diff options
Diffstat (limited to 'modules/nixos')
| -rw-r--r-- | modules/nixos/common/nix.nix | 3 | ||||
| -rw-r--r-- | modules/nixos/common/secrets.nix | 46 | ||||
| -rw-r--r-- | modules/nixos/emacs.nix | 19 | ||||
| -rw-r--r-- | modules/nixos/git/default.nix | 189 |
4 files changed, 87 insertions, 170 deletions
diff --git a/modules/nixos/common/nix.nix b/modules/nixos/common/nix.nix index efebe97..410e01d 100644 --- a/modules/nixos/common/nix.nix +++ b/modules/nixos/common/nix.nix @@ -14,13 +14,10 @@ in { }; config = { - nix.settings.trusted-users = ["@wheel"]; - nixpkgs = { config.allowUnfreePredicate = p: elem (getName p) cfg.allowedUnfreePackages; overlays = with inputs; [ - agenix.overlays.default nix-minecraft.overlay pollymc.overlay xmonad-ng.overlays.default diff --git a/modules/nixos/common/secrets.nix b/modules/nixos/common/secrets.nix index 2ee5753..9a82c44 100644 --- a/modules/nixos/common/secrets.nix +++ b/modules/nixos/common/secrets.nix @@ -1,45 +1,3 @@ -{ - config, - inputs, - lib, - pkgs, - this, - ... -}: -with lib; { - imports = [ - inputs.agenix.nixosModules.default - (mkAliasOptionModule ["secrets"] ["age" "secrets"]) - ]; - - config = { - age = { - identityPaths = - if this.isHeadful - then ["${config.my.home}/.ssh/id_${my.ssh.type}"] - else - map (attr: attr.path) (filter (attr: attr.type == my.ssh.type) - config.services.openssh.hostKeys); - - # This can be used to auto-add all secrets, thus eliminating the need to - # specify path to each envrypted file. The drawback is that this will - # expose *all* secrets to all machines and try to decrypt them all even on - # machines where the secret will not be used. - # - # secrets = - # let - # secretsSourceDir = "${inputs.self}/age"; - # in - # mapAttrs' - # (name: _: - # nameValuePair name { - # file = "${secretsSourceDir}/${name}"; - # owner = mkDefault my.username; - # group = mkDefault config.my.group; - # }) - # (builtins.readDir secretsSourceDir); - }; - - environment.systemPackages = with pkgs; [agenix]; - }; +{inputs, ...}: { + imports = [inputs.agenix.nixosModules.default]; } diff --git a/modules/nixos/emacs.nix b/modules/nixos/emacs.nix index e348398..82c2f6e 100644 --- a/modules/nixos/emacs.nix +++ b/modules/nixos/emacs.nix @@ -1,6 +1,5 @@ { config, - inputs, lib, ... }: @@ -8,23 +7,11 @@ with lib; let cfg = config.nixfiles.modules.emacs; in { config = mkIf cfg.enable { - secrets.authinfo = { - file = "${inputs.self}/secrets/authinfo"; - owner = my.username; - inherit (config.my) group; - }; - nixfiles.modules.x11.enable = true; - hm = { - programs.emacs.extraConfig = mkAfter '' - (appendq! auth-sources '("${config.secrets.authinfo.path}")) - ''; - - services.emacs = { - enable = true; - client.enable = true; - }; + hm.services.emacs = { + enable = true; + client.enable = true; }; }; } diff --git a/modules/nixos/git/default.nix b/modules/nixos/git/default.nix index 1bf63c7..fd25eec 100644 --- a/modules/nixos/git/default.nix +++ b/modules/nixos/git/default.nix @@ -1,7 +1,6 @@ { config, lib, - inputs, pkgs, ... }: @@ -24,123 +23,99 @@ in { }; }; - config = mkMerge [ - (mkIf cfg.client.enable { - secrets = { - glab-cli-config = { - file = "${inputs.self}/secrets/glab-cli-config"; - path = "${config.dirs.config}/glab-cli/config.yml"; - owner = my.username; - inherit (config.my) group; - }; - gh-hosts = { - file = "${inputs.self}/secrets/gh-hosts"; - path = "${config.dirs.config}/gh/hosts.yml"; - owner = my.username; - inherit (config.my) group; - }; - hut = { - file = "${inputs.self}/secrets/hut"; - path = "${config.dirs.config}/hut/config"; - owner = my.username; - inherit (config.my) group; - }; - }; - }) - (mkIf cfg.server.enable { - nixfiles.modules.nginx = { - enable = true; - virtualHosts.${cfg.server.domain} = { - locations = { - "/".extraConfig = let - cgitrc = pkgs.writeText "cgitrc" '' - root-title=github sux >:^( - root-desc=Homo sum, humani a me nihil alienum puto. - footer= + config = mkIf cfg.server.enable { + nixfiles.modules.nginx = { + enable = true; + virtualHosts.${cfg.server.domain} = { + locations = { + "/".extraConfig = let + cgitrc = pkgs.writeText "cgitrc" '' + root-title=github sux >:^( + root-desc=Homo sum, humani a me nihil alienum puto. + footer= - clone-url=https://${cfg.server.domain}/$CGIT_REPO_URL + clone-url=https://${cfg.server.domain}/$CGIT_REPO_URL - logo=/cgit-custom-logo.gif - favicon=/cgit-custom-favicon.gif - css=/cgit-custom-style.css + logo=/cgit-custom-logo.gif + favicon=/cgit-custom-favicon.gif + css=/cgit-custom-style.css - about-filter=${cfg.server.package}/lib/cgit/filters/about-formatting.sh - source-filter=${cfg.server.package}/lib/cgit/filters/syntax-highlighting.py - commit-filter=${cfg.server.package}/lib/cgit/filters/commit-links.sh + about-filter=${cfg.server.package}/lib/cgit/filters/about-formatting.sh + source-filter=${cfg.server.package}/lib/cgit/filters/syntax-highlighting.py + commit-filter=${cfg.server.package}/lib/cgit/filters/commit-links.sh - enable-git-config=1 - enable-gitweb-owner=1 - remove-suffix=1 + enable-git-config=1 + enable-gitweb-owner=1 + remove-suffix=1 - readme=:README - readme=:README.md - readme=:README.org - readme=:README.txt - readme=:readme - readme=:readme.md - readme=:readme.org - readme=:readme.txt + readme=:README + readme=:README.md + readme=:README.org + readme=:README.txt + readme=:readme + readme=:readme.md + readme=:readme.org + readme=:readme.txt - scan-path=${config.services.gitolite.dataDir}/repositories - ''; - in '' - include ${config.services.nginx.package}/conf/fastcgi_params; - fastcgi_split_path_info ^(/?)(.+)$; - fastcgi_pass unix:${config.services.fcgiwrap.socketAddress}; - fastcgi_param SCRIPT_FILENAME ${cfg.server.package}/cgit/cgit.cgi; - fastcgi_param CGIT_CONFIG ${cgitrc}; - fastcgi_param PATH_INFO $uri; - fastcgi_param QUERY_STRING $args; - fastcgi_param HTTP_HOST $server_name; - ''; - "~* ^.+(cgit.css|robots.txt)$".extraConfig = '' - root ${cfg.server.package}/cgit; + scan-path=${config.services.gitolite.dataDir}/repositories ''; - "~* ^.+cgit-custom-logo.gif$".extraConfig = '' - alias ${./logo.gif}; - ''; - "~* ^.+cgit-custom-favicon.gif$".extraConfig = '' - alias ${./favicon.ico}; - ''; - "~* ^.+cgit-custom-style.css$".extraConfig = let - css = with config.colourScheme; - pkgs.writeText "custom.css" '' - @import url("cgit.css"); + in '' + include ${config.services.nginx.package}/conf/fastcgi_params; + fastcgi_split_path_info ^(/?)(.+)$; + fastcgi_pass unix:${config.services.fcgiwrap.socketAddress}; + fastcgi_param SCRIPT_FILENAME ${cfg.server.package}/cgit/cgit.cgi; + fastcgi_param CGIT_CONFIG ${cgitrc}; + fastcgi_param PATH_INFO $uri; + fastcgi_param QUERY_STRING $args; + fastcgi_param HTTP_HOST $server_name; + ''; + "~* ^.+(cgit.css|robots.txt)$".extraConfig = '' + root ${cfg.server.package}/cgit; + ''; + "~* ^.+cgit-custom-logo.gif$".extraConfig = '' + alias ${./logo.gif}; + ''; + "~* ^.+cgit-custom-favicon.gif$".extraConfig = '' + alias ${./favicon.ico}; + ''; + "~* ^.+cgit-custom-style.css$".extraConfig = let + css = with config.colourScheme; + pkgs.writeText "custom.css" '' + @import url("cgit.css"); - div#cgit { - font-family: "${config.fontScheme.monospaceFont.family}", monospace; - -moz-tab-size: 4; - tab-size: 4; - } - ''; - in '' - alias ${css}; - ''; - }; + div#cgit { + font-family: "${config.fontScheme.monospaceFont.family}", monospace; + -moz-tab-size: 4; + tab-size: 4; + } + ''; + in '' + alias ${css}; + ''; }; }; + }; - services = let - user = "git"; - group = "git"; - in { - gitolite = { - enable = true; - inherit user group; - adminPubkey = my.ssh.key; - extraGitoliteRc = '' - # This allows hiding repositories via "cgit.ignore"[1]. - # - # [1]: https://www.omarpolo.com/post/cgit-gitolite.html - $RC{GIT_CONFIG_KEYS} = '.*'; - ''; - }; + services = let + user = "git"; + group = "git"; + in { + gitolite = { + enable = true; + inherit user group; + adminPubkey = my.ssh.key; + extraGitoliteRc = '' + # This allows hiding repositories via "cgit.ignore"[1]. + # + # [1]: https://www.omarpolo.com/post/cgit-gitolite.html + $RC{GIT_CONFIG_KEYS} = '.*'; + ''; + }; - fcgiwrap = { - enable = true; - inherit user group; - }; + fcgiwrap = { + enable = true; + inherit user group; }; - }) - ]; + }; + }; } |