From bb957032ffc5352229edbbdcdb56b9dba4408f37 Mon Sep 17 00:00:00 2001 From: Jakub Stachurski Date: Fri, 8 May 2026 23:23:19 +0200 Subject: Tacitus hosts and locale --- flake.nix | 4 +- home-modules/apps/nvim/default.nix | 44 ++++++++++-------- hosts/apocalypse/default.nix | 2 +- hosts/tacitus/default.nix | 53 ++++++++++++++++++++++ hosts/tacitus/disko.nix | 91 ++++++++++++++++++++++++++++++++++++++ hosts/tacitus/hardware.nix | 82 ++++++++++++++++++++++++++++++++++ hosts/tacitus/network.nix | 61 +++++++++++++++++++++++++ hosts/threshold/default.nix | 50 --------------------- hosts/threshold/disko.nix | 85 ----------------------------------- hosts/threshold/hardware.nix | 82 ---------------------------------- hosts/threshold/network.nix | 61 ------------------------- modules/default.nix | 1 + modules/locale.nix | 24 ++++++++++ services/email.nix | 15 ++++--- services/gomuks.nix | 67 ++++++++++++++++++++++++++++ 15 files changed, 415 insertions(+), 307 deletions(-) create mode 100644 hosts/tacitus/default.nix create mode 100644 hosts/tacitus/disko.nix create mode 100644 hosts/tacitus/hardware.nix create mode 100644 hosts/tacitus/network.nix delete mode 100644 hosts/threshold/default.nix delete mode 100644 hosts/threshold/disko.nix delete mode 100644 hosts/threshold/hardware.nix delete mode 100644 hosts/threshold/network.nix create mode 100644 modules/locale.nix create mode 100644 services/gomuks.nix diff --git a/flake.nix b/flake.nix index ecc793f..339a2d6 100644 --- a/flake.nix +++ b/flake.nix @@ -120,7 +120,7 @@ ]; }; - threshold = nixpkgs.lib.nixosSystem { + tacitus = nixpkgs.lib.nixosSystem { specialArgs = { inherit inputs; }; @@ -128,7 +128,7 @@ modules = [ ./modules ./users/wilkuu-server.nix - ./hosts/threshold + ./hosts/tacitus inputs.home-manager.nixosModules.default disko.nixosModules.disko inputs.sops-nix.nixosModules.sops diff --git a/home-modules/apps/nvim/default.nix b/home-modules/apps/nvim/default.nix index ae284bd..4dfbd17 100644 --- a/home-modules/apps/nvim/default.nix +++ b/home-modules/apps/nvim/default.nix @@ -15,41 +15,47 @@ in }; config = lib.mkIf config.homeapps.nvim.enable { + home.sessionVariables = { + TERM = "nvim"; + }; + programs.neovim = { - enable = true; + enable = false; defaultEditor = true; viAlias = true; vimAlias = true; vimdiffAlias = true; - withPython3 = true; - withNodeJs = true; - withRuby = true; + withPython3 = false; + withNodeJs = false; + withRuby = false; - coc.enable = false; - plugins = [ - ]; + # coc.enable = false; }; - home.file."./.config/nvim/lua/wilkuu/nix.lua".text = '' + home.file = lib.mkIf config.homeapps.nvim.lsp { + "./.config/nvim/lua/wilkuu/nix.lua".text = config.homeapps.nvim.lsp '' return { vue_ts_plugin = "${lib.getBin vue_ls}/lib/node_modules/@vue/language-server/node_modules/@vue/typescript-plugin/" } - ''; + '';}; home.sessionPath = [ "/home/wilkuu/.npm/bin/" ]; - home.packages = lib.mkIf config.homeapps.nvim.lsp ( + home.packages = with pkgs; - [ - lua - lua-language-server - ] - ++ [ - ts_ls - vue_ls - ] - ); + lib.mkMerge [ + (lib.mkIf config.homeapps.nvim.lsp ([ + lua + lua-language-server + ts_ls + vue_ls + ])) + [ + neovim + neovim-node-client + ] + ]; }; } diff --git a/hosts/apocalypse/default.nix b/hosts/apocalypse/default.nix index e82b048..179e2d1 100644 --- a/hosts/apocalypse/default.nix +++ b/hosts/apocalypse/default.nix @@ -23,7 +23,7 @@ addons = { desktop.hyprland.enable = false; desktop.xfce.enable = true; - desktop.cosmic.enable = false; + desktop.cosmic.enable = true; desktop.kde.enable = true; steam.enable = true; diff --git a/hosts/tacitus/default.nix b/hosts/tacitus/default.nix new file mode 100644 index 0000000..1efc539 --- /dev/null +++ b/hosts/tacitus/default.nix @@ -0,0 +1,53 @@ +{ + lib, + ... +}: +{ + imports = [ + ./network.nix + ./disko.nix + ./hardware.nix + ]; + addons = { + desktop.xfce.enable = lib.mkForce true; + gpg.enable = true; + virtualisation.host = true; + }; + + # Bootloader and boot setup. + boot.loader.efi.canTouchEfiVariables = lib.mkDefault true; + boot.loader.limine = { + efiSupport = true; + enable = true; + secureBoot = { + enable = true; + autoGenerateKeys = true; + autoEnrollKeys = { + extraArgs = [ + "--microsoft" + "--firmware-builtin" + ]; + }; + }; + }; + # Networking setup + networking.hostName = "tacitus"; + services.resolved = { + enable = true; + settings.Resolve.DNSOverTLS = "opportunistic"; + }; + + # SSH Access + services.openssh = { + enable = true; + ports = [ 22 ]; + openFirewall = true; + allowSFTP = true; + settings = { + PasswordAuthentication = false; + AllowUsers = [ "wilkuu" ]; + X11Forwarding = true; + PermitRootLogin = "no"; + }; + }; +} diff --git a/hosts/tacitus/disko.nix b/hosts/tacitus/disko.nix new file mode 100644 index 0000000..5e36661 --- /dev/null +++ b/hosts/tacitus/disko.nix @@ -0,0 +1,91 @@ +{ config, lib, ... }: +{ + options.host-config.disko = with lib; { + root_device = mkOption { + type = types.path; + default = "/dev/nvme0n1"; + example = "/dev/nvme0n1"; + description = "Root device for disko and grub"; + }; + enable = mkOption { + type = types.bool; + default = !config.addons.virtualisation.isTestVM; + description = "Whenever to enable disko or not."; + }; + }; + + config = + let + cfg = config.host-config.disko; + in + lib.mkIf (cfg.enable) { + services.btrfs.autoScrub = { + enable = true; + interval = "weekly"; + }; + + disko.devices = { + disk = { + main-disk = { + device = cfg.root_device; + type = "disk"; + content = { + type = "gpt"; + partitions = { + ESP = { + type = "EF00"; + size = "512M"; + content = { + type = "filesystem"; + format = "vfat"; + mountpoint = "/boot"; + mountOptions = [ "umask=0077" ]; + }; + }; + luks = { + size = "100%"; + content = { + type = "luks"; + name = "crypted"; + passwordFile = "/tmp/root-reserve-key.key"; + # Do not wait for recovery displaying and blocking formatting. + content = { + type = "btrfs"; + extraArgs = [ "-f" ]; + subvolumes = { + # Subvolume name is different from mountpoint + "/rootfs" = { + mountOptions = [ "compress=zstd" ]; + mountpoint = "/"; + }; + # Subvolume name is the same as the mountpoint + "/home" = { + mountOptions = [ "compress=zstd" ]; + mountpoint = "/home"; + }; + # Parent is not mounted so the mountpoint must be set + "/nix" = { + mountOptions = [ + "compress=zstd" + "noatime" + ]; + mountpoint = "/nix"; + }; + # Subvolume for the swapfile + "/swap" = { + mountpoint = "/.swapvol"; + swap = { + swapfile.size = "8G"; + }; + }; + }; + }; + }; + }; + }; + }; + }; + }; + }; + }; +} diff --git a/hosts/tacitus/hardware.nix b/hosts/tacitus/hardware.nix new file mode 100644 index 0000000..f0b2fe7 --- /dev/null +++ b/hosts/tacitus/hardware.nix @@ -0,0 +1,82 @@ +{ + config, + modulesPath, + lib, + ... +}: +{ + imports = [ + (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot.initrd.availableKernelModules = [ + "xhci_pci" + "ahci" + "nvme" + "usb_storage" + "usbhid" + "sd_mod" + ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-intel" ]; + boot.extraModulePackages = [ ]; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; + + ## Mountpoints: + + # Enable OpenGL + hardware.graphics = { + enable = true; + }; + + # Load nvidia driver for Xorg and Wayland + services.xserver.videoDrivers = [ "nvidia" ]; + + #NVIDIA Settings + hardware.nvidia = { + + # Modesetting is required. + modesetting.enable = true; + + # Nvidia power management. Experimental, and can cause sleep/suspend to fail. + # Enable this if you have graphical corruption issues or application crashes after waking + # up from sleep. This fixes it by saving the entire VRAM memory to /tmp/ instead + # of just the bare essentials. + powerManagement.enable = false; + + # Fine-grained power management. Turns off GPU when not in use. + # Experimental and only works on modern Nvidia GPUs (Turing or newer). + powerManagement.finegrained = false; + + # Use the NVidia open source kernel module (not to be confused with the + # independent third-party "nouveau" open source driver). + # Support is limited to the Turing and later architectures. Full list of + # supported GPUs is at: + # https://github.com/NVIDIA/open-gpu-kernel-modules#compatible-gpus + # Only available from driver 515.43.04+ + # Currently alpha-quality/buggy, so false is currently the recommended setting. + open = false; + + # Enable the Nvidia settings menu, + # accessible via `nvidia-settings`. + nvidiaSettings = true; + + # Optionally, you may need to select the appropriate driver version for your specific GPU. + package = config.boot.kernelPackages.nvidiaPackages.legacy_580; + + # prime = { + # offload = { + # enable = true; + # enableOffloadCmd = true; + # }; + # + # sync.enable = false; + + # intelBusId = "PCI:0:2:0"; + # nvidiaBusId = "PCI:1:0:0"; + # }; + }; + +} diff --git a/hosts/tacitus/network.nix b/hosts/tacitus/network.nix new file mode 100644 index 0000000..a4d0c03 --- /dev/null +++ b/hosts/tacitus/network.nix @@ -0,0 +1,61 @@ +{ ... }: +let + baseTCP = [ + 20 + 22 + 25 + 80 + 443 + ]; + baseUDP = [ + ]; + baseTCPRanges = [ ]; + baseUDPRanges = [ ]; +in +{ + systemd.network = { + enable = true; + networks."10-uplink" = { + matchConfig.Type = "ether"; + networkConfig = { + DHCP = "ipv4"; + IPv6AcceptRA = "yes"; + }; + linkConfig = { + RequiredForOnline = "yes"; + }; + ipv6AcceptRAConfig = { + UseDNS = "yes"; + UseDomains = "yes"; + }; + dns = [ + "192.168.88.1" + "1.1.1.1" + "2606:4700:4700:0000:0000:0000:0000:1002" + ]; + }; + }; + networking = { + useNetworkd = true; + nftables.enable = true; + useDHCP = true; + firewall = { + # check enable = true; + checkReversePath = false; + allowedTCPPorts = baseTCP; + allowedUDPPorts = baseUDP; + allowedUDPPortRanges = baseUDPRanges; + allowedTCPPortRanges = baseTCPRanges; + # TODO: Figure out how to do FW that allows only on the internal ip range + #interfaces = { + # "wg-home" = { + # allowedTCPPorts = secureTCP; + # allowedUDPPorts = secureUDP; + # allowedUDPPortRanges = secureUDPRanges; + # allowedTCPPortRanges = secureTCPRanges; + # }; + #}; + }; + }; + +} diff --git a/hosts/threshold/default.nix b/hosts/threshold/default.nix deleted file mode 100644 index 485997b..0000000 --- a/hosts/threshold/default.nix +++ /dev/null @@ -1,50 +0,0 @@ -{ - lib, - ... -}: -{ - - imports = [ - ./network.nix - ./disko.nix - ./hardware.nix - ]; - addons = { - desktop.xfce.enable = lib.mkForce true; - gpg.enable = true; - virtualisation.host = true; - }; - - # Bootloader and boot setup. - boot.loader.efi.canTouchEfiVariables = lib.mkDefault true; - - boot.loader.grub = { - enable = true; - useOSProber = false; - device = "nodev"; - efiSupport = true; - default = "saved"; - memtest86.enable = true; - }; - - # Networking setup - networking.hostName = "threshold"; - services.resolved = { - enable = true; - settings.Resolve.DNSOverTLS = "opportunistic"; - }; - - # SSH Access - services.openssh = { - enable = true; - ports = [ 22 ]; - openFirewall = true; - allowSFTP = true; - settings = { - PasswordAuthentication = false; - AllowUsers = [ "wilkuu" ]; - X11Forwarding = true; - PermitRootLogin = "no"; - }; - }; -} diff --git a/hosts/threshold/disko.nix b/hosts/threshold/disko.nix deleted file mode 100644 index ddbfa11..0000000 --- a/hosts/threshold/disko.nix +++ /dev/null @@ -1,85 +0,0 @@ -{ config, lib, ... }: -{ - options.host-config.disko = with lib; { - root_device = mkOption { - type = types.path; - default = "/dev/nvme0n1"; - example = "/dev/nvme0n1"; - description = "Root device for disko and grub"; - }; - enable = mkOption { - type = types.bool; - default = !config.addons.virtualisation.isTestVM; - description = "Whenever to enable disko or not."; - }; - }; - - config = - let - cfg = config.host-config.disko; - in - lib.mkIf (cfg.enable) { - services.btrfs.autoScrub = { - enable = true; - interval = "weekly"; - }; - - disko.devices = { - disk = { - main-disk = { - device = cfg.root_device; - type = "disk"; - content = { - type = "gpt"; - partitions = { - ESP = { - type = "EF00"; - size = "512M"; - content = { - type = "filesystem"; - format = "vfat"; - mountpoint = "/boot"; - mountOptions = [ "umask=0077" ]; - }; - }; - root = { - size = "100%"; - content = { - type = "btrfs"; - extraArgs = [ "-f" ]; - subvolumes = { - # Subvolume name is different from mountpoint - "/rootfs" = { - mountOptions = [ "compress=zstd" ]; - mountpoint = "/"; - }; - # Subvolume name is the same as the mountpoint - "/home" = { - mountOptions = [ "compress=zstd" ]; - mountpoint = "/home"; - }; - # Parent is not mounted so the mountpoint must be set - "/nix" = { - mountOptions = [ - "compress=zstd" - "noatime" - ]; - mountpoint = "/nix"; - }; - # Subvolume for the swapfile - "/swap" = { - mountpoint = "/.swapvol"; - swap = { - swapfile.size = "8G"; - }; - }; - }; - }; - }; - }; - }; - }; - }; - }; - }; -} diff --git a/hosts/threshold/hardware.nix b/hosts/threshold/hardware.nix deleted file mode 100644 index f0b2fe7..0000000 --- a/hosts/threshold/hardware.nix +++ /dev/null @@ -1,82 +0,0 @@ -{ - config, - modulesPath, - lib, - ... -}: -{ - imports = [ - (modulesPath + "/installer/scan/not-detected.nix") - ]; - - boot.initrd.availableKernelModules = [ - "xhci_pci" - "ahci" - "nvme" - "usb_storage" - "usbhid" - "sd_mod" - ]; - boot.initrd.kernelModules = [ ]; - boot.kernelModules = [ "kvm-intel" ]; - boot.extraModulePackages = [ ]; - - nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; - hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; - - ## Mountpoints: - - # Enable OpenGL - hardware.graphics = { - enable = true; - }; - - # Load nvidia driver for Xorg and Wayland - services.xserver.videoDrivers = [ "nvidia" ]; - - #NVIDIA Settings - hardware.nvidia = { - - # Modesetting is required. - modesetting.enable = true; - - # Nvidia power management. Experimental, and can cause sleep/suspend to fail. - # Enable this if you have graphical corruption issues or application crashes after waking - # up from sleep. This fixes it by saving the entire VRAM memory to /tmp/ instead - # of just the bare essentials. - powerManagement.enable = false; - - # Fine-grained power management. Turns off GPU when not in use. - # Experimental and only works on modern Nvidia GPUs (Turing or newer). - powerManagement.finegrained = false; - - # Use the NVidia open source kernel module (not to be confused with the - # independent third-party "nouveau" open source driver). - # Support is limited to the Turing and later architectures. Full list of - # supported GPUs is at: - # https://github.com/NVIDIA/open-gpu-kernel-modules#compatible-gpus - # Only available from driver 515.43.04+ - # Currently alpha-quality/buggy, so false is currently the recommended setting. - open = false; - - # Enable the Nvidia settings menu, - # accessible via `nvidia-settings`. - nvidiaSettings = true; - - # Optionally, you may need to select the appropriate driver version for your specific GPU. - package = config.boot.kernelPackages.nvidiaPackages.legacy_580; - - # prime = { - # offload = { - # enable = true; - # enableOffloadCmd = true; - # }; - # - # sync.enable = false; - - # intelBusId = "PCI:0:2:0"; - # nvidiaBusId = "PCI:1:0:0"; - # }; - }; - -} diff --git a/hosts/threshold/network.nix b/hosts/threshold/network.nix deleted file mode 100644 index a4d0c03..0000000 --- a/hosts/threshold/network.nix +++ /dev/null @@ -1,61 +0,0 @@ -{ ... }: -let - baseTCP = [ - 20 - 22 - 25 - 80 - 443 - ]; - baseUDP = [ - ]; - baseTCPRanges = [ ]; - baseUDPRanges = [ ]; -in -{ - systemd.network = { - enable = true; - networks."10-uplink" = { - matchConfig.Type = "ether"; - networkConfig = { - DHCP = "ipv4"; - IPv6AcceptRA = "yes"; - }; - linkConfig = { - RequiredForOnline = "yes"; - }; - ipv6AcceptRAConfig = { - UseDNS = "yes"; - UseDomains = "yes"; - }; - dns = [ - "192.168.88.1" - "1.1.1.1" - "2606:4700:4700:0000:0000:0000:0000:1002" - ]; - }; - }; - networking = { - useNetworkd = true; - nftables.enable = true; - useDHCP = true; - firewall = { - # check enable = true; - checkReversePath = false; - allowedTCPPorts = baseTCP; - allowedUDPPorts = baseUDP; - allowedUDPPortRanges = baseUDPRanges; - allowedTCPPortRanges = baseTCPRanges; - # TODO: Figure out how to do FW that allows only on the internal ip range - #interfaces = { - # "wg-home" = { - # allowedTCPPorts = secureTCP; - # allowedUDPPorts = secureUDP; - # allowedUDPPortRanges = secureUDPRanges; - # allowedTCPPortRanges = secureTCPRanges; - # }; - #}; - }; - }; - -} diff --git a/modules/default.nix b/modules/default.nix index 406d37c..26d6ec9 100644 --- a/modules/default.nix +++ b/modules/default.nix @@ -13,6 +13,7 @@ ./remote-builder.nix ./nh.nix ./motd.nix + ./locale.nix ]; nixpkgs.overlays = [ diff --git a/modules/locale.nix b/modules/locale.nix new file mode 100644 index 0000000..097ebc7 --- /dev/null +++ b/modules/locale.nix @@ -0,0 +1,24 @@ +{ ... }: +let + language_locale = "en_GB.UTF-8"; + actual_locale = "nl_NL.UTF-8"; + extraLocales = map (l: "${l}/UTF-8") ([ actual_locale ] ++ [ "pl_PL.UTF-8" ]); +in +{ + i18n = { + defaultLocale = language_locale; + extraLocales = extraLocales; + extraLocaleSettings = { + LC_CTYPE = language_locale; + LC_ADDRESS = actual_locale; + LC_MESSAGES = language_locale; + LC_MONETARY = actual_locale; + LC_NAME = actual_locale; + LC_NUMERIC = actual_locale; + LC_PAPER = actual_locale; + LC_TELEPHONE = actual_locale; + LC_TIME = actual_locale; + LC_COLLATE = actual_locale; + }; + }; +} diff --git a/services/email.nix b/services/email.nix index c698c5c..c05840d 100644 --- a/services/email.nix +++ b/services/email.nix @@ -235,13 +235,14 @@ in certificate = ( lib.mkIf (cfg.doACME) ( - lib.mapAttrs' (name: value: ( lib.nameValuePair ("nix_${(lib.replaceString "." "_" name)}") (value) )) ( - lib.genAttrs ([ cfg.domain ] ++ cfg.additionalDomains) (domain: { - cert = toStalwartCred "tls_${domain}_cert.pem"; - private-key = toStalwartCred "tls_${domain}_key.pem"; - default = (domain == cfg.domain); - }) - ) + lib.mapAttrs' (name: value: (lib.nameValuePair ("nix_${(lib.replaceString "." "_" name)}") (value))) + ( + lib.genAttrs ([ cfg.domain ] ++ cfg.additionalDomains) (domain: { + cert = toStalwartCred "tls_${domain}_cert.pem"; + private-key = toStalwartCred "tls_${domain}_key.pem"; + default = (domain == cfg.domain); + }) + ) ) ); }; diff --git a/services/gomuks.nix b/services/gomuks.nix new file mode 100644 index 0000000..be53daa --- /dev/null +++ b/services/gomuks.nix @@ -0,0 +1,67 @@ +{ + pkgs, + config, + lib, +}: +let + cfg = config.wilkuu.services.gomuks; + hostname = config.networking.hostName; +in +{ + options.wilkuu.serivces.gomuks = with lib; { + enable = mkEnableOption "Enable gomuks"; + # Hostname option is reused a lot, we might need to create a util for the options at this rate. + hostname = mkOption { + type = types.str; + default = "$matrix.{config.networking.hostName}.local"; + description = "Hostname on which gomuks should be hosted."; + }; + package = mkPackageOption pkgs "gomuks-web" { }; + dataDir = mkOption { + type = types.path; + default = "/srv/gomuks/"; + description = "Directory for where gomuks will store it's files."; + }; + + }; + config = lib.mkIf cfg.enable ( + let + yaml = pkgs.writers.writeYAML; + cfgDir = "${cfg.dataDir}/.config"; + configFile = yaml.generate "config.yaml" { + password_file = config.sops.secrets."gomuks/password".path; + }; + in + { + users.users.gomuks = { + isSystemUser = true; + group = "gomuks"; + }; + users.groups.gomuks = { }; + + sops.secrets."gomuks/password" = { + owner = "gomuks"; + sopsFile = ./secrets/${hostname}/gomuks.yaml; + }; + + systemd.services.gomuks = { + name = "gomuks"; + serviceConifg = { + User = "gomuks"; + ExecStart = "${cfg.package}"; + WorkingDirectory = "${cfg.dataDir}"; + Restart = "always"; + Environment = [ + "XDG_CONFIG_HOME=${cfgDir}" + ]; + }; + }; + + systemd.tmpfiles.rules = [ + "d ${cfgDir} 0700 ${cfg.user} ${cfg.user} -" + "L+ ${cfgDir}/config.yaml - - - - ${configFile}" + ]; + + } + ); +} -- cgit v1.3.1