From 8dd4dce913b60163afb0b4a9bdecc79c0c7ef873 Mon Sep 17 00:00:00 2001
From: Azat Bahawi <azat@bahawi.net>
Date: Sun, 21 Jan 2024 15:11:34 +0300
Subject: 2024-01-21

---
 modules/nixos/k3s.nix     |  2 +-
 modules/nixos/lxc.nix     |  7 +++----
 modules/nixos/unbound.nix | 25 +------------------------
 3 files changed, 5 insertions(+), 29 deletions(-)

(limited to 'modules/nixos')

diff --git a/modules/nixos/k3s.nix b/modules/nixos/k3s.nix
index dcbd052..016eb50 100644
--- a/modules/nixos/k3s.nix
+++ b/modules/nixos/k3s.nix
@@ -23,7 +23,7 @@ in {
 
     systemd.services.k3s.environment = {
       K3S_KUBECONFIG_OUTPUT = "/etc/rancher/k3s/k3s.yaml";
-      K3S_KUBECONFIG_MODE = "600";
+      K3S_KUBECONFIG_MODE = "664";
     };
   };
 }
diff --git a/modules/nixos/lxc.nix b/modules/nixos/lxc.nix
index 4f7805f..bfdab8f 100644
--- a/modules/nixos/lxc.nix
+++ b/modules/nixos/lxc.nix
@@ -6,11 +6,10 @@
 with lib; let
   cfg = config.nixfiles.modules.lxc;
 in {
-  options.nixfiles.modules.lxc.enable =
-    mkEnableOption "LXC/LXD";
+  options.nixfiles.modules.lxc.enable = mkEnableOption "LXC/Incus";
 
   config = mkIf cfg.enable {
-    virtualisation.lxd.enable = true;
-    my.extraGroups = "lxd";
+    virtualisation.incus.enable = true;
+    my.extraGroups = ["incus-admin"];
   };
 }
diff --git a/modules/nixos/unbound.nix b/modules/nixos/unbound.nix
index 8dce3f5..e6cad81 100644
--- a/modules/nixos/unbound.nix
+++ b/modules/nixos/unbound.nix
@@ -24,30 +24,7 @@ in {
     mkIf cfg.enable {
       ark.directories = [config.services.unbound.stateDir];
 
-      nixfiles.modules = {
-        redis.enable = true;
-
-        promtail.filters = [
-          {
-            match = {
-              selector = ''{syslog_identifier="unbound"} |~ " start | stopped |.*in-addr.arpa."'';
-              action = "drop";
-            };
-          }
-          {
-            match = {
-              selector = ''{syslog_identifier="unbound"} |= "reply:"'';
-              stages = [{static_labels.dns = "reply";}];
-            };
-          }
-          {
-            match = {
-              selector = ''{syslog_identifier="unbound"} |~ "redirect |always_null|always_nxdomain"'';
-              stages = [{static_labels.dns = "block";}];
-            };
-          }
-        ];
-      };
+      nixfiles.modules.redis.enable = true;
 
       services = {
         unbound = {
-- 
cgit 1.4.1