rouven.seifert/nixos-config
1
1
Fork 0
mirror of https://git.sr.ht/~rouven/nixos-config synced 2024-11-15 05:13:10 +01:00
Code Issues Packages Projects Releases Wiki Activity

Compare commits

base: rouven.seifert:a9f3c6836e81415a76e506448dae1615d5248a84
Branches Tags
rouven.seifert:main
rouven.seifert:push-vxnoqsltyuxy
..
compare: rouven.seifert:d46d0737c5456b56403231b3c153f82dbe105966
Branches Tags
rouven.seifert:main
rouven.seifert:push-vxnoqsltyuxy

No commits in common. "a9f3c6836e81415a76e506448dae1615d5248a84" and "d46d0737c5456b56403231b3c153f82dbe105966" have entirely different histories.
a9f3c6836e ... d46d0737c5

15 changed files with 275 additions and 172 deletions
Show stats Expand all files Collapse all files

30
flake.lock
View file

@ -12,11 +12,11 @@
"systems": "systems"
},
"locked": {
"lastModified": 1718371084,
"narHash": "sha256-abpBi61mg0g+lFFU0zY4C6oP6fBwPzbHPKBGw676xsA=",
"lastModified": 1716561646,
"narHash": "sha256-UIGtLO89RxKt7RF2iEgPikSdU53r6v/6WYB0RW3k89I=",
"owner": "ryantm",
"repo": "agenix",
"rev": "3a56735779db467538fb2e577eda28a9daacaca6",
"rev": "c2fc0762bbe8feb06a2e59a364fa81b3a57671c9",
"type": "github"
},
"original": {
@ -38,11 +38,11 @@
"poetry2nix": "poetry2nix"
},
"locked": {
"lastModified": 1718106692,
"narHash": "sha256-IGMrKVU2fXgn30LQduJIg89HefHLlPMgJ3mnnKpnNfU=",
"lastModified": 1715166702,
"narHash": "sha256-PJxwZoT1JWxMaKRdTLMHN55mdYlhZn2L5VpvyevKkug=",
"owner": "nix-community",
"repo": "authentik-nix",
"rev": "11f5e0fd17dd44d9946a23271d201b257df9f0f4",
"rev": "84c3ce6fe7c174ed1a53cbc5e36cf6a70f4dcc1b",
"type": "github"
},
"original": {
@ -300,11 +300,11 @@
]
},
"locked": {
"lastModified": 1718788307,
"narHash": "sha256-SqiOz0sljM0GjyQEVinPXQxaGcbOXw5OgpCWGPgh/vo=",
"lastModified": 1717931644,
"narHash": "sha256-Sz8Wh9cAiD5FhL8UWvZxBfnvxETSCVZlqWSYWaCPyu0=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "d7830d05421d0ced83a0f007900898bdcaf2a2ca",
"rev": "3d65009effd77cb0d6e7520b68b039836a7606cf",
"type": "github"
},
"original": {
@ -448,11 +448,11 @@
]
},
"locked": {
"lastModified": 1718507237,
"narHash": "sha256-xBEWCxWeRpWQggFFp8ugJCDa63cOJsVvx71R9F0Eowg=",
"lastModified": 1717995391,
"narHash": "sha256-lcJ7McLYCOZGmoUqWubg739iFIqVtPD+qDNQx6GPWCY=",
"owner": "nix-community",
"repo": "nix-index-database",
"rev": "6af2c5e58c20311276f59d247341cafeebfcb6f4",
"rev": "ab78ec24f803bab7a18370220ae3db92d6d33c94",
"type": "github"
},
"original": {
@ -463,11 +463,11 @@
},
"nixpkgs": {
"locked": {
"lastModified": 1718895438,
"narHash": "sha256-k3JqJrkdoYwE3fHE6xGDY676AYmyh4U2Zw+0Bwe5DLU=",
"lastModified": 1717786204,
"narHash": "sha256-4q0s6m0GUcN7q+Y2DqD27iLvbcd1G50T2lv08kKxkSI=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "d603719ec6e294f034936c0d0dc06f689d91b6c3",
"rev": "051f920625ab5aabe37c920346e3e69d7d34400e",
"type": "github"
},
"original": {

68
hosts/falkenstein/modules/mail/rspamd.nix
View file

@ -31,74 +31,6 @@
allow_username_mismatch = true;
path = /var/lib/rspamd/dkim/$domain.key;
'';
"reputation.conf".text = ''
rules {
ip_reputation = {
selector "ip" {
}
backend "redis" {
servers = "/run/redis-rspamd/redis.sock";
}
symbol = "IP_REPUTATION";
}
spf_reputation = {
selector "spf" {
}
backend "redis" {
servers = "/run/redis-rspamd/redis.sock";
}
symbol = "SPF_REPUTATION";
}
dkim_reputation = {
selector "dkim" {
}
backend "redis" {
servers = "/run/redis-rspamd/redis.sock";
}
symbol = "DKIM_REPUTATION"; # Also adjusts scores for DKIM_ALLOW, DKIM_REJECT
}
generic_reputation = {
selector "generic" {
selector = "ip"; # see https://rspamd.com/doc/configuration/selectors.html
}
backend "redis" {
servers = "/run/redis-rspamd/redis.sock";
}
symbol = "GENERIC_REPUTATION";
}
}
'';
"groups.conf".text = ''
group "reputation" {
symbols = {
"IP_REPUTATION_HAM" {
weight = 1.0;
}
"IP_REPUTATION_SPAM" {
weight = 4.0;
}
"DKIM_REPUTATION" {
weight = 1.0;
}
"SPF_REPUTATION_HAM" {
weight = 1.0;
}
"SPF_REPUTATION_SPAM" {
weight = 2.0;
}
"GENERIC_REPUTATION" {
weight = 1.0;
}
}
}
'';
};
};
redis = {

1
hosts/fujitsu/default.nix
View file

@ -4,7 +4,6 @@
./hardware-configuration.nix
./modules/networks
./modules/monitoring
./modules/nfs
];
boot.loader.grub.enable = true;

19
hosts/fujitsu/modules/nfs/default.nix
View file

@ -1,19 +0,0 @@
{ ... }:
{
fileSystems."/export" = {
device = "/dev/sda2";
fsType = "btrfs";
options = [ "subvol=export" "compress=zstd" "noatime" ];
};
services.nfs.server = {
enable = true;
exports = ''
/export 192.168.42.2(rw,fsid=0,no_subtree_check)
/export/movies 192.168.42.2(rw,fsid=0,no_subtree_check)
/export/shows 192.168.42.2(rw,fsid=0,no_subtree_check)
'';
};
networking.firewall.allowedTCPPorts = [ 2049 ];
}

8
hosts/nuc/modules/authentik/default.nix
View file

@ -12,15 +12,7 @@ in
services.authentik = {
enable = true;
environmentFile = config.age.secrets.authentik-core.path;
settings = {
cert_discovery_dir = "env://CREDENTIALS_DIRECTORY";
};
};
systemd.services.authentik-worker.serviceConfig.LoadCredential = [
"${domain}.pem:/var/lib/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${domain}/${domain}.crt"
"${domain}.key:/var/lib/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${domain}/${domain}.key"
];
services.authentik-ldap = {
enable = true;
environmentFile = config.age.secrets.authentik-ldap.path;

3
hosts/nuc/modules/matrix/default.nix
View file

@ -72,9 +72,6 @@ in
reverse_proxy /client/* unix//run/matrix-sliding-sync/server.sock
reverse_proxy /_matrix/client/unstable/org.matrix.msc3575/sync* unix//run/matrix-sliding-sync/server.sock
reverse_proxy 127.0.0.1:8008
handle /_synapse/metrics* {
respond 404
}
'';
# element

8
hosts/nuc/modules/networks/default.nix
View file

@ -1,13 +1,5 @@
{ ... }:
{
fileSystems."/media/movies" = {
device = "fujitsu.vpn.rfive.de:/movies";
fsType = "nfs";
};
fileSystems."/media/shows" = {
device = "fujitsu.vpn.rfive.de:/movies";
fsType = "nfs";
};
networking = {
hostName = "nuc";
domain = "rfive.de";

24
hosts/thinkpad/modules/security/default.nix
View file

@ -20,30 +20,6 @@
sudo.u2fAuth = true;
};
};
krb5 = {
enable = true;
settings = {
libdefaults = {
default_realm = "AGDSN.DE";
dns_lookup_realm = false;
dns_lookup_kdc = true;
ticket_lifetime = "24h";
forwardable = "yes";
};
realms."AGDSN.DE" = {
kdc = "idm.agdsn.network:88";
master_kdc = "idm.agdsn.network:88";
admin_server = "idm.agdsn.network:749";
default_domain = "agdsn.de";
};
domain_realm = {
"agdsn.de" = "AGDSN.DE";
".agdsn.de" = "AGDSN.DE";
"agdsn" = "AGDSN.DE";
".agdsn" = "AGDSN.DE";
};
};
};
};
services = {
fprintd.enable = true; # log in using fingerprint

10
hosts/thinkpad/modules/virtualisation/default.nix
View file

@ -1,9 +1,14 @@
{ pkgs, ... }:
{
virtualisation = {
podman = {
docker = {
rootless = {
enable = true;
defaultNetwork.settings.dns_enabled = true;
setSocketVariable = true;
daemon.settings = {
iptables = false;
};
};
};
libvirtd = {
enable = true;
@ -22,6 +27,5 @@
programs.virt-manager.enable = true;
environment.systemPackages = with pkgs; [
virt-viewer
podman-compose
];
}

2
users/rouven/default.nix
View file

@ -21,7 +21,7 @@
home-manager.useGlobalPkgs = true;
home-manager.users.rouven = { ... }: {
imports = [ ./modules ];
imports = [ ./modules ./options ];
config = {
home.username = "rouven";

2
users/rouven/modules/default.nix
View file

@ -10,7 +10,7 @@
./mpv
./ssh
./theme
# ./tex
./tex
./packages.nix
];
}

7
users/rouven/modules/ssh/default.nix
View file

@ -1,11 +1,10 @@
{ pkgs, ... }:
{ ... }:
let
git = "~/.ssh/git";
in
{
programs.ssh = {
enable = true;
package = pkgs.openssh_gssapi;
compression = true;
controlMaster = "auto";
controlPersist = "10m";
@ -68,15 +67,13 @@ in
user = "r5";
extraOptions = {
VerifyHostKeyDNS = "yes";
GSSAPIAuthentication = "yes";
};
};
"*.agdsn.network" = {
user = "r5";
extraOptions = {
# ProxyJump = "dijkstra";
ProxyJump = "dijkstra";
VerifyHostKeyDNS = "yes";
GSSAPIAuthentication = "yes";
};
};
"git@git.agdsn.de" = {

183
users/rouven/modules/wayland/shikane.nix
View file

@ -1,19 +1,172 @@
{ pkgs, ... }:
{
home.packages = [
pkgs.shikane
];
systemd.user.services.shikane = {
Unit = {
Description = "Dynamic output configuration tool";
Documentation = "man:shikane(1)";
After = [ "graphical-session-pre.target" ];
PartOf = [ "graphical-session.target" ];
services.shikane = {
enable = true;
settings = {
profile = [
{
name = "home";
output = [
{
match = "eDP-1";
enable = true;
position = {
x = 1920;
y = 0;
};
}
{
match = "DP-2";
enable = true;
position = {
x = 0;
y = 0;
};
}
{
match = "HDMI-A-1";
enable = true;
position = {
x = 3840;
y = 0;
};
}
];
}
{
name = "home-vertical";
output = [
{
match = "eDP-1";
enable = true;
position = {
x = 1080;
y = 0;
};
}
{
match = "DP-3";
enable = true;
position = {
x = 0;
y = 0;
};
transform = "270";
}
{
match = "HDMI-A-1";
enable = true;
position = {
x = 3000;
y = 0;
};
}
];
}
{
name = "external-monitor-default";
output = [
{
match = "eDP-1";
enable = true;
position = {
x = 0;
y = 0;
};
}
{
match = "HDMI-A-1";
enable = true;
position = {
x = 1920;
y = 0;
};
}
];
}
{
name = "external-monitor-usb-c";
output = [
{
match = "eDP-1";
enable = true;
position = {
x = 0;
y = 1440;
};
}
{
match = "/P24h/";
enable = true;
mode = {
height = 1440;
width = 2560;
refresh = 60;
};
position = {
x = 0;
y = 0;
};
}
];
}
{
name = "external-monitor-usb-c";
output = [
{
match = "eDP-1";
enable = true;
position = {
x = 1920;
y = 0;
};
}
{
match = "DP-2";
enable = true;
position = {
x = 0;
y = 0;
};
}
];
}
# vertical mode if on dp-3
{
name = "external-monitor-usb-c-vertical";
output = [
{
match = "eDP-1";
enable = true;
position = {
x = 1080;
y = 840;
};
}
{
match = "DP-3";
enable = true;
position = {
x = 0;
y = 0;
};
transform = "270";
}
];
}
{
name = "builtin";
output = [
{
match = "eDP-1";
enable = true;
position = {
x = 0;
y = 0;
};
}
];
}
];
};
Service = { ExecStart = "${pkgs.shikane}/bin/shikane"; };
Install = { WantedBy = [ "graphical-session.target" ]; };
};
}

3
users/rouven/options/default.nix Normal file
View file

@ -0,0 +1,3 @@
{
imports = [ ./shikane.nix ];
}

77
users/rouven/options/shikane.nix Normal file
View file

@ -0,0 +1,77 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.shikane;
tomlFormat = pkgs.formats.toml { };
in
{
meta.maintainers = [ maintainers.therealr5 ];
options.services.shikane = {
enable = mkEnableOption
"shikane, A dynamic output configuration tool that automatically detects and configures connected outputs based on a set of profiles.";
package = mkPackageOption pkgs "shikane" { };
settings = mkOption {
type = tomlFormat.type;
default = { };
example = literalExpression ''
{
profile = [
{
name = "external-monitor-default";
output = [
{
match = "eDP-1";
enable = true;
}
{
match = "HDMI-A-1";
enable = true;
position = {
x = 1920;
y = 0;
};
}
];
}
{
name = "builtin-monitor-only";
output = [
{
match = "eDP-1";
enable = true;
}
];
}
];
}
'';
description = ''
Configuration written to
<filename>$XDG_CONFIG_HOME/shikane/config.toml</filename>.
</para><para>
See <link xlink:href="https://gitlab.com/w0lff/shikane/-/blob/master/docs/shikane.5.man.md" />
for more information.
'';
};
};
config = mkIf cfg.enable {
systemd.user.services.shikane = {
Unit = {
Description = "Dynamic output configuration tool";
Documentation = "man:shikane(1)";
After = [ "graphical-session-pre.target" ];
PartOf = [ "graphical-session.target" ];
};
Service = { ExecStart = "${cfg.package}/bin/shikane -c ${tomlFormat.generate "shikane-config.toml" cfg.settings}"; };
Install = { WantedBy = [ "graphical-session.target" ]; };
};
};
}