ktiu/omniflake
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge remote-tracking branch 'refs/remotes/origin/main'

Browse source
This commit is contained in:
Till 2025-10-13 16:28:48 +02:00
commit 7f358ab0c5
29 changed files with 337 additions and 192 deletions
Download patch file Download diff file Expand all files Collapse all files

5
system/cosmic.nix Normal file
View file

@ -0,0 +1,5 @@
{ config, pkgs, ... }:
{
services.desktopManager.cosmic.enable = true;
}

6
system/desktop.nix
View file

@ -29,7 +29,7 @@
];
};
hardware.pulseaudio.enable = false;
services.pulseaudio.enable = false;
services.pipewire = {
enable = true;
@ -70,8 +70,8 @@
dbus.enable = true;
flatpak.enable = true;
fwupd.enable = true;
mullvad-vpn.enable = true;
mullvad-vpn.package = pkgs.mullvad-vpn;
# mullvad-vpn.enable = true;
# mullvad-vpn.package = pkgs.mullvad-vpn;
printing.enable = true;
};

9
system/ergodox.nix Normal file
View file

@ -0,0 +1,9 @@
{ config, pkgs, ... }:
{
services.udev = {
extraRules = ''
KERNEL=="hidraw*", SUBSYSTEM=="hidraw", MODE="0660", GROUP="wheel"
'';
};
}

3
system/guest.nix
View file

@ -10,5 +10,8 @@
"networkmanager"
];
shell = pkgs.fish;
openssh.authorizedKeys.keyFiles = [
./ssh/till${"@"}nova.pub
];
};
}

67
system/hardware/homer.nix Normal file
View file

@ -0,0 +1,67 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/hardware/network/broadcom-43xx.nix")
(modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
boot.extraModprobeConfig = ''
options snd_hda_intel power_save=0
'';
fileSystems."/" =
{ device = "/dev/disk/by-uuid/809e9e9e-ff44-4ecb-8754-e3f2000e5788";
fsType = "btrfs";
options = [ "subvol=root" ];
};
boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-uuid/68a19b7d-358a-419c-9507-1e103526f44a";
fileSystems."/home" =
{ device = "/dev/disk/by-uuid/809e9e9e-ff44-4ecb-8754-e3f2000e5788";
fsType = "btrfs";
options = [ "subvol=home" ];
};
fileSystems."/nix" =
{ device = "/dev/disk/by-uuid/809e9e9e-ff44-4ecb-8754-e3f2000e5788";
fsType = "btrfs";
options = [ "subvol=nix" ];
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/553D-668A";
fsType = "vfat";
options = [ "fmask=0022" "dmask=0022" ];
};
fileSystems."/var/mediathek" = {
device = "/dev/disk/by-uuid/7b0b589f-5759-411a-975a-08a3c7a0f953";
fsType = "ext4";
options = [ # If you don't have this options attribute, it'll default to "defaults"
# boot options for fstab. Search up fstab mount options you can use
"users" # Allows any user to mount and unmount
"nofail" # Prevent system from failing if this drive doesn't mount
];
};
swapDevices = [ ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.wlp3s0.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}

21
system/media.nix Normal file
View file

@ -0,0 +1,21 @@
{ config, pkgs, ... }:
{
services.sonarr = {
enable = true;
group = "media";
};
services.radarr = {
enable = true;
group = "media";
};
services.flaresolverr.enable = true;
services.prowlarr.enable = true;
services.bazarr.enable = true;
users.groups.media = {};
users.users.guest.extraGroups = [ "media" "wheel" ];
users.users.sonarr.extraGroups = [ "media" ];
}

54
system/web-server/dex.nix Normal file
View file

@ -0,0 +1,54 @@
{ config, pkgs, ... }:
let
dex = {
hostname = "dex.${config.networking.domain}";
};
in {
services.dex = {
enable = true;
environmentFile = "/var/custom-access/dex-environemnt";
settings = {
issuer = "https://${dex.hostname}";
storage.type = "sqlite3";
web.http = "127.0.0.1:5556";
staticClients = [
{
id = "outline";
name = "Outline Client";
redirectURIs = [ "https://${outline.hostname}/auth/oidc.callback" ];
secretFile = "/var/custom-access/outline-oidc-secret.txt";
}
];
enablePasswordDB = true;
# staticPasswords = [
# {
# email = "till@ktiu.net";
# # gen hash with $ htpasswd -nBC 10 "" | tr -d ':\n'
# hash = "";
# username = "bootstrap-admin";
# # $ uuidgen
# userID = "";
# }
# ];
};
};
security.acme.certs."${config.networking.domain}".extraDomainNames = [
"dex.${config.networking.domain}"
];
services.nginx.virtualHosts = {
"dex.${config.networking.domain}" = {
onlySSL = true;
useACMEHost = config.networking.domain;
locations."/" = {
proxyPass = "http://${config.services.dex.settings.web.http}";
proxyWebsockets = true;
};
};
};
}

2
system/web-server/ksh-map.nix
View file

@ -1,7 +1,7 @@
{ config, pkgs, ... }:
{
services.nginx.virtualHosts."karte.nichtzudritt.de" = {
services.nginx.virtualHosts."kshmap.ktiu.net" = {
forceSSL = true;
enableACME = true;
root = "/var/www/ksh-map/dist";

14
system/web-server/mail/postfix.nix
View file

@ -2,13 +2,13 @@
let
submissionHeaderCleanupRules = pkgs.writeText "submission_header_cleanup_rules" ''
/^Received:/ IGNORE
/^X-Originating-IP:/ IGNORE
/^X-Mailer:/ IGNORE
/^User-Agent:/ IGNORE
/^X-Enigmail:/ IGNORE
/^Message-ID:\s+<(.*?)@.*?>/ REPLACE Message-ID: <$1@ktiu.net>
submissionheadercleanuprules = pkgs.writetext "submission_header_cleanup_rules" ''
/^received:/ ignore
/^x-originating-ip:/ ignore
/^x-mailer:/ ignore
/^user-agent:/ ignore
/^x-enigmail:/ ignore
/^message-id:\s+<(.*?)@.*?>/ replace message-id: <$1@ktiu.net>
'';
in {

43
system/web-server/outline.nix
View file

@ -7,11 +7,6 @@ let
mail = "outline@${config.networking.domain}";
};
# bootstrapping only
# dex = {
# hostname = "dex.${config.networking.domain}";
# };
in {
services.outline = {
@ -42,38 +37,8 @@ in {
# };
};
# services.dex = {
# enable = true;
# environmentFile = "/var/custom-access/dex-environemnt";
# settings = {
# issuer = "https://${dex.hostname}";
# storage.type = "sqlite3";
# web.http = "127.0.0.1:5556";
# staticClients = [
# {
# id = "outline";
# name = "Outline Client";
# redirectURIs = [ "https://${outline.hostname}/auth/oidc.callback" ];
# secretFile = "/var/custom-access/outline-oidc-secret.txt";
# }
# ];
# enablePasswordDB = true;
# staticPasswords = [
# {
# email = "till@ktiu.net";
# # gen hash with $ htpasswd -nBC 10 "" | tr -d ':\n'
# hash = "";
# username = "bootstrap-admin";
# # $ uuidgen
# userID = "";
# }
# ];
# };
# };
security.acme.certs."${config.networking.domain}".extraDomainNames = [
"outline.${config.networking.domain}"
# "dex.${config.networking.domain}"
];
services.nginx.virtualHosts = {
@ -89,13 +54,5 @@ in {
};
};
# "dex.${config.networking.domain}" = {
# onlySSL = true;
# useACMEHost = config.networking.domain;
# locations."/" = {
# proxyPass = "http://${config.services.dex.settings.web.http}";
# proxyWebsockets = true;
# };
# };
};
}

16
system/yubikey.nix
View file

@ -3,14 +3,14 @@
{
services.udev = {
packages = [ pkgs.yubikey-personalization ];
extraRules = ''
ACTION=="remove",\
ENV{ID_BUS}=="usb",\
ENV{ID_MODEL_ID}=="0407",\
ENV{ID_VENDOR_ID}=="1050",\
ENV{ID_VENDOR}=="Yubico",\
RUN+="${pkgs.systemd}/bin/loginctl lock-sessions"
'';
# extraRules = ''
# ACTION=="remove",\
# ENV{ID_BUS}=="usb",\
# ENV{ID_MODEL_ID}=="0407",\
# ENV{ID_VENDOR_ID}=="1050",\
# ENV{ID_VENDOR}=="Yubico",\
# RUN+="${pkgs.systemd}/bin/loginctl lock-sessions"
# '';
};
security.pam.services = {
login.u2fAuth = true;