++ b/hosts/tacitus/disko.nix @@ -0,0 +1,91 @@ +{ config, lib, ... }: +{ + options.host-config.disko = with lib; { + root_device = mkOption { + type = types.path; + default = "/dev/nvme0n1"; + example = "/dev/nvme0n1"; + description = "Root device for disko and grub"; + }; + enable = mkOption { + type = types.bool; + default = !config.addons.virtualisation.isTestVM; + description = "Whenever to enable disko or not."; + }; + }; + + config = + let + cfg = config.host-config.disko; + in + lib.mkIf (cfg.enable) { + services.btrfs.autoScrub = { + enable = true; + interval = "weekly"; + }; + + disko.devices = { + disk = { + main-disk = { + device = cfg.root_device; + type = "disk"; + content = { + type = "gpt"; + partitions = { + ESP = { + type = "EF00"; + size = "512M"; + content = { + type = "filesystem"; + format = "vfat"; + mountpoint = "/boot"; + mountOptions = [ "umask=0077" ]; + }; + }; + luks = { + size = "100%"; + content = { + type = "luks"; + name = "crypted"; + passwordFile = "/tmp/root-reserve-key.key"; + # Do not wait for recovery displaying and blocking formatting. + content = { + type = "btrfs"; + extraArgs = [ "-f" ]; + subvolumes = { + # Subvolume name is different from mountpoint + "/rootfs" = { + mountOptions = [ "compress=zstd" ]; + mountpoint = "/"; + }; + # Subvolume name is the same as the mountpoint + "/home" = { + mountOptions = [ "compress=zstd" ]; + mountpoint = "/home"; + }; + # Parent is not mounted so the mountpoint must be set + "/nix" = { + mountOptions = [ + "compress=zstd" + "noatime" + ]; + mountpoint = "/nix"; + }; + # Subvolume for the swapfile + "/swap" = { + mountpoint = "/.swapvol"; + swap = { + swapfile.size = "8G"; + }; + }; + }; + }; + }; + }; + }; + }; + }; + }; + }; + }; +} diff --git a/hosts/threshold/hardware.nix b/hosts/tacitus/hardware.nix index f0b2fe7..f0b2fe7 100644 --- a/hosts/threshold/hardware.nix +++ b/hosts/tacitus/hardware.nix diff --git a/hosts/threshold/network.nix b/hosts/tacitus/network.nix index a4d0c03..a4d0c03 100644 --- a/hosts/threshold/network.nix +++ b/hosts/tacitus/network.nix diff --git a/hosts/threshold/disko.nix b/hosts/threshold/disko.nix deleted file mode 100644 index ddbfa11..0000000 --- a/hosts/threshold/disko.nix +++ /dev/null @@ -1,85 +0,0 @@ -{ config, lib, ... }: -{ - options.host-config.disko = with lib; { - root_device = mkOption { - type = types.path; - default = "/dev/nvme0n1"; - example = "/dev/nvme0n1"; - description = "Root device for disko and grub"; - }; - enable = mkOption { - type = types.bool; - default = !config.addons.virtualisation.isTestVM; - description = "Whenever to enable disko or not."; - }; - }; - - config = - let - cfg = config.host-config.disko; - in - lib.mkIf (cfg.enable) { - services.btrfs.autoScrub = { - enable = true; - interval = "weekly"; - }; - - disko.devices = { - disk = { - main-disk = { - device = cfg.root_device; - type = "disk"; - content = { - type = "gpt"; - partitions = { - ESP = { - type = "EF00"; - size = "512M"; - content = { - type = "filesystem"; - format = "vfat"; - mountpoint = "/boot"; - mountOptions = [ "umask=0077" ]; - }; - }; - root = { - size = "100%"; - content = { - type = "btrfs"; - extraArgs = [ "-f" ]; - subvolumes = { - # Subvolume name is different from mountpoint - "/rootfs" = { - mountOptions = [ "compress=zstd" ]; - mountpoint = "/"; - }; - # Subvolume name is the same as the mountpoint - "/home" = { - mountOptions = [ "compress=zstd" ]; - mountpoint = "/home"; - }; - # Parent is not mounted so the mountpoint must be set - "/nix" = { - mountOptions = [ - "compress=zstd" - "noatime" - ]; - mountpoint = "/nix"; - }; - # Subvolume for the swapfile - "/swap" = { - mountpoint = "/.swapvol"; - swap = { - swapfile.size = "8G"; - }; - }; - }; - }; - }; - }; - }; - }; - }; - }; - }; -} diff --git a/modules/default.nix b/modules/default.nix index 406d37c..26d6ec9 100644 --- a/modules/default.nix +++ b/modules/default.nix @@ -13,6 +13,7 @@ ./remote-builder.nix ./nh.nix ./motd.nix + ./locale.nix ]; nixpkgs.overlays = [ diff --git a/modules/locale.nix b/modules/locale.nix new file mode 100644 index 0000000..097ebc7 --- /dev/null +++ b/modules/locale.nix @@ -0,0 +1,24 @@ +{ ... }: +let + language_locale = "en_GB.UTF-8"; + actual_locale = "nl_NL.UTF-8"; + extraLocales = map (l: "${l}/UTF-8") ([ actual_locale ] ++ [ "pl_PL.UTF-8" ]); +in +{ + i18n = { + defaultLocale = language_locale; + extraLocales = extraLocales; + extraLocaleSettings = { + LC_CTYPE = language_locale; + LC_ADDRESS = actual_locale; + LC_MESSAGES = language_locale; + LC_MONETARY = actual_locale; + LC_NAME = actual_locale; + LC_NUMERIC = actual_locale; + LC_PAPER = actual_locale; + LC_TELEPHONE = actual_locale; + LC_TIME = actual_locale; + LC_COLLATE = actual_locale; + }; + }; +} diff --git a/services/email.nix b/services/email.nix index c698c5c..c05840d 100644 --- a/services/email.nix +++ b/services/email.nix @@ -235,13 +235,14 @@ in certificate = ( lib.mkIf (cfg.doACME) ( - lib.mapAttrs' (name: value: ( lib.nameValuePair ("nix_${(lib.replaceString "." "_" name)}") (value) )) ( - lib.genAttrs ([ cfg.domain ] ++ cfg.additionalDomains) (domain: { - cert = toStalwartCred "tls_${domain}_cert.pem"; - private-key = toStalwartCred "tls_${domain}_key.pem"; - default = (domain == cfg.domain); - }) - ) + lib.mapAttrs' (name: value: (lib.nameValuePair ("nix_${(lib.replaceString "." "_" name)}") (value))) + ( + lib.genAttrs ([ cfg.domain ] ++ cfg.additionalDomains) (domain: { + cert = toStalwartCred "tls_${domain}_cert.pem"; + private-key = toStalwartCred "tls_${domain}_key.pem"; + default = (domain == cfg.domain); + }) + ) ) ); }; diff --git a/services/gomuks.nix b/services/gomuks.nix new file mode 100644 index 0000000..be53daa --- /dev/null +++ b/services/gomuks.nix @@ -0,0 +1,67 @@ +{ + pkgs, + config, + lib, +}: +let + cfg = config.wilkuu.services.gomuks; + hostname = config.networking.hostName; +in +{ + options.wilkuu.serivces.gomuks = with lib; { + enable = mkEnableOption "Enable gomuks"; + # Hostname option is reused a lot, we might need to create a util for the options at this rate. + hostname = mkOption { + type = types.str; + default = "$matrix.{config.networking.hostName}.local"; + description = "Hostname on which gomuks should be hosted."; + }; + package = mkPackageOption pkgs "gomuks-web" { }; + dataDir = mkOption { + type = types.path; + default = "/srv/gomuks/"; + description = "Directory for where gomuks will store it's files."; + }; + + }; + config = lib.mkIf cfg.enable ( + let + yaml = pkgs.writers.writeYAML; + cfgDir = "${cfg.dataDir}/.config"; + configFile = yaml.generate "config.yaml" { + password_file = config.sops.secrets."gomuks/password".path; + }; + in + { + users.users.gomuks = { + isSystemUser = true; + group = "gomuks"; + }; + users.groups.gomuks = { }; + + sops.secrets."gomuks/password" = { + owner = "gomuks"; + sopsFile = ./secrets/${hostname}/gomuks.yaml; + }; + + systemd.services.gomuks = { + name = "gomuks"; + serviceConifg = { + User = "gomuks"; + ExecStart = "${cfg.package}"; + WorkingDirectory = "${cfg.dataDir}"; + Restart = "always"; + Environment = [ + "XDG_CONFIG_HOME=${cfgDir}" + ]; + }; + }; + + systemd.tmpfiles.rules = [ + "d ${cfgDir} 0700 ${cfg.user} ${cfg.user} -" + "L+ ${cfgDir}/config.yaml - - - - ${configFile}" + ]; + + } + ); +} |