diff options
Diffstat (limited to 'modules/nixos')
98 files changed, 2777 insertions, 2458 deletions
diff --git a/modules/nixos/acme.nix b/modules/nixos/acme.nix index 49be684..6a75818 100644 --- a/modules/nixos/acme.nix +++ b/modules/nixos/acme.nix @@ -1,13 +1,15 @@ -{ - config, - lib, - ... -}: -with lib; let +{ config, lib, ... }: +with lib; +let cfg = config.nixfiles.modules.acme; -in { +in +{ imports = [ - (mkAliasOptionModule ["certs"] ["security" "acme" "certs"]) + (mkAliasOptionModule [ "certs" ] [ + "security" + "acme" + "certs" + ]) ]; options.nixfiles.modules.acme = { @@ -21,7 +23,7 @@ in { }; config = mkIf cfg.enable { - ark.directories = ["/var/lib/acme"]; + ark.directories = [ "/var/lib/acme" ]; security.acme = { acceptTerms = true; diff --git a/modules/nixos/alertmanager.nix b/modules/nixos/alertmanager.nix index 4d7f2ec..a3457bc 100644 --- a/modules/nixos/alertmanager.nix +++ b/modules/nixos/alertmanager.nix @@ -5,10 +5,12 @@ libNginx, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.alertmanager; -in { - imports = [inputs.alertmanager-ntfy.nixosModules.default]; +in +{ + imports = [ inputs.alertmanager-ntfy.nixosModules.default ]; options.nixfiles.modules.alertmanager = { enable = mkEnableOption "Alertmanager"; @@ -31,7 +33,7 @@ in { ntfy.enable = true; nginx = { enable = true; - upstreams.alertmanager.servers."127.0.0.1:${toString cfg.port}" = {}; + upstreams.alertmanager.servers."127.0.0.1:${toString cfg.port}" = { }; virtualHosts.${cfg.domain} = { locations."/".proxyPass = "http://alertmanager"; extraConfig = libNginx.config.internalOnly; @@ -59,16 +61,14 @@ in { route = { receiver = my.username; - group_by = ["alertname"]; + group_by = [ "alertname" ]; }; receivers = [ { name = my.username; webhook_configs = [ - { - url = with config.services.alertmanager-ntfy; "http://${httpAddress}:${httpPort}"; - } + { url = with config.services.alertmanager-ntfy; "http://${httpAddress}:${httpPort}"; } ]; } ]; diff --git a/modules/nixos/android.nix b/modules/nixos/android.nix index 41b7ef9..363bd6c 100644 --- a/modules/nixos/android.nix +++ b/modules/nixos/android.nix @@ -1,16 +1,14 @@ -{ - config, - lib, - ... -}: -with lib; let +{ config, lib, ... }: +with lib; +let cfg = config.nixfiles.modules.android; -in { +in +{ options.nixfiles.modules.android.enable = mkEnableOption "support for Android devices"; config = mkIf cfg.enable { programs.adb.enable = true; - my.extraGroups = ["adbusers"]; + my.extraGroups = [ "adbusers" ]; }; } diff --git a/modules/nixos/beets.nix b/modules/nixos/beets.nix index f01e412..732f400 100644 --- a/modules/nixos/beets.nix +++ b/modules/nixos/beets.nix @@ -4,99 +4,102 @@ pkgs, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.beets; -in { - options.nixfiles.modules.beets.enable = - mkEnableOption "beets"; +in +{ + options.nixfiles.modules.beets.enable = mkEnableOption "beets"; config = mkIf cfg.enable { - hm = let - beetsdir = "${config.dirs.data}/beets"; - in { - home = { - activation.initialiseBeets = '' - if [[ ! -d "${beetsdir}" ]]; then - mkdir -p ${beetsdir} - fi - ''; + hm = + let + beetsdir = "${config.dirs.data}/beets"; + in + { + home = { + activation.initialiseBeets = '' + if [[ ! -d "${beetsdir}" ]]; then + mkdir -p ${beetsdir} + fi + ''; - sessionVariables.BEETSDIR = beetsdir; - }; + sessionVariables.BEETSDIR = beetsdir; + }; - programs = { - beets = { - enable = true; + programs = { + beets = { + enable = true; - package = pkgs.beets-unstable; + package = pkgs.beets-unstable; - settings = { - library = "${beetsdir}/library.db"; - directory = config.userDirs.music; - plugins = concatStringsSep " " [ - "badfiles" - "edit" - "fetchart" - "info" - "mbsync" - "mpdupdate" - "scrub" - "zero" - ]; - original_date = true; - import = { - write = true; - copy = true; - move = false; - bell = true; - from_scratch = true; - }; - match = { - preferred = { - countries = [ - "JP" - "KR" - "TW" - "HK" - "CN" - "RU" - "NL" - "DE" - "AT" - "GB|UK" - "CA" - "AU" - "NZ" - "US" - ]; - original_year = true; + settings = { + library = "${beetsdir}/library.db"; + directory = config.userDirs.music; + plugins = concatStringsSep " " [ + "badfiles" + "edit" + "fetchart" + "info" + "mbsync" + "mpdupdate" + "scrub" + "zero" + ]; + original_date = true; + import = { + write = true; + copy = true; + move = false; + bell = true; + from_scratch = true; + }; + match = { + preferred = { + countries = [ + "JP" + "KR" + "TW" + "HK" + "CN" + "RU" + "NL" + "DE" + "AT" + "GB|UK" + "CA" + "AU" + "NZ" + "US" + ]; + original_year = true; + }; + }; + edit = { + albumfields = "album artist albumartist"; + itemfields = "track title album artist albumartist day month year genre"; + }; + fetchart = { + auto = true; + cautious = true; + cover_names = "cover Cover folder Folder art Art album Album front Front"; + sources = "filesystem coverart itunes amazon albumart wikipedia"; + high_resolution = true; + }; + scrub.auto = true; + zero = { + fields = "comments genre"; + update_database = true; + }; + mpd = { + host = "127.0.0.1"; + port = 6600; }; - }; - edit = { - albumfields = "album artist albumartist"; - itemfields = "track title album artist albumartist day month year genre"; - }; - fetchart = { - auto = true; - cautious = true; - cover_names = "cover Cover folder Folder art Art album Album front Front"; - sources = "filesystem coverart itunes amazon albumart wikipedia"; - high_resolution = true; - }; - scrub.auto = true; - zero = { - fields = "comments genre"; - update_database = true; - }; - mpd = { - host = "127.0.0.1"; - port = 6600; }; }; - }; - bash.shellAliases.beet = "beet --config ${config.dirs.config}/beets/config.yaml"; + bash.shellAliases.beet = "beet --config ${config.dirs.config}/beets/config.yaml"; + }; }; - }; }; } diff --git a/modules/nixos/bluetooth.nix b/modules/nixos/bluetooth.nix index 26d081d..117aff7 100644 --- a/modules/nixos/bluetooth.nix +++ b/modules/nixos/bluetooth.nix @@ -1,16 +1,13 @@ -{ - config, - lib, - ... -}: -with lib; let +{ config, lib, ... }: +with lib; +let cfg = config.nixfiles.modules.bluetooth; -in { - options.nixfiles.modules.bluetooth.enable = - mkEnableOption "Bluetooth support"; +in +{ + options.nixfiles.modules.bluetooth.enable = mkEnableOption "Bluetooth support"; config = mkIf cfg.enable { - ark.directories = ["/var/lib/bluetooth"]; + ark.directories = [ "/var/lib/bluetooth" ]; hardware.bluetooth = { enable = true; diff --git a/modules/nixos/chromium.nix b/modules/nixos/chromium.nix index 3b87b4c..c7842d5 100644 --- a/modules/nixos/chromium.nix +++ b/modules/nixos/chromium.nix @@ -4,14 +4,16 @@ pkgs, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.chromium; -in { +in +{ options.nixfiles.modules.chromium.enable = mkEnableOption "Chromium"; config = mkIf cfg.enable { hm = { - home.packages = with pkgs; [profile-cleaner]; + home.packages = with pkgs; [ profile-cleaner ]; programs.chromium = { enable = true; @@ -19,7 +21,7 @@ in { package = pkgs.ungoogled-chromium; extensions = [ - {id = "cjpalhdlnbpafiamejdnhcphjbkeiagm";} # uBlock Origin + { id = "cjpalhdlnbpafiamejdnhcphjbkeiagm"; } # uBlock Origin ]; }; }; diff --git a/modules/nixos/clickhouse.nix b/modules/nixos/clickhouse.nix index 4fae683..12dc7fa 100644 --- a/modules/nixos/clickhouse.nix +++ b/modules/nixos/clickhouse.nix @@ -1,11 +1,9 @@ -{ - config, - lib, - ... -}: -with lib; let +{ config, lib, ... }: +with lib; +let cfg = config.nixfiles.modules.clickhouse; -in { +in +{ options.nixfiles.modules.clickhouse = { enable = mkEnableOption "Clickhouse"; }; diff --git a/modules/nixos/common/ark.nix b/modules/nixos/common/ark.nix index 3a12050..6c7148f 100644 --- a/modules/nixos/common/ark.nix +++ b/modules/nixos/common/ark.nix @@ -4,34 +4,42 @@ lib, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.ark; -in { +in +{ imports = [ - (mkAliasOptionModule ["ark"] ["nixfiles" "modules" "ark"]) + (mkAliasOptionModule [ "ark" ] [ + "nixfiles" + "modules" + "ark" + ]) inputs.impermanence.nixosModules.impermanence ]; - options.nixfiles.modules.ark = let - mkListOfAnythingOption = mkOption { - type = with types; listOf anything; # Assumed to be matching with the upstream type. - default = []; - }; - in { - enable = mkEnableOption "persistent storage support via impermanence"; + options.nixfiles.modules.ark = + let + mkListOfAnythingOption = mkOption { + type = with types; listOf anything; # Assumed to be matching with the upstream type. + default = [ ]; + }; + in + { + enable = mkEnableOption "persistent storage support via impermanence"; - path = mkOption { - type = types.str; - default = "/ark"; - }; + path = mkOption { + type = types.str; + default = "/ark"; + }; - directories = mkListOfAnythingOption; - files = mkListOfAnythingOption; - # hm = { - # directories = mkListOfAnythingOption; - # files = mkListOfAnythingOption; - # }; - }; + directories = mkListOfAnythingOption; + files = mkListOfAnythingOption; + # hm = { + # directories = mkListOfAnythingOption; + # files = mkListOfAnythingOption; + # }; + }; config = mkIf cfg.enable { environment.persistence.${cfg.path} = { diff --git a/modules/nixos/common/console.nix b/modules/nixos/common/console.nix index 3491e37..330310c 100644 --- a/modules/nixos/common/console.nix +++ b/modules/nixos/common/console.nix @@ -1,8 +1,5 @@ +{ config, pkgs, ... }: { - config, - pkgs, - ... -}: { stylix.targets.console.enable = false; console = { diff --git a/modules/nixos/common/documentation.nix b/modules/nixos/common/documentation.nix index cb66818..f7d1585 100644 --- a/modules/nixos/common/documentation.nix +++ b/modules/nixos/common/documentation.nix @@ -5,7 +5,8 @@ this, ... }: -with lib; { +with lib; +{ config = mkIf this.isHeadful { documentation = { dev.enable = true; @@ -14,13 +15,12 @@ with lib; { man.man-db.manualPages = (pkgs.buildEnv { name = "man-paths"; - paths = with config; - environment.systemPackages ++ hm.home.packages; - pathsToLink = ["/share/man"]; - extraOutputsToInstall = ["man"]; + paths = with config; environment.systemPackages ++ hm.home.packages; + pathsToLink = [ "/share/man" ]; + extraOutputsToInstall = [ "man" ]; ignoreCollisions = true; - }) - .overrideAttrs (_: _: {__contentAddressed = true;}); + }).overrideAttrs + (_: _: { __contentAddressed = true; }); }; environment.sessionVariables = { diff --git a/modules/nixos/common/home-manager.nix b/modules/nixos/common/home-manager.nix index 52f2fd3..c553a65 100644 --- a/modules/nixos/common/home-manager.nix +++ b/modules/nixos/common/home-manager.nix @@ -1,3 +1,4 @@ -{inputs, ...}: { - imports = [inputs.home-manager.nixosModule]; +{ inputs, ... }: +{ + imports = [ inputs.home-manager.nixosModule ]; } diff --git a/modules/nixos/common/kernel.nix b/modules/nixos/common/kernel.nix index 2fc40f9..5c45b5d 100644 --- a/modules/nixos/common/kernel.nix +++ b/modules/nixos/common/kernel.nix @@ -1,11 +1,12 @@ -{lib, ...}: -with lib; { +{ lib, ... }: +with lib; +{ boot = { # I don't use it even on laptops. It's also /required/ to disable it for # ZFS[1]. # [1]: https://github.com/openzfs/zfs/issues/260 # [1]: https://github.com/openzfs/zfs/issues/12842 - kernelParams = ["hibernate=no"]; + kernelParams = [ "hibernate=no" ]; kernel.sysctl = { "fs.file-max" = pow 2 17; diff --git a/modules/nixos/common/locale.nix b/modules/nixos/common/locale.nix index 76186bc..699f89b 100644 --- a/modules/nixos/common/locale.nix +++ b/modules/nixos/common/locale.nix @@ -1,9 +1,6 @@ +{ lib, pkgs, ... }: +with lib; { - lib, - pkgs, - ... -}: -with lib; { i18n = { defaultLocale = mkDefault "en_GB.UTF-8"; supportedLocales = [ diff --git a/modules/nixos/common/networking.nix b/modules/nixos/common/networking.nix index fb7d9b2..ecadf6e 100644 --- a/modules/nixos/common/networking.nix +++ b/modules/nixos/common/networking.nix @@ -5,14 +5,16 @@ this, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.common.networking; -in { - options.nixfiles.modules.common.networking.onlyDefault = - mkEnableOption "custom networking settings"; +in +{ + options.nixfiles.modules.common.networking.onlyDefault = mkEnableOption "custom networking settings"; config = mkIf (!cfg.onlyDefault) { - ark.directories = with config.networking; + ark.directories = + with config.networking; optional networkmanager.enable "/etc/NetworkManager/system-connections" ++ optional wireless.iwd.enable "/var/lib/iwd"; @@ -27,8 +29,8 @@ in { # Remove default hostname mappings. This is required at least by the # current implementation of the monitoring module. hosts = { - "127.0.0.2" = mkForce []; - "::1" = mkForce []; + "127.0.0.2" = mkForce [ ]; + "::1" = mkForce [ ]; }; nameservers = mkDefault dns.const.quad9.default; @@ -52,33 +54,35 @@ in { logReversePathDrops = false; }; } - (let - interface = "eth0"; # This assumes `usePredictableInterfaceNames` is false. - in + ( + let + interface = "eth0"; # This assumes `usePredictableInterfaceNames` is false. + in mkIf (hasAttr "ipv4" this && hasAttr "ipv6" this) { usePredictableInterfaceNames = false; # NOTE This can break something! interfaces.${interface} = { - ipv4.addresses = with this.ipv4; - optional (isString address && isInt prefixLength) { - inherit address prefixLength; - }; - - ipv6.addresses = with this.ipv6; - optional (isString address && isInt prefixLength) { - inherit address prefixLength; - }; + ipv4.addresses = + with this.ipv4; + optional (isString address && isInt prefixLength) { inherit address prefixLength; }; + + ipv6.addresses = + with this.ipv6; + optional (isString address && isInt prefixLength) { inherit address prefixLength; }; }; - defaultGateway = with this.ipv4; + defaultGateway = + with this.ipv4; mkIf (isString gatewayAddress) { inherit interface; address = gatewayAddress; }; - defaultGateway6 = with this.ipv6; + defaultGateway6 = + with this.ipv6; mkIf (isString gatewayAddress) { inherit interface; address = gatewayAddress; }; - }) + } + ) (mkIf this.isHeadful { interfaces = { eth0.useDHCP = mkDefault true; @@ -100,12 +104,8 @@ in { ]; environment = { - shellAliases = listToAttrs (map - ({ - name, - value, - }: - nameValuePair name "${pkgs.iproute2}/bin/${value}") [ + shellAliases = listToAttrs ( + map ({ name, value }: nameValuePair name "${pkgs.iproute2}/bin/${value}") [ { name = "bridge"; value = "bridge -color=always"; @@ -118,7 +118,8 @@ in { name = "tc"; value = "tc -color=always"; } - ]); + ] + ); systemPackages = with pkgs; [ ethtool diff --git a/modules/nixos/common/nix.nix b/modules/nixos/common/nix.nix index 2976cfc..146575d 100644 --- a/modules/nixos/common/nix.nix +++ b/modules/nixos/common/nix.nix @@ -4,13 +4,15 @@ lib, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.common.nix; -in { +in +{ options.nixfiles.modules.common.nix.allowedUnfreePackages = mkOption { description = "A list of allowed unfree packages."; type = with types; listOf str; - default = []; + default = [ ]; }; config = { @@ -22,13 +24,12 @@ in { nixpkgs.config.allowUnfreePredicate = p: elem (getName p) cfg.allowedUnfreePackages; - system.stateVersion = with builtins; - head (split "\n" (readFile "${inputs.nixpkgs}/.version")); + system.stateVersion = with builtins; head (split "\n" (readFile "${inputs.nixpkgs}/.version")); environment = { sessionVariables.NIX_SHELL_PRESERVE_PROMPT = "1"; localBinInPath = true; - defaultPackages = []; + defaultPackages = [ ]; }; }; } diff --git a/modules/nixos/common/secrets.nix b/modules/nixos/common/secrets.nix index 9a82c44..31787ac 100644 --- a/modules/nixos/common/secrets.nix +++ b/modules/nixos/common/secrets.nix @@ -1,3 +1,4 @@ -{inputs, ...}: { - imports = [inputs.agenix.nixosModules.default]; +{ inputs, ... }: +{ + imports = [ inputs.agenix.nixosModules.default ]; } diff --git a/modules/nixos/common/shell.nix b/modules/nixos/common/shell.nix index 5fbc441..a1a7f08 100644 --- a/modules/nixos/common/shell.nix +++ b/modules/nixos/common/shell.nix @@ -1,3 +1 @@ -_: { - programs.command-not-found.enable = false; -} +_: { programs.command-not-found.enable = false; } diff --git a/modules/nixos/common/stylix.nix b/modules/nixos/common/stylix.nix index 5ca5571..a89943a 100644 --- a/modules/nixos/common/stylix.nix +++ b/modules/nixos/common/stylix.nix @@ -5,8 +5,9 @@ pkgs, ... }: -with lib; { - imports = [inputs.stylix.nixosModules.stylix]; +with lib; +{ + imports = [ inputs.stylix.nixosModules.stylix ]; stylix.cursor = { name = "phinger-cursors"; diff --git a/modules/nixos/common/systemd.nix b/modules/nixos/common/systemd.nix index 3972670..b393d9f 100644 --- a/modules/nixos/common/systemd.nix +++ b/modules/nixos/common/systemd.nix @@ -1,14 +1,11 @@ +{ config, pkgs, ... }: { - config, - pkgs, - ... -}: { ark = { - files = ["/etc/machine-id"]; - directories = ["/var/lib/systemd/coredump"]; + files = [ "/etc/machine-id" ]; + directories = [ "/var/lib/systemd/coredump" ]; }; - my.extraGroups = ["systemd-journal"]; + my.extraGroups = [ "systemd-journal" ]; hm.systemd.user.startServices = "sd-switch"; @@ -24,15 +21,19 @@ SystemMaxUse=5G ''; - systemd = let - extraConfig = '' - DefaultTimeoutStartSec=30s - DefaultTimeoutStopSec=15s - ''; - in { - inherit extraConfig; - user = {inherit extraConfig;}; - }; + systemd = + let + extraConfig = '' + DefaultTimeoutStartSec=30s + DefaultTimeoutStopSec=15s + ''; + in + { + inherit extraConfig; + user = { + inherit extraConfig; + }; + }; environment.sessionVariables = { SYSTEMD_PAGERSECURE = "1"; diff --git a/modules/nixos/common/users.nix b/modules/nixos/common/users.nix index 367af41..eca9e1b 100644 --- a/modules/nixos/common/users.nix +++ b/modules/nixos/common/users.nix @@ -1,8 +1,10 @@ -{lib, ...}: -with lib; let +{ lib, ... }: +with lib; +let home = "/home/${my.username}"; -in { - ark.directories = [home]; +in +{ + ark.directories = [ home ]; users = { mutableUsers = false; @@ -16,8 +18,8 @@ in { description = my.fullname; inherit home; inherit (my) hashedPassword; - openssh.authorizedKeys.keys = [my.ssh.key]; - extraGroups = ["wheel"]; + openssh.authorizedKeys.keys = [ my.ssh.key ]; + extraGroups = [ "wheel" ]; }; }; }; diff --git a/modules/nixos/common/xdg.nix b/modules/nixos/common/xdg.nix index 668996f..1fe167e 100644 --- a/modules/nixos/common/xdg.nix +++ b/modules/nixos/common/xdg.nix @@ -4,19 +4,19 @@ this, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.common.xdg; -in { +in +{ options.nixfiles.modules.common.xdg.defaultApplications = mkOption { description = "Default applications."; type = with types; attrsOf (listOf str); - default = {}; + default = { }; }; config = { - xdg.portal = mkIf this.isHeadful { - enable = true; - }; + xdg.portal = mkIf this.isHeadful { enable = true; }; hm.xdg = mkMerge [ (with cfg; { @@ -31,11 +31,9 @@ in { (mkIf this.isHeadful { mimeApps = { enable = true; - defaultApplications = - mkMerge - (mapAttrsToList - (n: v: genAttrs v (_: ["${n}.desktop"])) - cfg.defaultApplications); + defaultApplications = mkMerge ( + mapAttrsToList (n: v: genAttrs v (_: [ "${n}.desktop" ])) cfg.defaultApplications + ); }; }) ]; diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix index 1a42517..1d5e905 100644 --- a/modules/nixos/default.nix +++ b/modules/nixos/default.nix @@ -15,12 +15,14 @@ _: { ./endlessh.nix ./fail2ban.nix ./firefox + ./foot.nix ./games ./git ./gnupg.nix ./gotify.nix ./grafana.nix ./hydra.nix + ./incus.nix ./ipfs.nix ./jackett.nix ./k3s.nix @@ -28,7 +30,6 @@ _: { ./libvirtd.nix ./lidarr.nix ./loki.nix - ./incus.nix ./matrix ./monitoring ./mpd.nix diff --git a/modules/nixos/docker.nix b/modules/nixos/docker.nix index 0795386..62dc095 100644 --- a/modules/nixos/docker.nix +++ b/modules/nixos/docker.nix @@ -5,9 +5,11 @@ pkgs, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.docker; -in { +in +{ options.nixfiles.modules.docker.enable = mkEnableOption "Docker"; config = mkIf cfg.enable { @@ -29,8 +31,8 @@ in { virtualisation.docker.enable = true; - environment.systemPackages = with pkgs; [docker-compose]; + environment.systemPackages = with pkgs; [ docker-compose ]; - my.extraGroups = ["docker"]; + my.extraGroups = [ "docker" ]; }; } diff --git a/modules/nixos/dwm.nix b/modules/nixos/dwm.nix index a32ed29..912be0c 100644 --- a/modules/nixos/dwm.nix +++ b/modules/nixos/dwm.nix @@ -4,9 +4,11 @@ pkgs, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.dwm; -in { +in +{ options.nixfiles.modules.dwm.enable = mkEnableOption "dwm"; config = mkIf cfg.enable { @@ -15,134 +17,137 @@ in { hm.xsession = { enable = true; - windowManager.command = let - pkg = pkgs.dwm.override { - conf = let - font = with config.stylix.fonts; "${monospace.name}:size=${toString sizes.terminal}"; - in '' - static const unsigned int borderpx = 1; - static const unsigned int snap = 32; - static const int showbar = 1; - static const int topbar = 1; + windowManager.command = + let + pkg = pkgs.dwm.override { + conf = + let + font = with config.stylix.fonts; "${monospace.name}:size=${toString sizes.terminal}"; + in + '' + static const unsigned int borderpx = 1; + static const unsigned int snap = 32; + static const int showbar = 1; + static const int topbar = 1; - static const char *fonts[] = { - "${font}" - }; + static const char *fonts[] = { + "${font}" + }; - static const char *colors[][3] = { - [SchemeNorm] = { - "${config.color.base06}", - "${config.color.base01}", - "${config.color.base01}", - }, - [SchemeSel] = { - "${config.color.base01}", - "${config.color.base06}", - "${config.color.base06}", - }, - }; + static const char *colors[][3] = { + [SchemeNorm] = { + "${config.color.base06}", + "${config.color.base01}", + "${config.color.base01}", + }, + [SchemeSel] = { + "${config.color.base01}", + "${config.color.base06}", + "${config.color.base06}", + }, + }; - static const char *tags[] = { - "1", - "2", - "3", - "4", - "5", - "6", - "7", - "8", - "9" - }; + static const char *tags[] = { + "1", + "2", + "3", + "4", + "5", + "6", + "7", + "8", + "9" + }; - static const Rule rules[] = { - { "Emacs", NULL, NULL, 1 << 0, 0, -1 }, - }; + static const Rule rules[] = { + { "Emacs", NULL, NULL, 1 << 0, 0, -1 }, + }; - static const float mfact = 0.666; - static const int nmaster = 1; - static const int resizehints = 0; - static const int lockfullscreen = 1; + static const float mfact = 0.666; + static const int nmaster = 1; + static const int resizehints = 0; + static const int lockfullscreen = 1; - static const Layout layouts[] = { - { "[]=", tile }, - { "><>", NULL }, - { "[M]", monocle }, - }; + static const Layout layouts[] = { + { "[]=", tile }, + { "><>", NULL }, + { "[M]", monocle }, + }; - #define MODKEY Mod4Mask - #define TAGKEYS(KEY,TAG) \ - { MODKEY, KEY, view, { .ui = 1 << TAG } }, \ - { MODKEY|ControlMask, KEY, toggleview, { .ui = 1 << TAG } }, \ - { MODKEY|ShiftMask, KEY, tag, { .ui = 1 << TAG } }, \ - { MODKEY|ControlMask|ShiftMask, KEY, toggletag, { .ui = 1 << TAG } }, + #define MODKEY Mod4Mask + #define TAGKEYS(KEY,TAG) \ + { MODKEY, KEY, view, { .ui = 1 << TAG } }, \ + { MODKEY|ControlMask, KEY, toggleview, { .ui = 1 << TAG } }, \ + { MODKEY|ShiftMask, KEY, tag, { .ui = 1 << TAG } }, \ + { MODKEY|ControlMask|ShiftMask, KEY, toggletag, { .ui = 1 << TAG } }, - static char dmenumon[2] = "0"; - static const char *dmenucmd[] = { - "${pkgs.dmenu}/bin/dmenu_run", - "-m", dmenumon, - "-fn", "${font}", - "-nb", "${config.color.base01}", - "-nf", "${config.color.base06}", - "-sb", "${config.color.base06}", - "-sf", "${config.color.base01}", - NULL, - }; - static const char *termcmd[] = { - "${getExe pkgs.alacritty}", - NULL, - }; + static char dmenumon[2] = "0"; + static const char *dmenucmd[] = { + "${pkgs.dmenu}/bin/dmenu_run", + "-m", dmenumon, + "-fn", "${font}", + "-nb", "${config.color.base01}", + "-nf", "${config.color.base06}", + "-sb", "${config.color.base06}", + "-sf", "${config.color.base01}", + NULL, + }; + static const char *termcmd[] = { + "${getExe pkgs.alacritty}", + NULL, + }; - static const Key keys[] = { - { MODKEY, XK_x, spawn, {.v = dmenucmd} }, - { MODKEY, XK_Return, spawn, {.v = termcmd} }, - { MODKEY, XK_b, togglebar, {0} }, - { MODKEY, XK_j, focusstack, {.i = +1} }, - { MODKEY, XK_k, focusstack, {.i = -1} }, - { MODKEY|ShiftMask, XK_k, incnmaster, {.i = +1} }, - { MODKEY|ShiftMask, XK_j, incnmaster, {.i = -1} }, - { MODKEY, XK_comma, setmfact, {.f = -0.05} }, - { MODKEY, XK_period, setmfact, {.f = +0.05} }, - { MODKEY, XK_p, zoom, {0} }, - { MODKEY, XK_Tab, view, {0} }, - { MODKEY, XK_d, killclient, {0} }, - { MODKEY, XK_t, setlayout, {.v = &layouts[0]} }, - { MODKEY, XK_m, setlayout, {.v = &layouts[1]} }, - { MODKEY, XK_f, setlayout, {.v = &layouts[2]} }, - { MODKEY, XK_o, togglefloating, {0} }, - { MODKEY, XK_0, view, {.ui = ~0} }, - { MODKEY|ShiftMask, XK_0, tag, {.ui = ~0} }, - { MODKEY, XK_h, focusmon, {.i = -1} }, - { MODKEY, XK_l, focusmon, {.i = +1} }, - { MODKEY|ShiftMask, XK_h, tagmon, {.i = -1} }, - { MODKEY|ShiftMask, XK_l, tagmon, {.i = +1} }, - TAGKEYS( XK_1, 0) - TAGKEYS( XK_2, 1) - TAGKEYS( XK_3, 2) - TAGKEYS( XK_4, 3) - TAGKEYS( XK_5, 4) - TAGKEYS( XK_6, 5) - TAGKEYS( XK_7, 6) - TAGKEYS( XK_8, 7) - TAGKEYS( XK_9, 8) - { MODKEY|ShiftMask, XK_q, quit, {0} }, - }; + static const Key keys[] = { + { MODKEY, XK_x, spawn, {.v = dmenucmd} }, + { MODKEY, XK_Return, spawn, {.v = termcmd} }, + { MODKEY, XK_b, togglebar, {0} }, + { MODKEY, XK_j, focusstack, {.i = +1} }, + { MODKEY, XK_k, focusstack, {.i = -1} }, + { MODKEY|ShiftMask, XK_k, incnmaster, {.i = +1} }, + { MODKEY|ShiftMask, XK_j, incnmaster, {.i = -1} }, + { MODKEY, XK_comma, setmfact, {.f = -0.05} }, + { MODKEY, XK_period, setmfact, {.f = +0.05} }, + { MODKEY, XK_p, zoom, {0} }, + { MODKEY, XK_Tab, view, {0} }, + { MODKEY, XK_d, killclient, {0} }, + { MODKEY, XK_t, setlayout, {.v = &layouts[0]} }, + { MODKEY, XK_m, setlayout, {.v = &layouts[1]} }, + { MODKEY, XK_f, setlayout, {.v = &layouts[2]} }, + { MODKEY, XK_o, togglefloating, {0} }, + { MODKEY, XK_0, view, {.ui = ~0} }, + { MODKEY|ShiftMask, XK_0, tag, {.ui = ~0} }, + { MODKEY, XK_h, focusmon, {.i = -1} }, + { MODKEY, XK_l, focusmon, {.i = +1} }, + { MODKEY|ShiftMask, XK_h, tagmon, {.i = -1} }, + { MODKEY|ShiftMask, XK_l, tagmon, {.i = +1} }, + TAGKEYS( XK_1, 0) + TAGKEYS( XK_2, 1) + TAGKEYS( XK_3, 2) + TAGKEYS( XK_4, 3) + TAGKEYS( XK_5, 4) + TAGKEYS( XK_6, 5) + TAGKEYS( XK_7, 6) + TAGKEYS( XK_8, 7) + TAGKEYS( XK_9, 8) + { MODKEY|ShiftMask, XK_q, quit, {0} }, + }; - static const Button buttons[] = { - { ClkLtSymbol, 0, Button1, setlayout, {0} }, - { ClkLtSymbol, 0, Button3, setlayout, {.v = &layouts[2]} }, - { ClkWinTitle, 0, Button2, zoom, {0} }, - { ClkStatusText, 0, Button2, spawn, {.v = termcmd} }, - { ClkClientWin, MODKEY, Button1, movemouse, {0} }, - { ClkClientWin, MODKEY, Button2, togglefloating, {0} }, - { ClkClientWin, MODKEY, Button3, resizemouse, {0} }, - { ClkTagBar, 0, Button1, view, {0} }, - { ClkTagBar, 0, Button3, toggleview, {0} }, - { ClkTagBar, MODKEY, Button1, tag, {0} }, - { ClkTagBar, MODKEY, Button3, toggletag, {0} }, - }; - ''; - }; - in + static const Button buttons[] = { + { ClkLtSymbol, 0, Button1, setlayout, {0} }, + { ClkLtSymbol, 0, Button3, setlayout, {.v = &layouts[2]} }, + { ClkWinTitle, 0, Button2, zoom, {0} }, + { ClkStatusText, 0, Button2, spawn, {.v = termcmd} }, + { ClkClientWin, MODKEY, Button1, movemouse, {0} }, + { ClkClientWin, MODKEY, Button2, togglefloating, {0} }, + { ClkClientWin, MODKEY, Button3, resizemouse, {0} }, + { ClkTagBar, 0, Button1, view, {0} }, + { ClkTagBar, 0, Button3, toggleview, {0} }, + { ClkTagBar, MODKEY, Button1, tag, {0} }, + { ClkTagBar, MODKEY, Button3, toggletag, {0} }, + }; + ''; + }; + in getExe' pkg "dwm"; }; @@ -151,7 +156,14 @@ in { # package = pkgs.dwm-status.override { # enableAlsaUtils = false; # }; - order = ["audio" "backlight" "battery" "cpu_load" "network" "time"]; + order = [ + "audio" + "backlight" + "battery" + "cpu_load" + "network" + "time" + ]; }; services.xserver.displayManager.startx.enable = true; diff --git a/modules/nixos/emacs.nix b/modules/nixos/emacs.nix index 7d2112b..8a59c9b 100644 --- a/modules/nixos/emacs.nix +++ b/modules/nixos/emacs.nix @@ -1,11 +1,9 @@ -{ - config, - lib, - ... -}: -with lib; let +{ config, lib, ... }: +with lib; +let cfg = config.nixfiles.modules.emacs; -in { +in +{ config = mkIf cfg.enable { nixfiles.modules.common.xdg.defaultApplications.emacs = [ "application/atom+xml" diff --git a/modules/nixos/endlessh-go.nix b/modules/nixos/endlessh-go.nix index 435305d..efaaa8f 100644 --- a/modules/nixos/endlessh-go.nix +++ b/modules/nixos/endlessh-go.nix @@ -4,14 +4,17 @@ this, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.endlessh-go; -in { +in +{ options.nixfiles.modules.endlessh-go.enable = mkEnableOption "endlessh-go"; - config = let - port = 22; - in + config = + let + port = 22; + in mkIf cfg.enable { services.endlessh-go = { enable = true; @@ -22,9 +25,12 @@ in { listenAddress = this.wireguard.ipv4.address; port = 9229; }; - extraOptions = ["-geoip_supplier=ip-api" "-v=1"]; + extraOptions = [ + "-geoip_supplier=ip-api" + "-v=1" + ]; }; - networking.firewall.allowedTCPPorts = [port]; + networking.firewall.allowedTCPPorts = [ port ]; }; } diff --git a/modules/nixos/endlessh.nix b/modules/nixos/endlessh.nix index caf9a38..f1bf0bc 100644 --- a/modules/nixos/endlessh.nix +++ b/modules/nixos/endlessh.nix @@ -1,16 +1,15 @@ -{ - config, - lib, - ... -}: -with lib; let +{ config, lib, ... }: +with lib; +let cfg = config.nixfiles.modules.endlessh; -in { +in +{ options.nixfiles.modules.endlessh.enable = mkEnableOption "endlessh"; - config = let - port = 22; - in + config = + let + port = 22; + in mkIf cfg.enable { ark.directories = [ "/var/lib/gotify-server" @@ -20,9 +19,12 @@ in { services.endlessh = { enable = true; inherit port; - extraOptions = ["-v" "-4"]; + extraOptions = [ + "-v" + "-4" + ]; }; - networking.firewall.allowedTCPPorts = [port]; + networking.firewall.allowedTCPPorts = [ port ]; }; } diff --git a/modules/nixos/fail2ban.nix b/modules/nixos/fail2ban.nix index ce35c1f..a0cc2b4 100644 --- a/modules/nixos/fail2ban.nix +++ b/modules/nixos/fail2ban.nix @@ -4,14 +4,15 @@ this, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.fail2ban; -in { - options.nixfiles.modules.fail2ban.enable = - mkEnableOption "fail2ban"; +in +{ + options.nixfiles.modules.fail2ban.enable = mkEnableOption "fail2ban"; config = mkIf cfg.enable { - ark.directories = ["/var/lib/fail2ban"]; + ark.directories = [ "/var/lib/fail2ban" ]; services.fail2ban = { enable = true; @@ -22,9 +23,13 @@ in { rndtime = "8m"; }; - ignoreIP = - optionals (hasAttr "wireguard" this) - (with config.nixfiles.modules.wireguard; [ipv4.subnet ipv6.subnet]); + ignoreIP = optionals (hasAttr "wireguard" this) ( + with config.nixfiles.modules.wireguard; + [ + ipv4.subnet + ipv6.subnet + ] + ); jails.DEFAULT.settings.blocktype = "DROP"; }; diff --git a/modules/nixos/firefox/addons.nix b/modules/nixos/firefox/addons.nix index bd14bb5..28235d4 100644 --- a/modules/nixos/firefox/addons.nix +++ b/modules/nixos/firefox/addons.nix @@ -1,7 +1,5 @@ +{ buildFirefoxXpiAddon, lib }: { - buildFirefoxXpiAddon, - lib, -}: { "bitwarden" = buildFirefoxXpiAddon { pname = "bitwarden"; version = "2024.2.1"; @@ -33,10 +31,10 @@ }; "bypass-paywalls" = buildFirefoxXpiAddon { pname = "bypass-paywalls"; - version = "3.5.9.0"; + version = "3.6.0.0"; addonId = "magnolia_limited_permissions_d@12.34"; - url = "https://addons.mozilla.org/firefox/downloads/file/4248144/bypass_paywalls_clean_d-3.5.9.0.xpi"; - sha256 = "938da8dcfa0e3ff012b40cf54a270ca73b03183387ef9330bf8b7771dbf10a5c"; + url = "https://addons.mozilla.org/firefox/downloads/file/4251818/bypass_paywalls_clean_d-3.6.0.0.xpi"; + sha256 = "30a57df51a241838dca9360a12801ea82f2deaf76a6b63f1279235e2f5f3c939"; meta = with lib; { homepage = "https://gitlab.com/magnolia1234/bypass-paywalls-firefox-clean"; description = "Bypass Paywalls"; @@ -173,6 +171,7 @@ "*://*.courant.com/*" "*://*.courier-journal.com/*" "*://*.couriermail.com.au/*" + "*://*.courrierinternational.com/*" "*://*.crainscleveland.com/*" "*://*.crainsdetroit.com/*" "*://*.crainsnewyork.com/*" @@ -290,6 +289,7 @@ "*://*.ftm.nl/*" "*://*.gazetadopovo.com.br/*" "*://*.gazzetta.it/*" + "*://*.gbnews.com/*" "*://*.geelongadvertiser.com.au/*" "*://*.gelderlander.nl/*" "*://*.genomeweb.com/*" @@ -423,6 +423,7 @@ "*://*.lehighvalleylive.com/*" "*://*.lejdd.fr/*" "*://*.lemagit.fr/*" + "*://*.lemoniteur.fr/*" "*://*.lenouveleconomiste.fr/*" "*://*.lenouvelliste.ch/*" "*://*.leparisien.fr/*" @@ -526,6 +527,7 @@ "*://*.nytimes.com/*" "*://*.nzherald.co.nz/*" "*://*.nzz.ch/*" + "*://*.observador.pt/*" "*://*.ocbj.com/*" "*://*.ocregister.com/*" "*://*.oklahoman.com/*" @@ -560,6 +562,7 @@ "*://*.popularmechanics.com/*" "*://*.post-gazette.com/*" "*://*.pourlascience.fr/*" + "*://*.pourleco.com/*" "*://*.precisionmedicineonline.com/*" "*://*.pressenterprise.com/*" "*://*.prevention.com/*" @@ -864,16 +867,21 @@ homepage = "https://consentomatic.au.dk/"; description = "Automatic handling of GDPR consent forms"; license = licenses.mit; - mozPermissions = ["activeTab" "tabs" "storage" "<all_urls>"]; + mozPermissions = [ + "activeTab" + "tabs" + "storage" + "<all_urls>" + ]; platforms = platforms.all; }; }; "darkreader" = buildFirefoxXpiAddon { pname = "darkreader"; - version = "4.9.78"; + version = "4.9.80"; addonId = "addon@darkreader.org"; - url = "https://addons.mozilla.org/firefox/downloads/file/4243182/darkreader-4.9.78.xpi"; - sha256 = "21e08b3f26e9b54257d30f6b2fb2d966d41ace54d2d79ccec55e55517084c7ce"; + url = "https://addons.mozilla.org/firefox/downloads/file/4249607/darkreader-4.9.80.xpi"; + sha256 = "a93f1250b72cc27fe4a9b02be062c68fb079e45a1233d562852b48e1e9b99307"; meta = with lib; { homepage = "https://darkreader.org/"; description = "Dark mode for every website. Take care of your eyes, use dark theme for night and daily browsing."; @@ -939,10 +947,10 @@ }; "languagetool" = buildFirefoxXpiAddon { pname = "languagetool"; - version = "8.3.0"; + version = "8.6.0"; addonId = "languagetool-webextension@languagetool.org"; - url = "https://addons.mozilla.org/firefox/downloads/file/4199245/languagetool-8.3.0.xpi"; - sha256 = "e357424e3df9dde4ba10eb9f8f3719ac4830681570557f4d51db15a462cd7667"; + url = "https://addons.mozilla.org/firefox/downloads/file/4249956/languagetool-8.6.0.xpi"; + sha256 = "d9db9aac9fdd53eb39179c153161762cd9e9eb1f6d7da8e8b8a32238b4847094"; meta = with lib; { homepage = "https://languagetool.org"; description = "With this extension you can check text with the free style and grammar checker LanguageTool. It finds many errors that a simple spell checker cannot detect, like mixing up there/their, a/an, or repeating a word."; @@ -970,7 +978,11 @@ homepage = "https://github.com/MorbZ/no-pdf-download"; description = "Opens all PDF files directly in the browser."; license = licenses.mit; - mozPermissions = ["webRequest" "webRequestBlocking" "<all_urls>"]; + mozPermissions = [ + "webRequest" + "webRequestBlocking" + "<all_urls>" + ]; platforms = platforms.all; }; }; diff --git a/modules/nixos/firefox/default.nix b/modules/nixos/firefox/default.nix index 6d1b31b..881e9ad 100644 --- a/modules/nixos/firefox/default.nix +++ b/modules/nixos/firefox/default.nix @@ -5,9 +5,11 @@ pkgs, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.firefox; -in { +in +{ options.nixfiles.modules.firefox.enable = mkEnableOption "Firefox"; config = mkIf cfg.enable { @@ -18,13 +20,13 @@ in { ]; hm = { - imports = [inputs.arkenfox.hmModules.arkenfox]; + imports = [ inputs.arkenfox.hmModules.arkenfox ]; - home.packages = with pkgs; [profile-cleaner]; + home.packages = with pkgs; [ profile-cleaner ]; stylix.targets.firefox = { enable = true; - profileNames = ["default"]; + profileNames = [ "default" ]; }; programs.firefox = { @@ -34,37 +36,40 @@ in { arkenfox.enable = true; - profiles.default = let - mkCssWithRoot = css: - mkMerge [ - # https://github.com/tinted-theming/base24/blob/master/styling.md - (with config.colors.withHashtag; '' - :root { - --black: ${base01}; - --red: ${base08}; - --green: ${base0B}; - --yellow: ${base09}; - --blue: ${base0D}; - --magenta: ${base0E}; - --cyan: ${base0C}; - --white: ${base06}; - --bright-black: ${base02}; - --bright-red: ${base12}; - --bright-green: ${base14}; - --bright-yellow: ${base13}; - --bright-blue: ${base16}; - --bright-magenta: ${base17}; - --bright-cyan: ${base15}; - --bright-white: ${base07}; - --background: ${base00}; - --foreground: ${base05}; - '') - ( - let - mapFonts = concatMapStringsSep ", " (font: ''"${font}"''); - size = toString config.stylix.fonts.sizes.applications; - in - with config.fonts.fontconfig.defaultFonts; '' + profiles.default = + let + mkCssWithRoot = + css: + mkMerge [ + # https://github.com/tinted-theming/base24/blob/master/styling.md + (with config.colors.withHashtag; '' + :root { + --black: ${base01}; + --red: ${base08}; + --green: ${base0B}; + --yellow: ${base09}; + --blue: ${base0D}; + --magenta: ${base0E}; + --cyan: ${base0C}; + --white: ${base06}; + --bright-black: ${base02}; + --bright-red: ${base12}; + --bright-green: ${base14}; + --bright-yellow: ${base13}; + --bright-blue: ${base16}; + --bright-magenta: ${base17}; + --bright-cyan: ${base15}; + --bright-white: ${base07}; + --background: ${base00}; + --foreground: ${base05}; + '') + ( + let + mapFonts = concatMapStringsSep ", " (font: ''"${font}"''); + size = toString config.stylix.fonts.sizes.applications; + in + with config.fonts.fontconfig.defaultFonts; + '' --serif-font-family: ${mapFonts serif}, serif; --serif-font-size: ${size}; --sans-serif-font-family: ${mapFonts sansSerif}, sans-serif; @@ -73,50 +78,54 @@ in { --monospace-font-size: ${size}; } '' - ) - (builtins.readFile css) - ]; - in { - id = 0; - - isDefault = true; - - userChrome = mkCssWithRoot ./userChrome.css; - - userContent = mkCssWithRoot ./userContent.css; - - extensions = let - # This was done using the incredible addon generator[1]. All credit - # goes to Robert Helgesson. - # - # [1]: https://sr.ht/~rycee/mozilla-addons-to-nix/ - buildFirefoxXpiAddon = makeOverridable ({ - stdenv ? pkgs.stdenv, - fetchurl ? pkgs.fetchurl, - pname, - version, - addonId, - url, - sha256, - meta, - ... - }: - stdenv.mkDerivation { - name = "${pname}-${version}"; - inherit meta; - src = fetchurl {inherit url sha256;}; - preferLocalBuild = true; - allowSubstitutes = true; - buildCommand = '' - dst="$out/share/mozilla/extensions/{ec8030f7-c20a-464f-9b0e-13a3a9e97384}" - mkdir -p "$dst" - install -v -m644 "$src" "$dst/${addonId}.xpi" - ''; - }); - - addons = import ./addons.nix {inherit buildFirefoxXpiAddon lib;}; + ) + (builtins.readFile css) + ]; in - with addons; + { + id = 0; + + isDefault = true; + + userChrome = mkCssWithRoot ./userChrome.css; + + userContent = mkCssWithRoot ./userContent.css; + + extensions = + let + # This was done using the incredible addon generator[1]. All credit + # goes to Robert Helgesson. + # + # [1]: https://sr.ht/~rycee/mozilla-addons-to-nix/ + buildFirefoxXpiAddon = makeOverridable ( + { + stdenv ? pkgs.stdenv, + fetchurl ? pkgs.fetchurl, + pname, + version, + addonId, + url, + sha256, + meta, + ... + }: + stdenv.mkDerivation { + name = "${pname}-${version}"; + inherit meta; + src = fetchurl { inherit url sha256; }; + preferLocalBuild = true; + allowSubstitutes = true; + buildCommand = '' + dst="$out/share/mozilla/extensions/{ec8030f7-c20a-464f-9b0e-13a3a9e97384}" + mkdir -p "$dst" + install -v -m644 "$src" "$dst/${addonId}.xpi" + ''; + } + ); + + addons = import ./addons.nix { inherit buildFirefoxXpiAddon lib; }; + in + with addons; [ bypass-paywalls consent-o-matic @@ -133,483 +142,434 @@ in { ] ++ optional config.nixfiles.modules.ipfs.enable ipfs-companion; - search = { - force = true; - - default = "DuckDuckGo"; - order = ["DuckDuckGo" "Yahoo" "Google"]; - - engines = let - getIcon = url: sha256: pkgs.fetchurl {inherit url sha256;}; - in { - "Amazon.com".metaData.hidden = true; - "Bing".metaData.hidden = true; - "Ebay".metaData.hidden = true; - - "2GIS" = { - urls = [{template = "https://2gis.ru/kazan/search/{searchTerms}";}]; - icon = - getIcon - "https://d-assets.2gis.ru/favicon.png" - "sha256-BlSaYRcUx9zhfJnVK5V7rsyft4qaueIEOONiCg+6aLE="; - definedAliases = ["@2gis"]; - }; - - "AliExpress" = { - urls = [{template = "https://aliexpress.ru/wholesale?SearchText={searchTerms}";}]; - icon = - getIcon - "https://ae01.alicdn.com/images/eng/wholesale/icon/aliexpress.ico" - "sha256-7xgem2pY2PNuv8as1YnS+U03GvDLLGjhcDLt69rtmaA="; - definedAliases = ["@aliexpress" "@ali"]; - }; - - "Ansible Galaxy" = { - urls = [{template = "https://galaxy.ansible.com/search?keywords={searchTerms}";}]; - icon = - getIcon - "https://galaxy.ansible.com/assets/favicon.ico" - "sha256-oAolpZhdKbVTraes6dDlafpvq/Vypu264vgKN4jzJk8="; - definedAliases = ["@ansible" "@galaxy" "@ag"]; - }; - - "Arch Wiki" = { - urls = [{template = "https://wiki.archlinux.org/index.php?search={searchTerms}";}]; - icon = - getIcon - "https://wiki.archlinux.org/favicon.ico" - "sha256-0uxMtT8myzTT7p9k6v5UxsguPKu+vHPlglNTMbnN1T0="; - definedAliases = ["@archwiki" "@aw"]; - }; - - "crates.io" = { - urls = [{template = "https://crates.io/search?q={searchTerms}";}]; - icon = - getIcon - "https://crates.io/favicon.ico" - "sha256-upooA/+m5KMUD1t4WFY3EOmytdpUFgNqUj12Auta1mM="; - definedAliases = ["@crates"]; - }; - - "Discogs" = { - urls = [{template = "https://www.discogs.com/search?q={searchTerms}";}]; - icon = - getIcon - "https://st.discogs.com/d56dcb7367720ea20f1b11a4385705517c7e7702/images/favicon.ico" - "sha256-zEDrbmcUf8XHUyYzNc6JsWzBioX8sm8tjScGHim5VTk="; - definedAliases = ["@discogs"]; - }; - - "Docker Hub" = { - urls = [{template = "https://hub.docker.com/search?q={searchTerms}";}]; - icon = - getIcon - "https://www.docker.com/wp-content/uploads/2023/04/cropped-Docker-favicon-32x32.png" - "sha256-4NmHGMaq31qoIvdlmy7fI3qTbkcp1/tJhqQu/9Ci4/c="; - definedAliases = ["@dockerhub" "@docker"]; - }; - - "Ecosia" = { - urls = [{template = "https://www.ecosia.org/search?q={searchTerms}";}]; - icon = - getIcon - "https://cdn-static.ecosia.org/static/icons/favicon.ico" - "sha256-uvPShG1yVh4C4zaJmGuhhr96V/NredB1Wte9O3U6QxA="; - definedAliases = ["@ecosia"]; - }; - - "Genius" = { - urls = [{template = "https://genius.com/search?q={searchTerms}";}]; - icon = - getIcon - "https://assets.genius.com/images/apple-touch-icon.png" - "sha256-M9YQEVg3T7hMO/xPfihR1aXfG+/pNiVOBCOtzx3GrkE="; - definedAliases = ["@genius"]; - }; - - "GitHub" = { - urls = [{template = "https://github.com/search?q={searchTerms}";}]; - icon = - getIcon - "https://github.githubassets.com/favicons/favicon-dark.svg" - "sha256-qu/d9ftvsntplFuxw9RFL8BpI9b2g5b6xfeGw6Ekh6w="; - definedAliases = ["@github" "@gh"]; - }; - - "godocs.io" = { - urls = [{template = "https://godocs.io/?q={searchTerms}";}]; - icon = - getIcon - "https://go.dev/images/favicon-gopher.svg" - "sha256-OlKpUUeYF8TtMoX4e0ERK1ocIb53OJ8ZDxvwJaQVM/0="; - definedAliases = ["@godocs"]; - }; - - "pkgs.go.dev" = { - urls = [{template = "https://pkg.go.dev/search?q={searchTerms}";}]; - icon = - getIcon - "https://go.dev/images/favicon-gopher.svg" - "sha256-OlKpUUeYF8TtMoX4e0ERK1ocIb53OJ8ZDxvwJaQVM/0="; - definedAliases = ["@gopkgs"]; - }; - - "Hackage" = { - urls = [{template = "https://hackage.haskell.org/packages/search?terms={searchTerms}";}]; - icon = - getIcon - "https://hackage.haskell.org/static/favicon.png" - "sha256-+6WAv93yaA3L2eheGKxklY/uRAvbKD1q/WcmufmhKxY="; - definedAliases = ["@hackage"]; - }; - - "Hoogle" = { - urls = [{template = "https://hoogle.haskell.org/?hoogle={searchTerms}";}]; - icon = - getIcon - "https://hoogle.haskell.org/favicon.png" - "sha256-6qmjRYDDRUwm6EdLoZB6o9XtoujsfDEQJ9xOu3Knei8="; - definedAliases = ["@hoogle"]; - }; - - "Jisho" = { - urls = [{template = "https://jisho.org/search/{searchTerms}";}]; - icon = - getIcon - "https://assets.jisho.org/assets/favicon-062c4a0240e1e6d72c38aa524742c2d558ee6234497d91dd6b75a182ea823d65.ico" - "sha256-BixKAkDh5tcsOKpSR0LC1VjuYjRJfZHda3WhguqCPWU="; - definedAliases = ["@jisho"]; - }; - - "コトバンク" = { - urls = [{template = "https://kotobank.jp/gs/?q={searchTerms}";}]; - icon = - getIcon - "https://kotobank.jp/favicon.ico" - "sha256-t+EzqURlQwznuBqa0GcBbqumvZqtU7HrEAjGUlqp1tg="; - definedAliases = ["@kotobank"]; - }; - - "Kubernetes" = { - urls = [{template = "https://kubernetes.io/search/?q={searchTerms}";}]; - icon = - getIcon - "https://kubernetes.io/images/favicon.png" - "sha256-YI5QvGQXoaTG3uUGQ/R99Xl2r+VqBAA1qqthzPbf8nQ="; - definedAliases = ["@kubernetes" "@k8s"]; - }; - - "Last.fm" = { - urls = [{template = "https://www.last.fm/search?q={searchTerms}";}]; - icon = - getIcon - "https://www.last.fm/static/images/favicon.702b239b6194.ico" - "sha256-ID+DfF+dZ5CzKiBp/psQPRD6r/06PZ0rVYiELWUt5Mw="; - definedAliases = ["@lastfm"]; - }; - - "MDN" = { - urls = [{template = "https://developer.mozilla.org/en-US/search?q={searchTerms}";}]; - icon = - getIcon - "https://developer.mozilla.org/favicon-48x48.cbbd161b.png" - "sha256-Wnd0BqQIKgroGmV+R8vqV9uNBwDvcxBrQ8hXOLOFeKY="; - definedAliases = ["@mdn"]; - }; - - "MELPA" = { - urls = [{template = "https://melpa.org/#/?q={searchTerms}";}]; - icon = - getIcon - "https://melpa.org/favicon.ico" - "sha256-bmlydqXBM8MUMC6cOTGSHPx6zN8tZFqmQ+srbXkSCA4="; - definedAliases = ["@melpa"]; - }; - - "MusicBrainz" = { - urls = [{template = "https://musicbrainz.org/search?type=artist&query={searchTerms}";}]; - icon = - getIcon - "https://musicbrainz.org/static/images/favicons/favicon-16x16.png" - "sha256-M5mKQurmO9AP0gfC+5OLwi8k4XWQy759eQrrKAeytl0="; - definedAliases = ["@musicbrainz" "@mb"]; - }; - - "NixOS Packages" = { - urls = [{template = "https://search.nixos.org/packages?channel=unstable&query={searchTerms}";}]; - icon = - getIcon - "https://nixos.org/favicon.png" - "sha256-awcsDbbpRcDJnJpRavj/IcKMReEektRcqKbE35IJTKQ="; - definedAliases = ["@nixpkgs" "@np"]; - }; - - "NixOS Options" = { - urls = [{template = "https://search.nixos.org/options?channel=unstable&query={searchTerms}";}]; - icon = - getIcon - "https://nixos.org/favicon.png" - "sha256-awcsDbbpRcDJnJpRavj/IcKMReEektRcqKbE35IJTKQ="; - definedAliases = ["@nixopts" "@no"]; - }; - - "NixOS Wiki" = { - urls = [{template = "https://nixos.wiki/index.php?search={searchTerms}";}]; - icon = - getIcon - "https://nixos.wiki/favicon.png" - "sha256-DE8IgVninF6Aq3iNMgerhvF1dpoXqDUSibtWSpf/dN4="; - definedAliases = ["@nixoswiki" "@nw"]; - }; - - "OpenStreetMap" = { - urls = [{template = "https://www.openstreetmap.org/search?query={searchTerms}";}]; - icon = - getIcon - "https://www.openstreetmap.org/assets/favicon-32x32-99b88fcadeef736889823c8a886b89d8cada9d4423a49a27de29bacc0a6bebd1.png" - "sha256-dt4QVbQPdb4neS/fwH3yOWOSbEdkjMZtAYnIeCfr7qI="; - definedAliases = ["@openstreetmap" "@osm" "@maps"]; - }; - - "ProtonDB" = { - urls = [{template = "https://www.protondb.com/search?q={searchTerms}";}]; - icon = - getIcon - "https://www.protondb.com/sites/protondb/images/favicon.ico" - "sha256-oauOp0EASNjMcThfzYJ2TfbaOYHBPL8LOp+9lmp4pmc="; - definedAliases = ["@protondb"]; - }; - - "PyPI" = { - urls = [{template = "https://pypi.org/search/?q={searchTerms}";}]; - icon = - getIcon - "https://pypi.org/static/images/logo-small.2a411bc6.svg" - "sha256-+fcSfcNxAMLIFkp+gh52c48lQORoyhcegUIFtuq/zYs="; - definedAliases = ["@pypi"]; - }; + search = { + force = true; - "Python Docs" = { - urls = [{template = "https://docs.python.org/3/search.html?q={searchTerms}";}]; - icon = - getIcon - "https://docs.python.org/3/_static/py.svg" - "sha256-WGW+i8wK+IhZSQPqARL2yNkjxXJsQIHoyFYRDMcznO8="; - definedAliases = ["@pydocs"]; - }; + default = "DuckDuckGo"; + order = [ + "DuckDuckGo" + "Yahoo" + "Google" + ]; - "Rate Your Music" = { - urls = [{template = "https://rateyourmusic.com/search?searchterm={searchTerms}";}]; - icon = - getIcon - "https://e.snmc.io/3.0/img/logo/sonemic-32.png" - "sha256-JpTt1tjBkUvDMTGrG7Hg2EiE8PR3RL7McodeZk1EpZA="; - definedAliases = ["@rym"]; - }; + engines = + let + getIcon = url: sha256: pkgs.fetchurl { inherit url sha256; }; + in + { + "Amazon.com".metaData.hidden = true; + "Bing".metaData.hidden = true; + "Ebay".metaData.hidden = true; + + "2GIS" = { + urls = [ { template = "https://2gis.ru/kazan/search/{searchTerms}"; } ]; + icon = getIcon "https://d-assets.2gis.ru/favicon.png" "sha256-BlSaYRcUx9zhfJnVK5V7rsyft4qaueIEOONiCg+6aLE="; + definedAliases = [ "@2gis" ]; + }; + + "AliExpress" = { + urls = [ { template = "https://aliexpress.ru/wholesale?SearchText={searchTerms}"; } ]; + icon = getIcon "https://ae01.alicdn.com/images/eng/wholesale/icon/aliexpress.ico" "sha256-7xgem2pY2PNuv8as1YnS+U03GvDLLGjhcDLt69rtmaA="; + definedAliases = [ + "@aliexpress" + "@ali" + ]; + }; + + "Ansible Galaxy" = { + urls = [ { template = "https://galaxy.ansible.com/search?keywords={searchTerms}"; } ]; + icon = getIcon "https://galaxy.ansible.com/assets/favicon.ico" "sha256-oAolpZhdKbVTraes6dDlafpvq/Vypu264vgKN4jzJk8="; + definedAliases = [ + "@ansible" + "@galaxy" + "@ag" + ]; + }; + + "Arch Wiki" = { + urls = [ { template = "https://wiki.archlinux.org/index.php?search={searchTerms}"; } ]; + icon = getIcon "https://wiki.archlinux.org/favicon.ico" "sha256-0uxMtT8myzTT7p9k6v5UxsguPKu+vHPlglNTMbnN1T0="; + definedAliases = [ + "@archwiki" + "@aw" + ]; + }; + + "crates.io" = { + urls = [ { template = "https://crates.io/search?q={searchTerms}"; } ]; + icon = getIcon "https://crates.io/favicon.ico" "sha256-upooA/+m5KMUD1t4WFY3EOmytdpUFgNqUj12Auta1mM="; + definedAliases = [ "@crates" ]; + }; + + "Discogs" = { + urls = [ { template = "https://www.discogs.com/search?q={searchTerms}"; } ]; + icon = getIcon "https://st.discogs.com/d56dcb7367720ea20f1b11a4385705517c7e7702/images/favicon.ico" "sha256-zEDrbmcUf8XHUyYzNc6JsWzBioX8sm8tjScGHim5VTk="; + definedAliases = [ "@discogs" ]; + }; + + "Docker Hub" = { + urls = [ { template = "https://hub.docker.com/search?q={searchTerms}"; } ]; + icon = getIcon "https://www.docker.com/wp-content/uploads/2023/04/cropped-Docker-favicon-32x32.png" "sha256-4NmHGMaq31qoIvdlmy7fI3qTbkcp1/tJhqQu/9Ci4/c="; + definedAliases = [ + "@dockerhub" + "@docker" + ]; + }; + + "Ecosia" = { + urls = [ { template = "https://www.ecosia.org/search?q={searchTerms}"; } ]; + icon = getIcon "https://cdn-static.ecosia.org/static/icons/favicon.ico" "sha256-uvPShG1yVh4C4zaJmGuhhr96V/NredB1Wte9O3U6QxA="; + definedAliases = [ "@ecosia" ]; + }; + + "Genius" = { + urls = [ { template = "https://genius.com/search?q={searchTerms}"; } ]; + icon = getIcon "https://assets.genius.com/images/apple-touch-icon.png" "sha256-M9YQEVg3T7hMO/xPfihR1aXfG+/pNiVOBCOtzx3GrkE="; + definedAliases = [ "@genius" ]; + }; + + "GitHub" = { + urls = [ { template = "https://github.com/search?q={searchTerms}"; } ]; + icon = getIcon "https://github.githubassets.com/favicons/favicon-dark.svg" "sha256-qu/d9ftvsntplFuxw9RFL8BpI9b2g5b6xfeGw6Ekh6w="; + definedAliases = [ + "@github" + "@gh" + ]; + }; + + "godocs.io" = { + urls = [ { template = "https://godocs.io/?q={searchTerms}"; } ]; + icon = getIcon "https://go.dev/images/favicon-gopher.svg" "sha256-OlKpUUeYF8TtMoX4e0ERK1ocIb53OJ8ZDxvwJaQVM/0="; + definedAliases = [ "@godocs" ]; + }; + + "pkgs.go.dev" = { + urls = [ { template = "https://pkg.go.dev/search?q={searchTerms}"; } ]; + icon = getIcon "https://go.dev/images/favicon-gopher.svg" "sha256-OlKpUUeYF8TtMoX4e0ERK1ocIb53OJ8ZDxvwJaQVM/0="; + definedAliases = [ "@gopkgs" ]; + }; + + "Hackage" = { + urls = [ { template = "https://hackage.haskell.org/packages/search?terms={searchTerms}"; } ]; + icon = getIcon "https://hackage.haskell.org/static/favicon.png" "sha256-+6WAv93yaA3L2eheGKxklY/uRAvbKD1q/WcmufmhKxY="; + definedAliases = [ "@hackage" ]; + }; + + "Hoogle" = { + urls = [ { template = "https://hoogle.haskell.org/?hoogle={searchTerms}"; } ]; + icon = getIcon "https://hoogle.haskell.org/favicon.png" "sha256-6qmjRYDDRUwm6EdLoZB6o9XtoujsfDEQJ9xOu3Knei8="; + definedAliases = [ "@hoogle" ]; + }; + + "Jisho" = { + urls = [ { template = "https://jisho.org/search/{searchTerms}"; } ]; + icon = getIcon "https://assets.jisho.org/assets/favicon-062c4a0240e1e6d72c38aa524742c2d558ee6234497d91dd6b75a182ea823d65.ico" "sha256-BixKAkDh5tcsOKpSR0LC1VjuYjRJfZHda3WhguqCPWU="; + definedAliases = [ "@jisho" ]; + }; + + "コトバンク" = { + urls = [ { template = "https://kotobank.jp/gs/?q={searchTerms}"; } ]; + icon = getIcon "https://kotobank.jp/favicon.ico" "sha256-t+EzqURlQwznuBqa0GcBbqumvZqtU7HrEAjGUlqp1tg="; + definedAliases = [ "@kotobank" ]; + }; + + "Kubernetes" = { + urls = [ { template = "https://kubernetes.io/search/?q={searchTerms}"; } ]; + icon = getIcon "https://kubernetes.io/images/favicon.png" "sha256-YI5QvGQXoaTG3uUGQ/R99Xl2r+VqBAA1qqthzPbf8nQ="; + definedAliases = [ + "@kubernetes" + "@k8s" + ]; + }; + + "Last.fm" = { + urls = [ { template = "https://www.last.fm/search?q={searchTerms}"; } ]; + icon = getIcon "https://www.last.fm/static/images/favicon.702b239b6194.ico" "sha256-ID+DfF+dZ5CzKiBp/psQPRD6r/06PZ0rVYiELWUt5Mw="; + definedAliases = [ "@lastfm" ]; + }; + + "MDN" = { + urls = [ { template = "https://developer.mozilla.org/en-US/search?q={searchTerms}"; } ]; + icon = getIcon "https://developer.mozilla.org/favicon-48x48.cbbd161b.png" "sha256-Wnd0BqQIKgroGmV+R8vqV9uNBwDvcxBrQ8hXOLOFeKY="; + definedAliases = [ "@mdn" ]; + }; + + "MELPA" = { + urls = [ { template = "https://melpa.org/#/?q={searchTerms}"; } ]; + icon = getIcon "https://melpa.org/favicon.ico" "sha256-bmlydqXBM8MUMC6cOTGSHPx6zN8tZFqmQ+srbXkSCA4="; + definedAliases = [ "@melpa" ]; + }; + + "MusicBrainz" = { + urls = [ { template = "https://musicbrainz.org/search?type=artist&query={searchTerms}"; } ]; + icon = getIcon "https://musicbrainz.org/static/images/favicons/favicon-16x16.png" "sha256-M5mKQurmO9AP0gfC+5OLwi8k4XWQy759eQrrKAeytl0="; + definedAliases = [ + "@musicbrainz" + "@mb" + ]; + }; + + "NixOS Packages" = { + urls = [ { template = "https://search.nixos.org/packages?channel=unstable&query={searchTerms}"; } ]; + icon = getIcon "https://nixos.org/favicon.png" "sha256-awcsDbbpRcDJnJpRavj/IcKMReEektRcqKbE35IJTKQ="; + definedAliases = [ + "@nixpkgs" + "@np" + ]; + }; + + "NixOS Options" = { + urls = [ { template = "https://search.nixos.org/options?channel=unstable&query={searchTerms}"; } ]; + icon = getIcon "https://nixos.org/favicon.png" "sha256-awcsDbbpRcDJnJpRavj/IcKMReEektRcqKbE35IJTKQ="; + definedAliases = [ + "@nixopts" + "@no" + ]; + }; + + "NixOS Wiki" = { + urls = [ { template = "https://nixos.wiki/index.php?search={searchTerms}"; } ]; + icon = getIcon "https://nixos.wiki/favicon.png" "sha256-DE8IgVninF6Aq3iNMgerhvF1dpoXqDUSibtWSpf/dN4="; + definedAliases = [ + "@nixoswiki" + "@nw" + ]; + }; + + "OpenStreetMap" = { + urls = [ { template = "https://www.openstreetmap.org/search?query={searchTerms}"; } ]; + icon = getIcon "https://www.openstreetmap.org/assets/favicon-32x32-99b88fcadeef736889823c8a886b89d8cada9d4423a49a27de29bacc0a6bebd1.png" "sha256-dt4QVbQPdb4neS/fwH3yOWOSbEdkjMZtAYnIeCfr7qI="; + definedAliases = [ + "@openstreetmap" + "@osm" + "@maps" + ]; + }; + + "ProtonDB" = { + urls = [ { template = "https://www.protondb.com/search?q={searchTerms}"; } ]; + icon = getIcon "https://www.protondb.com/sites/protondb/images/favicon.ico" "sha256-oauOp0EASNjMcThfzYJ2TfbaOYHBPL8LOp+9lmp4pmc="; + definedAliases = [ "@protondb" ]; + }; + + "PyPI" = { + urls = [ { template = "https://pypi.org/search/?q={searchTerms}"; } ]; + icon = getIcon "https://pypi.org/static/images/logo-small.2a411bc6.svg" "sha256-+fcSfcNxAMLIFkp+gh52c48lQORoyhcegUIFtuq/zYs="; + definedAliases = [ "@pypi" ]; + }; + + "Python Docs" = { + urls = [ { template = "https://docs.python.org/3/search.html?q={searchTerms}"; } ]; + icon = getIcon "https://docs.python.org/3/_static/py.svg" "sha256-WGW+i8wK+IhZSQPqARL2yNkjxXJsQIHoyFYRDMcznO8="; + definedAliases = [ "@pydocs" ]; + }; + + "Rate Your Music" = { + urls = [ { template = "https://rateyourmusic.com/search?searchterm={searchTerms}"; } ]; + icon = getIcon "https://e.snmc.io/3.0/img/logo/sonemic-32.png" "sha256-JpTt1tjBkUvDMTGrG7Hg2EiE8PR3RL7McodeZk1EpZA="; + definedAliases = [ "@rym" ]; + }; + + "Rust Std" = { + urls = [ { template = "https://doc.rust-lang.org/std/?search={searchTerms}"; } ]; + icon = getIcon "https://www.rust-lang.org/static/images/favicon-32x32.png" "sha256-l2y4jpnODbua4dyLvXTMBlHVkoDPM9y00l6L61so7eA="; + definedAliases = [ + "@ruststd" + "@rust" + ]; + }; + + "SourceHut" = { + urls = [ { template = "https://sr.ht/projects?search={searchTerms}"; } ]; + icon = getIcon "https://sr.ht/static/logo.png" "sha256-NBzKZhqE9//zVJlOwYiwyW/jRFh8+nS2YvC3zMCQ1fU="; + definedAliases = [ + "@sourcehut" + "@srht" + ]; + }; + + "SteamDB" = { + urls = [ { template = "https://steamdb.info/search/?a=app&q={searchTerms}"; } ]; + icon = getIcon "https://steamdb.info/static/logos/32px.png" "sha256-IUBiB5JUSvyDa+m/wecmHB8s3Wfu0JK98bJ+ZRZ5ybQ="; + definedAliases = [ "@steamdb" ]; + }; + + "WolframAlpha" = { + urls = [ { template = "https://www.wolframalpha.com/input?i={searchTerms}"; } ]; + icon = getIcon "https://www.wolframalpha.com/_next/static/images/favicon_1zbE9hjk.ico" "sha256-S9k7AlBQiDElBCGopJ8xfBD6dIhGU+EBh8t1QYbP2S4="; + definedAliases = [ + "@wolframalpha" + "@wa" + ]; + }; + + "Yahoo" = { + urls = [ { template = "https://yahoo.com/search/?text={searchTerms}"; } ]; + icon = getIcon "https://yahoostatic.net/s3/web4static/_/v2/oxjfXL1EO-B5Arm80ZrL00p0al4.png" "sha256-gvYh4oCZEO7BL2QZ6QvQFlmFiP2L4SLJrxAsKFcG6G4="; + definedAliases = [ + "@yahoo" + "@ya" + ]; + }; + + "YouTube" = { + urls = [ { template = "https://yewtu.be/search?q={}"; } ]; + icon = getIcon "https://www.youtube.com/s/desktop/280a3f09/img/favicon.ico" "sha256-i7HQ+kOhdDbVndVG9vdMdtxEc13vdSLCLYAxFm24kR0="; + definedAliases = [ + "@youtube" + "@yt" + ]; + }; + }; + }; - "Rust Std" = { - urls = [{template = "https://doc.rust-lang.org/std/?search={searchTerms}";}]; - icon = - getIcon - "https://www.rust-lang.org/static/images/favicon-32x32.png" - "sha256-l2y4jpnODbua4dyLvXTMBlHVkoDPM9y00l6L61so7eA="; - definedAliases = ["@ruststd" "@rust"]; - }; + # NOTE This silently overrides all other bookmarks. + bookmarks = [ + { + name = "Bookmarks Toolbar"; + toolbar = true; + bookmarks = with config.nixfiles.modules; [ + (mkIf syncthing.enable { + name = "Syncthing"; + url = "http://${config.services.syncthing.guiAddress}"; + }) + (mkIf ipfs.enable { + name = "IPFS"; + url = "http://127.0.0.1:${toString ipfs.apiPort}/webui"; + }) + ]; + } + ]; - "SourceHut" = { - urls = [{template = "https://sr.ht/projects?search={searchTerms}";}]; - icon = - getIcon - "https://sr.ht/static/logo.png" - "sha256-NBzKZhqE9//zVJlOwYiwyW/jRFh8+nS2YvC3zMCQ1fU="; - definedAliases = ["@sourcehut" "@srht"]; + # https://github.com/arkenfox/user.js/blob/master/user.js + arkenfox = { + enable = true; + "0000".enable = true; + "0100" = { + enable = true; + "0103"."browser.startup.homepage".value = "about:blank"; }; - - "SteamDB" = { - urls = [{template = "https://steamdb.info/search/?a=app&q={searchTerms}";}]; - icon = - getIcon - "https://steamdb.info/static/logos/32px.png" - "sha256-IUBiB5JUSvyDa+m/wecmHB8s3Wfu0JK98bJ+ZRZ5ybQ="; - definedAliases = ["@steamdb"]; + "0200".enable = true; + "0300".enable = true; + "0400" = { + enable = true; + "0401"."browser.safebrowsing.phishing.enabled".enable = true; + "0402"."browser.safebrowsing.downloads.enabled".enable = true; + "0404" = { + "browser.safebrowsing.downloads.remote.block_potentially_unwanted".enable = true; + "browser.safebrowsing.downloads.remote.block_uncommon".enable = true; + }; + "0405"."browser.safebrowsing.allowOverride".enable = true; }; - - "WolframAlpha" = { - urls = [{template = "https://www.wolframalpha.com/input?i={searchTerms}";}]; - icon = - getIcon - "https://www.wolframalpha.com/_next/static/images/favicon_1zbE9hjk.ico" - "sha256-S9k7AlBQiDElBCGopJ8xfBD6dIhGU+EBh8t1QYbP2S4="; - definedAliases = ["@wolframalpha" "@wa"]; + "0600".enable = true; + "0700" = { + enable = true; + "0710"."network.trr.mode" = { + enable = true; + value = 5; + }; }; - - "Yahoo" = { - urls = [{template = "https://yahoo.com/search/?text={searchTerms}";}]; - icon = - getIcon - "https://yahoostatic.net/s3/web4static/_/v2/oxjfXL1EO-B5Arm80ZrL00p0al4.png" - "sha256-gvYh4oCZEO7BL2QZ6QvQFlmFiP2L4SLJrxAsKFcG6G4="; - definedAliases = ["@yahoo" "@ya"]; + "0800" = { + enable = true; + "0830" = { + "browser.search.separatePrivateDefault" = { + enable = true; + value = false; + }; + "browser.search.separatePrivateDefault.ui.enabled" = { + enable = true; + value = false; + }; + }; }; - - "YouTube" = { - urls = [{template = "https://yewtu.be/search?q={}";}]; - icon = - getIcon - "https://www.youtube.com/s/desktop/280a3f09/img/favicon.ico" - "sha256-i7HQ+kOhdDbVndVG9vdMdtxEc13vdSLCLYAxFm24kR0="; - definedAliases = ["@youtube" "@yt"]; + "0900".enable = true; + "1000" = { + enable = true; + "1001".enable = false; + }; + "1200".enable = true; + "1600".enable = true; + "1700".enable = true; + "2000".enable = true; + "2400".enable = true; + "2600" = { + enable = true; + "2615"."permissions.default.shortcuts".enable = true; }; - }; - }; - - # NOTE This silently overrides all other bookmarks. - bookmarks = [ - { - name = "Bookmarks Toolbar"; - toolbar = true; - bookmarks = with config.nixfiles.modules; [ - (mkIf syncthing.enable { - name = "Syncthing"; - url = "http://${config.services.syncthing.guiAddress}"; - }) - (mkIf ipfs.enable { - name = "IPFS"; - url = "http://127.0.0.1:${toString ipfs.apiPort}/webui"; - }) - ]; - } - ]; - - # https://github.com/arkenfox/user.js/blob/master/user.js - arkenfox = { - enable = true; - "0000".enable = true; - "0100" = { - enable = true; - "0103"."browser.startup.homepage".value = "about:blank"; - }; - "0200".enable = true; - "0300".enable = true; - "0400" = { - enable = true; - "0401"."browser.safebrowsing.phishing.enabled".enable = true; - "0402"."browser.safebrowsing.downloads.enabled".enable = true; - "0404" = { - "browser.safebrowsing.downloads.remote.block_potentially_unwanted".enable = true; - "browser.safebrowsing.downloads.remote.block_uncommon".enable = true; + "2700".enable = true; + "2800" = { + enable = true; + "2811"."privacy.clearOnShutdown.history".value = false; }; - "0405"."browser.safebrowsing.allowOverride".enable = true; - }; - "0600".enable = true; - "0700" = { - enable = true; - "0710"."network.trr.mode" = { + "4500" = { enable = true; - value = 5; + "4502".enable = false; + "4504".enable = false; }; - }; - "0800" = { - enable = true; - "0830" = { - "browser.search.separatePrivateDefault" = { - enable = true; - value = false; - }; - "browser.search.separatePrivateDefault.ui.enabled" = { - enable = true; - value = false; + "5000" = { + enable = true; + "5003"."signon.rememberSignons".enable = true; + "5017" = { + "extensions.formautofill.addresses.enabled".enable = true; + "extensions.formautofill.creditCards.enabled".enable = true; }; + "5019"."browser.pagethumbnails.capturing_disabled".enable = true; }; - }; - "0900".enable = true; - "1000" = { - enable = true; - "1001".enable = false; - }; - "1200".enable = true; - "1600".enable = true; - "1700".enable = true; - "2000".enable = true; - "2400".enable = true; - "2600" = { - enable = true; - "2615"."permissions.default.shortcuts".enable = true; - }; - "2700".enable = true; - "2800" = { - enable = true; - "2811"."privacy.clearOnShutdown.history".value = false; - }; - "4500" = { - enable = true; - "4502".enable = false; - "4504".enable = false; - }; - "5000" = { - enable = true; - "5003"."signon.rememberSignons".enable = true; - "5017" = { - "extensions.formautofill.addresses.enabled".enable = true; - "extensions.formautofill.creditCards.enabled".enable = true; + "5500" = { + enable = true; + "5508"."media.eme.enabled".enable = true; + "5508"."browser.eme.ui.enabled".enable = true; }; - "5019"."browser.pagethumbnails.capturing_disabled".enable = true; + "6000".enable = true; + "7000".enable = true; + "8000".enable = true; + "9000".enable = true; }; - "5500" = { - enable = true; - "5508"."media.eme.enabled".enable = true; - "5508"."browser.eme.ui.enabled".enable = true; - }; - "6000".enable = true; - "7000".enable = true; - "8000".enable = true; - "9000".enable = true; - }; - settings = { - "app.update.auto" = false; - "browser.backspace_action" = 0; - "browser.disableResetPrompt" = true; - "browser.download.autohideButton" = false; - "browser.newtabpage.introShown" = true; - "browser.newtabpage.pinned" = ""; - "browser.onboarding.enabled" = false; - "browser.open.lastDir" = config.my.home; - "browser.protections_panel.infoMessage.seen" = true; - "browser.region.update.region" = "US"; - "browser.search.region" = "US"; - "browser.search.update" = false; - "browser.shell.checkDefaultBrowser" = false; - "browser.tabs.closeWindowWithLastTab" = true; - "browser.tabs.firefox-view" = false; - "browser.tabs.firefox-view-next" = false; - "browser.tabs.inTitlebar" = 0; - "browser.tabs.tabmanager.enabled" = false; - "browser.tabs.warnOnClose" = false; - "browser.tabs.warnOnCloseOtherTabs" = false; - "browser.tabs.warnOnOpen" = false; - "browser.toolbars.bookmarks.visibility" = "newtab"; - "browser.translations.enable" = false; - "browser.urlbar.decodeURLsOnCopy" = true; - "browser.urlbar.suggest.engines" = false; - "browser.warnOnQuitShortcut" = false; - "devtools.everOpened" = true; - "doh-rollout.home-region" = "US"; - "extensions.pocket.enabled" = false; - "extensions.update.autoUpdateDefault" = false; - "extensions.update.enabled" = false; - "full-screen-api.warning.delay" = 0; - "full-screen-api.warning.timeout" = 0; - "general.autoScroll" = true; - "general.smoothScroll" = true; - "identity.fxaccounts.enabled" = false; - "media.autoplay.blocking_policy" = 2; - "media.autoplay.default" = 5; - "media.hardwaremediakeys.enabled" = false; - "reader.parse-on-load.enabled" = false; - "toolkit.legacyUserProfileCustomizations.stylesheets" = true; + settings = { + "app.update.auto" = false; + "browser.backspace_action" = 0; + "browser.disableResetPrompt" = true; + "browser.download.autohideButton" = false; + "browser.newtabpage.introShown" = true; + "browser.newtabpage.pinned" = ""; + "browser.onboarding.enabled" = false; + "browser.open.lastDir" = config.my.home; + "browser.protections_panel.infoMessage.seen" = true; + "browser.region.update.region" = "US"; + "browser.search.region" = "US"; + "browser.search.update" = false; + "browser.shell.checkDefaultBrowser" = false; + "browser.tabs.closeWindowWithLastTab" = true; + "browser.tabs.firefox-view" = false; + "browser.tabs.firefox-view-next" = false; + "browser.tabs.inTitlebar" = 0; + "browser.tabs.tabmanager.enabled" = false; + "browser.tabs.warnOnClose" = false; + "browser.tabs.warnOnCloseOtherTabs" = false; + "browser.tabs.warnOnOpen" = false; + "browser.toolbars.bookmarks.visibility" = "newtab"; + "browser.translations.enable" = false; + "browser.urlbar.decodeURLsOnCopy" = true; + "browser.urlbar.suggest.engines" = false; + "browser.warnOnQuitShortcut" = false; + "devtools.everOpened" = true; + "doh-rollout.home-region" = "US"; + "extensions.pocket.enabled" = false; + "extensions.update.autoUpdateDefault" = false; + "extensions.update.enabled" = false; + "full-screen-api.warning.delay" = 0; + "full-screen-api.warning.timeout" = 0; + "general.autoScroll" = true; + "general.smoothScroll" = true; + "identity.fxaccounts.enabled" = false; + "media.autoplay.blocking_policy" = 2; + "media.autoplay.default" = 5; + "media.hardwaremediakeys.enabled" = false; + "reader.parse-on-load.enabled" = false; + "toolkit.legacyUserProfileCustomizations.stylesheets" = true; + }; }; - }; }; }; }; diff --git a/modules/nixos/foot.nix b/modules/nixos/foot.nix new file mode 100644 index 0000000..502e143 --- /dev/null +++ b/modules/nixos/foot.nix @@ -0,0 +1,34 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; +let + cfg = config.nixfiles.modules.foot; +in +{ + options.nixfiles.modules.foot.enable = mkEnableOption "Foot terminal emulator"; + + config = mkIf cfg.enable { + hm = { + home.packages = with pkgs; [ libsixel ]; + + programs.foot = { + enable = true; + settings = { + main = { + utmp-helper = "${pkgs.libutempter}/lib/utempter/utempter"; + pad = + let + n = toString config.stylix.fonts.sizes.terminal; + in + "${n}x${n}"; + }; + scrollback.lines = pow 2 14; + }; + }; + }; + }; +} diff --git a/modules/nixos/games/default.nix b/modules/nixos/games/default.nix index 78aae62..585164e 100644 --- a/modules/nixos/games/default.nix +++ b/modules/nixos/games/default.nix @@ -1,11 +1,9 @@ -{ - config, - lib, - ... -}: -with lib; let +{ config, lib, ... }: +with lib; +let cfg = config.nixfiles.modules.games; -in { +in +{ imports = [ ./gamemode.nix ./lutris.nix @@ -15,8 +13,7 @@ in { ./steam.nix ]; - options.nixfiles.modules.games.enable32BitSupport = - mkEnableOption "support for games"; + options.nixfiles.modules.games.enable32BitSupport = mkEnableOption "support for games"; config = mkIf cfg.enable32BitSupport { services = { diff --git a/modules/nixos/games/gamemode.nix b/modules/nixos/games/gamemode.nix index 193a764..eb485f8 100644 --- a/modules/nixos/games/gamemode.nix +++ b/modules/nixos/games/gamemode.nix @@ -1,18 +1,13 @@ -{ - config, - lib, - ... -}: -with lib; let +{ config, lib, ... }: +with lib; +let cfg = config.nixfiles.modules.games.gamemode; -in { - options.nixfiles.modules.games.gamemode.enable = - mkEnableOption "Feral GameMode"; +in +{ + options.nixfiles.modules.games.gamemode.enable = mkEnableOption "Feral GameMode"; config = mkIf cfg.enable { - hm.xdg.configFile."gamemode.ini".text = generators.toINI {} { - general.softrealtime = "auto"; - }; + hm.xdg.configFile."gamemode.ini".text = generators.toINI { } { general.softrealtime = "auto"; }; programs.gamemode.enable = true; }; diff --git a/modules/nixos/games/lutris.nix b/modules/nixos/games/lutris.nix index f130be3..62fe521 100644 --- a/modules/nixos/games/lutris.nix +++ b/modules/nixos/games/lutris.nix @@ -4,9 +4,11 @@ pkgs, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.games.lutris; -in { +in +{ options.nixfiles.modules.games.lutris.enable = mkEnableOption "Lutris"; config = mkIf cfg.enable { diff --git a/modules/nixos/games/mangohud.nix b/modules/nixos/games/mangohud.nix index 509e035..955f50c 100644 --- a/modules/nixos/games/mangohud.nix +++ b/modules/nixos/games/mangohud.nix @@ -1,11 +1,9 @@ -{ - config, - lib, - ... -}: -with lib; let +{ config, lib, ... }: +with lib; +let cfg = config.nixfiles.modules.games.mangohud; -in { +in +{ options.nixfiles.modules.games.mangohud.enable = mkEnableOption "MangoHud"; config = mkIf cfg.enable { diff --git a/modules/nixos/games/minecraft.nix b/modules/nixos/games/minecraft.nix index 8a1a0b5..6e163dc 100644 --- a/modules/nixos/games/minecraft.nix +++ b/modules/nixos/games/minecraft.nix @@ -5,10 +5,12 @@ pkgs, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.games.minecraft; -in { - imports = [inputs.minecraft.nixosModules.minecraft-servers]; +in +{ + imports = [ inputs.minecraft.nixosModules.minecraft-servers ]; options.nixfiles.modules.games.minecraft = { client.enable = mkEnableOption "Minecraft client"; @@ -30,13 +32,11 @@ in { }; config = mkMerge [ - (mkIf cfg.client.enable { - hm.home.packages = [pkgs.prismlauncher]; - }) + (mkIf cfg.client.enable { hm.home.packages = [ pkgs.prismlauncher ]; }) (mkIf cfg.server.enable { - nixfiles.modules.common.nix.allowedUnfreePackages = ["minecraft-server"]; + nixfiles.modules.common.nix.allowedUnfreePackages = [ "minecraft-server" ]; - ark.directories = [config.services.minecraft-servers.dataDir]; + ark.directories = [ config.services.minecraft-servers.dataDir ]; services.minecraft-servers = { enable = true; @@ -78,9 +78,9 @@ in { }; }; - nixpkgs.overlays = [inputs.minecraft.overlay]; + nixpkgs.overlays = [ inputs.minecraft.overlay ]; - my.extraGroups = [config.services.minecraft-servers.group]; + my.extraGroups = [ config.services.minecraft-servers.group ]; }) ]; } diff --git a/modules/nixos/games/steam-run.nix b/modules/nixos/games/steam-run.nix index fc51c85..cfee8ae 100644 --- a/modules/nixos/games/steam-run.nix +++ b/modules/nixos/games/steam-run.nix @@ -4,9 +4,11 @@ pkgs, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.games.steam-run; -in { +in +{ options.nixfiles.modules.games.steam-run = { enable = mkEnableOption "native Steam runtime"; @@ -19,7 +21,10 @@ in { config = mkIf cfg.enable { nixfiles.modules = { - common.nix.allowedUnfreePackages = ["steam" "steam-run"]; + common.nix.allowedUnfreePackages = [ + "steam" + "steam-run" + ]; games = { enable32BitSupport = true; @@ -30,46 +35,55 @@ in { hm.home.packages = with pkgs; [ (steam.override { - extraLibraries = _: + extraLibraries = + _: with cfg.quirks; - optional blackIsleStudios openssl_1_0_0 - ++ optionals cryptOfTheNecrodancer [ - (import (builtins.fetchTarball { - url = "https://github.com/NixOS/nixpkgs/archive/d1c3fea7ecbed758168787fe4e4a3157e52bc808.tar.gz"; - sha256 = "0ykm15a690v8lcqf2j899za3j6hak1rm3xixdxsx33nz7n3swsyy"; - }) {inherit (config.nixpkgs) config localSystem;}) - .flac - ] - ++ optionals mountAndBladeWarband [ - (glew.overrideAttrs (_: super: let + optional blackIsleStudios openssl_1_0_0 + ++ optionals cryptOfTheNecrodancer [ + (import (builtins.fetchTarball { + url = "https://github.com/NixOS/nixpkgs/archive/d1c3fea7ecbed758168787fe4e4a3157e52bc808.tar.gz"; + sha256 = "0ykm15a690v8lcqf2j899za3j6hak1rm3xixdxsx33nz7n3swsyy"; + }) { inherit (config.nixpkgs) config localSystem; }).flac + ] + ++ optionals mountAndBladeWarband [ + (glew.overrideAttrs ( + _: super: + let opname = super.pname; - in rec { + in + rec { pname = "${opname}-steam-run-fix"; inherit (super) version; src = fetchurl { url = "mirror://sourceforge/${opname}/${opname}-${version}.tgz"; hash = "sha256-BN6R5+Z2MDm8EZQAlc2cf4gLq6ghlqd2X3J6wFqZPJU="; }; - })) - (fmodex.overrideAttrs (_: super: let + } + )) + (fmodex.overrideAttrs ( + _: super: + let opname = super.pname; - in rec { + in + rec { pname = "${opname}-steam-run-fix"; inherit (super) version; - installPhase = let - libPath = makeLibraryPath [ - alsa-lib - libpulseaudio - stdenv.cc.cc - ]; - in '' - install -Dm755 api/lib/libfmodex64-${version}.so $out/lib/libfmodex64.so - patchelf --set-rpath ${libPath} $out/lib/libfmodex64.so - ''; - })) - ]; - }) - .run + installPhase = + let + libPath = makeLibraryPath [ + alsa-lib + libpulseaudio + stdenv.cc.cc + ]; + in + '' + install -Dm755 api/lib/libfmodex64-${version}.so $out/lib/libfmodex64.so + patchelf --set-rpath ${libPath} $out/lib/libfmodex64.so + ''; + } + )) + ]; + }).run ]; }; } diff --git a/modules/nixos/games/steam.nix b/modules/nixos/games/steam.nix index 7262d7f..5883b0e 100644 --- a/modules/nixos/games/steam.nix +++ b/modules/nixos/games/steam.nix @@ -4,15 +4,19 @@ pkgs, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.games.steam; -in { - options.nixfiles.modules.games.steam.enable = - mkEnableOption "Steam runtime"; +in +{ + options.nixfiles.modules.games.steam.enable = mkEnableOption "Steam runtime"; config = mkIf cfg.enable { nixfiles.modules = { - common.nix.allowedUnfreePackages = ["steam" "steam-original"]; + common.nix.allowedUnfreePackages = [ + "steam" + "steam-original" + ]; games = { enable32BitSupport = true; @@ -22,7 +26,7 @@ in { }; hm.home.packages = with pkgs; [ - (steam.override {extraEnv.MANGOHUD = 1;}) + (steam.override { extraEnv.MANGOHUD = 1; }) protontricks ]; }; diff --git a/modules/nixos/git/default.nix b/modules/nixos/git/default.nix index cbeb48a..34ca200 100644 --- a/modules/nixos/git/default.nix +++ b/modules/nixos/git/default.nix @@ -6,9 +6,11 @@ pkgs, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.git; -in { +in +{ options.nixfiles.modules.git.server = { enable = mkEnableOption "Git server"; @@ -26,59 +28,59 @@ in { }; config = mkIf cfg.server.enable { - ark.directories = [ - config.services.gitolite.dataDir - ]; + ark.directories = [ config.services.gitolite.dataDir ]; nixfiles.modules.nginx = { enable = true; virtualHosts.${cfg.server.domain} = { locations = { - "/".extraConfig = let - cgitrc = pkgs.writeText "cgitrc" '' - root-title=github sux (⩺_⩹) - root-desc=https://github.com/azahi + "/".extraConfig = + let + cgitrc = pkgs.writeText "cgitrc" '' + root-title=github sux (⩺_⩹) + root-desc=https://github.com/azahi - clone-url=https://${cfg.server.domain}/$CGIT_REPO_URL + clone-url=https://${cfg.server.domain}/$CGIT_REPO_URL - logo=/cgit-custom-logo.gif - favicon=/cgit-custom-favicon.gif - css=/cgit-custom-style.css + logo=/cgit-custom-logo.gif + favicon=/cgit-custom-favicon.gif + css=/cgit-custom-style.css - about-filter=${cfg.server.package}/lib/cgit/filters/about-formatting.sh - source-filter=${cfg.server.package}/lib/cgit/filters/syntax-highlighting.py - commit-filter=${cfg.server.package}/lib/cgit/filters/commit-links.sh + about-filter=${cfg.server.package}/lib/cgit/filters/about-formatting.sh + source-filter=${cfg.server.package}/lib/cgit/filters/syntax-highlighting.py + commit-filter=${cfg.server.package}/lib/cgit/filters/commit-links.sh - enable-git-config=1 - enable-gitweb-owner=1 - remove-suffix=1 + enable-git-config=1 + enable-gitweb-owner=1 + remove-suffix=1 - readme=:README - readme=:README.md - readme=:README.org - readme=:README.txt - readme=:readme - readme=:readme.md - readme=:readme.org - readme=:readme.txt + readme=:README + readme=:README.md + readme=:README.org + readme=:README.txt + readme=:readme + readme=:readme.md + readme=:readme.org + readme=:readme.txt - scan-path=${config.services.gitolite.dataDir}/repositories - ''; - in '' - include ${config.services.nginx.package}/conf/fastcgi_params; - fastcgi_split_path_info ^(/?)(.+)$; - fastcgi_pass unix:${config.services.fcgiwrap.socketAddress}; - fastcgi_param SCRIPT_FILENAME ${cfg.server.package}/cgit/cgit.cgi; - fastcgi_param CGIT_CONFIG ${cgitrc}; - fastcgi_param PATH_INFO $uri; - fastcgi_param QUERY_STRING $args; - fastcgi_param HTTP_HOST $server_name; + scan-path=${config.services.gitolite.dataDir}/repositories + ''; + in + '' + include ${config.services.nginx.package}/conf/fastcgi_params; + fastcgi_split_path_info ^(/?)(.+)$; + fastcgi_pass unix:${config.services.fcgiwrap.socketAddress}; + fastcgi_param SCRIPT_FILENAME ${cfg.server.package}/cgit/cgit.cgi; + fastcgi_param CGIT_CONFIG ${cgitrc}; + fastcgi_param PATH_INFO $uri; + fastcgi_param QUERY_STRING $args; + fastcgi_param HTTP_HOST $server_name; - ${libNginx.config.appendHead [ - ''<meta name="go-import" content="$host$uri git https://$host$uri">'' - (libPlausible.htmlPlausibleScript {inherit (cfg.server) domain;}) - ]} - ''; + ${libNginx.config.appendHead [ + ''<meta name="go-import" content="$host$uri git https://$host$uri">'' + (libPlausible.htmlPlausibleScript { inherit (cfg.server) domain; }) + ]} + ''; "~* ^.+(cgit.css|robots.txt)$".extraConfig = '' root ${cfg.server.package}/cgit; ''; @@ -88,43 +90,47 @@ in { "~* ^.+cgit-custom-favicon.gif$".extraConfig = '' alias ${./favicon.ico}; ''; - "~* ^.+cgit-custom-style.css$".extraConfig = let - css = pkgs.writeText "custom.css" '' - @import url("cgit.css"); + "~* ^.+cgit-custom-style.css$".extraConfig = + let + css = pkgs.writeText "custom.css" '' + @import url("cgit.css"); - div#cgit { - font-family: monospace; - -moz-tab-size: 4; - tab-size: 4; - } + div#cgit { + font-family: monospace; + -moz-tab-size: 4; + tab-size: 4; + } + ''; + in + '' + alias ${css}; ''; - in '' - alias ${css}; - ''; }; }; }; - services = let - user = "git"; - group = "git"; - in { - gitolite = { - enable = true; - inherit user group; - adminPubkey = my.ssh.key; - extraGitoliteRc = '' - # This allows hiding repositories via "cgit.ignore"[1]. - # - # [1]: https://www.omarpolo.com/post/cgit-gitolite.html - $RC{GIT_CONFIG_KEYS} = '.*'; - ''; - }; + services = + let + user = "git"; + group = "git"; + in + { + gitolite = { + enable = true; + inherit user group; + adminPubkey = my.ssh.key; + extraGitoliteRc = '' + # This allows hiding repositories via "cgit.ignore"[1]. + # + # [1]: https://www.omarpolo.com/post/cgit-gitolite.html + $RC{GIT_CONFIG_KEYS} = '.*'; + ''; + }; - fcgiwrap = { - enable = true; - inherit user group; + fcgiwrap = { + enable = true; + inherit user group; + }; }; - }; }; } diff --git a/modules/nixos/gnupg.nix b/modules/nixos/gnupg.nix index 5300554..ad2c939 100644 --- a/modules/nixos/gnupg.nix +++ b/modules/nixos/gnupg.nix @@ -4,9 +4,11 @@ pkgs, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.gnupg; -in { +in +{ options.nixfiles.modules.gnupg.pinentry = mkOption { description = "Name of a pinentry implementation."; type = types.package; @@ -30,7 +32,7 @@ in { grabKeyboardAndMouse = true; - sshKeys = [my.pgp.grip]; + sshKeys = [ my.pgp.grip ]; pinentryPackage = cfg.pinentry; }; diff --git a/modules/nixos/gotify.nix b/modules/nixos/gotify.nix index 4bdd4fa..ad9b277 100644 --- a/modules/nixos/gotify.nix +++ b/modules/nixos/gotify.nix @@ -4,9 +4,11 @@ libNginx, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.gotify; -in { +in +{ options.nixfiles.modules.gotify = { enable = mkEnableOption "Gotify"; @@ -17,14 +19,15 @@ in { }; }; - config = let - db = "gotify"; - in + config = + let + db = "gotify"; + in mkIf cfg.enable { nixfiles.modules = { nginx = { enable = true; - upstreams.gotify.servers."127.0.0.1:${toString config.services.gotify.port}" = {}; + upstreams.gotify.servers."127.0.0.1:${toString config.services.gotify.port}" = { }; virtualHosts.${cfg.domain} = { locations."/" = { proxyPass = "http://gotify"; @@ -50,7 +53,7 @@ in { }; postgresql = { - ensureDatabases = [db]; + ensureDatabases = [ db ]; ensureUsers = [ { name = db; @@ -61,7 +64,10 @@ in { }; systemd.services.gotify-server = { - after = ["network-online.target" "postgresql.service"]; + after = [ + "network-online.target" + "postgresql.service" + ]; environment = { GOTIFY_DATABASE_DIALECT = "postgres"; GOTIFY_DATABASE_CONNECTION = concatStringsSep " " [ diff --git a/modules/nixos/grafana.nix b/modules/nixos/grafana.nix index 2f32225..233c9e5 100644 --- a/modules/nixos/grafana.nix +++ b/modules/nixos/grafana.nix @@ -5,9 +5,11 @@ libNginx, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.grafana; -in { +in +{ options.nixfiles.modules.grafana = { enable = mkEnableOption "Grafana"; @@ -24,11 +26,12 @@ in { }; }; - config = let - db = "grafana"; - in + config = + let + db = "grafana"; + in mkIf cfg.enable { - ark.directories = [config.services.grafana.dataDir]; + ark.directories = [ config.services.grafana.dataDir ]; secrets = { grafana-key = { @@ -51,7 +54,7 @@ in { nixfiles.modules = { nginx = { enable = true; - upstreams.grafana.servers."127.0.0.1:${toString cfg.port}" = {}; + upstreams.grafana.servers."127.0.0.1:${toString cfg.port}" = { }; virtualHosts.${cfg.domain} = { locations."/" = { proxyPass = "http://grafana"; @@ -109,7 +112,7 @@ in { }; postgresql = { - ensureDatabases = [db]; + ensureDatabases = [ db ]; ensureUsers = [ { name = db; diff --git a/modules/nixos/hydra.nix b/modules/nixos/hydra.nix index ec3297c..85b89ab 100644 --- a/modules/nixos/hydra.nix +++ b/modules/nixos/hydra.nix @@ -1,11 +1,9 @@ -{ - config, - lib, - ... -}: -with lib; let +{ config, lib, ... }: +with lib; +let cfg = config.nixfiles.modules.hydra; -in { +in +{ options.nixfiles.modules.hydra = { enable = mkEnableOption "Hydra"; @@ -26,32 +24,34 @@ in { nixfiles.modules = { nginx = { enable = true; - upstreams.hydra.servers."127.0.0.1:${toString cfg.port}" = {}; + upstreams.hydra.servers."127.0.0.1:${toString cfg.port}" = { }; virtualHosts.${cfg.domain}.locations."/".proxyPass = "http://hydra"; }; postgresql.enable = true; }; - services = let - db = "hydra"; - in { - hydra = { - enable = true; - listenHost = "127.0.0.1"; - inherit (cfg) port; - dbi = "dbi:Pg:dbname=${db};user=${db}"; - hydraURL = cfg.domain; - }; + services = + let + db = "hydra"; + in + { + hydra = { + enable = true; + listenHost = "127.0.0.1"; + inherit (cfg) port; + dbi = "dbi:Pg:dbname=${db};user=${db}"; + hydraURL = cfg.domain; + }; - postgresql = { - ensureDatabases = [db]; - ensureUsers = [ - { - name = db; - ensureDBOwnership = true; - } - ]; + postgresql = { + ensureDatabases = [ db ]; + ensureUsers = [ + { + name = db; + ensureDBOwnership = true; + } + ]; + }; }; - }; }; } diff --git a/modules/nixos/incus.nix b/modules/nixos/incus.nix index 14bbc1d..184aa03 100644 --- a/modules/nixos/incus.nix +++ b/modules/nixos/incus.nix @@ -1,15 +1,13 @@ -{ - config, - lib, - ... -}: -with lib; let +{ config, lib, ... }: +with lib; +let cfg = config.nixfiles.modules.incus; -in { +in +{ options.nixfiles.modules.incus.enable = mkEnableOption "Incus"; config = mkIf cfg.enable { - ark.directories = ["/var/lib/incus"]; + ark.directories = [ "/var/lib/incus" ]; virtualisation.incus = { enable = true; @@ -55,7 +53,7 @@ in { }; }; - networking.firewall.trustedInterfaces = ["incusbr0"]; + networking.firewall.trustedInterfaces = [ "incusbr0" ]; # FIXME https://nixpk.gs/pr-tracker.html?pr=295364 # systemd.services.incus.path = mkForce [ @@ -63,6 +61,6 @@ in { # "${config.boot.zfs.package}/lib/udev" # ]; - my.extraGroups = ["incus-admin"]; + my.extraGroups = [ "incus-admin" ]; }; } diff --git a/modules/nixos/ipfs.nix b/modules/nixos/ipfs.nix index 99ce6c9..cd28372 100644 --- a/modules/nixos/ipfs.nix +++ b/modules/nixos/ipfs.nix @@ -5,13 +5,15 @@ this, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.ipfs; gatewayDefaultPort = 6001; apiDefaultPort = 5001; swarmDefaultPort = 4001; -in { +in +{ options.nixfiles.modules.ipfs = { enable = mkEnableOption "IPFS daemon"; @@ -24,19 +26,13 @@ in { gatewayPort = mkOption { description = "Gateway port."; type = with types; port; - default = - if this.isHeadless - then gatewayDefaultPort + 990 - else gatewayDefaultPort; + default = if this.isHeadless then gatewayDefaultPort + 990 else gatewayDefaultPort; }; apiPort = mkOption { description = "API port."; type = with types; port; - default = - if this.isHeadless - then apiDefaultPort + 990 - else apiDefaultPort; + default = if this.isHeadless then apiDefaultPort + 990 else apiDefaultPort; }; swarmPort = mkOption { @@ -86,22 +82,25 @@ in { "/ip4/10.0.0.0/ipcidr/8" "/ip6/fc00::/ipcidr/7" ]; - in { + in + { Addresses = { API = "/ip4/127.0.0.1/tcp/${toString cfg.apiPort}"; Gateway = "/ip4/127.0.0.1/tcp/${toString cfg.gatewayPort}"; - Swarm = let - port = toString cfg.swarmPort; - in [ - "/ip4/0.0.0.0/tcp/${port}" - "/ip6/::/tcp/${port}" - "/ip4/0.0.0.0/udp/${port}/quic" - "/ip4/0.0.0.0/udp/${port}/quic-v1" - "/ip4/0.0.0.0/udp/${port}/quic-v1/webtransport" - "/ip6/::/udp/${port}/quic" - "/ip6/::/udp/${port}/quic-v1" - "/ip6/::/udp/${port}/quic-v1/webtransport" - ]; + Swarm = + let + port = toString cfg.swarmPort; + in + [ + "/ip4/0.0.0.0/tcp/${port}" + "/ip6/::/tcp/${port}" + "/ip4/0.0.0.0/udp/${port}/quic" + "/ip4/0.0.0.0/udp/${port}/quic-v1" + "/ip4/0.0.0.0/udp/${port}/quic-v1/webtransport" + "/ip6/::/udp/${port}/quic" + "/ip6/::/udp/${port}/quic-v1" + "/ip6/::/udp/${port}/quic-v1/webtransport" + ]; NoAnnounce = filterAddresses; }; @@ -116,7 +115,7 @@ in { }; networking.firewall = rec { - allowedTCPPorts = [swarmDefaultPort]; + allowedTCPPorts = [ swarmDefaultPort ]; allowedUDPPorts = allowedTCPPorts; }; } @@ -124,8 +123,8 @@ in { nixfiles.modules.nginx = { enable = true; upstreams = with cfg; { - kubo_gateway.servers."127.0.0.1:${toString gatewayPort}" = {}; - kubo_api.servers."127.0.0.1:${toString apiPort}" = {}; + kubo_gateway.servers."127.0.0.1:${toString gatewayPort}" = { }; + kubo_api.servers."127.0.0.1:${toString apiPort}" = { }; }; virtualHosts = { ${cfg.domain} = { @@ -135,9 +134,7 @@ in { "api.${cfg.domain}" = { locations = { "/".proxyPass = "http://kubo_api"; - "~ ^/$".return = "301 http${ - optionalString config.nixfiles.modules.acme.enable "s" - }://api.${cfg.domain}/webui"; + "~ ^/$".return = "301 http${optionalString config.nixfiles.modules.acme.enable "s"}://api.${cfg.domain}/webui"; }; extraConfig = libNginx.config.internalOnly; }; diff --git a/modules/nixos/jackett.nix b/modules/nixos/jackett.nix index 772e0e9..492e77a 100644 --- a/modules/nixos/jackett.nix +++ b/modules/nixos/jackett.nix @@ -4,9 +4,11 @@ libNginx, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.jackett; -in { +in +{ options.nixfiles.modules.jackett = { enable = mkEnableOption "Jackett"; @@ -18,11 +20,11 @@ in { }; config = mkIf cfg.enable { - ark.directories = ["/var/lib/jackett"]; + ark.directories = [ "/var/lib/jackett" ]; nixfiles.modules.nginx = { enable = true; - upstreams.jackett.servers."127.0.0.1:9117" = {}; + upstreams.jackett.servers."127.0.0.1:9117" = { }; virtualHosts.${cfg.domain} = { locations."/".proxyPass = "http://jackett"; extraConfig = libNginx.config.internalOnly; diff --git a/modules/nixos/k3s.nix b/modules/nixos/k3s.nix index 016eb50..a6efd9f 100644 --- a/modules/nixos/k3s.nix +++ b/modules/nixos/k3s.nix @@ -1,11 +1,9 @@ -{ - config, - lib, - ... -}: -with lib; let +{ config, lib, ... }: +with lib; +let cfg = config.nixfiles.modules.k3s; -in { +in +{ options.nixfiles.modules.k3s = { enable = mkEnableOption "K3s"; }; diff --git a/modules/nixos/kde.nix b/modules/nixos/kde.nix index 2f6aa92..333e9f7 100644 --- a/modules/nixos/kde.nix +++ b/modules/nixos/kde.nix @@ -4,20 +4,25 @@ pkgs, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.kde; -in { +in +{ options.nixfiles.modules.kde.enable = mkEnableOption "KDE Plasma"; config = mkIf cfg.enable { nixfiles.modules = { - common.xdg.defaultApplications."org.kde.dolphin" = ["inode/directory"]; + common.xdg.defaultApplications."org.kde.dolphin" = [ "inode/directory" ]; gnupg.pinentry = pkgs.pinentry-qt; sound.enable = true; }; hm = { + # Fucking broken. I don't want to bother with fixing this shit now. + stylix.targets.kde.enable = false; + programs.firefox.profiles.default.settings = { "widget.use-xdg-desktop-portal.file-picker" = 1; "widget.use-xdg-desktop-portal.mime-handler" = 1; @@ -31,15 +36,13 @@ in { xdg.configFile = { "fontconfig/conf.d/10-hm-fonts.conf".force = mkForce true; "mimeapps.list".force = mkForce true; - "kcminputrc".text = generators.toINI {} { + "kcminputrc".text = generators.toINI { } { Keyboard = with config.services.xserver; { RepeatDelay = autoRepeatDelay; RepeatRate = autoRepeatInterval; }; }; - "baloofilerc".text = generators.toINI {} { - "Basic Settings"."Indexing-Enabled" = false; - }; + "baloofilerc".text = generators.toINI { } { "Basic Settings"."Indexing-Enabled" = false; }; }; }; diff --git a/modules/nixos/libvirtd.nix b/modules/nixos/libvirtd.nix index 0d58f5e..009fd24 100644 --- a/modules/nixos/libvirtd.nix +++ b/modules/nixos/libvirtd.nix @@ -4,13 +4,15 @@ pkgs, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.libvirtd; -in { +in +{ options.nixfiles.modules.libvirtd.enable = mkEnableOption "libvirtd"; config = mkIf cfg.enable { - ark.directories = ["/var/lib/libvirt"]; + ark.directories = [ "/var/lib/libvirt" ]; hm.home.packages = with pkgs; [ bridge-utils @@ -36,7 +38,7 @@ in { ovmf = { enable = true; - packages = [pkgs.OVMFFull.fd]; + packages = [ pkgs.OVMFFull.fd ]; }; swtpm = { @@ -46,6 +48,6 @@ in { }; }; - my.extraGroups = ["libvirtd"]; + my.extraGroups = [ "libvirtd" ]; }; } diff --git a/modules/nixos/lidarr.nix b/modules/nixos/lidarr.nix index 9b166cf..84d363b 100644 --- a/modules/nixos/lidarr.nix +++ b/modules/nixos/lidarr.nix @@ -5,9 +5,11 @@ libNginx, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.lidarr; -in { +in +{ options.nixfiles.modules.lidarr = { enable = mkEnableOption "Lidarr"; @@ -21,11 +23,11 @@ in { config = mkIf cfg.enable { secrets.lidarr-api-key.file = "${inputs.self}/secrets/lidarr-api-key"; - ark.directories = ["/var/lib/lidarr"]; + ark.directories = [ "/var/lib/lidarr" ]; nixfiles.modules.nginx = { enable = true; - upstreams.lidarr.servers."127.0.0.1:8686" = {}; + upstreams.lidarr.servers."127.0.0.1:8686" = { }; virtualHosts.${cfg.domain} = { locations."/".proxyPass = "http://lidarr"; extraConfig = libNginx.config.internalOnly; diff --git a/modules/nixos/loki.nix b/modules/nixos/loki.nix index ce19004..c446848 100644 --- a/modules/nixos/loki.nix +++ b/modules/nixos/loki.nix @@ -4,9 +4,11 @@ libNginx, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.loki; -in { +in +{ options.nixfiles.modules.loki = { enable = mkEnableOption "Loki"; @@ -24,11 +26,11 @@ in { }; config = mkIf cfg.enable { - ark.directories = [config.services.loki.configuration.common.path_prefix]; + ark.directories = [ config.services.loki.configuration.common.path_prefix ]; nixfiles.modules.nginx = with cfg; { enable = true; - upstreams.loki.servers."127.0.0.1:${toString cfg.port}" = {}; + upstreams.loki.servers."127.0.0.1:${toString cfg.port}" = { }; virtualHosts.${domain} = { locations."/".proxyPass = "http://loki"; extraConfig = libNginx.config.internalOnly; diff --git a/modules/nixos/matrix/dendrite.nix b/modules/nixos/matrix/dendrite.nix index c65b55b..5e8a7e4 100644 --- a/modules/nixos/matrix/dendrite.nix +++ b/modules/nixos/matrix/dendrite.nix @@ -5,9 +5,11 @@ pkgs, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.matrix.dendrite; -in { +in +{ options.nixfiles.modules.matrix.dendrite = { enable = mkEnableOption "Dendrite Matrix server"; @@ -24,9 +26,10 @@ in { }; }; - config = let - db = "dendrite"; - in + config = + let + db = "dendrite"; + in mkIf cfg.enable { ark.directories = [ "/var/lib/dendrite" @@ -46,25 +49,21 @@ in { nixfiles.modules = { nginx = { enable = true; - upstreams.dendrite.servers."127.0.0.1:${toString config.services.dendrite.httpPort}" = {}; + upstreams.dendrite.servers."127.0.0.1:${toString config.services.dendrite.httpPort}" = { }; virtualHosts.${cfg.domain}.locations = { "/_matrix".proxyPass = "http://dendrite"; "= /.well-known/matrix/server" = { extraConfig = '' add_header Content-Type application/json; ''; - return = "200 '${generators.toJSON {} { - "m.server" = "${cfg.domain}:443"; - }}'"; + return = "200 '${generators.toJSON { } { "m.server" = "${cfg.domain}:443"; }}'"; }; "= /.well-known/matrix/client" = { extraConfig = '' add_header Content-Type application/json; add_header Access-Control-Allow-Origin *; ''; - return = "200 '${generators.toJSON {} { - "m.homeserver".base_url = "https://${cfg.domain}"; - }}'"; + return = "200 '${generators.toJSON { } { "m.homeserver".base_url = "https://${cfg.domain}"; }}'"; }; }; }; @@ -95,7 +94,7 @@ in { }; services.postgresql = { - ensureDatabases = [db]; + ensureDatabases = [ db ]; ensureUsers = [ { name = db; @@ -106,118 +105,134 @@ in { systemd.services.dendrite = { description = "Dendrite Matrix homeserver"; - wantedBy = ["multi-user.target"]; - requires = ["network.target" "postgresql.service"]; - after = ["network.target" "postgresql.service"]; - serviceConfig = let - needsPrivileges = cfg.port < 1024; - capabilities = [""] ++ optionals needsPrivileges ["CAP_NET_BIND_SERVICE"]; - in { - Restart = "on-failure"; - ExecStartPre = let - settings = { - version = 2; - global = { - server_name = cfg.domain; - private_key = config.secrets.dendrite-private-key.path; - database = { - connection_string = "postgresql://${db}@/${db}?host=/run/postgresql"; - max_open_conns = 64; - max_idle_connections = 8; - }; - cache = { - max_size_estimated = "1gb"; - max_age = "1h"; - }; - trusted_third_party_id_servers = [ - "matrix.org" - "nixos.org" - "vector.im" - ]; - presence = { - enable_inbound = false; - enable_outbound = false; + wantedBy = [ "multi-user.target" ]; + requires = [ + "network.target" + "postgresql.service" + ]; + after = [ + "network.target" + "postgresql.service" + ]; + serviceConfig = + let + needsPrivileges = cfg.port < 1024; + capabilities = [ "" ] ++ optionals needsPrivileges [ "CAP_NET_BIND_SERVICE" ]; + in + { + Restart = "on-failure"; + ExecStartPre = + let + settings = { + version = 2; + global = { + server_name = cfg.domain; + private_key = config.secrets.dendrite-private-key.path; + database = { + connection_string = "postgresql://${db}@/${db}?host=/run/postgresql"; + max_open_conns = 64; + max_idle_connections = 8; + }; + cache = { + max_size_estimated = "1gb"; + max_age = "1h"; + }; + trusted_third_party_id_servers = [ + "matrix.org" + "nixos.org" + "vector.im" + ]; + presence = { + enable_inbound = false; + enable_outbound = false; + }; + }; + client_api = { + registration_disabled = true; + guests_disabled = true; + registration_shared_secret = "$REGISTRATION_SHARED_SECRET"; + }; + media_api = { + base_path = "/var/lib/dendrite/media_store"; + max_file_size_bytes = 0; + dynamic_thumbnails = true; + max_thumbnail_generators = 8; + thumbnail_sizes = [ + { + width = 32; + height = 32; + method = "crop"; + } + { + width = 96; + height = 96; + method = "crop"; + } + { + width = 640; + height = 480; + method = "scale"; + } + ]; + }; + logging = [ + { + type = "std"; + level = "warn"; + } + ]; }; - }; - client_api = { - registration_disabled = true; - guests_disabled = true; - registration_shared_secret = "$REGISTRATION_SHARED_SECRET"; - }; - media_api = { - base_path = "/var/lib/dendrite/media_store"; - max_file_size_bytes = 0; - dynamic_thumbnails = true; - max_thumbnail_generators = 8; - thumbnail_sizes = [ - { - width = 32; - height = 32; - method = "crop"; - } - { - width = 96; - height = 96; - method = "crop"; - } - { - width = 640; - height = 480; - method = "scale"; - } - ]; - }; - logging = [ - { - type = "std"; - level = "warn"; - } + in + concatStringsSep " " [ + (getExe pkgs.envsubst) + "-i ${(pkgs.formats.yaml { }).generate "dendrite.yaml" settings}" + "-o /run/dendrite/dendrite.yaml" ]; - }; - in - concatStringsSep " " [ - (getExe pkgs.envsubst) - "-i ${(pkgs.formats.yaml {}).generate "dendrite.yaml" settings}" - "-o /run/dendrite/dendrite.yaml" + ExecStart = concatStringsSep " " [ + (getExe' pkgs.dendrite "dendrite") + "--config /run/dendrite/dendrite.yaml" + "--http-bind-address 127.0.0.1:${toString cfg.port}" ]; - ExecStart = concatStringsSep " " [ - (getExe' pkgs.dendrite "dendrite") - "--config /run/dendrite/dendrite.yaml" - "--http-bind-address 127.0.0.1:${toString cfg.port}" - ]; - ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID"; - EnvironmentFile = config.secrets.dendrite-environment-file.path; - DynamicUser = true; - StateDirectory = "dendrite"; - RuntimeDirectory = "dendrite"; - RuntimeDirectoryMode = "0700"; - AmbientCapabilities = capabilities; - CapabilityBoundingSet = capabilities; - UMask = "0077"; - LockPersonality = true; - MemoryDenyWriteExecute = true; - NoNewPrivileges = true; - PrivateDevices = true; - PrivateTmp = true; - PrivateUsers = !needsPrivileges; - ProtectClock = true; - ProtectControlGroups = true; - ProtectHome = true; - ProtectHostname = true; - ProtectKernelLogs = true; - ProtectKernelModules = true; - ProtectKernelTunables = true; - ProtectSystem = "strict"; - ProtectProc = "noaccess"; - ProcSubset = "pid"; - RemoveIPC = true; - RestrictAddressFamilies = ["AF_UNIX" "AF_INET" "AF_INET6"]; - RestrictNamespaces = true; - RestrictRealtime = true; - RestrictSUIDSGID = true; - SystemCallArchitectures = "native"; - SystemCallFilter = ["@system-service" "~@privileged"]; - }; + ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID"; + EnvironmentFile = config.secrets.dendrite-environment-file.path; + DynamicUser = true; + StateDirectory = "dendrite"; + RuntimeDirectory = "dendrite"; + RuntimeDirectoryMode = "0700"; + AmbientCapabilities = capabilities; + CapabilityBoundingSet = capabilities; + UMask = "0077"; + LockPersonality = true; + MemoryDenyWriteExecute = true; + NoNewPrivileges = true; + PrivateDevices = true; + PrivateTmp = true; + PrivateUsers = !needsPrivileges; + ProtectClock = true; + ProtectControlGroups = true; + ProtectHome = true; + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + ProtectSystem = "strict"; + ProtectProc = "noaccess"; + ProcSubset = "pid"; + RemoveIPC = true; + RestrictAddressFamilies = [ + "AF_UNIX" + "AF_INET" + "AF_INET6" + ]; + RestrictNamespaces = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + SystemCallArchitectures = "native"; + SystemCallFilter = [ + "@system-service" + "~@privileged" + ]; + }; }; }; } diff --git a/modules/nixos/matrix/element.nix b/modules/nixos/matrix/element.nix index 3d47800..92a2927 100644 --- a/modules/nixos/matrix/element.nix +++ b/modules/nixos/matrix/element.nix @@ -4,9 +4,11 @@ pkgs, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.matrix.element; -in { +in +{ options.nixfiles.modules.matrix.element = { enable = mkEnableOption "Element, a Matrix web interface"; @@ -26,7 +28,8 @@ in { config = mkIf cfg.enable { assertions = [ { - assertion = with config.nixfiles.modules.matrix; + assertion = + with config.nixfiles.modules.matrix; (synapse.enable || dendrite.enable) && !(!synapse.enable && !dendrite.enable); message = "Synapse or Dendrite must be enabled"; } diff --git a/modules/nixos/monitoring/default.nix b/modules/nixos/monitoring/default.nix index 5aed215..6e5b782 100644 --- a/modules/nixos/monitoring/default.nix +++ b/modules/nixos/monitoring/default.nix @@ -4,9 +4,11 @@ pkgs, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.monitoring; -in { +in +{ options.nixfiles.modules.monitoring.enable = mkEnableOption '' a glue to provision a monitoring stack ''; @@ -134,83 +136,93 @@ in { }; prometheus = { - scrapeConfigs = with my.configurations; + scrapeConfigs = + with my.configurations; mapAttrsToList - ( - name: value: { + (name: value: { job_name = name; static_configs = [ { - targets = with value; - map (host: + targets = + with value; + map ( + host: concatStringsSep ":" [ - ( - if isAttrs host - then host.hostname - else host - ) + (if isAttrs host then host.hostname else host) (toString port) - ]) - hosts; + ] + ) hosts; } ]; - relabel_configs = - [ - { - source_labels = ["__address__"]; - regex = "([^:]+):\\d+"; - target_label = "instance"; - } - ] - ++ optionals (hasAttr "relabel" value) value.relabel; - } - ) - { - promtail = { - hosts = [manwe varda yavanna]; - inherit (config.nixfiles.modules.promtail) port; - }; - ntfy = { - hosts = [manwe]; - inherit (config.nixfiles.modules.ntfy.prometheus) port; - }; - soju = { - hosts = ["127.0.0.1"]; - inherit (config.nixfiles.modules.soju.prometheus) port; - }; - endlessh-go = { - hosts = [manwe varda yavanna]; - inherit (config.services.endlessh-go.prometheus) port; - }; - nginx = { - hosts = [manwe yavanna]; - inherit (config.services.prometheus.exporters.nginx) port; - }; - node = { - hosts = [manwe varda yavanna]; - inherit (config.services.prometheus.exporters.node) port; - }; - postgres = { - hosts = [manwe]; - inherit (config.services.prometheus.exporters.postgres) port; - }; - redis = { - hosts = [manwe]; - inherit (config.services.prometheus.exporters.redis) port; - }; - unbound = { - hosts = [manwe]; - inherit (config.services.prometheus.exporters.unbound) port; - }; - wireguard = { - hosts = [manwe]; - inherit (config.services.prometheus.exporters.wireguard) port; - }; - exportarr-lidarr = { - hosts = [yavanna]; - inherit (config.services.prometheus.exporters.exportarr-lidarr) port; + relabel_configs = [ + { + source_labels = [ "__address__" ]; + regex = "([^:]+):\\d+"; + target_label = "instance"; + } + ] ++ optionals (hasAttr "relabel" value) value.relabel; + }) + { + promtail = { + hosts = [ + manwe + varda + yavanna + ]; + inherit (config.nixfiles.modules.promtail) port; + }; + ntfy = { + hosts = [ manwe ]; + inherit (config.nixfiles.modules.ntfy.prometheus) port; + }; + soju = { + hosts = [ "127.0.0.1" ]; + inherit (config.nixfiles.modules.soju.prometheus) port; + }; + endlessh-go = { + hosts = [ + manwe + varda + yavanna + ]; + inherit (config.services.endlessh-go.prometheus) port; + }; + nginx = { + hosts = [ + manwe + yavanna + ]; + inherit (config.services.prometheus.exporters.nginx) port; + }; + node = { + hosts = [ + manwe + varda + yavanna + ]; + inherit (config.services.prometheus.exporters.node) port; + }; + postgres = { + hosts = [ manwe ]; + inherit (config.services.prometheus.exporters.postgres) port; + }; + redis = { + hosts = [ manwe ]; + inherit (config.services.prometheus.exporters.redis) port; + }; + unbound = { + hosts = [ manwe ]; + inherit (config.services.prometheus.exporters.unbound) port; + }; + wireguard = { + hosts = [ manwe ]; + inherit (config.services.prometheus.exporters.wireguard) port; + }; + exportarr-lidarr = { + hosts = [ yavanna ]; + inherit (config.services.prometheus.exporters.exportarr-lidarr) port; + }; }; - }; ruleFiles = [ ./rules/nginx.yaml @@ -222,9 +234,7 @@ in { alertmanagers = [ { scheme = "https"; - static_configs = [ - {targets = [config.nixfiles.modules.alertmanager.domain];} - ]; + static_configs = [ { targets = [ config.nixfiles.modules.alertmanager.domain ]; } ]; } ]; }; diff --git a/modules/nixos/mpd.nix b/modules/nixos/mpd.nix index 485cde3..7c3c821 100644 --- a/modules/nixos/mpd.nix +++ b/modules/nixos/mpd.nix @@ -4,16 +4,18 @@ pkgs, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.mpd; -in { +in +{ options.nixfiles.modules.mpd.enable = mkEnableOption "MPD and its clients."; config = mkIf cfg.enable { nixfiles.modules.sound.enable = true; hm = { - home.packages = with pkgs; [mpc_cli]; + home.packages = with pkgs; [ mpc_cli ]; services.mpd = { enable = true; @@ -170,19 +172,31 @@ in { } { key = "J"; - command = ["select_item" "scroll_down"]; + command = [ + "select_item" + "scroll_down" + ]; } { key = "K"; - command = ["select_item" "scroll_up"]; + command = [ + "select_item" + "scroll_up" + ]; } { key = "h"; - command = ["previous_column" "master_screen"]; + command = [ + "previous_column" + "master_screen" + ]; } { key = "l"; - command = ["next_column" "slave_screen"]; + command = [ + "next_column" + "slave_screen" + ]; } { key = "g"; diff --git a/modules/nixos/mpv.nix b/modules/nixos/mpv.nix index a2b73fa..8042c1a 100644 --- a/modules/nixos/mpv.nix +++ b/modules/nixos/mpv.nix @@ -1,92 +1,91 @@ -{ - config, - lib, - ... -}: -with lib; let +{ config, lib, ... }: +with lib; +let cfg = config.nixfiles.modules.mpv; -in { +in +{ config = mkIf cfg.enable { nixfiles.modules.common = { shell.aliases.cam = "mpv av://v4l2:/dev/video0"; - xdg.defaultApplications.mpv = let - audio = [ - "audio/aac" - "audio/ac3" - "audio/basic" - "audio/flac" - "audio/midi" - "audio/mp4" - "audio/mpeg" - "audio/ogg" - "audio/opus" - "audio/vnd.dts" - "audio/vnd.dts.hd" - "audio/webm" - "audio/x-adpcm" - "audio/x-aifc" - "audio/x-aiff" - "audio/x-ape" - "audio/x-flac+ogg" - "audio/x-m4b" - "audio/x-m4r" - "audio/x-matroska" - "audio/x-mpegurl" - "audio/x-musepack" - "audio/x-opus+ogg" - "audio/x-speex" - "audio/x-speex+ogg" - "audio/x-vorbis+ogg" - "audio/x-wav" - "audio/x-wavpack" - "x-content/audio-cdda" - "x-content/audio-dvd" - ]; - video = [ - "video/3gpp" - "video/3gpp2" - "video/mkv" - "video/mp2t" - "video/mp4" - "video/mpeg" - "video/ogg" - "video/quicktime" - "video/vnd.mpegurl" - "video/vnd.radgamettools.bink" - "video/vnd.radgamettools.smacker" - "video/wavelet" - "video/webm" - "video/x-matroska" - "video/x-matroska-3d" - "video/x-mjpeg" - "video/x-msvideo" - "video/x-ogm+ogg" - "video/x-theora+ogg" - "x-content/video-bluray" - "x-content/video-dvd" - "x-content/video-hddvd" - "x-content/video-svcd" - "x-content/video-vcd" - ]; - image = [ - "image/avif" - "image/bmp" - "image/gif" - "image/jp2" - "image/jpeg" - "image/jpg" - "image/jpm" - "image/jpx" - "image/jxl" - "image/png" - "image/tiff" - "image/vnd.microsoft.icon" - "image/webp" - "image/webp" - "image/x-tga" - ]; - in + xdg.defaultApplications.mpv = + let + audio = [ + "audio/aac" + "audio/ac3" + "audio/basic" + "audio/flac" + "audio/midi" + "audio/mp4" + "audio/mpeg" + "audio/ogg" + "audio/opus" + "audio/vnd.dts" + "audio/vnd.dts.hd" + "audio/webm" + "audio/x-adpcm" + "audio/x-aifc" + "audio/x-aiff" + "audio/x-ape" + "audio/x-flac+ogg" + "audio/x-m4b" + "audio/x-m4r" + "audio/x-matroska" + "audio/x-mpegurl" + "audio/x-musepack" + "audio/x-opus+ogg" + "audio/x-speex" + "audio/x-speex+ogg" + "audio/x-vorbis+ogg" + "audio/x-wav" + "audio/x-wavpack" + "x-content/audio-cdda" + "x-content/audio-dvd" + ]; + video = [ + "video/3gpp" + "video/3gpp2" + "video/mkv" + "video/mp2t" + "video/mp4" + "video/mpeg" + "video/ogg" + "video/quicktime" + "video/vnd.mpegurl" + "video/vnd.radgamettools.bink" + "video/vnd.radgamettools.smacker" + "video/wavelet" + "video/webm" + "video/x-matroska" + "video/x-matroska-3d" + "video/x-mjpeg" + "video/x-msvideo" + "video/x-ogm+ogg" + "video/x-theora+ogg" + "x-content/video-bluray" + "x-content/video-dvd" + "x-content/video-hddvd" + "x-content/video-svcd" + "x-content/video-vcd" + ]; + image = [ + "image/avif" + "image/bmp" + "image/gif" + "image/jp2" + "image/jpeg" + "image/jpg" + "image/jpm" + "image/jpx" + "image/jxl" + "image/png" + "image/tiff" + "image/vnd.microsoft.icon" + "image/webp" + "image/webp" + "image/x-tga" + ]; + in audio ++ video ++ image; }; }; diff --git a/modules/nixos/murmur.nix b/modules/nixos/murmur.nix index 8ac7899..7621c9e 100644 --- a/modules/nixos/murmur.nix +++ b/modules/nixos/murmur.nix @@ -4,13 +4,15 @@ lib, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.murmur; -in { +in +{ options.nixfiles.modules.murmur.enable = mkEnableOption "Murmur"; config = mkIf cfg.enable { - ark.directories = ["/var/lib/murmur"]; + ark.directories = [ "/var/lib/murmur" ]; secrets.murmur-environment = { file = "${inputs.self}/secrets/murmur-environment"; diff --git a/modules/nixos/nextcloud.nix b/modules/nixos/nextcloud.nix index 13cecb7..4053c38 100644 --- a/modules/nixos/nextcloud.nix +++ b/modules/nixos/nextcloud.nix @@ -4,9 +4,11 @@ pkgs, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.nextcloud; -in { +in +{ options.nixfiles.modules.nextcloud = { enable = mkEnableOption "Nextcloud"; @@ -21,97 +23,105 @@ in { nixfiles.modules = { nginx = { enable = true; - virtualHosts.${cfg.domain} = {}; + virtualHosts.${cfg.domain} = { }; }; postgresql.enable = true; }; - services = let - db = "nextcloud"; - in { - nextcloud = mkMerge [ - { - enable = true; - package = pkgs.nextcloud23; - - hostName = cfg.domain; + services = + let + db = "nextcloud"; + in + { + nextcloud = mkMerge [ + { + enable = true; + package = pkgs.nextcloud23; - appstoreEnable = false; + hostName = cfg.domain; - config = { - adminpassFile = null; # This needs to be set as secret. + appstoreEnable = false; - dbtype = "pgsql"; - dbhost = "/run/postgresql"; - dbuser = db; - dbname = db; + config = { + adminpassFile = null; # This needs to be set as secret. - defaultPhoneRegion = "RU"; - }; + dbtype = "pgsql"; + dbhost = "/run/postgresql"; + dbuser = db; + dbname = db; - extraApps = let - mkNextcloudApp = { - name, - version, - hash, - }: - pkgs.fetchNextcloudApp { - inherit name version hash; - url = "https://github.com/nextcloud/${name}/archive/refs/tags/v${version}.tar.gz"; - }; - in { - contacts = mkNextcloudApp { - name = "contacts"; - version = "4.0.1"; - sha256 = "sha256-dXKsG8KmlUojeY5dUn/XsMD3KaSh4QcZFOGDdcqlSvE="; - }; - calendar = mkNextcloudApp { - name = "calendar"; - version = "3.0.5"; - sha256 = "sha256-aKUKm7fWJQxOWwma56Tv+GGIo+p0n30Nhoyt4XoxsjI="; - }; - files_rightclick = mkNextcloudApp { - name = "files_rightclick"; - version = "23.0.1"; - sha256 = "sha256-VYODzkvvGrtpyRoug/8UPKhAgfCx1ltP1JdGPiB/lts="; - }; - unsplash = mkNextcloudApp { - name = "unsplash"; - version = "1.2.4"; - sha256 = "sha256-KGSkBOrNu0nK0YvAPYaxEL/kZNoJQD1oBV2aUBxh6cI="; - }; - previewgenerator = mkNextcloudApp { - name = "previewgenerator"; - version = "3.4.1"; - sha256 = "sha256-IUdj0xWt5zHxQoiMv1bYyYTzekuOFrsRIe530QOwC/w="; + defaultPhoneRegion = "RU"; }; - bruteforcesettings = mkNextcloudApp { - name = "bruteforcesettings"; - version = "2.3.0"; - sha256 = "sha256-J7ujmiPaw8GI7vDfVPXEum2XAMWvahciP8C6iXgckdE="; - }; - }; - } - (mkIf config.nixfiles.modules.acme.enable { - https = true; - config.overwriteProtocol = "https"; - }) - ]; - postgresql = { - ensureDatabases = [db]; - ensureUsers = [ - { - name = db; - ensureDBOwnership = true; + extraApps = + let + mkNextcloudApp = + { + name, + version, + hash, + }: + pkgs.fetchNextcloudApp { + inherit name version hash; + url = "https://github.com/nextcloud/${name}/archive/refs/tags/v${version}.tar.gz"; + }; + in + { + contacts = mkNextcloudApp { + name = "contacts"; + version = "4.0.1"; + sha256 = "sha256-dXKsG8KmlUojeY5dUn/XsMD3KaSh4QcZFOGDdcqlSvE="; + }; + calendar = mkNextcloudApp { + name = "calendar"; + version = "3.0.5"; + sha256 = "sha256-aKUKm7fWJQxOWwma56Tv+GGIo+p0n30Nhoyt4XoxsjI="; + }; + files_rightclick = mkNextcloudApp { + name = "files_rightclick"; + version = "23.0.1"; + sha256 = "sha256-VYODzkvvGrtpyRoug/8UPKhAgfCx1ltP1JdGPiB/lts="; + }; + unsplash = mkNextcloudApp { + name = "unsplash"; + version = "1.2.4"; + sha256 = "sha256-KGSkBOrNu0nK0YvAPYaxEL/kZNoJQD1oBV2aUBxh6cI="; + }; + previewgenerator = mkNextcloudApp { + name = "previewgenerator"; + version = "3.4.1"; + sha256 = "sha256-IUdj0xWt5zHxQoiMv1bYyYTzekuOFrsRIe530QOwC/w="; + }; + bruteforcesettings = mkNextcloudApp { + name = "bruteforcesettings"; + version = "2.3.0"; + sha256 = "sha256-J7ujmiPaw8GI7vDfVPXEum2XAMWvahciP8C6iXgckdE="; + }; + }; } + (mkIf config.nixfiles.modules.acme.enable { + https = true; + config.overwriteProtocol = "https"; + }) ]; + + postgresql = { + ensureDatabases = [ db ]; + ensureUsers = [ + { + name = db; + ensureDBOwnership = true; + } + ]; + }; }; - }; systemd = { services = { - nextcloud-setup.after = ["network-online.target" "postgresql.service"]; + nextcloud-setup.after = [ + "network-online.target" + "postgresql.service" + ]; nextcloud-preview-generate-cron.serviceConfig = { Type = "oneshot"; @@ -121,7 +131,7 @@ in { }; timers.nextcloud-preview-generate = { - wantedBy = ["timers.target"]; + wantedBy = [ "timers.target" ]; timerConfig = { OnBootSec = "15m"; OnUnitActiveSec = "15m"; diff --git a/modules/nixos/nginx.nix b/modules/nixos/nginx.nix index 05c6a06..ed34237 100644 --- a/modules/nixos/nginx.nix +++ b/modules/nixos/nginx.nix @@ -5,9 +5,11 @@ this, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.nginx; -in { +in +{ options.nixfiles.modules.nginx = { enable = mkEnableOption "Nginx"; @@ -62,8 +64,9 @@ in { '' add_header X-Robots-Tag "noindex, nofollow, noarchive, nosnippet"; '' - (optionalString (hasAttr "wireguard" this) - (with config.nixfiles.modules.wireguard; '' + (optionalString (hasAttr "wireguard" this) ( + with config.nixfiles.modules.wireguard; + '' geo $internal { default 0; 127.0.0.1/32 1; @@ -71,7 +74,8 @@ in { ${ipv4.subnet} 1; ${ipv6.subnet} 1; } - '')) + '' + )) ]; inherit (cfg) upstreams; @@ -84,15 +88,18 @@ in { locations."/".return = "444"; }; } - // (mkIf (cfg.virtualHosts != null) (mapAttrs (_: attr: - mkMerge [ - attr - (mkIf config.nixfiles.modules.acme.enable { - enableACME = mkDefault true; - forceSSL = mkDefault true; - }) - ]) - cfg.virtualHosts)); + // (mkIf (cfg.virtualHosts != null) ( + mapAttrs ( + _: attr: + mkMerge [ + attr + (mkIf config.nixfiles.modules.acme.enable { + enableACME = mkDefault true; + forceSSL = mkDefault true; + }) + ] + ) cfg.virtualHosts + )); }; fail2ban.jails = { @@ -107,6 +114,9 @@ in { }; }; - networking.firewall.allowedTCPPorts = [80 443]; + networking.firewall.allowedTCPPorts = [ + 80 + 443 + ]; }; } diff --git a/modules/nixos/node-exporter.nix b/modules/nixos/node-exporter.nix index 43f48f6..8e76903 100644 --- a/modules/nixos/node-exporter.nix +++ b/modules/nixos/node-exporter.nix @@ -4,9 +4,11 @@ this, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.node-exporter; -in { +in +{ options.nixfiles.modules.node-exporter.enable = mkEnableOption "Prometheus Node Exporter"; config = mkIf cfg.enable { diff --git a/modules/nixos/nsd.nix b/modules/nixos/nsd.nix index ae72f1d..f44a2a0 100644 --- a/modules/nixos/nsd.nix +++ b/modules/nixos/nsd.nix @@ -5,9 +5,11 @@ this, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.nsd; -in { +in +{ options.nixfiles.modules.nsd = { enable = mkEnableOption "NSD"; @@ -19,194 +21,208 @@ in { }; config = mkIf cfg.enable { - nixfiles.modules.nginx = let - domain = my.domain.shire; - in { - enable = true; - virtualHosts = mapAttrs' (_: v: - nameValuePair "mta-sts.${v}" { - locations."= /.well-known/mta-sts.txt" = { - extraConfig = '' - add_header default_type text/plain; - ''; - return = "200 '${concatStringsSep "\\r\\n" [ - "version: STSv1" - "mode: enforce" - "max_age: 2419200" - "mx: ${domain}" - ]}'"; - }; - }) - my.domain; - }; + nixfiles.modules.nginx = + let + domain = my.domain.shire; + in + { + enable = true; + virtualHosts = mapAttrs' ( + _: v: + nameValuePair "mta-sts.${v}" { + locations."= /.well-known/mta-sts.txt" = { + extraConfig = '' + add_header default_type text/plain; + ''; + return = "200 '${ + concatStringsSep "\\r\\n" [ + "version: STSv1" + "mode: enforce" + "max_age: 2419200" + "mx: ${domain}" + ] + }'"; + }; + } + ) my.domain; + }; services = { nsd = { enable = true; - interfaces = with this; [ipv4.address ipv6.address]; + interfaces = with this; [ + ipv4.address + ipv6.address + ]; ipTransparent = true; ratelimit.enable = true; - zones = let - dns = inputs.dns.lib; - in - with dns.combinators; let - ips = hostname: - with my.configurations.${hostname}; { - A = [(a ipv4.address)]; - AAAA = [(aaaa ipv6.address)]; + zones = + let + dns = inputs.dns.lib; + in + with dns.combinators; + let + ips = + hostname: with my.configurations.${hostname}; { + A = [ (a ipv4.address) ]; + AAAA = [ (aaaa ipv6.address) ]; }; - mkEmailEntries = { - domain ? my.domain.shire, - dkimKey ? null, - }: { - MX = [(mx.mx 10 "${my.domain.shire}.")]; - TXT = [(spf.soft ["a"])]; - DMARC = [ - { - p = "quarantine"; - sp = "quarantine"; - rua = ["mailto:admin+rua@${domain}"]; - ruf = ["mailto:admin+ruf@${domain}"]; - } - ]; - DKIM = optional (dkimKey != null) { - selector = "mail"; - p = dkimKey; + mkEmailEntries = + { + domain ? my.domain.shire, + dkimKey ? null, + }: + { + MX = [ (mx.mx 10 "${my.domain.shire}.") ]; + TXT = [ (spf.soft [ "a" ]) ]; + DMARC = [ + { + p = "quarantine"; + sp = "quarantine"; + rua = [ "mailto:admin+rua@${domain}" ]; + ruf = [ "mailto:admin+ruf@${domain}" ]; + } + ]; + DKIM = optional (dkimKey != null) { + selector = "mail"; + p = dkimKey; + }; + subdomains._mta-sts.TXT = [ "v=STSv1; id=20230506134541Z" ]; }; - subdomains._mta-sts.TXT = ["v=STSv1; id=20230506134541Z"]; - }; - mkZone = { - domain, - sldIps ? (ips "manwe"), - extra ? {}, - }: { - ${domain}.data = dns.toString domain (mkMerge [ - { - TTL = 60 * 60; + mkZone = + { + domain, + sldIps ? (ips "manwe"), + extra ? { }, + }: + { + ${domain}.data = dns.toString domain (mkMerge [ + { + TTL = 60 * 60; - SOA = { - nameServer = "${cfg.fqdn}."; - adminEmail = "admin+dns@${my.domain.shire}"; - serial = 2022091601; # Don't forget to bump the revision! - }; + SOA = { + nameServer = "${cfg.fqdn}."; + adminEmail = "admin+dns@${my.domain.shire}"; + serial = 2022091601; # Don't forget to bump the revision! + }; - NS = with my.domain; [ - "ns1.${shire}" - # "ns2.${shire}" - ]; + NS = with my.domain; [ + "ns1.${shire}" + # "ns2.${shire}" + ]; - CAA = letsEncrypt "admin+caa@${my.domain.shire}"; - } - sldIps - extra - ]); - }; + CAA = letsEncrypt "admin+caa@${my.domain.shire}"; + } + sldIps + extra + ]); + }; # https://ariadne.id/ # https://docs.keyoxide.org/service-providers/dns/ - ariadneIdProof.TXT = ["openpgp4fpr:${my.pgp.fingerprint}"]; + ariadneIdProof.TXT = [ "openpgp4fpr:${my.pgp.fingerprint}" ]; in - mkMerge [ - (mkZone rec { - domain = my.domain.shire; - extra = mkMerge [ - (mkEmailEntries { - inherit domain; - dkimKey = "@DKIM_KEY@"; - }) - { - subdomains = rec { - manwe = ips "manwe"; - "*.manwe" = manwe; - varda = ips "varda"; - "*.varda" = varda; - yavanna = ips "yavanna"; - "*.yavanna" = yavanna; - - mta-sts = manwe; - - ns1 = manwe; - # ns2 = varda; - - alertmanager = manwe; - bitwarden = manwe; - git = manwe; - grafana = manwe; - loki = manwe; - ntfy = manwe; - plausible = manwe; - prometheus = manwe; - radicale = manwe; - rss-bridge = manwe; - vaultwarden = manwe; - - flood = yavanna; - jackett = yavanna; - lidarr = yavanna; - }; - } - ]; - }) - (mkZone rec { - domain = my.domain.azahi; - extra = mkMerge [ - (mkEmailEntries { - inherit domain; - dkimKey = "@DKIM_KEY@"; - }) - ariadneIdProof - { - subdomains = { - mta-sts = ips "manwe"; + mkMerge [ + (mkZone rec { + domain = my.domain.shire; + extra = mkMerge [ + (mkEmailEntries { + inherit domain; + dkimKey = "@DKIM_KEY@"; + }) + { + subdomains = rec { + manwe = ips "manwe"; + "*.manwe" = manwe; + varda = ips "varda"; + "*.varda" = varda; + yavanna = ips "yavanna"; + "*.yavanna" = yavanna; + + mta-sts = manwe; + + ns1 = manwe; + # ns2 = varda; + + alertmanager = manwe; + bitwarden = manwe; + git = manwe; + grafana = manwe; + loki = manwe; + ntfy = manwe; + plausible = manwe; + prometheus = manwe; + radicale = manwe; + rss-bridge = manwe; + vaultwarden = manwe; + + flood = yavanna; + jackett = yavanna; + lidarr = yavanna; + }; + } + ]; + }) + (mkZone rec { + domain = my.domain.azahi; + extra = mkMerge [ + (mkEmailEntries { + inherit domain; + dkimKey = "@DKIM_KEY@"; + }) + ariadneIdProof + { + subdomains = { + mta-sts = ips "manwe"; - git = ips "manwe"; - }; - } - ]; - }) - (mkZone rec { - domain = my.domain.gondor; - extra = mkMerge [ - (mkEmailEntries { - inherit domain; - dkimKey = "@DKIM_KEY@"; - }) - { - subdomains = { - mta-sts = ips "manwe"; + git = ips "manwe"; + }; + } + ]; + }) + (mkZone rec { + domain = my.domain.gondor; + extra = mkMerge [ + (mkEmailEntries { + inherit domain; + dkimKey = "@DKIM_KEY@"; + }) + { + subdomains = { + mta-sts = ips "manwe"; - frodo = ips "manwe" // ariadneIdProof; - }; - } - ]; - }) - (mkZone rec { - domain = my.domain.rohan; - extra = mkMerge [ - (mkEmailEntries { - inherit domain; - dkimKey = "@DKIM_KEY@"; - }) - { - subdomains = { - mta-sts = ips "manwe"; + frodo = ips "manwe" // ariadneIdProof; + }; + } + ]; + }) + (mkZone rec { + domain = my.domain.rohan; + extra = mkMerge [ + (mkEmailEntries { + inherit domain; + dkimKey = "@DKIM_KEY@"; + }) + { + subdomains = { + mta-sts = ips "manwe"; - frodo = ips "manwe" // ariadneIdProof; - }; - } - ]; - }) - ]; + frodo = ips "manwe" // ariadneIdProof; + }; + } + ]; + }) + ]; }; fail2ban.jails.nsd.enabled = true; }; networking.firewall = rec { - allowedTCPPorts = [53]; + allowedTCPPorts = [ 53 ]; allowedUDPPorts = allowedTCPPorts; }; }; diff --git a/modules/nixos/ntfy.nix b/modules/nixos/ntfy.nix index 037f84a..5739855 100644 --- a/modules/nixos/ntfy.nix +++ b/modules/nixos/ntfy.nix @@ -5,9 +5,11 @@ this, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.ntfy; -in { +in +{ options.nixfiles.modules.ntfy = { enable = mkEnableOption "ntfy"; @@ -24,7 +26,9 @@ in { }; prometheus = { - enable = mkEnableOption "Prometheus exporter." // {default = true;}; + enable = mkEnableOption "Prometheus exporter." // { + default = true; + }; address = mkOption { description = "Address."; @@ -41,11 +45,11 @@ in { }; config = mkIf cfg.enable { - ark.files = [config.services.ntfy-sh.settings.auth-file]; + ark.files = [ config.services.ntfy-sh.settings.auth-file ]; nixfiles.modules.nginx = { enable = true; - upstreams.ntfy.servers.${config.services.ntfy-sh.settings.listen-http} = {}; + upstreams.ntfy.servers.${config.services.ntfy-sh.settings.listen-http} = { }; virtualHosts.${cfg.domain} = { locations = { "/" = { @@ -67,7 +71,8 @@ in { base-url = "https://${cfg.domain}"; behind-proxy = true; enable-metrics = cfg.prometheus.enable; - metrics-listen-http = with cfg.prometheus; + metrics-listen-http = + with cfg.prometheus; optionalString cfg.prometheus.enable "${address}:${toString port}"; }; }; diff --git a/modules/nixos/nullmailer.nix b/modules/nixos/nullmailer.nix index 193b109..9f7b4ac 100644 --- a/modules/nixos/nullmailer.nix +++ b/modules/nixos/nullmailer.nix @@ -4,9 +4,11 @@ lib, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.nullmailer; -in { +in +{ options.nixfiles.modules.nullmailer.enable = mkEnableOption "Nullmailer"; config = mkIf cfg.enable { diff --git a/modules/nixos/openssh.nix b/modules/nixos/openssh.nix index 4324e45..9b82757 100644 --- a/modules/nixos/openssh.nix +++ b/modules/nixos/openssh.nix @@ -1,11 +1,9 @@ -{ - config, - lib, - ... -}: -with lib; let +{ config, lib, ... }: +with lib; +let cfg = config.nixfiles.modules.openssh; -in { +in +{ options.nixfiles.modules.openssh.server = { enable = mkEnableOption "OpenSSH server"; @@ -29,15 +27,12 @@ in { services = { openssh = { enable = true; - ports = [cfg.server.port]; + ports = [ cfg.server.port ]; settings = { ClientAliveCountMax = 3; ClientAliveInterval = 60; KbdInteractiveAuthentication = false; - LogLevel = - if config.nixfiles.modules.fail2ban.enable - then "VERBOSE" - else "ERROR"; + LogLevel = if config.nixfiles.modules.fail2ban.enable then "VERBOSE" else "ERROR"; MaxAuthTries = 3; PasswordAuthentication = false; PermitRootLogin = mkForce "no"; diff --git a/modules/nixos/plausible.nix b/modules/nixos/plausible.nix index 8de54d2..d63e3ab 100644 --- a/modules/nixos/plausible.nix +++ b/modules/nixos/plausible.nix @@ -4,9 +4,11 @@ lib, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.plausible; -in { +in +{ options.nixfiles.modules.plausible = { enable = mkEnableOption "Plausible Analytics"; @@ -23,15 +25,18 @@ in { }; }; - config = let - db = "plausible"; - in + config = + let + db = "plausible"; + in mkIf cfg.enable { _module.args.libPlausible = { - htmlPlausibleScript = { - domain ? "$host", - src ? "https://${cfg.domain}/js/script.js", - }: ''<script defer data-domain="${domain}" src="${src}"></script>''; + htmlPlausibleScript = + { + domain ? "$host", + src ? "https://${cfg.domain}/js/script.js", + }: + ''<script defer data-domain="${domain}" src="${src}"></script>''; }; secrets = { @@ -43,7 +48,7 @@ in { nixfiles.modules = { nginx = { enable = true; - upstreams.plausible.servers."127.0.0.1:${toString cfg.port}" = {}; + upstreams.plausible.servers."127.0.0.1:${toString cfg.port}" = { }; virtualHosts.${cfg.domain}.locations."/" = { proxyPass = "http://plausible"; proxyWebsockets = true; @@ -62,7 +67,7 @@ in { }; services.postgresql = { - ensureDatabases = [db]; + ensureDatabases = [ db ]; ensureUsers = [ { name = db; diff --git a/modules/nixos/podman.nix b/modules/nixos/podman.nix index 5e369a6..bb4fda5 100644 --- a/modules/nixos/podman.nix +++ b/modules/nixos/podman.nix @@ -5,9 +5,11 @@ pkgs, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.podman; -in { +in +{ options.nixfiles.modules.podman.enable = mkEnableOption "Podman"; config = mkIf cfg.enable { @@ -29,13 +31,13 @@ in { virtualisation.podman.enable = true; - environment.systemPackages = with pkgs; [podman-compose]; + environment.systemPackages = with pkgs; [ podman-compose ]; - my.extraGroups = ["podman"]; + my.extraGroups = [ "podman" ]; hm.xdg.configFile = { "containers/registries.conf".source = pkgs.writers.writeTOML "containers-registries.toml" { - registries.search.registries = ["docker.io"]; + registries.search.registries = [ "docker.io" ]; }; "containers/storage.conf".source = pkgs.writers.writeTOML "containers-storage.toml" { diff --git a/modules/nixos/postgresql.nix b/modules/nixos/postgresql.nix index 89b24b8..5081340 100644 --- a/modules/nixos/postgresql.nix +++ b/modules/nixos/postgresql.nix @@ -5,9 +5,11 @@ this, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.postgresql; -in { +in +{ options.nixfiles.modules.postgresql = { enable = mkEnableOption "PostgreSQL"; @@ -19,7 +21,7 @@ in { extraPostStart = mkOption { type = with types; listOf str; - default = []; + default = [ ]; description = '' Additional post-startup commands. @@ -37,7 +39,7 @@ in { } ]; - ark.directories = [config.services.postgresql.dataDir]; + ark.directories = [ config.services.postgresql.dataDir ]; services = { postgresql = { @@ -72,21 +74,25 @@ in { }; }; - systemd.services.postgresql.postStart = optionalString (cfg.extraPostStart != []) concatLines cfg.extraPostStart; + systemd.services.postgresql.postStart = optionalString ( + cfg.extraPostStart != [ ] + ) concatLines cfg.extraPostStart; - environment.sessionVariables.PSQLRC = toString (pkgs.writeText "psqlrc" '' - \set QUIET 1 + environment.sessionVariables.PSQLRC = toString ( + pkgs.writeText "psqlrc" '' + \set QUIET 1 - \timing - \x auto - \pset null '[NULL]' - \set PROMPT1 '%[%033[1m%]%M %n@%/%R%[%033[0m%]% λ ' - \set PROMPT2 ' … > ' - \set VERBOSITY verbose - \set HISTCONTROL ignoredups - \set HISTFILE /dev/null + \timing + \x auto + \pset null '[NULL]' + \set PROMPT1 '%[%033[1m%]%M %n@%/%R%[%033[0m%]% λ ' + \set PROMPT2 ' … > ' + \set VERBOSITY verbose + \set HISTCONTROL ignoredups + \set HISTFILE /dev/null - \unset QUIET - ''); + \unset QUIET + '' + ); }; } diff --git a/modules/nixos/profiles/default.nix b/modules/nixos/profiles/default.nix index 2027758..93c46e3 100644 --- a/modules/nixos/profiles/default.nix +++ b/modules/nixos/profiles/default.nix @@ -4,9 +4,11 @@ pkgs, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.profiles.default; -in { +in +{ imports = [ ./dev ./headful.nix @@ -14,7 +16,7 @@ in { ]; config = mkIf cfg.enable { - ark.directories = ["/var/log"]; + ark.directories = [ "/var/log" ]; programs.less = { enable = true; diff --git a/modules/nixos/profiles/dev/containers.nix b/modules/nixos/profiles/dev/containers.nix index 67754c0..d2a7d62 100644 --- a/modules/nixos/profiles/dev/containers.nix +++ b/modules/nixos/profiles/dev/containers.nix @@ -4,9 +4,11 @@ pkgs, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.profiles.dev.containers; -in { +in +{ config = mkIf cfg.enable { nixfiles.modules = { common.shell.aliases.b = "buildah"; @@ -17,10 +19,10 @@ in { home = { sessionVariables.MINIKUBE_HOME = "${config.dirs.config}/minikube"; - packages = with pkgs; [buildah]; + packages = with pkgs; [ buildah ]; }; - xdg.dataFile."minikube/config/config.json".text = generators.toJSON {} { + xdg.dataFile."minikube/config/config.json".text = generators.toJSON { } { config.Rootless = true; driver = "podman"; container-runtime = "cri-o"; diff --git a/modules/nixos/profiles/dev/default.nix b/modules/nixos/profiles/dev/default.nix index 5253e95..d2411ea 100644 --- a/modules/nixos/profiles/dev/default.nix +++ b/modules/nixos/profiles/dev/default.nix @@ -4,12 +4,12 @@ pkgs, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.profiles.dev; -in { - imports = [ - ./containers.nix - ]; +in +{ + imports = [ ./containers.nix ]; config = mkIf cfg.enable { hm.home.language = { diff --git a/modules/nixos/profiles/headful.nix b/modules/nixos/profiles/headful.nix index d8e1699..8206aa8 100644 --- a/modules/nixos/profiles/headful.nix +++ b/modules/nixos/profiles/headful.nix @@ -4,9 +4,11 @@ pkgs, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.profiles.headful; -in { +in +{ config = mkIf cfg.enable { nixfiles.modules = { chromium.enable = true; @@ -77,7 +79,7 @@ in { psd.enable = true; }; - environment.systemPackages = with pkgs; [lm_sensors]; + environment.systemPackages = with pkgs; [ lm_sensors ]; my.extraGroups = [ "audio" diff --git a/modules/nixos/profiles/headless.nix b/modules/nixos/profiles/headless.nix index d1fcfa4..f3f3572 100644 --- a/modules/nixos/profiles/headless.nix +++ b/modules/nixos/profiles/headless.nix @@ -4,9 +4,11 @@ pkgs, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.profiles.headless; -in { +in +{ config = mkIf cfg.enable { nixfiles.modules = { openssh.server.enable = true; @@ -33,7 +35,7 @@ in { optimise = { automatic = true; - dates = ["daily"]; + dates = [ "daily" ]; }; }; diff --git a/modules/nixos/prometheus.nix b/modules/nixos/prometheus.nix index 0320e82..9f28cd5 100644 --- a/modules/nixos/prometheus.nix +++ b/modules/nixos/prometheus.nix @@ -4,9 +4,11 @@ libNginx, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.prometheus; -in { +in +{ options.nixfiles.modules.prometheus = { enable = mkEnableOption "Prometheus"; @@ -26,7 +28,7 @@ in { config = mkIf cfg.enable { nixfiles.modules.nginx = with cfg; { enable = true; - upstreams.prometheus.servers."127.0.0.1:${toString cfg.port}" = {}; + upstreams.prometheus.servers."127.0.0.1:${toString cfg.port}" = { }; virtualHosts.${domain} = { locations."/".proxyPass = "http://prometheus"; extraConfig = libNginx.config.internalOnly; diff --git a/modules/nixos/promtail.nix b/modules/nixos/promtail.nix index 28dc897..65d88d4 100644 --- a/modules/nixos/promtail.nix +++ b/modules/nixos/promtail.nix @@ -4,9 +4,11 @@ this, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.promtail; -in { +in +{ options.nixfiles.modules.promtail = { enable = mkEnableOption "Promtail"; @@ -25,7 +27,7 @@ in { filters = mkOption { description = ''Filters to use with "scrape_config.pipeline_stages".''; type = with types; listOf attrs; - default = []; + default = [ ]; }; }; @@ -64,60 +66,63 @@ in { job_name = "journal"; journal.max_age = "24h"; relabel_configs = - map (n: let - label = toLower n; - in { - source_labels = ["__journal_${label}"]; - target_label = - if hasPrefix "_" label - then substring 1 (stringLength label - 1) label - else label; - }) [ - # Derived from systemd.journal fields[1]. - # - # [1]: https://github.com/coreos/go-systemd/blob/main/sdjournal/journal.go#L335 - # [1]: https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html + map + ( + n: + let + label = toLower n; + in + { + source_labels = [ "__journal_${label}" ]; + target_label = if hasPrefix "_" label then substring 1 (stringLength label - 1) label else label; + } + ) + [ + # Derived from systemd.journal fields[1]. + # + # [1]: https://github.com/coreos/go-systemd/blob/main/sdjournal/journal.go#L335 + # [1]: https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html - "MESSAGE" - # "MESSAGE_ID" - "PRIORITY" - # "CODE_FILE" - # "CODE_LINE" - # "CODE_FUNC" - # "ERRNO" - "SYSLOG_FACILITY" - "SYSLOG_IDENTIFIER" - # "SYSLOG_PID" - # "_PID" - # "_UID" - # "_GID" - # "_COMM" - # "_EXE" - "_CMDLINE" - # "_CAP_EFFECTIVE" - # "_AUDIT_SESSION" - # "_AUDIT_LOGINUID" - # "_SYSTEMD_CGROUP" - # "_SYSTEMD_SESSION" - # "_SYSTEMD_UNIT" - # "_SYSTEMD_USER_UNIT" - # "_SYSTEMD_OWNER_UID" - # "_SYSTEMD_SLICE" - # "_SELINUX_CONTEXT" - # "_SOURCE_REALTIME_TIMESTAMP" - # "_BOOT_ID" - # "_MACHINE_ID" - "_HOSTNAME" - # "_TRANSPORT" - # "__CURSOR" - # "__REALTIME_TIMESTAMP" - # "__MONOTONIC_TIMESTAMP" - ] + "MESSAGE" + # "MESSAGE_ID" + "PRIORITY" + # "CODE_FILE" + # "CODE_LINE" + # "CODE_FUNC" + # "ERRNO" + "SYSLOG_FACILITY" + "SYSLOG_IDENTIFIER" + # "SYSLOG_PID" + # "_PID" + # "_UID" + # "_GID" + # "_COMM" + # "_EXE" + "_CMDLINE" + # "_CAP_EFFECTIVE" + # "_AUDIT_SESSION" + # "_AUDIT_LOGINUID" + # "_SYSTEMD_CGROUP" + # "_SYSTEMD_SESSION" + # "_SYSTEMD_UNIT" + # "_SYSTEMD_USER_UNIT" + # "_SYSTEMD_OWNER_UID" + # "_SYSTEMD_SLICE" + # "_SELINUX_CONTEXT" + # "_SOURCE_REALTIME_TIMESTAMP" + # "_BOOT_ID" + # "_MACHINE_ID" + "_HOSTNAME" + # "_TRANSPORT" + # "__CURSOR" + # "__REALTIME_TIMESTAMP" + # "__MONOTONIC_TIMESTAMP" + ] ++ [ { # This is weird. I can't find where is this defined in the # source code but apparently it exists. - source_labels = ["__journal_priority_keyword"]; + source_labels = [ "__journal_priority_keyword" ]; target_label = "level"; } ]; diff --git a/modules/nixos/psd.nix b/modules/nixos/psd.nix index eb5a1a8..f974af2 100644 --- a/modules/nixos/psd.nix +++ b/modules/nixos/psd.nix @@ -4,15 +4,16 @@ pkgs, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.psd; -in { - options.nixfiles.modules.psd.enable = - mkEnableOption "Profile Sync Daemon"; +in +{ + options.nixfiles.modules.psd.enable = mkEnableOption "Profile Sync Daemon"; config = mkIf cfg.enable { hm = { - home.packages = with pkgs; [profile-sync-daemon]; + home.packages = with pkgs; [ profile-sync-daemon ]; xdg.configFile."psd/psd.conf".text = '' USE_OVERLAYFS="yes" @@ -20,40 +21,42 @@ in { }; systemd.user = { - services = let - exe = getExe' pkgs.profile-sync-daemon "profile-sync-daemon"; - in { - psd = { - unitConfig = { - Description = "Profile-sync-daemon"; - Wants = ["psd-resync.service"]; - RequiresMountsFor = "/home/"; - After = ["local-fs.target"]; - }; - serviceConfig = { - RemainAfterExit = true; - ExecStart = "${exe} startup"; - ExecStop = "${exe} unsync"; + services = + let + exe = getExe' pkgs.profile-sync-daemon "profile-sync-daemon"; + in + { + psd = { + unitConfig = { + Description = "Profile-sync-daemon"; + Wants = [ "psd-resync.service" ]; + RequiresMountsFor = "/home/"; + After = [ "local-fs.target" ]; + }; + serviceConfig = { + RemainAfterExit = true; + ExecStart = "${exe} startup"; + ExecStop = "${exe} unsync"; + }; + wantedBy = [ "graphical.target" ]; }; - wantedBy = ["graphical.target"]; - }; - psd-resync = { - unitConfig = { - Description = "Profile-sync-daemon resync"; - After = ["psd.service"]; - Wants = ["psd-resync.timer"]; - BindsTo = ["psd.service"]; + psd-resync = { + unitConfig = { + Description = "Profile-sync-daemon resync"; + After = [ "psd.service" ]; + Wants = [ "psd-resync.timer" ]; + BindsTo = [ "psd.service" ]; + }; + serviceConfig.ExecStart = "${exe} resync"; + wantedBy = [ "graphical.target" ]; }; - serviceConfig.ExecStart = "${exe} resync"; - wantedBy = ["graphical.target"]; }; - }; timers.psd-resync = { unitConfig = { Description = "Profile-sync-daemon resync timer"; - BindsTo = ["psd.service"]; + BindsTo = [ "psd.service" ]; }; timerConfig.OnUnitActiveSec = "1h"; }; diff --git a/modules/nixos/radarr.nix b/modules/nixos/radarr.nix index 72abfac..9e4e13f 100644 --- a/modules/nixos/radarr.nix +++ b/modules/nixos/radarr.nix @@ -4,9 +4,11 @@ libNginx, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.radarr; -in { +in +{ options.nixfiles.modules.radarr = { enable = mkEnableOption "Radarr"; @@ -18,11 +20,11 @@ in { }; config = mkIf cfg.enable { - ark.directories = ["/var/lib/radarr"]; + ark.directories = [ "/var/lib/radarr" ]; nixfiles.modules.nginx = { enable = true; - upstreams.radarr.servers."127.0.0.1:7878" = {}; + upstreams.radarr.servers."127.0.0.1:7878" = { }; virtualHosts.${cfg.domain} = { locations."/".proxyPass = "http://radarr"; extraConfig = libNginx.config.internalOnly; diff --git a/modules/nixos/radicale.nix b/modules/nixos/radicale.nix index 588ed51..59fb4a2 100644 --- a/modules/nixos/radicale.nix +++ b/modules/nixos/radicale.nix @@ -5,9 +5,11 @@ libNginx, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.radicale; -in { +in +{ options.nixfiles.modules.radicale = { enable = mkEnableOption "Radicale"; @@ -18,11 +20,12 @@ in { }; }; - config = let - port = 5232; - in + config = + let + port = 5232; + in mkIf cfg.enable { - ark.directories = ["/var/lib/radicale"]; + ark.directories = [ "/var/lib/radicale" ]; secrets.radicale-htpasswd = { file = "${inputs.self}/secrets/radicale-htpasswd"; @@ -32,7 +35,7 @@ in { nixfiles.modules.nginx = { enable = true; - upstreams.radicale.servers."127.0.0.1:${toString port}" = {}; + upstreams.radicale.servers."127.0.0.1:${toString port}" = { }; virtualHosts.${cfg.domain} = { locations."/".proxyPass = "http://radicale"; extraConfig = libNginx.config.internalOnly; @@ -42,7 +45,7 @@ in { services.radicale = { enable = true; settings = { - server.hosts = ["127.0.0.1:${toString port}"]; + server.hosts = [ "127.0.0.1:${toString port}" ]; web.type = "none"; auth = { type = "htpasswd"; diff --git a/modules/nixos/redis.nix b/modules/nixos/redis.nix index ca25101..e2151c7 100644 --- a/modules/nixos/redis.nix +++ b/modules/nixos/redis.nix @@ -4,13 +4,15 @@ this, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.redis; -in { +in +{ options.nixfiles.modules.redis.enable = mkEnableOption "Redis"; config = mkIf cfg.enable { - ark.directories = ["/var/lib/redis-default"]; + ark.directories = [ "/var/lib/redis-default" ]; services = { redis = { diff --git a/modules/nixos/rss-bridge.nix b/modules/nixos/rss-bridge.nix index 486f2bf..de1d6b6 100644 --- a/modules/nixos/rss-bridge.nix +++ b/modules/nixos/rss-bridge.nix @@ -4,9 +4,11 @@ libNginx, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.rss-bridge; -in { +in +{ options.nixfiles.modules.rss-bridge = { enable = mkEnableOption "RSS-Bridge"; @@ -18,7 +20,7 @@ in { }; config = mkIf cfg.enable { - ark.directories = ["/var/lib/rss-bridge"]; + ark.directories = [ "/var/lib/rss-bridge" ]; nixfiles.modules.nginx = { enable = true; @@ -28,7 +30,7 @@ in { services.rss-bridge = { enable = true; virtualHost = cfg.domain; - whitelist = ["*"]; + whitelist = [ "*" ]; }; }; } diff --git a/modules/nixos/rtorrent.nix b/modules/nixos/rtorrent.nix index c39f306..82ef1b2 100644 --- a/modules/nixos/rtorrent.nix +++ b/modules/nixos/rtorrent.nix @@ -5,14 +5,18 @@ pkgs, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.rtorrent; -in { +in +{ options.nixfiles.modules.rtorrent = { enable = mkEnableOption "rTorrent"; flood = { - enable = mkEnableOption "Flood" // {default = cfg.enable;}; + enable = mkEnableOption "Flood" // { + default = cfg.enable; + }; domain = mkOption { description = "Domain name sans protocol scheme."; @@ -22,202 +26,223 @@ in { }; }; - config = let - user = "rtorrent"; - group = "rtorrent"; - baseDir = "/var/lib/rtorrent"; - rpcSocket = "${baseDir}/rpc.socket"; - in + config = + let + user = "rtorrent"; + group = "rtorrent"; + baseDir = "/var/lib/rtorrent"; + rpcSocket = "${baseDir}/rpc.socket"; + in mkIf cfg.enable (mkMerge [ - (let - port = 50000; - in { - ark.directories = [baseDir]; - - systemd = { - services.rtorrent = { - description = "rTorrent"; - after = ["network.target" "local-fs.target"]; - serviceConfig = let - leechDir = "${baseDir}/leech"; - seedDir = "${baseDir}/seed"; - sessionDir = "${baseDir}/session"; - logDir = "${baseDir}/log"; - configFile = let - moveCompleted = getExe (pkgs.writeShellApplication { - name = "move-completed"; - runtimeInputs = with pkgs; [ - coreutils-full - gnused - findutils + ( + let + port = 50000; + in + { + ark.directories = [ baseDir ]; + + systemd = { + services.rtorrent = { + description = "rTorrent"; + after = [ + "network.target" + "local-fs.target" + ]; + serviceConfig = + let + leechDir = "${baseDir}/leech"; + seedDir = "${baseDir}/seed"; + sessionDir = "${baseDir}/session"; + logDir = "${baseDir}/log"; + configFile = + let + moveCompleted = getExe ( + pkgs.writeShellApplication { + name = "move-completed"; + runtimeInputs = with pkgs; [ + coreutils-full + gnused + findutils + ]; + text = '' + set -x + + leech_path="$1" + seed_path="$2" + # seed_path="$(echo "$2" | sed 's@+@ @g;s@%@\\x@g' | xargs -0 printf '%b')" + + mkdir -pv "$seed_path" + mv -fv "$leech_path" "$seed_path" + ''; + } + ); + in + pkgs.writeText "rtorrent.rc" '' + method.insert = cfg.leech, private|const|string, (cat, "${leechDir}") + method.insert = cfg.seed, private|const|string, (cat, "${seedDir}") + method.insert = cfg.session, private|const|string, (cat, "${sessionDir}") + method.insert = cfg.log, private|const|string, (cat, "${logDir}") + method.insert = cfg.rpcsocket, private|const|string, (cat, "${rpcSocket}") + + directory.default.set = (cat, (cfg.leech)) + session.path.set = (cat, (cfg.session)) + + network.port_range.set = ${toString port}-${toString port} + network.port_random.set = no + + dht.mode.set = disable + protocol.pex.set = no + + trackers.use_udp.set = no + + protocol.encryption.set = allow_incoming,try_outgoing,enable_retry + + pieces.memory.max.set = ${toString (pow 2 11)}M + pieces.preload.type.set = 2 + + network.xmlrpc.size_limit.set = ${toString (pow 2 17)} + + network.max_open_files.set = ${toString (pow 2 10)} + network.max_open_sockets.set = ${toString (pow 2 10)} + + network.http.max_open.set = ${toString (pow 2 8)} + + throttle.global_down.max_rate.set_kb = 0 + throttle.global_up.max_rate.set_kb = 0 + + encoding.add = UTF-8 + system.umask.set = 0027 + system.cwd.set = (directory.default) + + network.scgi.open_local = (cat, (cfg.rpcsocket)) + + method.insert = d.move_completed, simple, "\ + d.directory.set=$argument.1=;\ + execute=${moveCompleted}, $argument.0=, $argument.1=;\ + d.save_full_session=\ + " + method.insert = d.leech_path, simple, "\ + if=(d.is_multi_file),\ + (cat, (d.directory), /),\ + (cat, (d.directory), /, (d.name))\ + " + method.insert = d.seed_path, simple, "\ + cat=$cfg.seed=, /, $d.custom1=\ + " + method.set_key = event.download.finished, move_complete, "\ + d.move_completed=$d.leech_path=, $d.seed_path=\ + " + + log.open_file = "log", (cat, (cfg.log), "/", "default.log") + log.add_output = "info", "log" + log.execute = (cat, (cfg.log), "/", "execute.log") + ''; + in + { + Restart = "on-failure"; + RestartSec = 3; + + KillMode = "process"; + KillSignal = "SIGHUP"; + + User = user; + Group = group; + + ExecStartPre = concatStringsSep " " [ + "${pkgs.coreutils-full}/bin/mkdir -p" + leechDir + seedDir + sessionDir + logDir + ]; + ExecStart = concatStringsSep " " [ + (getExe pkgs.rtorrent) + "-n" + "-o system.daemon.set=true" + "-o network.bind_address.set=0.0.0.0" + "-o import=${configFile}" + ]; + ExecStop = concatStringsSep " " [ + "${pkgs.coreutils-full}/bin/rm -rf" + rpcSocket ]; - text = '' - set -x - - leech_path="$1" - seed_path="$2" - # seed_path="$(echo "$2" | sed 's@+@ @g;s@%@\\x@g' | xargs -0 printf '%b')" - - mkdir -pv "$seed_path" - mv -fv "$leech_path" "$seed_path" - ''; - }); - in - pkgs.writeText "rtorrent.rc" '' - method.insert = cfg.leech, private|const|string, (cat, "${leechDir}") - method.insert = cfg.seed, private|const|string, (cat, "${seedDir}") - method.insert = cfg.session, private|const|string, (cat, "${sessionDir}") - method.insert = cfg.log, private|const|string, (cat, "${logDir}") - method.insert = cfg.rpcsocket, private|const|string, (cat, "${rpcSocket}") - - directory.default.set = (cat, (cfg.leech)) - session.path.set = (cat, (cfg.session)) - - network.port_range.set = ${toString port}-${toString port} - network.port_random.set = no - - dht.mode.set = disable - protocol.pex.set = no - - trackers.use_udp.set = no - - protocol.encryption.set = allow_incoming,try_outgoing,enable_retry - - pieces.memory.max.set = ${toString (pow 2 11)}M - pieces.preload.type.set = 2 - - network.xmlrpc.size_limit.set = ${toString (pow 2 17)} - - network.max_open_files.set = ${toString (pow 2 10)} - network.max_open_sockets.set = ${toString (pow 2 10)} - - network.http.max_open.set = ${toString (pow 2 8)} - - throttle.global_down.max_rate.set_kb = 0 - throttle.global_up.max_rate.set_kb = 0 - - encoding.add = UTF-8 - system.umask.set = 0027 - system.cwd.set = (directory.default) - - network.scgi.open_local = (cat, (cfg.rpcsocket)) - - method.insert = d.move_completed, simple, "\ - d.directory.set=$argument.1=;\ - execute=${moveCompleted}, $argument.0=, $argument.1=;\ - d.save_full_session=\ - " - method.insert = d.leech_path, simple, "\ - if=(d.is_multi_file),\ - (cat, (d.directory), /),\ - (cat, (d.directory), /, (d.name))\ - " - method.insert = d.seed_path, simple, "\ - cat=$cfg.seed=, /, $d.custom1=\ - " - method.set_key = event.download.finished, move_complete, "\ - d.move_completed=$d.leech_path=, $d.seed_path=\ - " - - log.open_file = "log", (cat, (cfg.log), "/", "default.log") - log.add_output = "info", "log" - log.execute = (cat, (cfg.log), "/", "execute.log") - ''; - in { - Restart = "on-failure"; - RestartSec = 3; - - KillMode = "process"; - KillSignal = "SIGHUP"; - User = user; - Group = group; + RuntimeDirectory = "rtorrent"; + RuntimeDirectoryMode = 750; + UMask = 27; + AmbientCapabilities = [ "" ]; + CapabilityBoundingSet = [ "" ]; + LockPersonality = true; + MemoryDenyWriteExecute = true; + NoNewPrivileges = true; + PrivateDevices = true; + PrivateTmp = true; + PrivateUsers = true; + ProtectClock = true; + ProtectControlGroups = true; + ProtectHome = true; + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + ProcSubset = "pid"; + RemoveIPC = true; + RestrictAddressFamilies = [ + "AF_UNIX" + "AF_INET" + "AF_INET6" + ]; + RestrictNamespaces = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + SystemCallArchitectures = "native"; + SystemCallFilter = [ + "@system-service" + "~@resources" + "~@privileged" + ]; + }; + wantedBy = [ "multi-user.target" ]; + }; - ExecStartPre = concatStringsSep " " [ - "${pkgs.coreutils-full}/bin/mkdir -p" - leechDir - seedDir - sessionDir - logDir - ]; - ExecStart = concatStringsSep " " [ - (getExe pkgs.rtorrent) - "-n" - "-o system.daemon.set=true" - "-o network.bind_address.set=0.0.0.0" - "-o import=${configFile}" - ]; - ExecStop = concatStringsSep " " [ - "${pkgs.coreutils-full}/bin/rm -rf" - rpcSocket - ]; + tmpfiles.rules = [ "d '${baseDir}' 0750 ${user} ${group} -" ]; + }; - RuntimeDirectory = "rtorrent"; - RuntimeDirectoryMode = 0750; - UMask = 0027; - AmbientCapabilities = [""]; - CapabilityBoundingSet = [""]; - LockPersonality = true; - MemoryDenyWriteExecute = true; - NoNewPrivileges = true; - PrivateDevices = true; - PrivateTmp = true; - PrivateUsers = true; - ProtectClock = true; - ProtectControlGroups = true; - ProtectHome = true; - ProtectHostname = true; - ProtectKernelLogs = true; - ProtectKernelModules = true; - ProtectKernelTunables = true; - ProcSubset = "pid"; - RemoveIPC = true; - RestrictAddressFamilies = ["AF_UNIX" "AF_INET" "AF_INET6"]; - RestrictNamespaces = true; - RestrictRealtime = true; - RestrictSUIDSGID = true; - SystemCallArchitectures = "native"; - SystemCallFilter = ["@system-service" "~@resources" "~@privileged"]; + users = { + users.${user} = { + inherit group; + shell = pkgs.bashInteractive; + home = baseDir; + description = "rTorrent"; + isSystemUser = true; }; - wantedBy = ["multi-user.target"]; + groups.${group} = { }; }; - - tmpfiles.rules = ["d '${baseDir}' 0750 ${user} ${group} -"]; - }; - - users = { - users.${user} = { - inherit group; - shell = pkgs.bashInteractive; - home = baseDir; - description = "rTorrent"; - isSystemUser = true; + my.extraGroups = [ group ]; + + networking.firewall.allowedTCPPorts = [ port ]; + + boot.kernel.sysctl = { + "net.core.rmem_max" = mkOverride 500 (pow 2 24); + "net.core.wmem_max" = mkOverride 500 (pow 2 24); + "net.ipv4.tcp_fin_timeout" = mkOverride 500 30; + "net.ipv4.tcp_rmem" = mkOverride 500 (mkTcpMem 12 23 24); + "net.ipv4.tcp_slow_start_after_idle" = 0; + "net.ipv4.tcp_tw_recycle" = mkOverride 500 1; + "net.ipv4.tcp_tw_reuse" = mkOverride 500 1; + "net.ipv4.tcp_wmem" = mkOverride 500 (mkTcpMem 12 23 24); }; - groups.${group} = {}; - }; - my.extraGroups = [group]; - - networking.firewall.allowedTCPPorts = [port]; - - boot.kernel.sysctl = { - "net.core.rmem_max" = mkOverride 500 (pow 2 24); - "net.core.wmem_max" = mkOverride 500 (pow 2 24); - "net.ipv4.tcp_fin_timeout" = mkOverride 500 30; - "net.ipv4.tcp_rmem" = mkOverride 500 (mkTcpMem 12 23 24); - "net.ipv4.tcp_slow_start_after_idle" = 0; - "net.ipv4.tcp_tw_recycle" = mkOverride 500 1; - "net.ipv4.tcp_tw_reuse" = mkOverride 500 1; - "net.ipv4.tcp_wmem" = mkOverride 500 (mkTcpMem 12 23 24); - }; - }) - (let - port = 50001; - pkg = pkgs.nodePackages.flood; - in + } + ) + ( + let + port = 50001; + pkg = pkgs.nodePackages.flood; + in mkIf cfg.flood.enable { nixfiles.modules.nginx = { enable = true; - upstreams.flood.servers."127.0.0.1:${toString port}" = {}; + upstreams.flood.servers."127.0.0.1:${toString port}" = { }; virtualHosts.${cfg.flood.domain} = { root = "${pkg}/lib/node_modules/flood/dist/assets"; locations = { @@ -233,8 +258,11 @@ in { systemd.services.flood = { description = "Flood"; - after = ["network.target" "rtorrent.service"]; - path = with pkgs; [mediainfo]; + after = [ + "network.target" + "rtorrent.service" + ]; + path = with pkgs; [ mediainfo ]; serviceConfig = { Restart = "on-failure"; RestartSec = 3; @@ -255,10 +283,10 @@ in { ]; RuntimeDirectory = "rtorrent"; - RuntimeDirectoryMode = 0750; - UMask = 0027; - AmbientCapabilities = [""]; - CapabilityBoundingSet = [""]; + RuntimeDirectoryMode = 750; + UMask = 27; + AmbientCapabilities = [ "" ]; + CapabilityBoundingSet = [ "" ]; LockPersonality = true; NoNewPrivileges = true; PrivateDevices = true; @@ -274,7 +302,11 @@ in { ProcSubset = "pid"; ProtectProc = "invisible"; RemoveIPC = true; - RestrictAddressFamilies = ["AF_UNIX" "AF_INET" "AF_INET6"]; + RestrictAddressFamilies = [ + "AF_UNIX" + "AF_INET" + "AF_INET6" + ]; RestrictNamespaces = true; RestrictRealtime = true; RestrictSUIDSGID = true; @@ -288,8 +320,9 @@ in { "~@resources" ]; }; - wantedBy = ["multi-user.target"]; + wantedBy = [ "multi-user.target" ]; }; - }) + } + ) ]); } diff --git a/modules/nixos/searx.nix b/modules/nixos/searx.nix index 5c37f58..de51a20 100644 --- a/modules/nixos/searx.nix +++ b/modules/nixos/searx.nix @@ -5,9 +5,11 @@ libNginx, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.searx; -in { +in +{ options.nixfiles.modules.searx = { enable = mkEnableOption "SearX"; @@ -33,7 +35,7 @@ in { nixfiles.modules.nginx = { enable = true; - upstreams.searx.servers."127.0.0.1:${toString cfg.port}" = {}; + upstreams.searx.servers."127.0.0.1:${toString cfg.port}" = { }; virtualHosts.${cfg.domain} = { locations."/".proxyPass = "http://searx"; extraConfig = libNginx.config.internalOnly; diff --git a/modules/nixos/shadowsocks.nix b/modules/nixos/shadowsocks.nix index 69688da..670faec 100644 --- a/modules/nixos/shadowsocks.nix +++ b/modules/nixos/shadowsocks.nix @@ -5,9 +5,11 @@ pkgs, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.shadowsocks; -in { +in +{ options.nixfiles.modules.shadowsocks = { enable = mkEnableOption "Shadowsocks"; @@ -31,61 +33,65 @@ in { systemd.services.shadowsocks = { description = "Shadowsocks"; - after = ["network.target"]; - wantedBy = ["multi-user.target"]; + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; serviceConfig = { DynamicUser = true; RuntimeDirectory = "shadowsocks"; LoadCredential = "secret.json:${config.secrets.shadowsocks-json.path}"; - ExecStartPre = let - mergeJson = let - configFile = pkgs.writeText "config.json" (generators.toJSON {} { - server = "::"; - server_port = cfg.port; - # Can't really use AEAD-2022[1] just yet because it's not - # supported by some[2] clients. - # - # [1]: https://shadowsocks.org/doc/sip022.html - # [2]: https://github.com/shadowsocks/ShadowsocksX-NG/issues/1480 - # [2]: https://github.com/shadowsocks/shadowsocks-windows/issues/3448 - # method = "2022-blake3-chacha20-poly1305"; - method = "chacha20-ietf-poly1305"; - password = null; # Must be set as a secret. - users = null; # Muse be set as a secret. - fast_open = true; - acl = pkgs.writeText "block-internal-access.acl" '' - [outbound_block_list] - 0.0.0.0/8 - 10.0.0.0/8 - 100.64.0.0/10 - 127.0.0.0/8 - 169.254.0.0/16 - 172.16.0.0/12 - 192.0.0.0/24 - 192.0.2.0/24 - 192.88.99.0/24 - 192.168.0.0/16 - 198.18.0.0/15 - 198.51.100.0/24 - 203.0.113.0/24 - 224.0.0.0/4 - 240.0.0.0/4 - 255.255.255.255/32 - ::1/128 - ::ffff:127.0.0.1/104 - fc00::/7 - fe80::/10 + ExecStartPre = + let + mergeJson = + let + configFile = pkgs.writeText "config.json" ( + generators.toJSON { } { + server = "::"; + server_port = cfg.port; + # Can't really use AEAD-2022[1] just yet because it's not + # supported by some[2] clients. + # + # [1]: https://shadowsocks.org/doc/sip022.html + # [2]: https://github.com/shadowsocks/ShadowsocksX-NG/issues/1480 + # [2]: https://github.com/shadowsocks/shadowsocks-windows/issues/3448 + # method = "2022-blake3-chacha20-poly1305"; + method = "chacha20-ietf-poly1305"; + password = null; # Must be set as a secret. + users = null; # Muse be set as a secret. + fast_open = true; + acl = pkgs.writeText "block-internal-access.acl" '' + [outbound_block_list] + 0.0.0.0/8 + 10.0.0.0/8 + 100.64.0.0/10 + 127.0.0.0/8 + 169.254.0.0/16 + 172.16.0.0/12 + 192.0.0.0/24 + 192.0.2.0/24 + 192.88.99.0/24 + 192.168.0.0/16 + 198.18.0.0/15 + 198.51.100.0/24 + 203.0.113.0/24 + 224.0.0.0/4 + 240.0.0.0/4 + 255.255.255.255/32 + ::1/128 + ::ffff:127.0.0.1/104 + fc00::/7 + fe80::/10 + ''; + } + ); + in + pkgs.writeShellScript "meregeJson" '' + ${getExe pkgs.jq} \ + -s '.[0] * .[1]' \ + ${configFile} \ + $CREDENTIALS_DIRECTORY/secret.json \ + >$RUNTIME_DIRECTORY/config.json ''; - }); in - pkgs.writeShellScript "meregeJson" '' - ${getExe pkgs.jq} \ - -s '.[0] * .[1]' \ - ${configFile} \ - $CREDENTIALS_DIRECTORY/secret.json \ - >$RUNTIME_DIRECTORY/config.json - ''; - in mergeJson; ExecStart = "${pkgs.shadowsocks-rust}/bin/ssserver --config \${RUNTIME_DIRECTORY}/config.json"; }; @@ -100,7 +106,7 @@ in { ''; }; - networking.firewall.allowedTCPPorts = [cfg.port]; + networking.firewall.allowedTCPPorts = [ cfg.port ]; # https://github.com/shadowsocks/shadowsocks/wiki/Optimizing-Shadowsocks boot.kernel.sysctl = { diff --git a/modules/nixos/soju.nix b/modules/nixos/soju.nix index 71dff86..f8212b5 100644 --- a/modules/nixos/soju.nix +++ b/modules/nixos/soju.nix @@ -5,9 +5,11 @@ this, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.soju; -in { +in +{ options.nixfiles.modules.soju = { enable = mkEnableOption "soju"; @@ -30,7 +32,9 @@ in { }; prometheus = { - enable = mkEnableOption "Prometheus exporter" // {default = true;}; + enable = mkEnableOption "Prometheus exporter" // { + default = true; + }; port = mkOption { description = "Port."; @@ -40,9 +44,10 @@ in { }; }; - config = let - db = "soju"; - in + config = + let + db = "soju"; + in mkIf cfg.enable { nixfiles.modules = { acme.enable = true; @@ -58,7 +63,7 @@ in { }; services.postgresql = { - ensureDatabases = [db]; + ensureDatabases = [ db ]; ensureUsers = [ { name = db; @@ -69,41 +74,41 @@ in { systemd.services.soju = { description = "soju IRC bouncer"; - wantedBy = ["multi-user.target"]; - wants = ["network-online.target"]; - requires = ["postgresql.service"]; - after = ["network-online.target" "postgresql.service"]; + wantedBy = [ "multi-user.target" ]; + wants = [ "network-online.target" ]; + requires = [ "postgresql.service" ]; + after = [ + "network-online.target" + "postgresql.service" + ]; serviceConfig = { - ExecStart = let - # https://soju.im/doc/soju.1.html - configFile = pkgs.writeText "soju.conf" '' - listen ircs://${cfg.address}:${toString cfg.port} - tls ${with config.certs.${cfg.domain}; "${directory}/fullchain.pem ${directory}/key.pem"} - ${ - with cfg.prometheus; - optionalString enable - "listen http+prometheus://localhost:${toString port}" - } - db postgres ${ - concatStringsSep " " [ - "host=/run/postgresql" - "user=${db}" - "dbname=${db}" - "sslmode=disable" - ] - } - hostname ${cfg.domain} - title ${cfg.domain} - ''; - in + ExecStart = + let + # https://soju.im/doc/soju.1.html + configFile = pkgs.writeText "soju.conf" '' + listen ircs://${cfg.address}:${toString cfg.port} + tls ${with config.certs.${cfg.domain}; "${directory}/fullchain.pem ${directory}/key.pem"} + ${with cfg.prometheus; optionalString enable "listen http+prometheus://localhost:${toString port}"} + db postgres ${ + concatStringsSep " " [ + "host=/run/postgresql" + "user=${db}" + "dbname=${db}" + "sslmode=disable" + ] + } + hostname ${cfg.domain} + title ${cfg.domain} + ''; + in concatStringsSep " " [ (getExe' pkgs.soju "soju") "-config ${configFile}" ]; DynamicUser = true; - SupplementaryGroups = [config.services.nginx.group]; - AmbientCapabilities = [""]; - CapabilityBoundingSet = [""]; + SupplementaryGroups = [ config.services.nginx.group ]; + AmbientCapabilities = [ "" ]; + CapabilityBoundingSet = [ "" ]; UMask = "0077"; LockPersonality = true; MemoryDenyWriteExecute = true; @@ -122,12 +127,19 @@ in { ProtectProc = "invisible"; ProcSubset = "pid"; RemoveIPC = true; - RestrictAddressFamilies = ["AF_UNIX" "AF_INET" "AF_INET6"]; + RestrictAddressFamilies = [ + "AF_UNIX" + "AF_INET" + "AF_INET6" + ]; RestrictNamespaces = true; RestrictRealtime = true; RestrictSUIDSGID = true; SystemCallArchitectures = "native"; - SystemCallFilter = ["@system-service" "~@privileged"]; + SystemCallFilter = [ + "@system-service" + "~@privileged" + ]; }; }; }; diff --git a/modules/nixos/solaar.nix b/modules/nixos/solaar.nix index ccfff4a..17a04de 100644 --- a/modules/nixos/solaar.nix +++ b/modules/nixos/solaar.nix @@ -4,49 +4,59 @@ pkgs, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.solaar; -in { +in +{ options.nixfiles.modules.solaar = { enable = mkEnableOption "Solaar"; }; config = mkIf cfg.enable { hm = { - home.packages = with pkgs; [solaar]; + home.packages = with pkgs; [ solaar ]; systemd.user.services.solaar = { Unit = { Description = "Device manager for Logitech devices"; - After = ["graphical-session-pre.target"]; - PartOf = ["graphical-session.target"]; + After = [ "graphical-session-pre.target" ]; + PartOf = [ "graphical-session.target" ]; }; Service = { # The dirtiest hack I've ever implemented... I should be ashamed of # it. Regardless, that shit still doesn't work because each reconnect, # /dev/hidraw* is recreated and has default permissions which breaks # Solaar. Fuck this shit. - ExecStartPre = getExe (pkgs.writeShellApplication { - name = "solaar-pre"; - text = '' - for i in /dev/hidraw*; do - if [ -c "$i" ]; then - sudo chown root:input "$i" - sudo chmod 0660 "$i" - fi - done - ''; - }); + ExecStartPre = getExe ( + pkgs.writeShellApplication { + name = "solaar-pre"; + text = '' + for i in /dev/hidraw*; do + if [ -c "$i" ]; then + sudo chown root:input "$i" + sudo chmod 0660 "$i" + fi + done + ''; + } + ); ExecStart = "${getExe pkgs.solaar "solaar"} --window=hide"; }; - Install.WantedBy = ["graphical-session.target"]; + Install.WantedBy = [ "graphical-session.target" ]; }; }; - boot.kernelModules = ["hid_logitech_dj" "hid_logitech_hidpp"]; + boot.kernelModules = [ + "hid_logitech_dj" + "hid_logitech_hidpp" + ]; hardware.uinput.enable = true; - my.extraGroups = ["uinput" "input"]; + my.extraGroups = [ + "uinput" + "input" + ]; }; } diff --git a/modules/nixos/sonarr.nix b/modules/nixos/sonarr.nix index 5cd8931..b11dda0 100644 --- a/modules/nixos/sonarr.nix +++ b/modules/nixos/sonarr.nix @@ -4,9 +4,11 @@ libNginx, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.sonarr; -in { +in +{ options.nixfiles.modules.sonarr = { enable = mkEnableOption "Sonarr"; @@ -18,11 +20,11 @@ in { }; config = mkIf cfg.enable { - ark.directories = ["/var/lib/sonarr"]; + ark.directories = [ "/var/lib/sonarr" ]; nixfiles.modules.nginx = { enable = true; - upstreams.sonarr.servers."127.0.0.1:8989" = {}; + upstreams.sonarr.servers."127.0.0.1:8989" = { }; virtualHosts.${cfg.domain} = { locations."/".proxyPass = "http://sonarr"; extraConfig = libNginx.config.internalOnly; diff --git a/modules/nixos/sound.nix b/modules/nixos/sound.nix index 073d59c..ff90dfc 100644 --- a/modules/nixos/sound.nix +++ b/modules/nixos/sound.nix @@ -1,13 +1,10 @@ -{ - config, - lib, - ... -}: -with lib; let +{ config, lib, ... }: +with lib; +let cfg = config.nixfiles.modules.sound; -in { - options.nixfiles.modules.sound.enable = - mkEnableOption "sound support"; +in +{ + options.nixfiles.modules.sound.enable = mkEnableOption "sound support"; config = mkIf cfg.enable { services.pipewire = { diff --git a/modules/nixos/syncthing.nix b/modules/nixos/syncthing.nix index ecc983f..74d4afe 100644 --- a/modules/nixos/syncthing.nix +++ b/modules/nixos/syncthing.nix @@ -6,9 +6,11 @@ this, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.syncthing; -in { +in +{ options.nixfiles.modules.syncthing = { enable = mkEnableOption "Syncthing"; @@ -74,7 +76,8 @@ in { insecureSkipHostcheck = this.isHeadless; }; - devices = mapAttrs (name: attr: + devices = mapAttrs ( + name: attr: mkIf (attr.syncthing.id != null && hasAttr "wireguard" attr) { inherit (attr.syncthing) id; compression = "metadata"; @@ -82,30 +85,33 @@ in { address = "tcp://${name}.${config.networking.domain}:22000"; autoAcceptFolders = true; untrusted = false; - }) - my.configurations; - - folders = let - filterDevices = f: - attrNames (filterAttrs (_: attr: - (attr.hostname != this.hostname) - && (attr.syncthing.id != null) - && f attr) - my.configurations); - all = filterDevices (_: true); - notHeadless = filterDevices (attr: !attr.isHeadless); - notOther = filterDevices (attr: !attr.isOther); - - simple = { - type = "simple"; - params.keep = "5"; - }; - trashcan = { - type = "trashcan"; - params.cleanoutDays = "7"; - }; - in - with config.hm.xdg.userDirs; { + } + ) my.configurations; + + folders = + let + filterDevices = + f: + attrNames ( + filterAttrs ( + _: attr: (attr.hostname != this.hostname) && (attr.syncthing.id != null) && f attr + ) my.configurations + ); + all = filterDevices (_: true); + notHeadless = filterDevices (attr: !attr.isHeadless); + notOther = filterDevices (attr: !attr.isOther); + + simple = { + type = "simple"; + params.keep = "5"; + }; + trashcan = { + type = "trashcan"; + params.cleanoutDays = "7"; + }; + in + with config.hm.xdg.userDirs; + { share = { path = publicShare; devices = notHeadless; @@ -145,7 +151,7 @@ in { (mkIf this.isHeadless { nixfiles.modules.nginx = { enable = true; - upstreams.syncthing.servers.${config.services.syncthing.guiAddress} = {}; + upstreams.syncthing.servers.${config.services.syncthing.guiAddress} = { }; virtualHosts.${cfg.domain} = { locations."/".proxyPass = "http://syncthing"; extraConfig = libNginx.config.internalOnly; diff --git a/modules/nixos/throttled.nix b/modules/nixos/throttled.nix index eca803b..7d37cd4 100644 --- a/modules/nixos/throttled.nix +++ b/modules/nixos/throttled.nix @@ -1,11 +1,9 @@ -{ - config, - lib, - ... -}: -with lib; let +{ config, lib, ... }: +with lib; +let cfg = config.nixfiles.modules.throttled; -in { +in +{ options.nixfiles.modules.throttled.enable = mkEnableOption "Throttled"; config = mkIf cfg.enable { diff --git a/modules/nixos/thunderbird.nix b/modules/nixos/thunderbird.nix index 29ea9c9..74af3b5 100644 --- a/modules/nixos/thunderbird.nix +++ b/modules/nixos/thunderbird.nix @@ -1,11 +1,9 @@ -{ - config, - lib, - ... -}: -with lib; let +{ config, lib, ... }: +with lib; +let cfg = config.nixfiles.modules.thunderbird; -in { +in +{ options.nixfiles.modules.thunderbird.enable = mkEnableOption "Thunderbird"; config = mkIf cfg.enable { @@ -20,7 +18,8 @@ in { isDefault = true; withExternalGnupg = true; # https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/user.js - settings = with config.colors.withHashtag; + settings = + with config.colors.withHashtag; config.hm.programs.firefox.profiles.default.settings // { "app.donation.eoy.version.viewed" = 999; diff --git a/modules/nixos/unbound.nix b/modules/nixos/unbound.nix index 5aaf104..e71d48c 100644 --- a/modules/nixos/unbound.nix +++ b/modules/nixos/unbound.nix @@ -5,9 +5,11 @@ this, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.unbound; -in { +in +{ options.nixfiles.modules.unbound = { enable = mkEnableOption "Unbound"; @@ -18,11 +20,12 @@ in { }; }; - config = let - adblock-conf = "${config.services.unbound.stateDir}/adblock.conf"; - in + config = + let + adblock-conf = "${config.services.unbound.stateDir}/adblock.conf"; + in mkIf cfg.enable { - ark.directories = [config.services.unbound.stateDir]; + ark.directories = [ config.services.unbound.stateDir ]; nixfiles.modules.redis.enable = true; @@ -45,40 +48,51 @@ in { ipv6.address ]; - local-zone = - concatLists - (mapAttrsToList (h: _: ["\"${h}.${cfg.domain}\" redirect"]) - my.configurations); - local-data = concatLists (mapAttrsToList (hostname: let - domain = "${hostname}.${cfg.domain}"; - in - attr: (optionals (hasAttr "wireguard" attr) (with attr.wireguard; - [ - "\"${domain} 604800 IN A ${ipv4.address}\"" - "\"${domain} 604800 IN AAAA ${ipv6.address}\"" - "\"${domain}. A ${ipv4.address}\"" - "\"${domain}. AAAA ${ipv6.address}\"" - ] - ++ concatMap (domain: [ - "\"${domain}. A ${ipv4.address}\"" - "\"${domain}. AAAA ${ipv6.address}\"" - ]) - attr.domains))) - my.configurations); - local-data-ptr = concatLists (mapAttrsToList (hostname: let - domain = "${hostname}.${cfg.domain}"; - in - attr: (optionals (hasAttr "wireguard" attr) (with attr.wireguard; - [ - "\"${ipv4.address} ${domain}\"" - "\"${ipv6.address} ${domain}\"" - ] - ++ concatMap (domain: [ - "\"${ipv4.address} ${domain}\"" - "\"${ipv6.address} ${domain}\"" - ]) - attr.domains))) - my.configurations); + local-zone = concatLists ( + mapAttrsToList (h: _: [ "\"${h}.${cfg.domain}\" redirect" ]) my.configurations + ); + local-data = concatLists ( + mapAttrsToList ( + hostname: + let + domain = "${hostname}.${cfg.domain}"; + in + attr: + (optionals (hasAttr "wireguard" attr) ( + with attr.wireguard; + [ + "\"${domain} 604800 IN A ${ipv4.address}\"" + "\"${domain} 604800 IN AAAA ${ipv6.address}\"" + "\"${domain}. A ${ipv4.address}\"" + "\"${domain}. AAAA ${ipv6.address}\"" + ] + ++ concatMap (domain: [ + "\"${domain}. A ${ipv4.address}\"" + "\"${domain}. AAAA ${ipv6.address}\"" + ]) attr.domains + )) + ) my.configurations + ); + local-data-ptr = concatLists ( + mapAttrsToList ( + hostname: + let + domain = "${hostname}.${cfg.domain}"; + in + attr: + (optionals (hasAttr "wireguard" attr) ( + with attr.wireguard; + [ + "\"${ipv4.address} ${domain}\"" + "\"${ipv6.address} ${domain}\"" + ] + ++ concatMap (domain: [ + "\"${ipv4.address} ${domain}\"" + "\"${ipv6.address} ${domain}\"" + ]) attr.domains + )) + ) my.configurations + ); private-domain = map (domain: "${domain}.") [ cfg.domain @@ -124,9 +138,19 @@ in { { name = "."; forward-tls-upstream = true; - forward-addr = let - mkDnsOverTls = ips: auth: map (ip: concatStrings [ip "@" auth]) ips; - in + forward-addr = + let + mkDnsOverTls = + ips: auth: + map ( + ip: + concatStrings [ + ip + "@" + auth + ] + ) ips; + in mkDnsOverTls dns.const.quad9.default "853#dns.quad9.net"; } ]; @@ -154,40 +178,45 @@ in { systemd = { services = { - unbound.after = ["unbound-adblock-update.service"]; + unbound.after = [ "unbound-adblock-update.service" ]; unbound-adblock-update = { serviceConfig = with config.services.unbound; { Type = "oneshot"; User = user; Group = group; - ExecStart = getExe (pkgs.writeShellApplication { - name = "unbound-adblock-update"; - runtimeInputs = [pkgs.curl package]; - text = '' - curl \ - -s \ - -o ${adblock-conf} \ - "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/unbound/multi.blacklist.conf" - - if [[ -f "${localControlSocketPath}" ]]; then - unbound-control reload - fi - ''; - }); + ExecStart = getExe ( + pkgs.writeShellApplication { + name = "unbound-adblock-update"; + runtimeInputs = [ + pkgs.curl + package + ]; + text = '' + curl \ + -s \ + -o ${adblock-conf} \ + "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/unbound/multi.blacklist.conf" + + if [[ -f "${localControlSocketPath}" ]]; then + unbound-control reload + fi + ''; + } + ); }; }; }; timers.unbound-adblock-update = { - requires = ["network-online.target"]; - after = ["network-online.target"]; + requires = [ "network-online.target" ]; + after = [ "network-online.target" ]; timerConfig = { OnCalendar = "daily"; Persistent = true; Unit = "unbound-adblock-update.service"; }; - wantedBy = ["timers.target"]; + wantedBy = [ "timers.target" ]; }; }; diff --git a/modules/nixos/vaultwarden.nix b/modules/nixos/vaultwarden.nix index 53a3f81..2cacb6c 100644 --- a/modules/nixos/vaultwarden.nix +++ b/modules/nixos/vaultwarden.nix @@ -4,9 +4,11 @@ lib, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.vaultwarden; -in { +in +{ options.nixfiles.modules.vaultwarden = { enable = mkEnableOption "Vaultwarden"; @@ -17,11 +19,12 @@ in { }; }; - config = let - db = "vaultwarden"; - in + config = + let + db = "vaultwarden"; + in mkIf cfg.enable { - ark.directories = ["/var/lib/bitwarden_rs"]; + ark.directories = [ "/var/lib/bitwarden_rs" ]; secrets.vaultwarden-environment = { file = "${inputs.self}/secrets/vaultwarden-environment"; @@ -33,8 +36,8 @@ in { nginx = { enable = true; upstreams = with config.services.vaultwarden.config; { - vaultwarden_rocket.servers."${ROCKET_ADDRESS}:${toString ROCKET_PORT}" = {}; - vaultwarden_websocket.servers."${WEBSOCKET_ADDRESS}:${toString WEBSOCKET_PORT}" = {}; + vaultwarden_rocket.servers."${ROCKET_ADDRESS}:${toString ROCKET_PORT}" = { }; + vaultwarden_websocket.servers."${WEBSOCKET_ADDRESS}:${toString WEBSOCKET_PORT}" = { }; }; virtualHosts.${cfg.domain}.locations = { "/" = { @@ -95,7 +98,7 @@ in { }; postgresql = { - ensureDatabases = [db]; + ensureDatabases = [ db ]; ensureUsers = [ { name = db; @@ -123,14 +126,14 @@ in { }; environment.etc = { - "fail2ban/filter.d/vaultwarden.conf".text = generators.toINI {} { + "fail2ban/filter.d/vaultwarden.conf".text = generators.toINI { } { Definition = { failregex = "^.*Username or password is incorrect\. Try again\. IP: <ADDR>\. Username:.*$"; ignoreregex = ""; journalmatch = "_SYSTEMD_UNIT=vaultwarden.service"; }; }; - "fail2ban/filter.d/vaultwarden-admin.conf".text = generators.toINI {} { + "fail2ban/filter.d/vaultwarden-admin.conf".text = generators.toINI { } { Definition = { failregex = "^.*Invalid admin token\. IP: <ADDR>.*$"; ignoreregex = ""; diff --git a/modules/nixos/victoriametrics.nix b/modules/nixos/victoriametrics.nix index 6b037b9..88dff1b 100644 --- a/modules/nixos/victoriametrics.nix +++ b/modules/nixos/victoriametrics.nix @@ -4,9 +4,11 @@ libNginx, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.prometheus; -in { +in +{ options.nixfiles.modules.prometheus = { enable = mkEnableOption "VictoriaMetrics"; @@ -26,7 +28,7 @@ in { config = mkIf cfg.enable { nixfiles.modules.nginx = with cfg; { enable = true; - upstreams.victoriametrics.servers."127.0.0.1:${toString cfg.port}" = {}; + upstreams.victoriametrics.servers."127.0.0.1:${toString cfg.port}" = { }; virtualHosts.${domain} = { locations."/".proxyPass = "http://victoriametrics"; extraConfig = libNginx.config.internalOnly; diff --git a/modules/nixos/vim/default.nix b/modules/nixos/vim/default.nix index 2fdf064..5d62e35 100644 --- a/modules/nixos/vim/default.nix +++ b/modules/nixos/vim/default.nix @@ -4,9 +4,11 @@ pkgs, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.vim; -in { +in +{ config = mkIf cfg.enable { programs.vim.package = (pkgs.vim-full.override { @@ -23,13 +25,13 @@ in { rubySupport = false; tclSupport = false; ximSupport = false; - }) - .customize { - name = "vim"; - vimrcConfig = with cfg; { - customRC = rc; - packages.myVimPackage.start = plugins; + }).customize + { + name = "vim"; + vimrcConfig = with cfg; { + customRC = rc; + packages.myVimPackage.start = plugins; + }; }; - }; }; } diff --git a/modules/nixos/wayland.nix b/modules/nixos/wayland.nix index b64ab32..e3dba79 100644 --- a/modules/nixos/wayland.nix +++ b/modules/nixos/wayland.nix @@ -4,12 +4,16 @@ pkgs, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.wayland; -in { +in +{ options.nixfiles.modules.wayland.enable = mkEnableOption "Wayland"; config = mkIf cfg.enable { - hm.home.packages = with pkgs; [wl-clipboard]; + nixfiles.modules.foot.enable = true; + + hm.home.packages = with pkgs; [ wl-clipboard ]; }; } diff --git a/modules/nixos/wireguard.nix b/modules/nixos/wireguard.nix index d05c6ae..f645a90 100644 --- a/modules/nixos/wireguard.nix +++ b/modules/nixos/wireguard.nix @@ -6,9 +6,11 @@ this, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.wireguard; -in { +in +{ options.nixfiles.modules.wireguard = { client = { enable = mkEnableOption "WireGuard client"; @@ -56,16 +58,20 @@ in { peers = mkOption { description = "List of peers."; type = with types; listOf attrs; - default = mapAttrsToList (_: attr: - with attr; { - inherit (wireguard) publicKey; - allowedIPs = with wireguard; [ - "${ipv4.address}/32" - "${ipv6.address}/128" - ]; - }) (filterAttrs (_: attr: - attr.hostname != this.hostname && hasAttr "wireguard" attr) - my.configurations); + default = + mapAttrsToList + ( + _: attr: with attr; { + inherit (wireguard) publicKey; + allowedIPs = with wireguard; [ + "${ipv4.address}/32" + "${ipv6.address}/128" + ]; + } + ) + ( + filterAttrs (_: attr: attr.hostname != this.hostname && hasAttr "wireguard" attr) my.configurations + ); }; }; @@ -105,13 +111,16 @@ in { (mkIf (cfg.client.enable || cfg.server.enable) { secrets."wireguard-private-key-${this.hostname}".file = "${inputs.self}/secrets/wireguard-private-key-${this.hostname}"; - networking.firewall.trustedInterfaces = [cfg.interface]; + networking.firewall.trustedInterfaces = [ cfg.interface ]; }) (mkIf cfg.client.enable { networking.wg-quick.interfaces.${cfg.interface} = mkMerge [ (with this.wireguard; { privateKeyFile = config.secrets."wireguard-private-key-${this.hostname}".path; - address = ["${ipv4.address}/16" "${ipv6.address}/16"]; + address = [ + "${ipv4.address}/16" + "${ipv6.address}/16" + ]; }) (with cfg.server; { peers = [ @@ -119,15 +128,16 @@ in { inherit publicKey; endpoint = "${address}:${toString port}"; allowedIPs = - if cfg.client.enableTrafficRouting - then [ - "0.0.0.0/0" - "::/0" - ] - else [ - cfg.ipv4.subnet - cfg.ipv6.subnet - ]; + if cfg.client.enableTrafficRouting then + [ + "0.0.0.0/0" + "::/0" + ] + else + [ + cfg.ipv4.subnet + cfg.ipv6.subnet + ]; persistentKeepalive = 25; } ]; @@ -141,7 +151,11 @@ in { environment.systemPackages = with pkgs; [ (writeShellApplication { name = "wg-toggle"; - runtimeInputs = [iproute2 jq wireguard-tools]; + runtimeInputs = [ + iproute2 + jq + wireguard-tools + ]; text = '' ip46() { sudo ip -4 "$@" @@ -166,7 +180,10 @@ in { enable = true; interfaces.${cfg.interface} = with cfg.server; { privateKeyFile = config.secrets."wireguard-private-key-${this.hostname}".path; - ips = ["${ipv4.address}/16" "${ipv6.address}/16"]; + ips = [ + "${ipv4.address}/16" + "${ipv6.address}/16" + ]; listenPort = port; inherit peers; allowedIPsAsRoutes = false; @@ -179,12 +196,12 @@ in { externalInterface = mkDefault "eth0"; - internalInterfaces = [cfg.interface]; - internalIPs = [cfg.ipv4.subnet]; - internalIPv6s = [cfg.ipv6.subnet]; + internalInterfaces = [ cfg.interface ]; + internalIPs = [ cfg.ipv4.subnet ]; + internalIPv6s = [ cfg.ipv6.subnet ]; }; - firewall.allowedUDPPorts = [cfg.server.port]; + firewall.allowedUDPPorts = [ cfg.server.port ]; }; services.prometheus.exporters.wireguard = { diff --git a/modules/nixos/x11.nix b/modules/nixos/x11.nix index 52420db..55ba0b5 100644 --- a/modules/nixos/x11.nix +++ b/modules/nixos/x11.nix @@ -4,9 +4,11 @@ pkgs, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.x11; -in { +in +{ options.nixfiles.modules.x11.enable = mkEnableOption "X11"; config = mkIf cfg.enable { @@ -19,7 +21,7 @@ in { XCOMPOSECACHE = "${config.dirs.cache}/libx11/compose"; }; - packages = with pkgs; [xclip]; + packages = with pkgs; [ xclip ]; }; xresources.properties = { @@ -34,21 +36,23 @@ in { services.xsettingsd = { enable = true; # https://codeberg.org/derat/xsettingsd#settings - settings = let - xprop = config.hm.xresources.properties; - in { - "Net/CursorBlink" = 1; - "Net/CursorBlinkTime" = 1200; - "Net/DndDragThreshold" = 0; - "Net/DoubleClickDistance" = 5; - "Net/DoubleClickTime" = 250; - "Net/EnableEventSounds" = 1; - "Net/EnableInputFeedbackSounds" = 1; - "Xft/Antialias" = xprop."Xft.antialias"; - "Xft/HintStyle" = xprop."Xft.hintstyle"; - "Xft/Hinting" = xprop."Xft.hinting"; - "Xft/RGBA" = xprop."Xft.rgba"; - }; + settings = + let + xprop = config.hm.xresources.properties; + in + { + "Net/CursorBlink" = 1; + "Net/CursorBlinkTime" = 1200; + "Net/DndDragThreshold" = 0; + "Net/DoubleClickDistance" = 5; + "Net/DoubleClickTime" = 250; + "Net/EnableEventSounds" = 1; + "Net/EnableInputFeedbackSounds" = 1; + "Xft/Antialias" = xprop."Xft.antialias"; + "Xft/HintStyle" = xprop."Xft.hintstyle"; + "Xft/Hinting" = xprop."Xft.hinting"; + "Xft/RGBA" = xprop."Xft.rgba"; + }; }; }; diff --git a/modules/nixos/xmonad.nix b/modules/nixos/xmonad.nix index b4eb4a0..7b49f52 100644 --- a/modules/nixos/xmonad.nix +++ b/modules/nixos/xmonad.nix @@ -4,9 +4,11 @@ pkgs, ... }: -with lib; let +with lib; +let cfg = config.nixfiles.modules.xmonad; -in { +in +{ options.nixfiles.modules.xmonad.enable = mkEnableOption "XMonad"; config = mkIf cfg.enable { @@ -24,6 +26,6 @@ in { services.xserver.displayManager.startx.enable = true; - nixpkgs.overlays = [inputs.xmonad-ng.overlays.default]; + nixpkgs.overlays = [ inputs.xmonad-ng.overlays.default ]; }; } diff --git a/modules/nixos/zathura.nix b/modules/nixos/zathura.nix index e7d1415..95039a5 100644 --- a/modules/nixos/zathura.nix +++ b/modules/nixos/zathura.nix @@ -1,11 +1,9 @@ -{ - config, - lib, - ... -}: -with lib; let +{ config, lib, ... }: +with lib; +let cfg = config.nixfiles.modules.zathura; -in { +in +{ config = mkIf cfg.enable { nixfiles.modules.common.xdg.defaultApplications."org.pwmt.zathura" = [ "application/pdf" |