aboutsummaryrefslogtreecommitdiff
path: root/hosts
diff options
context:
space:
mode:
Diffstat (limited to 'hosts')
-rw-r--r--hosts/sagittarius/default.nix57
-rw-r--r--hosts/sagittarius/hardware.nix31
-rw-r--r--hosts/sagittarius/home.nix23
-rw-r--r--hosts/sagittarius/ssh.nix10
-rw-r--r--hosts/sagittarius/web/acme.nix10
-rw-r--r--hosts/sagittarius/web/blog.nix14
-rw-r--r--hosts/sagittarius/web/default.nix8
-rw-r--r--hosts/sagittarius/web/git.nix8
-rw-r--r--hosts/sagittarius/web/matrix.nix115
-rw-r--r--hosts/sagittarius/web/mediadb.nix19
-rw-r--r--hosts/wonderland/default.nix149
-rw-r--r--hosts/wonderland/hardware.nix39
-rw-r--r--hosts/wonderland/home.nix136
-rw-r--r--hosts/wonderland/sops.nix23
14 files changed, 642 insertions, 0 deletions
diff --git a/hosts/sagittarius/default.nix b/hosts/sagittarius/default.nix
new file mode 100644
index 0000000..6bf1a22
--- /dev/null
+++ b/hosts/sagittarius/default.nix
@@ -0,0 +1,57 @@
+{ pkgs, ... }: {
+ imports = [
+ # Include the results of the hardware scan.
+ ./hardware.nix
+ ./home.nix
+ ./ssh.nix
+ ./web
+ ];
+
+ boot.loader.grub.device = "/dev/sda";
+ time.timeZone = "Europe/Helsinki";
+
+ networking = {
+ hostName = "sagittarius";
+ useNetworkd = true;
+ firewall.allowedTCPPorts = [ 22 ];
+ };
+ systemd.network = {
+ enable = true;
+ networks."10-wan" = {
+ matchConfig.Name = "enp1s0";
+ networkConfig.DHCP = "ipv4";
+ address = [ "2a01:4f9:c012:c7a7::/64" ];
+ routes = [{ routeConfig.Gateway = "fe80::1"; }];
+ };
+ };
+
+ # Select internationalisation properties.
+ i18n.defaultLocale = "en_US.UTF-8";
+
+ programs.gnupg.agent = {
+ enable = true;
+ enableSSHSupport = true;
+ };
+
+ users.users = {
+ ascella = {
+ isNormalUser = true;
+ extraGroups = [ "wheel" ];
+ openssh.authorizedKeys.keys = [
+ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKiDCf9LMx9diW5BveEju9w2Xv2kk7qKCyLESLyymzih ihp@ihp-laptop"
+ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHOsgD2+McS1+FFMKV9N620ta4DqHCYR1LqyoIR+AwU7 osiris@underworld"
+ ];
+ };
+ };
+
+ programs.zsh.enable = true;
+ users.defaultUserShell = pkgs.zsh;
+
+ # This value determines the NixOS release from which the default
+ # settings for stateful data, like file locations and database versions
+ # on your system were taken. It‘s perfectly fine and recommended to leave
+ # this value at the release version of the first install of this system.
+ # Before changing this value read the documentation for this option
+ # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+ system.stateVersion = "23.05"; # Did you read the comment?
+}
diff --git a/hosts/sagittarius/hardware.nix b/hosts/sagittarius/hardware.nix
new file mode 100644
index 0000000..783b081
--- /dev/null
+++ b/hosts/sagittarius/hardware.nix
@@ -0,0 +1,31 @@
+# Do not modify this file! It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations. Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+ imports =
+ [ (modulesPath + "/profiles/qemu-guest.nix")
+ ];
+
+ boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+ boot.initrd.kernelModules = [ ];
+ boot.kernelModules = [ ];
+ boot.extraModulePackages = [ ];
+
+ fileSystems."/" =
+ { device = "/dev/disk/by-uuid/34d333d4-2298-47c7-b015-5c3e2fd1a27e";
+ fsType = "ext4";
+ };
+
+ swapDevices = [ ];
+
+ # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+ # (the default) this is the recommended approach. When using systemd-networkd it's
+ # still possible to use this option, but it's recommended to use it in conjunction
+ # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+ networking.useDHCP = lib.mkDefault true;
+ # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+
+ nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}
diff --git a/hosts/sagittarius/home.nix b/hosts/sagittarius/home.nix
new file mode 100644
index 0000000..4c5999d
--- /dev/null
+++ b/hosts/sagittarius/home.nix
@@ -0,0 +1,23 @@
+{ home-manager, flakeRoot, ... }: {
+ home-manager.useGlobalPkgs = true;
+ home-manager.useUserPackages = true;
+ home-manager.sharedModules = [{ imports = [ (flakeRoot + /share/home) ]; }];
+
+ home-manager.users.ascella = {
+ programs.direnv = {
+ enable = true;
+ nix-direnv.enable = true;
+ };
+
+ home.stateVersion = "23.05";
+ };
+
+ home-manager.users.root = {
+ programs.direnv = {
+ enable = true;
+ nix-direnv.enable = true;
+ };
+
+ home.stateVersion = "23.05";
+ };
+}
diff --git a/hosts/sagittarius/ssh.nix b/hosts/sagittarius/ssh.nix
new file mode 100644
index 0000000..8c80a53
--- /dev/null
+++ b/hosts/sagittarius/ssh.nix
@@ -0,0 +1,10 @@
+{ ... }: {
+ services.openssh = {
+ enable = true;
+ settings = {
+ PermitRootLogin = "no";
+ PasswordAuthentication = false;
+ AllowUsers = [ "ascella" ];
+ };
+ };
+}
diff --git a/hosts/sagittarius/web/acme.nix b/hosts/sagittarius/web/acme.nix
new file mode 100644
index 0000000..4cde574
--- /dev/null
+++ b/hosts/sagittarius/web/acme.nix
@@ -0,0 +1,10 @@
+{ ... }: {
+ security.acme = {
+ acceptTerms = true;
+ defaults = {
+ email = "miran.bastaja04@gmail.com";
+ dnsProvider = "porkbun";
+ credentialsFile = "/var/secrets/porkbun.env";
+ };
+ };
+}
diff --git a/hosts/sagittarius/web/blog.nix b/hosts/sagittarius/web/blog.nix
new file mode 100644
index 0000000..1226bd7
--- /dev/null
+++ b/hosts/sagittarius/web/blog.nix
@@ -0,0 +1,14 @@
+{ ... }: {
+ imports = [ ./acme.nix ];
+ networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+ services.nginx = {
+ enable = true;
+
+ virtualHosts."sorre.xyz" = {
+ enableACME = true;
+ forceSSL = true;
+ root = "/var/www/blog";
+ };
+ };
+}
diff --git a/hosts/sagittarius/web/default.nix b/hosts/sagittarius/web/default.nix
new file mode 100644
index 0000000..3fc702e
--- /dev/null
+++ b/hosts/sagittarius/web/default.nix
@@ -0,0 +1,8 @@
+{ ... }: {
+ imports = [
+ ./blog.nix
+ ./matrix.nix
+ ./mediadb.nix
+ # ./git.nix
+ ];
+}
diff --git a/hosts/sagittarius/web/git.nix b/hosts/sagittarius/web/git.nix
new file mode 100644
index 0000000..732f7d0
--- /dev/null
+++ b/hosts/sagittarius/web/git.nix
@@ -0,0 +1,8 @@
+{ ... }: {
+ services.gitDaemon = {
+ enable = true;
+ repositories = [ "/srv/git/" ];
+ exportAll = true;
+ basePath = "/srv/git/";
+ };
+}
diff --git a/hosts/sagittarius/web/matrix.nix b/hosts/sagittarius/web/matrix.nix
new file mode 100644
index 0000000..fc32044
--- /dev/null
+++ b/hosts/sagittarius/web/matrix.nix
@@ -0,0 +1,115 @@
+{ pkgs, config, ... }:
+let
+ server_name = "sorre.xyz";
+ matrix_hostname = "matrix.${server_name}";
+ #admin_email = "gloss_unranked088@simplelogin.com";
+
+ # Build a dervation that stores the content of `${server_name}/.well-known/matrix/server`
+ well_known_server = pkgs.writeText "well-known-matrix-server" ''
+ {
+ "m.server": "${matrix_hostname}"
+ }
+ '';
+
+ # Build a dervation that stores the content of `${server_name}/.well-known/matrix/client`
+ well_known_client = pkgs.writeText "well-known-matrix-client" ''
+ {
+ "m.homeserver": {
+ "base_url": "https://${matrix_hostname}"
+ }
+ }
+ '';
+in
+{
+ imports = [ ./acme.nix ];
+
+ networking.firewall.allowedTCPPorts = [ 80 443 8448 ];
+ networking.firewall.allowedUDPPorts = [ 80 443 8448 ];
+
+ services.matrix-conduit = {
+ enable = true;
+ # Currently conduit seems to have no substituter for the flake, which means
+ # that the compilation would be done on the server, therefore we're using
+ # the (prebuilt) nixpkgs version of it for now.
+ #package = inputs.conduit.packages.${pkgs.system}.default;
+ package = pkgs.matrix-conduit;
+ settings.global.server_name = server_name;
+ settings.global.allow_registration = false;
+ };
+
+ services.nginx = {
+ enable = true;
+ recommendedProxySettings = true;
+
+ virtualHosts."${matrix_hostname}" = {
+ enableACME = true;
+ forceSSL = true;
+
+ listen = [
+ {
+ addr = "0.0.0.0";
+ port = 443;
+ ssl = true;
+ }
+ {
+ addr = "[::]";
+ port = 443;
+ ssl = true;
+ }
+ {
+ addr = "0.0.0.0";
+ port = 8448;
+ ssl = true;
+ }
+ {
+ addr = "[::]";
+ port = 8448;
+ ssl = true;
+ }
+ ];
+ locations."/_matrix/" = {
+ proxyPass = "http://backend_conduit$request_uri";
+ proxyWebsockets = true;
+ extraConfig = ''
+ proxy_set_header Host $host;
+ proxy_buffering off;
+ '';
+ };
+ extraConfig = ''
+ merge_slashes off;
+ '';
+ };
+
+ virtualHosts."${server_name}" = {
+ enableACME = true;
+ forceSSL = true;
+
+ locations = {
+ "=/.well-known/matrix/server" = {
+ alias = "${well_known_server}";
+ extraConfig = ''
+ # Set the header since by default NGINX thinks it's just bytes
+ default_type application/json;
+ '';
+ };
+ "=/.well-known/matrix/client" = {
+ # Use the contents of the derivation built previously
+ alias = "${well_known_client}";
+
+ extraConfig = ''
+ # Set the header since by default NGINX thinks it's just bytes
+ default_type application/json;
+
+ # https://matrix.org/docs/spec/client_server/r0.4.0#web-browser-clients
+ add_header Access-Control-Allow-Origin "*";
+ '';
+ };
+ };
+ };
+
+ upstreams."backend_conduit".servers = {
+ "[::1]:${toString config.services.matrix-conduit.settings.global.port}" =
+ { };
+ };
+ };
+}
diff --git a/hosts/sagittarius/web/mediadb.nix b/hosts/sagittarius/web/mediadb.nix
new file mode 100644
index 0000000..78d76cd
--- /dev/null
+++ b/hosts/sagittarius/web/mediadb.nix
@@ -0,0 +1,19 @@
+{ pkgs, ... }: {
+ networking.firewall.allowedTCPPorts = [ 5432 ];
+
+ services.postgresql = {
+ enable = true;
+ package = pkgs.postgresql_15_jit;
+ enableTCPIP = true;
+ enableJIT = true;
+
+ settings = { password_encryption = "scram-sha-256"; };
+
+ authentication = ''
+ # TYPE DATABASE USER ADDRESS METHOD
+ local all postgres peer
+ host all postgres all reject
+ host all all all scram-sha-256
+ '';
+ }; # end of services.postgreslq
+}
diff --git a/hosts/wonderland/default.nix b/hosts/wonderland/default.nix
new file mode 100644
index 0000000..b78eb4e
--- /dev/null
+++ b/hosts/wonderland/default.nix
@@ -0,0 +1,149 @@
+{ config, pkgs, flakeRoot, ... }: {
+ imports = [
+ # Include the results of the hardware scan.
+ ./hardware.nix
+ ./home.nix
+ ./sops.nix
+ (flakeRoot + /share/system/steam.nix)
+ (flakeRoot + /share/system/hyprland.nix)
+ #(flakeRoot + /share/system/spotifyd.nix)
+ ];
+
+ nixpkgs.config.allowUnfree = true;
+ nix.gc = {
+ dates = "weekly";
+ automatic = true;
+ persistent = true;
+ randomizedDelaySec = "15min";
+ };
+
+ # Use the systemd-boot EFI boot loader.
+ boot = {
+ loader.systemd-boot.enable = true;
+ loader.efi.canTouchEfiVariables = true;
+ initrd.kernelModules = [ "amdgpu" ];
+ };
+
+ networking = {
+ hostName = "wonderland";
+ useNetworkd = true;
+
+ nftables.enable = true;
+ firewall = {
+ enable = true;
+ allowedTCPPorts = [ 80 443 34197 ];
+ };
+
+ wireless = {
+ enable = true;
+ environmentFile = config.sops.secrets."wireless.env".path;
+ userControlled.enable = true;
+ networks = {
+ "@HOME_WIFI_SSID@".psk = "@HOME_WIFI_PSK@";
+ "@PHONE_HOTSPOT_SSID@" = {
+ psk = "@PHONE_HOTSPOT_PSK@";
+ hidden = true;
+ };
+ "eduroam" = {
+ authProtocols = [ "WPA-EAP" ];
+ auth = ''
+ pairwise=CCMP TKIP
+ eap=TTLS PEAP TLS
+ group=CCMP TKIP
+ identity="mbastaja@tvz.hr"
+ altsubject_match="DNS:freeradius.tvz.hr"
+ phase1="peaplabel=0"
+ phase2="auth=PAP"
+ password="@EDUROAM_PASS@"
+ anonymous_identity="anonymous@tvz.hr"
+ '';
+ };
+ };
+ };
+ };
+
+ # Set your time zone.
+ time.timeZone = "Europe/Zagreb";
+
+ # Select internationalisation properties.
+ i18n.defaultLocale = "en_US.UTF-8";
+
+ services.xserver = {
+ enable = true;
+ displayManager = {
+ sddm.enable = true;
+ defaultSession = "plasmawayland";
+ };
+ desktopManager.plasma5.enable = true;
+ videoDrivers = [ "amdgpu" ];
+ };
+
+ # Enable sound.
+ sound.enable = true;
+ services.pipewire = {
+ enable = true;
+ alsa.enable = true;
+ pulse.enable = true;
+ };
+
+ services.printing = {
+ enable = true;
+ drivers = with pkgs; [
+ gutenprint
+ gutenprintBin
+ epson_201207w
+ epson-201401w
+ ];
+ };
+
+ programs.gnupg.agent = {
+ enable = true;
+ enableSSHSupport = true;
+ };
+
+ hardware.bluetooth.enable = true;
+ services.mullvad-vpn.enable = true;
+
+ virtualisation.podman = {
+ enable = true;
+ dockerSocket.enable = true;
+ dockerCompat = true;
+ autoPrune.enable = true;
+ };
+
+ users.users = {
+ alice = {
+ isNormalUser = true;
+ extraGroups = [ "wheel" "video" "network" "podman" ];
+ };
+ madhatter = {
+ isNormalUser = true;
+ extraGroups = [ "video" "network" ];
+ };
+ guest = {
+ isNormalUser = true;
+ extraGroups = [ "video" "network" ];
+ };
+ };
+
+ programs.zsh.enable = true;
+ users.defaultUserShell = pkgs.zsh;
+
+ fonts.packages = with pkgs; [
+ noto-fonts
+ noto-fonts-cjk
+ noto-fonts-emoji
+ proggyfonts
+ (nerdfonts.override { fonts = [ "FiraCode" ]; })
+ overpass
+ inter
+ ];
+
+ # This value determines the NixOS release from which the default
+ # settings for stateful data, like file locations and database versions
+ # on your system were taken. It‘s perfectly fine and recommended to leave
+ # this value at the release version of the first install of this system.
+ # Before changing this value read the documentation for this option
+ # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+ system.stateVersion = "22.05"; # Did you read the comment?
+}
diff --git a/hosts/wonderland/hardware.nix b/hosts/wonderland/hardware.nix
new file mode 100644
index 0000000..a99d2a3
--- /dev/null
+++ b/hosts/wonderland/hardware.nix
@@ -0,0 +1,39 @@
+# Do not modify this file! It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations. Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+ imports =
+ [ (modulesPath + "/installer/scan/not-detected.nix")
+ ];
+
+ boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "sd_mod" ];
+ boot.initrd.kernelModules = [ ];
+ boot.kernelModules = [ "kvm-amd" ];
+ boot.extraModulePackages = [ ];
+
+ fileSystems."/" =
+ { device = "/dev/disk/by-uuid/fc1a2a05-efb0-45e7-83f2-2b9dae515b0a";
+ fsType = "ext4";
+ };
+
+ fileSystems."/boot" =
+ { device = "/dev/disk/by-uuid/FEB7-A352";
+ fsType = "vfat";
+ };
+
+ swapDevices =
+ [ { device = "/dev/disk/by-uuid/f16d9af0-4043-4d39-a8d6-e788451f8e9e"; }
+ ];
+
+ # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+ # (the default) this is the recommended approach. When using systemd-networkd it's
+ # still possible to use this option, but it's recommended to use it in conjunction
+ # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+ networking.useDHCP = lib.mkDefault true;
+ # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+ # networking.interfaces.wlp2s0.useDHCP = lib.mkDefault true;
+
+ hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}
diff --git a/hosts/wonderland/home.nix b/hosts/wonderland/home.nix
new file mode 100644
index 0000000..c29420b
--- /dev/null
+++ b/hosts/wonderland/home.nix
@@ -0,0 +1,136 @@
+{ pkgs
+, flakeRoot
+, ...
+}:
+let
+ desktop-pkgs = with pkgs; [
+ mullvad-vpn
+ bitwarden
+ calibre
+ beekeeper-studio
+ thunderbird
+ brightnessctl
+
+ libsForQt5.plasma-browser-integration
+ libsForQt5.kdeconnect-kde
+ libsForQt5.ark
+ libsForQt5.kate
+ haruna # Video player
+ libreoffice-qt
+ gimp
+ audacity
+ discord
+ whatsapp-for-linux
+ inkscape
+
+ wineWowPackages.full
+ winetricks
+ ];
+in
+{
+ home-manager.useGlobalPkgs = true;
+ home-manager.useUserPackages = true;
+ home-manager.sharedModules = [{ imports = [ (flakeRoot + /share/home) ]; }];
+
+ home-manager.users.alice = {
+ imports =
+ let
+ home = flakeRoot + /share/home;
+ in
+ [
+ # Custom home manager modules
+ (flakeRoot + /share/hm-modules/wpaperd.nix)
+
+ # Config
+ (home + /kitty.nix)
+ (home + /hyprland.nix)
+ (home + /git.nix)
+ (home + /firefox)
+ (home + /wezterm)
+ ];
+ home.packages = with pkgs;
+ [
+ signal-desktop
+ tdesktop # Telegram desktop
+ qbittorrent
+ okteta
+ emacs
+ # spotify-qt librespot
+ nheko # matrix client
+
+ # Various utils
+ # qemu_kvm
+ pijul # alternative vsc system
+ tokei # counts lines of code
+ dua # modern du with interactive mode (dua i)
+ btop # modern top
+
+ # Gaming
+ libsForQt5.kpat # solitare
+ jdk17_headless
+ superTuxKart
+
+ linux-wifi-hotspot
+ qemu_kvm
+ ]
+ ++ desktop-pkgs;
+
+ home.stateVersion = "22.05";
+
+ programs.gallery-dl = {
+ enable = true;
+ settings.extractor = {
+ base-directory = "$XDG_DOWNLOAD_DIR/gallery-dl";
+
+ postprocessors = [
+ {
+ name = "metadata";
+ mode = "json";
+ whitelist = [
+ "danbooru"
+ "moebooru"
+ "gelbooru"
+ "sankaku"
+ "nhentai"
+ "rule34"
+ ];
+ }
+ {
+ name = "zip";
+ compression = "store";
+ extension = "cbz";
+ filter = "extension not in ('zip', 'rar')";
+ whitelist = [ "nhentai" "mangadex" ];
+ }
+ ];
+
+ Danbooru.metadata = true;
+ }; # End of settings.extractor
+ }; # End of programs.gallery-dl
+ }; # End of users.alice
+
+ home-manager.users.madhatter = {
+ home.packages = desktop-pkgs;
+ imports =
+ let
+ home = flakeRoot + /share/home;
+ in
+ [
+ # Config
+ (home + /kitty.nix)
+ (home + /git.nix)
+ (home + /firefox)
+ ];
+
+ home.stateVersion = "23.05";
+ };
+
+ home-manager.users.root = {
+ home.packages = with pkgs; [
+ linux-wifi-hotspot
+ dua # modern du with interactive mode (dua i)
+ ];
+
+ home.stateVersion = "22.05";
+ };
+}
diff --git a/hosts/wonderland/sops.nix b/hosts/wonderland/sops.nix
new file mode 100644
index 0000000..0ac9d3d
--- /dev/null
+++ b/hosts/wonderland/sops.nix
@@ -0,0 +1,23 @@
+{ ... }: {
+ sops = {
+ age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+ defaultSopsFile = ../../secrets/credentials.json;
+ secrets = {
+ # FIXME: using mode 444 here is a hack so that spotifyd can cat the
+ # values out, but it obviously exposes the secrets to anyone that knows
+ # they are there. A better solution would be to override the spotifyd
+ # module to make the systemd service run the program with a group, and
+ # then give read priviledges to only that group.
+ # "spotify/password" = {
+ # mode = "444";
+ # };
+ # "spotify/username" = {
+ # mode = "444";
+ # };
+ "wireless.env" = {
+ sopsFile = ../../secrets/wireless.env;
+ format = "dotenv";
+ };
+ };
+ }; # end of sops
+}
generated by cgit v1.3.1 (git 2.54.0) at 2026-10-27 12:06:39 +0000