diff options
Diffstat (limited to 'modules')
117 files changed, 9391 insertions, 0 deletions
diff --git a/modules/nixfiles/acme.nix b/modules/nixfiles/acme.nix new file mode 100644 index 0000000..196a6a5 --- /dev/null +++ b/modules/nixfiles/acme.nix @@ -0,0 +1,32 @@ +{ + config, + lib, + ... +}: +with lib; let + cfg = config.nixfiles.modules.acme; +in { + imports = [ + (mkAliasOptionModule ["certs"] ["security" "acme" "certs"]) + ]; + + options.nixfiles.modules.acme = { + enable = mkEnableOption "Whether to enable ACME."; + + email = mkOption { + description = "Email for notifications."; + type = with types; str; + default = "admin+acme@${my.domain.shire}"; + }; + }; + + config = mkIf cfg.enable { + security.acme = { + acceptTerms = true; + defaults = { + inherit (cfg) email; + validMinDays = 60; + }; + }; + }; +} diff --git a/modules/nixfiles/alacritty.nix b/modules/nixfiles/alacritty.nix new file mode 100644 index 0000000..8b3e646 --- /dev/null +++ b/modules/nixfiles/alacritty.nix @@ -0,0 +1,119 @@ +{ + config, + lib, + ... +}: +with lib; let + cfg = config.nixfiles.modules.alacritty; +in { + options.nixfiles.modules.alacritty.enable = + mkEnableOption "Whether to enable Alacritty terminal emulator."; + + config = mkIf cfg.enable { + hm.programs.alacritty = { + enable = true; + settings = with config.nixfiles.modules; { + window = { + padding = with config.fontScheme.monospaceFont; { + x = size; + y = size; + }; + dynamic_padding = false; + decorations = + if (kde.enable || gnome.enable) + then "full" + else "none"; + }; + font = with config.fontScheme.monospaceFont; { + normal = { + inherit family; + style = "Regular"; + }; + bold = { + inherit family; + style = "Bold"; + }; + italic = { + inherit family; + style = "Italic"; + }; + bold_italic = { + inherit family; + style = "Bold Italic"; + }; + inherit size; + }; + colors = with profiles.common.colourScheme; { + primary = {inherit background foreground;}; + cursor = { + text = "CellBackground"; + cursor = "CellForeground"; + }; + vi_mode_cursor = { + text = "CellBackground"; + cursor = "CellForeground"; + }; + search = { + matches = { + foreground = white; + background = red; + }; + focused_match = { + foreground = red; + background = black; + }; + bar = { + foreground = black; + background = white; + }; + }; + hints = { + start = { + foreground = black; + background = yellow; + }; + end = { + foreground = yellow; + background = black; + }; + line_indicator = { + foreground = null; + background = null; + }; + selection = { + text = "CellBackground"; + background = "CellForeground"; + }; + normal = { + inherit black red green yellow blue magenta cyan white; + }; + bright = { + inherit + brightBlack + brightRed + brightGreen + brightYellow + brightBlue + brightMagenta + brightCyan + brightWhite + ; + }; + }; + }; + bell = { + duration = 0; + command = null; # TODO notify-send? + }; + cursor = { + style = { + shape = "Block"; + blinking = "Off"; + }; + vi_mode_style = "Block"; + }; + selection.save_to_clipboard = true; # TODO autocutsel? + }; + }; + }; +} diff --git a/modules/nixfiles/alertmanager.nix b/modules/nixfiles/alertmanager.nix new file mode 100644 index 0000000..e067cd1 --- /dev/null +++ b/modules/nixfiles/alertmanager.nix @@ -0,0 +1,81 @@ +{ + config, + lib, + ... +}: +with lib; let + cfg = config.nixfiles.modules.alertmanager; +in { + options.nixfiles.modules.alertmanager = { + enable = mkEnableOption "Whether to enable Alertmanager."; + + port = mkOption { + description = "Port."; + type = with types; port; + default = 30112; + }; + + domain = mkOption { + description = "Domain name sans protocol scheme."; + type = with types; nullOr str; + default = config.nixfiles.modules.monitoring.domain; + }; + + path = mkOption { + description = "Path."; + type = with types; str; + default = "/alertmanager"; + }; + }; + + config = mkIf cfg.enable { + nixfiles.modules.nginx = with cfg; { + enable = true; + virtualHosts.${cfg.domain}.locations.${path} = { + proxyPass = "http://127.0.0.1:${toString port}${path}"; + extraConfig = '' + if ($internal != 1) { + return 403; + } + ''; + }; + }; + + services = let + acme = config.nixfiles.modules.acme.enable; + in { + prometheus.alertmanager = { + enable = true; + + listenAddress = "127.0.0.1"; + inherit (cfg) port; + + extraFlags = [ + "--web.external-url=http${ + optionalString acme "s" + }://${cfg.domain}${cfg.path}" + ]; + + # TODO Make an option. + configuration = { + global = { + smtp_from = "alertmanager@${my.domain.shire}"; + smtp_smarthost = "${my.domain.shire}:584"; + }; + + route = { + receiver = my.username; + group_by = ["alertname"]; + }; + + receivers = [ + { + name = my.username; + email_configs = [{to = "${my.username}+alert@${my.domain.shire}";}]; + } + ]; + }; + }; + }; + }; +} diff --git a/modules/nixfiles/aria2.nix b/modules/nixfiles/aria2.nix new file mode 100644 index 0000000..87f2109 --- /dev/null +++ b/modules/nixfiles/aria2.nix @@ -0,0 +1,48 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.aria2; +in { + options.nixfiles.modules.aria2.enable = + mkEnableOption "Whether to enable aria2."; + + config = mkIf cfg.enable { + hm = { + programs.aria2 = { + enable = true; + + settings = { + bt-max-peers = 128; + bt-save-metadata = true; + continue = true; + enable-dht = true; + enable-peer-exchange = true; + enable-rpc = false; + follow-torrent = true; + log-level = "info"; + max-connection-per-server = 16; + max-overall-upload-limit = "1K"; + max-tries = 5; + max-upload-limit = "1K"; + seed-ratio = 0.1; + seed-time = 0.1; + stream-piece-selector = "default"; + timeout = 60; + }; + }; + + xdg.desktopEntries.aria2c = { + name = "aria2"; + genericName = "Download Manager"; + exec = "${pkgs.aria2}/bin/aria2c"; + terminal = true; + categories = ["Application" "Network"]; + mimeType = ["application/x-bittorrent" "x-scheme-handler/magnet"]; + }; + }; + }; +} diff --git a/modules/nixfiles/aspell.nix b/modules/nixfiles/aspell.nix new file mode 100644 index 0000000..7669eb9 --- /dev/null +++ b/modules/nixfiles/aspell.nix @@ -0,0 +1,23 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.aspell; +in { + options.nixfiles.modules.aspell.enable = + mkEnableOption "Whether to enable GNU Aspell."; + + config = mkIf cfg.enable { + hm.home = { + file.".aspell.conf".text = '' + personal /dev/null + repl /dev/null + ''; + + packages = with pkgs; [(aspellWithDicts (p: with p; [en ru]))]; + }; + }; +} diff --git a/modules/nixfiles/bat.nix b/modules/nixfiles/bat.nix new file mode 100644 index 0000000..d4bb1d6 --- /dev/null +++ b/modules/nixfiles/bat.nix @@ -0,0 +1,39 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.bat; +in { + options.nixfiles.modules.bat.enable = mkEnableOption "Whether to enable Bat."; + + config = mkIf cfg.enable { + hm.programs = { + bat = { + enable = true; + config = { + style = "plain"; + tabs = "4"; + theme = "base16"; + wrap = "never"; + }; + }; + + bash = { + shellAliases = let + bat = "${pkgs.bat}/bin/bat"; + in { + bay = "${bat} --language=yaml --tabs 2"; + baj = "${bat} --language=json --tabs 2"; + }; + + initExtra = mkAfter '' + _complete_alias bay _bat bat + _complete_alias baj _bat bat + ''; + }; + }; + }; +} diff --git a/modules/nixfiles/beets.nix b/modules/nixfiles/beets.nix new file mode 100644 index 0000000..de4cd73 --- /dev/null +++ b/modules/nixfiles/beets.nix @@ -0,0 +1,73 @@ +{ + config, + lib, + ... +}: +with lib; let + cfg = config.nixfiles.modules.beets; +in { + options.nixfiles.modules.beets.enable = + mkEnableOption "Whether to enable beets."; + + config = mkIf cfg.enable { + hm = let + beetsdir = "${config.hm.xdg.dataHome}/beets"; + in { + home.sessionVariables.BEETSDIR = beetsdir; + + programs = { + beets = { + enable = true; + + settings = { + library = "${beetsdir}/library.db"; + directory = config.userDirs.music; + plugins = "badfiles edit fetchart info mbsync scrub"; + original_date = true; + import = { + write = true; + copy = true; + move = false; + bell = true; + from_scratch = true; + }; + match = { + preferred = { + countries = [ + "JP" + "KR" + "TW" + "HK" + "CN" + "RU" + "NL" + "DE" + "AT" + "GB|UK" + "CA" + "AU" + "NZ" + "US" + ]; + original_year = true; + }; + }; + edit = { + albumfields = "album artist albumartist"; + itemfields = "track title album artist albumartist day month year genre"; + }; + fetchart = { + auto = true; + cautious = true; + cover_names = "cover Cover folder Folder art Art album Album front Front"; + sources = "filesystem coverart itunes amazon albumart wikipedia"; + }; + scrub.auto = true; + }; + }; + + bash.shellAliases.beet = "${config.hm.programs.beets.package}/bin/beet --config ${config.dirs.config}/beets/config.yaml"; + }; + }; + }; +} diff --git a/modules/nixfiles/bluetooth.nix b/modules/nixfiles/bluetooth.nix new file mode 100644 index 0000000..04e6b8d --- /dev/null +++ b/modules/nixfiles/bluetooth.nix @@ -0,0 +1,34 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.bluetooth; +in { + options.nixfiles.modules.bluetooth.enable = + mkEnableOption "Whether to enable Bluetooth support."; + + config = mkIf cfg.enable { + hardware.bluetooth = { + enable = true; + package = pkgs.bluezFull; + settings.General.FastConnectable = true; + }; + + environment = { + etc."bluetooth/input.conf".text = generators.toINI {} { + General = { + IdleTimeout = 15; + UserspaceHID = true; + }; + }; + + systemPackages = with pkgs; + with config.nixfiles.modules; + optional gnome.enable gnome.gnome-bluetooth + ++ optional kde.enable plasma5Packages.bluedevil; + }; + }; +} diff --git a/modules/nixfiles/broot.nix b/modules/nixfiles/broot.nix new file mode 100644 index 0000000..19cd1d6 --- /dev/null +++ b/modules/nixfiles/broot.nix @@ -0,0 +1,18 @@ +{ + config, + lib, + ... +}: +with lib; let + cfg = config.nixfiles.modules.broot; +in { + options.nixfiles.modules.broot.enable = + mkEnableOption "Whether to enable broot."; + + config = mkIf cfg.enable { + hm.programs.broot = { + enable = true; + modal = true; + }; + }; +} diff --git a/modules/nixfiles/chromium.nix b/modules/nixfiles/chromium.nix new file mode 100644 index 0000000..1ec761c --- /dev/null +++ b/modules/nixfiles/chromium.nix @@ -0,0 +1,42 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.chromium; +in { + options.nixfiles.modules.chromium.enable = + mkEnableOption "Whether to enable Chromium."; + + config = mkIf cfg.enable { + hm = { + # home.sessionVariables.BROWSER = mkOverride 300 "chromium"; + + programs.chromium = { + enable = true; + + package = pkgs.chromium; + + extensions = + [ + {id = "cjpalhdlnbpafiamejdnhcphjbkeiagm";} # UBlock Origin + {id = "clngdbkpkpeebahjckkjfobafhncgmne";} # Stylus + {id = "cnojnbdhbhnkbcieeekonklommdnndci";} # Search By Image + {id = "doojmbjmlfjjnbmnoijecmcbfeoakpjm";} # NoScript + {id = "eimadpbcbfnmbkopoojfekhnkhdbieeh";} # Dark Reader + {id = "jinjaccalgkegednnccohejagnlnfdag";} # Violentmonkey + {id = "nibjojkomfdiaoajekhjakgkdhaomnch";} # IPFS Companion + {id = "nngceckbapebfimnlniiiahkandclblb";} # Bitwarden + {id = "pmcmeagblkinmogikoikkdjiligflglb";} # Privacy Redirect + ] + ++ optional config.nixfiles.modules.kde.enable { + id = "cimiefiiaegbelhefglklhhakcgmhkai"; # KDE Plasma Integration + }; + }; + }; + + services.psd.enable = true; + }; +} diff --git a/modules/nixfiles/common/console.nix b/modules/nixfiles/common/console.nix new file mode 100644 index 0000000..3c73695 --- /dev/null +++ b/modules/nixfiles/common/console.nix @@ -0,0 +1,6 @@ +{config, ...}: { + console = { + earlySetup = true; + useXkbConfig = config.services.xserver.enable; + }; +} diff --git a/modules/nixfiles/common/default.nix b/modules/nixfiles/common/default.nix new file mode 100644 index 0000000..d73ac53 --- /dev/null +++ b/modules/nixfiles/common/default.nix @@ -0,0 +1,19 @@ +_: { + imports = [ + ./documentation.nix + ./environment.nix + ./home-manager.nix + ./kernel.nix + ./locale.nix + ./networking.nix + ./nix.nix + ./secrets.nix + ./security.nix + ./services.nix + ./shell + ./systemd.nix + ./tmp.nix + ./users.nix + ./xdg.nix + ]; +} diff --git a/modules/nixfiles/common/documentation.nix b/modules/nixfiles/common/documentation.nix new file mode 100644 index 0000000..344d59d --- /dev/null +++ b/modules/nixfiles/common/documentation.nix @@ -0,0 +1,48 @@ +{ + config, + lib, + pkgs, + this, + ... +}: +with lib; { + config = mkMerge [ + (mkIf this.isHeadful { + documentation = { + enable = true; + + dev.enable = true; + doc.enable = false; + info.enable = false; + nixos.enable = true; + + man = { + enable = true; + generateCaches = true; + man-db = { + enable = true; + manualPages = + (pkgs.buildEnv { + name = "man-paths"; + paths = with config; + environment.systemPackages ++ hm.home.packages; + pathsToLink = ["/share/man"]; + extraOutputsToInstall = ["man"]; + ignoreCollisions = true; + }) + .overrideAttrs (_: _: {__contentAddressed = true;}); + }; + }; + }; + + environment.sessionVariables = { + MANOPT = "--no-hyphenation"; + MANPAGER = "${pkgs.less}/bin/less -+F"; + }; + }) + (mkIf this.isHeadless { + hm.manual.manpages.enable = false; + documentation.enable = false; + }) + ]; +} diff --git a/modules/nixfiles/common/environment.nix b/modules/nixfiles/common/environment.nix new file mode 100644 index 0000000..9998441 --- /dev/null +++ b/modules/nixfiles/common/environment.nix @@ -0,0 +1,7 @@ +{lib, ...}: +with lib; { + environment = { + localBinInPath = true; + defaultPackages = mkForce []; + }; +} diff --git a/modules/nixfiles/common/home-manager.nix b/modules/nixfiles/common/home-manager.nix new file mode 100644 index 0000000..e4c5d3b --- /dev/null +++ b/modules/nixfiles/common/home-manager.nix @@ -0,0 +1,23 @@ +{ + config, + inputs, + lib, + ... +}: +with lib; { + imports = [ + inputs.home-manager.nixosModules.home-manager + (mkAliasOptionModule ["hm"] ["home-manager" "users" my.username]) + ]; + + hm.home = {inherit (config.system) stateVersion;}; + + home-manager = { + backupFileExtension = "bak"; + useUserPackages = true; + useGlobalPkgs = true; + verbose = true; + }; + + system.extraDependencies = [inputs.home-manager]; +} diff --git a/modules/nixfiles/common/kernel.nix b/modules/nixfiles/common/kernel.nix new file mode 100644 index 0000000..f6c096b --- /dev/null +++ b/modules/nixfiles/common/kernel.nix @@ -0,0 +1,32 @@ +{lib, ...}: +with lib; { + boot = { + kernelParams = ["hibernate=no"]; + + kernel.sysctl = { + "fs.file-max" = pow 2 17; + "fs.inotify.max_user_watches" = pow 2 19; + "fs.suid_dumpable" = 0; + "kernel.core_uses_pid" = 1; + "kernel.exec-shield" = 1; + "kernel.kptr_restrict" = 1; + "kernel.maps_protect" = 1; + "kernel.msgmax" = pow 2 16; + "kernel.msgmnb" = pow 2 16; + "kernel.pid_max" = pow 2 16; + "kernel.randomize_va_space" = 2; + "kernel.shmall" = pow 2 28; + "kernel.shmmax" = pow 2 28; + "kernel.sysrq" = 0; + "vm.dirty_background_bytes" = pow 2 22; + "vm.dirty_background_ratio" = 5; + "vm.dirty_bytes" = pow 2 22; + "vm.dirty_ratio" = 30; + "vm.min_free_kbytes" = pow 2 16; + "vm.mmap_min_addr" = pow 2 12; + "vm.overcommit_memory" = mkDefault 0; + "vm.overcommit_ratio" = mkDefault 50; + "vm.vfs_cache_pressure" = 50; + }; + }; +} diff --git a/modules/nixfiles/common/locale.nix b/modules/nixfiles/common/locale.nix new file mode 100644 index 0000000..34a738b --- /dev/null +++ b/modules/nixfiles/common/locale.nix @@ -0,0 +1,18 @@ +{lib, ...}: +with lib; { + i18n.defaultLocale = mkDefault "en_GB.UTF-8"; + + time.timeZone = mkDefault "Europe/Moscow"; + + # TODO Fcitx or UIM as a Japanese IME. + services.xserver = { + layout = comcat ["us" "ru"]; + xkbVariant = comcat ["" "phonetic"]; + xkbOptions = comcat [ + "terminate:ctrl_alt_bksp" + "caps:escape" + "compose:menu" + "grp:win_space_toggle" + ]; + }; +} diff --git a/modules/nixfiles/common/networking.nix b/modules/nixfiles/common/networking.nix new file mode 100644 index 0000000..0ff7e3d --- /dev/null +++ b/modules/nixfiles/common/networking.nix @@ -0,0 +1,66 @@ +{ + config, + lib, + pkgs, + this, + ... +}: +with lib; { + hm.home.file.".digrc".text = '' + +answer + +multiline + +recurse + ''; + + networking = { + hostName = this.hostname; + hostId = substring 0 8 (builtins.hashString "md5" this.hostname); + domain = my.domain.shire; + + usePredictableInterfaceNames = false; + + useDHCP = false; + + nameservers = dns.const.quad9.default; + + hosts = { + "127.0.0.2" = mkForce []; + "::1" = mkForce []; + }; + + firewall = { + enable = true; + + logRefusedConnections = false; + logRefusedPackets = false; + + rejectPackets = false; + + allowPing = config.nixfiles.modules.profiles.headless.enable; + }; + }; + + environment = { + systemPackages = with pkgs; [dnsutils ldns myip rsync]; + + shellAliases = listToAttrs (map + ({ + name, + value, + }: + nameValuePair name "${pkgs.iproute2}/bin/${value}") [ + { + name = "bridge"; + value = "bridge -color=always"; + } + { + name = "ip"; + value = "ip -color=always"; + } + { + name = "tc"; + value = "tc -color=always"; + } + ]); + }; +} diff --git a/modules/nixfiles/common/nix.nix b/modules/nixfiles/common/nix.nix new file mode 100644 index 0000000..cc050f8 --- /dev/null +++ b/modules/nixfiles/common/nix.nix @@ -0,0 +1,173 @@ +{ + config, + inputs, + lib, + pkgs, + this, + ... +}: +with lib; let + nixfilesSrc = "${config.my.home}/src/nixfiles"; +in { + _module.args = let + importNixpkgs = nixpkgs: + import nixpkgs { + inherit (config.nixpkgs) localSystem crossSystem config; + }; + in rec { + pkgsMaster = importNixpkgs inputs.nixpkgs-master; + pkgsStable = importNixpkgs inputs.nixpkgs-stable; + pkgsRev = rev: sha256: + importNixpkgs (pkgs.fetchFromGitHub { + owner = "NixOS"; + repo = "nixpkgs"; + inherit rev sha256; + }); + pkgsPR = pr: pkgsRev "refs/pull/${toString pr}/head"; + pkgsLocal = importNixpkgs "${config.my.home}/src/nixpkgs"; + }; + + nix = let + filteredInputs = filterAttrs (n: _: n != "self") inputs; + in { + # https://github.com/NixOS/nix/blob/master/src/libutil/experimental-features.cc + extraOptions = '' + extra-experimental-features = ca-derivations + extra-experimental-features = flakes + extra-experimental-features = nix-command + extra-experimental-features = recursive-nix + flake-registry = ${inputs.flake-registry}/flake-registry.json + keep-derivations = true + keep-outputs = true + warn-dirty = false + ''; + + nixPath = + mapAttrsToList (n: v: "${n}=${v}") filteredInputs + ++ ["nixfiles=${nixfilesSrc}"]; + + registry = + mapAttrs (_: flake: {inherit flake;}) filteredInputs + // { + nixfiles.flake = inputs.self; + }; + + settings = { + trusted-users = ["root" "@wheel"]; + + substituters = [ + "https://azahi.cachix.org" + "https://cachix.cachix.org" + "https://mic92.cachix.org" + "https://nix-community.cachix.org" + "https://pre-commit-hooks.cachix.org" + ]; + trusted-public-keys = [ + "azahi.cachix.org-1:2bayb+iWYMAVw3ZdEpVg+NPOHCXncw7WMQ0ElX1GO3s=" + "cachix.cachix.org-1:eWNHQldwUO7G2VkjpnjDbWwy4KQ/HNxht7H4SSoMckM=" + "mic92.cachix.org-1:gi8IhgiT3CYZnJsaW7fxznzTkMUOn1RY4GmXdT/nXYQ=" + "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" + "pre-commit-hooks.cachix.org-1:Pkk3Panw5AW24TOv6kz3PvLhlH8puAsJTBbOPmBo7Rc=" + ]; + }; + }; + + nixpkgs = { + overlays = with inputs; [ + self.overlays.default + (_: super: + { + nix-bash-completions = + super.nix-bash-completions.overrideAttrs + (_: _: { + postPatch = '' + substituteInPlace _nix --replace 'nix nixos-option' 'nixos-option' + ''; + }); + nix-index = super.nix-index.override {nix = config.nix.package;}; + logcli = super.grafana-loki.overrideAttrs (_: _: { + subPackages = ["cmd/logcli"]; + preFixup = ""; + doCheck = false; + }); + helm = super.kubernetes-helm-wrapped.override { + plugins = with super.kubernetes-helmPlugins; [ + helm-diff + helm-secrets + ]; + }; + pgcli = super.pgcli.overrideAttrs (_: _: { + # https://github.com/NixOS/nixpkgs/pull/184533 + postPatch = '' + substituteInPlace setup.py \ + --replace "pgspecial>=1.13.1,<2.0.0" "pgspecial>=1.13.1" + ''; + }); + } + // (with super; let + np = nodePackages; + in { + dockerfile-language-server = np.dockerfile-language-server-nodejs; + editorconfig = editorconfig-core-c; + inherit (np) bash-language-server; + inherit (np) vim-language-server; + inherit (np) yaml-language-server; + json-language-server = np.vscode-json-languageserver; + k3d = kube3d; + lua-language-server = sumneko-lua-language-server; + nix-language-server = rnix-lsp; + telepresence = telepresence2; + tor-browser = tor-browser-bundle-bin; + })) + agenix.overlay + emacs-overlay.overlay + nur.overlay + xmonad-ng.overlay + ]; + + config.allowUnfree = true; + }; + + environment = { + sessionVariables.NIX_SHELL_PRESERVE_PROMPT = "1"; + + etc = { + nixpkgs.source = inputs.nixpkgs; + + gc-roots.text = + concatMapStrings (x: x + "\n") + (with inputs; [nixpkgs nixpkgs-master nixpkgs-stable]); + }; + + systemPackages = with pkgs; + optionals config.profile.headful [ + (pkgs.nixfiles.override { + nix = config.nix.package; + inherit nixfilesSrc; + }) + nix-top + nix-tree + ]; + }; + + hm.home.file.".nix-defexpr/default.nix".text = + optionalString this.isHeadful + ( + let + hostname = strings.escapeNixIdentifier this.hostname; + in '' + let + self = builtins.getFlake "nixfiles"; + configurations = self.nixosConfigurations; + local = configurations.${hostname}; + in rec { + inherit self; + inherit (self) inputs lib; + inherit (lib) my; + this = my.configurations.${hostname}; + inherit (local) config; + inherit (local.config.system.build) toplevel vm vmWithBootLoader manual; + } // configurations // local._module.args + '' + ); +} diff --git a/modules/nixfiles/common/secrets.nix b/modules/nixfiles/common/secrets.nix new file mode 100644 index 0000000..9e59716 --- /dev/null +++ b/modules/nixfiles/common/secrets.nix @@ -0,0 +1,47 @@ +{ + config, + inputs, + lib, + pkgs, + this, + ... +}: +with lib; { + imports = [ + inputs.agenix.nixosModule + (mkAliasOptionModule ["secrets"] ["age" "secrets"]) + ]; + + config = { + age = { + identityPaths = + if this.isHeadful + then ["${config.my.home}/.ssh/id_${my.ssh.type}"] + else + map (attr: attr.path) (filter (attr: attr.type == my.ssh.type) + config.services.openssh.hostKeys); + + # This can be used to auto-add all secrets, thus eleminating the need to + # specify path to each envrypted file. The drawback is that this will + # expose *all* secrets to all machines and try to decrypt them all even on + # machines where the secret will not be used. + # + # secrets = + # let + # secretsSourceDir = "${inputs.self}/age"; + # in + # mapAttrs' + # (name: _: + # nameValuePair name { + # file = "${secretsSourceDir}/${name}"; + # owner = mkDefault my.username; + # group = mkDefault config.my.group; + # }) + # (builtins.readDir secretsSourceDir); + }; + + environment.systemPackages = with pkgs; [agenix]; + + system.extraDependencies = [inputs.agenix]; + }; +} diff --git a/modules/nixfiles/common/security.nix b/modules/nixfiles/common/security.nix new file mode 100644 index 0000000..d47edc9 --- /dev/null +++ b/modules/nixfiles/common/security.nix @@ -0,0 +1,19 @@ +_: { + security = { + sudo = { + enable = true; + execWheelOnly = true; + wheelNeedsPassword = false; + extraConfig = '' + Defaults env_keep+="SSH_CONNECTION SSH_CLIENT SSH_TTY" + ''; + }; + + polkit.extraConfig = '' + polkit.addRule(function (action, subject) { + if (subject.isInGroup('wheel')) + return polkit.Result.YES; + }); + ''; + }; +} diff --git a/modules/nixfiles/common/services.nix b/modules/nixfiles/common/services.nix new file mode 100644 index 0000000..376c87d --- /dev/null +++ b/modules/nixfiles/common/services.nix @@ -0,0 +1,9 @@ +_: { + services = { + earlyoom.enable = true; + haveged.enable = true; + irqbalance.enable = true; + }; + + hardware.ksm.enable = true; +} diff --git a/modules/nixfiles/common/shell/default.nix b/modules/nixfiles/common/shell/default.nix new file mode 100644 index 0000000..7174443 --- /dev/null +++ b/modules/nixfiles/common/shell/default.nix @@ -0,0 +1,125 @@ +{ + lib, + pkgs, + this, + ... +}: +with lib; { + hm = { + programs = { + bash = { + enable = true; + + shellOptions = [ + "autocd" + "cdspell" + "checkjobs" + "checkwinsize" + "dirspell" + "extglob" + "globstar" + "histappend" + "histreedit" + "histverify" + ]; + + profileExtra = '' + export _PROFILE_SOURCED=1 + ''; + + initExtra = '' + set -o notify + + ${readFile ./functions.bash} + + GRC_ALIASES=true + source ${pkgs.grc}/etc/profile.d/grc.sh + + if [ -z $_PROFILE_SOURCED ] && [ -f $HOME/.profile ]; then + source $HOME/.profile + fi + ''; + + historyControl = ["ignoredups" "ignorespace"]; + }; + + command-not-found.enable = false; + + dircolors.enable = true; + }; + + home.packages = with pkgs; [grc]; + }; + + programs.command-not-found.enable = false; + + environment = { + shellAliases = + listToAttrs + (map + ({ + name, + value, + }: + nameValuePair name (with pkgs; let + pkg = + if this.isHeadful + then + (coreutils.overrideAttrs (_: super: { + patches = + super.patches + ++ [ + (fetchpatch { + url = "https://raw.githubusercontent.com/jarun/advcpmv/master/advcpmv-0.9-9.1.patch"; + sha256 = "sha256-d+SRT/R4xmfHLAdOr7m4R3WFiW64P5ZH6iqDvErYCyg="; + }) + ]; + })) + else coreutils; + in "${pkg}/bin/coreutils --coreutils-prog=${value}")) + ( + let + mkAlias = { + name ? head command, + command, + }: { + inherit name; + value = concatStringsSep " " command; + }; + + progressBar = optionalString this.isHeadful "--progress-bar"; + in [ + (mkAlias { + command = ["cp" "--interactive" "--recursive" progressBar]; + }) + (mkAlias {command = ["mv" "--interactive" progressBar];}) + (mkAlias {command = ["rm" "--interactive=once"];}) + (mkAlias {command = ["ln" "--interactive"];}) + (mkAlias {command = ["mkdir" "--parents"];}) + (mkAlias {command = ["rmdir" "--parents"];}) + (mkAlias { + name = "lower"; + command = ["tr" "'[:upper:]'" "'[:lower:]'"]; + }) + (mkAlias { + name = "upper"; + command = ["tr" "'[:lower:]'" "'[:upper:]'"]; + }) + (mkAlias { + name = "disk"; + command = [ + "df" + "--human-readable" + "--exclude-type=tmpfs" + "--exclude-type=devtmpfs" + "2>/dev/null" + ]; + }) + ] + )) + // genAttrs ["grep" "egrep" "fgrep"] + (name: "${pkgs.gnugrep}/bin/${name} --color=always"); + + systemPackages = with pkgs; [bash-completion bc gawk hr moreutils pv]; + }; +} diff --git a/modules/nixfiles/common/shell/functions.bash b/modules/nixfiles/common/shell/functions.bash new file mode 100644 index 0000000..c18104f --- /dev/null +++ b/modules/nixfiles/common/shell/functions.bash @@ -0,0 +1,73 @@ +_complete_alias() { + local alias_name=$1 + local base_function=$2 + local function_name=_alias_$alias_name + shift 2 + eval "$function_name() { + COMP_WORDS=( ${*@Q} \"\${COMP_WORDS[@]:1}\" ) + (( COMP_CWORD += $# - 1 )) + _completion_loader $1 + $base_function + }" + complete -F "$function_name" "$alias_name" +} + +function where() { + local s + s="$(type -P "$1")" + realpath "$s" +} +_complete_alias where _complete complete + +function what() { + local s + s="$(where "$1")" + printf "%s\n" "${s%/*/*}" +} +_complete_alias what _complete complete + +function cat() { + if (($# == 1)) && [[ -d $1 ]]; then + ll "$1" + else + command cat "$@" + fi +} + +function cd() { + builtin cd "$@" && + if ((${#FUNCNAME[@]} == 1)); then + ls + fi +} + +function mkcd() { + mkdir -p "$1" && builtin cd "$1" +} + +function mvcd() { + mv -i -- "$PWD" "$1" && builtin cd . +} + +function bak() { + local f + for f; do + cp -ai -- "$f" "$f.bak" + done +} + +function ubak() { + local f + for f; do + [[ $f == *.bak ]] || f="$f.bak" + mv -i -- "$f" "${f%.bak}" + done +} + +function dec2hex() { + printf "0x%X\n" "$1" +} + +function hex2dec() { + printf "%d\n" "0x$1" +} diff --git a/modules/nixfiles/common/systemd.nix b/modules/nixfiles/common/systemd.nix new file mode 100644 index 0000000..5c7282d --- /dev/null +++ b/modules/nixfiles/common/systemd.nix @@ -0,0 +1,22 @@ +{pkgs, ...}: { + hm.systemd.user.startServices = "sd-switch"; + + services.journald.extraConfig = '' + SystemMaxUse=5G + ''; + + systemd = let + extraConfig = '' + DefaultTimeoutStartSec=30s + DefaultTimeoutStopSec=15s + ''; + in { + inherit extraConfig; + user = {inherit extraConfig;}; + }; + + environment.sessionVariables = { + SYSTEMD_PAGER = "${pkgs.less}/bin/less"; + SYSTEMD_LESS = "FRSXMK"; + }; +} diff --git a/modules/nixfiles/common/tmp.nix b/modules/nixfiles/common/tmp.nix new file mode 100644 index 0000000..3fbf253 --- /dev/null +++ b/modules/nixfiles/common/tmp.nix @@ -0,0 +1,18 @@ +_: { + systemd.mounts = [ + { + what = "tmpfs"; + where = "/tmp"; + type = "tmpfs"; + mountConfig.Options = [ + "huge=within_size" + "mode=1777" + "noatime" + "nodev" + "nosuid" + "rw" + "size=25%" + ]; + } + ]; +} diff --git a/modules/nixfiles/common/users.nix b/modules/nixfiles/common/users.nix new file mode 100644 index 0000000..0878db6 --- /dev/null +++ b/modules/nixfiles/common/users.nix @@ -0,0 +1,21 @@ +{lib, ...}: +with lib; { + imports = [(mkAliasOptionModule ["my"] ["users" "users" my.username])]; + + users = { + mutableUsers = false; + + users = { + root.hashedPassword = "[REDACTED]"; + + ${my.username} = { + isNormalUser = true; + uid = 1000; + description = my.fullname; + inherit (my) hashedPassword; + openssh.authorizedKeys.keys = [my.ssh.key]; + extraGroups = ["wheel"]; + }; + }; + }; +} diff --git a/modules/nixfiles/common/xdg.nix b/modules/nixfiles/common/xdg.nix new file mode 100644 index 0000000..c05f5e3 --- /dev/null +++ b/modules/nixfiles/common/xdg.nix @@ -0,0 +1,86 @@ +{ + config, + lib, + this, + ... +}: +with lib; { + imports = let + withBase = s: ["home-manager" "users" my.username "xdg" s]; + in [ + (mkAliasOptionModule ["dirs" "cache"] (withBase "cacheHome")) + (mkAliasOptionModule ["dirs" "config"] (withBase "configHome")) + (mkAliasOptionModule ["dirs" "data"] (withBase "dataHome")) + (mkAliasOptionModule ["dirs" "state"] (withBase "stateHome")) + (mkAliasOptionModule ["userDirs"] (withBase "userDirs")) + ]; + + hm = { + xdg = mkMerge [ + { + enable = true; + + userDirs = let + inherit (config.my) home; + tmp = home + "/tmp"; + in { + enable = true; + + createDirectories = this.isHeadful; + + desktop = tmp; + documents = "${home}/doc"; + download = tmp; + music = tmp; + pictures = tmp; + videos = tmp; + templates = tmp; + publicShare = "${home}/share"; + }; + } + (mkIf this.isHeadful { + mimeApps = let + images = [ + "image/bmp" + "image/gif" + "image/jpeg" + "image/jpg" + "image/png" + "image/svg+xml" + "image/tiff" + "image/webp" + ]; + media = [ + "audio/aac" + "audio/flac" + "audio/mp3" + "audio/ogg" + "audio/wav" + "audio/webm" + "video/mkv" + "video/mp4" + "video/ogg" + "video/webm" + "video/x-matroska" + ]; + in { + enable = true; + + defaultApplications = + mkMerge + (mapAttrsToList (n: ms: genAttrs ms (_: ["${n}.desktop"])) { + aria2 = ["application/x-bittorrent" "x-scheme-handler/magnet"]; + emacsclient = ["x-scheme-handler/mailto"]; + firefox = [ + "text/html" + "x-scheme-handler/http" + "x-scheme-handler/https" + ]; + gwenview = images; + mpv = media; + }); + }; + }) + ]; + }; +} diff --git a/modules/nixfiles/curl.nix b/modules/nixfiles/curl.nix new file mode 100644 index 0000000..e7bee31 --- /dev/null +++ b/modules/nixfiles/curl.nix @@ -0,0 +1,38 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.curl; +in { + options.nixfiles.modules.curl.enable = + mkEnableOption "Wether to enable cURL."; + + config = mkIf cfg.enable { + hm.home.file.".curlrc".text = '' + connect-timeout = 60 + progress-bar + referer = ";auto" + remote-time + show-error + ''; + + environment.systemPackages = with pkgs; [ + curl + (writeShellScriptBin "0x0" '' + url="https://0x0.st" + form="file=@" + + if [ -t 0 ] && [ -n "$1" ]; then + form="$form$1" + else + form="$form-" + fi + + ${curl}/bin/curl --form "$form" "$url" + '') + ]; + }; +} diff --git a/modules/nixfiles/default.nix b/modules/nixfiles/default.nix new file mode 100644 index 0000000..8d26e7f --- /dev/null +++ b/modules/nixfiles/default.nix @@ -0,0 +1,80 @@ +{...}: { + imports = [ + ./acme.nix + ./alacritty.nix + ./alertmanager.nix + ./aria2.nix + ./aspell.nix + ./bat.nix + ./beets.nix + ./bluetooth.nix + ./broot.nix + ./chromium.nix + ./common + ./curl.nix + ./direnv.nix + ./docker.nix + ./dwm.nix + ./emacs.nix + ./endlessh-go.nix + ./endlessh.nix + ./fail2ban.nix + ./firefox + ./flatpak.nix + ./fonts.nix + ./games + ./git.nix + ./gnome.nix + ./gnupg.nix + ./gotify.nix + ./grafana.nix + ./htop.nix + ./hydra.nix + ./ipfs.nix + ./kde.nix + ./libvirtd.nix + ./lidarr.nix + ./loki.nix + ./lxc.nix + ./matrix + ./monitoring.nix + ./mpd.nix + ./mpv.nix + ./nextcloud.nix + ./nginx.nix + ./nmap.nix + ./node-exporter.nix + ./nsd.nix + ./openssh.nix + ./password-store.nix + ./podman.nix + ./postgresql.nix + ./profiles + ./prometheus.nix + ./promtail.nix + ./psd.nix + ./qutebrowser.nix + ./radarr.nix + ./radicale.nix + ./rss-bridge.nix + ./rtorrent.nix + ./searx.nix + ./shadowsocks.nix + ./soju.nix + ./sonarr.nix + ./sound.nix + ./subversion.nix + ./syncthing.nix + ./throttled.nix + ./tmux.nix + ./unbound.nix + ./vaultwarden.nix + ./vim + ./vscode.nix + ./wget.nix + ./wireguard.nix + ./x11.nix + ./xmonad.nix + ./zathura.nix + ]; +} diff --git a/modules/nixfiles/direnv.nix b/modules/nixfiles/direnv.nix new file mode 100644 index 0000000..aea7dd8 --- /dev/null +++ b/modules/nixfiles/direnv.nix @@ -0,0 +1,24 @@ +{ + config, + lib, + ... +}: +with lib; let + cfg = config.nixfiles.modules.direnv; +in { + options.nixfiles.modules.direnv.enable = + mkEnableOption "Whether to enable direnv and Lorri."; + + config = mkIf cfg.enable { + hm = { + programs.direnv = { + enable = true; + nix-direnv.enable = true; + }; + + home.sessionVariables.DIRENV_LOG_FORMAT = ""; + }; + + services.lorri.enable = true; + }; +} diff --git a/modules/nixfiles/docker.nix b/modules/nixfiles/docker.nix new file mode 100644 index 0000000..d2e53d6 --- /dev/null +++ b/modules/nixfiles/docker.nix @@ -0,0 +1,34 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.docker; +in { + options.nixfiles.modules.docker.enable = + mkEnableOption "Whether to enable Docker."; + + config = mkIf cfg.enable { + secrets.containers-auth = { + file = "${inputs.self}/secrets/containers-auth"; + path = "${config.my.home}/.docker/config.json"; + owner = my.username; + }; + + virtualisation.docker.enable = true; + + environment.systemPackages = with pkgs; [docker-compose]; + + my.extraGroups = ["docker"]; + + hm.programs.bash = { + shellAliases.d = "${pkgs.docker}/bin/docker"; + + initExtra = mkAfter '' + _complete_alias d _docker docker + ''; + }; + }; +} diff --git a/modules/nixfiles/dwm.nix b/modules/nixfiles/dwm.nix new file mode 100644 index 0000000..86d15fb --- /dev/null +++ b/modules/nixfiles/dwm.nix @@ -0,0 +1,159 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.dwm; +in { + options.nixfiles.modules.dwm.enable = mkEnableOption "Whether to enable dwm."; + + config = mkIf cfg.enable { + nixfiles.modules.x11.enable = true; + + hm.xsession = { + enable = true; + + windowManager.command = let + pkg = pkgs.dwm.override { + conf = let + font = with config.fontScheme.monospaceFont; "${family}:size=${toString size}"; + colour = config.colourScheme; + in '' + static const unsigned int borderpx = 1; + static const unsigned int snap = 32; + static const int showbar = 1; + static const int topbar = 1; + + static const char *fonts[] = { + "${font}" + }; + + static const char *colors[][3] = { + [SchemeNorm] = { + "${colour.white}", + "${colour.black}", + "${colour.black}", + }, + [SchemeSel] = { + "${colour.black}", + "${colour.white}", + "${colour.white}", + }, + }; + + static const char *tags[] = { + "1", + "2", + "3", + "4", + "5", + "6", + "7", + "8", + "9" + }; + + static const Rule rules[] = { + { "Emacs", NULL, NULL, 1 << 0, 0, -1 }, + }; + + static const float mfact = 0.666; + static const int nmaster = 1; + static const int resizehints = 0; + static const int lockfullscreen = 1; + + static const Layout layouts[] = { + { "[]=", tile }, + { "><>", NULL }, + { "[M]", monocle }, + }; + + #define MODKEY Mod4Mask + #define TAGKEYS(KEY,TAG) \ + { MODKEY, KEY, view, { .ui = 1 << TAG } }, \ + { MODKEY|ControlMask, KEY, toggleview, { .ui = 1 << TAG } }, \ + { MODKEY|ShiftMask, KEY, tag, { .ui = 1 << TAG } }, \ + { MODKEY|ControlMask|ShiftMask, KEY, toggletag, { .ui = 1 << TAG } }, + + static char dmenumon[2] = "0"; + static const char *dmenucmd[] = { + "${pkgs.dmenu}/bin/dmenu_run", + "-m", dmenumon, + "-fn", "${font}", + "-nb", "${colour.black}", + "-nf", "${colour.white}", + "-sb", "${colour.white}", + "-sf", "${colour.black}", + NULL, + }; + static const char *termcmd[] = { + "${pkgs.alacritty}/bin/alacritty", + NULL, + }; + + static const Key keys[] = { + { MODKEY, XK_x, spawn, {.v = dmenucmd } }, + { MODKEY, XK_Return, spawn, {.v = termcmd } }, + { MODKEY, XK_b, togglebar, {0} }, + { MODKEY, XK_j, focusstack, {.i = +1 } }, + { MODKEY, XK_k, focusstack, {.i = -1 } }, + { MODKEY|ShiftMask, XK_k, incnmaster, {.i = +1 } }, + { MODKEY|ShiftMask, XK_j, incnmaster, {.i = -1 } }, + { MODKEY, XK_comma, setmfact, {.f = -0.05} }, + { MODKEY, XK_period, setmfact, {.f = +0.05} }, + { MODKEY, XK_p, zoom, {0} }, + { MODKEY, XK_Tab, view, {0} }, + { MODKEY, XK_d, killclient, {0} }, + { MODKEY, XK_t, setlayout, {.v = &layouts[0]} }, + { MODKEY, XK_m, setlayout, {.v = &layouts[1]} }, + { MODKEY, XK_f, setlayout, {.v = &layouts[2]} }, + { MODKEY, XK_o, togglefloating, {0} }, + { MODKEY, XK_0, view, {.ui = ~0 } }, + { MODKEY|ShiftMask, XK_0, tag, {.ui = ~0 } }, + { MODKEY, XK_h, focusmon, {.i = -1 } }, + { MODKEY, XK_l, focusmon, {.i = +1 } }, + { MODKEY|ShiftMask, XK_h, tagmon, {.i = -1 } }, + { MODKEY|ShiftMask, XK_l, tagmon, {.i = +1 } }, + TAGKEYS( XK_1, 0) + TAGKEYS( XK_2, 1) + TAGKEYS( XK_3, 2) + TAGKEYS( XK_4, 3) + TAGKEYS( XK_5, 4) + TAGKEYS( XK_6, 5) + TAGKEYS( XK_7, 6) + TAGKEYS( XK_8, 7) + TAGKEYS( XK_9, 8) + { MODKEY|ShiftMask, XK_q, quit, {0} }, + }; + + static const Button buttons[] = { + { ClkLtSymbol, 0, Button1, setlayout, {0} }, + { ClkLtSymbol, 0, Button3, setlayout, {.v = &layouts[2]} }, + { ClkWinTitle, 0, Button2, zoom, {0} }, + { ClkStatusText, 0, Button2, spawn, {.v = termcmd } }, + { ClkClientWin, MODKEY, Button1, movemouse, {0} }, + { ClkClientWin, MODKEY, Button2, togglefloating, {0} }, + { ClkClientWin, MODKEY, Button3, resizemouse, {0} }, + { ClkTagBar, 0, Button1, view, {0} }, + { ClkTagBar, 0, Button3, toggleview, {0} }, + { ClkTagBar, MODKEY, Button1, tag, {0} }, + { ClkTagBar, MODKEY, Button3, toggletag, {0} }, + }; + ''; + }; + in "${pkg}/bin/dwm"; + }; + + hm.services.dwm-status = { + enable = true; + # package = pkgs.dwm-status.override { + # enableAlsaUtils = false; + # }; + order = ["audio" "backlight" "battery" "cpu_load" "network" "time"]; + }; + + services.xserver.displayManager.startx.enable = true; + }; +} diff --git a/modules/nixfiles/emacs.nix b/modules/nixfiles/emacs.nix new file mode 100644 index 0000000..230b965 --- /dev/null +++ b/modules/nixfiles/emacs.nix @@ -0,0 +1,69 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.emacs; +in { + options.nixfiles.modules.emacs.enable = + mkEnableOption "Whether to enable the GNU Emacs."; + + # TODO Nixify. + config = mkIf cfg.enable { + hm = { + home = { + packages = with pkgs; [ + cmigemo # :lang japanese + gcc # :lang (org +roam2) + gnuplot # :lang (org +gnuplot) + gnutls # :app irc + graphviz # :lang (org +roam2) + grip # :lang (markdown +grip) + maim # :lang (org +dragndrop) + pandoc # :lang org markdown latex + plantuml # :lang plantuml + pre-commit # :tools magit + sqlite # :lang (org +roam2) + texlive.combined.scheme-full # :lang org tex + xclip # :os (tty +osc) + ]; + + activation = { + symlinkMigemoFiles = '' + target="${config.dirs.data}/migemo" + [[ -L "$target" ]] && rm "$target" + ln -s ${pkgs.cmigemo}/share/migemo "$target" + ''; + symlinkSkkFiles = '' + target="${config.dirs.data}/skk" + [[ -L "$target" ]] && rm "$target" + ln -s ${pkgs.skk-dicts}/share "$target" + ''; + symlinkPlantumlFiles = '' + target="${config.dirs.data}/plantuml" + [[ -L "$target" ]] && rm "$target" + ln -s ${pkgs.plantuml}/lib "$target" + ''; + }; + }; + + programs.emacs = { + enable = true; + package = pkgs.emacs28.override {nativeComp = true;}; + extraPackages = p: + with p; [ + vterm # :term vterm + ]; + }; + + services.emacs = { + enable = true; + client.enable = true; + }; + }; + + fonts.fonts = with pkgs; [emacs-all-the-icons-fonts]; + }; +} diff --git a/modules/nixfiles/endlessh-go.nix b/modules/nixfiles/endlessh-go.nix new file mode 100644 index 0000000..8ab71ee --- /dev/null +++ b/modules/nixfiles/endlessh-go.nix @@ -0,0 +1,57 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.endlessh-go; +in { + options.nixfiles.modules.endlessh-go = { + enable = mkEnableOption "Whether to enable endlessh-go."; + + prometheusPort = mkOption { + description = "Prometheus port."; + type = with types; port; + default = 9119; + }; + }; + + config = let + port = 22; + in + mkIf cfg.enable { + assertions = [ + { + assertion = !(any (x: x == port) config.services.openssh.ports); + message = "Port ${toString port} is already occupied by OpenSSH"; + } + ]; + + systemd.services.endlessh-go = { + description = "Endlessh SSH Tarpit"; + requires = ["network-online.target"]; + serviceConfig = { + Restart = "always"; + ExecStart = concatStringsSep " " [ + "${pkgs.endlessh-go}/bin/endlessh-go" + "-conn_type=tcp4" + "-host=0.0.0.0" + "-port=${toString port}" + "-enable_prometheus" + "-prometheus_port=${toString cfg.prometheusPort}" + "-geoip_supplier=ip-api" + "-logtostderr" + "-v=1" + ]; + KillSignal = "SIGTERM"; + AmbientCapabilities = "CAP_NET_BIND_SERVICE"; + DynamicUser = true; + StateDirectory = "endlessh-go"; + }; + wantedBy = ["multi-user.target"]; + }; + + networking.firewall.allowedTCPPorts = [port]; + }; +} diff --git a/modules/nixfiles/endlessh.nix b/modules/nixfiles/endlessh.nix new file mode 100644 index 0000000..2871683 --- /dev/null +++ b/modules/nixfiles/endlessh.nix @@ -0,0 +1,45 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.endlessh; +in { + options.nixfiles.modules.endlessh.enable = + mkEnableOption "Whether to enable endlessh."; + + config = let + port = 22; + in + mkIf cfg.enable { + assertions = [ + { + assertion = !(any (x: x == port) config.services.openssh.ports); + message = "Port ${toString port} is already occupied by OpenSSH"; + } + ]; + + systemd.services.endlessh = { + description = "Endlessh SSH Tarpit"; + requires = ["network-online.target"]; + serviceConfig = { + Restart = "always"; + ExecStart = concatStringsSep " " [ + "${pkgs.endlessh}/bin/endlessh" + "-v" + "-4" + "-p ${toString port}" + ]; + KillSignal = "SIGTERM"; + AmbientCapabilities = "CAP_NET_BIND_SERVICE"; + DynamicUser = true; + StateDirectory = "endlessh"; + }; + wantedBy = ["multi-user.target"]; + }; + + networking.firewall.allowedTCPPorts = [port]; + }; +} diff --git a/modules/nixfiles/fail2ban.nix b/modules/nixfiles/fail2ban.nix new file mode 100644 index 0000000..56670e7 --- /dev/null +++ b/modules/nixfiles/fail2ban.nix @@ -0,0 +1,32 @@ +{ + config, + lib, + this, + ... +}: +with lib; let + cfg = config.nixfiles.modules.fail2ban; +in { + options.nixfiles.modules.fail2ban.enable = + mkEnableOption "Whether to enable fail2ban service."; + + config = mkIf cfg.enable { + services.fail2ban = { + enable = true; + + bantime-increment = { + enable = true; + maxtime = "24h"; + rndtime = "8m"; + }; + + ignoreIP = + optionals (hasAttr "wireguard" this) + (with config.nixfiles.modules.wireguard; [ipv4.subnet ipv6.subnet]); + + jails.DEFAULT = '' + blocktype = DROP + ''; + }; + }; +} diff --git a/modules/nixfiles/firefox/default.nix b/modules/nixfiles/firefox/default.nix new file mode 100644 index 0000000..d7afdae --- /dev/null +++ b/modules/nixfiles/firefox/default.nix @@ -0,0 +1,52 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.firefox; +in { + options.nixfiles.modules.firefox.enable = mkEnableOption ""; + + config = mkIf cfg.enable { + hm = { + home = { + # sessionVariables.BROWSER = mkOverride 200 "firefox"; + + packages = with pkgs; [ + (writeShellScriptBin "firefox-vanilla" '' + ${config.hm.programs.firefox.package}/bin/firefox -p vanilla $@ + '') + profile-cleaner + ]; + }; + + programs.firefox = { + enable = true; + + package = pkgs.firefox.override { + cfg = with config.nixfiles.modules; { + enablePlasmaBrowserIntegration = kde.enable; + enableGnomeExtensions = gnome.enable; + }; + }; + + profiles.default = (import ./profile.nix) config.nixfiles.modules lib; + + extensions = with pkgs.nur.repos.rycee.firefox-addons; + [ + bitwarden + darkreader + ipfs-companion + noscript + privacy-redirect + stylus + ublock-origin + violentmonkey + ] + ++ optional config.nixfiles.modules.kde.enable plasma-integration; + }; + }; + }; +} diff --git a/modules/nixfiles/firefox/profile.nix b/modules/nixfiles/firefox/profile.nix new file mode 100644 index 0000000..3382b85 --- /dev/null +++ b/modules/nixfiles/firefox/profile.nix @@ -0,0 +1,479 @@ +modules: lib: +with lib; let + mkCssWithRoot = css: + mkMerge [ + (with modules.profiles.common.colourScheme; '' + :root { + --black: ${black}; + --red: ${red}; + --green: ${green}; + --yellow: ${yellow}; + --blue: ${blue}; + --magenta: ${magenta}; + --cyan: ${cyan}; + --white: ${white}; + --bright-black: ${brightBlack}; + --bright-red: ${brightRed}; + --bright-green: ${brightGreen}; + --bright-yellow: ${brightYellow}; + --bright-blue: ${brightBlue}; + --bright-magenta: ${brightMagenta}; + --bright-cyan: ${brightCyan}; + --bright-white: ${brightWhite}; + --background: ${background}; + --foreground: ${foreground}; + '') + (with modules.fonts.fontScheme; '' + --sans-serif-font-family: "${sansSerifFont.family}", "${sansSerifFontFallback.family}", sans-serif; + --sans-serif-font-size: ${toString sansSerifFont.size}; + --serif-font-family: "${serifFont.family}", "${serifFontFallback.family}", serif; + --serif-font-size: ${toString serifFont.size}; + --monospace-font-family: "${monospaceFont.family}", "${monospaceFontFallback.family}", monospace; + --monospace-font-size: ${toString monospaceFont.size}; + } + '') + (builtins.readFile css) + ]; +in { + id = 0; + + isDefault = true; + + userChrome = mkCssWithRoot ./userChrome.css; + + userContent = mkCssWithRoot ./userContent.css; + + settings = { + # Updates + # + "app.update.auto" = false; + "browser.search.update" = false; + "extensions.update.enabled" = false; + "extensions.update.autoUpdateDefault" = false; + # + "extensions.getAddons.cache.enabled" = false; + "extensions.getAddons.showPane" = false; + + # Telemetry + # + # https://bugzilla.mozilla.org/1195552 + "datareporting.healthreport.service.enabled" = false; + "datareporting.healthreport.uploadEnabled" = false; + "datareporting.policy.dataSubmissionEnabled" = false; + # https://firefox-source-docs.mozilla.org/toolkit/components/telemetry/telemetry/internals/preferences.html + # https://medium.com/georg-fritzsche/data-preference-changes-in-firefox-58-2d5df9c428b5 + "toolkit.telemetry.unified" = false; + "toolkit.telemetry.server" = "data:,"; + "toolkit.telemetry.archive.enabled" = false; + "toolkit.telemetry.newProfilePing.enabled" = false; + "toolkit.telemetry.shutdownPingSender.enabled" = false; + "toolkit.telemetry.firstShutdownPing.enabled" = false; + "toolkit.telemetry.updatePing.enabled" = false; + "toolkit.telemetry.bhrPing.enabled" = false; # Background Hang Reporter + # https://blog.mozilla.org/data/2018/08/20/effectively-measuring-search-in-firefox + "toolkit.telemetry.coverage.opt-out" = true; + "toolkit.coverage.opt-out" = true; + "toolkit.coverage.endpoint.base" = ""; + + # Studies + # + # https://support.mozilla.org/en-US/kb/shield/ + "app.shield.optoutstudies.enabled" = false; + # https://mozilla.github.io/normandy/ + "app.normandy.enabled" = false; + "app.normandy.api_url" = ""; + + # Crash reports + # + "browser.tabs.crashReporting.sendReport" = false; + "breakpad.reportURL" = ""; + + # Captive Portal detection + # + # https://www.eff.org/deeplinks/2017/08/how-captive-portals-interfere-wireless-security-and-privacy + "captivedetect.canonicalURL" = ""; + "network.captive-portal-service.enabled" = false; + # https://bugzilla.mozilla.org/1460537 + "network.connectivity-service.enabled" = false; + + # Safe browsing + # + # https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/ + # https://wiki.mozilla.org/Security/Safe_Browsing + # https://support.mozilla.org/kb/how-does-phishing-and-malware-protection-work + "browser.safebrowsing.malware.enabled" = false; + "browser.safebrowsing.passwords.enabled" = false; + "browser.safebrowsing.phishing.enabled" = false; + "browser.safebrowsing.downloads.enabled" = false; + "browser.safebrowsing.downloads.remote.enabled" = false; + "browser.safebrowsing.downloads.remote.url" = ""; + "browser.safebrowsing.downloads.remote.block_potentially_unwanted" = false; + "browser.safebrowsing.downloads.remote.block_uncommon" = false; + + # Implicit outbound + # + # https://developer.mozilla.org/docs/Web/HTTP/Link_prefetching_FAQ + "network.prefetch-next" = false; + # https://developer.mozilla.org/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control + "network.dns.disablePrefetch" = true; + "network.dns.disablePrefetchFromHTTPS" = true; + # + "network.predictor.enabled" = false; + "network.predictor.enable-prefetch" = false; + # https://news.slashdot.org/story/15/08/14/2321202/how-to-quash-firefoxs-silent-requests + "network.http.speculative-parallel-limit" = 0; + # https://www.bleepingcomputer.com/news/software/major-browsers-to-prevent-disabling-of-click-tracking-privacy-risk/ + "browser.send_pings" = false; + # https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/WebBrowsers + "network.proxy.socks_remote_dns" = true; + # https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/26424 + "network.file.disable_unc_paths" = true; + + # Proxy + # + # https://blog.mozilla.org/security/2021/10/25/securing-the-proxy-api-for-firefox-add-ons/ + "network.proxy.failover_direct" = false; + # https://bugzilla.mozilla.org/buglist.cgi?bug_id=1732792,1733994,1733481 + "network.proxy.allow_bypass" = false; + + # DNS-over-HTTPS (DoH) + # + # https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/ + # https://wiki.mozilla.org/Security/DOH-resolver-policy + # https://blog.mozilla.org/mozilla/news/firefox-by-default-dns-over-https-rollout-in-canada/ + # https://www.eff.org/deeplinks/2020/12/dns-doh-and-odoh-oh-my-year-review-2020 ***/ + "network.trr.mode" = 5; + + # Location bar & search + # + "browser.fixup.alternate.enabled" = false; + # + "browser.urlbar.trimURLs" = false; + # + "browser.search.suggest.enabled" = false; + "browser.urlbar.suggest.searches" = false; + # https://bugzilla.mozilla.org/1348275 + "browser.urlbar.speculativeConnect.enabled" = false; + # https://bugzilla.mozilla.org/1642623 + "browser.urlbar.dnsResolveSingleWordsAfterSearch" = 0; + # https://blog.mozilla.org/data/2021/09/15/data-and-firefox-suggest/ + "browser.urlbar.suggest.quicksuggest.nonsponsored" = false; + "browser.urlbar.suggest.quicksuggest.sponsored" = false; + + # Search & form history + # https://blog.mindedsecurity.com/2011/10/autocompleteagain.html + # https://bugzilla.mozilla.org/381681 + "browser.formfill.enable" = false; + # https://wiki.mozilla.org/Firefox/Features/Form_Autofill + "extensions.formautofill.available" = "off"; + "extensions.formautofill.addresses.enabled" = false; + "extensions.formautofill.creditCards.available" = false; + "extensions.formautofill.creditCards.enabled" = false; + "extensions.formautofill.heuristics.enabled" = false; + + # Passwords + # + "signon.rememberSignons" = false; + + # Disk avoidance + # + # Disable caching to disk. + # This is a possible performance hit. Could be removed in favor of PSD? + "browser.cache.disk.enable" = false; + # + "browser.privatebrowsing.forceMediaMemoryCache" = true; + "media.memory_cache_max_size" = 65536; + # Extra session data + "browser.sessionstore.privacy_level" = 2; + # Reduce writes + "browser.sessionstore.interval" = 30000; + + # SSL/TLS + # + # Block connections (SSL_ERROR_UNSAFE_NEGOTIATION) to servers that don't support RFC 5746 + # https://wiki.mozilla.org/Security:Renegotiation + # https://datatracker.ietf.org/doc/html/rfc5746 + # https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555 + # https://www.ssllabs.com/ssl-pulse + "security.ssl.require_safe_negotiation" = true; + # Disable TLS1.3 0-RTT + # https://github.com/tlswg/tls13-spec/issues/1001 + # https://www.rfc-editor.org/rfc/rfc9001.html#name-replay-attacks-with-0-rtt + # https://blog.cloudflare.com/tls-1-3-overview-and-q-and-a/ + "security.tls.enable_0rtt_data" = false; + + # OCSP (Online Certificate Status Protocol) + # + # https://en.wikipedia.org/wiki/Ocsp + # https://scotthelme.co.uk/revocation-is-broken/ + # https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/ + # https://www.imperialviolet.org/2014/04/19/revchecking.html + # "security.OCSP.require" = true; + + # HPKP (HTTP Public Key Pinning) + # + # https://blog.mozilla.org/security/2016/10/18/phasing-out-sha-1-on-the-public-web/ + "security.pki.sha1_enforcement_level" = 1; + # https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/16206 + "security.cert_pinning.enforcement_level" = 2; + # https://bugzilla.mozilla.org/buglist.cgi?bug_id=1429800,1670985 + # https://blog.mozilla.org/security/tag/crlite/ + "security.remote_settings.crlite_filters.enabled" = true; + "security.pki.crlite_mode" = 2; + + # Mixed content + # + "security.mixed_content.block_display_content" = true; + # Force HTTPS-only mode + # Exceptions are managed on the settings page + "dom.security.https_only_mode" = true; + "dom.security.https_only_mode_pbm" = true; + # https://bugzilla.mozilla.org/buglist.cgi?bug_id=1642387,1660945 + "dom.security.https_only_mode_send_http_background_request" = false; + + # UI + # + # Dispaly warning on the padlock for "broken security" + # https://wiki.mozilla.org/Security:Renegotiation + # https://bugzilla.mozilla.org/1353705 + "security.ssl.treat_unsafe_negotiation_as_broken" = true; + # https://github.com/pyllyukko/user.js/issues/210 + "browser.ssl_override_behavior" = 1; + # Display advanced information on Insecure Connection warning pages + "browser.xul.error_pages.expert_bad_cert" = true; + # Display "Not Secure" text on HTTP sites + "security.insecure_connection_text.enabled" = true; + # + "browser.privatebrowsing.infoEnabled" = false; + "browser.privatebrowsing.infoTitleEnabled" = false; + "browser.privatebrowsing.promoEnabled" = false; + "browser.privatebrowsing.promoTitleEnabled" = false; + "browser.privatebrowsing.vpnpromourl" = ""; + + # UX + # + "browser.urlbar.decodeURLsOnCopy" = true; + # + "browser.tabs.closeWindowWithLastTab" = true; + # + "general.autoScroll" = true; + "general.smoothScroll" = true; + + # Headers & referers + # + # "network.http.referer.XOriginPolicy" = 2; + # "network.http.referer.XOriginTrimmingPolicy" = 2; + + # Containers + # + # https://wiki.mozilla.org/Security/Contextual_Identity_Project/Containers + # https://addons.mozilla.org/firefox/addon/temporary-containers/ + # https://medium.com/@stoically/enhance-your-privacy-in-firefox-with-temporary-containers-33925cd6cd21 + # https://github.com/stoically/temporary-containers/wiki + "privacy.userContext.enabled" = true; + "privacy.userContext.ui.enabled" = true; + + # WebRTC + # + # Disable WebRTC + # https://browserleaks.com/webrtc + # https://groups.google.com/g/discuss-webrtc/c/6stQXi72BEU/m/2FwZd24UAQAJ + # https://datatracker.ietf.org/doc/html/draft-ietf-mmusic-mdns-ice-candidates#section-3.1.1 + # "media.peerconnection.enabled" = false; + + # DRM + # + # https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-we-just-lost-web-what-we-learned-it-and-what-we-need-do-next + "media.eme.enabled" = false; + # https://bugzilla.mozilla.org/show_bug.cgi?id=1451762#c55 + "browser.eme.ui.enabled" = false; + + # GMP (Gecko Media Plugins) + # + "media.gmp-provider.enabled" = false; + + # Disable autoplay of HTML5 media + "media.autoplay.enabled" = false; + "media.autoplay.default" = 5; + "media.autoplay.blocking_policy" = 2; + + # DOM (Document Object Model) + # + # Disable "Confirm you want to leave" dialog on page close + # https://developer.mozilla.org/docs/Web/Events/beforeunload + "dom.disable_beforeunload" = true; + # Prevent scripts from moving and resizing open windows + "dom.disable_window_move_resize" = true; + # Block popup windows + "dom.disable_open_during_load" = true; + # Limit events that can cause a popup + "dom.popup_allowed_events" = "click dblclick mousedown pointerdown"; + + # PDFjs + # + # "pdfjs.disabled" = true; + "pdfjs.enableScripting" = false; + + # Developer Tools + # + "devtools.accessibility.enabled" = false; + "devtools.application.enabled" = false; + "devtools.chrome.enabled" = true; + "devtools.dom.enabled" = true; + "devtools.enabled" = true; + "devtools.inspector.enabled" = true; + "devtools.jsonview.enabled" = true; + "devtools.memory.enabled" = true; + "devtools.netmonitor.enabled" = true; + "devtools.performance.enabled" = false; + "devtools.storage.enabled" = true; + "devtools.styleeditor.enabled" = true; + # This will prevent working with XUL + # https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/16222 + "devtools.debugger.enabled" = false; + "devtools.debugger.remote-enabled" = false; + + # Downloads + # + "browser.download.useDownloadDir" = false; + "browser.download.alwaysOpenPanel" = false; + "browser.download.manager.addToRecentDocs" = false; + "browser.download.autohideButton" = false; + + # Extensions + # + # https://mike.kaply.com/2012/02/21/understanding-add-on-scopes/ + # https://archive.is/DYjAM + "extensions.enabledScopes" = 5; + "extensions.autoDisableScopes" = 15; + # https://bugzilla.mozilla.org/buglist.cgi?bug_id=1659530,1681331 + "extensions.postDownloadThirdPartyPrompt" = false; + # Disable recommendations in about:addons panes + "extensions.htmlaboutaddons.recommendations.enabled" = false; + # Mozilla's trash + "extensions.pocket.enabled" = false; + "extensions.screenshots.disabled" = true; + "idenitity.fxaccounts.enabled" = false; + "reader.parse-on-load.enabled" = false; + + # ETP (Encahnced Tracking Protection) + # + # https://blog.mozilla.org/security/2021/02/23/total-cookie-protection/ + "browser.contentblocking.category" = "strict"; + "privacy.partition.serviceWorkers" = true; + + # Sanitize + # + "privacy.sanitize.sanitizeOnShutdown" = true; + "privacy.sanitize.timeSpan" = 0; + "privacy.clearOnShutdown.cache" = true; + "privacy.clearOnShutdown.cookies" = false; + "privacy.clearOnShutdown.downloads" = true; + "privacy.clearOnShutdown.formdata" = true; + "privacy.clearOnShutdown.history" = false; + "privacy.clearOnShutdown.offlineApps" = false; + "privacy.clearOnShutdown.sessions" = false; + "privacy.clearOnShutdown.siteSettings" = false; + "privacy.cpd.cache" = true; + "privacy.cpd.cookies" = false; + "privacy.cpd.downloads" = true; + "privacy.cpd.formdata" = true; + "privacy.cpd.history" = false; + "privacy.cpd.offlineApps" = false; + "privacy.cpd.passwords" = false; + "privacy.cpd.sessions" = false; + "privacy.cpd.siteSettings" = false; + + # Fingerprinting + # + # https://bugzilla.mozilla.org/418986 + # "privacy.resistFingerprinting" = true; + # https://bugzilla.mozilla.org/1448423 + # "browser.startup.blankWindow" = false; + + # Rice + # + "toolkit.legacyUserProfileCustomizations.stylesheets" = true; + # + "browser.startup.homepage" = "about:blank"; # TODO Custom? + "browser.startup.homepage_welcome_url" = ""; + "browser.startup.homepage_welcome_url.additional" = ""; + # + "browser.toolbars.bookmarks.visibility" = "never"; + # + "browser.tabs.inTitlebar" = 1; + # + "browser.newtabpage.enabled" = false; + "browser.newtabpage.enhanced" = false; + "browser.newtabpage.activity-stream.default.sites" = ""; + "browser.newtabpage.activity-stream.asrouter.disable-captive-portal-vpn-promo" = + true; + "browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons" = false; + "browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features" = + false; + "browser.newtabpage.activity-stream.discoverystream.enabled" = false; + "browser.newtabpage.activity-stream.feeds.discoverystreamfeed" = false; + "browser.newtabpage.activity-stream.feeds.places" = false; + "browser.newtabpage.activity-stream.feeds.sections" = false; + "browser.newtabpage.activity-stream.feeds.snippets" = false; + "browser.newtabpage.activity-stream.feeds.telemetry" = false; + "browser.newtabpage.activity-stream.feeds.topsites" = false; + "browser.newtabpage.activity-stream.showSearch" = false; + "browser.newtabpage.activity-stream.showSponsored" = false; + "browser.newtabpage.activity-stream.showSponsoredTopSites" = false; + "browser.newtabpage.activity-stream.telemetry" = false; + # + "layout.css.color-mix.enabled" = true; + # + "svg.context-properties.content.enabled" = true; + + # Annoyances + # + "browser.aboutConfig.showWarning" = false; + "browser.disableResetPrompt" = true; + "browser.newtabpage.introShown" = true; + "browser.onboarding.enabled" = false; + "browser.shell.checkDefaultBrowser" = false; + "browser.tabs.warnOnClose" = false; + "browser.tabs.warnOnCloseOtherTabs" = false; + "browser.tabs.warnOnOpen" = false; + "browser.tabs.warnOnQuitShortcut" = false; + "full-screen-api.warning.delay" = 0; + "full-screen-api.warning.timeout" = 0; + "permissions.default.shortcuts" = 2; + "security.dialog_enable_delay" = 0; + + # Geo + # + # Disable OS provider + "geo.provider.use_gpsd" = false; + # Use the Mozilla provider. Defaults to Google otherwise + "geo.provider.network.url" = "https://location.services.mozilla.com/v1/geolocate?key=%MOZILLA_API_KEY%"; + + # Unsorted + # + "accessibility.force_disabled" = 1; + "beacon.enabled" = false; + "browser.helperApps.deleteTempFileOnExit" = true; + "browser.pagethumbnails.capturing_disabled" = true; + "browser.region.network.url" = ""; + "browser.region.update.enabled" = false; + "browser.selfsupport.url" = ""; + "browser.uitour.enabled" = false; + "browser.uitour.url" = ""; + "intl.accept_languages" = "en-US, en"; + "layout.spellcheckDefault" = 2; + "middlemouse.contentLoadURL" = false; + "permissions.delegation.enabled" = false; + "permissions.manager.defaultsUrl" = ""; + "webchannel.allowObject.urlWhitelist" = ""; + "network.manage-offline-status" = false; + "xpinstall.signatures.required" = false; + + # Toolbar + # + "browser.uiCustomization.state" = '' + {"placements":{"widget-overflow-fixed-list":["ublock0_raymondhill_net-browser-action","_73a6fe31-595d-460b-a920-fcc0f8843232_-browser-action","_446900e4-71c2-419f-a6a7-df9c091e268b_-browser-action","_2e5ff8c8-32fe-46d0-9fc8-6b8986621f3c_-browser-action","_b7f9d2cd-d772-4302-8c3f-eb941af36f76_-browser-action","ipfs-firefox-addon_lidel_org-browser-action","addon_darkreader_org-browser-action","_7a7a4a92-a2a0-41d1-9fd7-1e92480d612d_-browser-action","_aecec67f-0d10-4fa7-b7c7-609a2db280cf_-browser-action"],"nav-bar":["back-button","forward-button","urlbar-container","save-to-pocket-button"],"toolbar-menubar":["menubar-items"],"TabsToolbar":["tabbrowser-tabs","new-tab-button","alltabs-button"],"PersonalToolbar":["personal-bookmarks"]},"seen":["addon_darkreader_org-browser-action","ipfs-firefox-addon_lidel_org-browser-action","plasma-browser-integration_kde_org-browser-action","ublock0_raymondhill_net-browser-action","_2e5ff8c8-32fe-46d0-9fc8-6b8986621f3c_-browser-action","_446900e4-71c2-419f-a6a7-df9c091e268b_-browser-action","_73a6fe31-595d-460b-a920-fcc0f8843232_-browser-action","_7a7a4a92-a2a0-41d1-9fd7-1e92480d612d_-browser-action","_aecec67f-0d10-4fa7-b7c7-609a2db280cf_-browser-action","_b7f9d2cd-d772-4302-8c3f-eb941af36f76_-browser-action","developer-button"],"dirtyAreaCache":["nav-bar","widget-overflow-fixed-list","toolbar-menubar","TabsToolbar","PersonalToolbar"],"currentVersion":17,"newElementCount":6} + ''; + }; +} diff --git a/modules/nixfiles/firefox/userChrome.css b/modules/nixfiles/firefox/userChrome.css new file mode 100644 index 0000000..4d83391 --- /dev/null +++ b/modules/nixfiles/firefox/userChrome.css @@ -0,0 +1,156 @@ +@-moz-document url(chrome://browser/content/browser.xul), url(chrome://browser/content/browser.xhtml) +{ + :root { + --toolbarbutton-border-radius: 0 !important; + --tab-border-radius: 0 !important; + --tab-block-margin: 0 !important; + --arrowpanel-border-radius: 0 !important; + } + + #PersonalToolbar toolbarbutton:not(:hover), + #bookmarks-toolbar-button:not(:hover) { + filter: grayscale(1) !important; + } + + .titlebar-spacer { + display: none !important; + } + + .tabbrowser-tab::after, + .tabbrowser-tab::before { + border: none !important; + } + + #urlbar[pageproxystate="valid"] > #identity-box.verifiedIdentity, + #urlbar[pageproxystate="valid"] > #identity-box.chromeUI, + #urlbar[pageproxystate="valid"] > #identity-box.extensionPage, + #urlbar-display-box { + border: none !important; + } + + .tab-close-button { + display: none !important; + } + + #tabbrowser-tabs:not([movingtab]) + > #tabbrowser-arrowscrollbox + > .tabbrowser-tab + > .tab-stack + > .tab-background[multiselected="true"], + #tabbrowser-tabs:not([movingtab]) + > #tabbrowser-arrowscrollbox + > .tabbrowser-tab + > .tab-stack + > .tab-background[selected="true"] { + background-image: none !important; + } + + #nav-bar:not([tabs-hidden="true"]) { + box-shadow: none; + } + + #tabbrowser-tabs[haspinnedtabs]:not([positionpinnedtabs]) + > #tabbrowser-arrowscrollbox + > .tabbrowser-tab[first-visible-unpinned-tab] { + margin-inline-start: 0 !important; + } + + .tab-background { + border-right: 0px solid var(--black) !important; + margin-left: -4px !important; + } + + .tabbrowser-tab:is([visuallyselected="true"], [multiselected]) + > .tab-stack + > .tab-background { + box-shadow: none !important; + } + + .tabbrowser-tab[last-visible-tab="true"] { + padding-inline-end: 0 !important; + } + + #tabs-newtab-button { + padding-left: 0 !important; + } + + #urlbar-input-container { + border: 3px solid var(--black) !important; + } + + #urlbar[focused="true"] > #urlbar-background { + box-shadow: none !important; + } + + #navigator-toolbox { + border: none !important; + } + + .bookmark-item .toolbarbutton-icon { + display: none; + } + + toolbarbutton.bookmark-item:not(.subviewbutton) { + min-width: 1.6em; + } + + #back-button, + #forward-button, + #context-bookmarklink, + #context-inspect-a11y, + #context-navigation, + #context-openlinkinusercontext-menu, + #context-pocket, + #context-print-selection, + #context-savelink, + #context-savelinktopocket, + #context-savepage, + #context-searchselect, + #context-selectall, + #context-sendimage, + #context-sendlinktodevice, + #context-sendlinktodevice, + #context-sendpagetodevice, + #context-viewsource, + #context_bookmarkTab, + #context_closeTabOptions, + #context_moveTabOptions, + #context_reopenInContainer, + #context_selectAllTabs, + #context_sendTabToDevice { + display: none !important; + } + + .identity-color-blue { + --identity-tab-color: var(--blue) !important; + --identity-icon-color: var(--blue) !important; + } + .identity-color-turquoise { + --identity-tab-color: var(--cyan) !important; + --identity-icon-color: var(--cyan) !important; + } + .identity-color-green { + --identity-tab-color: var(--green) !important; + --identity-icon-color: var(--green) !important; + } + .identity-color-yellow { + --identity-tab-color: var(--yellow) !important; + --identity-icon-color: var(--yellow) !important; + } + .identity-color-orange { + --identity-tab-color: var(--brightRed) !important; + --identity-icon-color: var(--brightRed) !important; + } + .identity-color-red { + --identity-tab-color: var(--red) !important; + --identity-icon-color: var(--red) !important; + } + .identity-color-pink { + --identity-tab-color: var(--brightMagenta) !important; + --identity-icon-color: var(--brightMagenta) !important; + } + .identity-color-purple { + --identity-tab-color: var(--magenta) !important; + --identity-icon-color: var(--magenta) !important; + } +} diff --git a/modules/nixfiles/firefox/userContent.css b/modules/nixfiles/firefox/userContent.css new file mode 100644 index 0000000..8426dc3 --- /dev/null +++ b/modules/nixfiles/firefox/userContent.css @@ -0,0 +1,210 @@ +@-moz-document url(about:blank), url(about:home), url(about:newtab), url(about:privatebrowsing) { + html, + body { + background: var(--background) !important; + } + + body { + display: none !important; + } +} + +@-moz-document media-document(all) { + body { + background-image: none !important; + background-color: var(--background) !important; + } +} + +@-moz-document url-prefix(https://gitlab.com/) +{ + code { + font-family: var(--monospace-font-family) !important; + font-size: var(--monospace-font-size) !important; + } +} + +@-moz-document url-prefix(https://github.com/), url-prefix(https://gist.github.com/) +{ + .blob-num, + .blob-code-inner { + font-family: var(--monospace-font-family) !important; + font-size: var(--monospace-font-size) !important; + } +} + +@-moz-document regexp("https:\/\/.*\.stackexchange\.com\/.*"), url-prefix(https://askubuntu.com/), url-prefix(https://serverfault.com/), url-prefix(https://stackoverflow.com/), url-prefix(https://superuser.com/) +{ + #footer, + #left-sidebar, + #noscript-warning, + #notify-container, + #post-form, + #sidebar, + .ai-start, + .bottom-notice, + .comment-user, + .d-flex.g4, + .d-flex.s-btn-group, + .js-add-link.comments-link, + .js-dismissable-hero, + .js-post-issue, + .js-show-link.comments-link, + .post-taglist, + .s-notice, + .s-topbar, + .site-header, + a.ws-nowrap { + display: none !important; + } + + #question-header .question-hyperlink { + font-family: var(--sans-serif-font-family); + } + + #mainbar { + width: 100% !important; + } + + #content { + margin-top: -50px !important; + border-width: 0 0 0 0 !important; + } +} + +@-moz-document regexp("https:\/\/habr\.com\/(ru|en)\/(article|company\/.*\/blog|post)\/.*") { + .Vue-Toastification__container, + .tm-article-presenter__meta, + .tm-article-snippet__labels, + .tm-article-sticky-panel, + .tm-base-layout__header, + .tm-block.tm-block_spacing-bottom, + .tm-block_spacing-around, + .tm-comment-footer, + .tm-comment__header, + .tm-footer, + .tm-footer-menu, + .tm-header, + .tm-notice, + .tm-page__header, + .tm-page__sidebar, + .tm-user-info, + vue-portal-target { + display: none !important; + } + + * { + transition: none !important; + } + + body { + font-family: var(--sans-serif-font-family) !important; + font-size: var(--sans-serif-font-size) !important; + } + + #app { + height: auto !important; + } + + .tm-article-presenter__footer, + .tm-page__main_has-sidebar { + margin-left: auto !important; + margin-right: auto !important; + max-width: 100% !important; + } + + .tm-page { + padding: 0 !important; + } + + .tm-comment__buttons { + margin: 0 !important; + } + + code { + font-family: var(--monospace-font-family) !important; + font-size: var(--monospace-font-size) !important; + } +} + +@-moz-document url-prefix(https://jisho.org) +{ + header, + footer { + display: none !important; + } +} + +@-moz-document url-prefix(https://search.nixos.org) +{ + .search-sidebar, + footer.container { + display: none !important; + } +} + +@-moz-document url-prefix(https://gog.com) +{ + .galaxy-section-wrapper { + display: none !important; + } +} + +@-moz-document url-prefix(https://steamdb.info) +{ + #steamdb-extension-protip { + display: none !important; + } +} + +@-moz-document regexp("https:\/\/\.*\.hh\.ru/.*") { + .HH-Supernova-Footer, + .index-dashboard-applicant__banners, + .notification-manager, + .resume-sidebar-background, + .supernova-overlay { + display: none !important; + } +} + +@-moz-document url-prefix(https://utaten.com/lyric) +{ + :root { + --kana-font-size: 20px; + --furigana-font-size: 14px; + } + + body { + font-family: var(--sans-serif-font-family) !important; + font-size: var(--kana-font-size) !important; + } + + .rb { + font-size: var(--kana-font-size) !important; + } + + .rt { + font-size: var(--furigana-font-size) !important; + } + + #footer__area, + #reviews, + #sidebar, + .btn_sbs, + .gaugeWrap, + .lyricData, + .movie_contents, + .newLyricWorkFooter, + .path::before, + .recommendAdTag, + .shareArea, + .sideBySideBanner, + .topBanner, + header { + display: none !important; + } + + #contents { + width: 100% !important; + } +} diff --git a/modules/nixfiles/flatpak.nix b/modules/nixfiles/flatpak.nix new file mode 100644 index 0000000..0dec763 --- /dev/null +++ b/modules/nixfiles/flatpak.nix @@ -0,0 +1,13 @@ +{ + config, + lib, + ... +}: +with lib; let + cfg = config.nixfiles.modules.flatpak; +in { + options.nixfiles.modules.flatpak.enable = + mkEnableOption "Whether to enable Flatpak."; + + config = mkIf cfg.enable {services.flatpak.enable = true;}; +} diff --git a/modules/nixfiles/fonts.nix b/modules/nixfiles/fonts.nix new file mode 100644 index 0000000..29e2acb --- /dev/null +++ b/modules/nixfiles/fonts.nix @@ -0,0 +1,106 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.fonts; +in { + imports = [ + (mkAliasOptionModule ["fontScheme"] [ + "nixfiles" + "modules" + "fonts" + "fontScheme" + ]) + ]; + + options.nixfiles.modules.fonts = { + enable = mkEnableOption "Whether to enable fonts and their configurations."; + + fontScheme = let + mkFont = { + family, + style, + size, + }: { + family = mkOption { + description = "Family of the font."; + type = types.str; + default = family; + }; + style = mkOption { + description = "Style of the font."; + type = types.str; + default = style; + }; + size = mkOption { + description = "Size of the font."; + type = types.int; + default = size; + }; + }; + in { + serifFont = mkFont { + family = "Iosevka Etoile"; + style = "Regular"; + size = 16; + }; + + serifFontFallback = mkFont { + family = "Sarasa Gothic J"; + style = "Regular"; + size = 16; + }; + + sansSerifFont = mkFont { + family = "Iosevka Aile"; + style = "Regular"; + size = 16; + }; + + sansSerifFontFallback = mkFont { + family = "Sarasa Gothic J"; + style = "Regular"; + size = 16; + }; + + monospaceFont = mkFont { + family = "Iosevka"; + style = "Regular"; + size = 16; + }; + + monospaceFontFallback = mkFont { + family = "Sarasa Mono J"; + style = "Regular"; + size = 16; + }; + }; + }; + + config = mkMerge [ + (mkIf cfg.enable { + hm.fonts.fontconfig.enable = true; + + fonts = { + fonts = with pkgs; [iosevka sarasa-gothic]; + + fontconfig = { + enable = true; + + defaultFonts = { + monospace = ["Iosevka" "Sarasa Mono" "DejaVu Sans Mono" "Noto Sans Mono"]; + sansSerif = ["Iosevka Aile" "Sarasa Gothic" "DejaVu Sans" "Noto Sans"]; + serif = ["Iosevka Etoile" "Sarasa Gothic" "DejaVu Serif" "Noto Serif"]; + }; + }; + }; + }) + (mkIf (!cfg.enable) { + hm.fonts.fontconfig.enable = mkForce false; + fonts.fontconfig.enable = mkForce false; + }) + ]; +} diff --git a/modules/nixfiles/games/default.nix b/modules/nixfiles/games/default.nix new file mode 100644 index 0000000..532fc57 --- /dev/null +++ b/modules/nixfiles/games/default.nix @@ -0,0 +1,47 @@ +{ + config, + lib, + ... +}: +with lib; let + cfg = config.nixfiles.modules.games; +in { + imports = [ + ./gamemode.nix + ./gog.nix + ./lutris.nix + ./mangohud.nix + ./minecraft.nix + ./steam-run.nix + ./steam.nix + ]; + + options.nixfiles.modules.games.enable32BitSupport = + mkEnableOption "Whether to enable support for games."; + + config = mkIf cfg.enable32BitSupport { + services = { + jack.alsa.support32Bit = config.services.jack.alsa.enable; + + pipewire.alsa.support32Bit = config.services.pipewire.alsa.enable; + + xserver.inputClassSections = [ + '' + Identifier "ds-touchpad" + Driver "libinput" + MatchProduct "Wireless Controller Touchpad" + Option "Ignore" "true" + '' + ]; + }; + + hardware = { + opengl = mkIf config.hardware.opengl.enable { + extraPackages32 = config.hardware.opengl.extraPackages; + driSupport32Bit = config.hardware.opengl.driSupport; + }; + + pulseaudio.support32Bit = config.hardware.pulseaudio.enable; + }; + }; +} diff --git a/modules/nixfiles/games/gamemode.nix b/modules/nixfiles/games/gamemode.nix new file mode 100644 index 0000000..a74b651 --- /dev/null +++ b/modules/nixfiles/games/gamemode.nix @@ -0,0 +1,13 @@ +{ + config, + lib, + ... +}: +with lib; let + cfg = config.nixfiles.modules.games.gamemode; +in { + options.nixfiles.modules.games.gamemode.enable = + mkEnableOption "Whether to enable GameMode."; + + config = mkIf cfg.enable {programs.gamemode.enable = true;}; +} diff --git a/modules/nixfiles/games/gog.nix b/modules/nixfiles/games/gog.nix new file mode 100644 index 0000000..f1188a2 --- /dev/null +++ b/modules/nixfiles/games/gog.nix @@ -0,0 +1,19 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.games.gog; +in { + options.nixfiles.modules.games.gog.enable = + mkEnableOption + "Whether to enable GOG clients and the ability to run GOG games."; + + config = mkIf cfg.enable { + nixfiles.modules.games.steam-run.enable = true; + + hm.home.packages = with pkgs; [lgogdownloader]; + }; +} diff --git a/modules/nixfiles/games/lutris.nix b/modules/nixfiles/games/lutris.nix new file mode 100644 index 0000000..ec1eaa2 --- /dev/null +++ b/modules/nixfiles/games/lutris.nix @@ -0,0 +1,37 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.games.lutris; +in { + options.nixfiles.modules.games.lutris.enable = + mkEnableOption "Whether to enable Lutris."; + + config = mkIf cfg.enable { + nixfiles.modules.games = { + steam-run.enable = true; + gamemode.enable = true; + }; + + hm.home.packages = with pkgs; [ + (lutris.override { + lutris-unwrapped = lutris-unwrapped.override { + wine = buildFHSUserEnv { + # We don't really need Wine because Lutris downloads required + # runtime files for us. This feature is more robust because you can + # juggle different versions without manually rebuilding anything + # because nixpkgs cache was pruned. + name = "empty"; + }; + }; + steamSupport = false; + extraPkgs = _: [ + driversi686Linux.mesa # Battle.net + ]; + }) + ]; + }; +} diff --git a/modules/nixfiles/games/mangohud.nix b/modules/nixfiles/games/mangohud.nix new file mode 100644 index 0000000..21d5fd1 --- /dev/null +++ b/modules/nixfiles/games/mangohud.nix @@ -0,0 +1,13 @@ +{ + config, + lib, + ... +}: +with lib; let + cfg = config.nixfiles.modules.games.mangohud; +in { + options.nixfiles.modules.games.mangohud.enable = + mkEnableOption "Whether to enable MangoHud."; + + config = mkIf cfg.enable {hm.programs.mangohud.enable = true;}; +} diff --git a/modules/nixfiles/games/minecraft.nix b/modules/nixfiles/games/minecraft.nix new file mode 100644 index 0000000..70a98ce --- /dev/null +++ b/modules/nixfiles/games/minecraft.nix @@ -0,0 +1,15 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.games.minecraft; +in { + options.nixfiles.modules.games.minecraft.enable = + mkEnableOption "Whether to enable Minecraft."; + + config = + mkIf cfg.enable {hm.home.packages = with pkgs; [jre nixfiles.UltimMC];}; +} diff --git a/modules/nixfiles/games/steam-run.nix b/modules/nixfiles/games/steam-run.nix new file mode 100644 index 0000000..983cc77 --- /dev/null +++ b/modules/nixfiles/games/steam-run.nix @@ -0,0 +1,59 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.games.steam-run; +in { + options.nixfiles.modules.games.steam-run = { + enable = mkEnableOption "Whether to enable native Steam runtime."; + + quirks = { + mountandblade = mkEnableOption ''Fix "Mount & Blade: Warband" issues.''; + }; + }; + + config = mkIf cfg.enable { + nixfiles.modules = { + games = { + enable32BitSupport = true; + gamemode.enable = true; + }; + }; + + hm.home.packages = with pkgs; [ + (steam.override { + extraLibraries = _: + with cfg.quirks; + optionals mountandblade [ + (glew.overrideAttrs (_: super: let + opname = super.pname; + in rec { + pname = "${opname}-mountandblade"; + inherit (super) version; + src = fetchurl { + url = "mirror://sourceforge/${opname}/${opname}-${version}.tgz"; + sha256 = "sha256-BN6R5+Z2MDm8EZQAlc2cf4gLq6ghlqd2X3J6wFqZPJU="; + }; + })) + (fmodex.overrideAttrs (_: super: let + opname = super.pname; + in rec { + pname = "${opname}-mountandblade"; + inherit (super) version; + installPhase = let + libPath = + makeLibraryPath [alsa-lib libpulseaudio stdenv.cc.cc]; + in '' + install -Dm755 api/lib/libfmodex64-${version}.so $out/lib/libfmodex64.so + patchelf --set-rpath ${libPath} $out/lib/libfmodex64.so + ''; + })) + ]; + }) + .run + ]; + }; +} diff --git a/modules/nixfiles/games/steam.nix b/modules/nixfiles/games/steam.nix new file mode 100644 index 0000000..c1d471e --- /dev/null +++ b/modules/nixfiles/games/steam.nix @@ -0,0 +1,21 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.games.steam; +in { + options.nixfiles.modules.games.steam.enable = + mkEnableOption "Whether to enable Steam runtime."; + + config = mkIf cfg.enable { + nixfiles.modules.games = { + enable32BitSupport = true; + gamemode.enable = true; + }; + + hm.home.packages = with pkgs; [steam]; + }; +} diff --git a/modules/nixfiles/git.nix b/modules/nixfiles/git.nix new file mode 100644 index 0000000..9008c2a --- /dev/null +++ b/modules/nixfiles/git.nix @@ -0,0 +1,125 @@ +{ + config, + lib, + inputs, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.git; +in { + options.nixfiles.modules.git.enable = + mkEnableOption "Whether to enable Git version control system."; + + config = mkIf cfg.enable { + secrets = { + glab-cli-config = { + file = "${inputs.self}/secrets/glab-cli-config"; + path = "${config.dirs.config}/glab-cli/config.yml"; + owner = my.username; + }; + gh-hosts = { + file = "${inputs.self}/secrets/gh-hosts"; + path = "${config.dirs.config}/gh/hosts.yml"; + owner = my.username; + }; + hut = { + file = "${inputs.self}/secrets/hut"; + path = "${config.dirs.config}/hut/config"; + owner = my.username; + }; + }; + + hm = { + home.packages = with pkgs; [glab hut]; + + programs = { + git = { + enable = true; + + package = pkgs.git.override { + sendEmailSupport = true; + withSsh = true; + }; + + userName = my.fullname; + userEmail = my.email; + signing = { + inherit (my.pgp) key; + signByDefault = true; + }; + + extraConfig = + { + advice.detachedHead = false; + color.ui = true; + core.whitespace = "trailing-space"; + diff = { + mnemonicPrefix = true; + renames = "copies"; + submodule = "log"; + }; + init.defaultBranch = "master"; + status.submoduleSummary = true; + github.user = my.username; + gitlab.user = my.username; + } + // mapAttrs' + (n: v: nameValuePair ''url "git@${v}:"'' {insteadOf = "${n}:";}) { + "bitbucket" = "bitbucket.com"; + "codeberg" = "codeberg.org"; + "github" = "github.com"; + "gitlab" = "gitlab.com"; + "sourcehut" = "git.sr.ht"; + }; + + aliases = let + git = "${config.hm.programs.git.package}/bin/git"; + curl = "${pkgs.curl}/bin/curl"; + in { + fuck = "!${git} reset --hard && ${git} clean -fdx"; + gud = ''commit -m "git gud"''; + wtc = "!${curl} -sq whatthecommit.com/index.txt | ${git} commit -F -"; + }; + + # All helper tool/editor generated files should go here. This must be + # kept relatively clean and void of any tooling/project-specific + # residual files. + ignores = [ + "*~" + ".ccls-cache/" + ".clangd/" + ".dir-locals.el" + ".gdb_history" + ".netrwhist" + "[._]*.s[a-v][a-z]" + "[._]*.sw[a-p]" + "[._]s[a-rt-v][a-z]" + "[._]ss[a-gi-z]" + "[._]sw[a-p]" + "\\#*\\#" + "compile_commands.json" + "cscope.*" + "vgcore.*" + ]; + }; + + gh = { + enable = true; + settings.git_protocol = "ssh"; + }; + + bash = { + shellAliases.gl = "${pkgs.glab}/bin/glab"; + initExtra = mkAfter "_complete_alias gl __start_glab glab"; + }; + }; + + xdg.configFile."glab-cli/aliases.yml".text = generators.toYAML {} { + ci = "pipeline ci"; + co = "mr checkout"; + li = "ci lint"; + }; + }; + }; +} diff --git a/modules/nixfiles/gnome.nix b/modules/nixfiles/gnome.nix new file mode 100644 index 0000000..2d0f6f6 --- /dev/null +++ b/modules/nixfiles/gnome.nix @@ -0,0 +1,65 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.gnome; +in { + options.nixfiles.modules.gnome.enable = + mkEnableOption "Whether to enable the GNOME desktop environment."; + + config = mkIf cfg.enable { + nixfiles.modules = { + gnupg.pinentry = mkForce "gnome"; + sound.enable = true; + x11.enable = true; + }; + + services = { + xserver = { + enable = true; + desktopManager.gnome.enable = true; + displayManager.gdm = { + enable = true; + wayland = false; + }; + }; + + gnome = { + core-os-services.enable = true; + core-shell.enable = true; + core-utilities.enable = false; + core-developer-tools.enable = false; + games.enable = false; + + chrome-gnome-shell.enable = false; + gnome-initial-setup.enable = false; + gnome-online-accounts.enable = false; + gnome-remote-desktop.enable = false; + gnome-settings-daemon.enable = true; + gnome-user-share.enable = false; + rygel.enable = false; + tracker-miners.enable = false; + tracker.enable = false; + }; + + dleyna-renderer.enable = false; + dleyna-server.enable = false; + }; + + environment = { + gnome = { + excludePackages = with pkgs.gnome; [ + geary + gnome-disk-utility + seahorse + sushi + ]; + }; + + systemPackages = with pkgs; [pinentry-gnome]; + }; + }; +} diff --git a/modules/nixfiles/gnupg.nix b/modules/nixfiles/gnupg.nix new file mode 100644 index 0000000..16b8264 --- /dev/null +++ b/modules/nixfiles/gnupg.nix @@ -0,0 +1,91 @@ +{ + config, + lib, + ... +}: +with lib; let + cfg = config.nixfiles.modules.gnupg; +in { + options.nixfiles.modules.gnupg = { + enable = mkEnableOption "Whether to enable GnuPG."; + + pinentry = mkOption { + description = "Name of a pinentry implementation."; + type = types.str; + default = with config.nixfiles.modules; + if kde.enable + then "qt" + else if gnome.enable + then "gnome" + else "curses"; + }; + }; + + config = mkIf cfg.enable { + hm = { + programs.gpg = { + enable = true; + + settings = + { + display-charset = "utf-8"; + enable-progress-filter = true; + fixed-list-mode = true; + keyid-format = "0xlong"; + no-comments = true; + no-emit-version = true; + no-greeting = true; + with-fingerprint = true; + throw-keyids = false; + + use-agent = true; + + armor = true; + + no-random-seed-file = true; + + list-options = "show-uid-validity"; + verify-options = "show-uid-validity"; + } + // (let + cipherAlgos = ["AES256" "AES192" "AES"]; + compressionAlgos = ["ZLIB" "BZIP2" "ZIP" "Uncompressed"]; + digestAlgos = ["SHA512" "SHA384" "SHA256" "SHA224"]; + + cs = concatStringsSep " "; + in { + default-preference-list = + cs (digestAlgos ++ cipherAlgos ++ compressionAlgos); + + personal-cipher-preferences = cs cipherAlgos; + personal-compress-preferences = cs compressionAlgos; + personal-digest-preferences = cs digestAlgos; + + s2k-cipher-algo = head cipherAlgos; + s2k-digest-algo = head digestAlgos; + + digest-algo = head digestAlgos; + cert-digest-algo = head digestAlgos; + }); + }; + + services.gpg-agent = { + enable = true; + + enableSshSupport = true; + enableScDaemon = false; + + defaultCacheTtl = 999999; + defaultCacheTtlSsh = 999999; + maxCacheTtl = 999999; + maxCacheTtlSsh = 999999; + + grabKeyboardAndMouse = true; + + sshKeys = [my.pgp.grip]; + + pinentryFlavor = cfg.pinentry; + }; + }; + }; +} diff --git a/modules/nixfiles/gotify.nix b/modules/nixfiles/gotify.nix new file mode 100644 index 0000000..b2bf3ae --- /dev/null +++ b/modules/nixfiles/gotify.nix @@ -0,0 +1,66 @@ +{ + config, + lib, + ... +}: +with lib; let + cfg = config.nixfiles.modules.gotify; +in { + options.nixfiles.modules.gotify = { + enable = mkEnableOption "Whether to enable Gotify."; + + domain = mkOption { + description = "Domain name sans protocol scheme."; + type = with types; str; + default = "gotify.${config.networking.domain}"; + }; + }; + + config = let + db = "gotify"; + in + mkIf cfg.enable { + nixfiles.modules = { + nginx = { + enable = true; + virtualHosts.${cfg.domain} = { + locations."/" = { + proxyPass = "http://127.0.0.1:${toString config.services.gotify.port}"; + proxyWebsockets = true; + }; + }; + }; + postgresql.enable = true; + }; + + services = { + gotify = { + enable = true; + port = 7665; + }; + + postgresql = { + ensureDatabases = [db]; + ensureUsers = [ + { + name = db; + ensurePermissions."DATABASE \"${db}\"" = "ALL PRIVILEGES"; + } + ]; + }; + }; + + systemd.services.gotify-server = { + after = ["network-online.target" "postgresql.service"]; + environment = { + GOTIFY_DATABASE_DIALECT = "postgres"; + GOTIFY_DATABASE_CONNECTION = concatStringsSep " " [ + "host=/run/postgresql" + "user=${db}" + "dbname=${db}" + "sslmode=disable" + ]; + }; + }; + }; +} diff --git a/modules/nixfiles/grafana.nix b/modules/nixfiles/grafana.nix new file mode 100644 index 0000000..4340f04 --- /dev/null +++ b/modules/nixfiles/grafana.nix @@ -0,0 +1,84 @@ +{ + config, + inputs, + lib, + ... +}: +with lib; let + cfg = config.nixfiles.modules.grafana; +in { + options.nixfiles.modules.grafana = { + enable = mkEnableOption "Whether to enable Grafana."; + + port = mkOption { + description = "Port."; + type = with types; port; + default = 30101; + }; + + domain = mkOption { + description = "Domain name sans protocol scheme."; + type = with types; nullOr str; + default = null; + }; + }; + + config = mkIf cfg.enable { + secrets = { + grafana-admin-password = { + file = "${inputs.self}/secrets/grafana-admin-password"; + owner = "grafana"; + group = "grafana"; + }; + grafana-key = { + file = "${inputs.self}/secrets/grafana-key"; + owner = "grafana"; + group = "grafana"; + }; + }; + + nixfiles.modules = { + nginx = { + enable = true; + virtualHosts.${cfg.domain}.locations."/".proxyPass = "http://127.0.0.1:${toString cfg.port}"; + }; + postgresql.enable = true; + }; + + services = let + db = "grafana"; + in { + grafana = { + enable = true; + + inherit (cfg) domain port; + protocol = "http"; + addr = "127.0.0.1"; + + analytics.reporting.enable = false; + + database = { + type = "postgres"; + host = "/run/postgresql"; + name = db; + user = db; + }; + + security = with config.secrets; { + secretKeyFile = grafana-key.path; + adminPasswordFile = grafana-admin-password.path; + }; + }; + + postgresql = { + ensureDatabases = [db]; + ensureUsers = [ + { + name = db; + ensurePermissions."DATABASE \"${db}\"" = "ALL PRIVILEGES"; + } + ]; + }; + }; + }; +} diff --git a/modules/nixfiles/htop.nix b/modules/nixfiles/htop.nix new file mode 100644 index 0000000..9cb3e60 --- /dev/null +++ b/modules/nixfiles/htop.nix @@ -0,0 +1,57 @@ +{ + config, + lib, + ... +}: +with lib; let + cfg = config.nixfiles.modules.htop; +in { + options.nixfiles.modules.htop.enable = + mkEnableOption "Whether to enable htop."; + + config = mkIf cfg.enable { + hm.programs.htop = { + enable = true; + + settings = with config.hm.lib.htop; { + fields = with fields; [ + PID + USER + PRIORITY + NICE + M_SIZE + M_RESIDENT + M_SHARE + STATE + PERCENT_CPU + PERCENT_MEM + TIME + COMM + ]; + account_guest_in_cpu_meter = 1; + detailed_cpu_time = 0; + enable_mouse = 0; + find_comm_in_cmdline = 1; + header_margin = 1; + hide_function_bar = 1; + hide_kernel_threads = 1; + hide_userland_threads = 1; + highlight_base_name = 1; + highlight_changes = 0; + highlight_changes_delay_secs = 1; + highlight_deleted_exe = 1; + highlight_megabytes = 1; + highlight_threads = 1; + shadow_other_users = 1; + show_cpu_frequency = 1; + show_cpu_usage = 1; + show_program_path = 0; + show_thread_names = 0; + strip_exe_from_cmdline = 1; + tree_view = 1; + tree_view_always_by_pid = 1; + update_process_names = 1; + }; + }; + }; +} diff --git a/modules/nixfiles/hydra.nix b/modules/nixfiles/hydra.nix new file mode 100644 index 0000000..4161eb3 --- /dev/null +++ b/modules/nixfiles/hydra.nix @@ -0,0 +1,56 @@ +{ + config, + lib, + ... +}: +with lib; let + cfg = config.nixfiles.modules.hydra; +in { + options.nixfiles.modules.hydra = { + enable = mkEnableOption "Whether to enable Nginx."; + + domain = mkOption { + description = "Domain name sans protocol scheme."; + type = with types; str; + default = "hydra.${config.networking.domain}"; + }; + + port = mkOption { + description = "Port."; + type = with types; port; + default = 7754; + }; + }; + + config = mkIf cfg.enable { + nixfiles.modules = { + nginx = { + enable = true; + virtualHosts.${cfg.domain}.locations."/".proxyPass = "http://127.0.0.1:${toString cfg.port}"; + }; + postgresql.enable = true; + }; + + services = let + db = "hydra"; + in { + hydra = { + enable = true; + listenHost = "127.0.0.1"; + inherit (cfg) port; + dbi = "dbi:Pg:dbname=${db};user=${db}"; + hydraURL = cfg.domain; + }; + + postgresql = { + ensureDatabases = [db]; + ensureUsers = [ + { + name = db; + ensurePermissions."DATABASE \"${db}\"" = "ALL PRIVILEGES"; + } + ]; + }; + }; + }; +} diff --git a/modules/nixfiles/ipfs.nix b/modules/nixfiles/ipfs.nix new file mode 100644 index 0000000..501a07c --- /dev/null +++ b/modules/nixfiles/ipfs.nix @@ -0,0 +1,168 @@ +{ + config, + lib, + this, + ... +}: +with lib; let + cfg = config.nixfiles.modules.ipfs; + + swarmDefaultPort = 4001; + apiDefaultPort = 5001; + gatewayDefaultPort = 6001; +in { + options.nixfiles.modules.ipfs = { + enable = mkEnableOption "Whether to enable IPFS daemon."; + + domain = mkOption { + description = "Domain name sans protocol scheme."; + type = with types; str; + default = "ipfs.${config.networking.fqdn}"; + }; + + swarmPort = mkOption { + description = "Swarm port."; + type = with types; port; + default = + if this.isHeadless + then swarmDefaultPort + 990 + else swarmDefaultPort; + }; + + apiPort = mkOption { + description = "API port."; + type = with types; port; + default = + if this.isHeadless + then apiDefaultPort + 990 + else apiDefaultPort; + }; + + gatewayPort = mkOption { + description = "Gateway port."; + type = with types; port; + default = + if this.isHeadless + then gatewayDefaultPort + 990 + else gatewayDefaultPort; + }; + }; + + config = mkIf cfg.enable (mkMerge [ + { + services.ipfs = { + enable = true; + + user = my.username; + inherit (config.my) group; + + dataDir = "${config.my.home}/.ipfs"; + + swarmAddress = let + port = toString cfg.swarmPort; + in + if this.isHeadless + then [ + "/ip4/127.0.0.1/tcp/${port}" + "/ip4/127.0.0.1/udp/${port}/quic" + ] + else [ + "/ip4/0.0.0.0/tcp/${port}" + "/ip6/::/tcp/${port}" + "/ip4/0.0.0.0/udp/${port}/quic" + "/ip6/::/udp/${port}/quic" + ]; + apiAddress = "/ip4/127.0.0.1/tcp/${toString cfg.apiPort}"; + gatewayAddress = "/ip4/127.0.0.1/tcp/${toString cfg.gatewayPort}"; + + autoMigrate = true; + autoMount = true; + emptyRepo = true; + enableGC = true; + + extraConfig = mkMerge [ + (let + filterAddresses = + [ + "/ip4/100.64.0.0/ipcidr/10" + "/ip4/169.254.0.0/ipcidr/16" + "/ip4/172.16.0.0/ipcidr/12" + "/ip4/192.0.0.0/ipcidr/24" + "/ip4/192.0.2.0/ipcidr/24" + "/ip4/192.168.0.0/ipcidr/16" + "/ip4/198.18.0.0/ipcidr/15" + "/ip4/198.51.100.0/ipcidr/24" + "/ip4/203.0.113.0/ipcidr/24" + "/ip4/240.0.0.0/ipcidr/4" + "/ip6/100::/ipcidr/64" + "/ip6/2001:2::/ipcidr/48" + "/ip6/2001:db8::/ipcidr/32" + "/ip6/fe80::/ipcidr/10" + ] + ++ optionals (!hasAttr "wireguard" this) [ + "/ip4/10.0.0.0/ipcidr/8" + "/ip6/fc00::/ipcidr/7" + ]; + in { + Addresses = with config.services.ipfs; { + # https://github.com/NixOS/nixpkgs/pull/165259 + # I think this shit broke inheritance... Gotta test more and make + # a PR I guess. + API = apiAddress; + Gateway = gatewayAddress; + Swarm = swarmAddress; + + NoAnnounce = filterAddresses; + }; + Swarm.AddrFilters = filterAddresses; + API.HTTPHeaders.Access-Control-Allow-Methods = ["GET" "POST" "PUT"]; + }) + (mkIf this.isHeadful { + API.HTTPHeaders.Access-Control-Allow-Origin = ["*"]; + }) + (mkIf this.isHeadless { + API.HTTPHeaders.Access-Control-Allow-Origin = ["https://${cfg.domain}" "https://api.${cfg.domain}"]; + }) + ]; + }; + + networking.firewall = rec { + allowedTCPPorts = [swarmDefaultPort]; + allowedUDPPorts = allowedTCPPorts; + }; + } + (mkIf this.isHeadless { + nixfiles.modules.nginx = { + enable = true; + virtualHosts = { + ${cfg.domain}.locations."/".proxyPass = "http://127.0.0.1:${toString cfg.gatewayPort}"; + "swarm.${cfg.domain}" = { + serverName = cfg.domain; + listen = [ + { + addr = "0.0.0.0"; + port = swarmDefaultPort; + } + { + addr = "[::0]"; + port = swarmDefaultPort; + } + ]; + locations."/".proxyPass = "http://127.0.0.1:${toString cfg.swarmPort}"; + }; + "api.${cfg.domain}" = { + # TODO Redirect "/" to "/webui" but keep other endpoints. + locations."/" = { + proxyPass = "http://127.0.0.1:${toString cfg.apiPort}"; + extraConfig = '' + if ($internal != 1) { + return 403; + } + ''; + }; + }; + }; + }; + }) + ]); +} diff --git a/modules/nixfiles/kde.nix b/modules/nixfiles/kde.nix new file mode 100644 index 0000000..571cb6d --- /dev/null +++ b/modules/nixfiles/kde.nix @@ -0,0 +1,27 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.kde; +in { + options.nixfiles.modules.kde.enable = + mkEnableOption "Whether to enable KDE Plasma 5."; + + config = mkIf cfg.enable { + nixfiles.modules = { + gnupg.pinentry = mkForce "qt"; + sound.enable = true; + x11.enable = true; + }; + + services.xserver = { + desktopManager.plasma5.enable = true; + displayManager.sddm.enable = true; + }; + + environment.systemPackages = with pkgs; [pinentry-qt]; + }; +} diff --git a/modules/nixfiles/libvirtd.nix b/modules/nixfiles/libvirtd.nix new file mode 100644 index 0000000..5ce37f0 --- /dev/null +++ b/modules/nixfiles/libvirtd.nix @@ -0,0 +1,40 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.libvirtd; +in { + options.nixfiles.modules.libvirtd.enable = + mkEnableOption "Wether to enable libvirtd."; + + config = mkIf cfg.enable { + virtualisation.libvirtd = { + enable = true; + + onBoot = "ignore"; + onShutdown = "shutdown"; + + qemu = { + package = pkgs.qemu_kvm; + runAsRoot = false; + + ovmf = { + enable = true; + packages = [pkgs.OVMFFull.fd]; + }; + + swtpm = { + enable = false; + package = pkgs.swtpm-tpm2; + }; + }; + }; + + environment.systemPackages = with pkgs; [virt-manager qemu-utils]; + + my.extraGroups = ["libvirtd"]; + }; +} diff --git a/modules/nixfiles/lidarr.nix b/modules/nixfiles/lidarr.nix new file mode 100644 index 0000000..54d1fe5 --- /dev/null +++ b/modules/nixfiles/lidarr.nix @@ -0,0 +1,27 @@ +{ + config, + lib, + ... +}: +with lib; let + cfg = config.nixfiles.modules.lidarr; +in { + options.nixfiles.modules.lidarr = { + enable = mkEnableOption "Whether to enable Lidarr."; + + domain = mkOption { + description = "Domain name sans protocol scheme."; + type = with types; str; + default = "lidarr.${config.networking.fqdn}"; + }; + }; + + config = mkIf cfg.enable { + nixfiles.modules.nginx = { + enable = true; + virtualHosts.${cfg.domain}.locations."/".proxyPass = "http://127.0.0.1:8686"; + }; + + services.lidarr.enable = true; + }; +} diff --git a/modules/nixfiles/loki.nix b/modules/nixfiles/loki.nix new file mode 100644 index 0000000..27217bd --- /dev/null +++ b/modules/nixfiles/loki.nix @@ -0,0 +1,113 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.loki; +in { + options.nixfiles.modules.loki = { + # TODO Figure out why this shit refuses to work with my configuraiton. + enable = mkEnableOption "Whether to enable Loki."; + + port = mkOption { + description = "Port."; + type = with types; port; + default = 30171; + }; + + domain = mkOption { + description = "Domain name sans protocol scheme."; + type = with types; str; + default = config.nixfiles.modules.monitoring.domain; + }; + + path = mkOption { + description = "Path."; + type = with types; str; + default = "/loki"; + }; + }; + + config = mkIf cfg.enable { + nixfiles.modules.nginx = with cfg; { + enable = true; + virtualHosts.${domain}.locations.${path} = { + proxyPass = "http://127.0.0.1:${toString port}"; + extraConfig = '' + if ($internal != 1) { + return 403; + } + ''; + }; + }; + + services.loki = { + enable = true; + + configuration = rec { + auth_enabled = false; + + server = rec { + http_listen_address = "127.0.0.1"; + http_listen_port = cfg.port; + http_path_prefix = cfg.path; + + grpc_listen_address = "127.0.0.1"; + grpc_listen_port = http_listen_port + 1; + + log_level = "warn"; + }; + + common = rec { + path_prefix = "/var/lib/loki"; + storage.filesystem = { + chunks_directory = "${path_prefix}/chunker"; + rules_directory = "${path_prefix}/ruler"; + }; + replication_factor = 1; + instance_interface_names = ["lo"]; + ring = { + instance_addr = "127.0.0.1"; + kvstore.store = "inmemory"; + }; + }; + + ruler = { + rule_path = "${common.path_prefix}/ruler"; + storage = { + type = "local"; + local.directory = + pkgs.writeTextDir "ruler/ruler.yml" + (generators.toJSON {} {groups = [{name = "default";}];}); + }; + }; + + schema_config.configs = [ + { + from = "2020-01-01"; + store = "boltdb-shipper"; + object_store = "filesystem"; + schema = "v11"; + index = { + prefix = "index_"; + period = "24h"; + }; + chunks = { + prefix = "chunks_"; + period = "24h"; + }; + } + ]; + + analytics.reporting_enabled = false; + }; + }; + + systemd.tmpfiles.rules = [ + "d /var/lib/loki 0700 loki loki - -" + "d /var/lib/loki/ruler 0700 loki loki - -" + ]; + }; +} diff --git a/modules/nixfiles/lxc.nix b/modules/nixfiles/lxc.nix new file mode 100644 index 0000000..ea4d8a6 --- /dev/null +++ b/modules/nixfiles/lxc.nix @@ -0,0 +1,16 @@ +{ + config, + lib, + ... +}: +with lib; let + cfg = config.nixfiles.modules.lxc; +in { + options.nixfiles.modules.lxc.enable = + mkEnableOption "Whether to enable LXC/LXD."; + + config = mkIf cfg.enable { + virtualisation.lxd.enable = true; + my.extraGroups = "lxd"; + }; +} diff --git a/modules/nixfiles/matrix/default.nix b/modules/nixfiles/matrix/default.nix new file mode 100644 index 0000000..bd221c4 --- /dev/null +++ b/modules/nixfiles/matrix/default.nix @@ -0,0 +1 @@ +_: {imports = [./dendrite.nix ./element.nix ./synapse.nix];} diff --git a/modules/nixfiles/matrix/dendrite.nix b/modules/nixfiles/matrix/dendrite.nix new file mode 100644 index 0000000..4e40e97 --- /dev/null +++ b/modules/nixfiles/matrix/dendrite.nix @@ -0,0 +1,148 @@ +{ + config, + lib, + inputs, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.matrix.dendrite; +in { + options.nixfiles.modules.matrix.dendrite = { + enable = mkEnableOption "Whether to enable Dendrite Matrix server."; + + domain = mkOption { + description = "Domain name sans protocol scheme."; + type = with types; str; + default = config.networking.domain; + }; + }; + + config = mkIf cfg.enable { + secrets.dendrite-private-key = { + file = "${inputs.self}/secrets/dendrite-private-key"; + mode = "0444"; # User is dynamic. + }; + + nixfiles.modules = { + nginx = { + enable = true; + virtualHosts.${cfg.domain}.locations = { + "/_matrix".proxyPass = "http://127.0.0.1:${toString config.services.dendrite.httpPort}"; + "= /.well-known/matrix/server" = { + extraConfig = '' + add_header Content-Type application/json; + ''; + return = "200 '${ + generators.toJSON {} {"m.server" = "${cfg.domain}:443";} + }'"; + }; + "= /.well-known/matrix/client" = { + extraConfig = '' + add_header Content-Type application/json; + add_header Access-Control-Allow-Origin *; + ''; + return = "200 '${ + generators.toJSON {} { + "m.homeserver".base_url = "https://${cfg.domain}"; + } + }'"; + }; + }; + }; + postgresql.enable = true; + }; + + services = let + name = "dendrite"; + prefix = "${name}-"; + databaseNames = [ + "account" + "appservice" + "device" + "federation" + "key" + "media" + "mscs" + "room" + "sync" + ]; + databaseList = forEach databaseNames (x: concatStrings [prefix x]); + databaseAttr = genAttrs databaseNames (x: concatStrings [prefix x]); + + mkDatabaseConnection = database: "postgres://${name}@/${database}?sslmode=disable"; + in { + dendrite = { + enable = true; + httpPort = 8008; + settings = { + global = { + server_name = cfg.domain; + + private_key = config.secrets.dendrite-private-key.path; + + disable_federation = false; + }; + + app_service_api.database.connection_string = + mkDatabaseConnection databaseAttr.appservice; + + client_api = { + registration_disabled = true; + turn = {}; # TODO + }; + + federation_api.database.connection_string = + mkDatabaseConnection databaseAttr.federation; + + key_server.database.connection_string = + mkDatabaseConnection databaseAttr.key; + + media_api = { + database.connection_string = + mkDatabaseConnection databaseAttr.media; + base_path = "./media"; + }; + + mscs.database.connection_string = + mkDatabaseConnection databaseAttr.mscs; + + room_server.database.connection_string = + mkDatabaseConnection databaseAttr.room; + + sync_api.database.connection_string = + mkDatabaseConnection databaseAttr.sync; + + user_api = { + account_database.connection_string = + mkDatabaseConnection databaseAttr.account; + device_database.connection_string = + mkDatabaseConnection databaseAttr.device; + }; + + metrics.enabled = false; # TODO + }; + }; + + postgresql = { + ensureDatabases = databaseList; + ensureUsers = + map (x: { + inherit name; + ensurePermissions."DATABASE \"${x}\"" = "ALL PRIVILEGES"; + }) + databaseList; + }; + }; + + systemd.services.dendrite.serviceConfig.ExecStart = + mkForce + (concatStringsSep " " [ + "${pkgs.dendrite}/bin/dendrite-monolith-server" + "--config /run/dendrite/dendrite.yaml" + "--http-bind-address 127.0.0.1:${ + toString config.services.dendrite.httpPort + }" + ]); + }; +} diff --git a/modules/nixfiles/matrix/element.nix b/modules/nixfiles/matrix/element.nix new file mode 100644 index 0000000..79c9f97 --- /dev/null +++ b/modules/nixfiles/matrix/element.nix @@ -0,0 +1,59 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.matrix.element; +in { + options.nixfiles.modules.matrix.element = { + enable = mkEnableOption "Whether to enable Element Matrix web interface."; + + domain = mkOption { + description = "Domain name sans protocol scheme."; + type = with types; nullOr str; + default = "element.${config.networking.domain}"; + }; + + homeserver = mkOption { + description = "Default Matrix homeserver."; + type = with types; str; + default = my.domain.azahi; + }; + }; + + config = mkIf cfg.enable { + assertions = [ + { + assertion = with config.nixfiles.modules.matrix; + (synapse.enable || dendrite.enable) && !(!synapse.enable && !dendrite.enable); + message = "Synapse or Dendrite must be enabled"; + } + ]; + + nixfiles.modules.nginx = with cfg; { + enable = true; + virtualHosts.${domain}.locations."/".root = pkgs.element-web.override { + conf = { + default_server_config."m.homeserver" = { + base_url = "https://${homeserver}"; + server_name = homeserver; + }; + disable_custom_urls = true; + disable_guests = true; + disable_login_language_selector = true; + disable_3pid_login = true; + brand = homeserver; + branding.authFooterLinks = [ + { + text = "Hosted on NixOS"; + url = "https://nixos.org"; + } + ]; + default_theme = "dark"; + }; + }; + }; + }; +} diff --git a/modules/nixfiles/matrix/synapse.nix b/modules/nixfiles/matrix/synapse.nix new file mode 100644 index 0000000..cde5f8e --- /dev/null +++ b/modules/nixfiles/matrix/synapse.nix @@ -0,0 +1,90 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.matrix.synapse; +in { + options.nixfiles.modules.matrix.synapse = { + enable = mkEnableOption "Whether to enable Synapse Matrix server."; + + domain = mkOption { + description = "Domain name sans protocol scheme."; + type = with types; str; + default = config.networking.domain; + }; + }; + + config = let + bind_address = "127.0.0.1"; + port = 8448; + in + mkIf cfg.enable { + nixfiles.modules = { + nginx = { + enable = true; + virtualHosts.${cfg.domain}.locations = { + "~ ^(/_matrix|/_synapse/client)".proxyPass = "http://${bind_address}:${toString port}"; + "= /.well-known/matrix/server" = { + extraConfig = '' + add_header Content-Type application/json; + ''; + return = "200 '${ + generators.toJSON {} {"m.server" = "${cfg.domain}:443";} + }'"; + }; + "= /.well-known/matrix/client" = { + extraConfig = '' + add_header Content-Type application/json; + add_header Access-Control-Allow-Origin *; + ''; + return = "200 '${ + generators.toJSON {} { + "m.homeserver".base_url = "https://${cfg.domain}"; + } + }'"; + }; + }; + }; + postgresql.enable = true; + }; + + services = let + db = "synapse"; + in { + matrix-synapse = { + enable = true; + server_name = config.networking.domain; + + database_type = "psycopg2"; + database_name = db; + database_user = db; + + listeners = [ + { + inherit bind_address port; + type = "http"; + tls = false; + x_forwarded = true; + resources = [ + { + names = ["client" "federation"]; + compress = false; + } + ]; + } + ]; + }; + + postgresql.initialScript = pkgs.writeText "init-matrix-synapse.sql" '' + CREATE USER "${db}"; + CREATE DATABASE "${db}" WITH OWNER "${db}" + TEMPLATE template0 + LC_COLLATE = "C" + LC_CTYPE = "C"; + ''; + }; + }; +} diff --git a/modules/nixfiles/monitoring.nix b/modules/nixfiles/monitoring.nix new file mode 100644 index 0000000..6db74d4 --- /dev/null +++ b/modules/nixfiles/monitoring.nix @@ -0,0 +1,114 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.monitoring; +in { + options.nixfiles.modules.monitoring = { + enable = mkEnableOption '' + Whether to enable custom monitoring stack. + + Currently this configures and enables Grafana, Loki, Prometheus and + Alertmanager. + ''; + + domain = mkOption { + description = "Domain name sans protocol scheme."; + type = with types; nullOr str; + default = "monitoring.${config.networking.domain}"; + }; + }; + + config = mkIf cfg.enable { + nixfiles.modules = { + grafana = { + enable = true; + inherit (cfg) domain; + }; + loki = { + enable = true; + inherit (cfg) domain; + }; + prometheus = { + enable = true; + inherit (cfg) domain; + }; + alertmanager = { + enable = true; + inherit (cfg) domain; + }; + }; + + services = { + grafana.provision = { + enable = true; + datasources = with config.nixfiles.modules; [ + { + name = "Prometheus"; + type = "prometheus"; + access = "proxy"; + url = with prometheus; "https://${domain}${path}"; + isDefault = true; + } + { + name = "Loki"; + type = "loki"; + access = "proxy"; + url = with loki; "https://${domain}${path}"; + } + ]; + # TODO Move dashboards to this repository. + dashboards = [ + { + name = "system"; + options.path = pkgs.fetchurl { + url = "https://gist.githubusercontent.com/azahi/b8951223e6850d88159b0c34749a20aa/raw/00c6928374b5d231dc3afe617165550868b8c233/System-1645616603173.json"; + sha256 = "sha256-vGlCOHT5Rp1K88Z8lkLGkvTDeFpgi967CSOb/797vwY="; + }; + } + { + name = "endlessh-go"; + options.path = pkgs.fetchurl { + url = "https://gist.githubusercontent.com/azahi/fd917e917fb53deacf3c6d7366bae2b2/raw/796530bd899e9328e423d18a462faf3c7d01c823/endlessh.json"; + sha256 = "sha256-/wJDiFlrHEa1f82pDFtG/T2GRKGlAur0dlQ8eeVJ3m4="; + }; + } + { + name = "unbound"; + options.path = pkgs.fetchurl { + url = "https://gist.githubusercontent.com/azahi/73fc27e22acc9a01898b2d3e21150aac/raw/37d03bc51253583d9265d6f2189242003092261e/Unbound-1645616052811.json"; + sha256 = "sha256-PXDCCa5qOg/Hj9CBId0OVUYmPlOjS05NxhDQ6zWxGp0="; + }; + } + { + name = "nginx"; + options.path = pkgs.fetchurl { + url = "https://raw.githubusercontent.com/nginxinc/nginx-prometheus-exporter/452953738bfcb8aac02ce6e6ac32f53479cad2aa/grafana/dashboard.json"; + sha256 = "sha256-HRDWsSQeLzybaJ1g5xZqtmhf8JPtGhv/6TD1aFsgJIw="; + }; + } + { + name = "postgersql"; + options.path = pkgs.fetchurl { + url = "https://raw.githubusercontent.com/lstn/misc-grafana-dashboards/051873e103119ff0edf9886dcdc0c6c0a3ee6702/dashboards/postgresql-database.json"; + sha256 = "sha256-awlj3BM3GaBBG/zJvxsVBRzoM8i6aY5dV34++DZFQHs="; + }; + } + ]; + }; + + loki.configuration.ruler.alertmanager_url = with config.nixfiles.modules.alertmanager; "https://${domain}${path}"; + + prometheus.alertmanagers = [ + { + scheme = "https"; + path_prefix = config.nixfiles.modules.alertmanager.path; + static_configs = [{targets = [cfg.domain];}]; + } + ]; + }; + }; +} diff --git a/modules/nixfiles/mpd.nix b/modules/nixfiles/mpd.nix new file mode 100644 index 0000000..b2962ab --- /dev/null +++ b/modules/nixfiles/mpd.nix @@ -0,0 +1,212 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.mpd; +in { + options.nixfiles.modules.mpd.enable = + mkEnableOption "Wether to enable MPD and its clients."; + + config = mkIf cfg.enable { + hm = { + home.packages = with pkgs; [mpc_cli]; + + services.mpd = { + enable = true; + + extraConfig = '' + restore_paused "yes" + + auto_update "no" + + replaygain "album" + replaygain_preamp "0" + replaygain_limit "yes" + + volume_normalization "no" + + zeroconf_enabled "no" + + audio_output { + type "pipewire" + name "piepwire" + } + ''; + }; + + programs.ncmpcpp = { + enable = true; + + settings = rec { + ncmpcpp_directory = "${config.hm.xdg.dataHome}/ncmpcpp"; + lyrics_directory = "${ncmpcpp_directory}/lyrics"; + + playlist_disable_highlight_delay = 1; + message_delay_time = 1; + + song_window_title_format = "{%a - }{%t}|{%f}"; + song_list_format = "{$6%t}|{$2%f}$1 $R{$8%b}$1 {$5%a}"; + song_columns_list_format = "(20)[red]{a} (30)[cyan]{b} (50)[blue]{t|f}"; + song_status_format = "{{$8%a$9{ $b-$/b $6%b$9 {(%y)} } - } '{%t}}|{%f}'"; + song_library_format = "{%n - }{%t}|{%f}"; + + now_playing_prefix = "$b"; + now_playing_suffix = "$/b"; + + selected_item_prefix = "$0"; + selected_item_suffix = "$9"; + modified_item_prefix = "$3> $9"; + + browser_playlist_prefix = "$2playlist$9 "; + browser_sort_format = "{%a - }{%t}|{%f} {(%l)}"; + + playlist_show_mpd_host = false; + playlist_show_remaining_time = false; + playlist_shorten_total_times = false; + playlist_separate_albums = false; + + playlist_display_mode = "classic"; + browser_display_mode = "classic"; + search_engine_display_mode = "classic"; + playlist_editor_display_mode = "classic"; + + incremental_seeking = true; + seek_time = 1; + + volume_change_step = 5; + + autocenter_mode = true; + centered_cursor = true; + + progressbar_look = "=*-"; + + default_place_to_search_in = "database"; + search_engine_default_search_mode = 1; + data_fetching_delay = false; + media_library_primary_tag = "album_artist"; + browser_sort_mode = "name"; + default_find_mode = "wrapped"; + default_tag_editor_pattern = "%n - %t"; + empty_tag_marker = "<blank>"; + tags_separator = " | "; + tag_editor_extended_numeration = true; + media_library_sort_by_mtime = false; + regular_expressions = "none"; + block_search_constraints_change_if_items_found = true; + + ignore_leading_the = true; + + enable_window_title = false; + + header_visibility = false; + statusbar_visibility = false; + titles_visibility = false; + + display_volume_level = false; + display_bitrate = false; + display_remaining_time = false; + + cyclic_scrolling = true; + lines_scrolled = 1; + + follow_now_playing_lyrics = false; + fetch_lyrics_for_current_song_in_background = false; + store_lyrics_in_song_dir = false; + + generate_win32_compatible_filenames = false; + allow_for_physical_item_deletion = false; + show_hidden_files_in_local_browser = false; + + screen_switcher_mode = "playlist, browser"; + startup_screen = "playlist"; + startup_slave_screen = ""; + startup_slave_screen_focus = false; + locked_screen_width_part = 50; + ask_for_locked_screen_width_part = true; + + jump_to_now_playing_song_at_start = false; + + ask_before_clearing_playlists = false; + + clock_display_seconds = false; + + mouse_support = false; + + external_editor = "${config.programs.vim.package}/bin/vim"; + use_console_editor = true; + + colors_enabled = true; + discard_colors_if_item_is_selected = true; + + empty_tag_color = "cyan"; + header_window_color = "cyan"; + volume_color = "cyan"; + state_line_color = "cyan"; + state_flags_color = "green"; + main_window_color = "blue"; + color1 = "cyan"; + color2 = "red"; + progressbar_color = "cyan"; + progressbar_elapsed_color = "white"; + statusbar_color = "yellow"; + window_border_color = "green"; + active_window_border = "red"; + }; + + bindings = [ + { + key = "j"; + command = "scroll_down"; + } + { + key = "k"; + command = "scroll_up"; + } + { + key = "J"; + command = ["select_item" "scroll_down"]; + } + { + key = "K"; + command = ["select_item" "scroll_up"]; + } + { + key = "h"; + command = ["previous_column" "master_screen"]; + } + { + key = "l"; + command = ["next_column" "slave_screen"]; + } + { + key = "g"; + command = "move_home"; + } + { + key = "G"; + command = "move_end"; + } + { + key = "d"; + command = [ + "delete_playlist_items" + "delete_browser_items" + "delete_stored_playlist" + ]; + } + { + key = "L"; + command = "show_lyrics"; + } + { + key = "H"; + command = "toggle_lyrics_fetcher"; + } + ]; + }; + }; + }; +} diff --git a/modules/nixfiles/mpv.nix b/modules/nixfiles/mpv.nix new file mode 100644 index 0000000..68628c5 --- /dev/null +++ b/modules/nixfiles/mpv.nix @@ -0,0 +1,133 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.mpv; +in { + options.nixfiles.modules.mpv.enable = mkEnableOption "Whether to enable MPV."; + + config = mkIf cfg.enable { + hm.programs = { + mpv = { + enable = true; + + package = with pkgs; + mpv-with-scripts.override { + scripts = with mpvScripts; [autoload mpv-autosub sponsorblock]; + }; + + bindings = { + "RIGHT" = "seek 10"; + "LEFT" = "seek -10"; + "UP" = "seek 60"; + "DOWN" = "seek -60"; + + "Shift+RIGHT" = "no-osd seek 1 exact"; + "Shift+LEFT" = "no-osd seek -1 exact"; + "Shift+UP" = "no-osd seek 5 exact"; + "Shift+DOWN" = "no-osd seek -5 exact"; + + "Alt+k" = "add sub-scale +0.1"; + "Alt+j" = "add sub-scale -0.1"; + + "B" = ''cycle-values background "#000000" "#ffffff"''; + }; + + profiles = { + "protocol.http".force-window = "immediate"; + "protocol.https".profile = "protocol.http"; + }; + + config = let + lang = comcat [ + "Japanese" + "japanese" + "jp" + "jpn" + "jaJP" + "ja-JP" + "English" + "english" + "en" + "eng" + "enUS" + "en-US" + "Russian" + "russian" + "ru" + "rus" + "ruRU" + "ru-RU" + ]; + in { + audio-display = "no"; + autofit-larger = "100%x95%"; + cursor-autohide = 1000; + force-seekable = "no"; + fullscreen = true; + load-unsafe-playlists = true; + msg-color = true; + msg-module = true; + prefetch-playlist = true; + save-position-on-quit = false; + screenshot-format = "png"; + screenshot-template = "%F [%p]"; + stop-screensaver = true; + term-osd-bar = true; + use-filedir-conf = true; + + osd-bar-align-y = 0; + osd-bar-h = 2; + osd-bar-w = 60; + osd-border-color = "#FF262626"; + osd-border-size = 2.5; + osd-color = "#FFFFFFFF"; + osd-duration = 2500; + osd-font-size = 40; + osd-fractions = true; + osd-level = 1; + osd-shadow-color = "#33000000"; + + osc = false; + + sub-auto = "fuzzy"; + sub-file-paths-append = "srt"; + sub-ass-force-margins = true; + sub-ass-force-style = "kerning=yes"; + sub-fix-timing = true; + sub-use-margins = true; + sub-font-size = 40; + sub-color = "#FFFFFFFF"; + sub-border-color = "#FF262626"; + sub-border-size = 2.5; + sub-shadow-offset = 1; + sub-shadow-color = "#33000000"; + sub-spacing = 0.5; + blend-subtitles = true; + + audio-file-auto = "fuzzy"; + volume = 100; + volume-max = 200; + + alang = lang; + slang = lang; + + ytdl = true; + ytdl-raw-options = ''sub-lang="${lang}",write-sub=''; + ytdl-format = "(bestvideo[height<=?1080][fps<=?60][protocol!=http_dash_segments])+(bestaudio[acodec=opus]/bestaudio)/best"; + }; + }; + + bash = { + shellAliases.cam = "${config.hm.programs.mpv.package}/bin/mpv av://v4l2:/dev/video0"; + + initExtra = mkAfter '' + _complete_alias cam _mpv mpv + ''; + }; + }; + }; +} diff --git a/modules/nixfiles/nextcloud.nix b/modules/nixfiles/nextcloud.nix new file mode 100644 index 0000000..d63f824 --- /dev/null +++ b/modules/nixfiles/nextcloud.nix @@ -0,0 +1,133 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.nextcloud; +in { + options.nixfiles.modules.nextcloud = { + enable = mkEnableOption "Whether to enable Nextcloud."; + + domain = mkOption { + description = "Domain name sans protocol scheme."; + type = with types; str; + default = "nextcloud.${config.networking.domain}"; + }; + }; + + config = mkIf cfg.enable { + nixfiles.modules = { + nginx = { + enable = true; + virtualHosts.${cfg.domain} = {}; + }; + postgresql.enable = true; + }; + + services = let + db = "nextcloud"; + in { + nextcloud = mkMerge [ + { + enable = true; + package = pkgs.nextcloud23; + + hostName = cfg.domain; + + appstoreEnable = false; + + config = { + adminpassFile = null; # This needs to be set as secret. + + dbtype = "pgsql"; + dbhost = "/run/postgresql"; + dbuser = db; + dbname = db; + + defaultPhoneRegion = "RU"; + }; + + extraApps = let + mkNextcloudApp = { + name, + version, + sha256, + }: + pkgs.fetchNextcloudApp { + inherit name version sha256; + url = "https://github.com/nextcloud/${name}/archive/refs/tags/v${version}.tar.gz"; + }; + in { + contacts = mkNextcloudApp { + name = "contacts"; + version = "4.0.1"; + sha256 = "sha256-dXKsG8KmlUojeY5dUn/XsMD3KaSh4QcZFOGDdcqlSvE="; + }; + calendar = mkNextcloudApp { + name = "calendar"; + version = "3.0.5"; + sha256 = "sha256-aKUKm7fWJQxOWwma56Tv+GGIo+p0n30Nhoyt4XoxsjI="; + }; + files_rightclick = mkNextcloudApp { + name = "files_rightclick"; + version = "23.0.1"; + sha256 = "sha256-VYODzkvvGrtpyRoug/8UPKhAgfCx1ltP1JdGPiB/lts="; + }; + unsplash = mkNextcloudApp { + name = "unsplash"; + version = "1.2.4"; + sha256 = "sha256-KGSkBOrNu0nK0YvAPYaxEL/kZNoJQD1oBV2aUBxh6cI="; + }; + previewgenerator = mkNextcloudApp { + name = "previewgenerator"; + version = "3.4.1"; + sha256 = "sha256-IUdj0xWt5zHxQoiMv1bYyYTzekuOFrsRIe530QOwC/w="; + }; + bruteforcesettings = mkNextcloudApp { + name = "bruteforcesettings"; + version = "2.3.0"; + sha256 = "sha256-J7ujmiPaw8GI7vDfVPXEum2XAMWvahciP8C6iXgckdE="; + }; + }; + } + (mkIf config.nixfiles.modules.acme.enable { + https = true; + config.overwriteProtocol = "https"; + }) + ]; + + postgresql = { + ensureDatabases = [db]; + ensureUsers = [ + { + name = db; + ensurePermissions."DATABASE \"${db}\"" = "ALL PRIVILEGES"; + } + ]; + }; + }; + + systemd = { + services = { + nextcloud-setup.after = ["network-online.target" "postgresql.service"]; + + nextcloud-preview-generate-cron.serviceConfig = { + Type = "oneshot"; + User = "nextcloud"; + ExecStart = "${config.services.nextcloud.occ}/bin/nextcloud-occ preview:pre-generate"; + }; + }; + + timers.nextcloud-preview-generate = { + wantedBy = ["timers.target"]; + timerConfig = { + OnBootSec = "15m"; + OnUnitActiveSec = "15m"; + Unit = "nextcloud-preview-generate-cron.service"; + }; + }; + }; + }; +} diff --git a/modules/nixfiles/nginx.nix b/modules/nixfiles/nginx.nix new file mode 100644 index 0000000..35f5098 --- /dev/null +++ b/modules/nixfiles/nginx.nix @@ -0,0 +1,90 @@ +{ + config, + lib, + pkgs, + this, + ... +}: +with lib; let + cfg = config.nixfiles.modules.nginx; +in { + options.nixfiles.modules.nginx = { + enable = mkEnableOption "Whether to enable Nginx."; + + virtualHosts = mkOption { + description = "Attrset of virtual hosts."; + # Not sure how to "inherit" the type from the original Nixpkgs option. + # Just make sure it's compatible with service.nginx.virtualHosts, ok? + type = with types; anything; + default = null; + }; + }; + + config = mkIf cfg.enable { + services = { + nginx = { + enable = true; + enableReload = true; + + package = pkgs.nginxMainline; + + statusPage = true; + + recommendedGzipSettings = true; + recommendedOptimisation = true; + recommendedProxySettings = true; + recommendedTlsSettings = true; + + commonHttpConfig = concatStrings [ + '' + add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive"; + '' + (optionalString (hasAttr "wireguard" this) + (with config.nixfiles.modules.wireguard; '' + geo $internal { + default 0; + 127.0.0.1/32 1; + ${ipv4.subnet} 1; + ${ipv6.subnet} 1; + } + '')) + ]; + + virtualHosts = + { + default = { + default = true; + rejectSSL = true; + locations."/".return = "444"; + }; + } + // (mkIf (cfg.virtualHosts != null) (mapAttrs (_: attr: + mkMerge [ + attr + (mkIf config.nixfiles.modules.acme.enable { + enableACME = true; + forceSSL = true; + }) + ]) + cfg.virtualHosts)); + }; + + fail2ban.jails = { + nginx-http-auth = '' + enabled = true + ''; + nginx-botsearch = '' + enabled = true + ''; + }; + + prometheus.exporters.nginx = { + enable = true; + listenAddress = mkDefault this.wireguard.ipv4.address; + port = mkDefault 9113; + }; + }; + + networking.firewall.allowedTCPPorts = [80 443]; + }; +} diff --git a/modules/nixfiles/nmap.nix b/modules/nixfiles/nmap.nix new file mode 100644 index 0000000..945cd59 --- /dev/null +++ b/modules/nixfiles/nmap.nix @@ -0,0 +1,42 @@ +{ + config, + lib, + pkgs, + inputs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.nmap; +in { + options.nixfiles.modules.nmap.enable = + mkEnableOption "Whether to enable Nmap."; + + config = mkIf cfg.enable { + hm.home = { + file = { + ".nmap/scripts/vulners/vulners.nse".source = "${inputs.nmap-vulners}/vulners.nse"; + ".nmap/scripts/vulscan/vulscan.nse".source = "${inputs.nmap-vulscan}/vulscan.nse"; + }; + packages = with pkgs; [nmap nmap-formatter]; + activation.regenerateNmapScriptDatabase = with pkgs; '' + # declare -a vulscandbs=( + # "cve" + # "exploitdb" + # "openvas" + # "osvdb" + # "scipvuldb" + # "securityfocus" + # "securitytracker" + # "xforce" + # ) + # for i in "''${vulscandbs[@]}"; do + # ${curl}/bin/curl \ + # -o "$HOME/.nmap/scripts/vulscan/$i.csv" \ + # "https://www.computec.ch/projekte/vulscan/download/$i.csv" + # done + + ${nmap}/bin/nmap --script-updatedb + ''; + }; + }; +} diff --git a/modules/nixfiles/node-exporter.nix b/modules/nixfiles/node-exporter.nix new file mode 100644 index 0000000..794c309 --- /dev/null +++ b/modules/nixfiles/node-exporter.nix @@ -0,0 +1,35 @@ +{ + config, + lib, + this, + ... +}: +with lib; let + cfg = config.nixfiles.modules.node-exporter; +in { + options.nixfiles.modules.node-exporter.enable = + mkEnableOption "Whether to enable Prometheus Node Exporter."; + + config = mkIf cfg.enable { + services.prometheus.exporters.node = { + enable = true; + listenAddress = mkDefault this.wireguard.ipv4.address; + port = 9100; + enabledCollectors = [ + "buddyinfo" + "ethtool" + "interrupts" + "ksmd" + "lnstat" + "logind" + "mountstats" + "network_route" + "processes" + "qdisc" + "systemd" + "tcpstat" + "zoneinfo" + ]; + }; + }; +} diff --git a/modules/nixfiles/nsd.nix b/modules/nixfiles/nsd.nix new file mode 100644 index 0000000..f328b5c --- /dev/null +++ b/modules/nixfiles/nsd.nix @@ -0,0 +1,157 @@ +{ + config, + inputs, + lib, + this, + ... +}: +with lib; let + cfg = config.nixfiles.modules.nsd; +in { + options.nixfiles.modules.nsd = { + enable = mkEnableOption "Whether to enable NSD."; + + fqdn = mkOption { + description = "FQDN of this nameserver."; + type = with types; str; + default = "ns.${config.networking.domain}"; + }; + }; + + config = mkIf cfg.enable { + services = { + nsd = { + enable = true; + interfaces = with this; [ipv4.address ipv6.address]; + ipTransparent = true; + ratelimit.enable = true; + + # TODO DNSSEC. + zones = let + dns = inputs.dns-nix.lib; + in + with dns.combinators; let + ips = hostname: + with my.configurations.${hostname}; { + A = [(a ipv4.address)]; + AAAA = [(aaaa ipv6.address)]; + }; + + # TODO Try moving DKIM keys somewhere in "my" or secrets maybe? + mkEmailEntries = { + domain ? my.domain.shire, + dkimKey ? null, + }: { + MX = [(mx.mx 10 "${domain}.")]; + TXT = [(spf.strict ["a" "mx"])]; + DMARC = [ + { + p = "quarantine"; + sp = "quarantine"; + rua = ["mailto:admin+rua@${domain}"]; + ruf = ["mailto:admin+ruf@${domain}"]; + } + ]; + DKIM = optional (dkimKey != null) { + selector = "mail"; + p = dkimKey; + }; + }; + + mkZone = { + domain, + sldIps ? (ips "manwe"), + extra ? {}, + }: { + ${domain}.data = dns.toString domain ({ + TTL = 60 * 60; + + SOA = { + nameServer = "${cfg.fqdn}."; + adminEmail = "admin+dns@${my.domain.shire}"; + serial = 2022081122; + }; + + NS = with my.domain; ["ns1.${shire}" "ns2.${shire}"]; + + CAA = letsEncrypt "admin+caa@${my.domain.shire}"; + } + // sldIps + // extra); + }; + in + mkMerge [ + (mkZone { + domain = my.domain.shire; + extra = + (mkEmailEntries { + dkimKey = "[DKIM]"; + }) + // { + subdomains = rec { + manwe = ips "manwe"; + "*.manwe" = manwe; + varda = ips "varda"; + "*.varda" = varda; + yavanna = ips "yavanna"; + "*.yavanna" = yavanna; + + ns1 = manwe; + # ns2 = varda; + + flood = yavanna; + gotify = manwe; + monitoring = manwe; + radicale = varda; + rss-bridge = varda; + vaultwarden = varda; + }; + }; + }) + (mkZone { + domain = my.domain.azahi; + extra = + (mkEmailEntries { + dkimKey = "[DKIM]"; + }) + // { + subdomains = { + github.CNAME = ["github.com/${my.username}"]; + gitlab.CNAME = ["gitlab.com/${my.username}"]; + }; + }; + }) + (mkZone { + domain = my.domain.gondor; + extra = + (mkEmailEntries { + dkimKey = "[DKIM]"; + }) + // { + subdomains.frodo = ips "manwe"; + }; + }) + (mkZone { + domain = my.domain.rohan; + extra = + (mkEmailEntries { + dkimKey = "[DKIM]"; + }) + // { + subdomains.frodo = ips "manwe"; + }; + }) + ]; + }; + + fail2ban.jails.nsd = '' + enabled = true + ''; + }; + + networking.firewall = rec { + allowedTCPPorts = [53]; + allowedUDPPorts = allowedTCPPorts; + }; + }; +} diff --git a/modules/nixfiles/openssh.nix b/modules/nixfiles/openssh.nix new file mode 100644 index 0000000..2f1559e --- /dev/null +++ b/modules/nixfiles/openssh.nix @@ -0,0 +1,52 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.openssh; +in { + options.nixfiles.modules.openssh = { + client.enable = mkEnableOption "Whether to enable OpenSSH client."; + server.enable = mkEnableOption "Whether to enable OpenSSH server."; + }; + + config = mkMerge [ + (mkIf cfg.client.enable { + hm = { + home.packages = with pkgs; [mosh sshfs]; + + programs.ssh = { + enable = true; + controlMaster = "auto"; + controlPersist = "24H"; + hashKnownHosts = true; + serverAliveCountMax = 30; + serverAliveInterval = 60; + }; + }; + }) + (mkIf cfg.server.enable { + programs.mosh.enable = true; + + services = let + port = 22022; + in { + openssh = { + enable = true; + ports = [port]; + logLevel = "VERBOSE"; + permitRootLogin = "no"; + passwordAuthentication = false; + }; + + fail2ban.jails.sshd = '' + enabled = true + mode = aggressive + port = ${toString port} + ''; + }; + }) + ]; +} diff --git a/modules/nixfiles/password-store.nix b/modules/nixfiles/password-store.nix new file mode 100644 index 0000000..19e2f2a --- /dev/null +++ b/modules/nixfiles/password-store.nix @@ -0,0 +1,33 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.password-store; +in { + options.nixfiles.modules.password-store.enable = + mkEnableOption "Whether to enable pass."; + + config = mkIf cfg.enable { + hm.programs = { + password-store = { + enable = true; + + package = pkgs.pass.withExtensions (p: with p; [pass-otp]); + + settings.PASSWORD_STORE_DIR = "${config.my.home}/.password-store"; + }; + + # A dirty little hack to make completions for "otp" to work. + bash.initExtra = let + completions = "${config.hm.programs.password-store.package}/share/bash-completion/completions"; + in + mkAfter '' + source ${completions}/pass-otp + source ${completions}/pass + ''; + }; + }; +} diff --git a/modules/nixfiles/podman.nix b/modules/nixfiles/podman.nix new file mode 100644 index 0000000..6c8b7e5 --- /dev/null +++ b/modules/nixfiles/podman.nix @@ -0,0 +1,35 @@ +{ + config, + lib, + inputs, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.podman; +in { + options.nixfiles.modules.podman.enable = + mkEnableOption "Whether to enable Podman."; + + config = mkIf cfg.enable { + secrets.containers-auth = { + file = "${inputs.self}/secrets/containers-auth"; + path = "${config.dirs.config}/containers/auth.json"; + owner = my.username; + }; + + virtualisation.podman.enable = true; + + environment.systemPackages = with pkgs; [podman-compose]; + + my.extraGroups = ["podman"]; + + hm.programs.bash = { + shellAliases.p = "${pkgs.podman}/bin/podman"; + + initExtra = mkAfter '' + _complete_alias p __start_podman podman + ''; + }; + }; +} diff --git a/modules/nixfiles/postgresql.nix b/modules/nixfiles/postgresql.nix new file mode 100644 index 0000000..23623af --- /dev/null +++ b/modules/nixfiles/postgresql.nix @@ -0,0 +1,53 @@ +{ + config, + lib, + pkgs, + this, + ... +}: +with lib; let + cfg = config.nixfiles.modules.postgresql; +in { + options.nixfiles.modules.postgresql.enable = + mkEnableOption "Whether to enable PostgeSQL."; + + config = mkIf cfg.enable { + hm = { + home.sessionVariables.PSQLRC = config.hm.xdg.configFile."psqlrc".target; + + xdg.configFile."psqlrc".text = '' + \set QUIET 1 + + \timing + \x auto + \pset null '[NULL]' + \set PROMPT1 '%[%033[1m%]%M %n@%/%R%[%033[0m%]% λ ' + \set PROMPT2 ' … > ' + \set VERBOSITY verbose + \set HISTCONTROL ignoredups + \set HISTFILE /dev/null + + \unset QUIET + ''; + }; + + services = { + postgresql = { + enable = true; + package = pkgs.postgresql_14; + # TODO Test if this is still required. + authentication = '' + local all all trust + host all all 127.0.0.1/32 trust + host all all ::1/128 trust + ''; + }; + + prometheus.exporters.postgres = { + enable = true; + listenAddress = mkDefault this.wireguard.ipv4.address; + port = mkDefault 9187; + }; + }; + }; +} diff --git a/modules/nixfiles/profiles/common.nix b/modules/nixfiles/profiles/common.nix new file mode 100644 index 0000000..dd287dc --- /dev/null +++ b/modules/nixfiles/profiles/common.nix @@ -0,0 +1,103 @@ +{ + config, + lib, + pkgs, + this, + ... +}: +with lib; let + cfg = config.nixfiles.modules.profiles.common; +in { + imports = [ + (mkAliasOptionModule ["colourScheme"] [ + "nixfiles" + "modules" + "profiles" + "common" + "colourScheme" + ]) + ]; + + options.nixfiles.modules.profiles.common = { + enable = mkEnableOption "The most common profiles of all profiles."; + + colourScheme = let + mkColour = default: + mkOption { + type = types.str; + inherit default; + description = "Color in a standard hexademical notation."; + example = "#000000"; + }; + in rec { + black = mkColour "#161719"; + red = mkColour "#cc6666"; + green = mkColour "#b5bd68"; + yellow = mkColour "#f0c674"; + blue = mkColour "#81a2be"; + magenta = mkColour "#b294bb"; + cyan = mkColour "#8abeb7"; + white = mkColour "#c5c8c6"; + + brightBlack = mkColour "#969896"; + brightRed = mkColour "#cc6666"; + brightGreen = mkColour "#b5bd68"; + brightYellow = mkColour "#f0c674"; + brightBlue = mkColour "#81a2be"; + brightMagenta = mkColour "#b294bb"; + brightCyan = mkColour "#8abeb7"; + brightWhite = mkColour "#ffffff"; + + background = black; + foreground = white; + }; + }; + + config = mkIf cfg.enable { + assertions = [ + { + assertion = !(with this; isHeadless && isHeadful); + message = '' + The configuration cannot be both "headful" and "headless" at the same + time. + ''; + } + ]; + + profile = with this; { + headless = isHeadless; + headful = isHeadful; + }; + + nixfiles.modules = { + htop.enable = true; + tmux.enable = true; + vim.enable = true; + }; + + hm.home.language = { + collate = "C"; + messages = "C"; + }; + + programs.less = { + enable = true; + envVariables.LESSHISTFILE = "-"; + }; + + environment.systemPackages = with pkgs; [ + cryptsetup + ddrescue + file + git + gnupg + lshw + lsof + pciutils + psmisc + tree + usbutils + util-linux + ]; + }; +} diff --git a/modules/nixfiles/profiles/default.nix b/modules/nixfiles/profiles/default.nix new file mode 100644 index 0000000..3df88f8 --- /dev/null +++ b/modules/nixfiles/profiles/default.nix @@ -0,0 +1,5 @@ +{lib, ...}: { + imports = [./common.nix ./dev ./headful.nix ./headless.nix]; + + config.nixfiles.modules.profiles.common.enable = lib.mkDefault true; +} diff --git a/modules/nixfiles/profiles/dev/common.nix b/modules/nixfiles/profiles/dev/common.nix new file mode 100644 index 0000000..d6c44ea --- /dev/null +++ b/modules/nixfiles/profiles/dev/common.nix @@ -0,0 +1,290 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.profiles.dev.common; +in { + options.nixfiles.modules.profiles.dev.common.enable = mkEnableOption ""; + + config = mkIf cfg.enable { + nixfiles.modules = { + bat.enable = true; + curl.enable = true; + direnv.enable = true; + git.enable = true; + gnupg.enable = true; + nmap.enable = true; + wget.enable = true; + }; + + hm.home = { + file = { + ".editorconfig".text = '' + root = true + + [*] + charset = utf-8 + end_of_line = lf + indent_size = 4 + indent_style = space + insert_final_newline = true + max_line_length = 80 + trim_trailing_whitespace = true + + [*.nix] + indent_size = 2 + indent_style = space + + [*.{S,s,asm}] + indent_size = 4 + indent_style = tab + + [*.{C,H,c,c++,cc,cpp,cxx,h,h++,hh,hpp,hxx}] + indent_size = 4 + indent_style = tab + + [*.{bash,sh}] + indent_size = 4 + indent_style = tab + + [*.{cl,clj,el,l,lisp,lsp,rkt,scm,ss}] + indent_size = unset + indent_style = unset + + [*.go] + indent_size = 4 + indent_style = tab + + [*.{py,pyx}] + indent_size = 4 + indent_style = space + + [*.{hs,lhs}] + indent_size = 2 + indent_style = space + + [*.{html,xhtml,xml}] + indent_size = 4 + indent_style = tab + + [*.json] + indent_size = 2 + indent_style = space + + [*.{yaml,yml}] + indent_size = 2 + indent_style = space + + [*.{toml,tml}] + indent_size = 4 + indent_style = space + + [*.{py,pyx}] + indent_size = 4 + indent_style = space + max_line_length = 72 + + [*.zig] + indent_size = 4 + indent_style = tab + + [configure.ac] + indent_size = 4 + indent_style = tab + + [{Makefile*,*.mk}] + indent_size = 4 + indent_style = tab + + [{CMakeLists.txt,*.cmake}] + indent_size = 8 + indent_style = tab + + [*.tex] + indent_size = 4 + indent_style = tab + + [*.{md,adoc,rtf,txt}] + indent_size = 4 + indent_style = tab + ''; + + ".ghc/ghci.conf".source = ./ghci.conf; + + ".stack/config.yaml".text = generators.toYAML {} { + templates.params = rec { + author-name = my.fullname; + author-email = my.email; + copyright = "Copyright (c) ${author-name} <${author-email}>"; + github-username = my.username; + }; + }; + + ".clang-format".text = generators.toYAML {} { + AccessModifierOffset = -4; + AlignAfterOpenBracket = "Align"; + AlignConsecutiveAssignments = "Consecutive"; + AlignConsecutiveBitFields = "Consecutive"; + AlignConsecutiveDeclarations = "Consecutive"; + AlignConsecutiveMacros = "Consecutive"; + AlignEscapedNewlines = "Right"; + AlignOperands = "Align"; + AlignTrailingComments = false; + AllowAllArgumentsOnNextLine = false; + AllowAllConstructorInitializersOnNextLine = true; + AllowAllParametersOfDeclarationOnNextLine = true; + AllowShortBlocksOnASingleLine = "Never"; + AllowShortCaseLabelsOnASingleLine = false; + AllowShortEnumsOnASingleLine = false; + AllowShortFunctionsOnASingleLine = "None"; + AllowShortIfStatementsOnASingleLine = "Never"; + AllowShortLambdasOnASingleLine = "Inline"; + AllowShortLoopsOnASingleLine = false; + AlwaysBreakAfterDefinitionReturnType = "All"; + AlwaysBreakAfterReturnType = "AllDefinitions"; + AlwaysBreakBeforeMultilineStrings = false; + AlwaysBreakTemplateDeclarations = "Yes"; + BinPackArguments = false; + BinPackParameters = false; + BreakBeforeBinaryOperators = "None"; + BreakBeforeBraces = "Allman"; + BreakBeforeTernaryOperators = true; + BreakConstructorInitializers = "BeforeComma"; + BreakInheritanceList = "BeforeComma"; + BreakStringLiterals = true; + ColumnLimit = 80; + CommentPragmas = "^ IWYU pragma:"; + CompactNamespaces = false; + ConstructorInitializerAllOnOneLineOrOnePerLine = false; + ConstructorInitializerIndentWidth = 4; + ContinuationIndentWidth = 4; + Cpp11BracedListStyle = true; + DeriveLineEnding = false; + DerivePointerAlignment = false; + DisableFormat = false; + ExperimentalAutoDetectBinPacking = false; + FixNamespaceComments = true; + IncludeBlocks = "Regroup"; + IndentCaseBlocks = false; + IndentCaseLabels = false; + IndentExternBlock = "NoIndent"; + IndentGotoLabels = false; + IndentPPDirectives = "None"; + IndentWidth = 4; + IndentWrappedFunctionNames = false; + KeepEmptyLinesAtTheStartOfBlocks = false; + Language = "Cpp"; + MaxEmptyLinesToKeep = 1; + NamespaceIndentation = "None"; + PointerAlignment = "Left"; + ReflowComments = false; + SortIncludes = "CaseSensitive"; + SortUsingDeclarations = true; + SpaceAfterCStyleCast = false; + SpaceAfterLogicalNot = false; + SpaceAfterTemplateKeyword = true; + SpaceBeforeAssignmentOperators = true; + SpaceBeforeCpp11BracedList = false; + SpaceBeforeCtorInitializerColon = true; + SpaceBeforeInheritanceColon = true; + SpaceBeforeParens = "ControlStatements"; + SpaceBeforeRangeBasedForLoopColon = true; + SpaceInEmptyParentheses = false; + SpacesBeforeTrailingComments = 1; + SpacesInAngles = false; + SpacesInCStyleCastParentheses = false; + SpacesInContainerLiterals = false; + SpacesInParentheses = false; + SpacesInSquareBrackets = false; + Standard = "Latest"; + TabWidth = 4; + UseTab = "Always"; + }; + + ".gdbinit".text = '' + set confirm off + set verbose off + set editing off + + set history expansion on + + set height 0 + set width 0 + + handle SIGALRM nostop print nopass + handle SIGBUS stop print nopass + handle SIGPIPE nostop print nopass + handle SIGSEGV stop print nopass + + set print address on + set print elements 0 + set print object on + set print pretty on + set print repeats 0 + set print static-members on + set print vtbl on + + set output-radix 10 + + set demangle-style gnu-v3 + + set disassembly-flavor intel + + alias iv=info variables + + alias da=disassemble + + define fs + finish + step + end + + define btc + backtrace + continue + end + ''; + }; + + sessionVariables = { + CARGO_HOME = "${config.dirs.data}/cargo"; + GOPATH = "${config.dirs.data}/go"; + PYTHONSTARTUP = ./pystartup.py; + }; + + # TODO Probably should scrap most of these in favor of per-project + # shell.nix or flake.nix. + packages = with pkgs; [ + alejandra + bash-language-server + cloc + dockerfile-language-server + editorconfig + fd + fzf + htmlq + jc + jq + json-language-server + logcli + nix-language-server + nixfmt + nixpkgs-fmt + ripgrep + ripgrep-all + shellcheck + shfmt + treefmt + wrk + yaml-language-server + yamllint + yq + ]; + }; + + my.extraGroups = ["kvm"]; + }; +} diff --git a/modules/nixfiles/profiles/dev/containers/default.nix b/modules/nixfiles/profiles/dev/containers/default.nix new file mode 100644 index 0000000..d0e7ed7 --- /dev/null +++ b/modules/nixfiles/profiles/dev/containers/default.nix @@ -0,0 +1,73 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.profiles.dev.containers; +in { + options.nixfiles.modules.profiles.dev.containers.enable = + mkEnableOption "Wether to enable tools for working with Kubernetes."; + + config = mkIf cfg.enable { + nixfiles.modules = { + profiles.dev.common.enable = true; + podman.enable = true; + }; + + hm = { + home = { + sessionVariables = { + MINIKUBE_IN_STYLE = "false"; + WERF_DEV = "true"; + WERF_INSECURE_REGISTRY = "true"; + WERF_LOG_DEBUG = "true"; + WERF_LOG_PRETTY = "false"; + WERF_LOG_VERBOSE = "true"; + WERF_SYNCHRONIZATION = ":local"; + }; + + file.".minikube/config/config.json".text = generators.toJSON {} { + config.Rootless = true; + driver = "podman"; + container-runtime = "cri-o"; + }; + + packages = with pkgs; [ + buildah + chart-testing + cmctl + helm + kubectl + kubectx + kubescape + kubespy + minikube + skaffold + skopeo + stern + telepresence + werf + ]; + }; + + programs.bash = { + shellAliases = with pkgs; { + b = "${buildah}/bin/buildah"; + h = "${helm}/bin/helm"; + k = "${kubectl}/bin/kubectl"; + kns = "${kubectx}/bin/kubens"; + ktx = "${kubectx}/bin/kubectx"; + }; + initExtra = mkAfter '' + _complete_alias b _buildah buildah + _complete_alias h __start_helm helm + _complete_alias k __start_kubectl kubectl + _complete_alias kns _kube_namespaces kubens + _complete_alias ktx _kube_contexts kubectx + ''; + }; + }; + }; +} diff --git a/modules/nixfiles/profiles/dev/default.nix b/modules/nixfiles/profiles/dev/default.nix new file mode 100644 index 0000000..1e0bd01 --- /dev/null +++ b/modules/nixfiles/profiles/dev/default.nix @@ -0,0 +1 @@ +_: {imports = [./common.nix ./containers ./sql];} diff --git a/modules/nixfiles/profiles/dev/ghci.conf b/modules/nixfiles/profiles/dev/ghci.conf new file mode 100644 index 0000000..d672167 --- /dev/null +++ b/modules/nixfiles/profiles/dev/ghci.conf @@ -0,0 +1,35 @@ +:set -XBinaryLiterals +:set -XFlexibleContexts +:set -XNoMonomorphismRestriction + +:seti -XConstraintKinds +:seti -XDataKinds +:seti -XDeriveFunctor +:seti -XFlexibleInstances +:seti -XFunctionalDependencies +:seti -XGADTs +:seti -XLambdaCase +:seti -XMagicHash +:seti -XMultiParamTypeClasses +:seti -XMultiWayIf +:seti -XOverloadedLabels +:seti -XPackageImports +:seti -XPolyKinds +:seti -XRankNTypes +:seti -XScopedTypeVariables +:seti -XStandaloneDeriving +:seti -XTupleSections +:seti -XTypeFamilies +:seti -XTypeOperators +:seti -XUndecidableInstances + +:set +c +:set +m +:set +r +:set +s +:set +t + +:set prompt "\ESC[1;34m>\ESC[m\STX " +:set prompt-cont "\ESC[1;94m|\ESC[m\STX " + +:def hoogle \x -> pure (":!hoogle --color --count=10 \"" ++ x ++ "\"") diff --git a/modules/nixfiles/profiles/dev/pystartup.py b/modules/nixfiles/profiles/dev/pystartup.py new file mode 100644 index 0000000..1a78b55 --- /dev/null +++ b/modules/nixfiles/profiles/dev/pystartup.py @@ -0,0 +1,127 @@ +import atexit +import os +import readline +import rlcompleter +import sys +from code import InteractiveConsole +from tempfile import mkstemp + +readline.parse_and_bind("tab: complete") + + +class TermColors(dict): + color_templates = ( + ("Normal", "0"), + ("Black", "0;30"), + ("Red", "0;31"), + ("Green", "0;32"), + ("Brown", "0;33"), + ("Blue", "0;34"), + ("Purple", "0;35"), + ("Cyan", "0;36"), + ("LightGray", "0;37"), + ("DarkGray", "1;30"), + ("LightRed", "1;31"), + ("LightGreen", "1;32"), + ("Yellow", "1;33"), + ("LightBlue", "1;34"), + ("LightPurple", "1;35"), + ("LightCyan", "1;36"), + ("White", "1;37"), + ) + color_base = "\001\033[%sm\002" + + def __init__(self): + self.update( + dict([(k, self.color_base % v) for k, v in self.color_templates]) + ) + + +class Completer(object): + def save_history(self): + import readline + + readline.write_history_file(self.python_histfile) + + def __init__(self): + self.python_dir = os.path.expanduser( + "%s/python" % os.environ["XDG_DATA_HOME"] + ) + + if not os.path.exists(self.python_dir): + os.mkdir(self.python_dir) + + self.python_histfile = os.path.expanduser( + "%s/history" % self.python_dir + ) + + if os.path.exists(self.python_histfile): + readline.read_history_file(self.python_histfile) + + readline.set_history_length(1000) + atexit.register(self.save_history) + + +def DisplayHook(value): + if value is not None: + try: + import __builtin__ + + __builtin__._ = value + except ImportError: + __builtins__._ = value + + import pprint + + pprint.pprint(value) + del pprint + + +class EditableBufferInteractiveConsole(InteractiveConsole): + def __init__(self, *args, **kwargs): + self.last_buffer = [] + InteractiveConsole.__init__(self, *args, **kwargs) + + def runsource(self, source, *args): + self.last_buffer = [source.encode("utf-8")] + return InteractiveConsole.runsource(self, source, *args) + + def raw_input(self, *args): + line = InteractiveConsole.raw_input(self, *args) + + if line == EDIT_CMD: + tmp_fd, tmp_file = mkstemp(".py") + + os.write(tmp_fd, b"\n".join(self.last_buffer)) + os.close(tmp_fd) + + os.system("%s %s" % (EDITOR, tmp_file)) + + line = open(tmp_file).read() + + os.unlink(tmp_file) + tmp_file = "" + + lines = line.split("\n") + + for i in range(len(lines) - 1): + self.push(lines[i]) + + line = lines[-1] + return line + + +TC = TermColors() +ps1 = "%sλ%s %s>%s " +sys.ps1 = ps1 % (TC["Blue"], TC["Normal"], TC["White"], TC["Normal"]) +ps2 = " %s…%s %s>%s " +sys.ps2 = ps2 % (TC["Blue"], TC["Normal"], TC["White"], TC["Normal"]) +sys.displayhook = DisplayHook + +C = Completer() +EDITOR = os.environ.get("EDITOR", "vim") +EDIT_CMD = ":e" +C = EditableBufferInteractiveConsole(locals=locals()) +C.interact(banner="") + +sys.exit() diff --git a/modules/nixfiles/profiles/dev/sql/default.nix b/modules/nixfiles/profiles/dev/sql/default.nix new file mode 100644 index 0000000..deb3738 --- /dev/null +++ b/modules/nixfiles/profiles/dev/sql/default.nix @@ -0,0 +1,94 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.profiles.dev.sql; +in { + options.nixfiles.modules.profiles.dev.sql.enable = + mkEnableOption "Whether to enable SQL database management tools."; + + config = mkIf cfg.enable { + hm = { + home.packages = with pkgs; [pgcli litecli]; + + xdg = let + mainSection = { + destructive_warning = "True"; + enable_pager = "True"; + keyword_casing = "auto"; + less_chatty = "True"; + log_file = "/dev/null"; + log_level = "CRITICAL"; + multi_line = "False"; + syntax_style = "default"; + table_format = "fancy_grid"; + }; + + colorsSection = with config.nixfiles.modules.profiles.common.colourScheme; { + "arg-toolbar" = "noinherit bold"; + "arg-toolbar.text" = "nobold"; + "bottom-toolbar" = "bg:${black} ${white}"; + "bottom-toolbar.off" = "bg:${black} ${brightBlack}"; + "bottom-toolbar.on" = "bg:${black} ${brightWhite}"; + "bottom-toolbar.transaction.failed" = "bg:${black} ${red} bold"; + "bottom-toolbar.transaction.valid" = "bg:${black} ${green} bold"; + "completion-menu.completion" = "bg:${black} ${white}"; + "completion-menu.completion.current" = "bg:${white} ${black}"; + "completion-menu.meta.completion" = "bg:${black} ${yellow}"; + "completion-menu.meta.completion.current" = "bg:${yellow} ${black}"; + "completion-menu.multi-column-meta" = "bg:${yellow} ${black}"; + "scrollbar" = "bg:${black}"; + "scrollbar.arrow" = "bg:${black}"; + "search" = "bg:${magenta} ${brightWhite}"; + "search-toolbar" = "noinherit bold"; + "search-toolbar.text" = "nobold"; + "search.current" = "bg:${green} ${brightWhite}"; + "selected" = "bg:${blue} ${brightWhite}"; + "system-toolbar" = "noinherit bold"; + }; + + mkCliConfig = { + name, + custom, + }: { + "${name}/config" = { + text = generators.toINI {} { + main = mainSection // custom; + colors = mapAttrs (_: v: "'${v}'") colorsSection; + }; + }; + }; + in { + configFile = mkMerge (map mkCliConfig [ + { + name = "pgcli"; + custom = { + auto_expand = "True"; + casing_file = "/dev/null"; + expand = "True"; + history_file = "/dev/null"; + keyring = "False"; + multi_line_mode = "psql"; + on_error = "STOP"; + prompt = "'\\u@\\h:\\d> '"; + vi = "True"; + }; + } + { + name = "litecli"; + custom = { + audit_log = "/dev/null"; + key_bindings = "vi"; + prompt = "'\\d> '"; + prompt_continuation = "'-> '"; + auto_vertical_output = "True"; + }; + } + ]); + }; + }; + }; +} diff --git a/modules/nixfiles/profiles/headful.nix b/modules/nixfiles/profiles/headful.nix new file mode 100644 index 0000000..fa2f0d7 --- /dev/null +++ b/modules/nixfiles/profiles/headful.nix @@ -0,0 +1,69 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.profiles.headful; +in { + imports = [ + (mkAliasOptionModule ["profile" "headful"] [ + "nixfiles" + "modules" + "profiles" + "headful" + "enable" + ]) + ]; + + options.nixfiles.modules.profiles.headful.enable = + mkEnableOption "Wether to enable headful profile."; + + config = mkIf cfg.enable { + nixfiles.modules = { + alacritty.enable = true; + aria2.enable = true; + aspell.enable = true; + emacs.enable = true; + firefox.enable = true; + mpv.enable = true; + openssh.client.enable = true; + password-store.enable = true; + sound.enable = true; + x11.enable = true; + + dwm.enable = mkDefault false; + kde.enable = mkDefault true; + xmonad.enable = mkDefault false; + }; + + hm.home.packages = with pkgs; [convmv dos2unix]; + + hardware.opengl = { + enable = true; + driSupport = true; + }; + + programs = { + iftop.enable = true; + mtr.enable = true; + traceroute.enable = true; + + bash.shellAliases.open = "${pkgs.xdg-utils}/bin/xdg-open"; + }; + + services.upower.enable = true; + + environment.systemPackages = with pkgs; [ + arping + ethtool + inetutils + nethogs + socat + tcpdump + ]; + + my.extraGroups = ["audio" "video" "input"]; + }; +} diff --git a/modules/nixfiles/profiles/headless.nix b/modules/nixfiles/profiles/headless.nix new file mode 100644 index 0000000..9737344 --- /dev/null +++ b/modules/nixfiles/profiles/headless.nix @@ -0,0 +1,67 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.profiles.headless; +in { + imports = [ + (mkAliasOptionModule ["profile" "headless"] [ + "nixfiles" + "modules" + "profiles" + "headless" + "enable" + ]) + ]; + + options.nixfiles.modules.profiles.headless.enable = + mkEnableOption "Whether to enable headless profile."; + + config = mkIf cfg.enable { + nixfiles.modules = { + openssh.server.enable = true; + endlessh-go.enable = true; + + fail2ban.enable = true; + + node-exporter.enable = true; + promtail.enable = true; + }; + + hm.home.file = { + ".hushlogin".text = ""; + ".bash_history".source = + config.hm.lib.file.mkOutOfStoreSymlink "/dev/null"; + }; + + boot.kernelPackages = pkgs.linuxPackages_5_15_hardened; + + nix = { + gc = { + automatic = true; + dates = "weekly"; + options = "--delete-older-than 30d"; + }; + + optimise = { + automatic = true; + dates = ["weekly"]; + }; + }; + + i18n = { + # TODO Convert everything including PostgreSQL databases to the "en_US" + # locale or probably even the "C" one. + defaultLocale = mkForce "C"; + supportedLocales = mkForce ["en_US.UTF-8/UTF-8" "en_GB.UTF-8/UTF-8"]; + }; + security.polkit.enable = false; + services.udisks2.enable = false; + xdg.sounds.enable = false; + + environment.systemPackages = with pkgs; [alacritty.terminfo]; + }; +} diff --git a/modules/nixfiles/prometheus.nix b/modules/nixfiles/prometheus.nix new file mode 100644 index 0000000..b67dd2e --- /dev/null +++ b/modules/nixfiles/prometheus.nix @@ -0,0 +1,60 @@ +{ + config, + lib, + ... +}: +with lib; let + cfg = config.nixfiles.modules.prometheus; +in { + options.nixfiles.modules.prometheus = { + enable = mkEnableOption "Whether to enable Prometheus."; + + port = mkOption { + description = "Port."; + type = with types; port; + default = 30111; + }; + + domain = mkOption { + description = "Domain name sans protocol scheme."; + type = with types; str; + default = config.nixfiles.modules.monitoring.domain; + }; + + path = mkOption { + description = "Path."; + type = with types; str; + default = "/prometheus"; + }; + }; + + config = mkIf cfg.enable { + nixfiles.modules.nginx = with cfg; { + enable = true; + virtualHosts.${domain}.locations.${path} = { + proxyPass = with cfg; "http://127.0.0.1:${toString port}"; + extraConfig = '' + if ($internal != 1) { + return 403; + } + ''; + }; + }; + + services.prometheus = with cfg; { + enable = true; + + listenAddress = "127.0.0.1"; + inherit port; + + extraFlags = [ + "--web.external-url=http${ + optionalString config.nixfiles.modules.acme.enable "s" + }://${domain}${path}" + "--storage.tsdb.retention.size=50GB" + "--storage.tsdb.retention.time=1y" + "--storage.tsdb.wal-compression" + ]; + }; + }; +} diff --git a/modules/nixfiles/promtail.nix b/modules/nixfiles/promtail.nix new file mode 100644 index 0000000..ba4e635 --- /dev/null +++ b/modules/nixfiles/promtail.nix @@ -0,0 +1,53 @@ +{ + config, + lib, + this, + ... +}: +with lib; let + cfg = config.nixfiles.modules.promtail; +in { + options.nixfiles.modules.promtail = { + enable = mkEnableOption "Whether to enable Promtail."; + + loki = { + url = mkOption { + description = "Address of a listening Loki service."; + type = with types; str; + default = with config.nixfiles.modules.loki; "https://${domain}${path}"; + }; + }; + }; + + config = mkIf cfg.enable { + services.promtail = { + enable = true; + + configuration = { + server = rec { + http_listen_address = this.wireguard.ipv4.address; + http_listen_port = 30181; + + grpc_listen_address = this.wireguard.ipv4.address; + grpc_listen_port = http_listen_port + 1; + + log_level = "warn"; + }; + + clients = [{url = "${cfg.loki.url}/loki/api/v1/push";}]; + + positions.filename = "/tmp/positions.yaml"; + + scrape_configs = [ + { + job_name = "journal"; + journal = { + max_age = "24h"; + labels.job = "systemd-journal"; + }; + } + ]; + }; + }; + }; +} diff --git a/modules/nixfiles/psd.nix b/modules/nixfiles/psd.nix new file mode 100644 index 0000000..290c067 --- /dev/null +++ b/modules/nixfiles/psd.nix @@ -0,0 +1,60 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.psd; +in { + options.nixfiles.modules.psd.enable = + mkEnableOption "Whether to enable Profile Sync Daemon."; + + config = mkIf cfg.enable { + hm.home = { + file."${config.hm.xdg.configHome}/psd/psd.conf".text = '' + USE_OVERLAYFS="yes" + ''; + + packages = with pkgs; [profile-sync-daemon]; + }; + + systemd.user = { + services = { + psd = { + unitConfig = { + Description = "Profile-sync-daemon"; + Wants = ["psd-resync.service"]; + RequiresMountsFor = "/home/"; + After = ["local-fs.target"]; + }; + serviceConfig = { + RemainAfterExit = true; + ExecStart = "${pkgs.profile-sync-daemon}/bin/profile-sync-daemon startup"; + ExecStop = "${pkgs.profile-sync-daemon}/bin/profile-sync-daemon unsync"; + }; + wantedBy = ["graphical.target"]; + }; + + psd-resync = { + unitConfig = { + Description = "Profile-sync-daemon resync"; + After = ["psd.service"]; + Wants = ["psd-resync.timer"]; + BindsTo = ["psd.service"]; + }; + serviceConfig.ExecStart = "${pkgs.profile-sync-daemon}/bin/profile-sync-daemon resync"; + wantedBy = ["graphical.target"]; + }; + }; + + timers.psd-resync = { + unitConfig = { + Description = "Profile-sync-daemon resync timer"; + BindsTo = ["psd.service"]; + }; + timerConfig.OnUnitActiveSec = "1h"; + }; + }; + }; +} diff --git a/modules/nixfiles/qutebrowser.nix b/modules/nixfiles/qutebrowser.nix new file mode 100644 index 0000000..5af7e1f --- /dev/null +++ b/modules/nixfiles/qutebrowser.nix @@ -0,0 +1,547 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.qutebrowser; +in { + options.nixfiles.modules.qutebrowser.enable = + mkEnableOption "Whether to enable qutebrowser."; + + config = mkIf cfg.enable { + hm = { + # home.sessionVariables.BROWSER = mkOverride 400 "qutebrowser"; + + programs.qutebrowser = with config.nixfiles.modules; { + enable = true; + + package = pkgs.qutebrowser.override { + withMediaPlayback = false; + withPdfReader = false; + }; + + keyBindings.normal = mkIf mpv.enable { + "z" = let + mpv = "${config.hm.programs.mpv.package}/bin/mpv"; + in "hint links spawn --detach ${mpv} {hint-url}"; + }; + + searchEngines = rec { + aliexpress = "https://www.aliexpress.com/wholesale?SearchText={}"; + ansible = "https://galaxy.ansible.com/search?keywords={}"; + arch = "https://wiki.archlinux.org/?search={}"; + crates = "https://crates.io/search?q={}"; + crawl = "http://crawl.chaosforge.org/index.php?search={}"; + discogs = "https://www.discogs.com/search/?q={}"; + dockerdocs = "https://docs.docker.com/search/?q={}"; + dockerhub = "https://hub.docker.com/search?q={}"; + doublegis = "https://2gis.ru/search/{}"; + duckduckgo = "https://duckduckgo.com/?q={}'"; + dwarffortress = "https://dwarffortresswiki.org/index.php?search={}"; + ebay = "https://www.ebay.com/sch/i.html?_nkw={}"; + ecosia = "https://www.ecosia.org/search?q={}"; + factorio = "https://wiki.factorio.com/index.php?search={}"; + genius = "https://genius.com/search?q={}"; + github = "https://github.com/search?q={}"; + godocs = "https://godocs.io/?q={}"; + gogdb = "https://www.gogdb.org/products?search={}"; + google = "https://www.google.com/search?q={}"; + google-images = "https://www.google.com/search?q={}&tbm=isch"; + gopkgs = "https://pkg.go.dev/search?q={}"; + habr = "https://habr.com/ru/search/?q={}"; + hackage = "https://hackage.haskell.org/packages/search?terms={}"; + hackernews = "https://hn.algolia.com/?q={}"; + headhunter = "https://hh.ru/search/vacancy?st=searchVacancy&text={}"; + hoogle = "https://hoogle.haskell.org/?hoogle={}"; + jisho = "https://jisho.org/search/{}"; + kotobank = "https://kotobank.jp/gs/?q={}"; + kubernetes = "https://kubernetes.io/search/?q={}"; + lastfm = "https://www.last.fm/search?q={}"; + lobsters = "https://lobste.rs/search?q=test{}"; + mdn = "https://developer.mozilla.org/en-US/search?q={}"; + melpa = "https://melpa.org/#/?q={}"; + moddb = "https://www.moddb.com/search?q={}"; + musicbrainz = "https://musicbrainz.org/search?query={}"; + nix-issues = "https://github.com/NixOS/nix/issues?q={}"; + nix-prs = "https://github.com/NixOS/nix/pulls?q={}"; + nixos-flakes = "https://search.nixos.org/flakes?query={}"; + nixos-options = "https://search.nixos.org/options?query={}"; + nixos-packages = "https://search.nixos.org/packages?query={}"; + nixos-wiki = "https://nixos.wiki/index.php?search={}"; + nixpkgs-issues = "https://github.com/NixOS/nixpkgs/issues?q={}"; + nixpkgs-prs = "https://github.com/NixOS/nixpkgs/pulls?q={}"; + openstreetmap = "https://www.openstreetmap.org/search?query={}"; + ozon = "https://www.ozon.ru/search/?text={}"; + protondb = "https://www.protondb.com/search?q={}"; + pypi = "https://pypi.org/search/?q={}"; + pythondocs = "https://docs.python.org/3/search.html?q={}"; + rateyourmusic = "https://rateyourmusic.com/search?searchterm={}"; + riichi = "https://riichi.wiki/index.php?search={}"; + rustdoc = "https://doc.rust-lang.org/std/?search={}"; + searx = "https://searx.tiekoetter.com/search?q={}"; + slashdot = "https://slashdot.org/index2.pl?fhfilter={}"; + sourcehut = "https://sr.ht/projects?search={}"; + steam = "https://store.steampowered.com/search/?term={}"; + steamdb = "https://steamdb.info/search/?a=app&q={}"; + ubuntu = "https://wiki.ubuntu.com/Home?action=fullsearch&value={}"; + wikipedia-en = "https://en.wikipedia.org/w/index.php?search={}"; + wikipedia-ru = "https://ru.wikipedia.org/w/index.php?search={}"; + wikipedia-ja = "https://ja.wikipedia.org/w/index.php?search={}"; + wolphramalpha = "https://www.wolframalpha.com/input/?i={}"; + yahoo = "https://yahoo.com/search/?text={}"; + yahoo-images = "https://yahoo.com/images/search?text={}"; + yahoo-market = "https://market.yahoo.com/search?text={}"; + youtube = "https://yewtu.be/search?q={}"; + + aw = arch; + d = duckduckgo; + do = dockerhub; + docker = dockerhub; + dod = dockerdocs; + g = google; + gh = github; + h = hoogle; + k = kubernetes; + mb = musicbrainz; + n = nixos-options; + nw = nixos-wiki; + py = pypi; + pyd = pythondocs; + rym = rateyourmusic; + s = searx; + sh = sourcehut; + sr = sourcehut; + w = wikipedia-en; + wen = wikipedia-en; + wja = wikipedia-ja; + wru = wikipedia-ru; + y = yahoo; + yt = youtube; + }; + + settings = { + changelog_after_upgrade = "never"; + + content = { + autoplay = false; + cookies.accept = "all"; + default_encoding = "utf-8"; + desktop_capture = "ask"; + dns_prefetch = false; + geolocation = false; + headers.do_not_track = true; + javascript.enabled = true; + prefers_reduced_motion = true; + webgl = true; + + blocking = { + enabled = true; + method = "adblock"; + adblock.lists = [ + "https://easylist.to/easylist/easylist.txt" + "https://easylist.to/easylist/easyprivacy.txt" + "https://easylist.to/easylist/fanboy-social.txt" + "https://secure.fanboy.co.nz/fanboy-annoyance.txt" + "https://secure.fanboy.co.nz/fanboy-cookiemonster.txt" + ]; + }; + }; + + completion = { + height = "50%"; + show = "auto"; + shrink = true; + timestamp_format = "%y-%m-%d"; + min_chars = 3; + open_categories = ["bookmarks" "quickmarks" "history"]; + + scrollbar = { + width = 0; + padding = 0; + }; + }; + + downloads = { + location = { + directory = config.userDirs.download; + prompt = true; + }; + remove_finished = 0; + }; + + editor.command = [ + ( + if alacritty.enable + then "${pkgs.alacritty}/bin/alacritty" + else "${pkgs.xterm}/bin/xterm" + ) + "-e" + "${config.programs.vim.package}/bin/vim" + "-f" + "{}" + ]; + + hints = { + auto_follow = "unique-match"; + auto_follow_timeout = 0; + border = "0px"; + min_chars = 1; + scatter = false; + uppercase = false; + }; + + hints.radius = 0; + keyhint.radius = 0; + prompt.radius = 0; + + scrolling = { + bar = "never"; + smooth = false; + }; + + spellcheck.languages = ["en-GB" "en-US" "ru-RU"]; + + statusbar.position = "bottom"; + + tabs = { + position = "top"; + + title = { + alignment = "left"; + format = "{audio}{index} : {current_title}"; + format_pinned = "{audio}{index}"; + }; + + min_width = -1; + max_width = -1; + + indicator.width = 0; + + pinned = { + shrink = true; + frozen = false; + }; + + close_mouse_button = "middle"; + mousewheel_switching = false; + + background = true; + select_on_remove = "next"; + new_position = { + related = "next"; + unrelated = "last"; + }; + + favicons = { + show = "pinned"; + scale = 0.75; + }; + }; + + url = rec { + default_page = "about:blank"; + start_pages = [default_page]; + }; + + window = { + hide_decoration = false; # TODO Test in a WM. + title_format = "{perc}{current_title}{title_sep}qutebrowser"; + }; + + colors = with config.colourScheme; { + completion = rec { + fg = white; + match.fg = red; + odd.bg = black; + even.bg = odd.bg; + category = { + fg = white; + bg = black; + border = { + top = black; + bottom = black; + }; + }; + item.selected = { + fg = black; + bg = white; + border = { + top = white; + bottom = white; + }; + }; + scrollbar = { + fg = white; + bg = black; + }; + }; + contextmenu = { + menu = { + fg = white; + bg = black; + }; + selected = { + fg = black; + bg = white; + }; + disabled = { + fg = brightBlack; + bg = black; + }; + }; + downloads = { + bar.bg = black; + start = { + fg = green; + bg = black; + }; + stop = { + fg = yellow; + bg = black; + }; + error = { + fg = red; + bg = black; + }; + system = { + fg = "none"; + bg = "none"; + }; + }; + hints = { + fg = white; + match.fg = red; + bg = black; + }; + keyhint = { + fg = white; + suffix.fg = red; + bg = black; + }; + messages = { + error = rec { + bg = black; + fg = red; + border = bg; + }; + info = rec { + fg = blue; + bg = black; + border = bg; + }; + warning = rec { + fg = yellow; + bg = black; + border = bg; + }; + }; + prompts = rec { + fg = white; + bg = black; + selected = { + fg = black; + bg = white; + }; + border = bg; + }; + statusbar = { + normal = { + bg = black; + fg = white; + }; + command = { + bg = black; + fg = white; + }; + insert = { + bg = green; + fg = black; + }; + passthrough = { + bg = blue; + fg = black; + }; + private = { + bg = magenta; + fg = black; + }; + url = { + fg = blue; + hover.fg = brightBlue; + success = { + http.fg = brightGreen; + https.fg = brightGreen; + }; + warn.fg = brightYellow; + error.fg = brightRed; + }; + }; + tabs = rec { + bar.bg = black; + even = { + bg = black; + fg = white; + }; + odd = with even; {inherit bg fg;}; + selected = rec { + even = { + bg = white; + fg = black; + }; + odd = with even; {inherit bg fg;}; + }; + pinned = rec { + even = { + bg = brightBlack; + fg = brightWhite; + }; + odd = with even; {inherit bg fg;}; + }; + indicator = { + start = green; + stop = yellow; + error = red; + system = "none"; + }; + }; + webpage = { + bg = "white"; + darkmode = { + enabled = false; + algorithm = "lightness-cielab"; + contrast = 0.0; + grayscale = { + all = false; + images = 0.0; + }; + policy = { + images = "smart"; + page = "smart"; + }; + threshold = { + background = 0; + text = 256; + }; + }; + preferred_color_scheme = "auto"; + }; + }; + + fonts = + (with config.fontScheme.monospaceFont; { + default_family = family; + default_size = (toString size) + "pt"; + }) + // { + web = with config.fontScheme; { + family = rec { + standard = sans_serif; + fixed = monospaceFont.family; + serif = serifFont.family; + sans_serif = sansSerifFont.family; + cursive = null; + fantasy = null; + }; + size = rec { + default = sansSerifFont.size; + default_fixed = monospaceFont.size; + minimum = 0; + minimum_logical = default / 2; + }; + }; + } + // (listToAttrs + (map (name: nameValuePair name "default_size default_family") [ + "completion.category" + "completion.entry" + "contextmenu" + "debug_console" + "downloads" + "hints" + "keyhint" + "messages.error" + "messages.info" + "messages.warning" + "prompts" + "statusbar" + ])); + + qt = mkIf kde.enable { + force_platform = null; + force_platformtheme = "KDE"; + }; + }; + + extraConfig = + (let + mkPaddingDictionary = { + name, + bottom, + left, + right, + top, + }: let + n = "c.${name}.padding"; + b = "'bottom': ${toString bottom}"; + l = "'left': ${toString left}"; + r = "'right': ${toString right}"; + t = "'top': ${toString top}"; + in "${n} = {${b}, ${l}, ${r}, ${t}}"; + + final = map mkPaddingDictionary [ + { + name = "hints"; + bottom = 3; + left = 3; + right = 3; + top = 3; + } + { + name = "statusbar"; + bottom = 1; + left = 0; + right = 3; + top = 1; + } + { + name = "tabs"; + bottom = 1; + left = 6; + right = 6; + top = 1; + } + ]; + in + concatStringsSep "\n" final + "\n") + + (let + allowSetting = setting: url: "config.set('content.${setting}', True, '${url}')"; + + allowMediaCaptureSetting = url: [ + (allowSetting "desktop_capture" url) + (allowSetting "media.audio_video_capture" url) + ]; + allowedMediaCapture = flatten (map allowMediaCaptureSetting [ + "https://discord.com" + "https://meet.google.com" + "https://web.skype.com" + ]); + + allowNotificationsSetting = allowSetting "notifications.enabled"; + allowedNotifications = map allowNotificationsSetting [ + "https://discord.com" + "https://web.skype.com" + "https://web.telegram.org" + "https://web.whatsapp.com" + ]; + + final = allowedMediaCapture ++ allowedNotifications; + in + concatStringsSep "\n" final + "\n"); + }; + }; + + services.psd.enable = true; + }; +} diff --git a/modules/nixfiles/radarr.nix b/modules/nixfiles/radarr.nix new file mode 100644 index 0000000..f57efc9 --- /dev/null +++ b/modules/nixfiles/radarr.nix @@ -0,0 +1,27 @@ +{ + config, + lib, + ... +}: +with lib; let + cfg = config.nixfiles.modules.radarr; +in { + options.nixfiles.modules.radarr = { + enable = mkEnableOption "Whether to enable Radarr."; + + domain = mkOption { + description = "Domain name sans protocol scheme."; + type = with types; str; + default = "radarr.${config.networking.fqdn}"; + }; + }; + + config = mkIf cfg.enable { + nixfiles.modules.nginx = { + enable = true; + virtualHosts.${cfg.domain}.locations."/".proxyPass = "http://127.0.0.1:7878"; + }; + + services.radarr.enable = true; + }; +} diff --git a/modules/nixfiles/radicale.nix b/modules/nixfiles/radicale.nix new file mode 100644 index 0000000..8286be1 --- /dev/null +++ b/modules/nixfiles/radicale.nix @@ -0,0 +1,48 @@ +{ + config, + inputs, + lib, + ... +}: +with lib; let + cfg = config.nixfiles.modules.radicale; +in { + options.nixfiles.modules.radicale = { + enable = mkEnableOption "Whether to enable Radicale."; + + domain = mkOption { + description = "Domain name sans protocol scheme."; + type = with types; str; + default = "radicale.${config.networking.domain}"; + }; + }; + + config = let + port = 5232; + in + mkIf cfg.enable { + secrets.radicale-htpasswd = { + file = "${inputs.self}/secrets/radicale-htpasswd"; + owner = "radicale"; + group = "radicale"; + }; + + nixfiles.modules.nginx = { + enable = true; + virtualHosts.${cfg.domain}.locations."/".proxyPass = "http://127.0.0.1:${toString port}"; + }; + + services.radicale = { + enable = true; + settings = { + server.hosts = ["127.0.0.1:${toString port}"]; + web.type = "none"; + auth = { + type = "htpasswd"; + htpasswd_filename = config.secrets.radicale-htpasswd.path; + htpasswd_encryption = "bcrypt"; + }; + }; + }; + }; +} diff --git a/modules/nixfiles/rss-bridge.nix b/modules/nixfiles/rss-bridge.nix new file mode 100644 index 0000000..fe3a638 --- /dev/null +++ b/modules/nixfiles/rss-bridge.nix @@ -0,0 +1,33 @@ +{ + config, + lib, + ... +}: +with lib; let + cfg = config.nixfiles.modules.rss-bridge; +in { + options.nixfiles.modules.rss-bridge = { + enable = mkEnableOption "Whether to enable rss-bridge."; + + domain = mkOption { + description = "Domain name sans protocol scheme."; + type = with types; str; + default = "rss-bridge.${config.networking.domain}"; + }; + }; + + config = mkIf cfg.enable { + nixfiles.modules.nginx = { + enable = true; + virtualHosts.${cfg.domain} = {}; + }; + + services = { + rss-bridge = { + enable = true; + virtualHost = cfg.domain; + whitelist = ["LWNprev" "Phoronix"]; # TODO Expand. + }; + }; + }; +} diff --git a/modules/nixfiles/rtorrent.nix b/modules/nixfiles/rtorrent.nix new file mode 100644 index 0000000..2f1708c --- /dev/null +++ b/modules/nixfiles/rtorrent.nix @@ -0,0 +1,246 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.rtorrent; +in { + options.nixfiles.modules.rtorrent = { + enable = mkEnableOption "Whether to enable rTorrent."; + + flood = { + enable = mkEnableOption "Whether to enable Flood."; + + domain = mkOption { + description = "Domain name sans protocol scheme."; + type = with types; str; + default = "flood.${config.networking.domain}"; + }; + }; + }; + + config = let + user = "rtorrent"; + group = "rtorrent"; + baseDir = "/var/lib/rtorrent"; + rpcSocket = "/run/rtorrent/rpc.socket"; + in + mkIf cfg.enable (mkMerge [ + (let + port = 50000; + in { + systemd = { + services.rtorrent = { + description = "rTorrent"; + after = ["network.target" "local-fs.target"]; + serviceConfig = let + leechDir = "${baseDir}/leech"; + seedDir = "${baseDir}/seed"; + sessionDir = "${baseDir}/session"; + logDir = "${baseDir}/log"; + in { + User = user; + Group = group; + Type = "simple"; + KillMode = "process"; + KillSignal = "SIGHUP"; + ExecStartPre = concatStringsSep " " [ + "${pkgs.coreutils-full}/bin/mkdir -p" + leechDir + seedDir + sessionDir + logDir + ]; + ExecStart = let + configFile = let + moveCompleted = let + pkg = pkgs.writeShellApplication { + name = "move-completed"; + runtimeInputs = with pkgs; [ + coreutils-full + gnused + findutils + ]; + text = '' + set -x + + leech_path="$1" + seed_path="$2" + # seed_path="$(echo "$2" | sed 's@+@ @g;s@%@\\x@g' | xargs -0 printf '%b')" + + mkdir -p "$seed_path" + mv -u "$leech_path" "$seed_path" + ''; + }; + in "${pkg}/bin/move-completed"; + in + pkgs.writeText "rtorrent.rc" '' + method.insert = cfg.leech, private|const|string, (cat, "${leechDir}") + method.insert = cfg.seed, private|const|string, (cat, "${seedDir}") + method.insert = cfg.session, private|const|string, (cat, "${sessionDir}") + method.insert = cfg.log, private|const|string, (cat, "${logDir}") + method.insert = cfg.rpcsocket, private|const|string, (cat, "${rpcSocket}") + + directory.default.set = (cat, (cfg.leech)) + session.path.set = (cat, (cfg.session)) + + network.port_range.set = ${toString port}-${toString port} + network.port_random.set = no + + dht.mode.set = disable + protocol.pex.set = no + + trackers.use_udp.set = no + + protocol.encryption.set = allow_incoming,try_outgoing,enable_retry + + pieces.memory.max.set = 2048M + pieces.preload.type.set = 2 + + network.max_open_files.set = 1024 + network.max_open_sockets.set = 1024 + + network.http.max_open.set = 128 + + throttle.global_down.max_rate.set_kb = 0 + throttle.global_up.max_rate.set_kb = 0 + + encoding.add = UTF-8 + system.umask.set = 0027 + system.cwd.set = (directory.default) + + network.scgi.open_local = (cat, (cfg.rpcsocket)) + schedule = scgi_group, 0, 0, "\ + execute.nothrow=chown, \":${group}\", (cfg.rpcsocket)\ + " + schedule = scgi_permission, 0, 0, "\ + execute.nothrow=chmod, \"g+w,o=\", (cfg.rpcsocket)\ + " + + method.insert = d.move_completed, simple, "\ + d.directory.set=$argument.1=;\ + execute=${moveCompleted}, $argument.0=, $argument.1=;\ + d.save_full_session=\ + " + method.insert = d.leech_path, simple, "\ + if=(d.is_multi_file),\ + (cat, (d.directory), /),\ + (cat, (d.directory), /, (d.name))\ + " + method.insert = d.seed_path, simple, "\ + cat=$cfg.seed=, /, $d.custom1=\ + " + method.set_key = event.download.finished, move_complete, "\ + d.move_completed=$d.leech_path=, $d.seed_path=\ + " + + log.open_file = "log", (cat, (cfg.log), "/", "default.log") + log.add_output = "debug", "log" + log.execute = (cat, (cfg.log), "/", "execute.log") + ''; + in + concatStringsSep " " [ + "${pkgs.rtorrent}/bin/rtorrent" + "-n" + "-o system.daemon.set=true" + "-o import=${configFile}" + ]; + Restart = "on-failure"; + RestartSec = 3; + RuntimeDirectory = "rtorrent"; + RuntimeDirectoryMode = 755; + }; + wantedBy = ["multi-user.target"]; + }; + + tmpfiles.rules = ["d '${baseDir}' 0750 ${user} ${group} -"]; + }; + + users = { + users.${user} = { + inherit group; + shell = pkgs.bashInteractive; + home = baseDir; + description = "rTorrent"; + isSystemUser = true; + }; + groups.${group} = {}; + }; + my.extraGroups = [group]; + + networking.firewall.allowedTCPPorts = [port]; + + boot.kernel.sysctl = { + "net.core.rmem_max" = mkOverride 500 (pow 2 24); + "net.core.wmem_max" = mkOverride 500 (pow 2 24); + "net.ipv4.tcp_fin_timeout" = mkOverride 500 30; + "net.ipv4.tcp_rmem" = mkOverride 500 (mkTcpMem 12 23 24); + "net.ipv4.tcp_slow_start_after_idle" = 0; + "net.ipv4.tcp_tw_recycle" = mkOverride 500 1; + "net.ipv4.tcp_tw_reuse" = mkOverride 500 1; + "net.ipv4.tcp_wmem" = mkOverride 500 (mkTcpMem 12 23 24); + }; + }) + (let + port = 50001; + pkg = pkgs.nodePackages.flood; + in + mkIf cfg.flood.enable { + nixfiles.modules.nginx = { + enable = true; + virtualHosts.${cfg.flood.domain} = { + root = "${pkg}/lib/node_modules/flood/dist/assets"; + locations = { + "/" = { + tryFiles = "$uri /index.html"; + extraConfig = '' + if ($internal != 1) { + return 403; + } + ''; + }; + "/api" = { + proxyPass = "http://127.0.0.1:${toString port}"; + extraConfig = '' + proxy_buffering off; + proxy_cache off; + + if ($internal != 1) { + return 403; + } + ''; + }; + }; + }; + }; + + systemd.services.flood = { + description = "Flood"; + after = ["network.target" "rtorrent.service"]; + path = with pkgs; [mediainfo]; + serviceConfig = { + User = user; + Group = group; + Type = "simple"; + KillMode = "process"; + ExecStart = concatStringsSep " " [ + "${pkg}/bin/flood" + "--allowedpath=${baseDir}" + "--baseuri=/" + "--rundir=${baseDir}/flood" + "--host=127.0.0.1" + "--port=${toString port}" + "--rtsocket=${rpcSocket}" + "--ssl=false" + "--auth=none" + ]; + Restart = "on-failure"; + RestartSec = 3; + }; + wantedBy = ["multi-user.target"]; + }; + }) + ]); +} diff --git a/modules/nixfiles/searx.nix b/modules/nixfiles/searx.nix new file mode 100644 index 0000000..a5bb005 --- /dev/null +++ b/modules/nixfiles/searx.nix @@ -0,0 +1,81 @@ +{ + config, + inputs, + lib, + ... +}: +with lib; let + cfg = config.nixfiles.modules.searx; +in { + options.nixfiles.modules.searx = { + enable = mkEnableOption "Whether to enable SearX."; + + port = mkOption { + description = "Port."; + type = with types; port; + default = 61001; + }; + + domain = mkOption { + description = "Domain name sans protocol scheme."; + type = with types; nullOr str; + default = "searx.${config.networking.domain}"; + }; + }; + + config = mkIf cfg.enable { + secrets.searx-environment = { + file = "${inputs.self}/secrets/searx-environment"; + owner = "searx"; + group = "searx"; + }; + + nixfiles.modules.nginx = { + enable = true; + virtualHosts.${cfg.domain}.locations."/" = { + proxyPass = "http://127.0.0.1:${toString cfg.port}"; + extraConfig = '' + if ($internal != 1) { + return 403; + } + ''; + }; + }; + + services = { + searx = { + enable = true; + + settings = { + general = { + instance_name = cfg.domain; + contact_url = "mailto:admin+searx@${config.networking.domain}"; + git_url = false; + git_branch = false; + docs_url = false; + wiki_url = false; + twitter_url = false; + }; + server = { + bind_address = "127.0.0.1"; + inherit (cfg) port; + secret_key = "@SECRET_KEY@"; + base_url = false; + image_proxy = false; + default_http_headers = { + Referrer-Policy = "no-referrer"; + X-Content-Type-Options = "nosniff"; + X-Download-Options = "noopen"; + X-Robots-Tag = "noindex, nofollow, nosnippet, noarchive"; + }; + }; + search = { + safe_search = 0; + autocomplete = ""; + }; + }; + environmentFile = config.secrets.searx-environment.path; + }; + }; + }; +} diff --git a/modules/nixfiles/shadowsocks.nix b/modules/nixfiles/shadowsocks.nix new file mode 100644 index 0000000..c496caa --- /dev/null +++ b/modules/nixfiles/shadowsocks.nix @@ -0,0 +1,119 @@ +{ + config, + inputs, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.shadowsocks; +in { + options.nixfiles.modules.shadowsocks = { + enable = mkEnableOption "Whether to enable Shadowsocks."; + + port = mkOption { + type = with types; port; + default = 8388; + description = "Port."; + }; + }; + + config = mkIf cfg.enable { + secrets.shadowsocks-password = { + file = "${inputs.self}/secrets/shadowsocks-password"; + mode = "0444"; # User is dynamic. + }; + + services = { + shadowsocks = { + enable = true; + passwordFile = config.secrets.shadowsocks-password.path; + localAddress = ["0.0.0.0"]; + mode = "tcp_only"; + }; + + fail2ban.jails.shadowsocks-libev = '' + enabled = true + filter = shadowsocks-libev + port = ${toString cfg.port} + ''; + }; + + systemd.services.shadowsocks-libev.path = with pkgs; + mkForce [ + (writeShellApplication { + name = "ss-server"; + runtimeInputs = [shadowsocks-libev]; + text = let + # https://github.com/shadowsocks/shadowsocks-libev/blob/master/acl/server_block_local.acl + aclFile = writeText "outbound_block_list.acl" '' + [outbound_block_list] + 0.0.0.0/8 + 10.0.0.0/8 + 100.64.0.0/10 + 127.0.0.0/8 + 169.254.0.0/16 + 172.16.0.0/12 + 192.0.0.0/24 + 192.0.2.0/24 + 192.88.99.0/24 + 192.168.0.0/16 + 198.18.0.0/15 + 198.51.100.0/24 + 203.0.113.0/24 + 224.0.0.0/4 + 240.0.0.0/4 + 255.255.255.255/32 + ::1/128 + ::ffff:127.0.0.1/104 + fc00::/7 + fe80::/10 + ''; + in '' + ss-server --acl ${aclFile} "$@" + ''; + }) + coreutils-full + jq + ]; + + environment.etc = mkIf config.nixfiles.modules.fail2ban.enable { + "fail2ban/filter.d/shadowsocks-libev.conf".text = '' + [Definition] + failregex = ^.*failed to handshake with <ADDR>: authentication error$ + ignoreregex = + journalmatch = _SYSTEMD_UNIT=shadowsocks-libev.service + ''; + }; + + networking.firewall = { + allowedTCPPorts = [cfg.port]; + extraCommands = '' + iptables -A nixos-fw -p tcp --syn --dport ${ + toString cfg.port + } -m connlimit --connlimit-above 32 -j nixos-fw-refuse + ''; + }; + + boot.kernel.sysctl = { + "net.core.rmem_max" = mkOverride 100 (pow 2 26); + "net.core.wmem_max" = mkOverride 100 (pow 2 26); + "net.core.netdev_max_backlog" = pow 2 18; + "net.core.somaxconn" = pow 2 12; + "net.ipv4.tcp_syncookies" = 1; + "net.ipv4.tcp_tw_reuse" = mkOverride 100 1; + "net.ipv4.tcp_tw_recycle" = mkOverride 100 0; + "net.ipv4.tcp_fin_timeout" = mkOverride 100 30; + "net.ipv4.tcp_keepalive_time" = 60 * 20; + "net.ipv4.ip_local_port_range" = "10000 65000"; + "net.ipv4.tcp_max_syn_backlog" = pow 2 13; + "net.ipv4.tcp_max_tw_buckets" = pow 2 12; + "net.ipv4.tcp_fastopen" = 3; + "net.ipv4.tcp_mem" = mkOverride 100 (mkTcpMem 15 16 17); + "net.ipv4.tcp_rmem" = mkOverride 100 (mkTcpMem 12 16 26); + "net.ipv4.tcp_wmem" = mkOverride 100 (mkTcpMem 12 16 26); + "net.ipv4.tcp_mtu_probing" = 1; + "net.ipv4.tcp_congestion_control" = "hybla"; + }; + }; +} diff --git a/modules/nixfiles/soju.nix b/modules/nixfiles/soju.nix new file mode 100644 index 0000000..b586cbf --- /dev/null +++ b/modules/nixfiles/soju.nix @@ -0,0 +1,83 @@ +{ + config, + lib, + pkgs, + this, + ... +}: +with lib; let + cfg = config.nixfiles.modules.soju; +in { + options.nixfiles.modules.soju = { + enable = mkEnableOption "Whether to enable soju."; + + protocol = mkOption { + description = "Port."; + type = with types; enum ["ircs" "irc+insecure"]; + default = "irc+insecure"; + }; + + address = mkOption { + description = "Address."; + type = with types; str; + default = this.wireguard.ipv4.address; + }; + + port = mkOption { + description = "Port."; + type = with types; port; + default = 6667; + }; + + domain = mkOption { + description = "Domain."; + type = with types; str; + default = config.networking.fqdn; + }; + }; + + config = let + db = "soju"; + in + mkIf cfg.enable { + services.postgresql = { + ensureDatabases = [db]; + ensureUsers = [ + { + name = db; + ensurePermissions."DATABASE \"${db}\"" = "ALL PRIVILEGES"; + } + ]; + }; + + systemd.services.soju = { + description = "soju IRC bouncer"; + wantedBy = ["multi-user.target"]; + after = ["network-online.target" "postgresql.service"]; + serviceConfig = { + Restart = "always"; + ExecStart = let + configFile = pkgs.writeText "soju.conf" '' + listen ${cfg.protocol}://${cfg.address}:${toString cfg.port} + db postgres "${ + concatStringsSep " " [ + "host=/run/postgresql" + "user=${db}" + "dbname=${db}" + "sslmode=disable" + ] + }" + hostname ${cfg.domain} + title ${cfg.domain} + ''; + in + concatStringsSep " " [ + "${pkgs.soju}/bin/soju" + "-config ${configFile}" + ]; + DynamicUser = true; + StateDirectory = "soju"; + }; + }; + }; +} diff --git a/modules/nixfiles/sonarr.nix b/modules/nixfiles/sonarr.nix new file mode 100644 index 0000000..a2003f0 --- /dev/null +++ b/modules/nixfiles/sonarr.nix @@ -0,0 +1,27 @@ +{ + config, + lib, + ... +}: +with lib; let + cfg = config.nixfiles.modules.sonarr; +in { + options.nixfiles.modules.sonarr = { + enable = mkEnableOption "Whether to enable Sonarr."; + + domain = mkOption { + description = "Domain name sans protocol scheme."; + type = with types; str; + default = "sonarr.${config.networking.fqdn}"; + }; + }; + + config = mkIf cfg.enable { + nixfiles.modules.nginx = { + enable = true; + virtualHosts.${cfg.domain}.locations."/".proxyPass = "http://127.0.0.1:8989"; + }; + + services.sonarr.enable = true; + }; +} diff --git a/modules/nixfiles/sound.nix b/modules/nixfiles/sound.nix new file mode 100644 index 0000000..b352f3e --- /dev/null +++ b/modules/nixfiles/sound.nix @@ -0,0 +1,21 @@ +{ + config, + lib, + ... +}: +with lib; let + cfg = config.nixfiles.modules.sound; +in { + options.nixfiles.modules.sound.enable = + mkEnableOption "Whether to enable sound support."; + + config = mkIf cfg.enable { + services.pipewire = { + enable = true; + + alsa.enable = false; + jack.enable = false; + pulse.enable = true; + }; + }; +} diff --git a/modules/nixfiles/subversion.nix b/modules/nixfiles/subversion.nix new file mode 100644 index 0000000..1cfdca6 --- /dev/null +++ b/modules/nixfiles/subversion.nix @@ -0,0 +1,53 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.subversion; +in { + options.nixfiles.modules.subversion.enable = + mkEnableOption "Whether to enable Subversion version control system."; + + config = mkIf cfg.enable { + nixfiles.modules.gnupg.enable = true; + + hm.home = { + file = { + ".subversion/config".text = generators.toINI {} { + auth = { + password-stores = "gpg-agent"; + ssl-client-cert-file-prompt = "no"; + store-passwords = "yes"; + store-auth-creds = "yes"; + }; + helpers = { + editor-cmd = "${config.programs.vim.package}/bin/vim"; + diff-cmd = "${pkgs.colordiff}/bin/colordiff"; + }; + miscellany = { + global-ignores = with config.hm.programs.git; + optionalString (ignores != []) (concatStringsSep " " ignores); + diff-ignore-content-type = "no"; + }; + working-copy = { + exclusive-locking-clients = "svn"; + exclusive-locking = true; + busy-timeout = 10000; + }; + }; + + ".subversion/servers".text = generators.toINI {} { + global = { + store-auth-creds = "yes"; + store-passwords = "yes"; + store-plaintext-passwords = "yes"; + }; + }; + }; + + packages = with pkgs; [(subversionClient.override {saslSupport = true;})]; + }; + }; +} diff --git a/modules/nixfiles/syncthing.nix b/modules/nixfiles/syncthing.nix new file mode 100644 index 0000000..5a973cc --- /dev/null +++ b/modules/nixfiles/syncthing.nix @@ -0,0 +1,161 @@ +{ + config, + lib, + pkgs, + this, + ... +}: +with lib; let + cfg = config.nixfiles.modules.syncthing; +in { + options.nixfiles.modules.syncthing = { + enable = mkEnableOption "Whether to enable Syncthing."; + + domain = mkOption { + description = "Domain name sans protocol scheme."; + type = with types; str; + default = "syncthing.${config.networking.fqdn}"; + }; + + # TODO Make this simpler. + cert = mkOption { + description = "Path to the cert file."; + type = with types; nullOr string; + default = null; + }; + + # TODO Make this simpler. + key = mkOption { + description = "Path to the key file."; + type = with types; nullOr string; + default = null; + }; + }; + + config = mkIf cfg.enable (mkMerge [ + { + assertions = [ + { + assertion = cfg.cert != null; + message = "Cert file needs to be specified."; + } + { + assertion = cfg.key != null; + message = "Key file needs to be specified."; + } + ]; + + services.syncthing = { + enable = true; + + user = my.username; + inherit (config.my) group; + + dataDir = config.my.home; + + guiAddress = "127.0.0.1:8384"; + + inherit (cfg) key cert; + + overrideDevices = true; + devices = mapAttrs (name: attr: + mkIf (attr.syncthing.id != null && hasAttr "wireguard" attr) { + inherit (attr.syncthing) id; + addresses = ["tcp://${name}.${config.networking.domain}:22000"]; + introducer = this.isHeadless; + }) + my.configurations; + + overrideFolders = true; + folders = let + filterDevices = f: + attrNames (filterAttrs (_: attr: + (attr.hostname != this.hostname) + && (attr.syncthing.id != null) + && f attr) + my.configurations); + all = filterDevices (_: true); + notHeadless = filterDevices (attr: !attr.isHeadless); + notOther = filterDevices (attr: !attr.isOther); + + simple = { + type = "simple"; + params.keep = "5"; + }; + trashcan = { + type = "trashcan"; + params.cleanoutDays = "30"; + }; + void = { + type = "external"; + params.versionPath = with pkgs; + writeShellScriptBin "backup" '' + ${coreutils-full}/bin/rm -rf $1/$2 + ''; + }; + in + with config.hm.xdg.userDirs; { + share = { + path = publicShare; + devices = notHeadless; + versioning = void; + }; + pass = { + path = + config.hm.programs.password-store.settings.PASSWORD_STORE_DIR; + devices = all; + versioning = trashcan; + }; + org = { + path = "${documents}/org"; + devices = all; + versioning = simple; + }; + roam = { + path = "${documents}/roam"; + devices = notOther; + versioning = simple; + }; + elfeed = { + path = "${config.my.home}/.elfeed"; + devices = notOther; + versioning = trashcan; + }; + vidya = { + path = "${documents}/vidya"; + devices = notOther; + versioning = void; + }; + }; + + extraOptions = { + gui = { + insecureAdminAccess = true; + insecureSkipHostcheck = this.isHeadless; + }; + options = { + # Only local discovery is used over VPN. + globalAnnounceEnabled = false; + relaysEnabled = false; + urAccepted = -1; + }; + }; + }; + + systemd.services.syncthing.environment.STNODEFAULTFOLDER = "yes"; + } + (mkIf this.isHeadless { + nixfiles.modules.nginx = { + enable = true; + virtualHosts.${cfg.domain}.locations."/" = { + proxyPass = "http://${config.services.syncthing.guiAddress}"; + extraConfig = '' + if ($internal != 1) { + return 403; + } + ''; + }; + }; + }) + ]); +} diff --git a/modules/nixfiles/throttled.nix b/modules/nixfiles/throttled.nix new file mode 100644 index 0000000..b7c7d8a --- /dev/null +++ b/modules/nixfiles/throttled.nix @@ -0,0 +1,117 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.throttled; +in { + options.nixfiles.modules.throttled.enable = + mkEnableOption "Whether to enable Throttled."; + + config = mkIf cfg.enable { + environment.etc."throttled.conf".text = '' + [GENERAL] + # Enable or disable the script execution + Enabled: True + # SYSFS path for checking if the system is running on AC power + Sysfs_Power_Path: /sys/class/power_supply/AC*/online + # Auto reload config on changes + Autoreload: True + + ## Settings to apply while connected to Battery power + [BATTERY] + # Update the registers every this many seconds + Update_Rate_s: 30 + # Max package power for time window #1 + PL1_Tdp_W: 29 + # Time window #1 duration + PL1_Duration_s: 28 + # Max package power for time window #2 + PL2_Tdp_W: 44 + # Time window #2 duration + PL2_Duration_S: 0.002 + # Max allowed temperature before throttling + Trip_Temp_C: 85 + # Set cTDP to normal=0, down=1 or up=2 (EXPERIMENTAL) + cTDP: 0 + # Disable BDPROCHOT (EXPERIMENTAL) + Disable_BDPROCHOT: False + + ## Settings to apply while connected to AC power + [AC] + # Update the registers every this many seconds + Update_Rate_s: 5 + # Max package power for time window #1 + PL1_Tdp_W: 44 + # Time window #1 duration + PL1_Duration_s: 28 + # Max package power for time window #2 + PL2_Tdp_W: 44 + # Time window #2 duration + PL2_Duration_S: 0.002 + # Max allowed temperature before throttling + Trip_Temp_C: 95 + # Set HWP energy performance hints to 'performance' on high load (EXPERIMENTAL) + # Uncomment only if you really want to use it + # HWP_Mode: False + # Set cTDP to normal=0, down=1 or up=2 (EXPERIMENTAL) + cTDP: 0 + # Disable BDPROCHOT (EXPERIMENTAL) + Disable_BDPROCHOT: False + + # All voltage values are expressed in mV and *MUST* be negative (i.e. undervolt)! + [UNDERVOLT.BATTERY] + # CPU core voltage offset (mV) + CORE: 0 + # Integrated GPU voltage offset (mV) + GPU: 0 + # CPU cache voltage offset (mV) + CACHE: 0 + # System Agent voltage offset (mV) + UNCORE: 0 + # Analog I/O voltage offset (mV) + ANALOGIO: 0 + + # All voltage values are expressed in mV and *MUST* be negative (i.e. undervolt)! + [UNDERVOLT.AC] + # CPU core voltage offset (mV) + CORE: 0 + # Integrated GPU voltage offset (mV) + GPU: 0 + # CPU cache voltage offset (mV) + CACHE: 0 + # System Agent voltage offset (mV) + UNCORE: 0 + # Analog I/O voltage offset (mV) + ANALOGIO: 0 + + # [ICCMAX.AC] + # # CPU core max current (A) + # CORE: + # # Integrated GPU max current (A) + # GPU: + # # CPU cache max current (A) + # CACHE: + + # [ICCMAX.BATTERY] + # # CPU core max current (A) + # CORE: + # # Integrated GPU max current (A) + # GPU: + # # CPU cache max current (A) + # CACHE: + ''; + + systemd.services.throttled = { + description = "Stop Intel throttling"; + serviceConfig = { + Type = "simple"; + ExecStart = "${pkgs.throttled}/opt/throttled/throttled.py"; + }; + environment.PYTHONUNBUFFERED = "1"; + wantedBy = ["multi-user.target"]; + }; + }; +} diff --git a/modules/nixfiles/tmux.nix b/modules/nixfiles/tmux.nix new file mode 100644 index 0000000..c90b0fc --- /dev/null +++ b/modules/nixfiles/tmux.nix @@ -0,0 +1,60 @@ +{ + config, + lib, + ... +}: +with lib; let + cfg = config.nixfiles.modules.tmux; +in { + options.nixfiles.modules.tmux.enable = + mkEnableOption "Whether to enable tmux."; + + config = mkIf cfg.enable { + hm.programs.tmux = { + enable = true; + + aggressiveResize = true; + baseIndex = 1; + clock24 = true; + disableConfirmationPrompt = true; + escapeTime = 0; + historyLimit = 50000; + newSession = true; + resizeAmount = 10; + terminal = "screen-256color"; + + extraConfig = '' + set -g set-titles on + + set -g status-left "" + set -g status-right "" + + set -g detach-on-destroy off + + set -g status-keys emacs + set -g mode-keys vi + + bind h select-pane -L + bind j select-pane -D + bind k select-pane -U + bind l select-pane -R + + bind -r H resize-pane -L 10 + bind -r J resize-pane -D 10 + bind -r K resize-pane -U 10 + bind -r L resize-pane -R 10 + + bind < swap-pane -D + bind > swap-pane -U + + bind , swap-window -t -1 + bind . swap-window -t +1 + + bind Tab last-window + + bind _ split-window -v + bind | split-window -h + ''; + }; + }; +} diff --git a/modules/nixfiles/unbound.nix b/modules/nixfiles/unbound.nix new file mode 100644 index 0000000..af983a8 --- /dev/null +++ b/modules/nixfiles/unbound.nix @@ -0,0 +1,208 @@ +{ + config, + lib, + pkgs, + this, + ... +}: +with lib; let + cfg = config.nixfiles.modules.unbound; +in { + options.nixfiles.modules.unbound = { + enable = mkEnableOption '' + Whether to enable Unbound. + + This service is configured to be used in conjunction with a Wireguard + server located on the same host to enable internal name resolution with a + forwarding fallback via Quad9. + + Features included: Internal name resolution, Quad9 as a recursive + resolver, DNSSEC validation, Redis cache and adblocking via pgl.yoyo.org + lists. + ''; + + domain = mkOption { + description = "Domain name sans protocol scheme."; + type = with types; str; + default = config.networking.domain; + }; + }; + + config = let + adblock-conf = "${config.services.unbound.stateDir}/adblock.conf"; + in + mkIf cfg.enable { + services = { + unbound = { + enable = true; + + package = pkgs.unbound-with-systemd.override { + withRedis = true; + withTFO = true; + }; + + settings = { + server = { + interface = with this.wireguard; [ + "127.0.0.1" + "::1" + ipv4.address + ipv6.address + ]; + + local-zone = + concatLists + (mapAttrsToList (h: _: [''"${h}.${cfg.domain}" redirect'']) + my.configurations); + local-data = concatLists (mapAttrsToList (hostname: let + domain = "${hostname}.${cfg.domain}"; + in + attr: (optionals (hasAttr "wireguard" attr) (with attr.wireguard; + [ + ''"${domain} 604800 IN A ${ipv4.address}"'' + ''"${domain} 604800 IN AAAA ${ipv6.address}"'' + ''"${domain}. A ${ipv4.address}"'' + ''"${domain}. AAAA ${ipv6.address}"'' + ] + ++ concatMap (domain: [ + ''"${domain}. A ${ipv4.address}"'' + ''"${domain}. AAAA ${ipv6.address}"'' + ]) + attr.domains))) + my.configurations); + local-data-ptr = concatLists (mapAttrsToList (hostname: let + domain = "${hostname}.${cfg.domain}"; + in + attr: (optionals (hasAttr "wireguard" attr) (with attr.wireguard; + [ + ''"${ipv4.address} ${domain}"'' + ''"${ipv6.address} ${domain}"'' + ] + ++ concatMap (domain: [ + ''"${ipv4.address} ${domain}"'' + ''"${ipv6.address} ${domain}"'' + ]) + attr.domains))) + my.configurations); + + access-control = with config.nixfiles.modules.wireguard; [ + "0.0.0.0/0 refuse" + "::/0 refuse" + "127.0.0.0/8 allow" + "::1/128 allow" + "${ipv4.subnet} allow" + "${ipv6.subnet} allow" + ]; + + private-domain = cfg.domain; + private-address = with config.nixfiles.modules.wireguard; [ + ipv4.subnet + ipv6.subnet + ]; + + domain-insecure = cfg.domain; + + prefetch = true; + prefetch-key = true; + + hide-identity = true; + hide-version = true; + + extended-statistics = true; + + include = ''"${adblock-conf}"''; + }; + + forward-zone = [ + { + name = "."; + forward-tls-upstream = true; + forward-addr = let + mkDnsOverTls = ips: auth: + map (ip: concatStrings [ip "@" auth]) ips; + in + mkDnsOverTls dns.const.quad9.default "853#dns.quad9.net"; + } + ]; + + cachedb = with config.services.redis.servers.unbound; { + backend = "redis"; + redis-server-host = bind; + redis-server-port = port; + }; + }; + + localControlSocketPath = "/run/unbound/unbound.socket"; + }; + + redis = { + servers.unbound = { + enable = true; + bind = "127.0.0.1"; + port = 6379; + }; + vmOverCommit = mkForce true; + }; + + prometheus.exporters = { + unbound = { + enable = true; + listenAddress = mkDefault this.wireguard.ipv4.address; + port = 9167; + fetchType = "uds"; + controlInterface = config.services.unbound.localControlSocketPath; + inherit (config.services.unbound) group user; + }; + + redis = { + enable = true; + listenAddress = mkDefault this.wireguard.ipv4.address; + port = mkDefault 9121; + extraFlags = with config.services.redis.servers.unbound; [ + "--redis.addr=redis://${bind}:${toString port}" + "--redis.user=${user}" + ]; + }; + }; + }; + + systemd = { + services = { + unbound.after = ["unbound-adblock-update.service"]; + + unbound-adblock-update = { + serviceConfig = with config.services.unbound; { + Type = "oneshot"; + User = user; + Group = group; + ExecStart = let + pkg = with pkgs; + writeShellApplication { + name = "unbound-adblock-update"; + runtimeInputs = [curl package]; + text = '' + curl \ + "https://pgl.yoyo.org/adservers/serverlist.php?hostformat=unbound&showintro=0&mimetype=plaintext" \ + >${adblock-conf} + + if [[ -f "${localControlSocketPath}" ]]; then + unbound-control reload + fi + ''; + }; + in "${pkg}/bin/unbound-adblock-update"; + }; + }; + }; + + timers.unbound-adblock-update = { + requires = ["network-online.target"]; + timerConfig = { + OnUnitActiveSec = "1d"; + Unit = "unbound-adblock-update.service"; + }; + wantedBy = ["timers.target"]; + }; + }; + }; +} diff --git a/modules/nixfiles/vaultwarden.nix b/modules/nixfiles/vaultwarden.nix new file mode 100644 index 0000000..4f5bcb4 --- /dev/null +++ b/modules/nixfiles/vaultwarden.nix @@ -0,0 +1,117 @@ +{ + config, + inputs, + lib, + ... +}: +with lib; let + cfg = config.nixfiles.modules.vaultwarden; +in { + options.nixfiles.modules.vaultwarden = { + enable = mkEnableOption "Whether to enable Vaultwarden."; + + domain = mkOption { + description = "Domain name sans protocol scheme."; + type = with types; str; + default = "vaultwarden.${config.networking.domain}"; + }; + }; + + config = mkIf cfg.enable { + secrets.vaultwarden-environment = { + file = "${inputs.self}/secrets/vaultwarden-environment"; + owner = "vaultwarden"; + group = "vaultwarden"; + }; + + nixfiles.modules = { + nginx = { + enable = true; + virtualHosts.${cfg.domain} = with config.services.vaultwarden.config; { + locations."/" = { + proxyPass = "http://[${ROCKET_ADDRESS}]:${toString ROCKET_PORT}"; + proxyWebsockets = true; + }; + locations."/notifications/hub" = { + proxyPass = "http://[${WEBSOCKET_ADDRESS}]:${toString WEBSOCKET_PORT}"; + proxyWebsockets = true; + }; + locations."/notifications/hub/negotiate" = { + proxyPass = "http://[${ROCKET_ADDRESS}]:${toString ROCKET_PORT}"; + proxyWebsockets = true; + }; + }; + }; + postgresql.enable = true; + }; + + services = let + db = "vaultwarden"; + in { + vaultwarden = { + enable = true; + config = { + TZ = config.time.timeZone; + + WEB_VAULT_ENABLED = true; + + DOMAIN = optionalString (cfg.domain != null) "http://${cfg.domain}"; + + SIGNUPS_ALLOWED = false; + INVITATIONS_ALLOWED = true; + + ROCKET_ADDRESS = "::1"; + ROCKET_PORT = 8812; + + WEBSOCKET_ENABLED = true; + WEBSOCKET_ADDRESS = "::1"; + WEBSOCKET_PORT = 8813; + + LOG_LEVEL = "error"; + + DATABASE_URL = "postgresql://${db}@/${db}"; + }; + dbBackend = "postgresql"; + environmentFile = config.secrets.vaultwarden-environment.path; + }; + + postgresql = { + ensureDatabases = [db]; + ensureUsers = [ + { + name = db; + ensurePermissions."DATABASE \"${db}\"" = "ALL PRIVILEGES"; + } + ]; + }; + + fail2ban.jails = mkIf config.nixfiles.modules.fail2ban.enable { + vaultwarden = '' + enabled = true + filter = vaultwarden + port = http,https + ''; + vaultwarden-admin = '' + enabled = true + filter = vaultwarden-admin + port = http,https + ''; + }; + }; + + environment.etc = mkIf config.nixfiles.modules.fail2ban.enable { + "fail2ban/filter.d/vaultwarden.conf".text = '' + [Definition] + failregex = ^.*Username or password is incorrect\. Try again\. IP: <ADDR>\. Username:.*$ + ignoreregex = + journalmatch = _SYSTEMD_UNIT=vaultwarden.service + ''; + "fail2ban/filter.d/vaultwarden-admin.conf".text = '' + [Definition] + failregex = ^.*Invalid admin token\. IP: <ADDR>.*$ + ignoreregex = + journalmatch = _SYSTEMD_UNIT=vaultwarden.service + ''; + }; + }; +} diff --git a/modules/nixfiles/vim/default.nix b/modules/nixfiles/vim/default.nix new file mode 100644 index 0000000..cef4423 --- /dev/null +++ b/modules/nixfiles/vim/default.nix @@ -0,0 +1,56 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.vim; +in { + options.nixfiles.modules.vim.enable = + mkEnableOption "Whether to enable Vim text editor."; + + config = mkIf cfg.enable { + programs.vim.package = with pkgs; + ((vim_configurable.override {features = "normal";} + // listToAttrs + (map (name: nameValuePair name false) [ + "cscopeSupport" + "darwinSupport" + "guiSupport" + "luaSupport" + "multibyteSupport" + "netbeansSupport" + "nlsSupport" + "perlSupport" + "pythonSupport" + "rubySupport" + "tclSupport" + "ximSupport" + ])) + .overrideAttrs (_: super: { + configureFlags = + super.configureFlags + ++ ["--enable-gpm=no" "--enable-gui=no"]; + })) + .customize { + name = "vim"; + vimrcConfig = { + customRC = readFile ./rc.vim; + packages.myVimPackage.start = with vimPlugins; [ + editorconfig-vim + vim-eunuch + vim-nix + vim-sleuth + vim-surround + vim-unimpaired + ]; + }; + }; + + environment = { + systemPackages = [config.programs.vim.package]; + variables.EDITOR = mkOverride 100 "vim"; + }; + }; +} diff --git a/modules/nixfiles/vim/rc.vim b/modules/nixfiles/vim/rc.vim new file mode 100644 index 0000000..c53b2d2 --- /dev/null +++ b/modules/nixfiles/vim/rc.vim @@ -0,0 +1,252 @@ +set nocompatible + +let $VIMFILES = expand('<sfile>:p:h') + +let g:skip_defaults_vim = 1 + +let g:netrw_dirhistmax = 0 + +set autoread +set backspace=indent,eol,start +set clipboard=unnamed,unnamedplus +set diffopt+=iwhite +set hidden +set history=256 +set lazyredraw +set mouse= +set path+=** +set tabpagemax=50 +set viminfo= + +set cmdheight=1 +set display+=lastline +set fillchars=vert:\ " +set laststatus=2 +set modeline +set noshowmode +set ruler +set shortmess+=I +set textwidth=0 +set title + +set sessionoptions-=options +set viewoptions-=options + +set noerrorbells +set novisualbell + +set splitbelow +set splitright + +set complete= +set complete+=. +set complete+=b +set complete+=t +set completeopt= +set completeopt+=menu +set completeopt+=longest + +set gdefault +set hlsearch +set incsearch +set iskeyword+=- +set magic + +set foldmethod=marker +set nofoldenable + +set shortmess= +set shortmess+=I +set shortmess+=T +set shortmess+=a +set shortmess+=c +set shortmess+=t + +set nolist +set nowrap + +set scrolloff=10 +set sidescrolloff=10 + +set number +if v:version >= 700 + set numberwidth=3 +endif + +set wildignorecase +set wildmenu +set wildignore= + +set nobackup +set noswapfile +set noundofile +set nowritebackup + +set smartcase +set ignorecase + +set autoindent +set breakindent +set smartindent + +set expandtab +set shiftround +set shiftwidth=4 +set smarttab +set softtabstop=4 +set tabstop=4 + +autocmd BufEnter *.* :set colorcolumn= + +if &t_Co == 8 && $TERM !~# '^Eterm' + set t_Co=16 +endif + +if &listchars ==# 'eol:$' + set listchars=tab:>\ ,trail:-,extends:>,precedes:<,nbsp:+ +endif + +if v:version > 703 || v:version == 703 && has("patch541") + set formatoptions+=j +endif + +if has('path_extra') + setglobal tags-=./tags tags-=./tags; tags^=./tags; +endif + +if !has('nvim') && &ttimeoutlen == -1 + set ttimeout + set ttimeoutlen=100 +endif + +try + set encoding=utf-8 + scriptencoding utf-8 +catch +endtry + +try + if &fileencodings !~? "utf-8" + let g:added_fenc_utf8 = 1 + set fileencodings+=utf-8 + endif +catch +endtry + +if has('autocmd') + filetype plugin indent on + + if exists("+omnifunc") + autocmd Filetype * + \ if &omnifunc == "" | + \ setlocal omnifunc=syntaxcomplete#Complete | + \ endif + endif + + autocmd BufEnter * set noreadonly +endif + +if has('syntax') && !exists('g:syntax_on') + syntax enable +endif + +if !exists('g:loaded_matchit') && findfile('plugin/matchit.vim', &rtp) ==# '' + runtime! macros/matchit.vim +endif + +nnoremap <SPACE> <nop> +let mapleader=" " + +nnoremap :W :w +nnoremap :W! :w! +nnoremap :Q :q +nnoremap :Q! :q! + +nnoremap <Expr> j v:count ? 'j' : 'gj' +nnoremap <Expr> k v:count ? 'k' : 'gk' + +nnoremap J gt +nnoremap K gT + +nnoremap <C-a> ^h +vnoremap <C-a> ^h +nnoremap H ^h +vnoremap H ^h + +nnoremap <C-e> $ +vnoremap <C-e> $ +nnoremap L $ +vnoremap L $ + +nnoremap N Nzzzv +nnoremap n nzzzv + +inoremap <C-u> <C-g>u<C-u> +inoremap <C-w> <C-g>u<C-w> + +vnoremap < <gv +vnoremap > >gv +vnoremap <Tab> >gv +vnoremap <S-Tab> <gv +nnoremap <Tab> >>_ +nnoremap <S-Tab> <<_ + +nnoremap ]b :<C-u>bnext<CR> +nnoremap [b :<C-u>bprevious<CR> + +nnoremap <C-h> <C-w>h +nnoremap <C-j> <C-w>j +nnoremap <C-k> <C-w>k +nnoremap <C-l> <C-w>l + +nnoremap * /\<<C-r>=expand('<cword>')<CR>\><CR> +nnoremap # ?\<<C-r>=expand('<cword>')<CR>\><CR> + +nnoremap <C-L> :<C-u>nohlsearch<C-r>=has('diff')?'<Bar>diffupdate':''<CR><CR><C-l> + +cnoremap ;/ <C-r>=expand('%:p:h').'/'<CR> +cnoremap ;; <C-r>=expand('%:t')<CR> +cnoremap ;. <C-r>=expand('%:p:r')<CR> + +nnoremap <Leader>. :<C-u>lcd %:p:h<CR> + +nnoremap Q @q + +nnoremap <Leader>c ^v$h +nnoremap <Leader>v ggVG + +nnoremap <Leader>y "+y +nnoremap <Leader>Y "+Y + +nnoremap <Leader>p "+p +nnoremap <Leader>P "+P + +inoremap <C-v> <C-c>"+pi +cnoremap <C-v> <C-r>+ + +nmap <Leader>w :<C-u>w!<CR> +nmap <Leader>wq :<C-u>wq!<CR> + +nnoremap ZX :<C-u>qa!<CR> + +nnoremap <Leader>q :<C-u>q<CR> + +command WS w !sudo tee "%" >/dev/null + +function! SwitchCase() + normal! ~ + if strlen(getline('.')) != virtcol('.') + normal! h + endif +endfunction +nnoremap ~ :<C-u>call SwitchCase()<CR> + +function! s:GM() + execute 'normal! ^' + let first_col = virtcol('.') + execute 'normal! g_' + let last_col = virtcol('.') + execute 'normal! ' . (first_col + last_col) / 2 . '|' +endfunction +nnoremap gm :<C-u>call <SID>GM()<CR> +onoremap gm :<C-u>call <SID>GM()<CR> diff --git a/modules/nixfiles/vscode.nix b/modules/nixfiles/vscode.nix new file mode 100644 index 0000000..b41d037 --- /dev/null +++ b/modules/nixfiles/vscode.nix @@ -0,0 +1,172 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.vscode; +in { + options.nixfiles.modules.vscode = { + enable = mkEnableOption "Whether to enable VSCode."; + + package = with pkgs; + mkOption { + type = types.enum [vscodium vscode vscode-fhs]; + default = vscodium; + description = "Which package to use as a VSCode implementation."; + }; + + vim.enable = mkOption { + type = types.bool; + default = true; + description = "Whether to enable Vim emulation."; + }; + }; + + config = mkIf cfg.enable { + hm.programs.vscode = with config.nixfiles; + with modules; + with profiles; { + enable = true; + + inherit (cfg) package; + + extensions = with pkgs; + with vscode-extensions; + [editorconfig.editorconfig file-icons.file-icons redhat.vscode-yaml] + ++ optional cfg.vim.enable vscodevim.vim + ++ vscode-utils.extensionsFromVscodeMarketplace [ + { + name = "vscode-xml"; + publisher = "redhat"; + version = "0.20.0"; + sha256 = "sha256-GKBrf9s8n7Wv14RSfwyDma1dM0fGMvRkU/7v2DAcB9A="; + } + ]; + + userSettings = let + font = config.fontScheme.monospaceFont; + fontFamily = font.family; + fontSize = font.size; + in { + editor = + { + inherit fontFamily fontSize; + inlayHints = {inherit fontFamily fontSize;}; + codeLens = false; + cursorStyle = "block"; + detectIndentation = true; + minimap.enabled = false; + renderWhitespace = "trailing"; + rulers = [80 120]; + smoothScrolling = false; + tabCompletion = true; + } + // (let + surround = 10; + in { + cursorSurroundingLines = surround; + scrollBeyondLastColumn = surround; + }); + + keyboard.dispatch = "keyCode"; + + diffEditor.codeLens = false; + + files = { + autoSave = "off"; + enableTrash = false; + }; + + workbench = { + activityBar.visible = false; + editor.highlightModifiedTabs = true; + enableExperiments = false; + settings.enableNaturalLanguageSearch = false; + startupEditor = "none"; + tips.enabled = false; + tree.indent = 4; + welcomePage = { + walkthroughs.openOnInstall = false; + preferReducedMotion = true; + }; + }; + + debug.console = {inherit fontFamily fontSize;}; + + scm = { + inputFontFamily = fontFamily; + inputFontSize = fontSize; + }; + + extensions = { + autoCheckUpdates = false; + autoUpdate = false; + ignoreRecommendations = true; + }; + + terminal = { + external.linuxExec = + if alacritty.enable + then "${pkgs.alacritty}/bin/alacritty" + else "${pkgs.xterm}/bin/xterm}"; + + integrated = { + inherit fontFamily fontSize; + enableBell = true; + }; + }; + + update = { + mode = "none"; + showReleaseNotes = false; + }; + + telemetry = { + enableCrashReporter = false; + enableTelemetry = false; + }; + + security.workspace.trust.enabled = false; + + git.allowForcePush = true; + + vim = let + applyInputMethod = { + "ibus" = let + bin = "${pkgs.ibus}/bin/ibus"; + in { + enable = true; + defaultIM = "xkb:us::eng"; + obtainIMCmd = "${bin} engine"; + switchIMCmd = "${bin} engine {im}"; + }; + "fcitx" = let + bin = "${pkgs.fcitx}/bin/fcitx-remote"; + in { + enable = true; + defaultIM = "1"; + obtainIMCmd = bin; + switchIMCmd = "${bin} -t {im}"; + }; + }; + in + mkIf cfg.vim.enable rec { + easymotion = true; + easymotionMarkerFontFamily = fontFamily; + easymotionMarkerFontSize = fontSize; + + leader = " "; + + useSystemClipboard = true; + + autoSwitchInputMethod = let + inputMethod = config.i18n.inputMethod.enabled; + in + mkIf (inputMethod != null) applyInputMethod.${inputMethod}; + }; + }; + }; + }; +} diff --git a/modules/nixfiles/wget.nix b/modules/nixfiles/wget.nix new file mode 100644 index 0000000..9e4db27 --- /dev/null +++ b/modules/nixfiles/wget.nix @@ -0,0 +1,36 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.wget; +in { + options.nixfiles.modules.wget.enable = + mkEnableOption "Whether to enable wget."; + + config = mkIf cfg.enable { + hm = { + home.file.".wgetrc".text = '' + adjust_extension = on + dirstruct = off + follow_ftp = on + passive_ftp = off + progress = bar + quota = inf + reclevel = 5 + recursive = off + robots = off + timestamping = off + tries = 5 + wait = 0 + waitretry = 10 + ''; + + programs.bash.shellAliases.wget = "${pkgs.wget}/bin/wget --hsts-file=${config.hm.xdg.cacheHome}/wget-hsts"; + }; + + environment.systemPackages = with pkgs; [wget]; + }; +} diff --git a/modules/nixfiles/wireguard.nix b/modules/nixfiles/wireguard.nix new file mode 100644 index 0000000..1da3e74 --- /dev/null +++ b/modules/nixfiles/wireguard.nix @@ -0,0 +1,208 @@ +{ + config, + lib, + pkgs, + this, + ... +}: +with lib; let + cfg = config.nixfiles.modules.wireguard; +in { + options.nixfiles.modules.wireguard = { + # TODO Make this simpler. + privateKeyFile = mkOption { + description = "Path to the private key file."; + type = with types; nullOr string; + default = null; + }; + + client = { + enable = mkEnableOption "Whether to enable WireGuard client."; + + enableTrafficRouting = mkOption { + description = "Whether to enable traffic routing through the sever."; + type = with types; bool; + default = !this.isHeadless; + }; + }; + + server = { + enable = mkEnableOption '' + Whether to enable WireGuard server. This module requires + <option>networking.nat.externalInterface</option> to be set. + ''; + + ipv4.address = mkOption { + description = "IPv4 address to bind to."; + type = with types; str; + default = my.configurations.manwe.wireguard.ipv4.address; + }; + + ipv6.address = mkOption { + description = "IPv4 address to bind to."; + type = with types; str; + default = my.configurations.manwe.wireguard.ipv6.address; + }; + + address = mkOption { + description = "Endpoint address to use"; + type = with types; str; + default = my.configurations.manwe.ipv4.address; + }; + + port = mkOption { + description = "Endpoint port to use."; + type = with types; int; + default = 6969; + }; + + publicKey = mkOption { + description = "Server's public key."; + type = with types; str; + default = my.configurations.manwe.wireguard.publicKey; + }; + + peers = mkOption { + description = "List of peers."; + type = with types; listOf attrs; + default = mapAttrsToList (_: attr: + with attr; { + inherit (wireguard) publicKey; + allowedIPs = with wireguard; [ + "${ipv4.address}/32" + "${ipv6.address}/128" + ]; + }) (filterAttrs (_: attr: + attr.hostname != this.hostname && hasAttr "wireguard" attr) + my.configurations); + }; + }; + + interface = mkOption { + description = "Name of the interface to use WireGuard with."; + type = with types; str; + default = "wg69"; + }; + + ipv4.subnet = mkOption { + description = "CIDR notation for the IPv4 subnet to use over WireGuard."; + type = with types; str; + default = "10.69.0.0/16"; + }; + + ipv6.subnet = mkOption { + description = "CIDR notation for the IPv6 subnet to use over WireGuard."; + type = with types; str; + default = "fd69::/16"; + }; + }; + + config = + { + assertions = [ + { + assertion = cfg.privateKeyFile != null; + message = "Key file must be specified."; + } + { + assertion = config.security.sudo.enable; + message = "Sudo is not enabled."; + } + { + assertion = any (x: x == "wheel") config.my.extraGroups; + message = ''User is not in the "wheel" group.''; + } + ]; + } + // mkMerge [ + (mkIf (cfg.client.enable || cfg.server.enable) { + networking.firewall.trustedInterfaces = [cfg.interface]; + }) + (mkIf cfg.client.enable { + networking.wg-quick.interfaces.${cfg.interface} = mkMerge [ + (with this.wireguard; { + inherit (cfg) privateKeyFile; + address = ["${ipv4.address}/16" "${ipv6.address}/16"]; + }) + (with cfg.server; { + peers = [ + { + inherit publicKey; + endpoint = "${address}:${toString port}"; + allowedIPs = + if cfg.client.enableTrafficRouting + then [ + "0.0.0.0/0" + "::/0" + ] + else [ + cfg.ipv4.subnet + cfg.ipv6.subnet + ]; + persistentKeepalive = 25; + } + ]; + dns = [ + ipv4.address + ipv6.address + ]; # This assumes that the host has Unbound running. + }) + ]; + + environment.systemPackages = with pkgs; [ + (writeShellApplication { + name = "wg-toggle"; + runtimeInputs = [iproute2 jq wireguard-tools]; + text = '' + ip46() { + sudo ip -4 "$@" + sudo ip -6 "$@" + } + + fwmark=$(sudo wg show ${cfg.interface} fwmark) || exit + if ip -j rule list lookup "$fwmark" | jq -e 'length > 0' >/dev/null; then + ip46 rule del lookup main suppress_prefixlength 0 + ip46 rule del lookup "$fwmark" + else + ip46 rule add not fwmark "$fwmark" lookup "$fwmark" + ip46 rule add lookup main suppress_prefixlength 0 + fi + ''; + }) + ]; + }) + (mkIf cfg.server.enable { + networking = { + wireguard = { + enable = true; + interfaces.${cfg.interface} = with cfg.server; { + inherit (cfg) privateKeyFile; + ips = ["${ipv4.address}/16" "${ipv6.address}/16"]; + listenPort = port; + inherit peers; + allowedIPsAsRoutes = false; + }; + }; + + nat = { + enable = true; + enableIPv6 = true; + + internalInterfaces = [cfg.interface]; + internalIPs = [cfg.ipv4.subnet]; + internalIPv6s = [cfg.ipv6.subnet]; + }; + + firewall.allowedUDPPorts = [cfg.server.port]; + }; + + # # TODO Dashboard for this. + # services.prometheus.exporters.wireguard = { + # enable = true; + # listenAddress = mkDefault this.wireguard.ipv4.address; + # withRemoteIp = true; + # port = 9586; + # }; + }) + ]; +} diff --git a/modules/nixfiles/x11.nix b/modules/nixfiles/x11.nix new file mode 100644 index 0000000..ff0feaf --- /dev/null +++ b/modules/nixfiles/x11.nix @@ -0,0 +1,110 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.x11; +in { + options.nixfiles.modules.x11.enable = mkEnableOption "Whether to enable X11."; + + config = mkIf cfg.enable { + nixfiles.modules.fonts.enable = true; + + hm = { + home = { + packages = with pkgs; + [xclip xdotool] + ++ (with xorg; [ + xdpyinfo + xdriinfo + xev + xfontsel + xkill + xlsatoms + xlsclients + xlsfonts + xprop + xrandr + xwininfo + ]); + + sessionVariables = with config.dirs; { + XCOMPOSEFILE = "${cache}/XComposeFile"; + XCOMPOSECACHE = "${cache}/XComposeCache"; + }; + }; + + xsession.scriptPath = ".xinitrc"; + + xresources.properties = with config.nixfiles.modules; let + font = with config.fontScheme.monospaceFont; "${family}:style=${style}:size=${toString size}"; + in + { + "*.font" = font; + + "Xft.antialias" = 1; + "Xft.autohint" = 0; + "Xft.dpi" = 96; + "Xft.hinting" = 1; + "Xft.hintstyle" = "hintslight"; + "Xft.lcdfilter" = "lcddefault"; + "Xft.rgba" = "rgb"; + } + // (with profiles.common.colourScheme; { + "*.color0" = black; + "*.color8" = brightBlack; + "*.color1" = red; + "*.color9" = brightRed; + "*.color2" = green; + "*.color10" = brightGreen; + "*.color3" = yellow; + "*.color11" = brightYellow; + "*.color4" = blue; + "*.color12" = brightBlue; + "*.color5" = magenta; + "*.color13" = brightMagenta; + "*.color6" = cyan; + "*.color14" = brightCyan; + "*.color7" = white; + "*.color15" = brightWhite; + + "*.background" = background; + "*.foreground" = foreground; + }); + }; + + services.xserver = { + enable = true; + + tty = mkDefault 1; + + autoRepeatDelay = 200; + autoRepeatInterval = 25; + + libinput.enable = true; + + monitorSection = '' + Option "DPMS" "false" + ''; + + serverFlagsSection = '' + Option "BlankTime" "0" + Option "OffTime" "0" + Option "StandbyTime" "0" + Option "SuspendTime" "0" + ''; + + inputClassSections = [ + '' + Identifier "Mouse" + MatchIsPointer "yes" + Option "AccelerationNumerator" "2" + Option "AccelerationDenominator" "1" + Option "AccelerationThreshold" "4" + '' + ]; + }; + }; +} diff --git a/modules/nixfiles/xmonad.nix b/modules/nixfiles/xmonad.nix new file mode 100644 index 0000000..566ec53 --- /dev/null +++ b/modules/nixfiles/xmonad.nix @@ -0,0 +1,28 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.nixfiles.modules.xmonad; +in { + options.nixfiles.modules.xmonad.enable = + mkEnableOption "Whether to enable XMonad."; + + config = mkIf cfg.enable { + nixfiles.modules.x11.enable = true; + + hm = { + xsession = { + enable = true; + + scriptPath = ".xinitrc"; + + windowManager.command = "${pkgs.xmonad-ng}/bin/xmonad-ng"; + }; + }; + + services.xserver.displayManager.startx.enable = true; + }; +} diff --git a/modules/nixfiles/zathura.nix b/modules/nixfiles/zathura.nix new file mode 100644 index 0000000..d4e11e6 --- /dev/null +++ b/modules/nixfiles/zathura.nix @@ -0,0 +1,123 @@ +{ + config, + lib, + ... +}: +with lib; let + cfg = config.nixfiles.modules.zathura; +in { + options.nixfiles.modules.zathura.enable = + mkEnableOption "Whether to enable zathura PDF reader."; + + config = mkIf cfg.enable { + hm.programs.zathura = with config.nixfiles.modules; { + enable = true; + + options = + (with profiles.common.colourScheme; { + default-fg = white; + default-bg = black; + + statusbar-fg = black; + statusbar-bg = white; + + inputbar-fg = black; + inputbar-bg = brightGreen; + + notification-fg = black; + notification-bg = brightBlue; + + notification-warning-fg = black; + notification-warning-bg = brightYellow; + + notification-error-fg = black; + notification-error-bg = brightRed; + + highlight-color = brightYellow; + highlight-active-color = yellow; + + completion-fg = brightWhite; + completion-bg = brightBlack; + + completion-highlight-fg = black; + completion-highlight-bg = brightRed; + + completion-group-fg = black; + completion-group-bg = brightRed; + + recolor-darkcolor = black; + recolor-lightcolor = white; + }) + // { + recolor = true; + recolor-keephue = false; + recolor-reverse-video = false; + + highlight-transparency = "0.3"; + + font = fonts.fontScheme.monospaceFont.family; + + n-completion-items = 10; + + guioptions = ""; + + statusbar-basename = true; + statusbar-home-tilde = true; + + statusbar-h-padding = 0; + statusbar-v-padding = 0; + + window-height = 800; + window-width = 600; + + window-icon = ""; + + abort-clear-search = true; + + incremental-search = true; + + adjust-open = "best-fit"; + + advance-pages-per-row = false; + + database = "sqlite"; + + dbus-service = false; + + page-padding = 0; + + pages-per-row = 1; + + render-loading = false; + + show-directories = true; + show-hidden = true; + show-recent = 10; + + link-zoom = true; + link-hadjust = true; + + window-title-basename = true; + window-title-home-tilde = true; + window-title-page = true; + + zoom-center = false; + zoom-max = 1000; + zoom-min = 10; + zoom-step = 10; + + scroll-hstep = -1; + scroll-step = 40; + scroll-full-overlap = 0; + scroll-wrap = true; + scroll-page-aware = false; + + selection-clipboard = + if (kde.enable || gnome.enable) + then "clipboard" + else "primary"; + selection-notification = false; + }; + }; + }; +} |