c2vi/dotfiles
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

....

Browse Source
This commit is contained in:
Sebastian Moser
2025-03-03 12:59:53 +01:00
parent 7204592732
commit 6a546d9f86
19 changed files with 696 additions and 116 deletions
Download Patch File Download Diff File Expand all files Collapse all files

223
hosts/fusu.nix
View File

@@ -1,5 +1,5 @@
{ inputs, pkgs, ... }:
{ inputs, pkgs, secretsDir, ... }:
{
imports = [
../common/all.nix
@@ -30,6 +30,8 @@
#];
boot.supportedFilesystems = [ "zfs" ];
boot.zfs.package = pkgs.zfs_unstable;
boot.zfs.forceImportRoot = false;
@@ -89,6 +91,21 @@
8080 # for mitm proxy
5901 # vnc
5357 # wsdd
8080 # for mitm proxy
49388
49389
49390
49391
49392
49393
];
networking.firewall.allowedUDPPorts = [
3702 # wsdd
67 # allow DHCP traffic
53 # allow dns
];
networking.networkmanager.enable = false; # Easiest to use and most distros use this by default.
@@ -101,6 +118,11 @@
environment.systemPackages = with pkgs; [
ntfs3g
virtiofsd
bcache-tools
su
fuse3
terraform
usbutils
];
nix.settings = {
@@ -131,4 +153,203 @@
nameservers = [ "1.1.1.1" "8.8.8.8" ];
};
############################ update ip service
systemd.services.update-ip =
let
update-ip = pkgs.writeShellApplication {
name = "update-ip";
runtimeInputs = with pkgs; [ curl w3m ];
text = ''
ip=$(curl my.ip.fi)
curl "http://dynv6.com/api/update?hostname=${builtins.readFile "${secretsDir}/dns-name-two"}&ipv4=$ip&token=${builtins.readFile "${secretsDir}/dns-name-two-token"}"
curl "https://dynamicdns.park-your-domain.com/update?host=home&domain=${builtins.readFile "${secretsDir}/dns-name"}&password=${builtins.readFile "${secretsDir}/dns-name-token"}&ip=$ip"
# https://www.namecheap.com/support/knowledgebase/article.aspx/29/11/how-to-dynamically-update-the-hosts-ip-with-an-https-request/
'';
};
#curl "https://dynamicdns.park-your-domain.com/update?host=mc&domain=c2vi.dev&password=${builtins.readFile "${secretsDir}/dns-name-token"}&ip=$ip"
in
{
enable = true;
description = "dyndns ip updates";
unitConfig = {
Type = "simple";
};
serviceConfig = {
Restart = "always";
RestartSec = "500s";
ExecStart = "${update-ip}/bin/update-ip";
};
wantedBy = [ "multi-user.target" ];
};
###################################### get oci ampere vm ####################################
systemd.services.oci-ampere =
let
oci-ampere = pkgs.writeShellApplication {
name = "oci-ampere";
runtimeInputs = with pkgs; [ terraform ];
text = ''
if [[ -f /home/me/here/oci-ampere-vm/not_gotten ]]
then
echo not gotten....................................
pwd
cd /home/me/here/oci-ampere-vm
terraform apply -auto-approve && rm /home/me/here/oci-ampere-vm/not_gotten
else
echo gotten!!!!!!!!!!!!!!!!!!!!!
fi
'';
};
in
{
enable = false;
description = "get a oci ampere vm";
unitConfig = {
Type = "simple";
};
serviceConfig = {
Restart = "always";
RestartSec = "500s";
ExecStart = "${oci-ampere}/bin/oci-ampere";
};
wantedBy = [ "multi-user.target" ];
};
################################ samba ######################################
services.samba-wsdd.enable = true; # make shares visible for windows 10 clients
# needed see: [[samba problems]] in my obsidian vault
users.users.files.group = "files";
users.groups.files = {};
services.samba = {
enable = true;
securityType = "user";
extraConfig = ''
server role = standalone server
map to guest = bad user
usershare allow guests = yes
hosts allow = 192.168.0.0/16
hosts deny = 0.0.0.0
workgroup = WORKGROUP
security = user
'';
shares = {
files = {
"valid users" = "files";
"comment" = "all my files";
"path" = "/home/files/storage/files";
"browsable" = "no";
"read only" = "no";
"guest ok" = "no";
"force user" = "files";
"force group" = "files";
"force create mode" = "0777";
# Papierkorb
"vfs object" = "recycle";
"recycle:repository" = "/home/files/storage/files/trash-files";
"recycle:keeptree" = "Yes";
"recycle:versions" = "Yes";
"recycle:touch" = "Yes";
"recycle:touch_mtime" = "Yes";
"recycle:maxsize" = "80000";
};
lan = {
"comment" = "gastordner";
"path" = "/home/files/storage/lan";
"read only" = "no";
"guest ok" = "yes";
"force user" = "files";
"force group" = "files";
"force create mode" = "0777";
# Papierkorb
"vfs object" = "recycle";
"recycle:repository" = "/home/files/storage/files/trash-lan";
"recycle:keeptree" = "No";
"recycle:versions" = "Yes";
"recycle:touch" = "Yes";
"recycle:touch_mtime" = "Yes";
"recycle:maxsize" = "8000";
};
mama = {
"comment" = "Meine Dateien auf Mamas Laptop";
"path" = "/home/files/storage/files/stuff/Mamas-Laptop";
"browsable" = "no";
"read only" = "no";
"guest ok" = "no";
"valid users" = "mamafiles";
"force user" = "files";
"force group" = "files";
"force create mode" = "0777";
};
};
};
############################## backup to onedrive ##################################
# needs that
programs.fuse.userAllowOther = true; # otherwise the root user has no acces to the mount
systemd.services.rclone-mount-backup = {
enable = false;
description = "Mount rclone backup folder";
unitConfig = {
Type = "simple";
};
serviceConfig = {
ExecStart = "${pkgs.bash}/bin/bash -c 'export PATH=/run/wrappers/bin:$PATH; id; ${pkgs.rclone}/bin/rclone mount --allow-non-empty --allow-other --vfs-cache-max-size 2G --vfs-cache-mode full backup: /home/files/backup'";
User = "files";
Group = "files";
};
wantedBy = [ "multi-user.target" ];
};
services.borgbackup.jobs.files = {
#user = "files";
extraCreateArgs = "--verbose --list --filter=AMECbchfs --stats --checkpoint-interval 600";
extraArgs = "--progress";
paths = "/home/files/storage";
doInit = false;
repo = "/home/files/backup/dateien-backup-borg-repo";
compression = "lzma,9";
startAt = "weekly";
user = "files";
group = "files";
postCreate = ''
echo create done!!!!!
'';
extraPruneArgs = "--stats --list --save-space";
patterns = [
"- /home/files/storage/files/no-backup"
];
encryption.mode = "repokey-blake2";
encryption.passCommand = "cat /home/files/secrets/borg-passphrase";
environment.BORG_KEY_FILE = "/home/files/secrets/borg-key";
prune.keep = {
#within = "1w"; # Keep all archives from the last day
daily = 7;
weekly = 7;
monthly = -1; # Keep at least one archive for each month
};
};
}

26
hosts/lush.nix
View File

@@ -145,6 +145,7 @@
uuid = "e0103dac-7da0-4e32-a01b-487b8c4c813c";
type = "wifi";
interface-name = "wlan0";
autoconnect = true;
};
wifi = {
@@ -164,6 +165,31 @@
};
};
hh40 = {
connection = {
id = "hh40";
uuid = "73a61cef-8f7b-4f42-ab3f-0066e0295bbc";
type = "wifi";
interface-name = "wlan0";
autoconnect = true;
};
wifi = {
hidden = "false";
mode = "infrastructure";
ssid = builtins.readFile "${secretsDir}/home-wifi-ssid";
};
wifi-security = {
key-mgmt = "wpa-psk";
psk = builtins.readFile "${secretsDir}/home-wifi-password";
};
ipv4 = {
method = "auto";
};
};
share = {
connection = {
id = "share";

50
hosts/main.nix
View File

@@ -38,6 +38,9 @@
virtualisation.vmVariant.services.timesyncd.enable = lib.mkForce false;
virtualisation.waydroid.enable = true;
services.nscd.enable = lib.mkForce false;
virtualisation.docker.enable = true;
@@ -55,6 +58,10 @@
programs.nix-ld.enable = true;
programs.steam.enable = true;
# disable touch clicks because i always tap while typing
#services.xserver.libinput.touchpad.tappingButtonMap = null;
services.xserver.libinput.touchpad.tapping = false;
@@ -76,10 +83,20 @@
# see: https://github.com/NixOS/nixpkgs/issues/300081
#"${inputs.nixpkgs-unstable}/nixos/modules/virtualisation/incus.nix"
#../scripts/yt-block/module.nix
# add waveforms flake module
#inputs.waveforms.nixosModule
];
services.udev.packages = [ inputs.waveforms.packages.${system}.adept2-runtime ];
environment.systemPackages = with pkgs; [
inputs.waveforms.packages.${system}.waveforms
# add pyclip for waydroid
python310Packages.pyclip
grim # screenshot functionality
slurp # screenshot functionality
wl-clipboard # wl-copy and wl-paste for copy/paste from stdin / stdout
@@ -91,6 +108,14 @@
];
})
# waveforms
# my keyboar flash script, that opens as an alacritty window
(pkgs.writeShellScriptBin "keyboard-flash" "alacritty --command ${pkgs.writeShellScriptBin "keyboard-flash-internal" "${./..}/scripts/keyboard-flash; bash"}/bin/keyboard-flash-internal")
# my keyboar flash script, that opens as an alacritty window
(pkgs.writeShellScriptBin "keyboard-flash-left" "alacritty --command ${pkgs.writeShellScriptBin "keyboard-flash-internal" "${./..}/scripts/keyboard-flash left; bash"}/bin/keyboard-flash-internal")
slint-lsp
cifs-utils
nfs-utils
@@ -104,7 +129,9 @@
# shedule nix builds with low priority, so the laptop is still usable while building something
nix.daemonCPUSchedPolicy = "idle";
nix.daemonIONiceLevel = 7;
systemd.services.nix-daemon.serviceConfig.Nice = 9;
systemd.services.nix-daemon.serviceConfig.Nice = 9;
# enable ntp
#services.ntp.enable = true;
@@ -513,14 +540,22 @@
virtualisation.incus.enable = true;
systemd.services.incus.path = [ pkgs.swtpm ];
#virtualisation.incus.package = inputs.nixpkgs-unstable.legacyPackages.x86_64-linux.incus;
users.users.me.extraGroups = [ "incus-admin" ];
# add myself to plugdev group for waveforms
# and incus-admin to use incus without sudo
users.users.me.extraGroups = [ "incus-admin" "plugdev" ];
virtualisation.podman.enable = true;
virtualisation.kvmgt.enable = true;
boot.extraModprobeConfig = "options i915 enable_guc=2";
boot.kernelParams = [ "intel_iommu=on" "pcie_aspm=force" ];
boot.resumeDevice = "/dev/disk/by-uuid/20002ed7-1431-4992-90f6-730bdc6eef2c";
boot.kernelParams = [
"resume_offset=45743809"
"intel_iommu=on"
"pcie_aspm=force"
];
virtualisation.kvmgt.vgpus = {
"i915-GVTg_V5_8" = {
@@ -544,17 +579,18 @@
############################## swap and hibernate ###################################
swapDevices = [ { device = "/swapfile"; } ];
boot.resumeDevice = "/swapfile";
# boot.resumeDevice = "/swapfile";
services.logind = {
extraConfig = ''
HandlePowerKey=suspend-then-hibernate
'';
lidSwitch = "suspend-then-hibernate";
lidSwitchExternalPower = "suspend-then-hibernate";
lidSwitch = "lock";
lidSwitchExternalPower = "lock";
lidSwitchDocked = "ignore";
};
systemd.sleep.extraConfig = ''
HibernateDelaySec=27h
HibernateDelaySec=4h
HibernateMode=shutdown
'';
}