summaryrefslogtreecommitdiff
path: root/modules/nixos
diff options
context:
space:
mode:
Diffstat (limited to 'modules/nixos')
-rw-r--r--modules/nixos/common/nix.nix3
-rw-r--r--modules/nixos/common/secrets.nix46
-rw-r--r--modules/nixos/emacs.nix19
-rw-r--r--modules/nixos/git/default.nix189
4 files changed, 87 insertions, 170 deletions
diff --git a/modules/nixos/common/nix.nix b/modules/nixos/common/nix.nix
index efebe97..410e01d 100644
--- a/modules/nixos/common/nix.nix
+++ b/modules/nixos/common/nix.nix
@@ -14,13 +14,10 @@ in {
};
config = {
- nix.settings.trusted-users = ["@wheel"];
-
nixpkgs = {
config.allowUnfreePredicate = p: elem (getName p) cfg.allowedUnfreePackages;
overlays = with inputs; [
- agenix.overlays.default
nix-minecraft.overlay
pollymc.overlay
xmonad-ng.overlays.default
diff --git a/modules/nixos/common/secrets.nix b/modules/nixos/common/secrets.nix
index 2ee5753..9a82c44 100644
--- a/modules/nixos/common/secrets.nix
+++ b/modules/nixos/common/secrets.nix
@@ -1,45 +1,3 @@
-{
- config,
- inputs,
- lib,
- pkgs,
- this,
- ...
-}:
-with lib; {
- imports = [
- inputs.agenix.nixosModules.default
- (mkAliasOptionModule ["secrets"] ["age" "secrets"])
- ];
-
- config = {
- age = {
- identityPaths =
- if this.isHeadful
- then ["${config.my.home}/.ssh/id_${my.ssh.type}"]
- else
- map (attr: attr.path) (filter (attr: attr.type == my.ssh.type)
- config.services.openssh.hostKeys);
-
- # This can be used to auto-add all secrets, thus eliminating the need to
- # specify path to each envrypted file. The drawback is that this will
- # expose *all* secrets to all machines and try to decrypt them all even on
- # machines where the secret will not be used.
- #
- # secrets =
- # let
- # secretsSourceDir = "${inputs.self}/age";
- # in
- # mapAttrs'
- # (name: _:
- # nameValuePair name {
- # file = "${secretsSourceDir}/${name}";
- # owner = mkDefault my.username;
- # group = mkDefault config.my.group;
- # })
- # (builtins.readDir secretsSourceDir);
- };
-
- environment.systemPackages = with pkgs; [agenix];
- };
+{inputs, ...}: {
+ imports = [inputs.agenix.nixosModules.default];
}
diff --git a/modules/nixos/emacs.nix b/modules/nixos/emacs.nix
index e348398..82c2f6e 100644
--- a/modules/nixos/emacs.nix
+++ b/modules/nixos/emacs.nix
@@ -1,6 +1,5 @@
{
config,
- inputs,
lib,
...
}:
@@ -8,23 +7,11 @@ with lib; let
cfg = config.nixfiles.modules.emacs;
in {
config = mkIf cfg.enable {
- secrets.authinfo = {
- file = "${inputs.self}/secrets/authinfo";
- owner = my.username;
- inherit (config.my) group;
- };
-
nixfiles.modules.x11.enable = true;
- hm = {
- programs.emacs.extraConfig = mkAfter ''
- (appendq! auth-sources '("${config.secrets.authinfo.path}"))
- '';
-
- services.emacs = {
- enable = true;
- client.enable = true;
- };
+ hm.services.emacs = {
+ enable = true;
+ client.enable = true;
};
};
}
diff --git a/modules/nixos/git/default.nix b/modules/nixos/git/default.nix
index 1bf63c7..fd25eec 100644
--- a/modules/nixos/git/default.nix
+++ b/modules/nixos/git/default.nix
@@ -1,7 +1,6 @@
{
config,
lib,
- inputs,
pkgs,
...
}:
@@ -24,123 +23,99 @@ in {
};
};
- config = mkMerge [
- (mkIf cfg.client.enable {
- secrets = {
- glab-cli-config = {
- file = "${inputs.self}/secrets/glab-cli-config";
- path = "${config.dirs.config}/glab-cli/config.yml";
- owner = my.username;
- inherit (config.my) group;
- };
- gh-hosts = {
- file = "${inputs.self}/secrets/gh-hosts";
- path = "${config.dirs.config}/gh/hosts.yml";
- owner = my.username;
- inherit (config.my) group;
- };
- hut = {
- file = "${inputs.self}/secrets/hut";
- path = "${config.dirs.config}/hut/config";
- owner = my.username;
- inherit (config.my) group;
- };
- };
- })
- (mkIf cfg.server.enable {
- nixfiles.modules.nginx = {
- enable = true;
- virtualHosts.${cfg.server.domain} = {
- locations = {
- "/".extraConfig = let
- cgitrc = pkgs.writeText "cgitrc" ''
- root-title=github sux >:^(
- root-desc=Homo sum, humani a me nihil alienum puto.
- footer=
+ config = mkIf cfg.server.enable {
+ nixfiles.modules.nginx = {
+ enable = true;
+ virtualHosts.${cfg.server.domain} = {
+ locations = {
+ "/".extraConfig = let
+ cgitrc = pkgs.writeText "cgitrc" ''
+ root-title=github sux >:^(
+ root-desc=Homo sum, humani a me nihil alienum puto.
+ footer=
- clone-url=https://${cfg.server.domain}/$CGIT_REPO_URL
+ clone-url=https://${cfg.server.domain}/$CGIT_REPO_URL
- logo=/cgit-custom-logo.gif
- favicon=/cgit-custom-favicon.gif
- css=/cgit-custom-style.css
+ logo=/cgit-custom-logo.gif
+ favicon=/cgit-custom-favicon.gif
+ css=/cgit-custom-style.css
- about-filter=${cfg.server.package}/lib/cgit/filters/about-formatting.sh
- source-filter=${cfg.server.package}/lib/cgit/filters/syntax-highlighting.py
- commit-filter=${cfg.server.package}/lib/cgit/filters/commit-links.sh
+ about-filter=${cfg.server.package}/lib/cgit/filters/about-formatting.sh
+ source-filter=${cfg.server.package}/lib/cgit/filters/syntax-highlighting.py
+ commit-filter=${cfg.server.package}/lib/cgit/filters/commit-links.sh
- enable-git-config=1
- enable-gitweb-owner=1
- remove-suffix=1
+ enable-git-config=1
+ enable-gitweb-owner=1
+ remove-suffix=1
- readme=:README
- readme=:README.md
- readme=:README.org
- readme=:README.txt
- readme=:readme
- readme=:readme.md
- readme=:readme.org
- readme=:readme.txt
+ readme=:README
+ readme=:README.md
+ readme=:README.org
+ readme=:README.txt
+ readme=:readme
+ readme=:readme.md
+ readme=:readme.org
+ readme=:readme.txt
- scan-path=${config.services.gitolite.dataDir}/repositories
- '';
- in ''
- include ${config.services.nginx.package}/conf/fastcgi_params;
- fastcgi_split_path_info ^(/?)(.+)$;
- fastcgi_pass unix:${config.services.fcgiwrap.socketAddress};
- fastcgi_param SCRIPT_FILENAME ${cfg.server.package}/cgit/cgit.cgi;
- fastcgi_param CGIT_CONFIG ${cgitrc};
- fastcgi_param PATH_INFO $uri;
- fastcgi_param QUERY_STRING $args;
- fastcgi_param HTTP_HOST $server_name;
- '';
- "~* ^.+(cgit.css|robots.txt)$".extraConfig = ''
- root ${cfg.server.package}/cgit;
+ scan-path=${config.services.gitolite.dataDir}/repositories
'';
- "~* ^.+cgit-custom-logo.gif$".extraConfig = ''
- alias ${./logo.gif};
- '';
- "~* ^.+cgit-custom-favicon.gif$".extraConfig = ''
- alias ${./favicon.ico};
- '';
- "~* ^.+cgit-custom-style.css$".extraConfig = let
- css = with config.colourScheme;
- pkgs.writeText "custom.css" ''
- @import url("cgit.css");
+ in ''
+ include ${config.services.nginx.package}/conf/fastcgi_params;
+ fastcgi_split_path_info ^(/?)(.+)$;
+ fastcgi_pass unix:${config.services.fcgiwrap.socketAddress};
+ fastcgi_param SCRIPT_FILENAME ${cfg.server.package}/cgit/cgit.cgi;
+ fastcgi_param CGIT_CONFIG ${cgitrc};
+ fastcgi_param PATH_INFO $uri;
+ fastcgi_param QUERY_STRING $args;
+ fastcgi_param HTTP_HOST $server_name;
+ '';
+ "~* ^.+(cgit.css|robots.txt)$".extraConfig = ''
+ root ${cfg.server.package}/cgit;
+ '';
+ "~* ^.+cgit-custom-logo.gif$".extraConfig = ''
+ alias ${./logo.gif};
+ '';
+ "~* ^.+cgit-custom-favicon.gif$".extraConfig = ''
+ alias ${./favicon.ico};
+ '';
+ "~* ^.+cgit-custom-style.css$".extraConfig = let
+ css = with config.colourScheme;
+ pkgs.writeText "custom.css" ''
+ @import url("cgit.css");
- div#cgit {
- font-family: "${config.fontScheme.monospaceFont.family}", monospace;
- -moz-tab-size: 4;
- tab-size: 4;
- }
- '';
- in ''
- alias ${css};
- '';
- };
+ div#cgit {
+ font-family: "${config.fontScheme.monospaceFont.family}", monospace;
+ -moz-tab-size: 4;
+ tab-size: 4;
+ }
+ '';
+ in ''
+ alias ${css};
+ '';
};
};
+ };
- services = let
- user = "git";
- group = "git";
- in {
- gitolite = {
- enable = true;
- inherit user group;
- adminPubkey = my.ssh.key;
- extraGitoliteRc = ''
- # This allows hiding repositories via "cgit.ignore"[1].
- #
- # [1]: https://www.omarpolo.com/post/cgit-gitolite.html
- $RC{GIT_CONFIG_KEYS} = '.*';
- '';
- };
+ services = let
+ user = "git";
+ group = "git";
+ in {
+ gitolite = {
+ enable = true;
+ inherit user group;
+ adminPubkey = my.ssh.key;
+ extraGitoliteRc = ''
+ # This allows hiding repositories via "cgit.ignore"[1].
+ #
+ # [1]: https://www.omarpolo.com/post/cgit-gitolite.html
+ $RC{GIT_CONFIG_KEYS} = '.*';
+ '';
+ };
- fcgiwrap = {
- enable = true;
- inherit user group;
- };
+ fcgiwrap = {
+ enable = true;
+ inherit user group;
};
- })
- ];
+ };
+ };
}
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-20 05:42:44 +0000