c2vi/dotfiles
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

...

Browse Source
This commit is contained in:
Sebastian Moser
2025-03-27 11:17:34 +01:00
parent ff78b4ecb3
commit dfaa2b6248
23 changed files with 380 additions and 85 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
hosts/acern.nix
View File

@@ -1,8 +1,8 @@
{ pkgs, inputs, secretsDir, ...}:
{
imports = [
inputs.nix-wsl.nixosModules.wsl
../users/me/headless.nix
../common/wsl.nix
inputs.networkmanager.nixosModules.networkmanager
inputs.home-manager.nixosModules.home-manager
@@ -10,19 +10,6 @@
../common/nixos-headless.nix
];
wsl.enable = true;
services.openssh = {
enable = true;
ports = [ 2222 ];
settings.PasswordAuthentication = false;
settings.KbdInteractiveAuthentication = false;
settings.X11Forwarding = true;
extraConfig = ''
X11UseLocalhost no
'';
};
programs.bash.loginShellInit = "";

47
hosts/fusu.nix
View File

@@ -1,7 +1,10 @@
{ inputs, pkgs, secretsDir, ... }:
{
#disabledModules = [ "services/databases/couchdb.nix" ];
imports = [
#"${inputs.nixpkgs-unstable}/nixos/modules/services/databases/couchdb.nix"
../common/all.nix
../common/nixos.nix
../common/building.nix
@@ -10,6 +13,7 @@
../users/me/headless.nix
../users/root/default.nix
../users/files/headless.nix
../users/server/headless.nix
];
# mac address for wakeonlan: 00:19:99:fd:28:23
@@ -29,8 +33,17 @@
#}
#];
services.tailscale.enable = true;
services.resilio = {
# TODO: add the config for the share to here
enable = true;
enableWebUI = true;
httpListenAddr = "100.70.54.18";
};
boot.supportedFilesystems = [ "zfs" ];
boot.zfs.package = pkgs.zfs_unstable;
@@ -83,6 +96,12 @@
networking.firewall.allowPing = true;
networking.firewall.enable = true;
networking.firewall.interfaces."tailscale0".allowedTCPPorts = [
443 # couchdb for obsidian live sync https
44444 # resilio sync
9000 # resilio webui
];
services.samba.openFirewall = true;
networking.firewall.allowedTCPPorts = [
@@ -154,6 +173,14 @@
};
############################ couchdb for Obsidian Live sync
#services.couchdb.enable = true;
#services.couchdb.extraConfigFiles = [ "/home/files/storage/files/stuff/obsidian-live-sync/local.ini" ];
#services.couchdb.databaseDir = "/home/files/storage/files/stuff/obsidian-live-sync/data";
############################ update ip service
systemd.services.update-ip =
@@ -240,16 +267,16 @@
services.samba = {
enable = true;
securityType = "user";
extraConfig = ''
server role = standalone server
map to guest = bad user
usershare allow guests = yes
hosts allow = 192.168.0.0/16
hosts deny = 0.0.0.0
workgroup = WORKGROUP
security = user
'';
shares = {
settings = {
global = {
"server role" = "standalone server";
"map to guest" = "bad user";
"usershare allow guests" = "yes";
# "hosts allow" = "192.168.1 127.0.0.1 localhost";
# "hosts deny" = "0.0.0.0/0";
"workgroup" = "WORKGROUP";
"security" = "user";
};
files = {
"valid users" = "files";
"comment" = "all my files";

25
hosts/lush.nix
View File

@@ -146,6 +146,7 @@
type = "wifi";
interface-name = "wlan0";
autoconnect = true;
autoconnect-priority = "-200";
};
wifi = {
@@ -172,6 +173,7 @@
type = "wifi";
interface-name = "wlan0";
autoconnect = true;
autoconnect-priority = "-999";
};
wifi = {
@@ -185,6 +187,25 @@
psk = builtins.readFile "${secretsDir}/home-wifi-password";
};
ipv4 = {
method = "auto";
address1 = "192.168.1.37/24";
};
};
dhcp = {
connection = {
id = "dhcp";
uuid = "c006389a-1697-4f77-91c3-95b466f85f13";
type = "ethernet";
autoconnect = "false";
interface-name = "end0";
};
ethernet = {
mac-address = "DC:A6:32:CB:4D:5E";
};
ipv4 = {
method = "auto";
};
@@ -196,11 +217,11 @@
uuid = "f55f34e3-4595-4642-b1f6-df3185bc0a04";
type = "ethernet";
autoconnect = false;
interface-name = "eth0";
interface-name = "end0";
};
ethernet = {
mac-address = "F4:39:09:4A:DF:0E";
mac-address = "DC:A6:32:CB:4D:5E";
};
ipv4 = {

2
hosts/mac.nix
View File

@@ -119,7 +119,7 @@ in {
restartIfChanged = false;
serviceConfig = {
ExecStart = "${pkgs.cage}/bin/cage -d -- ${myobs}/bin/obs";
ExecStart = "${pkgs.cage}/bin/cage -d -- ${pkgs.moonlight-qt}/bin/moonlight";
User = "root";
# ConditionPathExists = "/dev/tty0";

113
hosts/main.nix
View File

@@ -35,8 +35,44 @@
#services.openssh.enable = true;
services.sunshine = {
package = pkgs.sunshine.overrideAttrs {
src = pkgs.fetchFromGitHub {
owner = "garnacho";
repo = "Sunshine";
rev = "xdg-portal";
hash = "sha256-To1vhNQxjIa5Hc+z2xo+ODSQyIH6cnI3A7Ofc7MDL60=";
};
};
enable = true;
autoStart = true;
capSysAdmin = true;
openFirewall = true;
};
virtualisation.vmVariant.services.timesyncd.enable = lib.mkForce false;
services.tailscale.enable = true;
services.resilio = {
enable = true;
enableWebUI = true;
};
users.users.me.homeMode = "770"; # important for resilio
virtualisation.waydroid.enable = true;
@@ -60,6 +96,16 @@
################# make firefox default browser
xdg.mime.defaultApplications = {
"text/html" = "firefox.desktop";
"x-scheme-handler/http" = "firefox.desktop";
"x-scheme-handler/https" = "firefox.desktop";
"x-scheme-handler/about" = "firefox.desktop";
"x-scheme-handler/unknown" = "firefox.desktop";
};
# disable touch clicks because i always tap while typing
@@ -89,6 +135,16 @@
];
services.udev.packages = [ inputs.waveforms.packages.${system}.adept2-runtime ];
users.users.rslsync.extraGroups = ["users"];
# add myself to plugdev group for waveforms
# and incus-admin to use incus without sudo
users.users.me.extraGroups = [ "incus-admin" "plugdev" "rslsync" ];
nixpkgs.config.permittedInsecurePackages = [
"python-2.7.18.8"
];
environment.systemPackages = with pkgs; [
@@ -251,10 +307,14 @@
#networking.useDHCP = lib.mkForce true;
networking.firewall.allowPing = true;
networking.firewall.enable = false;
networking.firewall.enable = true;
services.samba.openFirewall = true;
networking.firewall.interfaces."tailscale0".allowedTCPPorts = [
44444 # resilio sync
];
networking.firewall.allowedTCPPorts = [
5357 # wsdd
8888 # for general usage
@@ -485,42 +545,49 @@
# */
systemd.services.waydroid = {
enable = false;
description = "run waydroid session in background";
unitConfig = {
Type = "simple";
};
serviceConfig = {
Restart = "always";
RestartSec = "500s";
ExecStart = "${pkgs.waydroid}/bin/waydroid session start";
User = "me";
Group = "users";
};
wantedBy = [ "multi-user.target" ];
};
#################################### samba ######################################
/*
services.samba-wsdd.enable = true; # make shares visible for windows 10 clients
services.samba = {
enable = true;
securityType = "user";
extraConfig = ''
security = user
map to guest = bad user
guest account = me
server role = standalone server
workgroup = WORKGROUP
'';
shares = {
rpi_schule = {
path = "${workDir}/rpi-schule/";
"guest ok" = "yes";
"read only" = "no";
public = "yes";
writable = "yes";
printable = "no";
comment = "share for rpi in school wlan";
};
settings = {
global = {
"security" = "user";
"map to guest" = "bad user";
"guest account" = "me";
"server role" = "standalone server";
"workgroup" = "WORKGROUP";
};
share = {
comment = "share for sharing stuff";
path = "${workDir}/share";
public = "yes";
"guest ok" = "yes";
"guest ok" = "yes";
"read only" = "no";
writable = "yes";
};
};
};
*/
######################################### virtualisation ###############################
@@ -541,10 +608,6 @@
systemd.services.incus.path = [ pkgs.swtpm ];
#virtualisation.incus.package = inputs.nixpkgs-unstable.legacyPackages.x86_64-linux.incus;
# add myself to plugdev group for waveforms
# and incus-admin to use incus without sudo
users.users.me.extraGroups = [ "incus-admin" "plugdev" ];
virtualisation.podman.enable = true;

62
hosts/mosatop.nix Normal file
View File

@@ -0,0 +1,62 @@
{ pkgs, inputs, secretsDir, ...}:
{
imports = [
../users/me/headless.nix
../common/wsl.nix
inputs.networkmanager.nixosModules.networkmanager
inputs.home-manager.nixosModules.home-manager
../common/all.nix
../common/nixos-headless.nix
];
# to build rpi images
boot.binfmt.emulatedSystems = [
"aarch64-linux"
"armv7l-linux"
];
######################### networking #####################################
networking.hostName = "mosatop";
networking.firewall.allowPing = true;
networking.firewall.enable = true;
networking.firewall.allowedUDPPorts = [
3702 # wsdd
51820 # wireguard
24454 # minecraft voice chat
];
networking.firewall.allowedTCPPorts = [
2222 # sshd
8888 # general use
9999 # general use
25565 # minecraft
];
networking.networkmanager.enable = true;
/*
networking.networkmanager.profiles = {
me = {
connection = {
id = "me";
uuid = "fe45d3bc-21c6-41ff-bc06-c936017c6e02";
type = "wireguard";
autoconnect = "true";
interface-name = "me0";
};
wireguard = {
listen-port = "51820";
private-key = builtins.readFile "${secretsDir}/wg-private-acern";
};
ipv4 = {
address1 = "10.1.1.5/24";
method = "manual";
};
} // (import ../common/wg-peers.nix { inherit secretsDir; }) ;
};
*/
}